cli-jaw 2.17.44 → 2.17.45

package/dist/src/slack/slack-file.js

@@ -5,9 +5,9 @@
 //      no Authorization header, no ok:false envelope)
 //   3. files.completeUploadExternal -> attaches file to a conversation
 // Source: docs.slack.dev/changelog/2024-04-a-better-way-to-upload-files-is-here-to-stay
-import { readFile, stat } from 'node:fs/promises';
+import { open, stat } from 'node:fs/promises';
 import { basename } from 'node:path';
-import { slackApi, describeSlackError, redactSlackTokens, slackFailure } from './api.js';
+import { slackApi, describeSlackError, redactSlackTokens } from './api.js';
 import { redactOutboundText } from '../messaging/redact.js';
 // Slack's per-file ceiling is 1 GB, but a chat transport has no business
 // streaming that. 50 MiB matches the inbound attachment cap the Discord
@@ -20,75 +20,127 @@ export function validateSlackFileSize(size) {
 }
 export async function sendSlackFile(token, target, filePath, options = {}) {
     const doFetch = options.fetchImpl || fetch;
-    const signalOpt = options.signal ? { signal: options.signal } : {};
-    // An already-aborted send must reach zero network calls. Handing the signal to
-    // slackApi is not enough: it only helps once the request is in flight, and the
-    // FIRST call here reserves an upload slot on Slack's side. A reservation nobody
-    // completes is state we left behind, one per shutdown. sendSlackText has had
-    // this guard since #417; the file path never got one (#464).
-    if (options.signal?.aborted) {
-        return slackFailure('slack_send_aborted', 499);
-    }
+    const deadline = AbortSignal.timeout(120_000);
+    const signal = options.signal ? AbortSignal.any([options.signal, deadline]) : deadline;
+    let stage = 'validation';
+    let fileId;
+    const receipt = (state) => ({
+        stage, state, channelId: target.targetId,
+        ...(target.threadId ? { threadTs: target.threadId } : {}),
+        ...(fileId ? { fileId } : {}), verification: 'not_checked',
+    });
+    const failure = (error, status = 502, state = 'failed') => ({
+        ok: false, sent: stage === 'completion' && state === 'unknown' ? 'unknown' : false,
+        retryable: false, error: redactSlackTokens(error), status, upload: receipt(state),
+    });
+    if (signal.aborted)
+        return failure('slack_send_aborted', 499);
     let fileStat;
     try {
         fileStat = await stat(filePath);
     }
     catch {
-        return { ok: false, error: `File not found: ${filePath}`, status: 400 };
+        return failure('File not found', 400);
+    }
+    if (!fileStat.isFile())
+        return failure('slack_file_not_regular', 400);
+    try {
+        validateSlackFileSize(fileStat.size);
     }
-    validateSlackFileSize(fileStat.size);
-    if (fileStat.size === 0) {
-        // Slack rejects a zero-length reservation with `missing_argument`,
-        // which reads as a client bug. Fail locally with something actionable.
-        return slackFailure('Cannot upload an empty file to Slack', 400);
+    catch {
+        return failure('File exceeds Slack transport limit (max 50 MiB)', 413);
     }
-    const filename = basename(filePath);
-    // The filename is attacker-or-agent-chosen text that lands in the channel as
-    // the file's title and upload name. The caption beside it was masked and
-    // this was not, so a credential-shaped basename went out verbatim (#408).
-    const safeFilename = redactOutboundText(filename);
-    // Step 1 — reserve an upload URL (POST, form-encoded per Slack docs).
-    const reserve = await slackApi(token, 'files.getUploadURLExternal', { filename: safeFilename, length: fileStat.size }, { fetchImpl: doFetch, form: true, ...signalOpt });
+    if (fileStat.size === 0)
+        return failure('Cannot upload an empty file to Slack', 400);
+    const safeFilename = redactOutboundText(basename(filePath));
+    stage = 'reservation';
+    if (signal.aborted)
+        return failure('slack_send_aborted', 499);
+    const reserve = await slackApi(token, 'files.getUploadURLExternal', { filename: safeFilename, length: fileStat.size }, { fetchImpl: doFetch, form: true, signal, maxResponseBytes: 1024 * 1024 });
     const uploadUrl = reserve.data?.upload_url;
-    const fileId = reserve.data?.file_id;
-    if (!reserve.ok || !uploadUrl || !fileId) {
-        return slackFailure(describeSlackError(reserve.error || 'upload_url_missing', reserve.data), reserve.status, undefined, reserve.grantedScopes);
+    const reservedId = reserve.data?.file_id;
+    if (!reserve.ok || !reserve.status || reserve.status < 200 || reserve.status >= 300) {
+        return { ...failure(describeSlackError(reserve.error || 'upload_url_missing', reserve.data), reserve.status),
+            ...(reserve.grantedScopes !== undefined ? { grantedScopes: reserve.grantedScopes } : {}),
+            ...(reserve.retryAfterMs !== undefined ? { retryAfterMs: reserve.retryAfterMs } : {}) };
+    }
+    if (typeof reservedId !== 'string' || !/^F[A-Z0-9]{1,100}$/.test(reservedId)
+        || typeof uploadUrl !== 'string')
+        return failure('slack_upload_reservation_invalid');
+    try {
+        const url = new URL(uploadUrl);
+        if (url.protocol !== 'https:' || url.username || url.password)
+            return failure('slack_upload_url_invalid');
     }
-    // Step 2 — POST the bytes to the returned URL.
+    catch {
+        return failure('slack_upload_url_invalid');
+    }
+    fileId = reservedId;
+    stage = 'upload';
     try {
-        const buffer = await readFile(filePath);
+        if (signal.aborted)
+            return failure('slack_send_aborted', 499);
+        const handle = await open(filePath, 'r');
+        let buffer;
+        try {
+            const current = await handle.stat();
+            if (!current.isFile() || current.size !== fileStat.size)
+                return failure('slack_file_changed', 409);
+            buffer = Buffer.alloc(fileStat.size + 1);
+            let offset = 0;
+            while (offset < buffer.length) {
+                if (signal.aborted)
+                    return failure('slack_send_aborted', 499);
+                const read = await handle.read(buffer, offset, buffer.length - offset, offset);
+                if (!read.bytesRead)
+                    break;
+                offset += read.bytesRead;
+            }
+            if (offset !== fileStat.size)
+                return failure('slack_file_changed', 409);
+            buffer = buffer.subarray(0, offset);
+        }
+        finally {
+            await handle.close();
+        }
+        if (signal.aborted)
+            return failure('slack_send_aborted', 499);
         const form = new FormData();
         form.append('file', new Blob([new Uint8Array(buffer)]), safeFilename);
-        // The raw presigned-URL POST is the long pole of the three steps (#417):
-        // it carries the file bytes, so it is the one a shutdown most needs to
-        // be able to abort.
-        const upload = await doFetch(uploadUrl, { method: 'POST', body: form, ...signalOpt });
-        if (!upload.ok) {
-            return { ok: false, error: `Slack upload failed (${upload.status})`, status: upload.status };
-        }
+        const upload = await doFetch(uploadUrl, { method: 'POST', body: form, signal });
+        if (!upload.ok)
+            return failure(`Slack upload failed (${upload.status})`, upload.status);
     }
     catch (error) {
-        // Abort during the byte upload is a cancellation, not a vendor failure (#417).
-        if (options.signal?.aborted || error?.name === 'AbortError') {
-            return slackFailure('slack_send_aborted', 499);
-        }
-        // The presigned upload URL is a temporary capability: a thrown fetch
-        // error routinely embeds it, and this string reaches both API responses
-        // and the image-relay log.
-        return slackFailure(redactSlackTokens(error.message), 502);
+        return signal.aborted || error?.name === 'AbortError'
+            ? failure('slack_send_aborted', 499) : failure('slack_file_upload_failed');
     }
-    // Step 3 — attach it to the conversation (thread-aware).
+    stage = 'completion';
+    if (signal.aborted)
+        return failure('slack_send_aborted', 499);
     const complete = await slackApi(token, 'files.completeUploadExternal', {
-        files: [{ id: fileId, title: safeFilename }],
-        channel_id: target.targetId,
+        files: [{ id: fileId, title: safeFilename }], channel_id: target.targetId,
         ...(target.threadId ? { thread_ts: target.threadId } : {}),
         ...(options.caption?.trim() ? { initial_comment: redactOutboundText(options.caption.trim()) } : {}),
-    }, { fetchImpl: doFetch, ...signalOpt });
-    if (!complete.ok) {
-        // File uploads are where a missing files:write scope actually bites,
-        // so pass the payload through for the needed-scope detail.
-        return slackFailure(describeSlackError(complete.error, complete.data), complete.status, undefined, complete.grantedScopes);
+    }, { fetchImpl: doFetch, signal, maxResponseBytes: 1024 * 1024 });
+    const httpOk = complete.status !== undefined && complete.status >= 200 && complete.status < 300;
+    if (!complete.ok || !httpOk) {
+        const knownRefusal = httpOk && complete.data?.['ok'] === false && typeof complete.data?.['error'] === 'string';
+        return { ...failure(describeSlackError(complete.error, complete.data), complete.status, knownRefusal ? 'failed' : 'unknown'),
+            ...(complete.grantedScopes !== undefined ? { grantedScopes: complete.grantedScopes } : {}),
+            ...(complete.retryAfterMs !== undefined ? { retryAfterMs: complete.retryAfterMs } : {}) };
     }
-    return { ok: true };
+    const files = complete.data?.['files'];
+    // A completion reply without a files[] echo proves nothing about the file
+    // reaching the channel: an intermediary that answers {"ok":true} would be
+    // reported as a delivered upload. Confirmation requires the reserved id back.
+    if (!Array.isArray(files) || !files.length
+        || !files.every(row => row && typeof row === 'object' && typeof row.id === 'string' && /^F[A-Z0-9]{1,100}$/.test(row.id))
+        || !files.some(row => row.id === fileId))
+        return failure('slack_file_completion_unconfirmed', 502, 'unknown');
+    const upload = { ...receipt('completed'), stage: 'completion', state: 'completed', fileId: reservedId };
+    if (signal.aborted)
+        return { ok: false, sent: true, retryable: false, upload, error: 'slack_send_aborted', status: 499 };
+    return { ok: true, sent: true, retryable: false, upload };
 }
 //# sourceMappingURL=slack-file.js.map

