@bastani/atomic 0.8.31-alpha.5 → 0.9.0-alpha.1

package/dist/core/system-prompt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system-prompt.d.ts","sourceRoot":"","sources":["../../src/core/system-prompt.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAyB,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AAWhE,MAAM,WAAW,iBAAiB;IAChC,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,iDAAiD;IACjD,EAAE,EAAE,MAAM,CAAC;IACX,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8FAA8F;IAC9F,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,wFAAwF;IACxF,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,qFAAqF;IACrF,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,uCAAuC;IACvC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,yBAAyB;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,sEAAsE;IACtE,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,+DAA+D;IAC/D,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gCAAgC;IAChC,YAAY,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxD,yBAAyB;IACzB,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;CAClB;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,CAmK3E","sourcesContent":["/**\n * System prompt construction and project context loading\n */\n\nimport { getDocsPath, getExamplesPath, getReadmePath } from \"../config.ts\";\nimport { formatSkillsForPrompt, type Skill } from \"./skills.ts\";\n\nconst DEFAULT_PROMPT_TOOLS = [\n  \"read\",\n  \"bash\",\n  \"edit\",\n  \"write\",\n  \"ask_user_question\",\n  \"todo\",\n] as const;\n\nexport interface SystemPromptModel {\n  /** Provider identifier for the selected model. */\n  provider: string;\n  /** Stable provider-specific model identifier. */\n  id: string;\n  /** Human-readable model name, when available. */\n  name?: string;\n}\n\nexport interface BuildSystemPromptOptions {\n  /** Custom system prompt (replaces default). */\n  customPrompt?: string;\n  /** Tools to include in prompt. Default: [read, bash, edit, write, ask_user_question, todo] */\n  selectedTools?: string[];\n  /** Tool names explicitly excluded by the caller and omitted from generated guidance. */\n  excludedTools?: string[];\n  /** Optional one-line tool snippets keyed by tool name. */\n  toolSnippets?: Record<string, string>;\n  /** Additional guideline bullets appended to the default system prompt guidelines. */\n  promptGuidelines?: string[];\n  /** Text to append to system prompt. */\n  appendSystemPrompt?: string;\n  /** Working directory. */\n  cwd: string;\n  /** Currently selected model, used for model-aware prompt metadata. */\n  selectedModel?: SystemPromptModel;\n  /** Current reasoning/thinking level for the selected model. */\n  selectedThinkingLevel?: string;\n  /** Pre-loaded context files. */\n  contextFiles?: Array<{ path: string; content: string }>;\n  /** Pre-loaded skills. */\n  skills?: Skill[];\n}\n\n/** Build the system prompt with tools, guidelines, and context */\nexport function buildSystemPrompt(options: BuildSystemPromptOptions): string {\n  const {\n    customPrompt,\n    selectedTools,\n    excludedTools,\n    toolSnippets,\n    promptGuidelines,\n    appendSystemPrompt,\n    cwd,\n    selectedModel,\n    selectedThinkingLevel,\n    contextFiles: providedContextFiles,\n    skills: providedSkills,\n  } = options;\n  const resolvedCwd = cwd;\n  const promptCwd = resolvedCwd.replace(/\\\\/g, \"/\");\n\n  const now = new Date();\n  const year = now.getFullYear();\n  const month = String(now.getMonth() + 1).padStart(2, \"0\");\n  const day = String(now.getDate()).padStart(2, \"0\");\n  const date = `${year}-${month}-${day}`;\n\n  const appendSection = appendSystemPrompt ? `\\n\\n${appendSystemPrompt}` : \"\";\n  const modelName =\n    selectedModel?.name?.trim() || selectedModel?.id || \"unknown\";\n  const modelReasoningLevel = selectedThinkingLevel?.trim() || \"off\";\n\n  const contextFiles = providedContextFiles ?? [];\n  const skills = providedSkills ?? [];\n  const explicitlyExcludedTools = new Set(excludedTools ?? []);\n  const isPromptToolAvailable = (name: string): boolean =>\n    (!selectedTools || selectedTools.includes(name)) &&\n    !explicitlyExcludedTools.has(name);\n\n  if (customPrompt) {\n    let prompt = customPrompt;\n\n    if (appendSection) {\n      prompt += appendSection;\n    }\n\n    // Append project context files\n    if (contextFiles.length > 0) {\n      prompt += \"\\n\\n# Project Context\\n\\n\";\n      prompt += \"Project-specific instructions and guidelines:\\n\\n\";\n      for (const { path: filePath, content } of contextFiles) {\n        prompt += `<context_file path=\\\"${filePath}\\\">\\n${content}\\n</context_file>\\n\\n`;\n      }\n    }\n\n    // Append skills section (only if read tool is available)\n    if (isPromptToolAvailable(\"read\") && skills.length > 0) {\n      prompt += formatSkillsForPrompt(skills);\n    }\n\n    // Add model metadata, date, and working directory last\n    prompt += `\\nModel name (used for commit attribution): ${modelName}`;\n    prompt += `\\nModel reasoning level: ${modelReasoningLevel}`;\n    prompt += `\\nCurrent date: ${date}`;\n    prompt += `\\nCurrent working directory: ${promptCwd}`;\n\n    return prompt;\n  }\n\n  // Get absolute paths to documentation and examples\n  const readmePath = getReadmePath();\n  const docsPath = getDocsPath();\n  const examplesPath = getExamplesPath();\n\n  // Build tools list based on selected tools.\n  // A tool appears in Available tools only when the caller provides a one-line snippet.\n  const tools = (selectedTools ?? DEFAULT_PROMPT_TOOLS).filter(\n    (name) => !explicitlyExcludedTools.has(name),\n  );\n  const visibleTools = tools.filter((name) => !!toolSnippets?.[name]);\n  const toolsList =\n    visibleTools.length > 0\n      ? visibleTools\n          .map((name) => `- ${name}: ${toolSnippets![name]}`)\n          .join(\"\\n\")\n      : \"(none)\";\n\n  // Build guidelines based on which tools are actually available\n  const guidelinesList: string[] = [];\n  const guidelinesSet = new Set<string>();\n  const addGuideline = (guideline: string): void => {\n    if (guidelinesSet.has(guideline)) {\n      return;\n    }\n    guidelinesSet.add(guideline);\n    guidelinesList.push(guideline);\n  };\n\n  const hasBash = tools.includes(\"bash\");\n  const hasGrep = tools.includes(\"grep\");\n  const hasFind = tools.includes(\"find\");\n  const hasLs = tools.includes(\"ls\");\n  const hasRead = tools.includes(\"read\");\n\n  // File exploration guidelines\n  if (hasBash && !hasGrep && !hasFind && !hasLs) {\n    addGuideline(\"Use bash for file operations like ls, rg, find\");\n  }\n\n  for (const guideline of promptGuidelines ?? []) {\n    const normalized = guideline.trim();\n    if (normalized.length > 0) {\n      addGuideline(normalized);\n    }\n  }\n\n  // Always include these\n  addGuideline(\"Be concise in your responses\");\n  addGuideline(\"Show file paths clearly when working with files\");\n\n  const guidelines = guidelinesList.map((g) => `- ${g}`).join(\"\\n\");\n\n  let prompt = `You are an expert coding assistant operating named Atomic, a coding agent harness. You help users by reading files, executing commands, editing code, and writing new files.\n\nAvailable tools:\n${toolsList}\n\nIn addition to the tools above, you may have access to other custom tools depending on the project.\n\nGuidelines:\n${guidelines}\n- Prefer using your effective-liteparse skill in case you need to work with PDFs\n\nAtomic documentation (read only when the user asks about customizing Atomic itself, its SDK, creating workflows, packages, extensions, themes, skills, or TUI):\n- Main documentation: ${readmePath}\n- Additional docs: ${docsPath}\n- Examples: ${examplesPath} (extensions, custom tools, SDK)\n- Docs/examples references above must be resolved against these absolute roots; e.g. docs/foo.md means ${docsPath}/foo.md and examples/bar means ${examplesPath}/bar.\n- When asked about: atomic workflows (docs/workflows.md), extensions (docs/extensions.md, examples/extensions/), themes (docs/themes.md), skills (docs/skills.md), prompt templates (docs/prompt-templates.md), TUI components (docs/tui.md), keybindings (docs/keybindings.md), SDK integrations (docs/sdk.md), custom providers (docs/custom-provider.md), adding models (docs/models.md), atomic packages (docs/packages.md)\n- When working on Atomic topics, read the docs and examples, and follow .md cross-references before implementing\n- Always read Atomic .md files completely and follow links to related docs (e.g., tui.md for TUI API details)`;\n\n  if (appendSection) {\n    prompt += appendSection;\n  }\n\n  // Append project context files\n  if (contextFiles.length > 0) {\n    prompt += \"\\n\\n# Project Context\\n\\n\";\n    prompt += \"Project-specific instructions and guidelines:\\n\\n\";\n    for (const { path: filePath, content } of contextFiles) {\n      prompt += `<context_file path=\\\"${filePath}\\\">\\n${content}\\n</context_file>\\n\\n`;\n    }\n  }\n\n  // Append skills section (only if read tool is available)\n  if (hasRead && skills.length > 0) {\n    prompt += formatSkillsForPrompt(skills);\n  }\n\n  // Add model metadata, date, and working directory last\n  prompt += `\\nModel name (used for commit attribution): ${modelName}`;\n  prompt += `\\nModel reasoning level: ${modelReasoningLevel}`;\n  prompt += `\\nCurrent date: ${date}`;\n  prompt += `\\nCurrent working directory: ${promptCwd}`;\n\n  return prompt;\n}\n"]}
