## Summary - add TUI approval options for persistent network host rules - add app-server v2 approval payload plumbing for network approval context + proposed network policy amendments - add app-server handling to translate `applyNetworkPolicyAmendment` decisions back into core review decisions - update docs/test client output and generated app-server schemas/types
362 lines
No EOL
7.6 KiB
JSON
362 lines
No EOL
7.6 KiB
JSON
{
|
|
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
"definitions": {
|
|
"AdditionalFileSystemPermissions": {
|
|
"properties": {
|
|
"read": {
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
},
|
|
"write": {
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"AdditionalMacOsPermissions": {
|
|
"properties": {
|
|
"accessibility": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
},
|
|
"automations": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/MacOsAutomationValue"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"calendar": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
},
|
|
"preferences": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/MacOsPreferencesValue"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"AdditionalPermissionProfile": {
|
|
"properties": {
|
|
"fileSystem": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/AdditionalFileSystemPermissions"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"macos": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/AdditionalMacOsPermissions"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"network": {
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"CommandAction": {
|
|
"oneOf": [
|
|
{
|
|
"properties": {
|
|
"command": {
|
|
"type": "string"
|
|
},
|
|
"name": {
|
|
"type": "string"
|
|
},
|
|
"path": {
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"read"
|
|
],
|
|
"title": "ReadCommandActionType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"command",
|
|
"name",
|
|
"path",
|
|
"type"
|
|
],
|
|
"title": "ReadCommandAction",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"command": {
|
|
"type": "string"
|
|
},
|
|
"path": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"listFiles"
|
|
],
|
|
"title": "ListFilesCommandActionType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"command",
|
|
"type"
|
|
],
|
|
"title": "ListFilesCommandAction",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"command": {
|
|
"type": "string"
|
|
},
|
|
"path": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"query": {
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"search"
|
|
],
|
|
"title": "SearchCommandActionType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"command",
|
|
"type"
|
|
],
|
|
"title": "SearchCommandAction",
|
|
"type": "object"
|
|
},
|
|
{
|
|
"properties": {
|
|
"command": {
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"enum": [
|
|
"unknown"
|
|
],
|
|
"title": "UnknownCommandActionType",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"command",
|
|
"type"
|
|
],
|
|
"title": "UnknownCommandAction",
|
|
"type": "object"
|
|
}
|
|
]
|
|
},
|
|
"MacOsAutomationValue": {
|
|
"anyOf": [
|
|
{
|
|
"type": "boolean"
|
|
},
|
|
{
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": "array"
|
|
}
|
|
]
|
|
},
|
|
"MacOsPreferencesValue": {
|
|
"anyOf": [
|
|
{
|
|
"type": "boolean"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
]
|
|
},
|
|
"NetworkApprovalContext": {
|
|
"properties": {
|
|
"host": {
|
|
"type": "string"
|
|
},
|
|
"protocol": {
|
|
"$ref": "#/definitions/NetworkApprovalProtocol"
|
|
}
|
|
},
|
|
"required": [
|
|
"host",
|
|
"protocol"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"NetworkApprovalProtocol": {
|
|
"enum": [
|
|
"http",
|
|
"https",
|
|
"socks5Tcp",
|
|
"socks5Udp"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"NetworkPolicyAmendment": {
|
|
"properties": {
|
|
"action": {
|
|
"$ref": "#/definitions/NetworkPolicyRuleAction"
|
|
},
|
|
"host": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"action",
|
|
"host"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"NetworkPolicyRuleAction": {
|
|
"enum": [
|
|
"allow",
|
|
"deny"
|
|
],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"properties": {
|
|
"approvalId": {
|
|
"description": "Unique identifier for this specific approval callback.\n\nFor regular shell/unified_exec approvals, this is null.\n\nFor zsh-exec-bridge subcommand approvals, multiple callbacks can belong to one parent `itemId`, so `approvalId` is a distinct opaque callback id (a UUID) used to disambiguate routing.",
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"command": {
|
|
"description": "The command to be executed.",
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"commandActions": {
|
|
"description": "Best-effort parsed command actions for friendly display.",
|
|
"items": {
|
|
"$ref": "#/definitions/CommandAction"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
},
|
|
"cwd": {
|
|
"description": "The command's working directory.",
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"itemId": {
|
|
"type": "string"
|
|
},
|
|
"networkApprovalContext": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/definitions/NetworkApprovalContext"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
],
|
|
"description": "Optional context for a managed-network approval prompt."
|
|
},
|
|
"proposedExecpolicyAmendment": {
|
|
"description": "Optional proposed execpolicy amendment to allow similar commands without prompting.",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
},
|
|
"proposedNetworkPolicyAmendments": {
|
|
"description": "Optional proposed network policy amendments (allow/deny host) for future requests.",
|
|
"items": {
|
|
"$ref": "#/definitions/NetworkPolicyAmendment"
|
|
},
|
|
"type": [
|
|
"array",
|
|
"null"
|
|
]
|
|
},
|
|
"reason": {
|
|
"description": "Optional explanatory reason (e.g. request for network access).",
|
|
"type": [
|
|
"string",
|
|
"null"
|
|
]
|
|
},
|
|
"threadId": {
|
|
"type": "string"
|
|
},
|
|
"turnId": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"itemId",
|
|
"threadId",
|
|
"turnId"
|
|
],
|
|
"title": "CommandExecutionRequestApprovalParams",
|
|
"type": "object"
|
|
} |