package/dist/src/slack/slack-file.js.map

@@ -1 +1 @@
-{"version":3,"file":"slack-file.js","sourceRoot":"","sources":["../../../src/slack/slack-file.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,gEAAgE;AAChE,8DAA8D;AAC9D,wEAAwE;AACxE,sDAAsD;AACtD,uEAAuE;AACvE,wFAAwF;AAExF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,YAAY,EAAmB,MAAM,UAAU,CAAC;AAC1G,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D,yEAAyE;AACzE,wEAAwE;AACxE,8BAA8B;AAC9B,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAC9C,IAAI,IAAI,GAAG,gBAAgB,EAAE,CAAC;QAC1B,MAAM,MAAM,CAAC,MAAM,CACf,IAAI,KAAK,CAAC,uCAAuC,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,EACpG,EAAE,UAAU,EAAE,GAAG,EAAE,CACtB,CAAC;IACN,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAC/B,KAAa,EACb,MAAoB,EACpB,QAAgB,EAChB,UAA8E,EAAE;IAEhF,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,+EAA+E;IAC/E,+EAA+E;IAC/E,gFAAgF;IAChF,6EAA6E;IAC7E,6DAA6D;IAC7D,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QAC1B,OAAO,YAAY,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACD,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAC5E,CAAC;IACD,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,mEAAmE;QACnE,uEAAuE;QACvE,OAAO,YAAY,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpC,6EAA6E;IAC7E,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,YAAY,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAElD,sEAAsE;IACtE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAC1B,KAAK,EACL,4BAA4B,EAC5B,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,EACjD,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,SAAS,EAAE,CACnD,CAAC;IACF,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;IACrC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;QACvC,OAAO,YAAY,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,IAAI,oBAAoB,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACnJ,CAAC;IAED,+CAA+C;IAC/C,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,oBAAoB;QACpB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,MAAM,CAAC,MAAM,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACjG,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,+EAA+E;QAC/E,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,IAAK,KAAe,EAAE,IAAI,KAAK,YAAY,EAAE,CAAC;YACrE,OAAO,YAAY,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QACD,qEAAqE;QACrE,wEAAwE;QACxE,2BAA2B;QAC3B,OAAO,YAAY,CAAC,iBAAiB,CAAE,KAAe,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1E,CAAC;IAED,yDAAyD;IACzD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAC3B,KAAK,EACL,8BAA8B,EAC9B;QACI,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QAC5C,UAAU,EAAE,MAAM,CAAC,QAAQ;QAC3B,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtG,EACD,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,CACvC,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACf,qEAAqE;QACrE,2DAA2D;QAC3D,OAAO,YAAY,CAAC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC/H,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC"}
+{"version":3,"file":"slack-file.js","sourceRoot":"","sources":["../../../src/slack/slack-file.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,gEAAgE;AAChE,8DAA8D;AAC9D,wEAAwE;AACxE,sDAAsD;AACtD,uEAAuE;AACvE,wFAAwF;AAExF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,iBAAiB,EAAmB,MAAM,UAAU,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D,yEAAyE;AACzE,wEAAwE;AACxE,8BAA8B;AAC9B,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEjD,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAC9C,IAAI,IAAI,GAAG,gBAAgB,EAAE,CAAC;QAC1B,MAAM,MAAM,CAAC,MAAM,CACf,IAAI,KAAK,CAAC,uCAAuC,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,EACpG,EAAE,UAAU,EAAE,GAAG,EAAE,CACtB,CAAC;IACN,CAAC;AACL,CAAC;AAuBD,MAAM,CAAC,KAAK,UAAU,aAAa,CAC/B,KAAa,EAAE,MAAoB,EAAE,QAAgB,EACrD,UAA8E,EAAE;IAEhF,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACvF,IAAI,KAAK,GAAoC,YAAY,CAAC;IAC1D,IAAI,MAA0B,CAAC;IAC/B,MAAM,OAAO,GAAG,CAAC,KAAsC,EAA0B,EAAE,CAAC,CAAC;QACjF,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ;QACxC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,aAAa;KAC7D,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,MAAM,GAAG,GAAG,EAAE,QAA8B,QAAQ,EAAuB,EAAE,CAAC,CAAC;QAC3G,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK;QAClF,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC;KACpF,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAC9D,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;IACxC,MAAM,CAAC;QAAC,OAAO,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;QAAE,OAAO,OAAO,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IACtE,IAAI,CAAC;QAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAC7C,MAAM,CAAC;QAAC,OAAO,OAAO,CAAC,iDAAiD,EAAE,GAAG,CAAC,CAAC;IAAC,CAAC;IACjF,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;IACrF,MAAM,YAAY,GAAG,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5D,KAAK,GAAG,aAAa,CAAC;IACtB,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAA4C,KAAK,EAC3E,4BAA4B,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,EAC/E,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC;IAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;IACzC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAClF,OAAO,EAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,IAAI,oBAAoB,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC;YACxG,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAChG,CAAC;IACD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC;WACrE,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,kCAAkC,CAAC,CAAC;IACzF,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;YAAE,OAAO,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC9G,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAAC,CAAC;IACvD,MAAM,GAAG,UAAU,CAAC;IACpB,KAAK,GAAG,QAAQ,CAAC;IACjB,IAAI,CAAC;QACD,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;gBAAE,OAAO,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;YACnG,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;YACzC,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC5B,IAAI,MAAM,CAAC,OAAO;oBAAE,OAAO,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;gBAC9D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC,CAAC;gBAC/E,IAAI,CAAC,IAAI,CAAC,SAAS;oBAAE,MAAM;gBAC3B,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC;YAC7B,CAAC;YACD,IAAI,MAAM,KAAK,QAAQ,CAAC,IAAI;gBAAE,OAAO,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;YACxE,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;gBAAS,CAAC;YAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QACnC,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,wBAAwB,MAAM,CAAC,MAAM,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,OAAO,IAAK,KAAe,EAAE,IAAI,KAAK,YAAY;YAC5D,CAAC,CAAC,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACnF,CAAC;IACD,KAAK,GAAG,YAAY,CAAC;IACrB,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,8BAA8B,EAAE;QACnE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ;QACzE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtG,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC;IAChG,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,YAAY,GAAG,MAAM,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAC/G,OAAO,EAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YACxH,GAAG,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1F,GAAG,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAClG,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC;IACvC,0EAA0E;IAC1E,0EAA0E;IAC1E,8EAA8E;IAC9E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM;WACnC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;WACtH,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC,mCAAmC,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IAClH,MAAM,MAAM,GAAG,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,YAAqB,EAAE,KAAK,EAAE,WAAoB,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC1H,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACzH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC9D,CAAC"}