+{"version":3,"file":"system-prompt.d.ts","sourceRoot":"","sources":["../../src/core/system-prompt.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAyB,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AAWhE,MAAM,WAAW,iBAAiB;IAChC,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,iDAAiD;IACjD,EAAE,EAAE,MAAM,CAAC;IACX,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8FAA8F;IAC9F,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,wFAAwF;IACxF,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,qFAAqF;IACrF,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,uCAAuC;IACvC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,yBAAyB;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,sEAAsE;IACtE,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,+DAA+D;IAC/D,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gCAAgC;IAChC,YAAY,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxD,yBAAyB;IACzB,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;CAClB;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,CA2K3E","sourcesContent":["/**\n * System prompt construction and project context loading\n */\n\nimport { getDocsPath, getExamplesPath, getReadmePath } from \"../config.ts\";\nimport { formatSkillsForPrompt, type Skill } from \"./skills.ts\";\n\nconst DEFAULT_PROMPT_TOOLS = [\n  \"read\",\n  \"bash\",\n  \"edit\",\n  \"write\",\n  \"ask_user_question\",\n  \"todo\",\n] as const;\n\nexport interface SystemPromptModel {\n  /** Provider identifier for the selected model. */\n  provider: string;\n  /** Stable provider-specific model identifier. */\n  id: string;\n  /** Human-readable model name, when available. */\n  name?: string;\n}\n\nexport interface BuildSystemPromptOptions {\n  /** Custom system prompt (replaces default). */\n  customPrompt?: string;\n  /** Tools to include in prompt. Default: [read, bash, edit, write, ask_user_question, todo] */\n  selectedTools?: string[];\n  /** Tool names explicitly excluded by the caller and omitted from generated guidance. */\n  excludedTools?: string[];\n  /** Optional one-line tool snippets keyed by tool name. */\n  toolSnippets?: Record<string, string>;\n  /** Additional guideline bullets appended to the default system prompt guidelines. */\n  promptGuidelines?: string[];\n  /** Text to append to system prompt. */\n  appendSystemPrompt?: string;\n  /** Working directory. */\n  cwd: string;\n  /** Currently selected model, used for model-aware prompt metadata. */\n  selectedModel?: SystemPromptModel;\n  /** Current reasoning/thinking level for the selected model. */\n  selectedThinkingLevel?: string;\n  /** Pre-loaded context files. */\n  contextFiles?: Array<{ path: string; content: string }>;\n  /** Pre-loaded skills. */\n  skills?: Skill[];\n}\n\n/** Build the system prompt with tools, guidelines, and context */\nexport function buildSystemPrompt(options: BuildSystemPromptOptions): string {\n  const {\n    customPrompt,\n    selectedTools,\n    excludedTools,\n    toolSnippets,\n    promptGuidelines,\n    appendSystemPrompt,\n    cwd,\n    selectedModel,\n    selectedThinkingLevel,\n    contextFiles: providedContextFiles,\n    skills: providedSkills,\n  } = options;\n  const resolvedCwd = cwd;\n  const promptCwd = resolvedCwd.replace(/\\\\/g, \"/\");\n\n  const now = new Date();\n  const year = now.getFullYear();\n  const month = String(now.getMonth() + 1).padStart(2, \"0\");\n  const day = String(now.getDate()).padStart(2, \"0\");\n  const date = `${year}-${month}-${day}`;\n\n  const appendSection = appendSystemPrompt ? `\\n\\n${appendSystemPrompt}` : \"\";\n  const modelName =\n    selectedModel?.name?.trim() || selectedModel?.id || \"unknown\";\n  const modelReasoningLevel = selectedThinkingLevel?.trim() || \"off\";\n\n  const contextFiles = providedContextFiles ?? [];\n  const skills = providedSkills ?? [];\n  const explicitlyExcludedTools = new Set(excludedTools ?? []);\n  const isPromptToolAvailable = (name: string): boolean =>\n    (!selectedTools || selectedTools.includes(name)) &&\n    !explicitlyExcludedTools.has(name);\n\n  if (customPrompt) {\n    let prompt = customPrompt;\n\n    if (appendSection) {\n      prompt += appendSection;\n    }\n\n    // Append project context files\n    if (contextFiles.length > 0) {\n      prompt += \"\\n\\n# Project Context\\n\\n\";\n      prompt += \"Project-specific instructions and guidelines:\\n\\n\";\n      for (const { path: filePath, content } of contextFiles) {\n        prompt += `<context_file path=\\\"${filePath}\\\">\\n${content}\\n</context_file>\\n\\n`;\n      }\n    }\n\n    // Append skills section (only if read tool is available)\n    if (isPromptToolAvailable(\"read\") && skills.length > 0) {\n      prompt += formatSkillsForPrompt(skills);\n    }\n\n    // Add model metadata, date, and working directory last\n    prompt += `\\nModel name (used for commit attribution): ${modelName}`;\n    prompt += `\\nModel reasoning level: ${modelReasoningLevel}`;\n    prompt += `\\nCurrent date: ${date}`;\n    prompt += `\\nCurrent working directory: ${promptCwd}`;\n\n    return prompt;\n  }\n\n  // Get absolute paths to documentation and examples\n  const readmePath = getReadmePath();\n  const docsPath = getDocsPath();\n  const examplesPath = getExamplesPath();\n\n  // Build tools list based on selected tools.\n  // A tool appears in Available tools only when the caller provides a one-line snippet.\n  const tools = (selectedTools ?? DEFAULT_PROMPT_TOOLS).filter(\n    (name) => !explicitlyExcludedTools.has(name),\n  );\n  const visibleTools = tools.filter((name) => !!toolSnippets?.[name]);\n  const toolsList =\n    visibleTools.length > 0\n      ? visibleTools\n          .map((name) => `- ${name}: ${toolSnippets![name]}`)\n          .join(\"\\n\")\n      : \"(none)\";\n\n  // Build guidelines based on which tools are actually available\n  const guidelinesList: string[] = [];\n  const guidelinesSet = new Set<string>();\n  const addGuideline = (guideline: string): void => {\n    if (guidelinesSet.has(guideline)) {\n      return;\n    }\n    guidelinesSet.add(guideline);\n    guidelinesList.push(guideline);\n  };\n\n  const hasBash = tools.includes(\"bash\");\n  const hasGrep = tools.includes(\"grep\");\n  const hasFind = tools.includes(\"find\");\n  const hasLs = tools.includes(\"ls\");\n  const hasRead = tools.includes(\"read\");\n  const shouldIncludeAskUserFallbackGuidance =\n    selectedTools !== undefined &&\n    tools.length > 0 &&\n    !tools.includes(\"ask_user_question\") &&\n    !explicitlyExcludedTools.has(\"ask_user_question\");\n\n  // File exploration guidelines\n  if (hasBash && !hasGrep && !hasFind && !hasLs) {\n    addGuideline(\"Use bash for file operations like ls, rg, find\");\n  }\n  if (shouldIncludeAskUserFallbackGuidance) {\n    addGuideline(\"Clarify ambiguous requirements using the ask_user_question tool if available.\");\n  }\n\n  for (const guideline of promptGuidelines ?? []) {\n    const normalized = guideline.trim();\n    if (normalized.length > 0) {\n      addGuideline(normalized);\n    }\n  }\n\n  // Always include these\n  addGuideline(\"Be concise in your responses\");\n  addGuideline(\"Show file paths clearly when working with files\");\n\n  const guidelines = guidelinesList.map((g) => `- ${g}`).join(\"\\n\");\n\n  let prompt = `You are an expert coding assistant operating named Atomic, a coding agent harness. You help users by reading files, executing commands, editing code, and writing new files.\n\nAvailable tools:\n${toolsList}\n\nIn addition to the tools above, you may have access to other custom tools depending on the project.\n\nGuidelines:\n${guidelines}\n- Prefer using your effective-liteparse skill in case you need to work with PDFs\n\nAtomic documentation (read only when the user asks about customizing Atomic itself, its SDK, creating workflows, packages, extensions, themes, skills, or TUI):\n- Main documentation: ${readmePath}\n- Additional docs: ${docsPath}\n- Examples: ${examplesPath} (extensions, custom tools, SDK)\n- Docs/examples references above must be resolved against these absolute roots; e.g. docs/foo.md means ${docsPath}/foo.md and examples/bar means ${examplesPath}/bar.\n- When asked about: atomic workflows (docs/workflows.md), extensions (docs/extensions.md, examples/extensions/), themes (docs/themes.md), skills (docs/skills.md), prompt templates (docs/prompt-templates.md), TUI components (docs/tui.md), keybindings (docs/keybindings.md), SDK integrations (docs/sdk.md), custom providers (docs/custom-provider.md), adding models (docs/models.md), atomic packages (docs/packages.md)\n- When working on Atomic topics, read the docs and examples, and follow .md cross-references before implementing\n- Always read Atomic .md files completely and follow links to related docs (e.g., tui.md for TUI API details)`;\n\n  if (appendSection) {\n    prompt += appendSection;\n  }\n\n  // Append project context files\n  if (contextFiles.length > 0) {\n    prompt += \"\\n\\n# Project Context\\n\\n\";\n    prompt += \"Project-specific instructions and guidelines:\\n\\n\";\n    for (const { path: filePath, content } of contextFiles) {\n      prompt += `<context_file path=\\\"${filePath}\\\">\\n${content}\\n</context_file>\\n\\n`;\n    }\n  }\n\n  // Append skills section (only if read tool is available)\n  if (hasRead && skills.length > 0) {\n    prompt += formatSkillsForPrompt(skills);\n  }\n\n  // Add model metadata, date, and working directory last\n  prompt += `\\nModel name (used for commit attribution): ${modelName}`;\n  prompt += `\\nModel reasoning level: ${modelReasoningLevel}`;\n  prompt += `\\nCurrent date: ${date}`;\n  prompt += `\\nCurrent working directory: ${promptCwd}`;\n\n  return prompt;\n}\n"]}

