@ashx-j/lunr 0.1.0

package/dist/core/plan-mode.js

@@ -0,0 +1,388 @@
+/**
+ * lunr: plan permission mode — read-only tool-gating heuristics + system-prompt addendum.
+ *
+ * Plan is a first-class permission mode (`PermissionMode = "plan"`). `gateToolCall`
+ * in permissions.ts applies `planModeBlockReason` when the session is in plan:
+ * `edit`/`write` and mutating `bash` are hard-blocked; read tools stay open.
+ * InteractiveMode installs `PLAN_MODE_ADDENDUM` via the shared system-prompt
+ * append slot (same slot auto mode uses).
+ *
+ * Bash heuristic (conservative, blocklist-based — NOT a security boundary):
+ * - any `>`/`>>` redirect outside quotes blocks the whole command;
+ * - the command is split on `;`, `|`, `&` separators (outside quotes) and every segment's
+ *   leading command must be read-only:
+ *   - known mutating commands (rm, mv, cp, mkdir, sed -i, tee, …) are blocked;
+ *   - `git` is limited to read-only subcommands (status/log/diff/show/… plus flag-only
+ *     branch/tag/remote); mutating subcommands (add/commit/push/checkout/…) are blocked;
+ *   - package managers are limited to read-only subcommands (install/add/remove/… blocked);
+ *   - arbitrary runners (sudo, xargs, npx, sh -c …) are blocked.
+ * Unknown-but-not-listed commands are ALLOWED (blocklist, not allowlist) — the model is
+ * additionally steered by the system-prompt addendum. False positives are expected; the
+ * user can run the command themselves or exit plan mode with /plan off.
+ */
+/** Appended to the system prompt while plan mode is active. */
+export const PLAN_MODE_ADDENDUM = "You are in plan mode. Investigate read-only, then present your plan by calling the present_plan tool with a concise summary — the user approves or declines it in a dialog. Do not make changes until the plan is approved. The user can also exit plan mode manually with /plan off.";
+/** Error returned to the model when a tool call is blocked by plan mode. */
+export const PLAN_MODE_BLOCK_MESSAGE = "Plan mode is active — propose a plan; no file changes.";
+const BLOCKED_TOOLS = new Set([
+    "edit",
+    "write",
+    "behavior_add",
+    "behavior_remove",
+    "memory_add",
+    "memory_remove",
+    "cron",
+]);
+/** Small allowlist of read-only commands permitted in plan mode. Everything else is rejected. */
+const ALLOWED_COMMANDS = new Set([
+    "ls",
+    "ll",
+    "cat",
+    "tac",
+    "grep",
+    "rg",
+    "find",
+    "pwd",
+    "echo",
+    "printf",
+    "head",
+    "tail",
+    "wc",
+    "less",
+    "more",
+    "sort",
+    "uniq",
+    "diff",
+    "cmp",
+    "comm",
+    "test",
+    "[",
+    "true",
+    "false",
+    "which",
+    "whereis",
+    "stat",
+    "file",
+    "id",
+    "whoami",
+    "who",
+    "date",
+    "cal",
+    "env",
+    "printenv",
+    "uname",
+    "hostname",
+    "uptime",
+    "nproc",
+    "tput",
+    "git",
+    "gh",
+    "node",
+    "npm",
+    "pnpm",
+    "yarn",
+    "bun",
+]);
+const MUTATING_GIT_SUBCOMMANDS = new Set([
+    "add",
+    "commit",
+    "push",
+    "pull",
+    "merge",
+    "rebase",
+    "reset",
+    "checkout",
+    "switch",
+    "restore",
+    "rm",
+    "mv",
+    "stash",
+    "cherry-pick",
+    "revert",
+    "clean",
+    "fetch",
+    "config",
+    "apply",
+    "am",
+    "init",
+    "clone",
+    "submodule",
+    "worktree",
+    "gc",
+    "prune",
+    "update-index",
+]);
+// git subcommands that are read-only only when they carry no positional args or
+// mutating flags (`git branch` lists, `git branch foo` / `git branch -d foo` mutate).
+const CONDITIONAL_GIT_SUBCOMMANDS = new Set(["branch", "tag", "remote"]);
+const CONDITIONAL_GIT_MUTATING_FLAGS = new Set(["-d", "-D", "-m", "-M", "-c", "-C"]);
+const PACKAGE_MANAGER_MUTATIONS = {
+    npm: new Set([
+        "install",
+        "add",
+        "remove",
+        "uninstall",
+        "update",
+        "upgrade",
+        "publish",
+        "link",
+        "unlink",
+        "ci",
+        "init",
+    ]),
+    pnpm: new Set(["install", "add", "remove", "uninstall", "update", "upgrade", "publish", "link", "unlink", "init"]),
+    yarn: new Set(["install", "add", "remove", "uninstall", "upgrade", "publish", "link", "unlink", "init"]),
+    bun: new Set(["install", "add", "remove", "uninstall", "update", "upgrade", "publish", "link", "unlink", "init"]),
+};
+// Almost every subcommand mutates the system.
+const ALWAYS_MUTATING_MANAGERS = new Set([
+    "apt",
+    "apt-get",
+    "brew",
+    "dnf",
+    "yum",
+    "pacman",
+    "choco",
+    "winget",
+    "scoop",
+]);
+/** Flags that cause an interpreter to execute code and are never allowed in plan mode. */
+const EXECUTING_NODE_FLAGS = new Set([
+    "-e",
+    "--eval",
+    "-p",
+    "--print",
+    "-r",
+    "--require",
+    "--import",
+    "-i",
+    "--interactive",
+]);
+const EXECUTING_PYTHON_FLAGS = new Set(["-c", "-m", "-i", "--interactive"]);
+/**
+ * Returns the block reason when plan mode should block this tool call, else undefined.