package/dist/src/slack/tool-access.js

@@ -4,10 +4,18 @@ import { resolveSlackToolGrant, slackCredentialKey } from './tool-context.js';
 export function slackToolDenied(code, statusCode = 403) {
     return Object.assign(new Error(code), { statusCode, code });
 }
-export function resolveSlackToolPrincipal(headers, operator) {
+export function slackToolContext(principal) {
+    if (!principal)
+        return undefined;
+    return principal.kind === 'turn' ? principal.grant : principal.context;
+}
+export function resolveSlackToolPrincipal(headers, operator, policy = {}) {
     const grantHeader = headers['x-jaw-slack-grant'];
+    const grant = typeof grantHeader === 'string' ? resolveSlackToolGrant(grantHeader) : null;
+    if (policy.isFullAccess === true) {
+        return grant ? { kind: 'operator', source: 'full-local', context: grant } : { kind: 'operator', source: 'full-local' };
+    }
     if (typeof grantHeader === 'string') {
-        const grant = resolveSlackToolGrant(grantHeader);
         if (!grant)
             throw slackToolDenied('slack_turn_grant_invalid', 401);
         return { kind: 'turn', grant };

package/dist/src/slack/tool-access.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-access.js","sourceRoot":"","sources":["../../../src/slack/tool-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAmB,MAAM,UAAU,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAuB,MAAM,mBAAmB,CAAC;AAInG,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,UAAU,GAAG,GAAG;IAC1D,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;AAChE,CAAC;AACD,MAAM,UAAU,yBAAyB,CAAC,OAAgC,EAAE,QAAgC;IACxG,MAAM,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACjD,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK;YAAE,MAAM,eAAe,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACnC,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAChF,MAAM,eAAe,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAAa,EAAE,OAAe,EAAE,KAAqB,EAAE,SAAsB,EAAE,SAAyB,EAAE,iBAAiB,GAAG,KAAK;IACzJ,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,IAAa,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACtH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAiK,KAAK,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;IAC/O,IAAI,IAAI,CAAC,KAAK,KAAK,aAAa,IAAI,IAAI,CAAC,KAAK,KAAK,cAAc;QAAE,MAAM,eAAe,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IACzH,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,YAAY,EAAE,EAAE,KAAK,OAAO;QAAE,MAAM,eAAe,CAAC,+BAA+B,CAAC,CAAC;IACrG,IAAI,YAAY,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC9B,wEAAwE;QACxE,gFAAgF;QAChF,0EAA0E;QAC1E,+EAA+E;QAC/E,+EAA+E;QAC/E,0EAA0E;QAC1E,IAAI,CAAC,YAAY,CAAC,aAAa,KAAK,SAAS,IAAI,YAAY,CAAC,aAAa,KAAK,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,IAAI,CAAC,SAAS;eACpI,CAAC,YAAY,CAAC,aAAa,KAAK,SAAS,IAAI,YAAY,CAAC,aAAa,KAAK,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,KAAK,SAAS,IAAI,YAAY,CAAC,SAAS,KAAK,KAAK,CAAC;eAChK,CAAC,YAAY,CAAC,eAAe,KAAK,SAAS,IAAI,YAAY,CAAC,eAAe,KAAK,KAAK,CAAC,MAAM,CAAC;YAAE,MAAM,eAAe,CAAC,+BAA+B,CAAC,CAAC;QAC7J,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAkE,KAAK,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;QACxJ,IAAI,QAAQ,CAAC,KAAK,KAAK,aAAa,IAAI,QAAQ,CAAC,KAAK,KAAK,cAAc;YAAE,MAAM,eAAe,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;QACjI,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,eAAe,CAAC,kCAAkC,CAAC,CAAC;IAC1M,CAAC;SAAM,IAAI,YAAY,CAAC,SAAS,KAAK,KAAK,IAAI,YAAY,CAAC,aAAa,KAAK,KAAK;WAC5E,CAAC,YAAY,CAAC,aAAa,KAAK,SAAS,IAAI,YAAY,CAAC,aAAa,KAAK,KAAK,CAAC;WAClF,YAAY,CAAC,eAAe,KAAK,KAAK,CAAC,MAAM;QAAE,MAAM,eAAe,CAAC,+BAA+B,CAAC,CAAC;IAC7G,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAA0F,KAAK,EAAE,uBAAuB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACxN,IAAI,MAAM,CAAC,KAAK,KAAK,aAAa,IAAI,MAAM,CAAC,KAAK,KAAK,cAAc;YAAE,MAAM,eAAe,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;QAC7H,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC;YAAE,MAAM,eAAe,CAAC,6BAA6B,CAAC,CAAC;QAC3M,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,OAAmB;YAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClE,IAAI,OAAO,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,WAAW,KAAK,QAAQ;YAAE,MAAM,eAAe,CAAC,6BAA6B,CAAC,CAAC;QACzH,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI;YAAE,MAAM,eAAe,CAAC,6BAA6B,CAAC,CAAC;QACnG,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,IAAI,YAAY,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAU,CAAC,CAAC;gBAAE,MAAM,eAAe,CAAC,gCAAgC,CAAC,CAAC;YAC5K,OAAO,OAAO,CAAC;QACnB,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM;QAC/B,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,eAAe,CAAC,6BAA6B,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,KAAK,GAAG,IAAI,OAAO,EAAqD,CAAC;AAC/E,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAI,KAAa,EAAE,SAA6B,EAAE,aAAiC,EACxH,SAA+C,EAAE,SAAsB,EAAE,mBAAsC,EAAE,iBAAiB,GAAG,KAAK;IAC1I,IAAI,SAAS,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,SAAS,EAAE,CAAC;IACtD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,EAAE;QACjB,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,aAAa;YAAE,MAAM,eAAe,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;IAC3K,CAAC,CAAC;IACF,OAAO,EAAE,CAAC;IACV,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC3D,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE;QAAE,MAAM,eAAe,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IACpG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAAC,OAAO,EAAE,CAAC;QACzH,IAAI,SAAS,EAAE,MAAM,KAAK,KAAK,CAAC,MAAM;YAAE,MAAM,eAAe,CAAC,0BAA0B,CAAC,CAAC;QAC1F,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC;QAC/C,MAAM,MAAM,GAAG,aAAa,IAAI,WAAW,CAAC;QAC5C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,MAAM,eAAe,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;QACnI,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAAC,OAAO,EAAE,CAAC;QACxH,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,MAAM,eAAe,CAAC,wBAAwB,CAAC,CAAC;QACvF,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YACzB,MAAM,kBAAkB,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;YAAC,OAAO,EAAE,CAAC;YAClI,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAAE,MAAM,eAAe,CAAC,yBAAyB,CAAC,CAAC;QAC/J,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC;YAAC,OAAO,EAAE,CAAC;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,mBAAmB;gBAAE,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;QAC9G,OAAO,MAAM,CAAC;IAClB,CAAC;YAAS,CAAC;QAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAAC,CAAC;AACrC,CAAC"}
