@aarmos/bridge 0.1.10 → 0.1.11

package/dist/rpc/router.js

@@ -1,349 +0,0 @@
-import { z } from "zod";
-import fs from "node:fs/promises";
-import path from "node:path";
-import { spawn } from "node:child_process";
-import { simpleGit } from "simple-git";
-import pg from "pg";
-import { HttpCallParams, previewHttpCall, executeHttpCall } from "../lib/http-broker.js";
-import { McpToolParams, previewMcpTool, executeMcpTool } from "../lib/mcp-broker.js";
-import { testLlmConnection } from "../lib/llm-test.js";
-const TestConnectionParams = z.object({
-    providerId: z.string().min(1),
-    baseUrl: z.string().url(),
-    apiKey: z.string().optional(),
-    model: z.string().min(1),
-    headers: z.record(z.string()).optional(),
-    timeoutMs: z.number().int().min(100).max(30_000).optional(),
-});
-const RpcRequest = z.object({
-    id: z.union([z.string(), z.number()]),
-    type: z.literal("rpc"),
-    method: z.string(),
-    params: z.unknown().optional(),
-});
-const BatchAction = z.object({
-    kind: z.enum(["fs.write", "shell.exec", "http.call", "mcp.tool"]),
-    params: z.unknown(),
-});
-export async function handleRpc(session, msg) {
-    const parsed = RpcRequest.safeParse(msg);
-    if (!parsed.success)
-        return { type: "error", error: "invalid rpc envelope" };
-    const { id, method, params } = parsed.data;
-    try {
-        const result = await dispatch(session, method, params);
-        return { id, type: "result", result };
-    }
-    catch (err) {
-        // Prefer a structured AarmosError when the thrown value carries one.
-        // Detection is duck-typed to avoid a hard runtime import from avar-core
-        // (bridge is used in contexts where the module graph is different).
-        const maybe = err && typeof err === "object" && "aarmos" in err
-            ? err
-                .aarmos
-            : undefined;
-        const message = err instanceof Error ? err.message : String(err);
-        return maybe
-            ? { id, type: "error", error: message, aarmos: maybe }
-            : { id, type: "error", error: message };
-    }
-}
-async function dispatch(session, method, params) {
-    switch (method) {
-        // ---- reads (always live, never previewed) ------------------------------
-        case "fs.read": {
-            const { path: rel, encoding } = z
-                .object({ path: z.string(), encoding: z.enum(["utf8", "base64"]).default("utf8") })
-                .parse(params);
-            const abs = session.resolveInJail(rel);
-            const buf = await fs.readFile(abs);
-            return { path: rel, encoding, data: encoding === "utf8" ? buf.toString("utf8") : buf.toString("base64") };
-        }
-        case "fs.list": {
-            const { path: rel } = z.object({ path: z.string().default(".") }).parse(params);
-            const abs = session.resolveInJail(rel);
-            const entries = await fs.readdir(abs, { withFileTypes: true });
-            return entries.map((e) => ({ name: e.name, dir: e.isDirectory(), file: e.isFile() }));
-        }
-        case "git.status": {
-            return await simpleGit(session.workspace).status();
-        }
-        case "git.branch": {
-            return await simpleGit(session.workspace).branch();
-        }
-        // ---- mutations (previewed under dry-run) -------------------------------
-        case "fs.write": {
-            const preview = await previewFsWrite(session, params);
-            if (session.dryRun)
-                return { preview: true, action: preview };
-            return await executeFsWrite(session, params);
-        }
-        case "shell.exec": {
-            const preview = previewShellExec(session, params);
-            if (session.dryRun)
-                return { preview: true, action: preview };
-            return await executeShellExec(session, params);
-        }
-        case "http.call": {
-            const p = HttpCallParams.parse(params);
-            const preview = { kind: "http.call", params: p, preview: previewHttpCall(p, session.httpAllow) };
-            if (session.dryRun)
-                return { preview: true, action: preview };
-            return await executeHttpCall(p, session.httpAllow);
-        }
-        case "mcp.tool": {
-            const p = McpToolParams.parse(params);
-            const preview = { kind: "mcp.tool", params: p, preview: previewMcpTool(p, session.mcpAllow) };
-            if (session.dryRun)
-                return { preview: true, action: preview };
-            return await executeMcpTool(p, session.mcpAllow);
-        }
-        // ---- LLM diagnostics (no receipt, no chat) -----------------------------
-        // Dry-runs a BYO-LLM provider so the CLI can surface the same
-        // structured LLM_* AarmosError codes the PWA shows in Settings, without
-        // minting an AVAR chat receipt. Never routed through the sticky
-        // active-provider ring; caller supplies the config each call.
