openclaw/dist/exec-defaults-BenGbA5f.js

Multi-channel AI gateway with extensible messaging integrations

import { v as resolveSessionAgentId } from "./agent-scope-MrLta7Pq.js";
import { r as resolveAgentConfig } from "./agent-scope-config-CgCYpZfK.js";
import { n as resolveSandboxRuntimeStatus } from "./runtime-status-DNNoBvYA.js";
import { B as resolveExecPolicyForMode, P as resolveExecApprovalsFromFile, R as resolveExecModeFromPolicy, _ as normalizeExecAsk, b as normalizeExecSecurity, f as loadExecApprovals, h as minSecurity, p as maxAsk, x as normalizeExecTarget, z as resolveExecModePolicy } from "./exec-approvals-C6M6SGY3.js";
import { l as isRequestedExecTargetAllowed, p as resolveExecTarget } from "./bash-tools.exec-runtime-Cyyn1NzR.js";
//#region src/agents/exec-defaults.ts
function hasLegacyExecPolicyOverride(exec) {
	return exec?.security !== void 0 || exec?.ask !== void 0;
}
function applyExecPolicyLayer(base, layer) {
	if (!layer) return base;
	if (layer.mode) return {
		mode: layer.mode,
		...resolveExecPolicyForMode(layer.mode)
	};
	if (hasLegacyExecPolicyOverride(layer)) return {
		security: layer.security ?? base.security,
		ask: layer.ask ?? base.ask
	};
	return base;
}
function applySessionLegacyExecPolicyLayer(base, sessionEntry) {
	const security = normalizeExecSecurity(sessionEntry?.execSecurity);
	const ask = normalizeExecAsk(sessionEntry?.execAsk);
	if (security !== null || ask !== null) return {
		security: security ?? base.security,
		ask: ask ?? base.ask
	};
	return base;
}
function resolveExecConfigState(params) {
	const cfg = params.cfg ?? {};
	const resolvedAgentId = params.agentId ?? resolveSessionAgentId({
		sessionKey: params.sessionKey,
		config: cfg
	});
	const globalExec = cfg.tools?.exec;
	const agentExec = resolvedAgentId ? resolveAgentConfig(cfg, resolvedAgentId)?.tools?.exec : void 0;
	return {
		cfg,
		host: params.execOverrides?.host ?? normalizeExecTarget(params.sessionEntry?.execHost) ?? agentExec?.host ?? globalExec?.host ?? "auto",
		agentId: resolvedAgentId,
		agentExec,
		globalExec
	};
}
function resolveExecSandboxAvailability(params) {
	return params.sandboxAvailable ?? (params.sessionKey ? resolveSandboxRuntimeStatus({
		cfg: params.cfg,
		sessionKey: params.sessionKey
	}).sandboxed : false);
}
/** Returns whether the current exec policy allows requesting host node execution. */
function canExecRequestNode(params) {
	const { cfg, host } = resolveExecConfigState(params);
	return isRequestedExecTargetAllowed({
		configuredTarget: host,
		requestedTarget: "node",
		sandboxAvailable: resolveExecSandboxAvailability({
			cfg,
			sessionKey: params.sessionKey,
			sandboxAvailable: params.sandboxAvailable
		})
	});
}
/** Resolves effective exec host, mode, approval policy, and node availability. */
function resolveExecDefaults(params) {
	const { cfg, host, agentId: resolvedAgentId, agentExec, globalExec } = resolveExecConfigState(params);
	const sandboxAvailable = resolveExecSandboxAvailability({
		cfg,
		sessionKey: params.sessionKey,
		sandboxAvailable: params.sandboxAvailable
	});
	const resolved = resolveExecTarget({
		configuredTarget: host,
		elevatedRequested: params.elevatedRequested === true,
		sandboxAvailable
	});
	const defaultSecurity = resolved.effectiveHost === "sandbox" ? "deny" : "full";
	const approvalDefaults = resolved.effectiveHost === "sandbox" ? void 0 : resolveExecApprovalsFromFile({
		file: loadExecApprovals(),
		agentId: resolvedAgentId,
		overrides: {
			security: defaultSecurity,
			ask: "off"
		}
	}).agent;
	const modePolicy = resolveExecModePolicy(applyExecPolicyLayer(applySessionLegacyExecPolicyLayer(applyExecPolicyLayer(applyExecPolicyLayer({
		security: approvalDefaults?.security ?? defaultSecurity,
		ask: approvalDefaults?.ask ?? "off"
	}, globalExec), agentExec), params.sessionEntry), params.execOverrides));
	const security = approvalDefaults?.security !== void 0 ? minSecurity(modePolicy.security, approvalDefaults.security) : modePolicy.security;
	const ask = approvalDefaults?.ask !== void 0 ? maxAsk(modePolicy.ask, approvalDefaults.ask) : modePolicy.ask;
	const mode = security === modePolicy.security && ask === modePolicy.ask ? modePolicy.mode : resolveExecModeFromPolicy({
		security,
		ask
	});
	return {
		host,
		effectiveHost: resolved.effectiveHost,
		mode,
		security,
		ask,
		node: params.execOverrides?.node ?? params.sessionEntry?.execNode ?? agentExec?.node ?? globalExec?.node,
		canRequestNode: isRequestedExecTargetAllowed({
			configuredTarget: host,
			requestedTarget: "node",
			sandboxAvailable
		})
	};
}
//#endregion
export { resolveExecDefaults as n, canExecRequestNode as t };