4 Commits

Include renames

Author	SHA1	Message	Date
BaaRai	16ddfc7779	Hierarchical run budgets: min(child, parent) with forced wrap-up (off by default) ... Per-level token/turn budgets: task -> intent (worker run) -> planner round (counted inside the task). A child's effective budget is min(own budget, parent's remaining above the wrap-up reserve). When the task can no longer afford one worker, workers stop claiming intents and the task settles through one forced wrap-up planner round (the existing settle sequence, budget words instead of the timeout words). Config: ARTEX_TASK_BUDGET_TOKENS, ARTEX_TASK_BUDGET_TURNS, ARTEX_INTENT_BUDGET_TOKENS, ARTEX_INTENT_BUDGET_TURNS. 0 or unset = unlimited; with all four unset nothing changes.	2026-11-12 17:27:28 +01:00
BaaRai	78f92f44fc	feat(intercept): target extraction, resolver, exemptions and the gate in the hook (S3b 1.5-1.7) ... The approval gate for asset targets now decides. It is opt-in per task and per conversation (target_gate, default off). With the flag off nothing is extracted, resolved, read or written, and every branch of the hook behaves as before. No UI. Extraction and normalisation (1.5) - intercept.NormalizeTarget: lower case, trailing dot, userinfo, IPv6 brackets, IPv4-mapped IPv6, decimal / hex / octal / short IPv4, percent- encoded host, punycode; port explicit, else the scheme default, else 0. - intercept.ExtractTargets: WebFetch url exactly; Bash, shell_open, Monitor (command) and shell_send (text) with the command-string rules (URL with a scheme, IP, IP:port, host:port, CIDR; a bare name is not a target); every string of the input for MCP tools, custom tools and any tool the gate does not know. ExecuteExtraTool is unwrapped to the inner tool. The platform's domain tools, the file tools and web_search have no target. - The fields are decoded as the tools decode them (key case, last duplicate), and a URL authority that reads differently quoted and unquoted yields both readings. Resolver, exemptions, gate decision (1.6) - Resolver interface, system implementation (A and AAAA), 3 s per lookup, positive answers cached 10 s per host with collapsed lookups, failures and empty answers never cached, always fresh when a request is raised. - Exemptions are exact host + port. Derived from the configuration (LLM gateways, search backend in use, platform proxies): computed on every call, never resolved, never voided. Stored (settings key target_gate_exempt_hosts, seeded once with the package sources): resolved, and void when any address is private, loopback, link-local, unspecified, unique-local, multicast or a metadata address. An entry in both origins counts as derived. A stored IP literal that can never be exempt does not apply. - GET / PUT /api/target-gate/exemptions and GET .../history. A change is validated (ValidateExemptionHost on the normalised host) and appended to target_gate_exemption_log in the transaction that stores it. - Interceptor.CheckTargets: asset block rules (global and of the task) on the name and its addresses, exemptions, resolution, pin lookup. A (host, 0) pin covers every port; a (host, 443) pin covers 443 only and never a target without a declared port; two pins are never merged. At most 5 unpinned targets per call. Codes: TARGET_RULE_BLOCKED, TARGET_RESOLVE_FAILED, TARGET_TOO_MANY, TARGET_GATE_UNAVAILABLE; none opens a request. - With the upstream egress proxy set every pin is name-only at call time, whatever name_only_effective says in its row. - An approval never pins zero addresses: the pin writer refuses a request that displays none (db.ErrTargetPinEmpty, 422 on the decide endpoint, the row stays pending) and RequestTargets does not open one. - Every block, and the first use per process of each exemption and of each pin version, is a decided row (decided_by system, decision_source target). The gate in the hook (1.7) - guard.applyIntercept: a deny by a rule or by the judge blocks first, before any target request exists; then CheckTargets; an allow is logged as before and does not satisfy the gate; an ask and an unpinned target share one request, and the classic ask is raised only when it was not merged. The call is checked again after the decisions, at most three passes. - The gate applies to every tool of a gated session, enabled for rules or not, and to the target-only guard of the planner and the main agent, which still records blocks only. - Target blocks have their own model-facing text, built from the code and the reason of the result. Not in this change: rendered targets of custom tools (1.8) and redirect targets (1.9). Subprocess paths stay advisory; the TestBypass_* tests document what the gate does not see.	2026-11-11 00:34:55 +01:00
BaaRai	1f4cb65ca6	feat(intercept): target-gate schema, opt-in flag and approval requests (S3b 1.2-1.4) ... Storage, flag and request path of the approval gate for asset targets. The gate itself is not wired into the tool hook yet (steps 1.5 to 1.7): with this change nothing is extracted, resolved or blocked, whatever the flag says. Schema and store (1.2) - tasks.target_gate, conversations.target_gate (default false). - intercept_pending.target_key and a partial unique index: one open request per scope (task or conversation) and host:port. - target_pins (no foreign keys: a pin outlives its task, its conversation and its request row) and target_gate_exemption_log. All DDL is idempotent; no CHECK constraints; the cascade on intercept_pending.conversation_id stays. - db/target_pins.go: pin lookup with port precedence, list, revoke, find-or-create of a request, and ResolveTargetRequest, which settles the row, supersedes the old pin and writes the new version in one transaction. - Deleting a task or an archive stub revokes its pins and settles its open target requests in the delete transaction. DeleteConversation and DeleteConversations revoke the pins of the removed conversations in the same transaction as the delete. Opt-in flag (1.3) - Per task through the create and metadata-patch paths, per conversation through create and patch; exposed in the task DTO. A retest conversation takes the flag of the finding's task, never its pins. A spawned task starts with the gate off. - The task flag is atomic and read on every call through TargetScope.Enabled. TargetScope now carries the Interceptor that owns the gate. Request, wait, decide (1.4) - pendingManager keeps a list of waiters per request; resolve wakes all. - RequestTargets: find-or-create per target, one card per request, wait on channel, poll, context and wait bound. A plain request is never settled by a call that leaves. A request merged with an ask is bound to its creating call and a timeout never allows it. - Decide records the approver (subject of the session token) and the remote address for every human decision, classic asks included. On a target request "allowed" pins the displayed addresses; that is the only writer of pins. - A request raised while the global egress proxy is set says the approval is name-only and its pin is stored with name_only_effective. - Routes: GET/POST .../target-pins and .../target-pins/{pid}/revoke under /api/tasks/{id} and /api/conversations/{id}; decision_source=target filter. - ValidateExemptionHost: an exemption written as an IP literal may be private unicast, never loopback, link-local or metadata, unspecified or multicast.	2026-11-10 23:05:47 +01:00
BaaRai	135b083b9a	feat(guard): planner and main-agent hooks, target-gate scope in every session (S3b 1.1) ... Step 1.1 of the S3b phase 1 plan. Wiring only: the approval gate for asset targets is not enforced yet and no behaviour changes. - Planner.Plan and MainAgent.Chat take a hooks parameter, like Worker.Execute. Their sessions had no hooks, so nothing saw their tool calls before execution. - guard.NewTargetOnly: the guard for those two agent kinds. It runs the target-gate seam only: no intercept rule, no fallback judge, and no entry in the audit ring (Guard.record is untouched and not called for these calls). - Task.TargetGuard, built beside Task.Guard. - intercept.WithTargetScope / TargetScopeFromContext: task id or conversation id, an Enabled func and a wait bound, set at the five session entry points (planner round, final planner round with wait bound 0, main-agent turn, worker intent, conversation turn). The seam allows every call and reads and writes nothing. No task or conversation has an opt-in flag yet, so Enabled is nil (off) everywhere.	2026-11-10 22:14:24 +01:00