-        case "aarmos.testConnection": {
-            const p = TestConnectionParams.parse(params);
-            return await testLlmConnection(p);
-        }
-        // ---- session controls --------------------------------------------------
-        case "session.setDryRun": {
-            const { on } = z.object({ on: z.boolean() }).parse(params);
-            session.dryRun = on;
-            return { dryRun: session.dryRun };
-        }
-        case "session.state": {
-            return { dryRun: session.dryRun, workspace: session.workspace };
-        }
-        // ---- read-only Postgres (only if operator passed --allow-sql) ----------
-        case "db.list": {
-            return {
-                databases: [...session.sqlAllow.values()].map((s) => ({ alias: s.alias })),
-            };
-        }
-        case "db.query": {
-            return await executeDbQuery(session, params);
-        }
-        // ---- scoped filesystem read (only if operator passed --allow-read) ------
-        case "fs.scopedRoots": {
-            return { roots: [...session.readAllow] };
-        }
-        case "fs.scopedRead": {
-            const { path: abs, encoding } = z
-                .object({
-                path: z.string(),
-                encoding: z.enum(["utf8", "base64"]).default("utf8"),
-            })
-                .parse(params);
-            const real = session.assertReadable(abs);
-            const buf = await fs.readFile(real);
-            // Soft cap: refuse to shovel enormous files through the WS in one shot.
-            if (buf.byteLength > 2 * 1024 * 1024) {
-                throw new Error(`file too large for scopedRead (${buf.byteLength} bytes; cap 2 MiB)`);
-            }
-            return {
-                path: real,
-                encoding,
-                bytes: buf.byteLength,
-                data: encoding === "utf8" ? buf.toString("utf8") : buf.toString("base64"),
-            };
-        }
-        case "fs.scopedList": {
-            const { path: abs } = z.object({ path: z.string() }).parse(params);
-            const real = session.assertReadable(abs);
-            const entries = await fs.readdir(real, { withFileTypes: true });
-            return {
-                path: real,
-                entries: entries.map((e) => ({
-                    name: e.name,
-                    absPath: path.join(real, e.name),
-                    dir: e.isDirectory(),
-                    file: e.isFile(),
-                })),
-            };
-        }
-        // ---- batch apply (commits an approved plan, ignoring dryRun) -----------
-        case "apply.batch": {
-            const { actions } = z.object({ actions: z.array(BatchAction) }).parse(params);
-            const results = [];
-            for (const a of actions) {
-                try {
-                    let res;
-                    if (a.kind === "fs.write")
-                        res = await executeFsWrite(session, a.params);
-                    else if (a.kind === "shell.exec")
-                        res = await executeShellExec(session, a.params);
-                    else if (a.kind === "http.call")
-                        res = await executeHttpCall(HttpCallParams.parse(a.params), session.httpAllow);
-                    else
-                        res = await executeMcpTool(McpToolParams.parse(a.params), session.mcpAllow);
-                    results.push({ ok: true, kind: a.kind, result: res });
-                }
-                catch (err) {
-                    results.push({
-                        ok: false,
-                        kind: a.kind,
-                        error: err instanceof Error ? err.message : String(err),
-                    });
-                    // Stop-on-first-error keeps partial-commit surprises out of the workspace.
