agent-safe-pipeline 不可越权的 Agent 执行管线

48export const ExecutionIntentSchema = z
49  .object({
50    version: z.literal("agent-safe.intent/1"),
51    intentId: z.string().uuid(),
52    tenantId: z.string().uuid(),
53    capturedAt: z.string().datetime(),
54    expiresAt: z.string().datetime(),
55    actor: IntentActorSchema,
56    action: actionName,
57    target: z.string().trim().min(1).max(500),
58    parameters: JsonObjectSchema,
59    downstreamTarget: DownstreamTargetSchema,
60    context: JsonObjectSchema,
61    correlationId: boundedId.optional(),
62    idempotencyKey: z.string().trim().min(1).max(180),
63  })
64  .strict();

32  public capture(proposalInput: AgentProposal, trustedInput: TrustedIntentContext): CapturedIntent {
33    this.hasher.assertInputBounded(proposalInput);
34    this.hasher.assertInputBounded(trustedInput);
35    const proposal = AgentProposalSchema.parse(proposalInput);
36    const trusted = TrustedIntentContextSchema.parse(trustedInput);
37    const capturedAt = this.clock();
38    const expiresAt = new Date(capturedAt.valueOf() + this.ttlSeconds * 1_000);
39    const intent = ExecutionIntentSchema.parse({
40      version: "agent-safe.intent/1",
41      intentId: this.createId(),
42      tenantId: trusted.tenantId,
43      capturedAt: capturedAt.toISOString(),
44      expiresAt: expiresAt.toISOString(),
45      actor: trusted.actor,
46      action: proposal.action,
47      target: proposal.target,
48      parameters: proposal.parameters,
49      downstreamTarget: trusted.downstreamTarget,
50      context: trusted.context,
51      ...(trusted.correlationId === undefined ? {} : { correlationId: trusted.correlationId }),
52      idempotencyKey: trusted.idempotencyKey,
53    });
54    return this.hasher.capture(intent);
55  }

63  public async evaluate(
64    captured: CapturedIntent,
65    evidence?: DecisionEvidence,
66  ): Promise<GateDecision> {
67    const controller = new AbortController();
68    const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
69    try {
70      const response = await this.fetchImpl(`${this.baseUrl}/v1/authority/enforce-and-bind`, {
71        method: "POST",
72        headers: {
73          authorization: `Bearer ${this.apiKey}`,
74          "content-type": "application/json",
75          "idempotency-key": captured.intent.idempotencyKey,
76        },
77        body: JSON.stringify({
78          ...CanonicalIntentHasher.bindingOf(captured.intent),
79          intent_hash: captured.intentHash,
80          mode: "ENFORCEMENT",
81          ...(evidence === undefined ? {} : { evidence }),
82        }),
83        signal: controller.signal,
84      });
85      if (!response.ok) {
86        return FailClosedDecision.create(captured.intentHash, "AUTHORITY_REQUEST_FAILED");
87      }
88      const text = await BoundedResponseBody.read(response, MAX_RESPONSE_BYTES);
89      if (text === null) {
90        return FailClosedDecision.create(captured.intentHash, "AUTHORITY_RESPONSE_TOO_LARGE");
91      }
92      const parsed = AuthorityResponseSchema.parse(JSON.parse(text));
93      if (parsed.action_hash !== captured.intentHash) {
94        return FailClosedDecision.create(captured.intentHash, "AUTHORITY_BINDING_MISMATCH");
95      }
96      const verdict =
97        parsed.status === "ALLOW"
98          ? "ALLOW"
99          : parsed.status === "ESCALATE" || parsed.status === "REVIEW_REQUIRED"
100            ? "ESCALATE"
101            : "BLOCK";
102      const canExecute =
103        verdict === "ALLOW" &&
104        parsed.should_execute &&
105        parsed.dossier_id !== null &&
106        parsed.execution_token !== null &&
107        parsed.execution_token_expires_at !== null &&
108        Date.parse(parsed.execution_token_expires_at) > Date.now() &&
109        Date.parse(parsed.execution_token_expires_at) <= Date.parse(captured.intent.expiresAt);
110      if (verdict === "ALLOW" && !canExecute) {
111        return FailClosedDecision.create(captured.intentHash, "AUTHORITY_GRANT_MISSING");

189  it("allows exactly one execution under one grant across 100 concurrent claims", async () => {
190    const { execute, pair, executor } = setup();
191    const intent = captured();
192    const decision = await pair.authority.evaluate(intent);
193
194    const results = await Promise.all(
195      Array.from({ length: 100 }, async () => executor.run(intent, decision)),
196    );
197
198    expect(results.filter((result) => result.executed)).toHaveLength(1);
199    expect(execute).toHaveBeenCalledTimes(1);
200    expect(
201      results.filter((result) => !result.executed && result.reason === "AUTHORIZATION_INVALID"),
202    ).toHaveLength(99);
203  });
204
205  it("does not consume a grant before action parameters pass the trusted schema", async () => {
206    const { execute, pair, executor } = setup();
207    const invalid = captured(-1);
208    const decision = await pair.authority.evaluate(invalid);
209
210    await expect(executor.run(invalid, decision)).rejects.toThrow("ACTION_PARAMETERS_INVALID");
211    expect(execute).not.toHaveBeenCalled();
212    expect(await pair.verifier.verifyAndConsume(invalid, decision)).not.toBeNull();
213  });