morluto
b8a9da0c0f
* refactor(config): parse capability settings into exact states * refactor(runtime): encode replay and process outcomes exactly * refactor: make analysis states unrepresentable * refactor(mcp): register canonical schemas with SDK * fix: preserve capability and catalog invariants * fix(build): remove stale compiled modules * fix(replay): update real verifier policy dependency * fix(package): verify the complete MCP catalog * fix(test): supply complete replay reload policy * refactor(contracts): centralize output schema lookup * refactor(mcp): delegate protocol boundaries to SDK * fix(browser): approve real source capture * fix(mcp): preserve catalog guidance
25 lines
824 B
TypeScript
25 lines
824 B
TypeScript
import type { ControlledReplayInput } from "../domain/javascriptReplay.js";
|
|
import type { EnabledJavaScriptReplayPolicy } from "./JavaScriptReplayPlanning.js";
|
|
|
|
/** Build the exact permission request for one controlled replay operation. */
|
|
export const replayPermissionRequest = (
|
|
input: ControlledReplayInput,
|
|
policy: EnabledJavaScriptReplayPolicy,
|
|
) => ({
|
|
capability: "javascript_replay" as const,
|
|
roots: [...input.left.modules, ...(input.right?.modules ?? [])].map(
|
|
({ path }) => path,
|
|
),
|
|
executables: [
|
|
policy.nodePath,
|
|
policy.bubblewrapPath,
|
|
policy.systemdRunPath,
|
|
policy.systemctlPath,
|
|
policy.shellPath,
|
|
],
|
|
environment_names: [],
|
|
network: "none" as const,
|
|
mount: true,
|
|
operation_identity: `run_controlled_replay:${input.mode === "plan" ? "plan" : input.plan_digest}`,
|
|
});
|