openclaw/dist/read-capability-Ba0RMAnC.js

Multi-channel AI gateway with extensible messaging integrations

import { r as isPathInside } from "./path-guards-Cp-mGr3-.js";
import { d as resolveConfigDir } from "./utils-P__uGsPB.js";
import { m as resolveAgentWorkspaceDir } from "./agent-scope-config-DcbEhP0R.js";
import { a as isToolAllowedByPolicies } from "./tool-policy-match-TnFxBs5z.js";
import "./agent-scope-DbtJyKUL.js";
import { i as resolveManagedMediaRoot } from "./sandbox-paths-hdOwYXJD.js";
import { n as resolvePathFromInput } from "./path-policy-s_BvJZSk.js";
import { r as resolveGroupToolPolicy } from "./agent-tools.policy-NF_9Y4S4.js";
import { t as resolveSenderToolPolicy } from "./sender-tool-policy-CfkQrDpm.js";
import { t as resolveEffectiveToolFsRootExpansionAllowed } from "./tool-fs-policy-BciYLPcO.js";
import { n as resolveWorkspaceRoot } from "./workspace-dir-CA-p1R3_.js";
import { n as readOutboundMediaFile, t as createBoundedOutboundMediaReadFile } from "./bounded-read-file-BXBH3Nms.js";
import { r as getAgentScopedMediaLocalRootsForSources } from "./local-roots-BphuGw-a.js";
import { a as readLocalMediaFile } from "./local-media-access-DXGJo-Ud.js";
import path from "node:path";
//#region src/media/read-capability.ts
function isAgentScopedMediaReadAllowedByToolPolicy(params) {
	const groupPolicy = resolveGroupToolPolicy({
		config: params.cfg,
		sessionKey: params.sessionKey,
		messageProvider: params.messageProvider,
		groupId: params.groupId,
		groupChannel: params.groupChannel,
		groupSpace: params.groupSpace,
		accountId: params.accountId,
		senderId: params.requesterSenderId,
		senderName: params.requesterSenderName,
		senderUsername: params.requesterSenderUsername,
		senderE164: params.requesterSenderE164
	});
	const senderPolicy = resolveSenderToolPolicy({
		config: params.cfg,
		agentId: params.agentId,
		sessionKey: params.sessionKey,
		messageProvider: params.messageProvider,
		senderId: params.requesterSenderId,
		senderName: params.requesterSenderName,
		senderUsername: params.requesterSenderUsername,
		senderE164: params.requesterSenderE164
	});
	if (!isToolAllowedByPolicies("read", [groupPolicy, senderPolicy])) return false;
	return true;
}
/** Creates a host reader bound to the agent workspace and configured local-file safety checks. */
function createAgentScopedHostMediaReadFile(params) {
	if (!resolveEffectiveToolFsRootExpansionAllowed({
		cfg: params.cfg,
		agentId: params.agentId
	}) || !isAgentScopedMediaReadAllowedByToolPolicy(params)) return;
	const inferredWorkspaceDir = params.workspaceDir ?? (params.agentId ? resolveAgentWorkspaceDir(params.cfg, params.agentId) : void 0);
	const workspaceRoot = resolveWorkspaceRoot(inferredWorkspaceDir);
	return createBoundedOutboundMediaReadFile(async (filePath, options) => {
		const resolvedPath = resolvePathFromInput(filePath, workspaceRoot);
		return await readLocalMediaFile(resolvedPath, params.localRoots, { maxBytes: options?.maxBytes ?? Number.MAX_SAFE_INTEGER });
	});
}
function getManagedMediaLocalRoots(mediaSources) {
	const roots = /* @__PURE__ */ new Set([path.join(resolveConfigDir(), "media", "outbound")]);
	for (const source of mediaSources ?? []) {
		const managedRoot = resolveManagedMediaRoot(source);
		if (managedRoot) roots.add(managedRoot);
	}
	return Array.from(roots);
}
function appendWorkspaceDirToLocalRoots(roots, workspaceDir) {
