@anhlp/alp 0.0.1-beta.4 → 0.0.1-beta.7

package/packages/core/dist/log.js

@@ -1,156 +0,0 @@
-// packages/core/src/log.js
-import { open, stat } from "node:fs/promises";
-var LEVELS = Object.freeze({ debug: 10, info: 20, warn: 30, error: 40 });
-var REDACTED = "[redacted]";
-var OMITTED = "[omitted]";
-var MAX_STRING = 2e3;
-var MAX_DEPTH = 5;
-var MAX_KEYS = 50;
-var MAX_ITEMS = 20;
-var STACK_LINES = 8;
-var SECRET_KEY = /pass(word|wd)?|secret|token|api[-_]?key|authorization|credential|cookie|private[-_]?key|bearer|signature/i;
-var OMITTED_KEY = /^(env|environment|prompt|prompts|instructions|content|text|input|headers|body|args|argv)$/i;
-var SECRET_NAME = /KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH|COOKIE|PRIVATE/i;
-var PATTERNS = [
-  [/\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi, `$1 ${REDACTED}`],
-  [/\b(sk|rk|pk)-[A-Za-z0-9_-]{16,}/g, REDACTED],
-  [/\bgh[pousr]_[A-Za-z0-9]{20,}/g, REDACTED],
-  [/\bgithub_pat_[A-Za-z0-9_]{20,}/g, REDACTED],
-  [/\bxox[abprs]-[A-Za-z0-9-]{10,}/g, REDACTED],
-  [/\bAKIA[0-9A-Z]{16}\b/g, REDACTED],
-  [/\bAIza[0-9A-Za-z_-]{30,}/g, REDACTED],
-  [/\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}/g, REDACTED],
-  [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(-----END [A-Z ]*PRIVATE KEY-----|$)/g, REDACTED],
-  [/(\b[a-z][a-z0-9+.-]*:\/\/)[^\s/@:]+:[^\s/@]+@/gi, `$1${REDACTED}@`],
-  // NAME=value and NAME: value for names that look like secrets; also JSON "token": "value".
-  [/(\b[\w.-]*(?:key|token|secret|passw(?:or)?d|credential|authorization|cookie)[\w.-]*["']?\s*[=:]\s*)(?:"[^"]{4,}"|'[^']{4,}'|[^\s,;&"']{8,})/gi, `$1${REDACTED}`],
-  // --token value, --api-key value
-  [/(--[\w-]*(?:key|token|secret|passw(?:or)?d|credential)[\w-]*\s+)[^\s-][^\s]*/gi, `$1${REDACTED}`]
-];
-function secretValues(env) {
-  const values = /* @__PURE__ */ new Set();
-  for (const [name, value] of Object.entries(env ?? {})) if (typeof value === "string" && value.length >= 8 && SECRET_NAME.test(name)) values.add(value);
-  return [...values].sort((a, b) => b.length - a.length);
-}
-function scrubText(text, { env = process.env, max = MAX_STRING } = {}) {
-  let result = String(text);
-  for (const value of secretValues(env)) result = result.split(value).join(REDACTED);
-  for (const [pattern, replacement] of PATTERNS) result = result.replace(pattern, replacement);
-  return result.length > max ? `${result.slice(0, max)}... (${result.length - max} more characters)` : result;
-}
-function describeError(error, options = {}) {
-  if (!(error instanceof Error)) return { message: scrubText(error, options) };
-  const stack = typeof error.stack === "string" ? error.stack.split("\n").slice(0, STACK_LINES).join("\n") : void 0;
-  return {
-    name: error.name,
-    ...typeof error.code === "string" || typeof error.code === "number" ? { code: error.code } : {},
-    message: scrubText(error.message, options),
-    ...stack ? { stack: scrubText(stack, options) } : {},
-    ...error.cause !== void 0 ? { cause: describeError(error.cause, options) } : {}
-  };
-}
-function redact(value, options = {}, depth = 0, seen = /* @__PURE__ */ new WeakSet()) {
-  if (value === null || value === void 0 || typeof value === "boolean" || typeof value === "number") return value;
-  if (typeof value === "string") return scrubText(value, options);
-  if (typeof value === "bigint") return String(value);
-  if (typeof value !== "object") return void 0;
-  if (value instanceof Error) return describeError(value, options);
-  if (seen.has(value)) return "[circular]";
-  if (depth >= MAX_DEPTH) return "[too deep]";
