code wiki / (root) / nx_tools_api.nx

nx_tools_api.nx

buildroot/runtime/nx_tools_api.nx

166849 B2656 linesdepth 8pulls 32 transitivereach 28 importersview sourcekind librarytopic tools
docsdependenciesstructsconstsfunctions

about

nx_tools_api.nx -- Exposes the nx_tool_registry over HTTP with GET and MCP-compatible JSON-RPC endpoints for tool discovery and invocation.

dependencies 9 imports · 21 importers

nx_jobclaim_lib.nx nx_mcp_envelope.nx nx_json_lib.nx nx_tool_registry.nx nx_cap_token.nx nx_tool_exec_allow.nx nx_tool_http_backend.nx sha256.nx nx_toolcall_idem_lib.nx nx_tools_api.nx nx_actlog_writer_gate.nx nx_api_edge.nx nx_cap_grant_e2e_gate.nx nx_cap_invoke_gate.nx nx_cap_issue_gate.nx nx_cap_revoke_gate.nx nx_catn_kat_gate.nx nx_id_handler_canonical_gate_t190. nx_job_handler_canonical_gate_t182 nx_job_put_error_gate.nx

diagram shows first 10 each side; +0 more imports, +11 more importers in the complete lists below.

imports: nx_jobclaim_lib.nxnx_mcp_envelope.nxnx_json_lib.nxnx_tool_registry.nxnx_cap_token.nxnx_tool_exec_allow.nxnx_tool_http_backend.nxsha256.nxnx_toolcall_idem_lib.nx

imported by: nx_actlog_writer_gate.nxnx_api_edge.nxnx_cap_grant_e2e_gate.nxnx_cap_invoke_gate.nxnx_cap_issue_gate.nxnx_cap_revoke_gate.nxnx_catn_kat_gate.nxnx_id_handler_canonical_gate_t190.nxnx_job_handler_canonical_gate_t182.nxnx_job_put_error_gate.nxnx_job_reservation_repro_t182.nxnx_mcp_body_gate.nxnx_mcp_http_envelope_gate.nxnx_redteam.nxnx_tools_api_exec_gate.nxnx_tools_api_gate.nxnx_tools_argv_idem_gate.nxnx_tools_argv_unicode_gate.nxnx_tools_denial_observation_candidate_t316.nxnx_tools_guidance_gate_t140.nxnx_tools_timing_gate.nx

