omp-conductor 0.13.0 → 0.15.0

package/src/confinement.ts

@@ -151,3 +151,57 @@ export function worktreeConfinement(root: string): (pi: ConfinementPi) => void {
   };
 }
 
+
+/**
+ * Tools a read-only session may call: reading, searching, and thinking.
+ *
+ * An allowlist rather than a blocklist, because the failure directions are not
+ * symmetric. A tool this package has never heard of — one a newer harness adds, or
+ * an MCP server contributes — must arrive **denied**: a blocklist would admit it by
+ * default, and the first unknown write tool would silently reopen the hole.
+ */
+const READ_ONLY_TOOLS = new Set([
+  "read",
+  "grep",
+  "glob",
+  "list",
+  "ls",
+  "todo",
+  "think",
+  "sequentialthinking",
+]);
+
+/**
+ * Decide whether one tool_call may run in a read-only session.
+ *
+ * Unlike {@link confineToolCall}, this refuses `bash` **outright** rather than
+ * inspecting it. That is the distinction the module header draws: parsing a shell
+ * string is a false sense of security, but declining to hand over a shell at all
+ * is a real boundary. A probe needs to read files, so it loses nothing.
+ */
+export function readOnlyToolCall(toolName: string): ConfineDecision | undefined {
+  if (READ_ONLY_TOOLS.has(toolName)) return undefined;
+  return {
+    block: true,
+    reason:
+      `Blocked: ${toolName} is not available to this session, which may only read. ` +
+      `Answer from the files you can read (read, grep, glob) — there is no shell, ` +
+      `no edit, and no network verb here.`,
+  };
+}
+
+/**
+ * Inline extension factory installing the read-only gate (#307).
+ *
+ * **Where this boundary does and does not hold.** It is installed by
+ * {@link createLocalSession}, so it covers exactly the sessions this package
+ * spawns. That is the whole population for the probes it exists for — a probe has
+ * no externally started shape, which is precisely what made the orchestrator's
+ * gate unenforceable in #143 — so for those it is absolute rather than advisory.
+ * It is not a sandbox: it constrains the session's tools, not the process.
+ */
+export function readOnlySession(): (pi: ConfinementPi) => void {
+  return (pi) => {
+    pi.on("tool_call", (event) => readOnlyToolCall(event.toolName));
+  };
+}