-  seen.add(value);
-  if (Array.isArray(value)) {
-    const items = value.slice(0, MAX_ITEMS).map((item) => redact(item, options, depth + 1, seen));
-    return value.length > MAX_ITEMS ? [...items, `... ${value.length - MAX_ITEMS} more`] : items;
-  }
-  const result = {};
-  for (const [key, item] of Object.entries(value).slice(0, MAX_KEYS)) {
-    result[key] = OMITTED_KEY.test(key) ? OMITTED : SECRET_KEY.test(key) ? REDACTED : redact(item, options, depth + 1, seen);
-  }
-  return result;
-}
-var CORRELATION = ["sessionId", "rootId", "assignmentId", "clientMessageId", "requestId", "agent"];
-var stderrSink = (line) => {
-  try {
-    process.stderr.write(`${line}
-`);
-  } catch {
-  }
-};
-function createLogger({ component, level, context = {}, write = stderrSink, now = () => /* @__PURE__ */ new Date(), env = process.env } = {}) {
-  const threshold = LEVELS[level ?? env.ALP_LOG_LEVEL] ?? LEVELS.info;
-  const options = { env };
-  const emit = (name, message, fields = {}) => {
-    if (LEVELS[name] < threshold) return;
-    try {
-      const { code, error, ...rest } = { ...context, ...fields };
-      const record = {
-        time: now().toISOString(),
-        level: name,
-        component,
-        ...code ? { code: String(code) } : {},
-        msg: scrubText(message, options)
-      };
-      for (const key of CORRELATION) if (rest[key] !== void 0) record[key] = redact(String(rest[key]), options);
-      if (error !== void 0) {
-        record.error = describeError(error, options);
-        if (!record.code && record.error.code !== void 0) record.code = String(record.error.code);
-      }
-      for (const [key, value] of Object.entries(rest)) {
-        if (CORRELATION.includes(key)) continue;
-        record[key] = OMITTED_KEY.test(key) ? OMITTED : SECRET_KEY.test(key) ? REDACTED : redact(value, options);
-      }
-      write(JSON.stringify(record));
-    } catch {
-    }
-  };
-  return {
-    component,
-    debug: (message, fields) => emit("debug", message, fields),
-    info: (message, fields) => emit("info", message, fields),
-    warn: (message, fields) => emit("warn", message, fields),
-    error: (message, fields) => emit("error", message, fields),
-    child: (extra = {}, name = component) => createLogger({ component: name, level, context: { ...context, ...extra }, write, now, env })
-  };
-}
-var TAIL_BYTES = 256 * 1024;
-async function readLogTail(file, { bytes = TAIL_BYTES, env = process.env } = {}) {
-  let handle;
-  try {
-    handle = await open(file, "r");
-    const { size } = await stat(file);
-    const start = Math.max(0, size - bytes);
-    const buffer = Buffer.alloc(size - start);
-    await handle.read(buffer, 0, buffer.length, start);
-    const lines = buffer.toString("utf8").split("\n");
-    if (start > 0) lines.shift();
-    const records = [];
-    for (const line of lines) {
-      if (!line.trim()) continue;
-      try {
-        const record = JSON.parse(line);
-        if (record && typeof record === "object" && typeof record.time === "string" && typeof record.level === "string" && typeof record.msg === "string") {
-          records.push(redact(record, { env }));
-          continue;
-        }
-      } catch {
-      }
-      records.push({ legacy: scrubText(line, { env, max: 500 }) });
-    }
-    return records;
-  } catch (error) {
-    if (error?.code === "ENOENT") return [];
-    throw error;
-  } finally {
-    await handle?.close();
-  }
-}
-export {
-  LEVELS,
-  OMITTED,
-  REDACTED,
-  createLogger,
-  describeError,
-  readLogTail,
-  redact,
-  scrubText
-};