+{"version":3,"file":"tool-access.js","sourceRoot":"","sources":["../../../src/slack/tool-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAmB,MAAM,UAAU,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAuB,MAAM,mBAAmB,CAAC;AAKnG,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,UAAU,GAAG,GAAG;IAC1D,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;AAChE,CAAC;AACD,MAAM,UAAU,gBAAgB,CAAC,SAAgD;IAC7E,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,OAAO,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAgC,EAAE,QAAgC,EACxG,SAAqC,EAAE;IACvC,MAAM,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1F,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC3H,CAAC;IACD,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,MAAM,eAAe,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACnC,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAChF,MAAM,eAAe,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,KAAa,EAAE,OAAe,EAAE,KAAqB,EAAE,SAAsB,EAAE,SAAyB,EAAE,iBAAiB,GAAG,KAAK;IACzJ,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,IAAa,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACtH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAiK,KAAK,EAAE,oBAAoB,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;IAC/O,IAAI,IAAI,CAAC,KAAK,KAAK,aAAa,IAAI,IAAI,CAAC,KAAK,KAAK,cAAc;QAAE,MAAM,eAAe,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IACzH,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,YAAY,EAAE,EAAE,KAAK,OAAO;QAAE,MAAM,eAAe,CAAC,+BAA+B,CAAC,CAAC;IACrG,IAAI,YAAY,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC9B,wEAAwE;QACxE,gFAAgF;QAChF,0EAA0E;QAC1E,+EAA+E;QAC/E,+EAA+E;QAC/E,0EAA0E;QAC1E,IAAI,CAAC,YAAY,CAAC,aAAa,KAAK,SAAS,IAAI,YAAY,CAAC,aAAa,KAAK,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,IAAI,CAAC,SAAS;eACpI,CAAC,YAAY,CAAC,aAAa,KAAK,SAAS,IAAI,YAAY,CAAC,aAAa,KAAK,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,KAAK,SAAS,IAAI,YAAY,CAAC,SAAS,KAAK,KAAK,CAAC;eAChK,CAAC,YAAY,CAAC,eAAe,KAAK,SAAS,IAAI,YAAY,CAAC,eAAe,KAAK,KAAK,CAAC,MAAM,CAAC;YAAE,MAAM,eAAe,CAAC,+BAA+B,CAAC,CAAC;QAC7J,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAkE,KAAK,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;QACxJ,IAAI,QAAQ,CAAC,KAAK,KAAK,aAAa,IAAI,QAAQ,CAAC,KAAK,KAAK,cAAc;YAAE,MAAM,eAAe,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;QACjI,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,eAAe,CAAC,kCAAkC,CAAC,CAAC;IAC1M,CAAC;SAAM,IAAI,YAAY,CAAC,SAAS,KAAK,KAAK,IAAI,YAAY,CAAC,aAAa,KAAK,KAAK;WAC5E,CAAC,YAAY,CAAC,aAAa,KAAK,SAAS,IAAI,YAAY,CAAC,aAAa,KAAK,KAAK,CAAC;WAClF,YAAY,CAAC,eAAe,KAAK,KAAK,CAAC,MAAM;QAAE,MAAM,eAAe,CAAC,+BAA+B,CAAC,CAAC;IAC7G,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAA0F,KAAK,EAAE,uBAAuB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACxN,IAAI,MAAM,CAAC,KAAK,KAAK,aAAa,IAAI,MAAM,CAAC,KAAK,KAAK,cAAc;YAAE,MAAM,eAAe,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;QAC7H,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC;YAAE,MAAM,eAAe,CAAC,6BAA6B,CAAC,CAAC;QAC3M,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,OAAmB;YAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClE,IAAI,OAAO,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,WAAW,KAAK,QAAQ;YAAE,MAAM,eAAe,CAAC,6BAA6B,CAAC,CAAC;QACzH,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI;YAAE,MAAM,eAAe,CAAC,6BAA6B,CAAC,CAAC;QACnG,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,IAAI,YAAY,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAU,CAAC,CAAC;gBAAE,MAAM,eAAe,CAAC,gCAAgC,CAAC,CAAC;YAC5K,OAAO,OAAO,CAAC;QACnB,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM;QAC/B,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,eAAe,CAAC,6BAA6B,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,KAAK,GAAG,IAAI,OAAO,EAAqD,CAAC;AAC/E,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAI,KAAa,EAAE,SAA6B,EAAE,aAAiC,EACxH,SAA+C,EAAE,SAAsB,EAAE,mBAAsC,EAAE,iBAAiB,GAAG,KAAK;IAC1I,IAAI,SAAS,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,SAAS,EAAE,CAAC;IACtD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,EAAE;QACjB,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,aAAa;YAAE,MAAM,eAAe,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;IAC3K,CAAC,CAAC;IACF,OAAO,EAAE,CAAC;IACV,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC3D,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE;QAAE,MAAM,eAAe,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IACpG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAAC,OAAO,EAAE,CAAC;QACzH,IAAI,SAAS,EAAE,MAAM,KAAK,KAAK,CAAC,MAAM;YAAE,MAAM,eAAe,CAAC,0BAA0B,CAAC,CAAC;QAC1F,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC;QAC/C,MAAM,MAAM,GAAG,aAAa,IAAI,WAAW,CAAC;QAC5C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,MAAM,eAAe,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;QACnI,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QAAC,OAAO,EAAE,CAAC;QACxH,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,MAAM,eAAe,CAAC,wBAAwB,CAAC,CAAC;QACvF,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YACzB,MAAM,kBAAkB,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;YAAC,OAAO,EAAE,CAAC;YAClI,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAAE,MAAM,eAAe,CAAC,yBAAyB,CAAC,CAAC;QAC/J,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC;YAAC,OAAO,EAAE,CAAC;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,mBAAmB;gBAAE,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;QAC9G,OAAO,MAAM,CAAC;IAClB,CAAC;YAAS,CAAC;QAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAAC,CAAC;AACrC,CAAC"}