+ */
+export function planModeBlockReason(toolName, input) {
+    if (BLOCKED_TOOLS.has(toolName)) {
+        return PLAN_MODE_BLOCK_MESSAGE;
+    }
+    if (toolName === "bash") {
+        const command = readBashCommand(input);
+        if (command && isMutatingBashCommand(command)) {
+            return `${PLAN_MODE_BLOCK_MESSAGE} Blocked command: ${command}`;
+        }
+    }
+    return undefined;
+}
+function readBashCommand(input) {
+    const command = input?.command;
+    return typeof command === "string" ? command : "";
+}
+/**
+ * Plan-mode bash allowlist. A command is mutating unless every segment is a
+ * known read-only command used safely (no redirects, no command substitution,
+ * no process substitution, no executing-interpreter flags).
+ */
+export function isMutatingBashCommand(command) {
+    if (!command.trim())
+        return false;
+    // Any output redirect outside quotes can write a file.
+    if (hasUnquotedRedirect(command))
+        return true;
+    // Command substitution / process substitution / grouped redirect syntaxes
+    // bypass a simple command-name check.
+    if (hasShellSubstitution(command))
+        return true;
+    // Every segment separated by ; | & && || must individually be read-only.
+    for (const segment of splitShellSegments(command)) {
+        if (isMutatingSegment(segment))
+            return true;
+    }
+    return false;
+}
+function hasUnquotedRedirect(command) {
+    let quote;
+    let escaped = false;
+    for (let i = 0; i < command.length; i++) {
+        const ch = command[i];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (ch === "\\" && quote !== "'") {
+            escaped = true;
+            continue;
+        }
+        if (quote) {
+            if (ch === quote)
+                quote = undefined;
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            quote = ch;
+            continue;
+        }
+        if (ch === ">")
+            return true;
+    }
+    return false;
+}
+function splitShellSegments(command) {
+    const segments = [];
+    let quote;
+    let escaped = false;
+    let start = 0;
+    for (let i = 0; i < command.length; i++) {
+        const ch = command[i];
+        const next = command[i + 1];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (ch === "\\" && quote !== "'") {
+            escaped = true;
+            continue;
+        }
+        if (quote) {
+            if (ch === quote)
+                quote = undefined;
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            quote = ch;
+            continue;
+        }
+        // Combined operators && and || split as one boundary.
+        if ((ch === "&" && next === "&") || (ch === "|" && next === "|")) {
+            segments.push(command.slice(start, i));
+            i++;
+            start = i + 1;
+            continue;
+        }
+        if (ch === ";" || ch === "|" || ch === "&" || ch === "\n") {
+            segments.push(command.slice(start, i));
+            start = i + 1;
+        }
+    }
+    segments.push(command.slice(start));
+    return segments.map((s) => s.trim()).filter((s) => s.length > 0);
+}
+/** True when the command contains command/process substitution outside quotes. */
+function hasShellSubstitution(command) {
+    let quote;
+    let escaped = false;
+    for (let i = 0; i < command.length; i++) {
+        const ch = command[i];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (ch === "\\" && quote !== "'") {
+            escaped = true;
+            continue;
+        }
+        if (quote) {
+            if (ch === quote)
+                quote = undefined;
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            quote = ch;
+            continue;
+        }
+        if (ch === "`")
+            return true;
+        if (ch === "$" && command[i + 1] === "(")
+            return true;
+        if (ch === "<" && command[i + 1] === "(")
+            return true;
+        if (ch === ">" && command[i + 1] === "(")
+            return true;
+        if (ch === "&" && command[i + 1] === ">")
+            return true;
+    }
+    return false;
+}
+function isMutatingSegment(segment) {
+    let tokens = segment.split(/\s+/).filter((t) => t.length > 0);
+    // Skip leading env assignments (FOO=bar cmd …) and command wrappers we can't see through.
+    while (tokens.length > 0 && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[0])) {
+        tokens = tokens.slice(1);
+    }
+    if (tokens.length === 0)
+        return false;
+    const command = basenameOf(tokens[0]).toLowerCase();
+    const args = tokens.slice(1);
+    if (ALWAYS_MUTATING_MANAGERS.has(command))
+        return true;
+    if (command === "sed") {
+        return args.some((a) => a === "-i" || a.startsWith("-i") || a.startsWith("--in-place") || /^-[^-]*i/.test(a));
+    }
+    if (command === "find") {
+        return args.some((a) => ["-delete", "-exec", "-execdir", "-ok", "-okdir"].includes(a));
+    }
+    if (command === "git") {
+        return isMutatingGit(args);
+    }
+    if (command === "gh") {
+        // Allow read-only views; block everything that changes remote state.
+        const sub = `${args[0] ?? ""} ${args[1] ?? ""}`;
+        return ![
+            "pr view",
+            "pr list",
+            "pr status",
+            "issue view",
+            "issue list",
+            "issue status",
+            "repo view",
+            "release view",
+            "release list",
+            "run list",
+            "run view",
+            "status",
+        ].includes(sub.trim());
+    }
+    if (command === "sh" || command === "bash" || command === "zsh" || command === "dash") {
+        // `sh -c '…'` runs arbitrary code; bare `sh script` also executes. Block -c; allow
+        // nothing else is too restrictive for `bash --version`, so allow flag-only invocations.
+        return args.some((a) => a === "-c" || a === "-s") || args.some((a) => !a.startsWith("-"));
+    }
+    const pkgMutations = PACKAGE_MANAGER_MUTATIONS[command];
+    if (pkgMutations) {
+        const subcommand = args.find((a) => !a.startsWith("-"))?.toLowerCase();
+        return subcommand !== undefined && pkgMutations.has(subcommand);
+    }
+    // Node / Python interpreters: flag-only, no executing flags, no positional scripts.
