skillscript-runtime 0.4.0 → 0.4.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/ARCHITECTURE.md +3 -2
- package/dist/bootstrap.d.ts.map +1 -1
- package/dist/bootstrap.js +9 -2
- package/dist/bootstrap.js.map +1 -1
- package/dist/compile.d.ts +9 -0
- package/dist/compile.d.ts.map +1 -1
- package/dist/compile.js +1 -0
- package/dist/compile.js.map +1 -1
- package/dist/connectors/config.d.ts +22 -0
- package/dist/connectors/config.d.ts.map +1 -1
- package/dist/connectors/config.js +132 -3
- package/dist/connectors/config.js.map +1 -1
- package/dist/connectors/mcp-remote.d.ts +79 -0
- package/dist/connectors/mcp-remote.d.ts.map +1 -0
- package/dist/connectors/mcp-remote.js +342 -0
- package/dist/connectors/mcp-remote.js.map +1 -0
- package/dist/connectors/registry.d.ts +10 -1
- package/dist/connectors/registry.d.ts.map +1 -1
- package/dist/connectors/registry.js +33 -3
- package/dist/connectors/registry.js.map +1 -1
- package/dist/help-content.d.ts.map +1 -1
- package/dist/help-content.js +1 -0
- package/dist/help-content.js.map +1 -1
- package/dist/lint.d.ts +10 -0
- package/dist/lint.d.ts.map +1 -1
- package/dist/lint.js +58 -0
- package/dist/lint.js.map +1 -1
- package/dist/mcp-server.d.ts.map +1 -1
- package/dist/mcp-server.js +16 -2
- package/dist/mcp-server.js.map +1 -1
- package/dist/runtime.d.ts.map +1 -1
- package/dist/runtime.js +80 -2
- package/dist/runtime.js.map +1 -1
- package/examples/hello.skill.provenance.json +1 -1
- package/examples/youtrack-morning-sweep.skill.md +17 -0
- package/package.json +1 -1
|
@@ -0,0 +1,342 @@
|
|
|
1
|
+
// v0.4.1 — `RemoteMcpConnector`. Bridges to remote MCP servers via a
|
|
2
|
+
// spawned child process (typically `npx mcp-remote ...`). The first
|
|
3
|
+
// JSON-instantiable connector class in the closed-set registry; pairs
|
|
4
|
+
// with v0.4.0's config-loader infrastructure to make `connectors.json`
|
|
5
|
+
// practically useful.
|
|
6
|
+
//
|
|
7
|
+
// Spec: Perry's v0.4.1 kickoff (c65e77af) + Scott's framing/scope
|
|
8
|
+
// answers in `89e2752d`.
|
|
9
|
+
//
|
|
10
|
+
// **Stdio framing.** Two protocols supported, config-driven:
|
|
11
|
+
// - `"lsp"` (default) — `Content-Length: N\r\n\r\n<body>` per the
|
|
12
|
+
// Language Server Protocol convention. What most MCPs speak.
|
|
13
|
+
// - `"newline"` — one JSON-RPC message per line, newline-delimited.
|
|
14
|
+
// Alternate convention; some lighter-weight MCPs use this shape.
|
|
15
|
+
//
|
|
16
|
+
// **Lifecycle.** Spawn the child on connector construction (or first
|
|
17
|
+
// dispatch); send `initialize`; cache the `tools_available` manifest
|
|
18
|
+
// from the response. On dispose, send `shutdown` request, then SIGTERM
|
|
19
|
+
// → wait → SIGKILL fallback to prevent orphan processes. Child crash
|
|
20
|
+
// → connector goes to an error state; subsequent dispatch throws
|
|
21
|
+
// DispatchError. No auto-restart in v0.4.1 (deliberate scope choice
|
|
22
|
+
// per the kickoff).
|
|
23
|
+
import { spawn } from "node:child_process";
|
|
24
|
+
import { RUNTIME_VERSION } from "../version.js";
|
|
25
|
+
const CONTRACT_VERSION = "1.0.0";
|
|
26
|
+
/** Connector dispatch error — bridge-side failures surface to skill via this. */
|
|
27
|
+
export class RemoteMcpDispatchError extends Error {
|
|
28
|
+
bridgeCause;
|
|
29
|
+
constructor(message, bridgeCause) {
|
|
30
|
+
super(message);
|
|
31
|
+
this.name = "RemoteMcpDispatchError";
|
|
32
|
+
this.bridgeCause = bridgeCause;
|
|
33
|
+
}
|
|
34
|
+
}
|
|
35
|
+
export class RemoteMcpConnector {
|
|
36
|
+
config;
|
|
37
|
+
static staticCapabilities() {
|
|
38
|
+
return {
|
|
39
|
+
connector_type: "mcp_connector",
|
|
40
|
+
implementation: "RemoteMcpConnector",
|
|
41
|
+
contract_version: CONTRACT_VERSION,
|
|
42
|
+
features: {
|
|
43
|
+
supports_identity_propagation: false,
|
|
44
|
+
supports_streaming_responses: false,
|
|
45
|
+
supports_batch: false,
|
|
46
|
+
},
|
|
47
|
+
};
|
|
48
|
+
}
|
|
49
|
+
/**
|
|
50
|
+
* Closed-set registry factory. Validates config shape, constructs the
|
|
51
|
+
* instance. The spawn + handshake are deferred to first dispatch (or
|
|
52
|
+
* an explicit `start()` call) so config validation can happen
|
|
53
|
+
* synchronously at load time.
|
|
54
|
+
*/
|
|
55
|
+
static fromConfig(config) {
|
|
56
|
+
const command = config["command"];
|
|
57
|
+
const args = config["args"];
|
|
58
|
+
if (typeof command !== "string" || command === "") {
|
|
59
|
+
throw new Error("RemoteMcpConnector config: `command` must be a non-empty string.");
|
|
60
|
+
}
|
|
61
|
+
if (!Array.isArray(args) || !args.every((a) => typeof a === "string")) {
|
|
62
|
+
throw new Error("RemoteMcpConnector config: `args` must be an array of strings.");
|
|
63
|
+
}
|
|
64
|
+
const env = config["env"];
|
|
65
|
+
if (env !== undefined) {
|
|
66
|
+
if (env === null || typeof env !== "object" || Array.isArray(env)) {
|
|
67
|
+
throw new Error("RemoteMcpConnector config: `env` must be an object of string values.");
|
|
68
|
+
}
|
|
69
|
+
for (const [k, v] of Object.entries(env)) {
|
|
70
|
+
if (typeof v !== "string") {
|
|
71
|
+
throw new Error(`RemoteMcpConnector config: env['${k}'] must be a string (got ${typeof v}).`);
|
|
72
|
+
}
|
|
73
|
+
}
|
|
74
|
+
}
|
|
75
|
+
const framing = config["framing"];
|
|
76
|
+
if (framing !== undefined && framing !== "lsp" && framing !== "newline") {
|
|
77
|
+
throw new Error(`RemoteMcpConnector config: \`framing\` must be "lsp" or "newline" (got ${JSON.stringify(framing)}).`);
|
|
78
|
+
}
|
|
79
|
+
return new RemoteMcpConnector({
|
|
80
|
+
command,
|
|
81
|
+
args: args,
|
|
82
|
+
env: env,
|
|
83
|
+
framing: framing,
|
|
84
|
+
});
|
|
85
|
+
}
|
|
86
|
+
child;
|
|
87
|
+
nextRequestId = 1;
|
|
88
|
+
pending = new Map();
|
|
89
|
+
inboundBuffer = Buffer.alloc(0);
|
|
90
|
+
initializePromise;
|
|
91
|
+
toolsAvailable = [];
|
|
92
|
+
errorState;
|
|
93
|
+
framing;
|
|
94
|
+
initTimeoutMs;
|
|
95
|
+
callTimeoutMs;
|
|
96
|
+
shutdownTimeoutMs;
|
|
97
|
+
constructor(config) {
|
|
98
|
+
this.config = config;
|
|
99
|
+
this.framing = config.framing ?? "lsp";
|
|
100
|
+
this.initTimeoutMs = config.initTimeoutMs ?? 10_000;
|
|
101
|
+
this.callTimeoutMs = config.callTimeoutMs ?? 30_000;
|
|
102
|
+
this.shutdownTimeoutMs = config.shutdownTimeoutMs ?? 2_000;
|
|
103
|
+
}
|
|
104
|
+
/**
|
|
105
|
+
* Spawn the child + run the `initialize` handshake. Idempotent;
|
|
106
|
+
* subsequent calls return the same in-flight or completed promise.