-                    break;
-                }
-            }
-            return { applied: results.length, results };
-        }
-        default:
-            throw new Error(`unknown method: ${method}`);
-    }
-}
-// -------- execution + preview helpers ----------------------------------------
-const FsWriteParams = z.object({
-    path: z.string(),
-    data: z.string(),
-    encoding: z.enum(["utf8", "base64"]).default("utf8"),
-});
-async function previewFsWrite(session, params) {
-    const p = FsWriteParams.parse(params);
-    const abs = session.resolveInJail(p.path);
-    let before = null;
-    let existed = false;
-    try {
-        const buf = await fs.readFile(abs);
-        existed = true;
-        before = p.encoding === "utf8" ? buf.toString("utf8") : buf.toString("base64");
-    }
-    catch {
-        // new file
-    }
-    const after = p.data;
-    return {
-        kind: "fs.write",
-        params: p,
-        preview: {
-            path: p.path,
-            encoding: p.encoding,
-            existed,
-            bytesBefore: before?.length ?? 0,
-            bytesAfter: after.length,
-            before,
-            after,
-        },
-    };
-}
-async function executeFsWrite(session, params) {
-    const p = FsWriteParams.parse(params);
-    const abs = session.resolveInJail(p.path);
-    await fs.mkdir(pathDirname(abs), { recursive: true });
-    await fs.writeFile(abs, p.encoding === "utf8" ? p.data : Buffer.from(p.data, "base64"));
-    return { path: p.path, bytes: p.data.length };
-}
-const ShellExecParams = z.object({
-    bin: z.string(),
-    args: z.array(z.string()).default([]),
-    cwd: z.string().default("."),
-});
-function previewShellExec(session, params) {
-    const p = ShellExecParams.parse(params);
-    if (!session.shellAllow.has(p.bin))
-        throw new Error(`shell binary not allowed: ${p.bin}`);
-    const absCwd = session.resolveInJail(p.cwd);
-    return {
-        kind: "shell.exec",
-        params: p,
-        preview: {
-            commandLine: [p.bin, ...p.args].join(" "),
-            cwd: absCwd,
-            binary: p.bin,
-            args: p.args,
-        },
-    };
-}
-async function executeShellExec(session, params) {
-    const p = ShellExecParams.parse(params);
-    if (!session.shellAllow.has(p.bin))
-        throw new Error(`shell binary not allowed: ${p.bin}`);
-    const absCwd = session.resolveInJail(p.cwd);
-    return await execAllowed(p.bin, p.args, absCwd);
-}
-function pathDirname(p) {
-    const i = p.lastIndexOf("/");
-    return i >= 0 ? p.slice(0, i) : ".";
-}
-function execAllowed(bin, args, cwd) {
-    return new Promise((resolve) => {
-        const child = spawn(bin, args, { cwd, shell: false });
-        let stdout = "";
-        let stderr = "";
-        child.stdout.on("data", (b) => (stdout += b.toString()));
-        child.stderr.on("data", (b) => (stderr += b.toString()));
-        child.on("close", (code) => resolve({ code: code ?? 0, stdout, stderr }));
-    });
-}
-// -------- read-only Postgres --------------------------------------------------
-//
-// Guarantees enforced here, not by convention:
-//   1. The operator must have opted in via `--allow-sql <alias>=<dsn>`.
-//      Without a matching alias, we throw before opening a connection.
-//   2. The query runs inside `BEGIN READ ONLY` with a bounded
-//      `statement_timeout`. Any write (INSERT/UPDATE/DELETE/DDL) is
-//      rejected by Postgres itself with `read_only_sql_transaction`.
-//   3. Rows are hard-capped; if the query returns more than `rowLimit`,
-//      we truncate and mark `truncated: true`. Model can page by `LIMIT`.
-//   4. Parameters go through the extended query protocol (`$1`, `$2`, …)
-//      so a single call cannot smuggle in a second statement via `;`.
-//   5. The DSN is never returned to the caller — only the alias, and
-//      row / column data.
