super-dsh 0.1.6 → 0.1.10-e

package/agent-codex/dist/app-server-approvals.js

@@ -0,0 +1,165 @@
+/** The four server-request method names that carry an approval decision. */
+export const APPROVAL_METHODS = {
+    command: ["item/commandExecution/requestApproval", "execCommandApproval"],
+    fileChange: ["item/fileChange/requestApproval", "applyPatchApproval"],
+};
+/** Default answer timeout: fail closed (decline) after this long. `0` disables. */
+export const DEFAULT_APPROVAL_TIMEOUT_MS = 300_000;
+/** Parse `CODEX_APPROVAL_TIMEOUT_MS` (invalid/absent → the default). */
+export function parseApprovalTimeout(raw) {
+    if (raw === undefined || raw.trim() === "")
+        return DEFAULT_APPROVAL_TIMEOUT_MS;
+    const value = Number(raw);
+    return Number.isFinite(value) && value >= 0 ? value : DEFAULT_APPROVAL_TIMEOUT_MS;
+}
+function asRecord(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return null;
+    return value;
+}
+function asString(value) {
+    return typeof value === "string" && value !== "" ? value : undefined;
+}
+/** Human-facing command text: the modern single string, or the legacy argv array. */
+function commandText(raw) {
+    const direct = asString(raw);
+    if (direct !== undefined)
+        return direct;
+    if (Array.isArray(raw)) {
+        const parts = raw.filter((part) => typeof part === "string");
+        return parts.length === 0 ? undefined : parts.join(" ");
+    }
+    return undefined;
+}
+/**
+ * Recognize one approval server-request and normalize it; `null` for every
+ * other method (the caller answers those with {@link failClosedResponse}).
+ */
+export function describeApprovalRequest(method, params) {
+    const record = asRecord(params) ?? {};
+    const reason = asString(record["reason"]);
+    const itemId = asString(record["itemId"]);
+    const callId = itemId ?? asString(record["callId"]);
+    switch (method) {
+        case "item/commandExecution/requestApproval":
+        case "execCommandApproval": {
+            const command = commandText(record["command"]);
+            const description = reason ?? command;
+            return {
+                kind: "command",
+                toolName: "command_execution",
+                ...(callId === undefined ? {} : { callId }),
+                ...(description === undefined ? {} : { reason: description }),
+            };
+        }
+        case "item/fileChange/requestApproval":
+        case "applyPatchApproval":
+            return {
+                kind: "fileChange",
+                toolName: "file_change",
+                ...(callId === undefined ? {} : { callId }),
+                ...(reason === undefined ? {} : { reason }),
+            };
+        default:
+            return null;
+    }
+}
+/** Whether a DSH approval outcome grants the action (`allowed-once` is the only grant). */
+export function isGrant(outcome) {
+    return outcome === "allowed-once";
+}
+/**
+ * Build the wire answer for one approval request from a DSH outcome.
+ * Only an explicit one-shot grant approves; everything else declines.
+ */
+export function approvalResponse(method, outcome) {
+    const granted = isGrant(outcome);
+    switch (method) {
+        case "item/commandExecution/requestApproval":
+        case "item/fileChange/requestApproval":
+            return { result: { decision: granted ? "accept" : "decline" } };
+        case "execCommandApproval":
+        case "applyPatchApproval":
+            // Legacy `ReviewDecision`: a plain `"approved"`, or a structured denial.
+            return { result: { decision: granted ? "approved" : { denied: { rejection: `denied by the user (${outcome})` } } } };
+        default:
+            return failClosedResponse(method);
+    }
+}
+/**
+ * The honest "we cannot service this" answer. Structured declines are used
+ * where the protocol defines a no-op shape; everything else gets a JSON-RPC
+ * method-not-found so the server resolves the pending request immediately
+ * instead of waiting forever.
+ */
+export function failClosedResponse(method) {
+    switch (method) {
+        case "item/tool/requestUserInput":
+            return { result: { answers: {} } };
+        case "mcpServer/elicitation/request":
+            return { result: { action: "decline", content: null, _meta: null } };
+        default:
+            return { error: { code: -32601, message: `Super D does not handle the app-server request "${method}"` } };
+    }
+}
+/**
+ * Race an approval answer against the timeout. On timeout the signal aborts
+ * (withdrawing the question from the UI) and we fail closed as `"cancelled"`.
+ */
+async function raceApproval(request, controller, timeoutMs) {
+    if (timeoutMs <= 0)
+        return request;
+    let timer;
+    try {
+        return await Promise.race([
+            request,
+            new Promise((resolve) => {
+                timer = setTimeout(() => {
+                    controller.abort();
+                    resolve("cancelled");
+                }, timeoutMs);
+                timer.unref?.();
+            }),
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Build the transport-level server-request handler. The returned function never
+ * throws: every failure path answers fail-closed.
+ */
+export function makeApprovalHandler(deps) {
+    return async (request) => {
+        const ask = describeApprovalRequest(request.method, request.params);
+        if (ask === null) {
+            deps.trace?.(`approval: unsupported server-request ${request.method} → fail-closed answer`);
+            return failClosedResponse(request.method);
+        }
+        const answerer = deps.getApproval();
+        if (answerer === undefined) {
+            // Fail closed: without an answerer the tool must not run.
+            deps.trace?.(`approval: no approval service mounted → decline ${ask.kind}`);
+            return approvalResponse(request.method, "unavailable");
+        }
+        const controller = new AbortController();
+        try {
+            const outcome = await raceApproval(answerer.request({
+                agent: deps.agent,
+                toolName: ask.toolName,
+                ...(ask.callId === undefined || deps.asCallId === undefined ? {} : { callId: deps.asCallId(ask.callId) }),
+                ...(ask.reason === undefined ? {} : { reason: ask.reason }),
+                signal: controller.signal,
+            }), controller, deps.timeoutMs);
+            deps.trace?.(`approval: ${ask.kind} → ${outcome}`);
+            return approvalResponse(request.method, outcome);
+        }
+        catch (error) {
+            // A synchronous throw (no open turn / audit append failure) still denies
+            // rather than hanging Codex.
+            deps.trace?.(`approval: request failed (${String(error)}) → decline`);
+            return approvalResponse(request.method, "unavailable");
+        }
+    };
+}