+    if (command === "node") {
+        return args.some((a) => !a.startsWith("-")) || args.some((a) => EXECUTING_NODE_FLAGS.has(a));
+    }
+    if (command === "python" || command === "python3") {
+        return args.some((a) => !a.startsWith("-")) || args.some((a) => EXECUTING_PYTHON_FLAGS.has(a));
+    }
+    // Final gate: the command must be in the read-only allowlist.
+    return !ALLOWED_COMMANDS.has(command);
+}
+function isMutatingGit(args) {
+    // Skip global flags like --no-pager / -C <dir> / -c key=val crudely: find the first
+    // token that doesn't start with "-" (imperfect for -C/-c values; conservative is fine).
+    let index = 0;
+    while (args[index] === "--no-pager")
+        index++;
+    const subcommand = args[index]?.toLowerCase();
+    if (!subcommand)
+        return false;
+    if (subcommand.startsWith("-"))
+        return false; // bare `git --version` etc. is read-only
+    if (MUTATING_GIT_SUBCOMMANDS.has(subcommand))
+        return true;
+    if (CONDITIONAL_GIT_SUBCOMMANDS.has(subcommand)) {
+        const rest = args.slice(index + 1);
+        return rest.some((a) => !a.startsWith("-") || CONDITIONAL_GIT_MUTATING_FLAGS.has(a));
+    }
+    return false;
+}
+function basenameOf(token) {
+    const parts = token.split(/[\\/]/);
+    return parts[parts.length - 1] ?? token;
+}
+//# sourceMappingURL=plan-mode.js.map

package/dist/core/plan-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-mode.js","sourceRoot":"","sources":["../../src/core/plan-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,+DAA+D;AAC/D,MAAM,CAAC,MAAM,kBAAkB,GAC9B,yRAAuR,CAAC;AAEzR,4EAA4E;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAAG,0DAAwD,CAAC;AAEhG,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC7B,MAAM;IACN,OAAO;IACP,cAAc;IACd,iBAAiB;IACjB,YAAY;IACZ,eAAe;IACf,MAAM;CACN,CAAC,CAAC;AAEH,iGAAiG;AACjG,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAChC,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,KAAK;IACL,MAAM;IACN,IAAI;IACJ,MAAM;IACN,KAAK;IACL,MAAM;IACN,QAAQ;IACR,MAAM;IACN,MAAM;IACN,IAAI;IACJ,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,GAAG;IACH,MAAM;IACN,OAAO;IACP,OAAO;IACP,SAAS;IACT,MAAM;IACN,MAAM;IACN,IAAI;IACJ,QAAQ;IACR,KAAK;IACL,MAAM;IACN,KAAK;IACL,KAAK;IACL,UAAU;IACV,OAAO;IACP,UAAU;IACV,QAAQ;IACR,OAAO;IACP,MAAM;IACN,KAAK;IACL,IAAI;IACJ,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;CACL,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACxC,KAAK;IACL,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,OAAO;IACP,UAAU;IACV,QAAQ;IACR,SAAS;IACT,IAAI;IACJ,IAAI;IACJ,OAAO;IACP,aAAa;IACb,QAAQ;IACR,OAAO;IACP,OAAO;IACP,QAAQ;IACR,OAAO;IACP,IAAI;IACJ,MAAM;IACN,OAAO;IACP,WAAW;IACX,UAAU;IACV,IAAI;IACJ,OAAO;IACP,cAAc;CACd,CAAC,CAAC;AAEH,gFAAgF;AAChF,sFAAsF;AACtF,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AACzE,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAErF,MAAM,yBAAyB,GAAgC;IAC9D,GAAG,EAAE,IAAI,GAAG,CAAC;QACZ,SAAS;QACT,KAAK;QACL,QAAQ;QACR,WAAW;QACX,QAAQ;QACR,SAAS;QACT,SAAS;QACT,MAAM;QACN,QAAQ;QACR,IAAI;QACJ,MAAM;KACN,CAAC;IACF,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAClH,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxG,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;CACjH,CAAC;AAEF,8CAA8C;AAC9C,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACxC,KAAK;IACL,SAAS;IACT,MAAM;IACN,KAAK;IACL,KAAK;IACL,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,OAAO;CACP,CAAC,CAAC;AAEH,0FAA0F;AAC1F,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACpC,IAAI;IACJ,QAAQ;IACR,IAAI;IACJ,SAAS;IACT,IAAI;IACJ,WAAW;IACX,UAAU;IACV,IAAI;IACJ,eAAe;CACf,CAAC,CAAC;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;AAE5E;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,KAAc,EAAsB;IACzF,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,OAAO,uBAAuB,CAAC;IAChC,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,OAAO,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/C,OAAO,GAAG,uBAAuB,qBAAqB,OAAO,EAAE,CAAC;QACjE,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,SAAS,eAAe,CAAC,KAAc,EAAU;IAChD,MAAM,OAAO,GAAI,KAA2C,EAAE,OAAO,CAAC;IACtE,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;AAAA,CAClD;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAW;IAC/D,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IAElC,uDAAuD;IACvD,IAAI,mBAAmB,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,0EAA0E;IAC1E,sCAAsC;IACtC,IAAI,oBAAoB,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/C,yEAAyE;IACzE,KAAK,MAAM,OAAO,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,iBAAiB,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,mBAAmB,CAAC,OAAe,EAAW;IACtD,IAAI,KAA4B,CAAC;IACjC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACV,CAAC;QACD,IAAI,EAAE,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAClC,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACV,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACX,IAAI,EAAE,KAAK,KAAK;gBAAE,KAAK,GAAG,SAAS,CAAC;YACpC,SAAS;