-const DbQueryParams = z.object({
-    alias: z.string().optional(),
-    sql: z.string().min(1),
-    params: z.array(z.unknown()).default([]),
-    rowLimit: z.number().int().min(1).max(10_000).default(500),
-    statementTimeoutMs: z.number().int().min(100).max(30_000).default(5_000),
-});
-async function executeDbQuery(session, params) {
-    const p = DbQueryParams.parse(params);
-    if (session.sqlAllow.size === 0) {
-        throw new Error("db.query is not permitted — start the CLI with --allow-sql <alias>=<dsn> to opt in.");
-    }
-    let entry;
-    if (p.alias) {
-        entry = session.sqlAllow.get(p.alias);
-        if (!entry)
-            throw new Error(`unknown --allow-sql alias: ${p.alias}`);
-    }
-    else if (session.sqlAllow.size === 1) {
-        entry = session.sqlAllow.values().next().value;
-    }
-    else {
-        throw new Error(`alias required (registered: ${[...session.sqlAllow.keys()].join(", ")})`);
-    }
-    const client = new pg.Client({ connectionString: entry.dsn });
-    const started = Date.now();
-    try {
-        await client.connect();
-        await client.query("BEGIN READ ONLY");
-        await client.query(`SET LOCAL statement_timeout = ${p.statementTimeoutMs}`);
-        const res = await client.query({ text: p.sql, values: p.params });
-        await client.query("ROLLBACK");
-        const truncated = res.rows.length > p.rowLimit;
-        return {
-            alias: entry.alias,
-            command: res.command,
-            rowCount: res.rowCount,
-            returnedRows: Math.min(res.rows.length, p.rowLimit),
-            truncated,
-            fields: res.fields?.map((f) => ({ name: f.name, dataTypeID: f.dataTypeID })),
-            rows: truncated ? res.rows.slice(0, p.rowLimit) : res.rows,
-            elapsedMs: Date.now() - started,
-        };
-    }
-    finally {
-        try {
-            await client.end();
-        }
-        catch {
-            /* ignore */
-        }
-    }
-}
-//# sourceMappingURL=router.js.map

package/dist/rpc/router.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/rpc/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACzB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;CAC5D,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAmCH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IACjE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAgB,EAAE,GAAY;IAC5D,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAC7E,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IAE3C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,qEAAqE;QACrE,wEAAwE;QACxE,oEAAoE;QACpE,MAAM,KAAK,GACT,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,QAAQ,IAAK,GAA+B;YAC5E,CAAC,CAAE,GAAqF;iBACnF,MAAM;YACX,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,KAAK;YACV,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;YACtD,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,OAAgB,EAAE,MAAc,EAAE,MAAe;IACvE,QAAQ,MAAM,EAAE,CAAC;QACf,2EAA2E;QAC3E,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC;iBAC9B,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;iBAClF,KAAK,CAAC,MAAM,CAAC,CAAC;YACjB,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACnC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5G,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAChF,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QACxF,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,OAAO,MAAM,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;QACrD,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,OAAO,MAAM,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;QACrD,CAAC;QAED,2EAA2E;QAC3E,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACtD,IAAI,OAAO,CAAC,MAAM;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC9D,OAAO,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAClD,IAAI,OAAO,CAAC,MAAM;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC9D,OAAO,MAAM,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,OAAO,GAAkB,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAChH,IAAI,OAAO,CAAC,MAAM;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC9D,OAAO,MAAM,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACrD,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACtC,MAAM,OAAO,GAAkB,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7G,IAAI,OAAO,CAAC,MAAM;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC9D,OAAO,MAAM,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnD,CAAC;QAED,2EAA2E;QAC3E,8DAA8D;QAC9D,wEAAwE;QACxE,gEAAgE;QAChE,8DAA8D;QAC9D,KAAK,uBAAuB,CAAC,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC7C,OAAO,MAAM,iBAAiB,CAAC,CAA4C,CAAC,CAAC;QAC/E,CAAC;QAED,2EAA2E;QAC3E,KAAK,mBAAmB,CAAC,CAAC,CAAC;YACzB,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC3D,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC;YACpB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACpC,CAAC;QACD,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QAClE,CAAC;QAED,2EAA2E;QAC3E,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,OAAO;gBACL,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;aAC3E,CAAC;QACJ,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,OAAO,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/C,CAAC;QAED,4EAA4E;QAC5E,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,CAAC;QACD,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC;iBAC9B,MAAM,CAAC;gBACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;gBAChB