|
|
107
|
+
* Called lazily by `call()` on first dispatch.
|
|
108
|
+
*/
|
|
109
|
+
start() {
|
|
110
|
+
if (this.initializePromise !== undefined)
|
|
111
|
+
return this.initializePromise;
|
|
112
|
+
this.initializePromise = this.doStart();
|
|
113
|
+
return this.initializePromise;
|
|
114
|
+
}
|
|
115
|
+
async doStart() {
|
|
116
|
+
const child = spawn(this.config.command, this.config.args, {
|
|
117
|
+
env: { ...process.env, ...this.config.env },
|
|
118
|
+
stdio: ["pipe", "pipe", "pipe"],
|
|
119
|
+
});
|
|
120
|
+
this.child = child;
|
|
121
|
+
child.on("error", (err) => {
|
|
122
|
+
this.errorState = err;
|
|
123
|
+
this.rejectAllPending(new RemoteMcpDispatchError(`child process error: ${err.message}`, err));
|
|
124
|
+
});
|
|
125
|
+
child.on("exit", (code, signal) => {
|
|
126
|
+
this.errorState ??= new Error(`child process exited (code=${code} signal=${signal ?? "none"})`);
|
|
127
|
+
this.rejectAllPending(new RemoteMcpDispatchError(`child process exited mid-request (code=${code} signal=${signal ?? "none"})`));
|
|
128
|
+
});
|
|
129
|
+
child.stderr?.on("data", (chunk) => {
|
|
130
|
+
// Surface child stderr to parent stderr for operator debugging.
|
|
131
|
+
// Most MCP impls write status + errors here.
|
|
132
|
+
process.stderr.write(`[${this.config.command}] ${chunk.toString()}`);
|
|
133
|
+
});
|
|
134
|
+
child.stdout?.on("data", (chunk) => {
|
|
135
|
+
this.inboundBuffer = Buffer.concat([this.inboundBuffer, chunk]);
|
|
136
|
+
this.drainInbound();
|
|
137
|
+
});
|
|
138
|
+
// MCP `initialize` request — spec at modelcontextprotocol.io.
|
|
139
|
+
// Minimal shape: protocolVersion + clientInfo + capabilities.
|
|
140
|
+
const initResult = await this.sendRequest("initialize", {
|
|
141
|
+
protocolVersion: "2024-11-05",
|
|
142
|
+
clientInfo: { name: "skillscript-runtime", version: RUNTIME_VERSION },
|
|
143
|
+
capabilities: {},
|
|
144
|
+
}, this.initTimeoutMs);
|
|
145
|
+
// After initialize, fetch the tools list to populate manifest.
|
|
146
|
+
// tools/list is optional per MCP spec; some servers expose tools
|
|
147
|
+
// via the initialize response directly. Try tools/list; tolerate
|
|
148
|
+
// either shape.
|
|
149
|
+
try {
|
|
150
|
+
const toolsResp = await this.sendRequest("tools/list", undefined, this.callTimeoutMs);
|
|
151
|
+
this.toolsAvailable = (toolsResp.tools ?? [])
|
|
152
|
+
.map((t) => t.name)
|
|
153
|
+
.filter((n) => typeof n === "string");
|
|
154
|
+
}
|
|
155
|
+
catch {
|
|
156
|
+
// tools/list unsupported — leave toolsAvailable empty; manifest
|
|
157
|
+
// will reflect "unknown".
|
|
158
|
+
}
|
|
159
|
+
return initResult;
|
|
160
|
+
}
|
|
161
|
+
async call(toolName, args, _ctxOverrides) {
|
|
162
|
+
if (this.errorState !== undefined) {
|
|
163
|
+
throw new RemoteMcpDispatchError(`RemoteMcpConnector in error state: ${this.errorState.message}`, this.errorState);
|
|
164
|
+
}
|
|
165
|
+
await this.start();
|
|
166
|
+
if (this.errorState !== undefined) {
|
|
167
|
+
throw new RemoteMcpDispatchError(`RemoteMcpConnector in error state after start: ${this.errorState.message}`, this.errorState);
|
|
168
|
+
}
|
|
169
|
+
const result = await this.sendRequest("tools/call", {
|
|
170
|
+
name: toolName,
|
|
171
|
+
arguments: args,
|
|
172
|
+
}, this.callTimeoutMs);
|
|
173
|
+
// MCP convention: `isError: true` indicates inner-tool error even
|
|
174
|
+
// when JSON-RPC succeeded. Surface as DispatchError so the skill's
|
|
175
|
+
// else: / OnError: machinery can catch it (matches the c580de5
|
|
176
|
+
// contract from T1).
|
|
177
|
+
if (result?.isError === true) {
|
|
178
|
+
throw new RemoteMcpDispatchError(`${toolName} returned isError: ${JSON.stringify(result.content)}`);
|
|
179
|
+
}
|
|
180
|
+
// Return the raw JSON-RPC result (including the `{content, isError}`
|
|
181
|
+
// wrapper). Runtime's `unwrapToolResult` does the MCP-convention
|
|
182
|
+
// unwrap: `[{type:"text", text:"<JSON>"}]` → `JSON.parse(text)` so
|
|
183
|
+
// skills get parsed objects bound directly, not a wrapped envelope.
|
|
184
|
+
return result;
|
|
185
|
+
}
|
|
186
|
+
async manifest() {
|
|
187
|
+
await this.start();
|
|
188
|
+
return {
|
|
189
|
+
capabilities_version: "1",
|
|
190
|
+
manifest: {
|
|
191
|
+
kind: "remote",
|
|
192
|
+
command: this.config.command,
|
|
193
|
+
args: this.config.args,
|
|
194
|
+
framing: this.framing,
|
|
195
|
+
tools_available: this.toolsAvailable,
|
|
196
|
+
},
|
|
197
|
+
};
|
|
198
|
+
}
|
|
199
|
+
/**
|
|
200
|
+
* Graceful shutdown. Best-effort `shutdown` JSON-RPC request, then
|
|
201
|
+
* SIGTERM, then SIGKILL fallback after `shutdownTimeoutMs`. Idempotent.