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC9B,KAAK,GAAG,EAAE,CAAC;YACX,SAAS;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;IAC7B,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,kBAAkB,CAAC,OAAe,EAAY;IACtD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,KAA4B,CAAC;IACjC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACV,CAAC;QACD,IAAI,EAAE,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAClC,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACV,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACX,IAAI,EAAE,KAAK,KAAK;gBAAE,KAAK,GAAG,SAAS,CAAC;YACpC,SAAS;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC9B,KAAK,GAAG,EAAE,CAAC;YACX,SAAS;QACV,CAAC;QACD,sDAAsD;QACtD,IAAI,CAAC,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YAClE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvC,CAAC,EAAE,CAAC;YACJ,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,SAAS;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAC3D,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvC,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;IACF,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACpC,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAAA,CACjE;AAED,kFAAkF;AAClF,SAAS,oBAAoB,CAAC,OAAe,EAAW;IACvD,IAAI,KAA4B,CAAC;IACjC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACV,CAAC;QACD,IAAI,EAAE,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YAClC,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACV,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACX,IAAI,EAAE,KAAK,KAAK;gBAAE,KAAK,GAAG,SAAS,CAAC;YACpC,SAAS;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC9B,KAAK,GAAG,EAAE,CAAC;YACX,SAAS;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC5B,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACtD,IAAI,EAAE,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAW;IACpD,IAAI,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9D,4FAA0F;IAC1F,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEtC,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE7B,IAAI,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvD,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACvB,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACtB,qEAAqE;QACrE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAChD,OAAO,CAAC;YACP,SAAS;YACT,SAAS;YACT,WAAW;YACX,YAAY;YACZ,YAAY;YACZ,cAAc;YACd,WAAW;YACX,cAAc;YACd,cAAc;YACd,UAAU;YACV,UAAU;YACV,QAAQ;SACR,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvF,qFAAmF;QACnF,wFAAwF;QACxF,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,YAAY,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,YAAY,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACvE,OAAO,UAAU,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACjE,CAAC;IAED,oFAAoF;IACpF,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,CAAC;IAED,8DAA8D;IAC9D,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAAA,CACtC;AAED,SAAS,aAAa,CAAC,IAAc,EAAW;IAC/C,oFAAoF;IACpF,wFAAwF;IACxF,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,YAAY;QAAE,KAAK,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,yCAAyC;IAEvF,IAAI,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,2BAA2B,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,UAAU,CAAC,KAAa,EAAU;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC;AAAA,CACxC","sourcesContent":["/**\n * lunr: plan permission mode — read-only tool-gating heuristics + system-prompt addendum.\n *\n * Plan is a first-class permission mode (`PermissionMode = \"plan\"`). `gateToolCall`\n * in permissions.ts applies `planModeBlockReason` when the session is in plan:\n * `edit`/`write` and mutating `bash` are hard-blocked; read tools stay open.\n * InteractiveMode installs `PLAN_MODE_ADDENDUM` via the shared system-prompt\n * append slot (same slot auto mode uses).\n *\n * Bash heuristic (conservative, blocklist-based — NOT a security boundary):\n * - any `>`/`>>` redirect outside quotes blocks the whole command;\n * - the command is split on `;`, `|`, `&` separators (outside quotes) and every segment's\n *   leading command must be read-only:\n *   - known mutating commands (rm, mv, cp, mkdir, sed -i, tee, …) are blocked;\n *   - `git` is limited to read-only subcommands (status/log/diff/show/… plus flag-only\n *     branch/tag/remote); mutating subcommands (add/commit/push/checkout/…) are blocked;\n *   - package managers are limited to read-only subcommands (install/add/remove/… blocked);\n *   - arbitrary runners (sudo, xargs, npx, sh -c …) are blocked.\n * Unknown-but-not-listed commands are ALLOWED (blocklist, not allowlist) — the model is\n * additionally steered by the system-prompt addendum. False positives are expected; the\n * user can run the command themselves or exit plan mode with /plan off.\n */\n\n/** Appended to the system prompt while plan mode is active. */\nexport const PLAN_MODE_ADDENDUM =\n\t\"You are in plan mode. Investigate read-only, then present your plan by calling the present_plan tool with a concise summary — the user approves or declines it in a dialog. Do not make changes until the plan is approved. The user can also exit plan mode manually with /plan off.