	if (!workspaceDir) return roots;
	const resolvedWorkspaceDir = path.resolve(workspaceDir);
	if (!roots?.length) return [resolvedWorkspaceDir];
	if (roots.some((root) => path.resolve(root) === resolvedWorkspaceDir)) return roots;
	return [...roots, resolvedWorkspaceDir];
}
function createWorkspaceAwareMediaReadFile(params) {
	const workspaceReadFile = params.workspaceMediaAccess?.readFile;
	const workspaceLocalRoots = params.workspaceMediaAccess?.localRoots ?? [];
	if (!workspaceReadFile || workspaceLocalRoots.length === 0) return params.hostReadFile;
	return createBoundedOutboundMediaReadFile(async (filePath, options) => {
		const resolvedPath = path.resolve(filePath);
		if (workspaceLocalRoots.some((root) => isPathInside(path.resolve(root), resolvedPath))) return await readOutboundMediaFile(workspaceReadFile, filePath, { maxBytes: options?.maxBytes ?? Number.MAX_SAFE_INTEGER });
		if (params.hostReadFile) return await readOutboundMediaFile(params.hostReadFile, filePath, { maxBytes: options?.maxBytes ?? Number.MAX_SAFE_INTEGER });
		return await readLocalMediaFile(filePath, params.localRoots, { maxBytes: options?.maxBytes ?? Number.MAX_SAFE_INTEGER });
	});
}
/** Resolves roots and optional host read capability for outbound media in an agent context. */
function resolveAgentScopedOutboundMediaAccess(params) {
	const resolvedWorkspaceDir = params.workspaceDir ?? params.mediaAccess?.workspaceDir ?? params.workspaceMediaAccess?.workspaceDir ?? (params.agentId ? resolveAgentWorkspaceDir(params.cfg, params.agentId) : void 0);
	const mediaReadAllowed = isAgentScopedMediaReadAllowedByToolPolicy(params);
	const managedLocalRoots = getManagedMediaLocalRoots(params.mediaSources);
	const hostLocalRoots = params.mediaAccess?.localRoots ?? getAgentScopedMediaLocalRootsForSources({
		cfg: params.cfg,
		agentId: params.agentId,
		mediaSources: params.mediaSources
	});
	const workspaceLocalRoots = params.workspaceMediaAccess?.localRoots ?? [];
	const baseLocalRoots = mediaReadAllowed ? workspaceLocalRoots.length > 0 ? Array.from(new Set([...hostLocalRoots, ...workspaceLocalRoots].map((root) => path.resolve(root)))) : hostLocalRoots : managedLocalRoots;
	const localRoots = mediaReadAllowed ? appendWorkspaceDirToLocalRoots(baseLocalRoots, resolvedWorkspaceDir) : baseLocalRoots;
	const hostReadFile = params.mediaAccess?.readFile ?? params.mediaReadFile ?? createAgentScopedHostMediaReadFile({
		cfg: params.cfg,
		agentId: params.agentId,
		localRoots: localRoots ?? [],
		workspaceDir: resolvedWorkspaceDir,
		sessionKey: params.sessionKey,
		messageProvider: params.messageProvider,
		groupId: params.groupId,
		groupChannel: params.groupChannel,
		groupSpace: params.groupSpace,
		accountId: params.accountId,
		requesterSenderId: params.requesterSenderId,
		requesterSenderName: params.requesterSenderName,
		requesterSenderUsername: params.requesterSenderUsername,
		requesterSenderE164: params.requesterSenderE164
	});
	const readFile = mediaReadAllowed ? createWorkspaceAwareMediaReadFile({
		workspaceMediaAccess: params.workspaceMediaAccess,
		hostReadFile,
		localRoots: localRoots ?? []
	}) : void 0;
	return {
		...localRoots?.length ? { localRoots } : {},
		...readFile ? { readFile } : {},
		...resolvedWorkspaceDir ? { workspaceDir: resolvedWorkspaceDir } : {}
	};
}
//#endregion
export { resolveAgentScopedOutboundMediaAccess as t };