package/packages/core/dist/migrations.d.ts

@@ -1,9 +0,0 @@
-export type Migration = { from: number; to: number; name: string; run(home: string): Promise<void> };
-export const MIGRATIONS: Migration[];
-export type MigrationResult = { from: number; to: number; steps: Array<{ name: string; from: number; to: number; backup: string; resumed: boolean }> };
-export function migrateState(home: string, options?: {
-  by?: string;
-  migrations?: Migration[];
-  target?: number;
-  log?: { info(message: string, fields?: object): void; warn(message: string, fields?: object): void };
-}): Promise<MigrationResult>;

package/packages/core/dist/migrations.js

@@ -1,95 +0,0 @@
-// packages/core/src/migrations.js
-import { readdir, readFile, rm, stat } from "node:fs/promises";
-import path from "node:path";
-import { AlpError } from "./errors.js";
-import { writeAtomic } from "./atomic.js";
-import { STATE_SCHEMA, assertStateSupported, migrationFile, readStateSchema, stateDir, writeStateSchema } from "./state-schema.js";
-import { STATE_UNITS, automaticBackup, restoreBackup } from "./backup.js";
-async function timelineCursors(home) {
-  const directory = path.join(stateDir(home), "timeline");
-  const names = await readdir(directory).catch((error) => {
-    if (error?.code === "ENOENT") return [];
-    throw error;
-  });
-  for (const name of names.filter((name2) => name2.endsWith(".jsonl"))) {
-    const file = path.join(directory, name);
-    const lines = [];
-    let cursor = 0;
-    let changed = false;
-    for (const line of (await readFile(file, "utf8")).split("\n")) {
-      if (!line) continue;
-      let envelope;
-      try {
-        envelope = JSON.parse(line);
-      } catch {
-        lines.push(line);
-        continue;
-      }
-      cursor = typeof envelope?.cursor === "number" && envelope.cursor > cursor ? envelope.cursor : cursor + 1;
-      if (envelope?.cursor === cursor) {
-        lines.push(line);
-        continue;
-      }
-      lines.push(JSON.stringify({ ...envelope, cursor }));
-      changed = true;
-    }
-    if (changed) await writeAtomic(file, lines.map((line) => `${line}
-`).join(""));
-  }
-}
-var MIGRATIONS = [
-  { from: 1, to: 2, name: "timeline-cursors", run: timelineCursors }
-];
-async function readJournal(home) {
-  try {
-    return JSON.parse(await readFile(migrationFile(home), "utf8"));
-  } catch (error) {
-    if (error?.code === "ENOENT") return void 0;
-    return {};
-  }
-}
-var exists = (file) => stat(file).then(() => true, () => false);
-async function migrateState(home, { by = "alp", migrations = MIGRATIONS, target = STATE_SCHEMA, log } = {}) {
-  const info = assertStateSupported(await readStateSchema(home), home);
-  let journal = await readJournal(home);
-  if (journal && Number.isSafeInteger(journal.to) && journal.to <= info.schema) {
-    await rm(migrationFile(home), { force: true });
-    journal = void 0;
-  }
-  if (info.fresh && !journal) {
-    await writeStateSchema(home, target, by);
-    return { from: target, to: target, steps: [] };
-  }
-  let schema = info.schema;
-  const steps = [];
-  while (schema < target) {
-    const step = migrations.find((candidate) => candidate.from === schema);
-    if (!step) throw new AlpError("STATE_MIGRATION_MISSING", `ALP has no migration from state schema ${schema}; the state was not changed`);
-    const resumed = journal?.to === step.to && typeof journal.backup === "string" && await exists(journal.backup);
-    const backup = resumed ? journal.backup : await automaticBackup(home, `pre-migrate-v${step.from}-v${step.to}`, { units: STATE_UNITS, by });
-    if (!resumed) await writeAtomic(migrationFile(home), JSON.stringify({ from: step.from, to: step.to, name: step.name, backup, by, startedAt: (/* @__PURE__ */ new Date()).toISOString() }) + "\n");
-    log?.info(`${resumed ? "continuing" : "running"} state migration ${step.name} (schema ${step.from} \u2192 ${step.to}); backup ${backup}`, { code: "ALP_STATE_MIGRATING", from: step.from, to: step.to, migration: step.name, resumed });
-    try {
-      await step.run(home);
-    } catch (error) {
-      try {
-        await restoreBackup({ home, file: backup, projects: false, safety: false, clearLive: false, by });
-      } catch (rollback) {
-        throw new AlpError("STATE_MIGRATION_ROLLBACK_FAILED", `state migration ${step.name} failed (${error?.message ?? error}) and putting the state back from ${backup} failed too (${rollback?.message ?? rollback}); the next start tries the migration again. See docs/alp/data-recovery.md`, { cause: error });
-      }
-      await rm(migrationFile(home), { force: true });
-      throw new AlpError("STATE_MIGRATION_FAILED", `state migration ${step.name} (schema ${step.from} \u2192 ${step.to}) failed: ${error?.message ?? error}; data was restored from ${backup} with workspace authority checks. See docs/alp/data-recovery.md`, { cause: error });
-    }
-    await writeStateSchema(home, step.to, by);
-    await rm(migrationFile(home), { force: true });
-    steps.push({ name: step.name, from: step.from, to: step.to, backup, resumed });
-    schema = step.to;
-    journal = void 0;
-  }
-  if (!info.marked && !steps.length) await writeStateSchema(home, schema, by);
-  return { from: info.schema, to: schema, steps };
-}
-export {
-  MIGRATIONS,
-  migrateState
-};