|
|
202
|
+
*/
|
|
203
|
+
async dispose() {
|
|
204
|
+
const child = this.child;
|
|
205
|
+
if (child === undefined || child.exitCode !== null)
|
|
206
|
+
return;
|
|
207
|
+
try {
|
|
208
|
+
// Best-effort; ignore errors — we're shutting down anyway.
|
|
209
|
+
await Promise.race([
|
|
210
|
+
this.sendRequest("shutdown", undefined, 1000),
|
|
211
|
+
new Promise((resolve) => setTimeout(resolve, 500)),
|
|
212
|
+
]);
|
|
213
|
+
}
|
|
214
|
+
catch {
|
|
215
|
+
// Ignore.
|
|
216
|
+
}
|
|
217
|
+
if (child.exitCode !== null)
|
|
218
|
+
return;
|
|
219
|
+
child.kill("SIGTERM");
|
|
220
|
+
await new Promise((resolve) => {
|
|
221
|
+
const timeoutHandle = setTimeout(() => {
|
|
222
|
+
if (child.exitCode === null)
|
|
223
|
+
child.kill("SIGKILL");
|
|
224
|
+
resolve();
|
|
225
|
+
}, this.shutdownTimeoutMs);
|
|
226
|
+
child.once("exit", () => {
|
|
227
|
+
clearTimeout(timeoutHandle);
|
|
228
|
+
resolve();
|
|
229
|
+
});
|
|
230
|
+
});
|
|
231
|
+
}
|
|
232
|
+
/** For tests + observability — names of tools surfaced by the initialize handshake. */
|
|
233
|
+
getToolsAvailable() {
|
|
234
|
+
return this.toolsAvailable;
|
|
235
|
+
}
|
|
236
|
+
// ─── Internal: JSON-RPC plumbing ────────────────────────────────────────
|
|
237
|
+
sendRequest(method, params, timeoutMs) {
|
|
238
|
+
if (this.child === undefined) {
|
|
239
|
+
throw new RemoteMcpDispatchError(`sendRequest('${method}') called before start()`);
|
|
240
|
+
}
|
|
241
|
+
if (this.child.exitCode !== null) {
|
|
242
|
+
throw new RemoteMcpDispatchError(`sendRequest('${method}') after child exit (code=${this.child.exitCode})`);
|
|
243
|
+
}
|
|
244
|
+
const id = this.nextRequestId++;
|
|
245
|
+
const request = {
|
|
246
|
+
jsonrpc: "2.0",
|
|
247
|
+
id,
|
|
248
|
+
method,
|
|
249
|
+
...(params !== undefined ? { params } : {}),
|
|
250
|
+
};
|
|
251
|
+
const encoded = this.encodeFrame(request);
|
|
252
|
+
return new Promise((resolve, reject) => {
|
|
253
|
+
const timeoutHandle = setTimeout(() => {
|
|
254
|
+
this.pending.delete(id);
|
|
255
|
+
reject(new RemoteMcpDispatchError(`${method} timed out after ${timeoutMs}ms`));
|
|
256
|
+
}, timeoutMs);
|
|
257
|
+
this.pending.set(id, { resolve, reject, timeoutHandle });
|
|
258
|
+
this.child.stdin?.write(encoded, (err) => {
|
|
259
|
+
if (err !== null && err !== undefined) {
|
|
260
|
+
clearTimeout(timeoutHandle);
|
|
261
|
+
this.pending.delete(id);
|
|
262
|
+
reject(new RemoteMcpDispatchError(`stdin write failed for ${method}: ${err.message}`, err));
|
|
263
|
+
}
|
|
264
|
+
});
|
|
265
|
+
});
|
|
266
|
+
}
|
|
267
|
+
encodeFrame(msg) {
|
|
268
|
+
const body = JSON.stringify(msg);
|
|
269
|
+
if (this.framing === "lsp") {
|
|
270
|
+
return `Content-Length: ${Buffer.byteLength(body, "utf8")}\r\n\r\n${body}`;
|
|
271
|
+
}
|
|
272
|
+
return `${body}\n`;
|
|
273
|
+
}
|
|
274
|
+
drainInbound() {
|
|
275
|
+
if (this.framing === "lsp")
|
|
276
|
+
this.drainLsp();
|
|
277
|
+
else
|
|
278
|
+
this.drainNewline();
|
|
279
|
+
}
|
|
280
|
+
drainLsp() {
|
|
281
|
+
while (true) {
|
|
282
|
+
const headerEnd = this.inboundBuffer.indexOf("\r\n\r\n");
|
|
283
|
+
if (headerEnd < 0)
|
|
284
|
+
return;
|
|
285
|
+
const headers = this.inboundBuffer.slice(0, headerEnd).toString("utf8");
|
|
286
|
+
const match = /Content-Length:\s*(\d+)/i.exec(headers);
|
|
287
|
+
if (match === null) {
|
|
288
|
+
// Malformed header — drop everything up to the separator and try again.
|
|
289
|
+
this.inboundBuffer = this.inboundBuffer.slice(headerEnd + 4);
|
|
290
|
+
continue;
|
|
291
|
+
}
|
|
292
|
+
const len = Number(match[1]);
|
|
293
|
+
const bodyStart = headerEnd + 4;
|
|
294
|
+
if (this.inboundBuffer.length < bodyStart + len)
|
|
295
|
+
return; // incomplete; wait for more
|
|
296
|
+
const body = this.inboundBuffer.slice(bodyStart, bodyStart + len).toString("utf8");
|
|
297
|
+
this.inboundBuffer = this.inboundBuffer.slice(bodyStart + len);
|
|
298
|
+
this.handleInboundMessage(body);
|
|
299
|
+
}
|
|
300
|
+
}
|
|
301
|
+
drainNewline() {
|
|
302
|
+
while (true) {
|
|
303
|
+
const nlIdx = this.inboundBuffer.indexOf("\n");
|
|
304
|
+
if (nlIdx < 0)
|
|
305
|
+
return;
|
|
306
|
+
const line = this.inboundBuffer.slice(0, nlIdx).toString("utf8").trim();
|
|
307
|
+
this.inboundBuffer = this.inboundBuffer.slice(nlIdx + 1);
|
|
308
|
+
if (line !== "")
|
|
309
|
+
this.handleInboundMessage(line);
|
|
310
|
+
}
|
|
311
|
+
}
|
|
312
|
+
handleInboundMessage(raw) {
|
|
313
|
+
let msg;
|
|
314
|
+
try {
|
|
315
|
+
msg = JSON.parse(raw);
|
|
316
|
+
}
|
|
317
|
+
catch (err) {
|
|
318
|
+
process.stderr.write(`[RemoteMcpConnector] malformed JSON from child: ${raw.slice(0, 200)}\n`);
|
|
319
|
+
return;
|
|
320
|
+
}
|
|
321
|
+
if (msg.id === undefined)
|
|
322
|
+
return; // notification — ignore for now
|
|
323
|
+
const pending = this.pending.get(msg.id);
|
|
324
|
+
if (pending === undefined)
|
|
325
|
+
return; // unknown id — ignore
|
|
326
|
+
this.pending.delete(msg.id);
|
|
327
|
+
clearTimeout(pending.timeoutHandle);
|
|
328
|
+
if (msg.error !== undefined) {
|
|
329
|
+
pending.reject(new RemoteMcpDispatchError(`JSON-RPC error ${msg.error.code}: ${msg.error.message}`, msg.error));
|
|
330
|
+
return;
|
|
331
|
+
}
|
|
332
|
+
pending.resolve(msg.result);
|
|
333
|
+
}
|
|
334
|
+
rejectAllPending(err) {
|
|
335
|
+
for (const [id, pending] of this.pending) {
|
|
336
|
+
clearTimeout(pending.timeoutHandle);
|
|
337
|
+
pending.reject(err);
|
|
338
|
+
this.pending.delete(id);
|
|
339
|
+
}
|
|
340
|
+
}
|
|
341
|
+
}
|
|
342
|
+
//# sourceMappingURL=mcp-remote.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"mcp-remote.js","sourceRoot":"","sources":["../../src/connectors/mcp-remote.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,oEAAoE;AACpE,sEAAsE;AACtE,uEAAuE;AACvE,sBAAsB;AACtB,EAAE;AACF,kEAAkE;AAClE,yBAAyB;AACzB,EAAE;AACF,6DAA6D;AAC7D,oEAAoE;AACpE,iEAAiE;AACjE,sEAAsE;AACtE,qEAAqE;AACrE,EAAE;AACF,qEAAqE;AACrE,qEAAqE;AACrE,uEAAuE;AACvE,qEAAqE;AACrE,iEAAiE;AACjE,oEAAoE;AACpE,oBAAoB;AAEpB,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAQhD,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAkDjC,iFAAiF;AACjF,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/B,WAAW,CAAU;IACrC,YAAY,OAAe,EAAE,WAAqB;QAChD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AAED,MAAM,OAAO,kBAAkB;IAgEA;IA/D7B,MAAM,CAAC,kBAAkB;QACvB,OAAO;YACL,cAAc,EAAE,eAAe;YAC/B,cAAc,EAAE,oBAAoB;YACpC,gBAAgB,EAAE,gBAAgB;YAClC,QAAQ,EAAE;gBACR,6BAA6B,EAAE,KAAK;gBACpC,4BAA4B,EAAE,KAAK;gBACnC,cAAc,EAAE,KAAK;aACtB;SACF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,UAAU,CAAC,MAA+B;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;YAC1F,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;oBAC1B,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,4BAA4B,OAAO,CAAC,IAAI,CAAC,CAAC;gBAChG,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,0EAA0E,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzH,CAAC;QACD,OAAO,IAAI,kBAAkB,CAAC;YAC5B,OAAO;YACP,IAAI,EAAE,IAAgB;YACtB,GAAG,EAAE,GAAyC;YAC9C,OAAO,EAAE,OAAuC;SACjD,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAA2B;IAChC,aAAa,GAAG,CAAC,CAAC;IAClB,OAAO,GAAG,IAAI,GAAG,EAAgC,CAAC;IAClD,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,iBAAiB,CAA+B;IAChD,cAAc,GAAa