package/dist/core/system-prompt.js

@@ -81,10 +81,17 @@ export function buildSystemPrompt(options) {
     const hasFind = tools.includes("find");
     const hasLs = tools.includes("ls");
     const hasRead = tools.includes("read");
+    const shouldIncludeAskUserFallbackGuidance = selectedTools !== undefined &&
+        tools.length > 0 &&
+        !tools.includes("ask_user_question") &&
+        !explicitlyExcludedTools.has("ask_user_question");
     // File exploration guidelines
     if (hasBash && !hasGrep && !hasFind && !hasLs) {
         addGuideline("Use bash for file operations like ls, rg, find");
     }
+    if (shouldIncludeAskUserFallbackGuidance) {
+        addGuideline("Clarify ambiguous requirements using the ask_user_question tool if available.");
+    }
     for (const guideline of promptGuidelines ?? []) {
         const normalized = guideline.trim();
         if (normalized.length > 0) {

package/dist/core/system-prompt.js.map

@@ -1 +1 @@
-{"version":3,"file":"system-prompt.js","sourceRoot":"","sources":["../../src/core/system-prompt.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAc,MAAM,aAAa,CAAC;AAEhE,MAAM,oBAAoB,GAAG;IAC3B,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,mBAAmB;IACnB,MAAM;CACE,CAAC;AAoCX,kEAAkE;AAClE,MAAM,UAAU,iBAAiB,CAAC,OAAiC;IACjE,MAAM,EACJ,YAAY,EACZ,aAAa,EACb,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,GAAG,EACH,aAAa,EACb,qBAAqB,EACrB,YAAY,EAAE,oBAAoB,EAClC,MAAM,EAAE,cAAc,GACvB,GAAG,OAAO,CAAC;IACZ,MAAM,WAAW,GAAG,GAAG,CAAC;IACxB,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAElD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;IAEvC,MAAM,aAAa,GAAG,kBAAkB,CAAC,CAAC,CAAC,OAAO,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,MAAM,SAAS,GACb,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,aAAa,EAAE,EAAE,IAAI,SAAS,CAAC;IAChE,MAAM,mBAAmB,GAAG,qBAAqB,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC;IAEnE,MAAM,YAAY,GAAG,oBAAoB,IAAI,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,cAAc,IAAI,EAAE,CAAC;IACpC,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAW,EAAE,CACtD,CAAC,CAAC,aAAa,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAErC,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,MAAM,GAAG,YAAY,CAAC;QAE1B,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,IAAI,aAAa,CAAC;QAC1B,CAAC;QAED,+BAA+B;QAC/B,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,2BAA2B,CAAC;YACtC,MAAM,IAAI,mDAAmD,CAAC;YAC9D,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,YAAY,EAAE,CAAC;gBACvD,MAAM,IAAI,wBAAwB,QAAQ,QAAQ,OAAO,uBAAuB,CAAC;YACnF,CAAC;QACH,CAAC;QAED,yDAAyD;QACzD,IAAI,qBAAqB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QAED,uDAAuD;QACvD,MAAM,IAAI,+CAA+C,SAAS,EAAE,CAAC;QACrE,MAAM,IAAI,4BAA4B,mBAAmB,EAAE,CAAC;QAC5D,MAAM,IAAI,mBAAmB,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,gCAAgC,SAAS,EAAE,CAAC;QAEtD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,mDAAmD;IACnD,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IAEvC,4CAA4C;IAC5C,sFAAsF;IACtF,MAAM,KAAK,GAAG,CAAC,aAAa,IAAI,oBAAoB,CAAC,CAAC,MAAM,CAC1D,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAC7C,CAAC;IACF,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,MAAM,SAAS,GACb,YAAY,CAAC,MAAM,GAAG,CAAC;QACrB,CAAC,CAAC,YAAY;aACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,KAAK,YAAa,CAAC,IAAI,CAAC,EAAE,CAAC;aAClD,IAAI,CAAC,IAAI,CAAC;QACf,CAAC,CAAC,QAAQ,CAAC;IAEf,+DAA+D;IAC/D,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,MAAM,YAAY,GAAG,CAAC,SAAiB,EAAQ,EAAE;QAC/C,IAAI,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7B,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEvC,8BAA8B;IAC9B,IAAI,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9C,YAAY,CAAC,gDAAgD,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,gBAAgB,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,YAAY,CAAC,UAAU,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,YAAY,CAAC,8BAA8B,CAAC,CAAC;IAC7C,YAAY,CAAC,iDAAiD,CAAC,CAAC;IAEhE,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAElE,IAAI,MAAM,GAAG;;;EAGb,SAAS;;;;;EAKT,UAAU;;;;wBAIY,UAAU;qBACb,QAAQ;cACf,YAAY;yGAC+E,QAAQ,kCAAkC,YAAY;;;8GAGjD,CAAC;IAE7G,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,aAAa,CAAC;IAC1B,CAAC;IAED,+BAA+B;IAC/B,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,2BAA2B,CAAC;QACtC,MAAM,IAAI,mDAAmD,CAAC;QAC9D,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,YAAY,EAAE,CAAC;YACvD,MAAM,IAAI,wBAAwB,QAAQ,QAAQ,OAAO,uBAAuB,CAAC;QACnF,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,IAAI,OAAO,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,uDAAuD;IACvD,MAAM,IAAI,+CAA+C,SAAS,EAAE,CAAC;IACrE,MAAM,IAAI,4BAA4B,mBAAmB,EAAE,CAAC;IAC5D,MAAM,IAAI,mBAAmB,IAAI,EAAE,CAAC;IACpC,MAAM,IAAI,gCAAgC,SAAS,EAAE,CAAC;IAEtD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["/**\n * System prompt construction and project context loading\n */\n\nimport { getDocsPath, getExamplesPath, getReadmePath } from \"../config.ts\";\nimport { formatSkillsForPrompt, type Skill } from \"./skills.ts\";\n\nconst DEFAULT_PROMPT_TOOLS = [\n  \"read\",\n  \"bash\",\n  \"edit\",\n  \"write\",\n  \"ask_user_question\",\n  \"todo\",\n] as const;\n\nexport interface SystemPromptModel {\n  /** Provider identifier for the selected model. */\n  provider: string;\n  /** Stable provider-specific model identifier. */\n  id: string;\n  /** Human-readable model name, when available. */\n  name?: string;\n}\n\nexport interface BuildSystemPromptOptions {\n  /** Custom system prompt (replaces default). */\n  customPrompt?: string;\n  /** Tools to include in prompt. Default: [read, bash, edit, write, ask_user_question, todo] */\n  selectedTools?: string[];\n  /** Tool names explicitly excluded by the caller and omitted from generated guidance. */\n  excludedTools?: string[];\n  /** Optional one-line tool snippets keyed by tool name. */\n  toolSnippets?: Record<string, string>;\n  /** Additional guideline bullets appended to the default system prompt guidelines. */\n  promptGuidelines?: string[];\n  /** Text to append to system prompt. */\n  appendSystemPrompt?: string;\n  /** Working directory. */\n  cwd: string;\n  /** Currently selected model, used for model-aware prompt metadata. */\n  selectedModel?: SystemPromptModel;\n  /** Current reasoning/thinking level for the selected model. */\n  selectedThinkingLevel?: string;\n  /** Pre-loaded context files. */\n  contextFiles?: Array<{ path: string; content: string }>;\n  /** Pre-loaded skills. */\n  skills?: Skill[];\n}\n\n/** Build the system prompt with tools, guidelines, and context */\nexport function buildSystemPrompt(options: BuildSystemPromptOptions): string {\n  const {\n    customPrompt,\n    selectedTools,\n    excludedTools,\n    toolSnippets,\n    promptGuidelines,\n    appendSystemPrompt,\n    cwd,\n    selectedModel,\n    selectedThinkingLevel,\n    contextFiles: providedContextFiles,\n    skills: providedSkills,\n  } = options;\n  const resolvedCwd = cwd;\n  const promptCwd = resolvedCwd.replace(/\\\\/g, \"/\");\n\n  const now = new Date();\n  const year = now.getFullYear();\n  const month = String(now.getMonth() + 1).padStart(2, \"0\");\n  const day = String(now.getDate()).padStart(2, \"0\");\n  const date = `${year}-${month}-${day}`;\n\n  const appendSection = appendSystemPrompt ? `\\n\\n${appendSystemPrompt}` : \"\";\n  const modelName =\n    selectedModel?.name?.trim() || selectedModel?.id || \"unknown\";\n  const modelReasoningLevel = selectedThinkingLevel?.trim() || \"off\";\n\n  const contextFiles = providedContextFiles ?? [];\n  const skills = providedSkills ?? [];\n  const explicitlyExcludedTools = new Set(excludedTools ?? []);\n  const isPromptToolAvailable = (name: string): boolean =>\n    (!selectedTools || selectedTools.includes(name)) &&\n    !explicitlyExcludedTools.has(name);\n\n  if (customPrompt) {\n    let prompt = customPrompt;\n\n    if (appendSection) {\n      prompt += appendSection;\n    }\n\n    // Append project context files\n    if (contextFiles.length > 0) {\n      prompt += \"\\n\\n# Project Context\\n\\n\";\n      prompt += \"Project-specific instructions and guidelines:\\n\\n\";\n      for (const { path: filePath, content } of contextFiles) {\n        prompt += `<context_file path=\\\"${filePath}\\\">\\n${content}\\n</context_file>\\n\\n`;\n      }\n    }\n\n    // Append skills section (only if read tool is available)\n    if (isPromptToolAvailable(\"read\") && skills.length > 0) {\n      prompt += formatSkillsForPrompt(skills);\n    }\n\n    // Add model metadata, date, and working directory last\n    prompt += `\\nModel name (used for commit attribution): ${modelName}`;\n    prompt += `\\nModel reasoning level: ${modelReasoningLevel}`;\n    prompt += `\\nCurrent date: ${date}`;\n    prompt += `\\nCurrent working directory: ${promptCwd}`;\n\n    return prompt;\n  }\n\n  // Get absolute paths to documentation and examples\n  const readmePath = getReadmePath();\n  const docsPath = getDocsPath();\n  const examplesPath = getExamplesPath();\n\n  // Build tools list based on selected tools.\n  // A tool appears in Available tools only when the caller provides a one-line snippet.\n  const tools = (selectedTools ?? DEFAULT_PROMPT_TOOLS).filter(\n    (name) => !explicitlyExcludedTools.has(name),\n  );\n  const visibleTools = tools.filter((name) => !!toolSnippets?.