package/packages/core/dist/models.d.ts

@@ -1,11 +0,0 @@
-/**
- * @type {Array<{ runtime: 'codex' | 'claude' | 'antigravity', id: string, label: string, description: string, efforts: string[], effort?: string }>}
- */
-export const MODELS: Array<{
-    runtime: "codex" | "claude" | "antigravity";
-    id: string;
-    label: string;
-    description: string;
-    efforts: string[];
-    effort?: string;
-}>;

package/packages/core/dist/models.js

@@ -1,44 +0,0 @@
-// packages/core/src/models.js
-var codexFull = ["low", "medium", "high", "xhigh", "max", "ultra"];
-var codexStandard = ["low", "medium", "high", "xhigh", "max"];
-var claudeFull = ["low", "medium", "high", "xhigh", "max", "ultracode"];
-var claudeLegacy = ["off", "low", "medium", "high", "xhigh", "max", "ultracode"];
-var claude46 = ["off", "low", "medium", "high", "max"];
-var MODELS = [
-  ["codex", "gpt-6.1-sol", "GPT-6.1-Sol", "Latest workhorse model for coding and everyday work.", codexFull, "low"],
-  // ALP runs GPT-6 Astra at low effort only.
-  ["codex", "gpt-6-astra", "GPT-6-Astra", "Frontier intelligence for the most demanding work.", ["low"], "low"],
-  ["codex", "gpt-6-sol", "GPT-6-Sol", "Previous generation workhorse model.", codexFull, "low"],
-  ["codex", "gpt-6-luna", "GPT-6-Luna", "Fast and affordable model for easier tasks.", codexStandard, "low"],
-  ["codex", "gpt-5.6-sol", "GPT-5.6-Sol", "Older generation workhorse model.", codexFull, "low"],
-  ["codex", "gpt-5.6-terra", "GPT-5.6-Terra", "Older balanced model for straightforward work.", codexFull, "low"],
-  ["codex", "gpt-5.6-luna", "GPT-5.6-Luna", "Older fast and efficient model.", codexStandard, "low"],
-  ["claude", "claude-opus-5-5", "Opus 5.5", "Latest release.", claudeFull, "medium"],
-  ["claude", "claude-opus-5", "Opus 5", "Previous release.", claudeLegacy, "high"],
-  ["claude", "claude-fable-5-1", "Fable 5.1", "Most powerful model.", claudeFull, "high"],
-  ["claude", "claude-fable-5", "Fable 5", "Previous release.", claudeFull, "high"],
-  ["claude", "claude-opus-4-8[1m]", "Opus 4.8 1M", "Opus 4.8 with 1M context window.", claudeLegacy, "high"],
-  ["claude", "claude-opus-4-8", "Opus 4.8", "Previous release.", claudeLegacy, "high"],
-  ["claude", "claude-sonnet-5-5", "Sonnet 5.5", "Best for everyday tasks.", claudeFull, "medium"],
-  ["claude", "claude-sonnet-5", "Sonnet 5", "Previous release.", claudeLegacy, "high"],
-  ["claude", "claude-sonnet-5[1m]", "Sonnet 5 1M", "Sonnet 5 with 1M context window.", claudeLegacy, "high"],
-  ["claude", "claude-opus-4-7[1m]", "Opus 4.7 1M", "Opus 4.7 with 1M context window.", claudeLegacy, "high"],
-  ["claude", "claude-opus-4-7", "Opus 4.7", "Previous release.", claudeLegacy, "high"],
-  ["claude", "claude-opus-4-6[1m]", "Opus 4.6 1M", "Opus 4.6 with 1M context window.", claude46, "high"],
-  ["claude", "claude-opus-4-6", "Opus 4.6", "Most capable for complex work.", claude46, "high"],
-  ["claude", "claude-sonnet-4-6[1m]", "Sonnet 4.6 1M", "Sonnet 4.6 with 1M context window.", claude46, "high"],
-  ["claude", "claude-sonnet-4-6", "Sonnet 4.6", "Best for everyday tasks.", claude46, "high"],
-  ["claude", "claude-haiku-4-5", "Haiku 4.5", "Fastest for quick answers.", [], void 0],
-  ["claude", "sonnet", "sonnet", "From Claude settings.json model.", [], void 0],
-  ["antigravity", "gemini-3.8-flash-high", "Gemini 3.8 Flash (High)", "High reasoning effort workhorse for complex tasks.", [], void 0],
-  ["antigravity", "gemini-3.8-flash-medium", "Gemini 3.8 Flash (Medium)", "Balanced speed and reasoning.", [], void 0],
-  ["antigravity", "gemini-3.8-flash-low", "Gemini 3.8 Flash (Low)", "Fast and efficient for straightforward work.", [], void 0],
-  ["antigravity", "gemini-2.5-pro", "Gemini 2.5 Pro", "Deep reasoning for coding and analysis.", [], void 0],
-  ["antigravity", "gemini-2.5-flash", "Gemini 2.5 Flash", "Fast and versatile everyday model.", [], void 0],
-  ["antigravity", "claude-sonnet-4-6", "Claude Sonnet 4.6", "Sonnet 4.6 via Antigravity.", [], void 0],
-  ["antigravity", "claude-opus-4-6-thinking", "Claude Opus 4.6 Thinking", "Opus 4.6 with thinking via Antigravity.", [], void 0],
-  ["antigravity", "gpt-oss-120b-medium", "GPT-OSS 120B (Medium)", "Open weights model via Antigravity.", [], void 0]
-].map(([runtime, id, label, description, efforts, effort]) => ({ runtime, id, label, description, efforts, ...effort ? { effort } : {} }));
-export {
-  MODELS
-};