package/dist/src/slack/tool-capabilities.js

@@ -1,3 +1,4 @@
+import { slackToolContext } from './tool-access.js';
 import { readSlackAuthSnapshot } from './verified-workspace.js';
 import { slackCredentialKey } from './tool-context.js';
 import { getRtsOutputStore } from './rts-output-store.js';
@@ -10,25 +11,27 @@ export async function slackToolCapabilities(token, definitions, principal, store
     const auth = token ? await readSlackAuthSnapshot(token, options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}) : null;
     const entries = [...SOURCE_TOOLS.map(item => ({ ...item, methods: ['search.info'].includes(item.operation) ? [] : ['conversations.history'], mutates: false, requiresInbound: false })), ...definitions.map(item => ({ operation: item.operation, scopes: [...item.scopes], methods: item.methods, mutates: item.mutates, requiresInbound: item.requiresInbound === true }))];
     const capabilities = entries.map(item => {
+        const context = item.operation === 'search.quote' ? slackToolContext(principal) : undefined;
+        const checkedPrincipal = context ? { kind: 'turn', grant: context } : principal;
         const readsHistory = item.methods.some(method => ['conversations.history', 'conversations.replies'].includes(method));
-        const contextScopes = principal?.kind === 'turn' && principal.grant.destination.targetId.startsWith('D')
+        const contextScopes = checkedPrincipal?.kind === 'turn' && checkedPrincipal.grant.destination.targetId.startsWith('D')
             ? ['im:read', 'users:read', ...(item.mutates && readsHistory ? ['im:history'] : [])] : [];
         const requiredScopes = [...new Set([...item.scopes, ...contextScopes])];
         const conditionalScopes = [
-            ...(principal?.kind === 'turn' ? [{ purpose: 'source and destination membership', oneOf: ['channels:read', 'groups:read', 'im:read', 'mpim:read'] }] : []),
+            ...(checkedPrincipal?.kind === 'turn' ? [{ purpose: 'source and destination membership', oneOf: ['channels:read', 'groups:read', 'im:read', 'mpim:read'] }] : []),
             ...(readsHistory ? [{ purpose: 'source or readback conversation history', oneOf: ['channels:history', 'groups:history', 'im:history', 'mpim:history'] }] : []),
         ];
         const granted = !token || !auth ? null : requiredScopes.length === 0 ? true : auth.scopes === null ? null : requiredScopes.every(scope => auth.scopes.includes(scope));
         const missingScopes = auth?.scopes ? requiredScopes.filter(scope => !auth.scopes.includes(scope)) : [];
         let reason = !token ? 'slack_unavailable' : !auth ? 'identity_unverified' : !principal ? 'turn_authorization_unavailable' : granted === null ? 'scopes_unverified' : !granted ? 'missing_scope' : null;
-        if (!reason && principal?.kind === 'turn' && (principal.grant.signal.aborted || principal.grant.expiresAt <= Date.now()
-            || principal.grant.teamId !== auth?.teamId || principal.grant.credentialKey !== slackCredentialKey(token)))
+        if (!reason && checkedPrincipal?.kind === 'turn' && (checkedPrincipal.grant.signal.aborted || checkedPrincipal.grant.expiresAt <= Date.now()
+            || checkedPrincipal.grant.teamId !== auth?.teamId || checkedPrincipal.grant.credentialKey !== slackCredentialKey(token)))
             reason = 'turn_grant_stale';
-        if (!reason && principal?.kind === 'turn' && /^(canvas|list)\./.test(item.operation) && !principal.grant.destination.targetId.startsWith('D'))
+        if (!reason && checkedPrincipal?.kind === 'turn' && /^(canvas|list)\./.test(item.operation) && !checkedPrincipal.grant.destination.targetId.startsWith('D'))
             reason = 'requester_dm_required';
         if (!reason && item.requiresInbound && !options.inboundReady)
             reason = 'inbound_unavailable';
-        if (!reason && item.operation === 'search.quote' && (principal?.kind !== 'turn' || !principal.grant.actionToken))
+        if (!reason && item.operation === 'search.quote' && !context?.actionToken)
             reason = 'action_token_unavailable';
         if (!reason && item.operation === 'search.quote' && !getRtsOutputStore())
             reason = 'privacy_store_unavailable';
@@ -40,8 +43,13 @@ export async function slackToolCapabilities(token, definitions, principal, store
         reason: 'response_capable_modal_ack_unimplemented', verified: false, verifiedAt: null, resourceChecksRequired: true });
     capabilities.push({ operation: 'search.raw', implemented: false, requiredScopes: ['search:read.public'], conditionalScopes: [], granted: null, missingScopes: [], available: false,
         reason: 'retention_path_unverified', verified: false, verifiedAt: null, resourceChecksRequired: true });
-    return { ok: true, authorization: { supportedPrintClis: ['cursor', 'claude', 'codex', 'grok'], pooledNative: false, otherClis: false,
-            limitation: 'Turn tools require a fresh supported print-process grant; pooled native and other CLI transports are unavailable.' }, observedAt: auth?.observedAt ?? null, scopesKnown: auth?.scopes !== null && auth !== null,
+    const fullLocal = principal?.kind === 'operator' && principal.source === 'full-local';
+    return { ok: true, authorization: { supportedPrintClis: ['cursor', 'claude', 'codex', 'grok'],
+            mode: fullLocal ? 'full-local' : principal?.kind ?? 'unavailable',
+            fullLocal, pooledNative: fullLocal, workers: fullLocal, otherClis: fullLocal,
+            limitation: fullLocal
+                ? 'Auto permits qualified direct local Jaw tool requests independently of CLI, native reuse, resume or worker role. Provider scopes, contextual action tokens, privacy and resource validity still apply.'
+                : 'Scoped turn tools require a fresh supported print-process grant; native and other transports can use qualified local Auto or explicit operator credentials.' }, observedAt: auth?.observedAt ?? null, scopesKnown: auth?.scopes !== null && auth !== null,
         verificationMeaning: 'observed real operation result; resource-specific and caller checks still apply', capabilities };
 }
 //# sourceMappingURL=tool-capabilities.js.map