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;aACrD,CAAC;iBACD,KAAK,CAAC,MAAM,CAAC,CAAC;YACjB,MAAM,IAAI,GAAG,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpC,wEAAwE;YACxE,IAAI,GAAG,CAAC,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CACb,kCAAkC,GAAG,CAAC,UAAU,oBAAoB,CACrE,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,IAAI;gBACV,QAAQ;gBACR,KAAK,EAAE,GAAG,CAAC,UAAU;gBACrB,IAAI,EAAE,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;aAC1E,CAAC;QACJ,CAAC;QACD,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnE,MAAM,IAAI,GAAG,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,OAAO;gBACL,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;oBAChC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;oBACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;iBACjB,CAAC,CAAC;aACJ,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC9E,MAAM,OAAO,GAA2E,EAAE,CAAC;YAC3F,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACH,IAAI,GAAY,CAAC;oBACjB,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU;wBAAE,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;yBACpE,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY;wBAAE,GAAG,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;yBAC7E,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW;wBAAE,GAAG,GAAG,MAAM,eAAe,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;;wBAC3G,GAAG,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;oBACjF,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACxD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,IAAI,CAAC;wBACX,EAAE,EAAE,KAAK;wBACT,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;qBACxD,CAAC,CAAC;oBACH,2EAA2E;oBAC3E,MAAM;gBACR,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QAC9C,CAAC;QAED;YACE,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACrD,CAAC,CAAC;AAEH,KAAK,UAAU,cAAc,CAAC,OAAgB,EAAE,MAAe;IAC7D,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnC,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,GAAG,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,WAAW;IACb,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC;IACrB,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,CAAC;QACT,OAAO,EAAE;YACP,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,OAAO;YACP,WAAW,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;YAChC,UAAU,EAAE,KAAK,CAAC,MAAM;YACxB,MAAM;YACN,KAAK;SACN;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,OAAgB,EAAE,MAAe;IAC7D,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IACxF,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;CAC7B,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,OAAgB,EAAE,MAAe;IACzD,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5C,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,CAAC;QACT,OAAO,EAAE;YACP,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACzC,GAAG,EAAE,MAAM;YACX,MAAM,EAAE,CAAC,CAAC,GAAG;YACb,IAAI,EAAE,CAAC,CAAC,IAAI;SACb;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,OAAgB,EAAE,MAAe;IAC/D,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5C,OAAO,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACtC,CAAC;AAED,SAAS,WAAW,CAClB,GAAW,EACX,IAAc,EACd,GAAW;IAEX,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACzD,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACzD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AACjF,EAAE;AACF,+CAA+C;AAC/C,wEAAwE;AACxE,uEAAuE;AACvE,8DAA8D;AAC9D,oEAAoE;AACpE,qEAAqE;AACrE,wEAAwE;AACxE,0EAA0E;AAC1E,yEAAyE;AACzE,sEAAsE;AACtE,qEAAqE;AACrE,0BAA0B;AAE1B,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAC1D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;CACzE,CAAC,CAAC;AAEH,KAAK,UAAU,cAAc,CAAC,OAAgB,EAAE,MAAe;IAC7D,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC;IACV,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACZ,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACvC,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;IACjD,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CACb,+BAA+B,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC1E,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,KAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACtC,MAAM,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC;QAC5E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAClE,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC/C,OAAO;YACL,KAAK,EAAE,KAAM,CAAC,KAAK;YACnB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC;YACnD,SAAS;YACT,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;YAC5E,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI;YAC1D,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SAChC,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/session.js

@@ -1,100 +0,0 @@
-import path from "node:path";
-import fs from "node:fs";
-export const DEFAULT_SHELL_ALLOW = [
-    "git",
-    "npm",
-    "pnpm",
-    "bun",
-    "node",
-    "ls",
-    "cat",
-    "rg",
-    "grep",
-];
-export function createSession(opts) {
-    const workspace = path.resolve(opts.workspace);
-    const shellAllow = new Set([...DEFAULT_SHELL_ALLOW, ...opts.extraShellAllow]);
-    const sqlAllow = new Map();
-    for (const entry of opts.sqlAllow ?? []) {
-        if (sqlAllow.has(entry.alias)) {
-            throw new Error(`duplicate --allow-sql alias: ${entry.alias}`);
-        }
-        sqlAllow.set(entry.alias, entry);
-    }
-    // Resolve each opted-in read root once, via realpath, so symlink games
-    // at request time can't sneak in an unlisted path.
