mirror of
https://github.com/BaaRai/ARTEX.git
synced 2026-11-13 11:40:53 +08:00
BaaRai
c0b741bcf6
The hook reads the parameters of a custom tool call, not the URL or the command they render, and not a target written in the template itself. The custom command and http tools now run the target gate inside the tool, on what they are about to run, before anything is sent or started. Gate off (the default) is unchanged: with no scope or the flag off nothing is parsed, resolved, read or written. - intercept.GateRenderedURL: the target is read as net/http dials it (host of the parsed URL, explicit port, else the scheme default), then goes through the same decision as at the hook (asset block rules, exemptions, resolution, pin lookup) and the same request-and-wait, at most three passes. A URL whose target cannot be read is blocked with TARGET_GATE_UNAVAILABLE and logged as a decided row; no request, no lookup. - intercept.GateRenderedCommand: the rendered command is read with the command-string rules of Bash, and so is the rendering without the shell quoting of the parameters (a quoted parameter inside a host name hides the name from the rules). A command that names no target passes, as in Bash. - A gated scope without the interceptor that owns the gate blocks (TARGET_GATE_UNAVAILABLE), it never lets the call through. - runCommandTool and runHTTPTool take the tool key, which names the request rows. The gate runs before the tool's own timeout starts. - guard.TargetBlockMessage (was targetBlockMessage) is exported so the tools return the same model-facing text as the hook. - Unchanged: the script tool (its target is in stored code; advisory, D9), the custom-tool test endpoint (no scope: the operator's own action, D14), the hook order (a rule or judge deny blocks first; the tool then never runs, so its rendered target is never read), the evaluation of asset rules. Tests: TestRendered* in intercept (no database); in server, against PostgreSQL: TestCustomHTTPRenderedTargetGated, TestCustomCommandRenderedTargetGated, TestCustomToolTestEndpointUngated, TestTargetGateEndToEnd (a scripted worker's WebFetch waits, a click pins, the next call passes, revoke, it asks again), TestDenyRuleWinsBeforeRenderedTarget and TestGateOffTaskIsUnchanged. Not in this change: redirect targets of WebFetch and of the custom http tool (1.9).