package/dist/src/slack/tool-capabilities.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-capabilities.js","sourceRoot":"","sources":["../../../src/slack/tool-capabilities.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAGvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,MAAM,YAAY,GAAG;IACjB,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAc,EAAE,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,EAAc,EAAE;IACpG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,oBAAoB,CAAC,EAAE;IAC5G,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,oBAAoB,EAAE,YAAY,CAAC,EAAE;CAC9E,CAAC;AACF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAoB,EAAE,WAAwC,EAAE,SAAoC,EAC5I,KAA8B,EAAE,OAA0D;IAC1F,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1H,MAAM,OAAO,GAAG,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9W,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QACpC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,uBAAuB,EAAE,uBAAuB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACtH,MAAM,aAAa,GAAG,SAAS,EAAE,IAAI,KAAK,MAAM,IAAI,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YACpG,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,iBAAiB,GAAG;YACtB,GAAG,CAAC,SAAS,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,KAAK,EAAE,CAAC,eAAe,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1J,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,yCAAyC,EAAE,KAAK,EAAE,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACjK,CAAC;QACF,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,MAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACxK,MAAM,aAAa,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxG,IAAI,MAAM,GAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC;QACtN,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,IAAI,KAAK,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,SAAS,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;eAChH,SAAS,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,MAAM,IAAI,SAAS,CAAC,KAAK,CAAC,aAAa,KAAK,kBAAkB,CAAC,KAAM,CAAC,CAAC;YAAE,MAAM,GAAG,kBAAkB,CAAC;QAC7I,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,IAAI,KAAK,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,uBAAuB,CAAC;QAChL,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,OAAO,CAAC,YAAY;YAAE,MAAM,GAAG,qBAAqB,CAAC;QAC7F,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,KAAK,cAAc,IAAI,CAAC,SAAS,EAAE,IAAI,KAAK,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC;YAAE,MAAM,GAAG,0BAA0B,CAAC;QACtJ,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,KAAK,cAAc,IAAI,CAAC,iBAAiB,EAAE;YAAE,MAAM,GAAG,2BAA2B,CAAC;QAC/G,MAAM,UAAU,GAAG,IAAI,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChL,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,iBAAiB,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI;YACxI,MAAM,EAAE,QAAQ,EAAE,UAAU,KAAK,IAAI,EAAE,UAAU,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC;IAC1F,CAAC,CAAC,CAAC;IACH,YAAY,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK;QAC1J,MAAM,EAAE,0CAA0C,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3H,YAAY,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,oBAAoB,CAAC,EAAE,iBAAiB,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK;QAC9K,MAAM,EAAE,2BAA2B,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5G,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,kBAAkB,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK;YAChI,UAAU,EAAE,mHAAmH,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,IAAI,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;QAC5N,mBAAmB,EAAE,iFAAiF,EAAE,YAAY,EAAE,CAAC;AAC/H,CAAC"}
+{"version":3,"file":"tool-capabilities.js","sourceRoot":"","sources":["../../../src/slack/tool-capabilities.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAA2B,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAGvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,MAAM,YAAY,GAAG;IACjB,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAc,EAAE,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,EAAc,EAAE;IACpG,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,oBAAoB,CAAC,EAAE;IAC5G,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,oBAAoB,EAAE,YAAY,CAAC,EAAE;CAC9E,CAAC;AACF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAoB,EAAE,WAAwC,EAAE,SAAoC,EAC5I,KAA8B,EAAE,OAA0D;IAC1F,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1H,MAAM,OAAO,GAAG,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9W,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,KAAK,cAAc,CAAC,CAAC,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,MAAM,gBAAgB,GAA8B,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3G,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,uBAAuB,EAAE,uBAAuB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACtH,MAAM,aAAa,GAAG,gBAAgB,EAAE,IAAI,KAAK,MAAM,IAAI,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YAClH,CAAC,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,iBAAiB,GAAG;YACtB,GAAG,CAAC,gBAAgB,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,KAAK,EAAE,CAAC,eAAe,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjK,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,yCAAyC,EAAE,KAAK,EAAE,CAAC,kBAAkB,EAAE,gBAAgB,EAAE,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACjK,CAAC;QACF,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,MAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACxK,MAAM,aAAa,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxG,IAAI,MAAM,GAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC;QACtN,IAAI,CAAC,MAAM,IAAI,gBAAgB,EAAE,IAAI,KAAK,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,gBAAgB,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;eACrI,gBAAgB,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,MAAM,IAAI,gBAAgB,CAAC,KAAK,CAAC,aAAa,KAAK,kBAAkB,CAAC,KAAM,CAAC,CAAC;YAAE,MAAM,GAAG,kBAAkB,CAAC;QAC3J,IAAI,CAAC,MAAM,IAAI,gBAAgB,EAAE,IAAI,KAAK,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,uBAAuB,CAAC;QAC9L,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,OAAO,CAAC,YAAY;YAAE,MAAM,GAAG,qBAAqB,CAAC;QAC7F,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,KAAK,cAAc,IAAI,CAAC,OAAO,EAAE,WAAW;YAAE,MAAM,GAAG,0BAA0B,CAAC;QAC/G,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,KAAK,cAAc,IAAI,CAAC,iBAAiB,EAAE;YAAE,MAAM,GAAG,2BAA2B,CAAC;QAC/G,MAAM,UAAU,GAAG,IAAI,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChL,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,iBAAiB,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI;YACxI,MAAM,EAAE,QAAQ,EAAE,UAAU,KAAK,IAAI,EAAE,UAAU,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC;IAC1F,CAAC,CAAC,CAAC;IACH,YAAY,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK;QAC1J,MAAM,EAAE,0CAA0C,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3H,YAAY,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,oBAAoB,CAAC,EAAE,iBAAiB,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK;QAC9K,MAAM,EAAE,2BAA2B,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5G,MAAM,SAAS,GAAG,SAAS,EAAE,IAAI,KAAK,UAAU,IAAI,SAAS,CAAC,MAAM,KAAK,YAAY,CAAC;IACtF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,kBAAkB,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC;YACzF,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,IAAI,aAAa;YACjE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;YAC5E,UAAU,EAAE,SAAS;gBACjB,CAAC,CAAC,wMAAwM;gBAC1M,CAAC,CAAC,6JAA6J,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,IAAI,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;QAChQ,mBAAmB,EAAE,iFAAiF,EAAE,YAAY,EAAE,CAAC;AAC/H,CAAC"}