[name]);\n  const toolsList =\n    visibleTools.length > 0\n      ? visibleTools\n          .map((name) => `- ${name}: ${toolSnippets![name]}`)\n          .join(\"\\n\")\n      : \"(none)\";\n\n  // Build guidelines based on which tools are actually available\n  const guidelinesList: string[] = [];\n  const guidelinesSet = new Set<string>();\n  const addGuideline = (guideline: string): void => {\n    if (guidelinesSet.has(guideline)) {\n      return;\n    }\n    guidelinesSet.add(guideline);\n    guidelinesList.push(guideline);\n  };\n\n  const hasBash = tools.includes(\"bash\");\n  const hasGrep = tools.includes(\"grep\");\n  const hasFind = tools.includes(\"find\");\n  const hasLs = tools.includes(\"ls\");\n  const hasRead = tools.includes(\"read\");\n\n  // File exploration guidelines\n  if (hasBash && !hasGrep && !hasFind && !hasLs) {\n    addGuideline(\"Use bash for file operations like ls, rg, find\");\n  }\n\n  for (const guideline of promptGuidelines ?? []) {\n    const normalized = guideline.trim();\n    if (normalized.length > 0) {\n      addGuideline(normalized);\n    }\n  }\n\n  // Always include these\n  addGuideline(\"Be concise in your responses\");\n  addGuideline(\"Show file paths clearly when working with files\");\n\n  const guidelines = guidelinesList.map((g) => `- ${g}`).join(\"\\n\");\n\n  let prompt = `You are an expert coding assistant operating named Atomic, a coding agent harness. You help users by reading files, executing commands, editing code, and writing new files.\n\nAvailable tools:\n${toolsList}\n\nIn addition to the tools above, you may have access to other custom tools depending on the project.\n\nGuidelines:\n${guidelines}\n- Prefer using your effective-liteparse skill in case you need to work with PDFs\n\nAtomic documentation (read only when the user asks about customizing Atomic itself, its SDK, creating workflows, packages, extensions, themes, skills, or TUI):\n- Main documentation: ${readmePath}\n- Additional docs: ${docsPath}\n- Examples: ${examplesPath} (extensions, custom tools, SDK)\n- Docs/examples references above must be resolved against these absolute roots; e.g. docs/foo.md means ${docsPath}/foo.md and examples/bar means ${examplesPath}/bar.\n- When asked about: atomic workflows (docs/workflows.md), extensions (docs/extensions.md, examples/extensions/), themes (docs/themes.md), skills (docs/skills.md), prompt templates (docs/prompt-templates.md), TUI components (docs/tui.md), keybindings (docs/keybindings.md), SDK integrations (docs/sdk.md), custom providers (docs/custom-provider.md), adding models (docs/models.md), atomic packages (docs/packages.md)\n- When working on Atomic topics, read the docs and examples, and follow .md cross-references before implementing\n- Always read Atomic .md files completely and follow links to related docs (e.g., tui.md for TUI API details)`;\n\n  if (appendSection) {\n    prompt += appendSection;\n  }\n\n  // Append project context files\n  if (contextFiles.length > 0) {\n    prompt += \"\\n\\n# Project Context\\n\\n\";\n    prompt += \"Project-specific instructions and guidelines:\\n\\n\";\n    for (const { path: filePath, content } of contextFiles) {\n      prompt += `<context_file path=\\\"${filePath}\\\">\\n${content}\\n</context_file>\\n\\n`;\n    }\n  }\n\n  // Append skills section (only if read tool is available)\n  if (hasRead && skills.length > 0) {\n    prompt += formatSkillsForPrompt(skills);\n  }\n\n  // Add model metadata, date, and working directory last\n  prompt += `\\nModel name (used for commit attribution): ${modelName}`;\n  prompt += `\\nModel reasoning level: ${modelReasoningLevel}`;\n  prompt += `\\nCurrent date: ${date}`;\n  prompt += `\\nCurrent working directory: ${promptCwd}`;\n\n  return prompt;\n}\n"]}
+{"version":3,"file":"system-prompt.js","sourceRoot":"","sources":["../../src/core/system-prompt.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAc,MAAM,aAAa,CAAC;AAEhE,MAAM,oBAAoB,GAAG;IAC3B,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,mBAAmB;IACnB,MAAM;CACE,CAAC;AAoCX,kEAAkE;AAClE,MAAM,UAAU,iBAAiB,CAAC,OAAiC;IACjE,MAAM,EACJ,YAAY,EACZ,aAAa,EACb,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,GAAG,EACH,aAAa,EACb,qBAAqB,EACrB,YAAY,EAAE,oBAAoB,EAClC,MAAM,EAAE,cAAc,GACvB,GAAG,OAAO,CAAC;IACZ,MAAM,WAAW,GAAG,GAAG,CAAC;IACxB,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAElD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;IAEvC,MAAM,aAAa,GAAG,kBAAkB,CAAC,CAAC,CAAC,OAAO,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,MAAM,SAAS,GACb,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,aAAa,EAAE,EAAE,IAAI,SAAS,CAAC;IAChE,MAAM,mBAAmB,GAAG,qBAAqB,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC;IAEnE,MAAM,YAAY,GAAG,oBAAoB,IAAI,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,cAAc,IAAI,EAAE,CAAC;IACpC,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAW,EAAE,CACtD,CAAC,CAAC,aAAa,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAErC,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,MAAM,GAAG,YAAY,CAAC;QAE1B,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,IAAI,aAAa,CAAC;QAC1B,CAAC;QAED,+BAA+B;QAC/B,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,2BAA2B,CAAC;YACtC,MAAM,IAAI,mDAAmD,CAAC;YAC9D,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,YAAY,EAAE,CAAC;gBACvD,MAAM,IAAI,wBAAwB,QAAQ,QAAQ,OAAO,uBAAuB,CAAC;YACnF,CAAC;QACH,CAAC;QAED,yDAAyD;QACzD,IAAI,qBAAqB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QAED,uDAAuD;QACvD,MAAM,IAAI,+CAA+C,SAAS,EAAE,CAAC;QACrE,MAAM,IAAI,4BAA4B,mBAAmB,EAAE,CAAC;QAC5D,MAAM,IAAI,mBAAmB,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,gCAAgC,SAAS,EAAE,CAAC;QAEtD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,mDAAmD;IACnD,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IAEvC,4CAA4C;IAC5C,sFAAsF;IACtF,MAAM,KAAK,GAAG,CAAC,aAAa,IAAI,oBAAoB,CAAC,CAAC,MAAM,CAC1D,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAC7C,CAAC;IACF,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,MAAM,SAAS,GACb,YAAY,CAAC,MAAM,GAAG,CAAC;QACrB,CAAC,CAAC,YAAY;aACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,KAAK,YAAa,CAAC,IAAI,CAAC,EAAE,CAAC;aAClD,IAAI,CAAC,IAAI,CAAC;QACf,CAAC,CAAC,QAAQ,CAAC;IAEf,+DAA+D;IAC/D,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,MAAM,YAAY,GAAG,CAAC,SAAiB,EAAQ,EAAE;QAC/C,IAAI,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7B,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,oCAAoC,GACxC,aAAa,KAAK,SAAS;QAC3B,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,CAAC,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACpC,CAAC,uBAAuB,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAEpD,8BAA8B;IAC9B,IAAI,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9C,YAAY,CAAC,gDAAgD,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,oCAAoC,EAAE,CAAC;QACzC,YAAY,CAAC,+EAA+E,CAAC,CAAC;IAChG,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,gBAAgB,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,YAAY,CAAC,UAAU,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,YAAY,CAAC,8BAA8B,CAAC,CAAC;IAC7C,YAAY,CAAC,iDAAiD,CAAC,CAAC;IAEhE,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAElE,IAAI,MAAM,GAAG;;;EAGb,SAAS;;;;;EAKT,UAAU;;;;wBAIY,UAAU;qBACb,QAAQ;cACf,YAAY;yGAC+E,QAAQ,kCAAkC,YAAY;;;8GAGjD,CAAC;IAE7G,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,aAAa,CAAC;IAC1B,CAAC;IAED,+BAA+B;IAC/B,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,2BAA2B,CAAC;QACtC,MAAM,IAAI,mDAAmD,CAAC;QAC9D,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,YAAY,EAAE,CAAC;YACvD,MAAM,IAAI,wBAAwB,QAAQ,QAAQ,OAAO,uBAAuB,CAAC;QACnF,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,IAAI,OAAO,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,uDAAuD;IACvD,MAAM,IAAI,+CAA+C,SAAS,EAAE,CAAC;IACrE,MAAM,IAAI,4BAA4B,mBAAmB,EAAE,CAAC;IAC5D,MAAM,IAAI,mBAAmB,IAAI,EAAE,CAAC;IACpC,MAAM,IAAI,gCAAgC,SAAS,EAAE,CAAC;IAEtD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["/**\n * System prompt construction and project context loading\n */\n\nimport { getDocsPath, getExamplesPath, getReadmePath } from \"../config.ts\";\nimport { formatSkillsForPrompt, type Skill } from \"./skills.ts\";\n\nconst DEFAULT_PROMPT_TOOLS = [\n  \"read\",\n  \"bash\",\n  \"edit\",\n  \"write\",\n  \"ask_user_question\",\n  \"todo\",\n] as const;\n\nexport interface SystemPromptModel {\n  /** Provider identifier for the selected model. */\n  provider: string;\n  /** Stable provider-specific model identifier. */\n  id: string;\n  /** Human-readable model name, when available. */\n  name?: string;\n}\n\nexport interface BuildSystemPromptOptions {\n  /** Custom system prompt (replaces default). */\n  customPrompt?: string;\n  /** Tools to include in prompt. Default: [read, bash, edit, write, ask_user_question, todo] */\n  selectedTools?: string[];\n  /** Tool names explicitly excluded by the caller and omitted from generated guidance. */\n  excludedTools?: string[];\n  /** Optional one-line tool snippets keyed by tool name. */\n  toolSnippets?: Record<string, string>;\n  /** Additional guideline bullets appended to the default system prompt guidelines. */\n  promptGuidelines?: string[];\n  /** Text to append to system prompt. */\n  appendSystemPrompt?: string;\n  /** Working directory. */\n  cwd: string;\n  /** Currently selected model, used for model-aware prompt metadata. */\n  selectedModel?: SystemPromptModel;\n  /** Current reasoning/thinking level for the selected model. */\n  selectedThinkingLevel?: string;\n  /** Pre-loaded context files. */\n  contextFiles?: Array<{ path: string; content: string }>;\n  /** Pre-loaded