structs

none

consts

20const TA_MAGIC_65536: i64 = 65536
25const TA_CAPTURE_CAP: i64 = 163840
26const TA_MAGIC_8192: i64 = 8192
27const TA_MAGIC_1048576: i64 = 1048576
28const TA_MAGIC_9999999999: i64 = 9999999999
29const TA_MAGIC_2048: i64 = 2048
30const TA_MAGIC_4096: i64 = 4096
31const TA_MAGIC_1469598: i64 = 1469598
32const TA_MAGIC_16384: i64 = 16384
33const TA_MAGIC_4294967295: i64 = 4294967295
34const TA_MAGIC_3600: i64 = 3600
35const TA_MAGIC_88161: i64 = 88161
37const TA_TOOLPFX: *u8 = "knowledge/toolreg-" as *u8 // production registry prefix (mirrors TOOL_PREFIX)
38const TA_MCP_PAGE: i64 = 64 // MCP tools/list page size (cursor pagination); clients walk nextCursor.
42const TA_ALL_LIMIT: i64 = 100000 // /api/tools emits ALL tools (effectively-unbounded page)
45const TA_CAP_SECRET: *u8 = "nishi-tools-cap-hmac-secret-v1-REPLACE-FROM-VAULT" as *u8
49const TA_CAP_KEYFILE: *u8 = "tools_cap_secret.key" as *u8
141const TA_LOG_I64_WIDTH: i64 = 20
142const TA_LOG_I64_MAX: i64 = 9223372036854775807
262const TA_CAPMODE_SLOTS: i64 = 16
263const TA_CAPMODE_UNSEEN: i64 = 0
264const TA_CAPMODE_PROV: i64 = 1
265const TA_CAPMODE_PLACE: i64 = 2
266const TA_CAPMODE_MODE: i64 = 420
267const TA_CAPMODE_LINE: i64 = 512
268const TA_CAPMODE_JRNL: *u8 = "knowledge/status/capmode.jrnl" as *u8
498const TA_MANIFEST_READ: i64 = 4096 // the seg store caps a manifest at 256 segment names; a read that FILLS this is unknown, not silent
499const TA_GEN_HASH_MUL: i64 = 131 // a rolling hash over the manifest bytes: any change in the segment list moves it
500const TA_GEN_HASH_MOD: i64 = 1000000007
556const TA_SCHEMACONF: *u8 = "knowledge/tool_schemas.conf" as *u8 // server CWD-relative (like tool_allowlist.conf)
560const TA_GRAMMARCONF: *u8 = "knowledge/tool_grammar.conf" as *u8
565const TA_FLAGSCONF: *u8 = "knowledge/tool_flags.conf" as *u8
568const TA_SYS_OPENAT: i64 = 257
569const TA_AT_FDCWD: i64 = 0 - 100
570const TA_OEXCL: i64 = 193 // O_CREAT(0x40)|O_EXCL(0x80)|O_WRONLY(0x1)
571const TA_CLAIMMODE: i64 = 420 // 0644
891const TA_RANK_DIR: *u8 = "knowledge/status/toolrank-" as *u8
892const TA_RANK_EXT: *u8 = ".tsv" as *u8
1202const TA_REVOKED_LIST: *u8 = "cap_revoked.list" as *u8 // newline-separated decimal nonces, relative to the server CWD
1329const TA_REPLY_MS_UNOBSERVED: i64 = 0 - 1 // inline path: the reply has not been written when the row is stamped
1434const TT_UNKNOWN: i64 = 0-1
1435const TT_I64_MAX: i64 = 9223372036854775807
1436const TT_US_PER_SEC: i64 = 1000000
1437const TT_NS_PER_US: i64 = 1000
1438const TT_NS_PER_SEC: i64 = 1000000000
1439const TT_I64_WIDTH: i64 = 20
2211const TA_CONSENT_LOG: *u8 = "cap_consent.log" as *u8
2337const OC_SLOTS: i64 = 256