package/packages/core/dist/permissions.d.ts

@@ -1,14 +0,0 @@
-export type PermissionBase = 'read-only' | 'workspace-write' | 'full-access';
-export type PermissionProfile = { name: string; base: PermissionBase; allow: string[]; ask: string[]; deny: string[]; beyondMode: 'refuse' | 'ask'; workdir?: 'copy' };
-export const BASES: PermissionBase[];
-export const ADVISORS: string[];
-export const MAX_RULES: number;
-export const TOOLS: string[];
-export function parseRule(rule: unknown, source?: string): { tool: string; specifier?: string };
-export function validatePermissions(value: unknown, source: string): { profiles: Record<string, { base?: PermissionBase; beyondMode?: 'refuse' | 'ask'; workdir?: 'copy'; allow: string[]; ask: string[]; deny: string[] }>; agents: Record<string, string> };
-export function addAllowRule(projectRoot: string, home: string | undefined, profileName: string, rule: string): Promise<string>;
-export function profileFor(projectRoot: string, home: string | undefined, agent: string): Promise<PermissionProfile | null>;
-export function capMode(mode: string, base: string): string;
-export function unwrapShell(command: string): string;
-export function simpleCommands(line: string): string[] | null;
-export function commandDecision(profile: Pick<PermissionProfile, 'allow' | 'deny'> & { ask?: string[] }, command: string): 'allow' | 'ask' | 'deny' | undefined;

