(input, _context)
| 632 | }, |
| 633 | |
| 634 | async checkPermissions(input, _context) { |
| 635 | if (feature('UDS_INBOX') && parseAddress(input.to).scheme === 'bridge') { |
| 636 | return { |
| 637 | behavior: 'ask' as const, |
| 638 | message: `Send a message to Remote Control session ${input.to}? It arrives as a user prompt on the receiving NCode (possibly another machine) via Anthropic's servers.`, |
| 639 | // safetyCheck (not mode) — permissions.ts guards this before both |
| 640 | // bypassPermissions (step 1g) and auto-mode's allowlist/classifier. |
| 641 | // Cross-machine prompt injection must stay bypass-immune. |
| 642 | decisionReason: { |
| 643 | type: 'safetyCheck', |
| 644 | reason: |
| 645 | 'Cross-machine bridge message requires explicit user consent', |
| 646 | classifierApprovable: false, |
| 647 | }, |
| 648 | } |
| 649 | } |
| 650 | return { behavior: 'allow' as const, updatedInput: input } |
| 651 | }, |
| 652 | |
| 653 | async validateInput(input, _context) { |
| 654 | if (input.to.trim().length === 0) { |
nothing calls this directly
no test coverage detected