,EAAE,CAAC;IAC9B,UAAU,CAAoB;IACrB,OAAO,CAAmB;IAC1B,aAAa,CAAS;IACtB,aAAa,CAAS;IACtB,iBAAiB,CAAS;IAE3C,YAA6B,MAAuB;QAAvB,WAAM,GAAN,MAAM,CAAiB;QAClD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC;QACvC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC;QACpD,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC;QACpD,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,KAAK,CAAC;IAC7D,CAAC;IAED;;;;OAIG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC;QACxE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YACzD,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YAC3C,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QAEnB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC;YACtB,IAAI,CAAC,gBAAgB,CAAC,IAAI,sBAAsB,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QAChG,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAChC,IAAI,CAAC,UAAU,KAAK,IAAI,KAAK,CAAC,8BAA8B,IAAI,WAAW,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC;YAChG,IAAI,CAAC,gBAAgB,CAAC,IAAI,sBAAsB,CAAC,0CAA0C,IAAI,WAAW,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC;QAClI,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,gEAAgE;YAChE,6CAA6C;YAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC;YAChE,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,8DAA8D;QAC9D,8DAA8D;QAC9D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE;YACtD,eAAe,EAAE,YAAY;YAC7B,UAAU,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,eAAe,EAAE;YACrE,YAAY,EAAE,EAAE;SACjB,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAEvB,+DAA+D;QAC/D,iEAAiE;QACjE,iEAAiE;QACjE,gBAAgB;QAChB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,CAEnF,CAAC;YACF,IAAI,CAAC,cAAc,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;iBAC1C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;iBAClB,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;YAChE,0BAA0B;QAC5B,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,IAAI,CACR,QAAgB,EAChB,IAA6B,EAC7B,aAA8B;QAE9B,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACrH,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,sBAAsB,CAAC,kDAAmD,IAAI,CAAC,UAAoB,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5I,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE;YAClD,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,IAAI;SAChB,EAAE,IAAI,CAAC,aAAa,CAA6C,CAAC;QAEnE,kEAAkE;QAClE,mEAAmE;QACnE,+DAA+D;QAC/D,qBAAqB;QACrB,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,sBAAsB,CAAC,GAAG,QAAQ,sBAAsB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,qEAAqE;QACrE,iEAAiE;QACjE,mEAAmE;QACnE,oEAAoE;QACpE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO;YACL,oBAAoB,EAAE,GAAG;YACzB,QAAQ,EAAE;gBACR,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;gBAC5B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;gBACtB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,eAAe,EAAE,IAAI,CAAC,cAAc;aACrC;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;YAAE,OAAO;QAC3D,IAAI,CAAC;YACH,2DAA2D;YAC3D,MAAM,OAAO,CAAC,IAAI,CAAC;gBACjB,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC;gBAC7C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,UAAU;QACZ,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;YAAE,OAAO;QACpC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;gBACpC,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;oBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACnD,OAAO,EAAE,CAAC;YACZ,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;gBACtB,YAAY,CAAC,aAAa,CAAC,CAAC;gBAC5B,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,uFAAuF;IACvF,iBAAiB;QACf,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED,2EAA2E;IAEnE,WAAW,CAAC,MAAc,EAAE,MAA2C,EAAE,SAAiB;QAChG,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,sBAAsB,CAAC,gBAAgB,MAAM,0BAA0B,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,sBAAsB,CAAC,gBAAgB,MAAM,6BAA6B,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC9G,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAChC,MAAM,OAAO,GAAmB;YAC9B,OAAO,EAAE,KAAK;YACd,EAAE;YACF,MAAM;YACN,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;gBACpC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,sBAAsB,CAAC,GAAG,MAAM,oBAAoB,SAAS,IAAI,CAAC,CAAC,CAAC;YACjF,CAAC,EAAE,SAAS,CAAC,CAAC;YACd,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;YACzD,IAAI,CAAC,KAAM,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACxC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;oBACtC,YAAY,CAAC,aAAa,CAAC,CAAC;oBAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBACxB,MAAM,CAAC,IAAI,sBAAsB,CAAC,0BAA0B,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC9F,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,WAAW,CAAC,GAAmB;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC3B,OAAO,mBAAmB,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;QAC7E,CAAC;QACD,OAAO,GAAG,IAAI,IAAI,CAAC;IACrB,CAAC;IAEO,YAAY;QAClB,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;YAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;;YACvC,IAAI,CAAC,YAAY,EAAE,CAAC;IAC3B,CAAC;IAEO,QAAQ;QACd,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACzD,IAAI,SAAS,GAAG,CAAC;gBAAE,OAAO;YAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACxE,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,wEAAwE;gBACxE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;gBAC7D,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC;YAChC,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,SAAS,GAAG,GAAG;gBAAE,OAAO,CAAC,4BAA4B;YACrF,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnF,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;YAC/D,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,KAAK,GAAG,CAAC;gBAAE,OAAO;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACxE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACzD,IAAI,IAAI,KAAK,EAAE;gBAAE,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,GAAW;QACtC,IAAI,GAAoB,CAAC;QACzB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/F,OAAO;QACT,CAAC;QACD,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS;YAAE,OAAO,CAAC,gCAAgC;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,CAAC,sBAAsB;QACzD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACpC,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,IAAI,sBAAsB,CAAC,kBAAkB,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YAChH,OAAO;QACT,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAEO,gBAAgB,CAAC,GAAU;QACjC,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACzC,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACpC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;CACF"}
|
|
@@ -9,7 +9,15 @@ export declare class Registry {
|
|
|
9
9
|
registerSkillStore(name: string, instance: SkillStore): void;
|
|
10
10
|
registerMemoryStore(name: string, instance: MemoryStore): void;
|
|
11
11
|
registerLocalModel(name: string, instance: LocalModel): void;
|
|
12
|
-
registerMcpConnector(name: string, instance: McpConnector): void;
|
|
12
|
+
registerMcpConnector(name: string, instance: McpConnector, allowedTools?: string[]): void;
|
|
13
|
+
/**
|
|
14
|
+
* Returns the per-connector allowlist or `undefined` if no allowlist is
|
|
15
|
+
* configured (allow-all semantics, v0.4.0 backward-compat). v0.4.1
|
|
16
|
+
* `disallowed-tool` lint + runtime defense-in-depth consult this.