package/dist/src/types/cli-engine.js

@@ -14,10 +14,35 @@
 //   2. Add the runtime entry in src/cli/registry.ts (the registry will
 //      no longer typecheck without it once P00.5 lands).
 //   3. Update fixtures and per-engine event extractors (P11+).
+export const RETIRED_CLI_SELECTIONS = [
+    'ai-e',
+    'claude-e',
+    'jwc',
+];
 export function isRetiredCliSelection(value) {
-    return value === 'jwc';
+    return typeof value === 'string' && RETIRED_CLI_SELECTIONS.includes(value);
 }
 export const RETIRED_RUNTIME_DIAGNOSTIC = 'retired_runtime:jwc';
+/**
+ * Diagnostic code for a stored retired runtime. `jwc` keeps the original
+ * literal so every existing contract that pins it stays byte-identical.
+ */
+export function retiredRuntimeDiagnostic(value) {
+    return value === 'jwc' ? RETIRED_RUNTIME_DIAGNOSTIC : `retired_runtime:${value}`;
+}
+const RETIRED_RUNTIME_NAMES = {
+    'ai-e': 'AI-E',
+    'claude-e': 'Claude E',
+    jwc: 'JWC',
+};
+/** Short label for a saved retired runtime, e.g. `JWC (retired)`. */
+export function retiredRuntimeLabel(value) {
+    return `${RETIRED_RUNTIME_NAMES[value]} (retired)`;
+}
+/** Selector label that also tells the reader what to do next. */
+export function retiredRuntimeChoiceLabel(value) {
+    return `${RETIRED_RUNTIME_NAMES[value]} (retired — choose another runtime)`;
+}
 /**
  * Runtime list of all engines, derived from the type via a `satisfies`
  * check so adding/removing a literal in `CliEngine` forces a corresponding
@@ -27,9 +52,7 @@ export const RETIRED_RUNTIME_DIAGNOSTIC = 'retired_runtime:jwc';
  */
 export const CLI_ENGINES = [
     'agy',
-    'ai-e',
     'claude',
-    'claude-e',
     'codex',
     'codex-app',
     'copilot',

package/dist/src/types/cli-engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-engine.js","sourceRoot":"","sources":["../../../src/types/cli-engine.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,+DAA+D;AAC/D,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,wEAAwE;AACxE,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,kCAAkC;AAClC,EAAE;AACF,uBAAuB;AACvB,6BAA6B;AAC7B,uEAAuE;AACvE,yDAAyD;AACzD,+DAA+D;AAqB/D,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAChD,OAAO,KAAK,KAAK,KAAK,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,qBAA8B,CAAC;AAEzE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACvB,KAAK;IACL,MAAM;IACN,QAAQ;IACR,UAAU;IACV,OAAO;IACP,WAAW;IACX,SAAS;IACT,QAAQ;IACR,MAAM;IACN,WAAW;IACX,UAAU;IACV,IAAI;CACiC,CAAC;AAE1C,MAAM,UAAU,WAAW,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,WAAiC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3F,CAAC"}
+{"version":3,"file":"cli-engine.js","sourceRoot":"","sources":["../../../src/types/cli-engine.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,+DAA+D;AAC/D,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,wEAAwE;AACxE,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,kCAAkC;AAClC,EAAE;AACF,uBAAuB;AACvB,6BAA6B;AAC7B,uEAAuE;AACvE,yDAAyD;AACzD,+DAA+D;AAmB/D,MAAM,CAAC,MAAM,sBAAsB,GAAG;IAClC,MAAM;IACN,UAAU;IACV,KAAK;CAC0C,CAAC;AAEpD,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,sBAA4C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACtG,CAAC;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,qBAA8B,CAAC;AAEzE;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAA0B;IAC/D,OAAO,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,mBAAmB,KAAK,EAAE,CAAC;AACrF,CAAC;AAED,MAAM,qBAAqB,GAAkD;IACzE,MAAM,EAAE,MAAM;IACd,UAAU,EAAE,UAAU;IACtB,GAAG,EAAE,KAAK;CACb,CAAC;AAEF,qEAAqE;AACrE,MAAM,UAAU,mBAAmB,CAAC,KAA0B;IAC1D,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,YAAY,CAAC;AACvD,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,yBAAyB,CAAC,KAA0B;IAChE,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,qCAAqC,CAAC;AAChF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACvB,KAAK;IACL,QAAQ;IACR,OAAO;IACP,WAAW;IACX,SAAS;IACT,QAAQ;IACR,MAAM;IACN,WAAW;IACX,UAAU;IACV,IAAI;CACiC,CAAC;AAE1C,MAAM,UAAU,WAAW,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,WAAiC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3F,CAAC"}

package/dist/src/types/cli-events.js

@@ -23,7 +23,7 @@ export function assertNever(value) {
 export function discriminate(cli, raw) {
     if (!isCliEventRecord(raw))
         return null;
-    if (cli === 'claude' || cli === 'claude-e' || cli === 'codex' || cli === 'cursor' || cli === 'grok' || cli === 'opencode' || cli === 'copilot') {
+    if (cli === 'claude' || cli === 'codex' || cli === 'cursor' || cli === 'grok' || cli === 'opencode' || cli === 'copilot') {
         return { ...raw, cli };
     }
     return null;

package/dist/src/types/cli-events.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-events.js","sourceRoot":"","sources":["../../../src/types/cli-events.ts"],"names":[],"mappings":"AAyHA,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,QAAQ,GAAG,EAAE;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAClF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAY;IACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,GAAY;IACpD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QAC/I,OAAO,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"cli-events.js","sourceRoot":"","sources":["../../../src/types/cli-events.ts"],"names":[],"mappings":"AAyHA,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,QAAQ,GAAG,EAAE;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAClF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAY;IACtC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,GAAY;IACpD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACzH,OAAO,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/workflows/employee-boundary.js

@@ -1,11 +1,15 @@
-// Shared assertions for Boss-only dispatch and employee boundaries.
+// Shared assertions for authorized dispatch and employee boundaries.
 // Does NOT import provider SDKs.
 import { hasImplementationDelegation } from './handoff.js';
-export function assertBossOnlyDispatch(isBoss) {
-    if (!isBoss) {
-        throw new Error('Only the Boss agent can dispatch jaw employees');
+export function assertAuthorizedDispatcher(authorized) {
+    if (!authorized) {
+        throw new Error('Only an authorized dispatcher can dispatch jaw employees');
     }
 }
+/** @deprecated Use assertAuthorizedDispatcher. Kept for existing callers. */
+export function assertBossOnlyDispatch(isBoss) {
+    assertAuthorizedDispatcher(isBoss);
+}
 export function assertNoImplementationDelegation(phase, taskBody, allowWrite = false) {
     if (phase === 'B' && !allowWrite && hasImplementationDelegation(taskBody)) {
         throw new Error('B-phase employees are read-only verifiers; implementation delegation is forbidden. Use --mutable to allow writes.');
@@ -21,7 +25,7 @@ export function assertReadOnlyAudit(phase, taskBody, allowWrite = false) {
 }
 export function validateDispatchTask(opts) {
     try {
-        assertBossOnlyDispatch(opts.isBoss);
+        assertAuthorizedDispatcher(opts.authorized);
         assertNoImplementationDelegation(opts.phase, opts.taskBody, opts.allowWrite);
         assertReadOnlyAudit(opts.phase, opts.taskBody, opts.allowWrite);
         return { ok: true };