\";\n\n/** Error returned to the model when a tool call is blocked by plan mode. */\nexport const PLAN_MODE_BLOCK_MESSAGE = \"Plan mode is active — propose a plan; no file changes.\";\n\nconst BLOCKED_TOOLS = new Set([\n\t\"edit\",\n\t\"write\",\n\t\"behavior_add\",\n\t\"behavior_remove\",\n\t\"memory_add\",\n\t\"memory_remove\",\n\t\"cron\",\n]);\n\n/** Small allowlist of read-only commands permitted in plan mode. Everything else is rejected. */\nconst ALLOWED_COMMANDS = new Set([\n\t\"ls\",\n\t\"ll\",\n\t\"cat\",\n\t\"tac\",\n\t\"grep\",\n\t\"rg\",\n\t\"find\",\n\t\"pwd\",\n\t\"echo\",\n\t\"printf\",\n\t\"head\",\n\t\"tail\",\n\t\"wc\",\n\t\"less\",\n\t\"more\",\n\t\"sort\",\n\t\"uniq\",\n\t\"diff\",\n\t\"cmp\",\n\t\"comm\",\n\t\"test\",\n\t\"[\",\n\t\"true\",\n\t\"false\",\n\t\"which\",\n\t\"whereis\",\n\t\"stat\",\n\t\"file\",\n\t\"id\",\n\t\"whoami\",\n\t\"who\",\n\t\"date\",\n\t\"cal\",\n\t\"env\",\n\t\"printenv\",\n\t\"uname\",\n\t\"hostname\",\n\t\"uptime\",\n\t\"nproc\",\n\t\"tput\",\n\t\"git\",\n\t\"gh\",\n\t\"node\",\n\t\"npm\",\n\t\"pnpm\",\n\t\"yarn\",\n\t\"bun\",\n]);\n\nconst MUTATING_GIT_SUBCOMMANDS = new Set([\n\t\"add\",\n\t\"commit\",\n\t\"push\",\n\t\"pull\",\n\t\"merge\",\n\t\"rebase\",\n\t\"reset\",\n\t\"checkout\",\n\t\"switch\",\n\t\"restore\",\n\t\"rm\",\n\t\"mv\",\n\t\"stash\",\n\t\"cherry-pick\",\n\t\"revert\",\n\t\"clean\",\n\t\"fetch\",\n\t\"config\",\n\t\"apply\",\n\t\"am\",\n\t\"init\",\n\t\"clone\",\n\t\"submodule\",\n\t\"worktree\",\n\t\"gc\",\n\t\"prune\",\n\t\"update-index\",\n]);\n\n// git subcommands that are read-only only when they carry no positional args or\n// mutating flags (`git branch` lists, `git branch foo` / `git branch -d foo` mutate).\nconst CONDITIONAL_GIT_SUBCOMMANDS = new Set([\"branch\", \"tag\", \"remote\"]);\nconst CONDITIONAL_GIT_MUTATING_FLAGS = new Set([\"-d\", \"-D\", \"-m\", \"-M\", \"-c\", \"-C\"]);\n\nconst PACKAGE_MANAGER_MUTATIONS: Record<string, Set<string>> = {\n\tnpm: new Set([\n\t\t\"install\",\n\t\t\"add\",\n\t\t\"remove\",\n\t\t\"uninstall\",\n\t\t\"update\",\n\t\t\"upgrade\",\n\t\t\"publish\",\n\t\t\"link\",\n\t\t\"unlink\",\n\t\t\"ci\",\n\t\t\"init\",\n\t]),\n\tpnpm: new Set([\"install\", \"add\", \"remove\", \"uninstall\", \"update\", \"upgrade\", \"publish\", \"link\", \"unlink\", \"init\"]),\n\tyarn: new Set([\"install\", \"add\", \"remove\", \"uninstall\", \"upgrade\", \"publish\", \"link\", \"unlink\", \"init\"]),\n\tbun: new Set([\"install\", \"add\", \"remove\", \"uninstall\", \"update\", \"upgrade\", \"publish\", \"link\", \"unlink\", \"init\"]),\n};\n\n// Almost every subcommand mutates the system.\nconst ALWAYS_MUTATING_MANAGERS = new Set([\n\t\"apt\",\n\t\"apt-get\",\n\t\"brew\",\n\t\"dnf\",\n\t\"yum\",\n\t\"pacman\",\n\t\"choco\",\n\t\"winget\",\n\t\"scoop\",\n]);\n\n/** Flags that cause an interpreter to execute code and are never allowed in plan mode. */\nconst EXECUTING_NODE_FLAGS = new Set([\n\t\"-e\",\n\t\"--eval\",\n\t\"-p\",\n\t\"--print\",\n\t\"-r\",\n\t\"--require\",\n\t\"--import\",\n\t\"-i\",\n\t\"--interactive\",\n]);\nconst EXECUTING_PYTHON_FLAGS = new Set([\"-c\", \"-m\", \"-i\", \"--interactive\"]);\n\n/**\n * Returns the block reason when plan mode should block this tool call, else undefined.\n */\nexport function planModeBlockReason(toolName: string, input: unknown): string | undefined {\n\tif (BLOCKED_TOOLS.has(toolName)) {\n\t\treturn PLAN_MODE_BLOCK_MESSAGE;\n\t}\n\tif (toolName === \"bash\") {\n\t\tconst command = readBashCommand(input);\n\t\tif (command && isMutatingBashCommand(command)) {\n\t\t\treturn `${PLAN_MODE_BLOCK_MESSAGE} Blocked command: ${command}`;\n\t\t}\n\t}\n\treturn undefined;\n}\n\nfunction readBashCommand(input: unknown): string {\n\tconst command = (input as { command?: unknown } | undefined)?.command;\n\treturn typeof command === \"string\" ? command : \"\";\n}\n\n/**\n * Plan-mode bash allowlist. A command is mutating unless every segment is a\n * known read-only command used safely (no redirects, no command substitution,\n * no process substitution, no executing-interpreter flags).\n */\nexport function isMutatingBashCommand(command: string): boolean {\n\tif (!command.trim()) return false;\n\n\t// Any output redirect outside quotes can write a file.\n\tif (hasUnquotedRedirect(command)) return true;\n\n\t// Command substitution / process substitution / grouped redirect syntaxes\n\t// bypass a simple command-name check.\n\tif (hasShellSubstitution(command)) return true;\n\n\t// Every segment separated by ; | & && || must individually be read-only.\n\tfor (const segment of splitShellSegments(command)) {\n\t\tif (isMutatingSegment(segment)) return true;\n\t}\n\treturn false;\n}\n\nfunction hasUnquotedRedirect(command: string): boolean {\n\tlet quote: \"'\" | '\"' | undefined;\n\tlet escaped = false;\n\tfor (let i = 0; i < command.length; i++) {\n\t\tconst ch = command[i];\n\t\tif (escaped) {\n\t\t\tescaped = false;\n\t\t\tcontinue;\n\t\t}\n\t\tif (ch === \"\\\\\" && quote !