skills. */\n  skills?: Skill[];\n}\n\n/** Build the system prompt with tools, guidelines, and context */\nexport function buildSystemPrompt(options: BuildSystemPromptOptions): string {\n  const {\n    customPrompt,\n    selectedTools,\n    excludedTools,\n    toolSnippets,\n    promptGuidelines,\n    appendSystemPrompt,\n    cwd,\n    selectedModel,\n    selectedThinkingLevel,\n    contextFiles: providedContextFiles,\n    skills: providedSkills,\n  } = options;\n  const resolvedCwd = cwd;\n  const promptCwd = resolvedCwd.replace(/\\\\/g, \"/\");\n\n  const now = new Date();\n  const year = now.getFullYear();\n  const month = String(now.getMonth() + 1).padStart(2, \"0\");\n  const day = String(now.getDate()).padStart(2, \"0\");\n  const date = `${year}-${month}-${day}`;\n\n  const appendSection = appendSystemPrompt ? `\\n\\n${appendSystemPrompt}` : \"\";\n  const modelName =\n    selectedModel?.name?.trim() || selectedModel?.id || \"unknown\";\n  const modelReasoningLevel = selectedThinkingLevel?.trim() || \"off\";\n\n  const contextFiles = providedContextFiles ?? [];\n  const skills = providedSkills ?? [];\n  const explicitlyExcludedTools = new Set(excludedTools ?? []);\n  const isPromptToolAvailable = (name: string): boolean =>\n    (!selectedTools || selectedTools.includes(name)) &&\n    !explicitlyExcludedTools.has(name);\n\n  if (customPrompt) {\n    let prompt = customPrompt;\n\n    if (appendSection) {\n      prompt += appendSection;\n    }\n\n    // Append project context files\n    if (contextFiles.length > 0) {\n      prompt += \"\\n\\n# Project Context\\n\\n\";\n      prompt += \"Project-specific instructions and guidelines:\\n\\n\";\n      for (const { path: filePath, content } of contextFiles) {\n        prompt += `<context_file path=\\\"${filePath}\\\">\\n${content}\\n</context_file>\\n\\n`;\n      }\n    }\n\n    // Append skills section (only if read tool is available)\n    if (isPromptToolAvailable(\"read\") && skills.length > 0) {\n      prompt += formatSkillsForPrompt(skills);\n    }\n\n    // Add model metadata, date, and working directory last\n    prompt += `\\nModel name (used for commit attribution): ${modelName}`;\n    prompt += `\\nModel reasoning level: ${modelReasoningLevel}`;\n    prompt += `\\nCurrent date: ${date}`;\n    prompt += `\\nCurrent working directory: ${promptCwd}`;\n\n    return prompt;\n  }\n\n  // Get absolute paths to documentation and examples\n  const readmePath = getReadmePath();\n  const docsPath = getDocsPath();\n  const examplesPath = getExamplesPath();\n\n  // Build tools list based on selected tools.\n  // A tool appears in Available tools only when the caller provides a one-line snippet.\n  const tools = (selectedTools ?? DEFAULT_PROMPT_TOOLS).filter(\n    (name) => !explicitlyExcludedTools.has(name),\n  );\n  const visibleTools = tools.filter((name) => !!toolSnippets?.[name]);\n  const toolsList =\n    visibleTools.length > 0\n      ? visibleTools\n          .map((name) => `- ${name}: ${toolSnippets![name]}`)\n          .join(\"\\n\")\n      : \"(none)\";\n\n  // Build guidelines based on which tools are actually available\n  const guidelinesList: string[] = [];\n  const guidelinesSet = new Set<string>();\n  const addGuideline = (guideline: string): void => {\n    if (guidelinesSet.has(guideline)) {\n      return;\n    }\n    guidelinesSet.add(guideline);\n    guidelinesList.push(guideline);\n  };\n\n  const hasBash = tools.includes(\"bash\");\n  const hasGrep = tools.includes(\"grep\");\n  const hasFind = tools.includes(\"find\");\n  const hasLs = tools.includes(\"ls\");\n  const hasRead = tools.includes(\"read\");\n  const shouldIncludeAskUserFallbackGuidance =\n    selectedTools !== undefined &&\n    tools.length > 0 &&\n    !tools.includes(\"ask_user_question\") &&\n    !explicitlyExcludedTools.has(\"ask_user_question\");\n\n  // File exploration guidelines\n  if (hasBash && !hasGrep && !hasFind && !hasLs) {\n    addGuideline(\"Use bash for file operations like ls, rg, find\");\n  }\n  if (shouldIncludeAskUserFallbackGuidance) {\n    addGuideline(\"Clarify ambiguous requirements using the ask_user_question tool if available.\");\n  }\n\n  for (const guideline of promptGuidelines ?? []) {\n    const normalized = guideline.trim();\n    if (normalized.length > 0) {\n      addGuideline(normalized);\n    }\n  }\n\n  // Always include these\n  addGuideline(\"Be concise in your responses\");\n  addGuideline(\"Show file paths clearly when working with files\");\n\n  const guidelines = guidelinesList.map((g) => `- ${g}`).join(\"\\n\");\n\n  let prompt = `You are an expert coding assistant operating named Atomic, a coding agent harness. You help users by reading files, executing commands, editing code, and writing new files.\n\nAvailable tools:\n${toolsList}\n\nIn addition to the tools above, you may have access to other custom tools depending on the project.\n\nGuidelines:\n${guidelines}\n- Prefer using your effective-liteparse skill in case you need to work with PDFs\n\nAtomic documentation (read only when the user asks about customizing Atomic itself, its SDK, creating workflows, packages, extensions, themes, skills, or TUI):\n- Main documentation: ${readmePath}\n- Additional docs: ${docsPath}\n- Examples: ${examplesPath} (extensions, custom tools, SDK)\n- Docs/examples references above must be resolved against these absolute roots; e.g. docs/foo.md means ${docsPath}/foo.md and examples/bar means ${examplesPath}/bar.\n- When asked about: atomic workflows (docs/workflows.md), extensions (docs/extensions.md, examples/extensions/), themes (docs/themes.md), skills (docs/skills.md), prompt templates (docs/prompt-templates.md), TUI components (docs/tui.md), keybindings (docs/keybindings.md), SDK integrations (docs/sdk.md), custom providers (docs/custom-provider.md), adding models (docs/models.md), atomic packages (docs/packages.md)\n- When working on Atomic topics, read the docs and examples, and follow .md cross-references before implementing\n- Always read Atomic .md files completely and follow links to related docs (e.g., tui.md for TUI API details)`;\n\n  if (appendSection) {\n    prompt += appendSection;\n  }\n\n  // Append project context files\n  if (contextFiles.length > 0) {\n    prompt += \"\\n\\n# Project Context\\n\\n\";\n    prompt += \"Project-specific instructions and guidelines:\\n\\n\";\n    for (const { path: filePath, content } of contextFiles) {\n      prompt += `<context_file path=\\\"${filePath}\\\">\\n${content}\\n</context_file>\\n\\n`;\n    }\n  }\n\n  // Append skills section (only if read tool is available)\n  if (hasRead && skills.length > 0) {\n    prompt += formatSkillsForPrompt(skills);\n  }\n\n  // Add model metadata, date, and working directory last\n  prompt += `\\nModel name (used for commit attribution): ${modelName}`;\n  prompt += `\\nModel reasoning level: ${modelReasoningLevel}`;\n  prompt += `\\nCurrent date: ${date}`;\n  prompt += `\\nCurrent working directory: ${promptCwd}`;\n\n  return prompt;\n}\n"]}

package/dist/core/tools/bash-policy-compile.d.ts

@@ -0,0 +1,5 @@
+import type { BashCommandPolicy, BashCommandPolicyMatchMode, CompileResult } from "./bash-policy-types.ts";
+export declare function compilePolicy(policy: BashCommandPolicy): CompileResult;
+export declare function validateBashCommandPolicy(policy: BashCommandPolicy): void;
+export declare function invalidPolicyMode(policy: BashCommandPolicy): BashCommandPolicyMatchMode;
+//# sourceMappingURL=bash-policy-compile.d.ts.map

package/dist/core/tools/bash-policy-compile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bash-policy-compile.d.ts","sourceRoot":"","sources":["../../../src/core/tools/bash-policy-compile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,iBAAiB,EACjB,0BAA0B,EAG1B,aAAa,EAGb,MAAM,wBAAwB,CAAC;AAqNhC,wBAAgB,aAAa,CAAC,MAAM,EAAE,iBAAiB,GAAG,aAAa,CA2CtE;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAKzE;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,0BAA0B,CAGvF","sourcesContent":["import type {\n\tBashCommandPolicy,\n\tBashCommandPolicyMatchMode,\n\tBashCommandRule,\n\tCompiledRule,\n\tCompileResult,\n\tCompileRuleResult,\n\tCompileRulesResult,\n} from \"./bash-policy-types.ts\";\n\ntype RuntimePropertyValue =\n\t| string\n\t| number\n\t| boolean\n\t| bigint\n\t| symbol\n\t| null\n\t| object\n\t| ((...args: readonly never[]) => RuntimePropertyValue)\n\t| undefined;\n\ntype RuleObjectKey = \"prefix\" | \"glob\" | \"regex\" | \"flags\";\n\nconst BASH_POLICY_TOP_LEVEL_KEYS = [\"default\", \"allow\", \"deny\", \"match\"] as const;\nconst BASH_POLICY_TOP_LEVEL_KEY_SET: ReadonlySet<string> = new Set(BASH_POLICY_TOP_LEVEL_KEYS);\n\nfunction hasOwnRuleKey<Key extends RuleObjectKey>(\n\tvalue: object,\n\tkey: Key,\n): value is Record<Key, RuntimePropertyValue> {\n\treturn Object.prototype.hasOwnProperty.call(value, key);\n}\n\nfunction hasOnlyRuleKeys(value: object, allowedKeys: readonly string[]): boolean {\n\treturn Object.keys(value).every((key) => allowedKeys.includes(key));\n}\n\nfunction unknownBashPolicyTopLevelKeys(policy: object): readonly string[] {\n\treturn Object.keys(policy).filter((key) => !BASH_POLICY_TOP_LEVEL_KEY_SET.has(key));\n}\n\nfunction escapeRegexLiteral(value: string): string {\n\treturn value.replace(/[\\\\^$.*+?