package/packages/core/dist/permissions.js

@@ -1,229 +0,0 @@
-// packages/core/src/permissions.js
-import path from "node:path";
-import { randomUUID } from "node:crypto";
-import { readFile, writeFile } from "node:fs/promises";
-import { moveFile } from "./atomic.js";
-import { AlpError } from "./errors.js";
-var BASES = ["read-only", "workspace-write", "full-access"];
-var RANK = { "read-only": 0, "workspace-write": 1, "full-access": 2 };
-var ADVISORS = ["oracle", "reviewer", "supervisor"];
-var MAX_RULES = 200;
-var NAME = /^[\w.-]{1,64}$/;
-var RULE = /^([A-Za-z][\w-]*)(?:\((.*)\))?$/s;
-var TOOLS = ["Bash", "Read", "Edit", "Write", "MultiEdit", "NotebookEdit", "Glob", "Grep", "WebFetch", "WebSearch", "Skill"];
-var own = (value, key) => Object.hasOwn(value, key) ? value[key] : void 0;
-var setOwn = (value, key, entry) => Object.defineProperty(value, key, { value: entry, enumerable: true, writable: true, configurable: true });
-var object = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
-var fail = (source, message) => {
-  throw new AlpError("INVALID_SETTINGS", `${source}: ${message}`);
-};
-function parseRule(rule, source = "rule") {
-  if (typeof rule !== "string" || rule.length > 500) fail(source, "a rule is text of at most 500 characters");
-  const match = RULE.exec(rule.trim());
-  if (!match) fail(source, `${JSON.stringify(rule)} is not Tool or Tool(specifier)`);
-  const [, tool, specifier] = match;
-  if (!TOOLS.includes(tool) && !/^mcp__[\w-]+(__[\w-]+)?$/.test(tool)) fail(source, `${JSON.stringify(rule)} names unknown tool ${tool}; use ${TOOLS.join(", ")} or mcp__<server>__<tool>`);
-  if (specifier !== void 0 && !specifier.trim()) fail(source, `${JSON.stringify(rule)} has an empty specifier`);
-  return { tool, ...specifier !== void 0 && specifier.trim() !== "*" ? { specifier: specifier.trim() } : {} };
-}
-function validatePermissions(value, source) {
-  if (value === void 0) return { profiles: {}, agents: {} };
-  if (!object(value)) fail(source, "permissions must be an object");
-  for (const key of Object.keys(value)) if (!["profiles", "agents"].includes(key)) fail(source, `unsupported permissions field '${key}'`);
-  const profiles = {};
-  if (value.profiles !== void 0) {
-    if (!object(value.profiles)) fail(source, "permissions.profiles must be an object");
-    for (const [name, profile] of Object.entries(value.profiles)) {
-      const where = `permissions.profiles.${name}`;
-      if (!NAME.test(name)) fail(source, `${where}: a profile name has letters, digits, dots, dashes and underscores`);
-      if (!object(profile)) fail(source, `${where} must be an object`);
-      for (const key of Object.keys(profile)) if (!["base", "allow", "ask", "deny", "beyondMode", "workdir"].includes(key)) fail(source, `${where}: unsupported field '${key}'`);
-      if (profile.workdir !== void 0 && profile.workdir !== "copy") fail(source, `${where}.workdir must be copy`);
-      if (profile.workdir === "copy" && profile.base !== void 0 && profile.base !== "read-only") fail(source, `${where}: workdir copy is for read-only profiles; writers use worktree isolation`);
-      if (profile.base !== void 0 && !BASES.includes(profile.base)) fail(source, `${where}.base must be ${BASES.join(", ")}`);
-      if (profile.beyondMode !== void 0 && !["refuse", "ask"].includes(profile.beyondMode)) fail(source, `${where}.beyondMode must be refuse or ask`);
-      const rules = {};
-      for (const kind of ["allow", "ask", "deny"]) {
-        const list = profile[kind] ?? [];
-        if (!Array.isArray(list) || list.length > MAX_RULES) fail(source, `${where}.${kind} must list at most ${MAX_RULES} rules`);
-        for (const rule of list) parseRule(rule, `${source}: ${where}.${kind}`);
-        rules[kind] = list.map((rule) => rule.trim());
-      }
-      setOwn(profiles, name, { ...profile.base ? { base: profile.base } : {}, ...profile.beyondMode ? { beyondMode: profile.beyondMode } : {}, ...profile.workdir ? { workdir: profile.workdir } : {}, ...rules });
-    }
-  }
-  const agents = {};
-  if (value.agents !== void 0) {
-    if (!object(value.agents)) fail(source, "permissions.agents must be an object");
-    for (const [agent, profile] of Object.entries(value.agents)) {
-      if (typeof profile !== "string" || !NAME.test(profile)) fail(source, `permissions.agents.${agent} must name a profile`);
-      setOwn(agents, agent, profile);
-    }
-  }
-  return { profiles, agents };
-}
-async function settingsPermissions(file) {
-  let text;
-  try {
-    text = await readFile(file, "utf8");
-  } catch (error) {
-    if (error.code === "ENOENT") return { profiles: {}, agents: {} };
-    throw error;
-  }
-  let settings;
-  try {
-    settings = JSON.parse(text);
-  } catch (error) {
-    fail(file, `invalid JSON: ${error.message}`);
-  }
-  if (!object(settings)) fail(file, "expected an object");
-  return validatePermissions(settings.permissions, file);
-}
-async function profileFor(projectRoot, home, agent) {
-  const project = await settingsPermissions(path.join(projectRoot, ".alp", "settings.json"));
-  const user = home ? await settingsPermissions(path.join(home, "settings.json")) : { profiles: {}, agents: {} };
-  const name = own(project.agents, agent) ?? own(user.agents, agent);
-  const advisor = ADVISORS.includes(agent);
-  if (!name) return advisor ? { name: "read-only", base: "read-only", allow: [], ask: [], deny: [], beyondMode: "refuse" } : null;
-  const defined = [own(project.profiles, name), own(user.profiles, name)].filter(Boolean);
-  if (!defined.length && !BASES.includes(name)) {