|
|
17
|
+
*/
|
|
18
|
+
getMcpConnectorAllowedTools(name: string): string[] | undefined;
|
|
19
|
+
/** True iff `toolName` is permitted by `name`'s allowlist (or no allowlist is configured). */
|
|
20
|
+
isToolAllowed(name: string, toolName: string): boolean;
|
|
13
21
|
registerAgentConnector(name: string, instance: AgentConnector): void;
|
|
14
22
|
getSkillStore(name?: string): SkillStore;
|
|
15
23
|
getMemoryStore(name?: string): MemoryStore;
|
|
@@ -52,6 +60,7 @@ export declare class Registry {
|
|
|
52
60
|
name: string;
|
|
53
61
|
instance: McpConnector;
|
|
54
62
|
ctor: McpConnectorClass;
|
|
63
|
+
allowedTools?: string[];
|
|
55
64
|
}>;
|
|
56
65
|
listAgentConnectors(): Array<{
|
|
57
66
|
name: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/connectors/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/connectors/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAyCtE,qBAAa,QAAQ;IACnB,OAAO,CAAC,WAAW,CAAyD;IAC5E,OAAO,CAAC,YAAY,CAA2D;IAC/E,OAAO,CAAC,WAAW,CAAyD;IAC5E,OAAO,CAAC,aAAa,CAA+B;IACpD,OAAO,CAAC,eAAe,CAAiE;IAIxF,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,GAAG,IAAI;IAI5D,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,GAAG,IAAI;IAI9D,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,GAAG,IAAI;IAI5D,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI;IAQzF;;;;OAIG;IACH,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS;IAI/D,8FAA8F;IAC9F,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO;IAMtD,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI;IAMpE,aAAa,CAAC,IAAI,SAAY,GAAG,UAAU;IAG3C,cAAc,CAAC,IAAI,SAAY,GAAG,WAAW;IAG7C,aAAa,CAAC,IAAI,SAAY,GAAG,UAAU;IAG3C,eAAe,CAAC,IAAI,SAAY,GAAG,YAAY;IAG/C;;;;;;OAMG;IACH,iBAAiB,CAAC,IAAI,SAAY,GAAG,cAAc;IAQnD,kBAAkB,CAAC,IAAI,SAAY,GAAG,eAAe;IAGrD,mBAAmB,CAAC,IAAI,SAAY,GAAG,gBAAgB;IAGvD,kBAAkB,CAAC,IAAI,SAAY,GAAG,eAAe;IAGrD,oBAAoB,CAAC,IAAI,SAAY,GAAG,iBAAiB;IAGzD,sBAAsB,CAAC,IAAI,SAAY,GAAG,mBAAmB;IAQ7D,qBAAqB,IAAI,eAAe,EAAE;IAC1C,sBAAsB,IAAI,gBAAgB,EAAE;IAC5C,qBAAqB,IAAI,eAAe,EAAE;IAC1C,uBAAuB,IAAI,iBAAiB,EAAE;IAC9C,yBAAyB,IAAI,mBAAmB,EAAE;IAOlD,eAAe,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,UAAU,CAAC;QAAC,IAAI,EAAE,eAAe,CAAA;KAAE,CAAC;IACvF,gBAAgB,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,WAAW,CAAC;QAAC,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC;IAC1F,eAAe,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,UAAU,CAAC;QAAC,IAAI,EAAE,eAAe,CAAA;KAAE,CAAC;IACvF,iBAAiB,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,YAAY,CAAC;QAAC,IAAI,EAAE,iBAAiB,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAYtH,mBAAmB,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,cAAc,CAAC;QAAC,IAAI,EAAE,mBAAmB,CAAA;KAAE,CAAC;IAInG;;;;;OAKG;IACH,wBAAwB,IAAI,kBAAkB,EAAE;IAYhD,aAAa,CAAC,IAAI,SAAY,GAAG,OAAO;IACxC,cAAc,CAAC,IAAI,SAAY,GAAG,OAAO;IACzC,aAAa,CAAC,IAAI,SAAY,GAAG,OAAO;IACxC,eAAe,CAAC,IAAI,SAAY,GAAG,OAAO;IAC1C,iBAAiB,CAAC,IAAI,SAAY,GAAG,OAAO;CAC7C"}
|
|
@@ -15,8 +15,27 @@ export class Registry {
|
|
|
15
15
|
registerLocalModel(name, instance) {
|
|
16
16
|
this.localModels.set(name, { instance, ctor: ctorOf(instance) });
|
|
17
17
|
}
|
|
18
|
-
registerMcpConnector(name, instance) {
|
|
19
|
-
this.mcpConnectors.set(name, {
|
|
18
|
+
registerMcpConnector(name, instance, allowedTools) {
|
|
19
|
+
this.mcpConnectors.set(name, {
|
|
20
|
+
instance,
|
|
21
|
+
ctor: ctorOf(instance),
|
|
22
|
+
...(allowedTools !== undefined ? { allowedTools: [...allowedTools] } : {}),
|
|
23
|
+
});
|
|
24
|
+
}
|
|
25
|
+
/**
|
|
26
|
+
* Returns the per-connector allowlist or `undefined` if no allowlist is
|
|
27
|
+
* configured (allow-all semantics, v0.4.0 backward-compat). v0.4.1
|
|
28
|
+
* `disallowed-tool` lint + runtime defense-in-depth consult this.