()[\\]{}|]/g, \"\\\\$&\");\n}\n\nfunction escapeGlobClassCharacter(char: string): string {\n\tif (char === \"\\\\\") return \"\\\\\\\\\";\n\tif (char === \"]\") return \"\\\\]\";\n\tif (char === \"[\") return \"\\\\[\";\n\treturn char;\n}\n\nfunction escapeEscapedGlobClassCharacter(char: string): string {\n\tif (char === \"\\\\\") return \"\\\\\\\\\";\n\tif (char === \"-\") return \"\\\\-\";\n\tif (char === \"^\") return \"\\\\^\";\n\tif (char === \"]\") return \"\\\\]\";\n\tif (char === \"[\") return \"\\\\[\";\n\treturn char;\n}\n\nfunction readGlobBracketClass(\n\tpattern: string,\n\topenIndex: number,\n): { readonly regexSource: string; readonly closeIndex: number } | undefined {\n\tlet cursor = openIndex + 1;\n\tlet negated = false;\n\tlet hasContent = false;\n\tlet content = \"\";\n\n\tif (cursor >= pattern.length) return undefined;\n\tif (pattern[cursor] === \"!\" || pattern[cursor] === \"^\") {\n\t\tnegated = true;\n\t\tcursor += 1;\n\t}\n\tif (pattern[cursor] === \"]\") {\n\t\tcontent += \"\\\\]\";\n\t\thasContent = true;\n\t\tcursor += 1;\n\t}\n\n\tfor (; cursor < pattern.length; cursor += 1) {\n\t\tconst char = pattern[cursor]!;\n\t\tif (char === \"]\") {\n\t\t\tif (!hasContent) return undefined;\n\t\t\treturn { regexSource: `[${negated ? \"^\" : \"\"}${content}]`, closeIndex: cursor };\n\t\t}\n\t\thasContent = true;\n\t\tif (char === \"\\\\\" && cursor + 1 < pattern.length) {\n\t\t\tcursor += 1;\n\t\t\tcontent += escapeEscapedGlobClassCharacter(pattern[cursor]!);\n\t\t\tcontinue;\n\t\t}\n\t\tcontent += escapeGlobClassCharacter(char);\n\t}\n\n\treturn undefined;\n}\n\nfunction compileCommandStringGlob(pattern: string): RegExp {\n\tlet source = \"^\";\n\tfor (let index = 0; index < pattern.length; index += 1) {\n\t\tconst char = pattern[index]!;\n\t\tif (char === \"*\") {\n\t\t\tsource += \".*\";\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"?\") {\n\t\t\tsource += \".\";\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"[\") {\n\t\t\tconst bracket = readGlobBracketClass(pattern, index);\n\t\t\tif (bracket !== undefined) {\n\t\t\t\tsource += bracket.regexSource;\n\t\t\t\tindex = bracket.closeIndex;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t}\n\t\tif (char === \"\\\\\" && index + 1 < pattern.length) {\n\t\t\tindex += 1;\n\t\t\tsource += escapeRegexLiteral(pattern[index]!);\n\t\t\tcontinue;\n\t\t}\n\t\tsource += escapeRegexLiteral(char);\n\t}\n\treturn new RegExp(`${source}$`);\n}\n\nfunction compileRule(rule: BashCommandRule, listName: \"allow\" | \"deny\", index: number): CompileRuleResult {\n\tif (typeof rule === \"string\") {\n\t\tif (rule.length === 0) {\n\t\t\treturn { ok: false, message: `${listName}[${index}] exact rule must not be empty` };\n\t\t}\n\t\treturn { ok: true, rule: { kind: \"exact\", source: rule, value: rule } };\n\t}\n\n\tif (typeof rule !== \"object\" || rule === null || Array.isArray(rule)) {\n\t\treturn { ok: false, message: `${listName}[${index}] rule must be a non-empty string or an object rule` };\n\t}\n\n\tconst hasPrefix = hasOwnRuleKey(rule, \"prefix\");\n\tconst hasGlob = hasOwnRuleKey(rule, \"glob\");\n\tconst hasRegex = hasOwnRuleKey(rule, \"regex\");\n\tconst variantCount = (hasPrefix ? 1 : 0) + (hasGlob ? 1 : 0) + (hasRegex ? 1 : 0);\n\tif (variantCount !== 1) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\tmessage: `${listName}[${index}] must specify exactly one of prefix, glob, or regex`,\n\t\t};\n\t}\n\n\tif (hasPrefix) {\n\t\tif (!hasOnlyRuleKeys(rule, [\"prefix\"])) {\n\t\t\treturn { ok: false, message: `${listName}[${index}] prefix rule must only contain prefix` };\n\t\t}\n\t\tif (typeof rule.prefix !== \"string\") {\n\t\t\treturn { ok: false, message: `${listName}[${index}].prefix must be a string` };\n\t\t}\n\t\tif (rule.prefix.length === 0) {\n\t\t\treturn { ok: false, message: `${listName}[${index}].prefix must not be empty` };\n\t\t}\n\t\treturn { ok: true, rule: { kind: \"prefix\", source: rule, value: rule.prefix } };\n\t}\n\n\tif (hasGlob) {\n\t\tif (!hasOnlyRuleKeys(rule, [\"glob\"])) {\n\t\t\treturn { ok: false, message: `${listName}[${index}] glob rule must only contain glob` };\n\t\t}\n\t\tif (typeof rule.glob !== \"string\") {\n\t\t\treturn { ok: false, message: `${listName}[${index}].glob must be a string` };\n\t\t}\n\t\tif (rule.glob.length === 0) {\n\t\t\treturn { ok: false, message: `${listName}[${index}].glob must not be empty` };\n\t\t}\n\t\ttry {\n\t\t\treturn { ok: true, rule: { kind: \"glob\", source: rule, value: compileCommandStringGlob(rule.glob) } };\n\t\t} catch {\n\t\t\treturn { ok: false, message: `${listName}[${index}].glob is not a valid command string glob` };\n\t\t}\n\t}\n\n\tif (!hasOnlyRuleKeys(rule, [\"regex\", \"flags\"])) {\n\t\treturn { ok: false, message: `${listName}[${index}] regex rule must only contain regex and optional flags` };\n\t}\n\tif (typeof rule.regex !== \"string\") {\n\t\treturn { ok: false, message: `${listName}[${index}].regex must be a string` };\n\t}\n\tif (rule.regex.length === 0) {\n\t\treturn { ok: false, message: `${listName}[${index}].regex must not be empty` };\n\t}\n\tconst hasFlags = hasOwnRuleKey(rule, \"flags\");\n\tif (hasFlags && typeof rule.flags !== \"string\") {\n\t\treturn { ok: false, message: `${listName}[${index}].flags must be a string when present` };\n\t}\n\tconst flags = hasFlags && typeof rule.flags === \"string\" ? rule.flags : \"\";\n\tif (/[gy]/.test(flags)) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\tmessage: `${listName}[${index}].flags must not include stateful g or y regex flags`,\n\t\t};\n\t}\n\ttry {\n\t\treturn { ok: true, rule: { kind: \"regex\", source: rule, value: new RegExp(rule.regex, flags) } };\n\t} catch {\n\t\treturn { ok: false, message: `${listName}[${index}].regex is not a valid JavaScript RegExp` };\n\t}\n}\n\nfunction compileRules(rules: readonly BashCommandRule[] | undefined, listName: \"allow\" | \"deny\"): CompileRulesResult {\n\tconst compiled: CompiledRule[] = [];\n\tif (rules === undefined) return { ok: true, rules: compiled };\n\tfor (let index = 0; index < rules.length; index += 1) {\n\t\tconst rule = rules[index]!;\n\t\tconst result = compileRule(rule, listName, index);\n\t\tif (!result.ok) return result;\n\t\tcompiled.push(result.rule);\n\t}\n\treturn { ok: true, rules: compiled };\n}\n\nexport function compilePolicy(policy: BashCommandPolicy): CompileResult {\n\tif (typeof policy !== \"object\" || policy === null || Array.isArray(policy)) {\n\t\treturn { ok: false, message: \"bash policy must be a non-null object\" };\n\t}\n\n\tconst unknownKeys = unknownBashPolicyTopLevelKeys(policy);\n\tif (unknownKeys.length > 0) {\n\t\tconst formattedKeys = unknownKeys.map((key) => JSON.stringify(key)).join(\", \");\n\t\treturn {\n\t\t\tok: false,\n\t\t\tmessage: `bash policy contains unknown top-level key${unknownKeys.length === 1 ? \"\" : \"s\"} ${formattedKeys}; allowed keys are default, allow, deny, and match`,\n\t\t};\n\t}\n\n\tconst defaultDecision = policy.default === undefined ? \"allow\" : policy.default;\n\tif (defaultDecision !== \"allow\" && defaultDecision !== \"deny\") {\n\t\treturn { ok: false, message: `bash policy default must be \"allow\" or \"deny\"` };\n\t}\n\tconst match = policy.match === undefined ? \"segments\" : policy.match;\n\tif (match !== \"whole\" && match !== \"segments\") {\n\t\treturn { ok: false, message: `bash policy match must be \"whole\" or \"segments\"` };\n\t}\n\tif (policy.allow !== undefined && !Array.isArray(policy.allow)) {\n\t\treturn { ok: false, message: \"bash policy allow must be an array\" };\n\t}\n\tif (policy.deny !== undefined && !Array.isArray(policy.deny)) {\n\t\treturn { ok: false, message: \"bash policy deny must be an array\" };\n\t}\n\n\tconst allow = compileRules(policy.allow, \"allow\");\n\tif (!allow.ok) return allow;\n\tconst deny = compileRules(policy.deny, \"deny\");\n\tif (!deny.ok) return deny;\n\n\treturn {\n\t\tok: true,\n\t\tpolicy: {\n\t\t\tdefaultDecision,\n\t\t\tmatch,\n\t\t\tallow: allow.rules,\n\t\t\tdeny: deny.rules,\n\t\t},\n\t};\n}\n\nexport function validateBashCommandPolicy(policy: BashCommandPolicy): void {\n\tconst compiled = compilePolicy(policy);\n\tif (!compiled.ok) {\n\t\tthrow new Error(`Invalid bash command policy: ${compiled.message}`);\n\t}\n}\n\nexport function invalidPolicyMode(policy: BashCommandPolicy): BashCommandPolicyMatchMode {\n\tif (typeof policy !== \"object\" || policy === null || Array.isArray(policy)) return \"segments\";\n\treturn policy.match === \"whole\" ? \"whole\" : \"segments\";\n}\n"]}

package/dist/core/tools/bash-policy-compile.js

@@ -0,0 +1,241 @@
+const BASH_POLICY_TOP_LEVEL_KEYS = ["default", "allow", "deny", "match"];
+const BASH_POLICY_TOP_LEVEL_KEY_SET = new Set(BASH_POLICY_TOP_LEVEL_KEYS);
+function hasOwnRuleKey(value, key) {
+    return Object.prototype.hasOwnProperty.call(value, key);
+}
+function hasOnlyRuleKeys(value, allowedKeys) {
+    return Object.keys(value).every((key) => allowedKeys.includes(key));
+}
+function unknownBashPolicyTopLevelKeys(policy) {
+    return Object.keys(policy).filter((key) => !BASH_POLICY_TOP_LEVEL_KEY_SET.has(key));
+}
+function escapeRegexLiteral(value) {
+    return value.replace(/[\\^$.*+?()[\]{}|]/g, "\\$&");
+}
+function escapeGlobClassCharacter(char) {
+    if (char === "\\")
+        return "\\\\";
+    if (char === "]")
+        return "\\]";
+    if (char === "[")
+        return "\\[";
+    return char;
+}
+function escapeEscapedGlobClassCharacter(char) {
+    if (char === "\\")
+        return "\\\\";
+    if (char === "-")
+        return "\\-";
+    if (char === "^")
+        return "\\^";
+    if (char === "]")
+        return "\\]";
+    if (char === "[")
+        return "\\[";
+    return char;
+}
+function readGlobBracketClass(pattern, openIndex) {