package/dist/src/workflows/employee-boundary.js.map

@@ -1 +1 @@
-{"version":3,"file":"employee-boundary.js","sourceRoot":"","sources":["../../../src/workflows/employee-boundary.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,iCAAiC;AAGjC,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAE3D,MAAM,UAAU,sBAAsB,CAAC,MAAe;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACtE,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,KAAmB,EAAE,QAAgB,EAAE,UAAU,GAAG,KAAK;IACtG,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,UAAU,IAAI,2BAA2B,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,mHAAmH,CAAC,CAAC;IACzI,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAmB,EAAE,QAAgB,EAAE,UAAU,GAAG,KAAK;IACzF,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACvD,CAAC;IACL,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAKpC;IACG,IAAI,CAAC;QACD,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,gCAAgC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7E,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;IACxD,CAAC;AACL,CAAC"}
+{"version":3,"file":"employee-boundary.js","sourceRoot":"","sources":["../../../src/workflows/employee-boundary.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,iCAAiC;AAGjC,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAE3D,MAAM,UAAU,0BAA0B,CAAC,UAAmB;IAC1D,IAAI,CAAC,UAAU,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAChF,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CAAC,MAAe;IAClD,0BAA0B,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,KAAmB,EAAE,QAAgB,EAAE,UAAU,GAAG,KAAK;IACtG,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,UAAU,IAAI,2BAA2B,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,mHAAmH,CAAC,CAAC;IACzI,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAmB,EAAE,QAAgB,EAAE,UAAU,GAAG,KAAK;IACzF,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACvD,CAAC;IACL,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAKpC;IACG,IAAI,CAAC;QACD,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5C,gCAAgC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7E,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;IACxD,CAAC;AACL,CAAC"}

package/dist/src/workflows/scope-sandbox.js

@@ -42,14 +42,17 @@ export function normalizeScope(projectRoot, scopePath) {
 export function isProtectedPath(filePath) {
     return PROTECTED_PATTERNS.some(regex => regex.test(filePath));
 }
-export function postDispatchDiffCheck(projectRoot, allowedScope) {
+export function postDispatchDiffCheck(projectRoot, allowedScope, opts) {
     if (!allowedScope)
         return { ok: true, modifiedOutside: [] };
     const modifiedFiles = listGitChangedFiles(projectRoot);
+    const allowProtectedPaths = opts?.allowProtectedPaths === true;
     const absoluteAllowedScope = path.resolve(projectRoot, allowedScope);
     const outsideFiles = modifiedFiles.filter(file => {
         const absFile = path.resolve(projectRoot, file);
-        return !isPathWithin(absFile, absoluteAllowedScope) || isProtectedPath(file);
+        if (!isPathWithin(absFile, absoluteAllowedScope))
+            return true;
+        return !allowProtectedPaths && isProtectedPath(file);
     });
     return {
         ok: outsideFiles.length === 0,

package/dist/src/workflows/scope-sandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-sandbox.js","sourceRoot":"","sources":["../../../src/workflows/scope-sandbox.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,qDAAqD;AAErD,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,MAAM,kBAAkB,GAAG;IACvB,SAAS;IACT,QAAQ;IACR,iBAAiB;IACjB,qBAAqB;IACrB,aAAa;IACb,kBAAkB;CACrB,CAAC;AAEF,SAAS,YAAY,CAAC,KAAa,EAAE,MAAc;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9C,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAmB;IAC5C,0FAA0F;IAC1F,MAAM,OAAO,GAAG;QACZ,QAAQ,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE;QACjE,QAAQ,CAAC,+BAA+B,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC1E,QAAQ,CAAC,0CAA0C,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE;KACxF,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,WAAmB,EAAE,SAAiB;IACjE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAE3D,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,0BAA0B,SAAS,yBAAyB,CAAC,CAAC;IAClF,CAAC;IAED,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QACjD,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAClF,CAAC;IACL,CAAC;IAED,OAAO,aAAa,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC5C,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,qBAAqB,CACjC,WAAmB,EAAE,YAAqB;IAE1C,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IAE5D,MAAM,aAAa,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAEvD,MAAM,oBAAoB,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAChD,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,oBAAoB,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,OAAO;QACH,EAAE,EAAE,YAAY,CAAC,MAAM,KAAK,CAAC;QAC7B,eAAe,EAAE,YAAY;KAChC,CAAC;AACN,CAAC"}
+{"version":3,"file":"scope-sandbox.js","sourceRoot":"","sources":["../../../src/workflows/scope-sandbox.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,qDAAqD;AAErD,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,MAAM,kBAAkB,GAAG;IACvB,SAAS;IACT,QAAQ;IACR,iBAAiB;IACjB,qBAAqB;IACrB,aAAa;IACb,kBAAkB;CACrB,CAAC;AAEF,SAAS,YAAY,CAAC,KAAa,EAAE,MAAc;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9C,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAmB;IAC5C,0FAA0F;IAC1F,MAAM,OAAO,GAAG;QACZ,QAAQ,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE;QACjE,QAAQ,CAAC,+BAA+B,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC1E,QAAQ,CAAC,0CAA0C,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE;KACxF,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,WAAmB,EAAE,SAAiB;IACjE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAE3D,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,0BAA0B,SAAS,yBAAyB,CAAC,CAAC;IAClF,CAAC;IAED,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QACjD,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAClF,CAAC;IACL,CAAC;IAED,OAAO,aAAa,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC5C,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,qBAAqB,CACjC,WAAmB,EAAE,YAAqB,EAC1C,IAAwC;IAExC,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;IAE5D,MAAM,aAAa,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,mBAAmB,GAAG,IAAI,EAAE,mBAAmB,KAAK,IAAI,CAAC;IAE/D,MAAM,oBAAoB,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,oBAAoB,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9D,OAAO,CAAC,mBAAmB,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,OAAO;QACH,EAAE,EAAE,YAAY,CAAC,MAAM,KAAK,CAAC;QAC7B,eAAe,EAAE,YAAY;KAChC,CAAC;AACN,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "cli-jaw",
-  "version": "2.17.44",
-  "description": "Personal AI assistant powered by Pi, Antigravity, AI-E, Claude, Claude E, Codex, Codex App, Cursor, Grok, Kiro, OpenCode, and Copilot — Web, Terminal, Slack, Telegram, and Discord interfaces with 33 skills active by default from a 230-skill reference library",
+  "version": "2.17.45",
+  "description": "Personal AI assistant powered by Pi, Antigravity, Claude, Codex, Codex App, Cursor, Grok, Kiro, OpenCode, and Copilot — Web, Terminal, Slack, Telegram, and Discord interfaces with 33 skills active by default from a 230-skill reference library",
   "type": "module",
   "keywords": [
     "ai-assistant",
@@ -69,10 +69,6 @@
     "rebuild:native": "npm rebuild better-sqlite3",
     "postinstall": "node scripts/postinstall-guard.cjs",
     "clean:dist": "node -e \"const fs=require('fs');fs.rmSync('dist',{recursive:true,force:true});\"",
-    "build:claude-e": "cargo build --release --manifest-path native/claude-e/Cargo.toml",
-    "test:claude-e": "cargo test --manifest-path native/claude-e/Cargo.toml",
-    "build:claude-exec": "npm run build:claude-e",
-    "test:claude-exec": "npm run test:claude-e",
     "check:copilot-gap": "tsx scripts/check-copilot-gap.ts",
     "check:deps": "tsx scripts/check-deps-offline.ts",
     "check:deps:audit": "tsx scripts/check-deps-audit.ts",