|
|
29
|
+
*/
|
|
30
|
+
getMcpConnectorAllowedTools(name) {
|
|
31
|
+
return this.mcpConnectors.get(name)?.allowedTools;
|
|
32
|
+
}
|
|
33
|
+
/** True iff `toolName` is permitted by `name`'s allowlist (or no allowlist is configured). */
|
|
34
|
+
isToolAllowed(name, toolName) {
|
|
35
|
+
const allowed = this.getMcpConnectorAllowedTools(name);
|
|
36
|
+
if (allowed === undefined)
|
|
37
|
+
return true;
|
|
38
|
+
return allowed.includes(toolName);
|
|
20
39
|
}
|
|
21
40
|
registerAgentConnector(name, instance) {
|
|
22
41
|
this.agentConnectors.set(name, { instance, ctor: ctorOf(instance) });
|
|
@@ -79,7 +98,18 @@ export class Registry {
|
|
|
79
98
|
listSkillStores() { return entries(this.skillStores); }
|
|
80
99
|
listMemoryStores() { return entries(this.memoryStores); }
|
|
81
100
|
listLocalModels() { return entries(this.localModels); }
|
|
82
|
-
listMcpConnectors() {
|
|
101
|
+
listMcpConnectors() {
|
|
102
|
+
const out = [];
|
|
103
|
+
for (const [name, entry] of this.mcpConnectors) {
|
|
104
|
+
out.push({
|
|
105
|
+
name,
|
|
106
|
+
instance: entry.instance,
|
|
107
|
+
ctor: entry.ctor,
|
|
108
|
+
...(entry.allowedTools !== undefined ? { allowedTools: entry.allowedTools } : {}),
|
|
109
|
+
});
|
|
110
|
+
}
|
|
111
|
+
return out;
|
|
112
|
+
}
|
|
83
113
|
listAgentConnectors() { return entries(this.agentConnectors); }
|
|
84
114
|
// ─── Aggregate view for the linter ──────────────────────────────────────
|
|
85
115
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/connectors/registry.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;
|
|
1
|
+
{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/connectors/registry.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAwCrD,MAAM,OAAO,QAAQ;IACX,WAAW,GAAG,IAAI,GAAG,EAA8C,CAAC;IACpE,YAAY,GAAG,IAAI,GAAG,EAAgD,CAAC;IACvE,WAAW,GAAG,IAAI,GAAG,EAA8C,CAAC;IACpE,aAAa,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC5C,eAAe,GAAG,IAAI,GAAG,EAAsD,CAAC;IAExF,2EAA2E;IAE3E,kBAAkB,CAAC,IAAY,EAAE,QAAoB;QACnD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAoB,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,mBAAmB,CAAC,IAAY,EAAE,QAAqB;QACrD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAqB,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,kBAAkB,CAAC,IAAY,EAAE,QAAoB;QACnD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAoB,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,oBAAoB,CAAC,IAAY,EAAE,QAAsB,EAAE,YAAuB;QAChF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE;YAC3B,QAAQ;YACR,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAsB;YAC3C,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3E,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,2BAA2B,CAAC,IAAY;QACtC,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;IACpD,CAAC;IAED,8FAA8F;IAC9F,aAAa,CAAC,IAAY,EAAE,QAAgB;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,sBAAsB,CAAC,IAAY,EAAE,QAAwB;QAC3D,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAwB,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,2EAA2E;IAE3E,aAAa,CAAC,IAAI,GAAG,SAAS;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC;IAC7D,CAAC;IACD,cAAc,CAAC,IAAI,GAAG,SAAS;QAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC;IAC/D,CAAC;IACD,aAAa,CAAC,IAAI,GAAG,SAAS;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC;IAC7D,CAAC;IACD,eAAe,CAAC,IAAI,GAAG,SAAS;QAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC;IACjE,CAAC;IACD;;;;;;OAMG;IACH,iBAAiB,CAAC,IAAI,GAAG,SAAS;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,QAAQ,CAAC;QAC/C,OAAO,uBAAuB,CAAC;IACjC,CAAC;IAED,2EAA2E;IAE3E,kBAAkB,CAAC,IAAI,GAAG,SAAS;QACjC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC;IACzD,CAAC;IACD,mBAAmB,CAAC,IAAI,GAAG,SAAS;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC;IAC3D,CAAC;IACD,kBAAkB,CAAC,IAAI,GAAG,SAAS;QACjC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC;IACzD,CAAC;IACD,oBAAoB,CAAC,IAAI,GAAG,SAAS;QACnC,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC;IAC7D,CAAC;IACD,sBAAsB,CAAC,IAAI,GAAG,SAAS;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC;QAC3C,OAAO,kBAAoD,CAAC;IAC9D,CAAC;IAED,2EAA2E;IAE3E,qBAAqB,KAAwB,OAAO,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACjF,sBAAsB,KAAyB,OAAO,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACpF,qBAAqB,KAAwB,OAAO,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACjF,uBAAuB,KAA0B,OAAO,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACvF,yBAAyB,KAA4B,OAAO,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAE7F,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,8DAA8D;IAE9D,eAAe,KAA2E,OAAO,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC7H,gBAAgB,KAA6E,OAAO,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACjI,eAAe,KAA2E,OAAO,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC7H,iBAAiB;QACf,MAAM,GAAG,GAAsG,EAAE,CAAC;QAClH,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI;gBACJ,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,mBAAmB,KAAmF,OAAO,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAE7I,2EAA2E;IAE3E;;;;;OAKG;IACH,wBAAwB;QACtB,OAAO;YACL,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;YAClE,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;YACnE,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;YAClE,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;YACpE,GAAG,IAAI,CAAC,yBAAyB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;SACvE,CAAC;IACJ,CAAC;IAED,2EAA2E;IAE3E,aAAa,CAAC,IAAI,GAAG,SAAS,IAAa,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/E,cAAc,CAAC,IAAI,GAAG,SAAS,IAAa,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjF,aAAa,CAAC,IAAI,GAAG,SAAS,IAAa,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/E,eAAe,CAAC,IAAI,GAAG,SAAS,IAAa,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnF,iBAAiB,CAAC,IAAI,GAAG,SAAS,IAAa,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;CACxF;AAED,MAAM,uBAAuB,GAAmB,IAAI,kBAAkB,EAAE,CAAC;AAEzE,SAAS,MAAM,CAAC,QAAgB;IAC9B,OAAO,QAAQ,CAAC,WAAW,CAAC;AAC9B,CAAC;AAED,SAAS,IAAI,CAAO,GAA6B,EAAE,IAAY,EAAE,IAAY;IAC3E,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,KAAK,IAAI,iCAAiC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,GAAG,CAClG,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAO,GAA6B;IACnD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAK,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE;QAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,OAAO,CAAO,GAA6B;IAClD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACtG,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"help-content.d.ts","sourceRoot":"","sources":["../src/help-content.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;
|
|
1
|
+
{"version":3,"file":"help-content.d.ts","sourceRoot":"","sources":["../src/help-content.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAwmBzD,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,EACpB,cAAc,EAAE,MAAM,EACtB,QAAQ,CAAC,EAAE,QAAQ,GAClB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAqBzB"}
|
package/dist/help-content.js
CHANGED
|
@@ -614,6 +614,7 @@ Three tiers per ERD §3:
|
|
|
614
614
|
- \`plugin-collision\` — placeholder for v1.x plugin-loader name conflicts
|
|
615
615
|
- \`deferred-skill-reference\` — composition ref (\`&\` / \`$ execute_skill\` / \`# Templates:\`) targets a skill not currently in the SkillStore; resolution deferred to execute time (v0.3.1+). Confirms the forward-reference path is engaged; clears once the target is stored.
|
|
616
616
|
- \`unparsed-json-field-access\` — op text contains \`$(VAR|json_parse).field\`; the \`|json_parse\` filter was removed in v0.3.3. Replace with \`$ json_parse $(VAR) -> P\` then \`$(P.field)\`.