+    let cursor = openIndex + 1;
+    let negated = false;
+    let hasContent = false;
+    let content = "";
+    if (cursor >= pattern.length)
+        return undefined;
+    if (pattern[cursor] === "!" || pattern[cursor] === "^") {
+        negated = true;
+        cursor += 1;
+    }
+    if (pattern[cursor] === "]") {
+        content += "\\]";
+        hasContent = true;
+        cursor += 1;
+    }
+    for (; cursor < pattern.length; cursor += 1) {
+        const char = pattern[cursor];
+        if (char === "]") {
+            if (!hasContent)
+                return undefined;
+            return { regexSource: `[${negated ? "^" : ""}${content}]`, closeIndex: cursor };
+        }
+        hasContent = true;
+        if (char === "\\" && cursor + 1 < pattern.length) {
+            cursor += 1;
+            content += escapeEscapedGlobClassCharacter(pattern[cursor]);
+            continue;
+        }
+        content += escapeGlobClassCharacter(char);
+    }
+    return undefined;
+}
+function compileCommandStringGlob(pattern) {
+    let source = "^";
+    for (let index = 0; index < pattern.length; index += 1) {
+        const char = pattern[index];
+        if (char === "*") {
+            source += ".*";
+            continue;
+        }
+        if (char === "?") {
+            source += ".";
+            continue;
+        }
+        if (char === "[") {
+            const bracket = readGlobBracketClass(pattern, index);
+            if (bracket !== undefined) {
+                source += bracket.regexSource;
+                index = bracket.closeIndex;
+                continue;
+            }
+        }
+        if (char === "\\" && index + 1 < pattern.length) {
+            index += 1;
+            source += escapeRegexLiteral(pattern[index]);
+            continue;
+        }
+        source += escapeRegexLiteral(char);
+    }
+    return new RegExp(`${source}$`);
+}
+function compileRule(rule, listName, index) {
+    if (typeof rule === "string") {
+        if (rule.length === 0) {
+            return { ok: false, message: `${listName}[${index}] exact rule must not be empty` };
+        }
+        return { ok: true, rule: { kind: "exact", source: rule, value: rule } };
+    }
+    if (typeof rule !== "object" || rule === null || Array.isArray(rule)) {
+        return { ok: false, message: `${listName}[${index}] rule must be a non-empty string or an object rule` };
+    }
+    const hasPrefix = hasOwnRuleKey(rule, "prefix");
+    const hasGlob = hasOwnRuleKey(rule, "glob");
+    const hasRegex = hasOwnRuleKey(rule, "regex");
+    const variantCount = (hasPrefix ? 1 : 0) + (hasGlob ? 1 : 0) + (hasRegex ? 1 : 0);
+    if (variantCount !== 1) {
+        return {
+            ok: false,
+            message: `${listName}[${index}] must specify exactly one of prefix, glob, or regex`,
+        };
+    }
+    if (hasPrefix) {
+        if (!hasOnlyRuleKeys(rule, ["prefix"])) {
+            return { ok: false, message: `${listName}[${index}] prefix rule must only contain prefix` };
+        }
+        if (typeof rule.prefix !== "string") {
+            return { ok: false, message: `${listName}[${index}].prefix must be a string` };
+        }
+        if (rule.prefix.length === 0) {
+            return { ok: false, message: `${listName}[${index}].prefix must not be empty` };
+        }
+        return { ok: true, rule: { kind: "prefix", source: rule, value: rule.prefix } };
+    }
+    if (hasGlob) {
+        if (!hasOnlyRuleKeys(rule, ["glob"])) {
+            return { ok: false, message: `${listName}[${index}] glob rule must only contain glob` };
+        }
+        if (typeof rule.glob !== "string") {
+            return { ok: false, message: `${listName}[${index}].glob must be a string` };
+        }
+        if (rule.glob.length === 0) {
+            return { ok: false, message: `${listName}[${index}].glob must not be empty` };
+        }
+        try {
+            return { ok: true, rule: { kind: "glob", source: rule, value: compileCommandStringGlob(rule.glob) } };
+        }
+        catch {
+            return { ok: false, message: `${listName}[${index}].glob is not a valid command string glob` };
+        }
+    }
+    if (!hasOnlyRuleKeys(rule, ["regex", "flags"])) {
+        return { ok: false, message: `${listName}[${index}] regex rule must only contain regex and optional flags` };
+    }
+    if (typeof rule.regex !== "string") {
+        return { ok: false, message: `${listName}[${index}].regex must be a string` };
+    }
+    if (rule.regex.length === 0) {
+        return { ok: false, message: `${listName}[${index}].regex must not be empty` };
+    }
+    const hasFlags = hasOwnRuleKey(rule, "flags");
+    if (hasFlags && typeof rule.flags !== "string") {
+        return { ok: false, message: `${listName}[${index}].flags must be a string when present` };
+    }
+    const flags = hasFlags && typeof rule.flags === "string" ? rule.flags : "";
+    if (/[gy]/.test(flags)) {
+        return {
+            ok: false,
+            message: `${listName}[${index}].flags must not include stateful g or y regex flags`,
+        };
+    }
+    try {
+        return { ok: true, rule: { kind: "regex", source: rule, value: new RegExp(rule.regex, flags) } };
+    }
+    catch {
+        return { ok: false, message: `${listName}[${index}].regex is not a valid JavaScript RegExp` };
+    }
+}
+function compileRules(rules, listName) {
+    const compiled = [];
+    if (rules === undefined)
+        return { ok: true, rules: compiled };
+    for (let index = 0; index < rules.length; index += 1) {
+        const rule = rules[index];
+        const result = compileRule(rule, listName, index);
+        if (!result.ok)
+            return result;
+        compiled.push(result.rule);
+    }
+    return { ok: true, rules: compiled };
+}
+export function compilePolicy(policy) {
+    if (typeof policy !== "object" || policy === null || Array.isArray(policy)) {
+        return { ok: false, message: "bash policy must be a non-null object" };
+    }
+    const unknownKeys = unknownBashPolicyTopLevelKeys(policy);
+    if (unknownKeys.length > 0) {
+        const formattedKeys = unknownKeys.map((key) => JSON.stringify(key)).join(", ");
+        return {
+            ok: false,
+            message: `bash policy contains unknown top-level key${unknownKeys.length === 1 ? "" : "s"} ${formattedKeys}; allowed keys are default, allow, deny, and match`,
+        };
+    }
+    const defaultDecision = policy.default === undefined ? "allow" : policy.default;
+    if (defaultDecision !== "allow" && defaultDecision !== "deny") {
+        return { ok: false, message: `bash policy default must be "allow" or "deny"` };
+    }
+    const match = policy.match === undefined ? "segments" : policy.match;
+    if (match !== "whole" && match !== "segments") {
+        return { ok: false, message: `bash policy match must be "whole" or "segments"` };
+    }
+    if (policy.allow !== undefined && !Array.isArray(policy.allow)) {
+        return { ok: false, message: "bash policy allow must be an array" };
+    }
+    if (policy.deny !== undefined && !Array.isArray(policy.deny)) {
+        return { ok: false, message: "bash policy deny must be an array" };
+    }
+    const allow = compileRules(policy.allow, "allow");
+    if (!allow.ok)
+        return allow;
+    const deny = compileRules(policy.deny, "deny");
+    if (!deny.ok)
+        return deny;
+    return {
+        ok: true,
+        policy: {
+            defaultDecision,
+            match,
+            allow: allow.rules,
+            deny: deny.rules,
+        },
+    };
+}
+export function validateBashCommandPolicy(policy) {
+    const compiled = compilePolicy(policy);
+    if (!compiled.ok) {
+        throw new Error(`Invalid bash command policy: ${compiled.message}`);
+    }
+}
+export function invalidPolicyMode(policy) {
+    if (typeof policy !== "object" || policy === null || Array.isArray(policy))
+        return "segments";
+    return policy.match === "whole" ? "whole" : "segments";
+}
+//# sourceMappingURL=bash-policy-compile.js.map