functions

52func ta_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
called by 33: edge_wedge_hasmainmainmainmain+27
53func ta_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { d[o + i] = s[i]; i = i + 1 } return o + i }
called by 49: edge_origin_allowededge_problem_too_largeedge_problem_short_bodynx_api_edge_handleciv_reqig_issue_req+43
73func ta_job_put(path: *u8, buf: *u8, n: i64) -> i64
called by 6: jt_setupmainmainmainta_job_publishta_mcp_call
95func ta_job_publish(output_path: *u8, output: *u8, output_n: i64, temp_path: *u8, marker: *u8, marker_n: i64, claim_path: *u8) -> i64
called by 3: mainta_promote_bookkeepta_mcp_call calls 1: ta_job_put
103func ta_catb(d: *u8, o: i64, s: *u8, n: i64) -> i64 { var i: i64 = 0; while i < n { d[o + i] = s[i]; i = i + 1 } return o + n }
called by 22: civ_reqig_issue_reqig_call_reqrv_callrv_revoke_reqmain+16
104func ta_catn(d: *u8, o: i64, v: i64) -> i64
called by 24: aw_numberedge_origin_allowededge_problem_too_largeedge_problem_short_bodymainmain+18
143func ta_log_size_add(a: i64, b: i64) -> i64
called by 3: mainta_actlog_x_tota_timing_emit_to
150func ta_journal_write_fd(fd: i64, row: *u8, n: i64) -> i64
called by 2: mainta_journal_append
162func ta_journal_append(path: *u8, row: *u8, n: i64) -> i64
called by 3: mainta_actlog_x_tota_timing_emit_to calls 1: ta_journal_write_fd
176func ta_actlog_x_to(path: *u8, tool: *u8, tlen: i64, lane: *u8, status: *u8, ec: i64, bytes: i64, dur_ms: i64, extra: *u8) -> i64
called by 3: mainta_actlog_xta_denial_observe_to calls 6: ta_log_size_addta_slenta_catnta_catta_catbta_journal_append
210func ta_actlog_x(tool: *u8, tlen: i64, lane: *u8, status: *u8, ec: i64, bytes: i64, dur_ms: i64, extra: *u8) -> i64
called by 2: ta_actlogta_promote_bookkeep calls 1: ta_actlog_x_to
213func ta_actlog(tool: *u8, tlen: i64, lane: *u8, status: *u8, ec: i64, bytes: i64, dur_ms: i64) -> i64
called by 3: ta_promote_bookkeepta_async_finishta_mcp_call calls 1: ta_actlog_x
217func ta_put1(d: *u8, o: i64, a: i64) -> i64 { d[o] = a as u8; return o + 1 }
called by 1: ta_json_esc
218func ta_put2(d: *u8, o: i64, a: i64, b: i64) -> i64 { d[o] = a as u8; d[o + 1] = b as u8; return o + 2 }
called by 1: ta_json_esc
219func ta_hexd(v: i64) -> i64 { if v < 10 { return 48 + v } return 87 + v } // 0-9 then a-f
called by 1: ta_json_esc
225func ta_load_cap_secret_from(keyfile: *u8, outlen: *i64) -> *u8
called by 2: ta_load_cap_secretta_cap_provisioned_from calls 1: ta_slen
270func ta_capmode_announce(mode: i64) -> i64
called by 1: ta_load_cap_secret calls 2: ta_catnta_cat
309func ta_load_cap_secret(outlen: *i64) -> *u8
called by 7: mainta_mcp_callta_cap_issueta_cap_revoketa_oauth_authorizeta_oauth_approve+1 calls 2: ta_load_cap_secret_fromta_capmode_announce
322func ta_cap_provisioned_from(keyfile: *u8) -> i64
called by 2: ta_cap_provisionedmain calls 2: ta_load_cap_secret_fromta_slen
332func ta_cap_provisioned() -> i64 { return ta_cap_provisioned_from(TA_CAP_KEYFILE) }
called by 2: mainta_cap_status calls 1: ta_cap_provisioned_from
335func ta_streq_n(a: *u8, an: i64, b: *u8) -> i64
called by 6: edge_origin_allowednx_api_edge_handlemainta_mcp_promgetta_mcpta_handle_pfx
344func ta_json_esc(d: *u8, o: i64, s: *u8, n: i64) -> i64
called by 7: ta_emit_mcp_schema_buf2ta_emit_fieldta_emit_toolsta_cap_denyta_mcp_callta_mcp_promget+1 calls 3: ta_put2ta_put1ta_hexd
363func ta_indexof(hay: *u8, hn: i64, needle: *u8) -> i64