== \"'\") {\n\t\t\tescaped = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (quote) {\n\t\t\tif (ch === quote) quote = undefined;\n\t\t\tcontinue;\n\t\t}\n\t\tif (ch === \"'\" || ch === '\"') {\n\t\t\tquote = ch;\n\t\t\tcontinue;\n\t\t}\n\t\tif (ch === \">\") return true;\n\t}\n\treturn false;\n}\n\nfunction splitShellSegments(command: string): string[] {\n\tconst segments: string[] = [];\n\tlet quote: \"'\" | '\"' | undefined;\n\tlet escaped = false;\n\tlet start = 0;\n\tfor (let i = 0; i < command.length; i++) {\n\t\tconst ch = command[i];\n\t\tconst next = command[i + 1];\n\t\tif (escaped) {\n\t\t\tescaped = false;\n\t\t\tcontinue;\n\t\t}\n\t\tif (ch === \"\\\\\" && quote !== \"'\") {\n\t\t\tescaped = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (quote) {\n\t\t\tif (ch === quote) quote = undefined;\n\t\t\tcontinue;\n\t\t}\n\t\tif (ch === \"'\" || ch === '\"') {\n\t\t\tquote = ch;\n\t\t\tcontinue;\n\t\t}\n\t\t// Combined operators && and || split as one boundary.\n\t\tif ((ch === \"&\" && next === \"&\") || (ch === \"|\" && next === \"|\")) {\n\t\t\tsegments.push(command.slice(start, i));\n\t\t\ti++;\n\t\t\tstart = i + 1;\n\t\t\tcontinue;\n\t\t}\n\t\tif (ch === \";\" || ch === \"|\" || ch === \"&\" || ch === \"\\n\") {\n\t\t\tsegments.push(command.slice(start, i));\n\t\t\tstart = i + 1;\n\t\t}\n\t}\n\tsegments.push(command.slice(start));\n\treturn segments.map((s) => s.trim()).filter((s) => s.length > 0);\n}\n\n/** True when the command contains command/process substitution outside quotes. */\nfunction hasShellSubstitution(command: string): boolean {\n\tlet quote: \"'\" | '\"' | undefined;\n\tlet escaped = false;\n\tfor (let i = 0; i < command.length; i++) {\n\t\tconst ch = command[i];\n\t\tif (escaped) {\n\t\t\tescaped = false;\n\t\t\tcontinue;\n\t\t}\n\t\tif (ch === \"\\\\\" && quote !== \"'\") {\n\t\t\tescaped = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (quote) {\n\t\t\tif (ch === quote) quote = undefined;\n\t\t\tcontinue;\n\t\t}\n\t\tif (ch === \"'\" || ch === '\"') {\n\t\t\tquote = ch;\n\t\t\tcontinue;\n\t\t}\n\t\tif (ch === \"`\") return true;\n\t\tif (ch === \"$\" && command[i + 1] === \"(\") return true;\n\t\tif (ch === \"<\" && command[i + 1] === \"(\") return true;\n\t\tif (ch === \">\" && command[i + 1] === \"(\") return true;\n\t\tif (ch === \"&\" && command[i + 1] === \">\") return true;\n\t}\n\treturn false;\n}\n\nfunction isMutatingSegment(segment: string): boolean {\n\tlet tokens = segment.split(/\\s+/).filter((t) => t.length > 0);\n\t// Skip leading env assignments (FOO=bar cmd …) and command wrappers we can't see through.\n\twhile (tokens.length > 0 && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[0])) {\n\t\ttokens = tokens.slice(1);\n\t}\n\tif (tokens.length === 0) return false;\n\n\tconst command = basenameOf(tokens[0]).toLowerCase();\n\tconst args = tokens.slice(1);\n\n\tif (ALWAYS_MUTATING_MANAGERS.has(command)) return true;\n\n\tif (command === \"sed\") {\n\t\treturn args.some((a) => a === \"-i\" || a.startsWith(\"-i\") || a.startsWith(\"--in-place\") || /^-[^-]*i/.test(a));\n\t}\n\tif (command === \"find\") {\n\t\treturn args.some((a) => [\"-delete\", \"-exec\", \"-execdir\", \"-ok\", \"-okdir\"].includes(a));\n\t}\n\tif (command === \"git\") {\n\t\treturn isMutatingGit(args);\n\t}\n\tif (command === \"gh\") {\n\t\t// Allow read-only views; block everything that changes remote state.\n\t\tconst sub = `${args[0] ?? \"\"} ${args[1] ?? \"\"}`;\n\t\treturn ![\n\t\t\t\"pr view\",\n\t\t\t\"pr list\",\n\t\t\t\"pr status\",\n\t\t\t\"issue view\",\n\t\t\t\"issue list\",\n\t\t\t\"issue status\",\n\t\t\t\"repo view\",\n\t\t\t\"release view\",\n\t\t\t\"release list\",\n\t\t\t\"run list\",\n\t\t\t\"run view\",\n\t\t\t\"status\",\n\t\t].includes(sub.trim());\n\t}\n\tif (command === \"sh\" || command === \"bash\" || command === \"zsh\" || command === \"dash\") {\n\t\t// `sh -c '…'` runs arbitrary code; bare `sh script` also executes. Block -c; allow\n\t\t// nothing else is too restrictive for `bash --version`, so allow flag-only invocations.\n\t\treturn args.some((a) => a === \"-c\" || a === \"-s\") || args.some((a) => !a.startsWith(\"-\"));\n\t}\n\n\tconst pkgMutations = PACKAGE_MANAGER_MUTATIONS[command];\n\tif (pkgMutations) {\n\t\tconst subcommand = args.find((a) => !a.startsWith(\"-\"))?.toLowerCase();\n\t\treturn subcommand !== undefined && pkgMutations.has(subcommand);\n\t}\n\n\t// Node / Python interpreters: flag-only, no executing flags, no positional scripts.\n\tif (command === \"node\") {\n\t\treturn args.some((a) => !a.startsWith(\"-\")) || args.some((a) => EXECUTING_NODE_FLAGS.has(a));\n\t}\n\tif (command === \"python\" || command === \"python3\") {\n\t\treturn args.some((a) => !a.startsWith(\"-\")) || args.some((a) => EXECUTING_PYTHON_FLAGS.has(a));\n\t}\n\n\t// Final gate: the command must be in the read-only allowlist.