-    const readAllow = [];
-    for (const raw of opts.readAllow ?? []) {
-        const abs = path.resolve(raw);
-        let real;
-        try {
-            real = fs.realpathSync(abs);
-        }
-        catch {
-            throw new Error(`--allow-read path does not exist: ${raw}`);
-        }
-        readAllow.push(real);
-    }
-    const httpAllow = new Set(opts.httpAllow ?? []);
-    const mcpAllow = new Set(opts.mcpAllow ?? []);
-    const capabilities = [
-        "fs.read",
-        "fs.write",
-        "fs.list",
-        "shell.exec",
-        "git.status",
-        "git.branch",
-        "events.fs",
-        "events.git",
-        "session.setDryRun",
-        "apply.batch",
-    ];
-    if (sqlAllow.size > 0) {
-        capabilities.push("db.list", "db.query");
-    }
-    if (readAllow.length > 0) {
-        capabilities.push("fs.scopedRoots", "fs.scopedRead", "fs.scopedList");
-    }
-    if (httpAllow.size > 0)
-        capabilities.push("http.call");
-    if (mcpAllow.size > 0)
-        capabilities.push("mcp.tool");
-    return {
-        workspace,
-        shellAllow,
-        sqlAllow,
-        readAllow,
-        httpAllow,
-        mcpAllow,
-        dryRun: true,
-        capabilities,
-        resolveInJail(rel) {
-            const abs = path.resolve(workspace, rel);
-            const rrel = path.relative(workspace, abs);
-            if (rrel.startsWith("..") || path.isAbsolute(rrel)) {
-                throw new Error(`path escapes workspace: ${rel}`);
-            }
-            return abs;
-        },
-        assertReadable(abs) {
-            if (!path.isAbsolute(abs)) {
-                throw new Error(`fs.scoped* requires an absolute path: ${abs}`);
-            }
-            let real;
-            try {
-                real = fs.realpathSync(abs);
-            }
-            catch {
-                throw new Error(`path not found: ${abs}`);
-            }
-            for (const root of readAllow) {
-                const rel = path.relative(root, real);
-                if (rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel))) {
-                    return real;
-                }
-            }
-            throw new Error(`path is not inside any --allow-read root: ${abs}`);
-        },
-    };
-}
-//# sourceMappingURL=session.js.map

package/dist/session.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,KAAK;IACL,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,MAAM;CACE,CAAC;AA8BX,MAAM,UAAU,aAAa,CAAC,IAO7B;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,mBAAmB,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACxC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,gCAAgC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,uEAAuE;IACvE,mDAAmD;IACnD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAS,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAEtD,MAAM,YAAY,GAAG;QACnB,SAAS;QACT,UAAU;QACV,SAAS;QACT,YAAY;QACZ,YAAY;QACZ,YAAY;QACZ,WAAW;QACX,YAAY;QACZ,mBAAmB;QACnB,aAAa;KACd,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACtB,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,GAAG,CAAC;QAAE,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC;QAAE,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAErD,OAAO;QACL,SAAS;QACT,UAAU;QACV,QAAQ;QACR,SAAS;QACT,SAAS;QACT,QAAQ;QACR,MAAM,EAAE,IAAI;QACZ,YAAY;QACZ,aAAa,CAAC,GAAW;YACvB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YAC3C,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;YACpD,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,cAAc,CAAC,GAAW;YACxB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,EAAE,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAC;YAC5C,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACtC,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBACnE,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,GAAG,EAAE,CAAC,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/watchers/files.js

@@ -1,31 +0,0 @@
-import chokidar from "chokidar";
-import path from "node:path";
-/**
- * Watches the workspace and streams debounced file-change events to the PWA.