called by 19: ge_hasciv_hasig_hasrv_hasmainmain+13 calls 1: ta_slen
378func ta_body_off(req: *u8, req_n: i64) -> i64
called by 8: ig_extractnmhg_caseta_headerta_mcpta_cap_issueta_cap_revoke+2
387func ta_reqline(req: *u8, req_n: i64, mo: *i64, po: *i64) -> i64
called by 4: nx_api_edge_handleta_query_capta_oauth_authorizeta_handle_pfx
404func ta_json_str(body: *u8, n: i64, keyq: *u8, out2: *i64) -> i64
called by 7: ig_extractta_idempotency_keyta_mcp_callta_mcp_resreadta_mcp_promgetta_cap_issue+1 calls 2: ta_indexofta_slen
419func ta_json_raw(body: *u8, n: i64, keyq: *u8, out2: *i64) -> i64
called by 2: ta_mcpta_cap_issue calls 2: ta_indexofta_slen
447func ta_json_str_array(body: *u8, n: i64, keyq: *u8, out: *i64, base: i64, maxn: i64, scratch: *u8, scap: i64) -> i64
called by 3: ta_mcp_callmaintug_case calls 5: ta_indexofjx_skip_wsta_slenjx_copy_str_argvjx_len
480func ta_emit(out: *u8, status: *u8, body: *u8, body_n: i64) -> i64
called by 6: ta_emit_litta_toolsta_mcpta_cap_consent_logta_cap_issueta_cap_revoke calls 3: ta_catta_catnta_catb
488func ta_emit_lit(out: *u8, status: *u8, lit: *u8) -> i64 { return ta_emit(out, status, lit, ta_slen(lit)) }
called by 8: ta_indexta_mcpta_cap_issueta_cap_revoketa_cap_statusta_oauth_prm+2 calls 2: ta_emitta_slen
502func ta_reg_gen(prefix: *u8) -> i64
called by 2: ta_mcpmain calls 1: ta_cat
519func ta_accepts_sse(req: *u8, req_n: i64) -> i64
called by 1: ta_mcp calls 2: ta_headerta_indexof
534func ta_emit_sse_listchanged(out: *u8, body: *u8, body_n: i64) -> i64
called by 1: ta_mcp calls 3: ta_catta_catbta_catn
573func ta_bool_json(v: i64) -> *u8 { if v == 1 { return "true" as *u8 } return "false" as *u8 }
called by 1: ta_emit_mcp_schema_buf2
576func ta_tsv_field(buf: *u8, ls: i64, le: i64, idx: i64, out2: *i64) -> i64
called by 4: ta_grammar_lookupta_flags_lookupta_emit_mcp_schema_buf2ta_schema_title_buf
596func ta_emit_mcp_schema_from(conf: *u8, name: *u8, nlen: i64, body: *u8, bin: i64) -> i64
called by 2: ta_emit_mcp_schemamain calls 1: ta_emit_mcp_schema_buf
610func ta_grammar_lookup(gbuf: *u8, gbn: i64, name: *u8, nlen: i64, out2: *i64) -> i64
called by 1: ta_emit_mcp_schema_buf2 calls 1: ta_tsv_field
643func ta_od_has(buf: *u8, od_s: i64, od_l: i64, needle: *u8) -> i64
called by 1: ta_od_is_regstub calls 1: ta_slen
664func ta_od_is_regstub(buf: *u8, od_s: i64, od_l: i64) -> i64
called by 1: ta_emit_mcp_schema_buf2 calls 1: ta_od_has
671func ta_flags_lookup(fbuf: *u8, fbn: i64, name: *u8, nlen: i64, out4: *i64) -> i64
called by 1: ta_emit_mcp_schema_buf2 calls 1: ta_tsv_field
707func ta_emit_mcp_schema_buf2(buf: *u8, bufn: i64, gbuf: *u8, gbn: i64, fbuf: *u8, fbn: i64, name: *u8, nlen: i64, body: *u8, bin: i64) -> i64
called by 2: ta_emit_mcp_schema_bufta_emit_tools calls 7: ta_tsv_fieldta_catta_json_escta_grammar_lookupta_od_is_regstubta_flags_lookup+1
804func ta_emit_mcp_schema_buf(buf: *u8, bufn: i64, name: *u8, nlen: i64, body: *u8, bin: i64) -> i64
called by 1: ta_emit_mcp_schema_from calls 1: ta_emit_mcp_schema_buf2
807func ta_emit_mcp_schema(name: *u8, nlen: i64, body: *u8, bin: i64) -> i64 { return ta_emit_mcp_schema_from(TA_SCHEMACONF, name, nlen, body, bin) }
calls 1: ta_emit_mcp_schema_from
810func ta_emit_field(body: *u8, b: i64, rec: *u8, rl: i64, idx: i64) -> i64
called by 1: ta_emit_tools calls 1: ta_json_esc
825func ta_desc_is_stub(rec: *u8, rl: i64, name: *u8, nlen: i64) -> i64