\n\treturn !ALLOWED_COMMANDS.has(command);\n}\n\nfunction isMutatingGit(args: string[]): boolean {\n\t// Skip global flags like --no-pager / -C <dir> / -c key=val crudely: find the first\n\t// token that doesn't start with \"-\" (imperfect for -C/-c values; conservative is fine).\n\tlet index = 0;\n\twhile (args[index] === \"--no-pager\") index++;\n\tconst subcommand = args[index]?.toLowerCase();\n\tif (!subcommand) return false;\n\tif (subcommand.startsWith(\"-\")) return false; // bare `git --version` etc. is read-only\n\n\tif (MUTATING_GIT_SUBCOMMANDS.has(subcommand)) return true;\n\tif (CONDITIONAL_GIT_SUBCOMMANDS.has(subcommand)) {\n\t\tconst rest = args.slice(index + 1);\n\t\treturn rest.some((a) => !a.startsWith(\"-\") || CONDITIONAL_GIT_MUTATING_FLAGS.has(a));\n\t}\n\treturn false;\n}\n\nfunction basenameOf(token: string): string {\n\tconst parts = token.split(/[\\\\/]/);\n\treturn parts[parts.length - 1] ?? token;\n}\n"]}

package/dist/core/process-registry.d.ts

@@ -0,0 +1,40 @@
+/**
+ * lunR: session-scoped process tracking — in-memory registry of detached child
+ * processes started via the bash tool.
+ *
+ * Tracks running processes so the user can see them (/processes), kill them,
+ * and is prompted at quit time. Processes are tagged with the owning session id
+ * so concurrent gateway chats do not share process visibility.
+ *
+ * pause/resume are Unix-only (SIGSTOP/SIGCONT); they throw on win32.
+ * restart re-spawns the recorded command detached and registers the new pid.
+ */
+export interface TrackedProcess {
+    pid: number;
+    command: string;
+    cwd: string;
+    startedAt: number;
+    status: "running" | "paused" | "exited";
+    exitCode?: number;
+    exitedAt?: number;
+    /** Owning session id (gateway chats use this for isolation). */
+    sessionId?: string;
+}
+export declare function register(pid: number, command: string, cwd: string, sessionId?: string): void;
+export declare function unregister(pid: number): void;
+/**
+ * Mark a tracked process as exited. Short-lived processes (< 3s) are deleted
+ * immediately to avoid noise; longer ones are retained as "exited" for 5 minutes.
+ */
+export declare function markExited(pid: number, exitCode: number | null): void;
+/** Returns the list, pruning dead entries via a liveness probe. */
+export declare function list(sessionId?: string): TrackedProcess[];
+export declare function kill(pid: number): void;
+export declare function killAll(sessionId?: string): void;
+export declare function pause(pid: number): void;
+export declare function resume(pid: number): void;
+export declare function restart(pid: number): number | undefined;
+export declare function isWindows(): boolean;
+/** Clear the registry (called on session replace). Pass sessionId to clear only one session's entries. */
+export declare function clearRegistry(sessionId?: string): void;
+//# sourceMappingURL=process-registry.d.ts.map

package/dist/core/process-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-registry.d.ts","sourceRoot":"","sources":["../../src/core/process-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,MAAM,WAAW,cAAc;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAaD,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAkB5F;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAG5C;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAYrE;AAED,mEAAmE;AACnE,wBAAgB,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,cAAc,EAAE,CAGzD;AA2BD,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAItC;AAED,wBAAgB,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAUhD;AAED,wBAAgB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAWvC;AAED,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAUxC;AAED,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CA2BvD;AAED,wBAAgB,SAAS,IAAI,OAAO,CAEnC;AAED,0GAA0G;AAC1G,wBAAgB,aAAa,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAQtD","sourcesContent":["/**\n * lunR: session-scoped process tracking — in-memory registry of detached child\n * processes started via the bash tool.\n *\n * Tracks running processes so the user can see them (/processes), kill them,\n * and is prompted at quit time. Processes are tagged with the owning session id\n * so concurrent gateway chats do not share process visibility.\n *\n * pause/resume are Unix-only (SIGSTOP/SIGCONT); they throw on win32.\n * restart re-spawns the recorded command detached and registers the new pid.