Documentation
¶
Overview ¶
Package inject adds the harness's own tools to the proxied manifest and answers their calls, for a session where the governed server has shed its GuardrailStatus/Kill tools (enforce mode). The tools are defined here as raw JSON because the harness answers them itself — it never hands them to the server's SDK — and the client must see them inside the same tools/list the rug-pull baseline is taken from.
Two tools:
- GuardrailStatus (read-only): reports the harness's posture for the session — mode, whether it is enforcing, the bound tool count.
- Kill (destructive): ends the session. Non-authoritative, exactly like the server's own Kill: it routes to a graceful stop, never to containment an operator did not arm.
Index ¶
Constants ¶
const ( ToolGuardrailStatus = "GuardrailStatus" ToolKill = "Kill" )
The injected tool names. A tools/call for either is answered here, not forwarded to the server.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Injector ¶
type Injector struct {
// contains filtered or unexported fields
}
Injector implements proxy.ToolInjector and answers the injected tools' calls via Answer, which a wrapping interceptor consults before the policy decision.
func New ¶
func New(status StatusProvider, stop func(reason string)) *Injector
New builds the injector. status reports posture for GuardrailStatus; stop ends the session for Kill (a graceful stop the harness supplies).
func (*Injector) Answer ¶
Answer produces the tool result text for an injected tool call. The bool reports whether this injector owns the tool; false means "not mine, forward it". args is the raw params.arguments, used only by Kill.
func (*Injector) Answers ¶
Answers reports whether the named tool is one this injector answers, so a wrapping interceptor can route its call here instead of to the server.
func (*Injector) Tools ¶
func (i *Injector) Tools() []json.RawMessage
Tools implements proxy.ToolInjector: the two tool definitions appended to every tools/list result.
type Interceptor ¶
type Interceptor struct {
// contains filtered or unexported fields
}
Interceptor answers calls to the injected tools and delegates everything else. It sits outermost on the proxy's refusal seam: a tools/call for GuardrailStatus or Kill is answered here — a success result written to the client, never forwarded to the server, which does not have the tool — and any other frame passes to the delegate (the policy decider). Answering an injected tool is not subject to the policy engine: these are the harness's own tools, and refusing the client's window into the harness posture, or its ability to stop the session, would be perverse.
func WrapInterceptor ¶
func WrapInterceptor(inj *Injector, delegate proxy.Interceptor) *Interceptor
WrapInterceptor puts the injected-tool answering in front of delegate.
func (*Interceptor) Intercept ¶
func (i *Interceptor) Intercept(raw []byte) []byte
Intercept answers an injected-tool call, else delegates.
type Status ¶
type Status struct {
Mode string `json:"mode"`
Enforcing bool `json:"enforcing"`
Bounded bool `json:"bounded"`
RuleLayers int `json:"rule_layers"`
}
Status is the harness-side posture the GuardrailStatus tool reports. It is deliberately small and carries no device identifiers — the harness is not the desktop, and an agent-facing tool must not become a fingerprinting side channel.
type StatusProvider ¶
type StatusProvider func() Status
StatusProvider reports the harness posture GuardrailStatus returns. It is a function so the injector holds no engine reference: the harness supplies a closure over whatever it wants surfaced.
Source Files