called by 1: ta_emit_tools calls 1: ta_slen
842func ta_schema_title_buf(buf: *u8, bufn: i64, name: *u8, nlen: i64, out2: *i64) -> i64
called by 1: ta_emit_tools calls 1: ta_tsv_field
895func ta_rank_path(prefix: *u8, out: *u8) -> i64
called by 2: ta_emit_toolsmain calls 1: ta_cat
910func ta_rank_calls(rb: *u8, rn: i64, name: *u8, nlen: i64) -> i64
called by 1: ta_emit_tools
942func ta_cap_grants(capp: *u8, capn: i64, name: *u8, nlen: i64) -> i64
called by 1: ta_emit_tools
961func ta_emit_tools(prefix: *u8, body: *u8, bin: i64, mcp: i64, offset: i64, limit: i64, out_more: *i64, capp: *u8, capn: i64) -> i64
called by 2: ta_toolsta_mcp calls 11: tool_list_pfxta_rank_pathta_cap_grantsta_rank_callstool_get_pfxta_cat+5
1103func ta_index(out: *u8) -> i64
called by 1: ta_handle_pfx calls 1: ta_emit_lit
1107func ta_emit_page(out: *u8, html: *u8, n: i64) -> i64
called by 1: ta_html_tools calls 3: ta_catta_catnta_catb
1117func ta_html_tools(out: *u8) -> i64
called by 1: ta_handle_pfx calls 2: ta_catta_emit_page
1126func ta_tools(prefix: *u8, out: *u8) -> i64
called by 1: ta_handle_pfx calls 3: ta_catta_emit_toolsta_emit
1135func ta_header(req: *u8, req_n: i64, key: *u8, out2: *i64) -> i64
called by 4: ta_accepts_sseta_mcp_callta_cap_issueta_cap_revoke calls 3: ta_body_offta_indexofta_slen
1164func ta_query_cap(req: *u8, req_n: i64, out2: *i64) -> i64
called by 3: ta_mcp_callta_mcpmain calls 1: ta_reqline
1194func ta_query_cap_available() -> i64
called by 1: main
1203func ta_openat_append(path: *u8) -> i64 { return __syscall(257, AT_FDCWD, path, 0x441, 0x1a4, 0, 0) } // O_WRONLY|O_CREAT|O_APPEND, 0644
called by 2: ta_append_revokedta_append_consent
1204func ta_nonce_revoked(nonce: i64) -> i64
called by 1: ta_mcp_call calls 1: ta_catn
1223func ta_append_revoked(nonce: i64) -> i64
called by 1: ta_cap_revoke calls 2: ta_catnta_openat_append
1235func ta_name_in_lines(buf: *u8, n: i64, nm: *u8, nl: i64) -> i64
called by 1: ta_async_match
1266func ta_async_match(buf: *u8, n: i64, nm: *u8, nl: i64, av: *i64, ac: i64) -> i64
called by 1: ta_mcp_call calls 1: ta_name_in_lines
1331func ta_defer_enable() -> i64 { ta_defer_ok = 1; return 0 }
1332func ta_promote_pending() -> i64 { return ta_pp_pending }
1335func ta_promote_bookkeep(nmp: *u8, nml: i64, jidp: i64, jpathp: *u8, joutp: *u8, jtmpp: *u8, xout: *u8, precap: i64, wrfd0: i64, t0: i64, reply_ms: i64) -> i64
called by 2: ta_promote_finishta_mcp_call calls 7: ta_timing_now_usta_catta_catnta_job_publishta_timing_emitta_actlog+1
1411func ta_async_pending() -> i64 { return ta_ap_pending }
1412func ta_async_finish() -> i64
calls 1: ta_actlog
1423func ta_promote_finish() -> i64
calls 1: ta_promote_bookkeep
1460func ta_timing_now_us() -> i64
called by 10: ta_promote_bookkeepta_timing_beginta_timing_read_doneta_timing_handle_beginta_timing_handle_doneta_timing_write_begin+4
1472func ta_timing_elapsed(begin: i64, end: i64) -> i64
called by 3: ta_timing_emit_tota_denial_observe_tomain
1477func ta_timing_field_ok(s: *u8, n: i64) -> i64
called by 2: ta_timing_emit_tota_denial_observe_to
1486func ta_timing_emit_to(path: *u8, tool: *u8, tlen: i64, lane: *u8, phase: *u8, job: i64, begin: i64, end: i64, code: i64, bytes: i64) -> i64
called by 3: ta_timing_emitta_denial_observe_tomain calls 8: ta_timing_field_okta_slenta_log_size_addta_catnta_catta_catb+2
1541func ta_timing_emit(tool: *u8, tlen: i64, lane: *u8, phase: *u8, job: i64, begin: i64, end: i64, code: i64, bytes: i64) -> i64