\n */\n\nimport { spawn } from \"node:child_process\";\nimport { getShellConfig, killProcessTree } from \"../utils/shell.ts\";\n\nexport interface TrackedProcess {\n\tpid: number;\n\tcommand: string;\n\tcwd: string;\n\tstartedAt: number;\n\tstatus: \"running\" | \"paused\" | \"exited\";\n\texitCode?: number;\n\texitedAt?: number;\n\t/** Owning session id (gateway chats use this for isolation). */\n\tsessionId?: string;\n}\n\nconst isWin32 = process.platform === \"win32\";\n\n/** Only retain exited processes that ran longer than this (ms). */\nconst EXIT_NOISE_GATE_MS = 3000;\n/** Evict exited entries after this TTL (ms). */\nconst EXIT_TTL_MS = 5 * 60 * 1000;\n/** Hard cap on tracked entries to prevent unbounded growth. */\nconst MAX_TRACKED = 100;\n\nconst processes = new Map<number, TrackedProcess>();\n\nexport function register(pid: number, command: string, cwd: string, sessionId?: string): void {\n\tif (!pid) return;\n\t// Evict the oldest non-busy entry when over cap. Exited entries are preferred\n\t// for eviction; if none, evict the oldest running entry.\n\tif (processes.size >= MAX_TRACKED) {\n\t\tlet oldest: { pid: number; entry: TrackedProcess } | undefined;\n\t\tfor (const [p, entry] of processes) {\n\t\t\tif (entry.status === \"exited\") {\n\t\t\t\toldest = { pid: p, entry };\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tif (!oldest || entry.startedAt < oldest.entry.startedAt) {\n\t\t\t\toldest = { pid: p, entry };\n\t\t\t}\n\t\t}\n\t\tif (oldest) processes.delete(oldest.pid);\n\t}\n\tprocesses.set(pid, { pid, command, cwd, startedAt: Date.now(), status: \"running\", sessionId });\n}\n\nexport function unregister(pid: number): void {\n\tif (!pid) return;\n\tprocesses.delete(pid);\n}\n\n/**\n * Mark a tracked process as exited. Short-lived processes (< 3s) are deleted\n * immediately to avoid noise; longer ones are retained as \"exited\" for 5 minutes.\n */\nexport function markExited(pid: number, exitCode: number | null): void {\n\tif (!pid) return;\n\tconst entry = processes.get(pid);\n\tif (!entry) return;\n\tconst livedMs = Date.now() - entry.startedAt;\n\tif (livedMs < EXIT_NOISE_GATE_MS) {\n\t\tprocesses.delete(pid);\n\t\treturn;\n\t}\n\tentry.status = \"exited\";\n\tentry.exitCode = exitCode ?? undefined;\n\tentry.exitedAt = Date.now();\n}\n\n/** Returns the list, pruning dead entries via a liveness probe. */\nexport function list(sessionId?: string): TrackedProcess[] {\n\tprune();\n\treturn [...processes.values()].filter((p) => sessionId === undefined || p.sessionId === sessionId);\n}\n\nfunction prune(): void {\n\tfor (const [pid, entry] of processes) {\n\t\tif (entry.status === \"exited\") {\n\t\t\tif (!entry.exitedAt || Date.now() - entry.exitedAt > EXIT_TTL_MS) {\n\t\t\t\tprocesses.delete(pid);\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\t\tif (!isAlive(pid)) {\n\t\t\t// A running/paused process that died unexpectedly becomes exited so\n\t\t\t// the user can see it, then the TTL evicts it.\n\t\t\tmarkExited(pid, null);\n\t\t}\n\t}\n}\n\nfunction isAlive(pid: number): boolean {\n\ttry {\n\t\tprocess.kill(pid, 0);\n\t\treturn true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nexport function kill(pid: number): void {\n\tif (!processes.has(pid)) return;\n\tkillProcessTree(pid);\n\tprocesses.delete(pid);\n}\n\nexport function killAll(sessionId?: string): void {\n\tfor (const [pid, entry] of processes) {\n\t\tif (sessionId !== undefined && entry.sessionId !== sessionId) continue;\n\t\ttry {\n\t\t\tkillProcessTree(pid);\n\t\t} catch {\n\t\t\t// ignore\n\t\t}\n\t\tprocesses.delete(pid);\n\t}\n}\n\nexport function pause(pid: number): void {\n\tif (isWin32) throw new Error(\"Pause/resume is unsupported on Windows.\");\n\tif (!processes.has(pid)) throw new Error(`Process ${pid} is not tracked.`);\n\ttry {\n\t\tprocess.kill(pid, \"SIGSTOP\");\n\t\tconst entry = processes.get(pid);\n\t\tif (entry) entry.status = \"paused\";\n\t} catch {\n\t\t// process may have died\n\t\tprocesses.delete(pid);\n\t}\n}\n\nexport function resume(pid: number): void {\n\tif (isWin32) throw new Error(\"Pause/resume is unsupported on Windows.\");\n\tif (!processes.has(pid)) throw new Error(`Process ${pid} is not tracked.`);\n\ttry {\n\t\tprocess.kill(pid, \"SIGCONT\");\n\t\tconst entry = processes.get(pid);\n\t\tif (entry) entry.status = \"running\";\n\t} catch {\n\t\tprocesses.delete(pid);\n\t}\n}\n\nexport function restart(pid: number): number | undefined {\n\tconst entry = processes.get(pid);\n\tif (!entry) return undefined;\n\ttry {\n\t\tkillProcessTree(pid);\n\t} catch {\n\t\t// ignore\n\t}\n\tprocesses.delete(pid);\n\n\ttry {\n\t\tconst shellConfig = getShellConfig();\n\t\tconst child = spawn(shellConfig.shell, [...shellConfig.args, entry.command], {\n\t\t\tcwd: entry.cwd,\n\t\t\tdetached: true,\n\t\t\tstdio: \"ignore\",\n\t\t\twindowsHide: true,\n\t\t});\n\t\tif (child.pid) {\n\t\t\tregister(child.pid, entry.command, entry.cwd, entry.sessionId);\n\t\t\tchild.unref();\n\t\t\treturn child.pid;\n\t\t}\n\t} catch {\n\t\t// re-spawn failed\n\t}\n\treturn undefined;\n}\n\nexport function isWindows(): boolean {\n\treturn isWin32;\n}\n\n/** Clear the registry (called on session replace). Pass sessionId to clear only one session's entries. */\nexport function clearRegistry(sessionId?: string): void {\n\tif (sessionId === undefined) {\n\t\tprocesses.clear();\n\t\treturn;\n\t}\n\tfor (const [pid, entry] of processes) {\n\t\tif (entry.sessionId === sessionId) processes.delete(pid);\n\t}\n}\n"]}