-    throw new AlpError("INVALID_SETTINGS", `permissions.agents.${agent} names profile '${name}', which no settings file defines`);
-  }
-  const base = defined.find((profile) => profile.base)?.base ?? (BASES.includes(name) ? name : advisor ? "read-only" : "full-access");
-  const copy = defined.some((profile) => profile.workdir === "copy");
-  if (copy && base !== "read-only") throw new AlpError("INVALID_SETTINGS", `Profile '${name}' has workdir copy, which needs base read-only`);
-  if (advisor && base !== "read-only") throw new AlpError("INVALID_SETTINGS", `${agent} is an advisor; its profile '${name}' must have base read-only`);
-  return {
-    name,
-    base,
-    allow: [...new Set(defined.flatMap((profile) => profile.allow ?? []))],
-    ask: [...new Set(defined.flatMap((profile) => profile.ask ?? []))],
-    deny: [...new Set(defined.flatMap((profile) => profile.deny ?? []))],
-    beyondMode: defined.find((profile) => profile.beyondMode)?.beyondMode ?? "refuse",
-    ...copy ? { workdir: "copy" } : {}
-  };
-}
-async function addAllowRule(projectRoot, home, profileName, rule) {
-  parseRule(rule);
-  for (const file of [path.join(projectRoot, ".alp", "settings.json"), ...home ? [path.join(home, "settings.json")] : []]) {
-    let settings;
-    try {
-      settings = JSON.parse(await readFile(file, "utf8"));
-    } catch (error) {
-      if (error.code === "ENOENT") continue;
-      throw error;
-    }
-    const profile = settings?.permissions?.profiles?.[profileName];
-    if (!object(profile)) continue;
-    profile.allow = [.../* @__PURE__ */ new Set([...profile.allow ?? [], rule])];
-    validatePermissions(settings.permissions, file);
-    const temporary = `${file}.${randomUUID().slice(0, 8)}.tmp`;
-    await writeFile(temporary, `${JSON.stringify(settings, null, 2)}
-`);
-    await moveFile(temporary, file);
-    return file;
-  }
-  throw new AlpError("INVALID_SETTINGS", `No settings file defines profile ${profileName}`);
-}
-var capMode = (mode, base) => (RANK[mode] ?? 0) <= (RANK[base] ?? 0) ? mode : base;
-function unwrapShell(command) {
-  const match = /^(?:\/\S*\/)?(?:ba|z|da)?sh\s+-l?c\s+(['"])([\s\S]*)\1\s*$/.exec(command.trim());
-  if (!match) return command.trim();
-  return match[1] === "'" ? match[2].replace(/'\\''/g, "'") : match[2].replace(/\\(["\\$`])/g, "$1");
-}
-function simpleCommands(line) {
-  const parts = [];
-  let current = "";
-  let quote = null;
-  for (let i = 0; i < line.length; i++) {
-    const char = line[i];
-    if (quote) {
-      if (char === "\\" && quote === '"') {
-        current += char + (line[++i] ?? "");
-        continue;
-      }
-      if (char === quote) quote = null;
-      if (quote === '"' && (char === "`" || char === "$" && line[i + 1] === "(")) return null;
-      current += char;
-      continue;
-    }
-    if (char === "\\") {
-      current += char + (line[++i] ?? "");
-      continue;
-    }
-    if (char === "'" || char === '"') {
-      quote = char;
-      current += char;
-      continue;
-    }
-    if (char === "`" || char === "$" && line[i + 1] === "(" || (char === "<" || char === ">") && line[i + 1] === "(") return null;
-    const two = line.slice(i, i + 2);
-    if (two === ">&" || two === "<&" || two === "&>") {
-      current += two;
-      i++;
-      continue;
-    }
-    if (two === "&&" || two === "||") {
-      parts.push(current);
-      current = "";
-      i++;
-      continue;
-    }
-    if (char === ";" || char === "|" || char === "\n" || char === "&") {
-      parts.push(current);
-      current = "";
-      continue;
-    }
-    current += char;
-  }
-  if (quote) return null;
-  parts.push(current);
-  return parts.map((part) => part.trim()).filter(Boolean);
-}
-function covers(specifier, command) {
-  if (specifier === void 0) return true;
-  const normalized = command.replace(/\s+/g, " ");
-  if (specifier.endsWith(":*") || specifier.endsWith(" *")) {
-    const prefix = specifier.slice(0, -2).trim().replace(/\s+/g, " ");
-    return normalized === prefix || normalized.startsWith(`${prefix} `);
-  }
-  if (specifier.endsWith("*")) return normalized.startsWith(specifier.slice(0, -1).replace(/\s+/g, " "));
-  return normalized === specifier.replace(/\s+/g, " ");
-}
-function redirects(command) {
-  const unquoted = command.replace(/'[^']*'|"(?:[^"\\]|\\.)*"/g, '""');
-  for (const match of unquoted.matchAll(/(?:\d*|&)>>?\s*(&?)(\S*)/g)) {
-    if (match[1] === "&" && /^\d+$/.test(match[2])) continue;
-    if (match[2] === "/dev/null") continue;
-    return true;
-  }
-  return false;
-}
-var bashRules = (rules) => rules.map((rule) => parseRule(rule)).filter((rule) => rule.tool === "Bash");
-function commandDecision(profile, command) {
-  const line = unwrapShell(command);
-  const parts = simpleCommands(line);
-  const deny = bashRules(profile.deny);
-  if (deny.some((rule) => rule.specifier === void 0)) return "deny";
-  if (!parts) return deny.length ? "deny" : (profile.ask ?? []).length ? "ask" : void 0;
-  if (parts.some((part) => deny.some((rule) => covers(rule.specifier, part)))) return "deny";
-  const ask = bashRules(profile.ask ?? []);
-  if (ask.some((rule) => rule.specifier === void 0) || parts.some((part) => ask.some((rule) => covers(rule.specifier, part)))) return "ask";
-  const allow = bashRules(profile.allow);
-  if (parts.every((part) => !redirects(part) && allow.some((rule) => covers(rule.specifier, part)))) return "allow";
-  return void 0;
-}
-export {
-  ADVISORS,
-  BASES,
-  MAX_RULES,
-  TOOLS,
-  addAllowRule,
-  capMode,
-  commandDecision,
-  parseRule,
-  profileFor,
-  simpleCommands,
-  unwrapShell,
-  validatePermissions
-};