|
|
617
|
+
- \`disallowed-tool\` (tier-1, v0.4.1) — \`$ name.tool\` references a tool not in the connector's \`allowed_tools\` allowlist. Either rewrite the skill to use a permitted tool or update \`connectors.json\` to grant access. Runtime defense-in-depth refuses disallowed dispatch even if lint is bypassed.
|
|
617
618
|
|
|
618
619
|
\`compile_skill({source})\` runs the full lint preflight and reports
|
|
619
620
|
findings in the \`errors\` + \`warnings\` arrays. \`lint_skill({source})\`
|
package/dist/help-content.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"help-content.js","sourceRoot":"","sources":["../src/help-content.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,kEAAkE;AAClE,qEAAqE;AACrE,2BAA2B;AAC3B,EAAE;AACF,kBAAkB;AAClB,0EAA0E;AAC1E,+DAA+D;AAC/D,uCAAuC;AACvC,kFAAkF;AAClF,kFAAkF;AAClF,uDAAuD;AACvD,EAAE;AACF,uEAAuE;AACvE,yDAAyD;AAIzD,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmGlB,CAAC;AAEF,MAAM,GAAG,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4JX,CAAC;AAEF,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiFnB,CAAC;AAEF,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqHhB,CAAC;AAEF,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8DnB,CAAC;AAEF,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;CA0B3B,CAAC;AAEF,MAAM,UAAU,GAAG
|
|
1
|
+
{"version":3,"file":"help-content.js","sourceRoot":"","sources":["../src/help-content.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,kEAAkE;AAClE,qEAAqE;AACrE,2BAA2B;AAC3B,EAAE;AACF,kBAAkB;AAClB,0EAA0E;AAC1E,+DAA+D;AAC/D,uCAAuC;AACvC,kFAAkF;AAClF,kFAAkF;AAClF,uDAAuD;AACvD,EAAE;AACF,uEAAuE;AACvE,yDAAyD;AAIzD,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmGlB,CAAC;AAEF,MAAM,GAAG,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4JX,CAAC;AAEF,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiFnB,CAAC;AAEF,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqHhB,CAAC;AAEF,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8DnB,CAAC;AAEF,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;CA0B3B,CAAC;AAEF,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2DlB,CAAC;AAEF,MAAM,UAAU,YAAY,CAC1B,KAAoB,EACpB,cAAsB,EACtB,QAAmB;IAEnB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO;YACL,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,cAAc;YACvB,OAAO,EAAE,UAAU;YACnB,gBAAgB,EAAE,CAAC,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,CAAC;SAChG,CAAC;IACJ,CAAC;IACD,IAAI,OAAe,CAAC;IACpB,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,KAAK;YAAU,OAAO,GAAG,GAAG,CAAC;YAAC,MAAM;QACzC,KAAK,aAAa;YAAE,OAAO,GAAG,WAAW,CAAC;YAAC,MAAM;QACjD,KAAK,UAAU;YAAK,OAAO,GAAG,QAAQ,CAAC;YAAC,MAAM;QAC9C,KAAK,aAAa;YAAE,OAAO,GAAG,WAAW,CAAC;YAAC,MAAM;QACjD,KAAK,YAAY;YAAG,OAAO,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAAC,MAAM;QACrE,KAAK,YAAY;YAAG,OAAO,GAAG,UAAU,CAAC;YAAC,MAAM;QAChD;YACE,OAAO,GAAG,oBAAoB,KAAK,oFAAoF,CAAC;IAC5H,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAmB;IAChD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,mBAAmB,CAAC;IACvD,MAAM,OAAO,GAAa;QACxB,4BAA4B;QAC5B,EAAE;QACF,mEAAmE;QACnE,EAAE;KACH,CAAC;IACF,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,EAAE,CAAC;IACtC,MAAM,EAAE,GAAG,QAAQ,CAAC,gBAAgB,EAAE,CAAC;IACvC,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,EAAE,CAAC;IACtC,MAAM,EAAE,GAAG,QAAQ,CAAC,iBAAiB,EAAE,CAAC;IACxC,MAAM,EAAE,GAAG,QAAQ,CAAC,mBAAmB,EAAE,CAAC;IAC1C,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtH,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvH,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChG,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxH,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7I,OAAO,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC"}
|
package/dist/lint.d.ts
CHANGED
|
@@ -86,6 +86,15 @@ export interface LintOptions {
|
|
|
86
86
|
* registry is provided.
|
|
87
87
|
*/
|
|
88
88
|
mcpConnectorNames?: string[];
|
|
89
|
+
/**
|
|
90
|
+
* Per-connector tool allowlists (v0.4.1). Map of connector name to
|
|
91
|
+
* the list of tool names that connector permits. `disallowed-tool`
|
|
92
|
+
* lint fires tier-1 on `$ name.tool` where `tool` isn't in the list.
|
|
93
|
+
* Connectors not in this map (or with `undefined` value) are treated
|
|
94
|
+
* as allow-all. Derived from `registry` when only the registry is
|
|
95
|
+
* provided.
|
|
96
|
+
*/
|
|
97
|
+
mcpConnectorAllowedTools?: Map<string, string[]>;
|
|
89
98
|
/**
|
|
90
99
|
* Errors from `connectors.json` load pass (v0.4.0). When provided,
|
|
91
100
|
* `unknown-connector-class` lint rule re-surfaces the subset of these
|
|
@@ -106,6 +115,7 @@ interface LintContext {
|
|
|
106
115
|
enableUnsafeShell: boolean | undefined;
|
|
107
116
|
mcpConnectorNames: string[] | undefined;
|
|
108
117
|
connectorConfigErrors: string[];
|
|
118
|
+
mcpConnectorAllowedTools: Map<string, string[]>;
|
|
109
119
|
}
|
|
110
120
|
export interface LintRule {
|
|
111
121
|
id: string;
|
package/dist/lint.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../src/lint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,KAAK,WAAW,EAAgB,MAAM,aAAa,CAAC;AAEpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAExD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,YAAY,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,kBAAkB,IAAI,kBAAkB,CAAA;KAAE,CAAC,CAAC;IAC9D,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,mBAAmB,CAAC;IAC/C;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC;AAED,UAAU,WAAW;IACnB,MAAM,EAAE,WAAW,CAAC;IACpB,iBAAiB,EAAE,KAAK,CAAC;QAAE,kBAAkB,IAAI,kBAAkB,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAC9E,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;IACnC,aAAa,EAAE,OAAO,CAAC;IACvB,QAAQ,EAAE,KAAK,GAAG,KAAK,GAAG,mBAAmB,CAAC;IAC9C,iBAAiB,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,iBAAiB,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACxC,qBAAqB,EAAE,MAAM,EAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"lint.d.ts","sourceRoot":"","sources":["../src/lint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,KAAK,WAAW,EAAgB,MAAM,aAAa,CAAC;AAEpE,OAAO,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAExD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,YAAY,