dillenberg/ECC
1
0
Fork 0
mirror of https://github.com/Jeuners/ECC.git synced 2026-09-13 16:52:30 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(ito): expose guarded live node qualification

Browse source 
Expose the canonical Itō CLI's pinned sixtytwo node-qualification path through ECC with double opt-in, explicit node/config gates, credential isolation, and no new MCP or execution authority.

Validated across the full Linux, macOS, and Windows Node/package-manager matrix, hosted coverage, CodeQL, security, lint, and focused bridge tests.
This commit is contained in:
Affaan Mustafa 2026-07-23 22:10:57 -07:00 • committed by GitHub
parent 34fbe007f0
commit 33c7dbb7d6
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
11 changed files with 384 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

35
scripts/lib/ito-environment.js
View file

@ -29,11 +29,20 @@ const ITO_RUNTIME_ENVIRONMENT_KEYS = Object.freeze([
"ITO_INVENTORY_URL",
]);
const ITO_EVAL_ENVIRONMENT_KEYS = Object.freeze([
"ITO_ENABLE_SIXTYTWO_LIVE",
"SIXTYTWO_API_TOKEN",
"SIXTYTWO_TOKEN",
"SSH_AUTH_SOCK",
"SSH_AGENT_PID",
]);
const ECC_ITO_CONTROL_KEYS = Object.freeze([
"ECC_DRY_RUN",
"ECC_ITO_CLI_EXECUTABLE",
"NODE_ENV",
]);
const ITO_RUNTIME_COMMANDS = new Set(["auth", "find", "status"]);
function copyDefined(source, target, key) {
if (typeof source[key] === "string") {
@ -56,6 +65,12 @@ function createSafeItoEnvironment(source = process.env, options = {}) {
}
}
if (options.includeItoEvals) {
for (const key of ITO_EVAL_ENVIRONMENT_KEYS) {
copyDefined(source, safe, key);
}
}
if (options.includeControls) {
for (const key of ECC_ITO_CONTROL_KEYS) {
copyDefined(source, safe, key);
@ -65,9 +80,29 @@ function createSafeItoEnvironment(source = process.env, options = {}) {
return Object.freeze(safe);
}
function getInvocationCommand(args = []) {
return args.filter((value) => value !== "--json")[0];
}
function createSafeItoInvocationEnvironment(
source = process.env,
args = [],
options = {},
) {
const command = getInvocationCommand(args);
return createSafeItoEnvironment(source, {
includeControls: options.includeControls === true,
includeItoRuntime: ITO_RUNTIME_COMMANDS.has(command),
includeItoEvals: command === "evals",
});
}
module.exports = Object.freeze({
ECC_ITO_CONTROL_KEYS,
ITO_EVAL_ENVIRONMENT_KEYS,
ITO_RUNTIME_ENVIRONMENT_KEYS,
SYSTEM_ENVIRONMENT_KEYS,
createSafeItoEnvironment,
createSafeItoInvocationEnvironment,
getInvocationCommand,
});