- * This is the fix for the "developer edits in VS Code, PWA drifts out of sync"
- * problem: any external write invalidates PWA-side state within ~150ms.
- */
-export function startFileWatcher(session, emit) {
-    const watcher = chokidar.watch(session.workspace, {
-        ignored: [
-            /(^|[/\\])\../, // dotfiles
-            /node_modules/,
-            /dist|build|\.next|\.turbo|\.cache/,
-        ],
-        ignoreInitial: true,
-        awaitWriteFinish: { stabilityThreshold: 120, pollInterval: 40 },
-        persistent: true,
-    });
-    const send = (kind) => (p) => {
-        const rel = path.relative(session.workspace, p) || ".";
-        emit({ kind, path: rel, at: Date.now() });
-    };
-    watcher
-        .on("add", send("add"))
-        .on("change", send("change"))
-        .on("unlink", send("unlink"))
-        .on("addDir", send("addDir"))
-        .on("unlinkDir", send("unlinkDir"));
-    return () => void watcher.close();
-}
-//# sourceMappingURL=files.js.map

package/dist/watchers/files.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"files.js","sourceRoot":"","sources":["../../src/watchers/files.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,IAAI,MAAM,WAAW,CAAC;AAS7B;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgB,EAAE,IAA4B;IAC7E,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE;QAChD,OAAO,EAAE;YACP,cAAc,EAAE,WAAW;YAC3B,cAAc;YACd,mCAAmC;SACpC;QACD,aAAa,EAAE,IAAI;QACnB,gBAAgB,EAAE,EAAE,kBAAkB,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE;QAC/D,UAAU,EAAE,IAAI;KACjB,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,CAAC,IAAqB,EAAE,EAAE,CAAC,CAAC,CAAS,EAAE,EAAE;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC;QACvD,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC;IAEF,OAAO;SACJ,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;SACtB,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;SAC5B,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;SAC5B,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;SAC5B,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAEtC,OAAO,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;AACpC,CAAC"}

package/dist/watchers/git.js

@@ -1,39 +0,0 @@
-import { simpleGit } from "simple-git";
-/**
- * Polls git HEAD + current branch every 1.5s. Fires only on change.
- * This catches `git checkout`, `git switch`, and `git commit` performed inside
- * VS Code, keeping the PWA agent's view of the repo consistent.
- */
-export function startGitWatcher(session, emit) {
-    const git = simpleGit(session.workspace);
-    let lastBranch = null;
-    let lastHead = null;
-    let stopped = false;
-    const tick = async () => {
-        if (stopped)
-            return;
-        try {
-            const status = await git.status();
-            const head = (await git.revparse(["HEAD"])).trim();
-            const branch = status.current ?? null;
-            if (branch !== lastBranch || head !== lastHead) {
-                const kind = branch !== lastBranch ? "branch" : "head";
-                lastBranch = branch;
-                lastHead = head;
-                emit({ kind, branch, head, at: Date.now() });
-            }
-        }
-        catch {
-            // not a git repo — quietly stop polling
-            stopped = true;
-            return;
-        }
-        if (!stopped)
-            setTimeout(tick, 1500);
-    };
-    void tick();
-    return () => {
-        stopped = true;
-    };
-}
-//# sourceMappingURL=git.js.map

package/dist/watchers/git.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"git.js","sourceRoot":"","sources":["../../src/watchers/git.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAUvC;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,OAAgB,EAAE,IAA6B;IAC7E,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,IAAI,OAAO;YAAE,OAAO;QACpB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC;YACtC,IAAI,MAAM,KAAK,UAAU,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/C,MAAM,IAAI,GAAqB,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;gBACzE,UAAU,GAAG,MAAM,CAAC;gBACpB,QAAQ,GAAG,IAAI,CAAC;gBAChB,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;YACxC,OAAO,GAAG,IAAI,CAAC;YACf,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC;IAEF,KAAK,IAAI,EAAE,CAAC;IACZ,OAAO,GAAG,EAAE;QACV,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC"}