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,kBAAkB,IAAI,kBAAkB,CAAA;KAAE,CAAC,CAAC;IAC9D,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,mBAAmB,CAAC;IAC/C;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B;;;;;;;OAOG;IACH,wBAAwB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC;AAED,UAAU,WAAW;IACnB,MAAM,EAAE,WAAW,CAAC;IACpB,iBAAiB,EAAE,KAAK,CAAC;QAAE,kBAAkB,IAAI,kBAAkB,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAC9E,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;IACnC,aAAa,EAAE,OAAO,CAAC;IACvB,QAAQ,EAAE,KAAK,GAAG,KAAK,GAAG,mBAAmB,CAAC;IAC9C,iBAAiB,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,iBAAiB,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACxC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,wBAAwB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,YAAY,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,GAAG,EAAE,WAAW,GAAG,WAAW,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAChE,WAAW,EAAE,MAAM,CAAC;CACrB;AAID,wBAAsB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAoCrF;AAED,kFAAkF;AAClF,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,UAAU,CAmC1E;AAED,6HAA6H;AAC7H,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAW3D;AAozCD,mFAAmF;AACnF,wBAAgB,SAAS,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAElE"}
|
package/dist/lint.js
CHANGED
|
@@ -12,6 +12,7 @@ export async function lint(source, options) {
|
|
|
12
12
|
enableUnsafeShell: options?.enableUnsafeShell,
|
|
13
13
|
mcpConnectorNames: options?.mcpConnectorNames ?? collectMcpConnectorNamesFromRegistry(options?.registry),
|
|
14
14
|
connectorConfigErrors: options?.connectorConfigErrors ?? [],
|
|
15
|
+
mcpConnectorAllowedTools: options?.mcpConnectorAllowedTools ?? collectMcpConnectorAllowedToolsFromRegistry(options?.registry),
|
|
15
16
|
};
|
|
16
17
|
const findings = [];
|
|
17
18
|
for (const rule of RULES) {
|
|
@@ -47,6 +48,7 @@ export function lintSync(source, options) {
|
|
|
47
48
|
enableUnsafeShell: options?.enableUnsafeShell,
|
|
48
49
|
mcpConnectorNames: options?.mcpConnectorNames ?? collectMcpConnectorNamesFromRegistry(options?.registry),
|
|
49
50
|
connectorConfigErrors: options?.connectorConfigErrors ?? [],
|
|
51
|
+
mcpConnectorAllowedTools: options?.mcpConnectorAllowedTools ?? collectMcpConnectorAllowedToolsFromRegistry(options?.registry),
|
|
50
52
|
};
|
|
51
53
|
const findings = [];
|
|
52
54
|
for (const rule of RULES) {
|
|
@@ -482,6 +484,51 @@ const UNKNOWN_CONNECTOR = {
|
|
|
482
484
|
return findings;
|
|
483
485
|
},
|
|
484
486
|
};
|
|
487
|
+
// v0.4.1 — `$ name.tool` where `name` is configured with an
|
|
488
|
+
// `allowed_tools` list that doesn't include `tool`. Tier-1 lint error
|
|
489
|
+
// at compile time. Closes the "minion-safe by default" framing from
|
|
490
|
+
// Perry's amendment 8a7356dc.
|
|
491
|
+
const DISALLOWED_TOOL = {
|
|
492
|
+
id: "disallowed-tool",
|
|
493
|
+
severity: "error",
|
|
494
|
+
description: "A `$ name.tool` op references a tool not permitted by the connector's `allowed_tools` allowlist.",
|
|
495
|
+
remediation: "Either rewrite the skill to use a tool that's in the allowlist, or update `connectors.json` to grant access. The runtime refuses disallowed dispatch even if lint is bypassed (defense-in-depth).",
|
|
496
|
+
check: (ctx) => {
|
|
497
|
+
if (ctx.mcpConnectorAllowedTools.size === 0)
|
|
498
|
+
return [];
|
|
499
|
+
const findings = [];
|
|
500
|
+
const reported = new Set();
|
|
501
|
+
for (const [targetName, target] of ctx.parsed.targets) {
|
|
502
|
+
walkOps(target.ops, (op) => {
|
|
503
|
+
if (op.kind !== "$" || op.mcpConnector === undefined)
|
|
504
|
+
return;
|
|
505
|
+
const ref = op.mcpConnector;
|
|
506
|
+
const allowed = ctx.mcpConnectorAllowedTools.get(ref);
|
|
507
|
+
if (allowed === undefined)
|
|
508
|
+
return; // no allowlist → allow-all
|
|
509
|
+
// Extract tool name from op.body — first token before whitespace.
|
|
510
|
+
const m = /^([A-Za-z_][\w:-]*)/.exec(op.body);
|
|
511
|
+
if (m === null)
|
|
512
|
+
return;
|
|
513
|
+
const toolName = m[1];
|
|
514
|
+
if (allowed.includes(toolName))
|
|
515
|
+
return;
|
|
516
|
+
const key = `${targetName}:${ref}:${toolName}`;
|
|
517
|
+
if (reported.has(key))
|
|
518
|
+
return;
|
|
519
|
+
reported.add(key);
|
|
520
|
+
findings.push({
|
|
521
|
+
rule: "disallowed-tool",
|
|
522
|
+
severity: "error",
|
|
523
|
+
message: `\`$ ${ref}.${toolName}\` in target '${targetName}' is not in the allowlist for connector '${ref}'. ${allowed.length === 0 ? "Allowlist is empty (connector configured but no tools permitted)." : `Allowed: ${allowed.join(", ")}.`} Either rewrite or grant access in connectors.json.`,
|
|
524
|
+
block: targetName,
|
|
525
|
+
extras: { connector: ref, tool: toolName, allowed },
|
|
526
|
+
});
|
|
527
|
+
});
|
|
528
|
+
}
|
|
529
|
+
return findings;
|
|
530
|
+
},
|
|
531
|
+
};
|
|
485
532
|
// v0.4.0 — `connectors.json` declares `class: "Foo"` where `Foo` is not
|
|
486
533
|
// in the closed-set class registry. The loader catches this at startup
|
|
487
534
|
// and surfaces via `connectorConfigErrors`; this rule re-surfaces the
|
|
@@ -1371,6 +1418,7 @@ const RULES = [
|
|
|
1371
1418
|
UNKNOWN_RETRIEVAL_ARG,
|
|
1372
1419
|
UNKNOWN_CONNECTOR,
|
|
1373
1420
|
UNKNOWN_CONNECTOR_CLASS,
|
|
1421
|
+
DISALLOWED_TOOL,
|
|
1374
1422
|
UNINITIALIZED_APPEND,
|
|
1375
1423
|
FOREACH_LOCAL_ACCUMULATOR_TARGET,
|
|
1376
1424
|
APPEND_TO_NON_LIST,
|
|
@@ -1530,6 +1578,16 @@ function collectMcpConnectorNamesFromRegistry(registry) {
|
|
|
1530
1578
|
return undefined;
|
|
1531
1579
|
return registry.listMcpConnectors().map((e) => e.name);
|
|
1532
1580
|
}
|
|
1581
|
+
function collectMcpConnectorAllowedToolsFromRegistry(registry) {
|
|
1582
|
+
const out = new Map();
|
|
1583
|
+
if (registry === undefined)
|
|
1584
|
+
return out;
|
|
1585
|
+
for (const e of registry.listMcpConnectors()) {
|
|
1586
|
+
if (e.allowedTools !== undefined)
|
|
1587
|
+
out.set(e.name, e.allowedTools);
|
|
1588
|
+
}
|
|
1589
|
+
return out;
|
|
1590
|
+
}
|
|
1533
1591
|
function buildFeatureSet(classes) {
|
|
1534
1592
|
const provided = new Set();
|
|
1535
1593
|
for (const Ctor of classes) {
|