called by 3: ta_promote_bookkeepta_timing_reply_logta_mcp_call calls 1: ta_timing_emit_to
1544func ta_timing_begin() -> i64
called by 1: main calls 1: ta_timing_now_us
1553func ta_timing_bind(tool: *u8, n: i64) -> i64 { tt_tool = tool; tt_tool_n = n; return 0 }
called by 2: ta_mcp_callta_denial_observe_to
1554func ta_timing_read_done() -> i64 { tt_read_end = ta_timing_now_us(); return 0 }
calls 1: ta_timing_now_us
1555func ta_timing_handle_begin() -> i64 { tt_handle_begin = ta_timing_now_us(); return 0 }
calls 1: ta_timing_now_us
1556func ta_timing_handle_done() -> i64 { tt_handle_end = ta_timing_now_us(); return 0 }
calls 1: ta_timing_now_us
1557func ta_timing_write_begin() -> i64 { tt_write_begin = ta_timing_now_us(); return 0 }
calls 1: ta_timing_now_us
1558func ta_timing_runner(begin: i64, end: i64, code: i64, bytes: i64) -> i64
called by 1: ta_mcp_call
1562func ta_timing_reply_prepare(code: i64) -> i64
calls 1: ta_timing_now_us
1568func ta_timing_reply_log(bytes: i64) -> i64
calls 1: ta_timing_emit
1587func ta_idempotency_key(body: *u8, bn: i64, out2: *i64) -> i64 { return ta_json_str(body, bn, "\"_idem\"" as *u8, out2) }
called by 1: ta_mcp_call calls 1: ta_json_str
1590func ta_cap_deny(jb:*u8,b0:i64,tool:*u8,tool_n:i64,granted:i64,presenter_count:i64)->i64
called by 1: ta_mcp_call calls 4: ta_catta_json_escta_slenta_catn
1619func ta_mcp_call(prefix: *u8, req: *u8, req_n: i64, body: *u8, bn: i64, jb: *u8, bin: i64) -> i64
called by 2: ta_mcptai_call calls 39: ta_json_strta_catta_load_cap_secretta_headerta_query_capcapt_verify+33
2088func ta_mcp_resread(body: *u8, bn: i64, jb: *u8, b0: i64) -> i64
calls 4: ta_json_strta_catta_indexoftea_run_pinned
2117func ta_mcp_promget(body: *u8, bn: i64, jb: *u8, b0: i64) -> i64
2144func ta_mcp(prefix: *u8, req: *u8, req_n: i64, out: *u8) -> i64
2242func ta_cap_issue(req: *u8, req_n: i64, out: *u8) -> i64
2288func ta_cap_revoke(req: *u8, req_n: i64, out: *u8) -> i64
2317func ta_cap_status(out: *u8) -> i64
2327func ta_oauth_prm(out: *u8) -> i64
2342func oauth_state_init() -> i64
2351func oauth_slotv(h: i64, slots: i64) -> i64 { var x: i64 = h; if x < 0 { x = 0 - x } return x - (x / slots) * slots }
2352func oauth_strhash(s: *u8, n: i64) -> i64 { var h: i64 = TA_MAGIC_1469598; var i: i64 = 0; while i < n { h = h * 31 + (s[i] as i64); i = i + 1 } if h == 0 { h = 1 } return h }
2354func oauth_param(src: *u8, slen: i64, key: *u8, klen: i64, out2: *i64) -> i64
2377func oauth_hexv(c: i64) -> i64 { if c >= 48 { if c <= 57 { return c - 48 } } if c >= 65 { if c <= 70 { return c - 55 } } if c >= 97 { if c <= 102 { return c - 87 } } return 0 }
2378func oauth_urldec(src: *u8, n: i64, dst: *u8) -> i64
2389func oauth_b64url(inb: *u8, n: i64, out: *u8) -> i64
2413func oauth_resp(out: *u8, status: *u8, ctype: *u8, body: *u8, blen: i64) -> i64
2425func ta_oauth_asmeta(out: *u8) -> i64
2431func ta_oauth_register(req: *u8, req_n: i64, out: *u8) -> i64
2453func ta_oauth_authorize(req: *u8, req_n: i64, out: *u8) -> i64
2498func ta_oauth_approve(req: *u8, req_n: i64, out: *u8) -> i64
2555func ta_oauth_token(req: *u8, req_n: i64, out: *u8) -> i64
2611func ta_handle_pfx(prefix: *u8, req: *u8, req_n: i64, out: *u8) -> i64
2643func ta_handle(req: *u8, req_n: i64, out: *u8) -> i64 { return ta_handle_pfx(TA_TOOLPFX, req, req_n, out) }
2645func ta_claim_meta(jb:*u8,b:i64,jid:i64,elapsed:i64,published:i64,has_meta:i64)->i64