package/packages/core/dist/profiles.d.ts

@@ -1,27 +0,0 @@
-/** Migrate complete choices while leaving legacy partial overrides readable. */
-export function normalizeAgentProfiles(config: any, name: any): any;
-/** Snapshot current user team choices into editable project profiles. */
-export function projectProfiles({ root, library, templates, runtime, teamIds }?: {
-    library?: string | undefined;
-}): Promise<{}>;
-/** Apply per-project agent choices without replacing the team's graph or rules. */
-export function applyProfile(team: any, profile: any): any;
-/** Refresh only inherited profiles; older scaffolds are recognized by their shipped defaults. */
-export function syncTemplateProfiles(settings: any, options?: {}): Promise<any>;
-export function userLibrary(): string;
-export function oracleProfiles(config: import("./types.js").AgentProfilesConfig | undefined): Array<import("./types.js").AgentModelConfig>;
-export function agentProfiles(config: import("./types.js").AgentProfilesConfig | undefined, name: string): Array<import("./types.js").AgentModelConfig>;
-export function parseProfile(profile: any): any;
-export function profileString(profile: any): string;
-export function modelEfforts(id: any): string[] | undefined;
-export function fitEffort(id: any, effort: any): any;
-export function anyModel(profile: any): boolean;
-export function offers(profiles: any, model: any): any;
-export function selectedProfile(profiles: Array<import("./types.js").AgentModelConfig>, model: string | undefined): import("./types.js").AgentModelConfig | undefined;
-export function profileModel(config: any): any;
-export function profileFingerprint(config: any, name: any): string;
-export function profileDefaults(profiles: any): {
-    [k: string]: {
-        [k: string]: string;
-    };
-};