package/dist/core/tools/bash-policy-compile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bash-policy-compile.js","sourceRoot":"","sources":["../../../src/core/tools/bash-policy-compile.ts"],"names":[],"mappings":"AAuBA,MAAM,0BAA0B,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AAClF,MAAM,6BAA6B,GAAwB,IAAI,GAAG,CAAC,0BAA0B,CAAC,CAAC;AAE/F,SAAS,aAAa,CACrB,KAAa,EACb,GAAQ;IAER,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,eAAe,CAAC,KAAa,EAAE,WAA8B;IACrE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,6BAA6B,CAAC,MAAc;IACpD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,6BAA6B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY;IAC7C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACjC,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/B,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,+BAA+B,CAAC,IAAY;IACpD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACjC,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/B,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,oBAAoB,CAC5B,OAAe,EACf,SAAiB;IAEjB,IAAI,MAAM,GAAG,SAAS,GAAG,CAAC,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,OAAO,GAAG,EAAE,CAAC;IAEjB,IAAI,MAAM,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;QACxD,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,IAAI,CAAC,CAAC;IACb,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;QAC7B,OAAO,IAAI,KAAK,CAAC;QACjB,UAAU,GAAG,IAAI,CAAC;QAClB,MAAM,IAAI,CAAC,CAAC;IACb,CAAC;IAED,OAAO,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAE,CAAC;QAC9B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,UAAU;gBAAE,OAAO,SAAS,CAAC;YAClC,OAAO,EAAE,WAAW,EAAE,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACjF,CAAC;QACD,UAAU,GAAG,IAAI,CAAC;QAClB,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAClD,MAAM,IAAI,CAAC,CAAC;YACZ,OAAO,IAAI,+BAA+B,CAAC,OAAO,CAAC,MAAM,CAAE,CAAC,CAAC;YAC7D,SAAS;QACV,CAAC;QACD,OAAO,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe;IAChD,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAE,CAAC;QAC7B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,MAAM,IAAI,IAAI,CAAC;YACf,SAAS;QACV,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,MAAM,IAAI,GAAG,CAAC;YACd,SAAS;QACV,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC;gBAC9B,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC;gBAC3B,SAAS;YACV,CAAC;QACF,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YACjD,KAAK,IAAI,CAAC,CAAC;YACX,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAE,CAAC,CAAC;YAC9C,SAAS;QACV,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,WAAW,CAAC,IAAqB,EAAE,QAA0B,EAAE,KAAa;IACpF,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,QAAQ,IAAI,KAAK,gCAAgC,EAAE,CAAC;QACrF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;IACzE,CAAC;IAED,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,QAAQ,IAAI,KAAK,qDAAqD,EAAE,CAAC;IAC1G,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;YACN,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,GAAG,QAAQ,IAAI,KAAK,sDAAsD;SACnF,CAAC;IACH,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,QAAQ,IAAI,KAAK,wCAAwC,EAAE,CAAC;QAC7F,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,QAAQ,IAAI,KAAK,2BAA2B,EAAE,CAAC;QAChF,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,QAAQ,IAAI,KAAK,4BAA4B,EAAE,CAAC;QACjF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;IACjF,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACb,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,QAAQ,IAAI,KAAK,oCAAoC,EAAE,CAAC;QACzF,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,QAAQ,IAAI,KAAK,yBAAyB,EAAE,CAAC;QAC9E,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,QAAQ,IAAI,KAAK,0BAA0B,EAAE,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC;YACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACvG,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,QAAQ,IAAI,KAAK,2CAA2C,EAAE,CAAC;QAChG,CAAC;IACF,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,QAAQ,IAAI,KAAK,yDAAyD,EAAE,CAAC;IAC9G,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,QAAQ,IAAI,KAAK,0BAA0B,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,QAAQ,IAAI,KAAK,2BAA2B,EAAE,CAAC;IAChF,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,QAAQ,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,QAAQ,IAAI,KAAK,uCAAuC,EAAE,CAAC;IAC5F,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;YACN,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,GAAG,QAAQ,IAAI,KAAK,sDAAsD;SACnF,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAClG,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,QAAQ,IAAI,KAAK,0CAA0C,EAAE,CAAC;IAC/F,CAAC;AACF,CAAC;AAED,SAAS,YAAY,CAAC,KAA6C,EAAE,QAA0B;IAC9F,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC9D,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAyB;IACtD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC;IACxE,CAAC;IAED,MAAM,WAAW,GAAG,6BAA6B,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/E,OAAO;YACN,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,6CAA6C,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,aAAa,oDAAoD;SAC9J,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IAChF,IAAI,eAAe,KAAK,OAAO,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;IAChF,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;IACrE,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO;QACN,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACP,eAAe;YACf,KAAK;YACL,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,IAAI,CAAC,KAAK;SAChB;KACD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAyB;IAClE,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;AACF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAyB;IAC1D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,UAAU,CAAC;IAC9F,OAAO,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;AACxD,CAAC","sourcesContent":["import type {\n\tBashCommandPolicy,\n\tBashCommandPolicyMatchMode,\n\tBashCommandRule,\n\tCompiledRule,\n\tCompileResult,\n\tCompileRuleResult,\n\tCompileRulesResult,\n} from \"./bash-policy-types.ts\";\n\ntype RuntimePropertyValue =\n\t| string\n\t| number\n\t| boolean\n\t| bigint\n\t| symbol\n\t| null\n\t| object\n\t| ((...args: readonly never[]) => RuntimePropertyValue)\n\t| undefined;\n\ntype RuleObjectKey = \"prefix\" | \"glob\" | \"regex\" | \"flags\";\n\nconst BASH_POLICY_TOP_LEVEL_KEYS = [\"default\", \"allow\", \"deny\", \"match\"] as const;\nconst BASH_POLICY_TOP_LEVEL_KEY_SET: ReadonlySet<string> = new Set(BASH_POLICY_TOP_LEVEL_KEYS);\n\nfunction hasOwnRuleKey<Key extends RuleObjectKey>(\n\tvalue: object,\n\tkey: Key,\n): value is Record<Key, RuntimePropertyValue> {\n\treturn Object.prototype.hasOwnProperty.call(value, key);\n}\n\nfunction hasOnlyRuleKeys(value: object, allowedKeys: readonly string[]): boolean {\n\treturn Object.keys(value).every((key) => allowedKeys.includes(key));\n}\n\nfunction unknownBashPolicyTopLevelKeys(policy: object): readonly string[] {\n\treturn Object.keys(policy).filter((key) => !BASH_POLICY_TOP_LEVEL_KEY_SET.has(key));\n}\n\nfunction escapeRegexLiteral(value: string): string {\n\treturn value.replace(/[\\\\^$.*+?()[\\]{}|]/g, \"\\\\$&\");\n}\n\nfunction escapeGlobClassCharacter(char: string): string {\n\tif (char === \"\\\\\") return \"\\\\\\\\\";\n\tif (char === \"]\") return \"\\\\]\";\n\tif (char === \"[\") return \"\\\\[\";\n\treturn char;\n}\n\nfunction escapeEscapedGlobClassCharacter(char: string): string {\n\tif (char === \"\\\\\") return \"\\\\\\\\\";\n\tif (char === \"-\") return \"\\\\-\";\n\tif (char === \"^\") return \"\\\\^\";\n\tif (char === \"]\") return \"\\\\]\";\n\tif (char === \"[\") return \"\\\\[\";\n\treturn char;\n}\n\nfunction readGlobBracketClass(\n\tpattern: string,\n\topenIndex: number,\n): { readonly regexSource: string; readonly closeIndex: number } | undefined {\n\tlet cursor = openIndex + 1;\n\tlet negated = false;\n\tlet hasContent = false;\n\tlet content = \"\";\n\n\tif (cursor >= pattern.length) return undefined;\n\tif (pattern[cursor] === \"!\" || pattern[cursor] === \"^\") {\n\t\tnegated = true;\n\t\tcursor += 1;\n\t}\n\tif (pattern[cursor] === \"]\") {\n\t\tcontent += \"\\\\]\";\n\t\thasContent = true;\n\t\tcursor += 1;\n\t}\n\n\tfor (; cursor < pattern.length; cursor += 1) {\n\t\tconst char = pattern[cursor]!;\n\t\tif (char === \"]\") {\n\t\t\tif (!hasContent) return undefined;\n\t\t\treturn { regexSource: `[${negated ? \"^\" : \"\"}${content}]`, closeIndex: cursor };\n\t\t}\n\t\thasContent = true;\n\t\tif (char === \"\\\\\" && cursor + 1 < pattern.length) {\n\t\t\tcursor += 1;\n\t\t\tcontent += escapeEscapedGlobClassCharacter(pattern[cursor]!);\n\t\t\tcontinue;\n\t\t}\n\t\tcontent += escapeGlobClassCharacter(char);\n\t}\n\n\treturn undefined;\n}\n\nfunction compileCommandStringGlob(pattern: string): RegExp {\n\tlet source = \"^\";\n\tfor (let index = 0; index < pattern.length; index += 1) {\n\t\tconst char = pattern[index]!;\n\t\tif (char === \"*\") {\n\t\t\tsource += \".*\";\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"?\") {\n\t\t\tsource += \".\";\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"[\") {\n\t\t\tconst bracket = readGlobBracketClass(pattern, index);\n\t\t\tif (bracket !== undefined) {\n\t\t\t\tsource += bracket.regexSource;\n\t\t\t\tindex = bracket.closeIndex;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t}\n\t\tif (char === \"\\\\\" && index + 1 < pattern.length) {\n\t\t\tindex += 1;\n\t\t\tsource += escapeRegexLiteral(pattern[index]!);\n\t\t\tcontinue;\n\t\t}\n\t\tsource += escapeRegexLiteral(char);\n\t}\n\treturn new RegExp(`${source}$`);\n}\n\nfunction compileRule(rule: BashCommandRule, listName: \"allow\" | \"deny\", index: number): CompileRuleResult {\n\tif (typeof rule === \"string\") {\n\t\tif (rule.length === 0) {\n\t\t\treturn { ok: false, message: `${listName}[${index}] exact rule must not be empty` };\n\t\t}\n\t\treturn { ok: true, rule: { kind: \"exact\", source: rule, value: rule } };\n\t}\n\n\tif (typeof rule !== \"object\" || rule === null || Array.isArray(rule)) {\n\t\treturn { ok: false, message: `${listName}[${index}] rule must be a non-empty string or an object rule` };\n\t}\n\n\tconst hasPrefix = hasOwnRuleKey(rule, \"prefix\");\n\tconst hasGlob = hasOwnRuleKey(rule, \"glob\");\n\tconst hasRegex = hasOwnRuleKey(rule, \"regex\");\n\tconst variantCount = (hasPrefix ? 1 : 0) + (hasGlob ? 1 : 0) + (hasRegex ? 1 : 0);\n\tif (variantCount !== 1) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\tmessage: `${listName}[${index}] must specify exactly one of prefix, glob, or regex`,\n\t\t};\n\t}\n\n\tif (hasPrefix) {\n\t\tif (!hasOnlyRuleKeys(rule, [\"prefix\"])) {\n\t\t\treturn { ok: false, message: `${listName}[${index}] prefix rule must only contain prefix` };\n\t\t}\n\t\tif (typeof rule.prefix !== \"string\") {\n\t\t\treturn { ok: false, message: `${listName}[${index}].prefix must be a string` };\n\t\t}\n\t\tif (rule.prefix.length === 0) {\n\t\t\treturn { ok: false, message: `${listName}[${index}].prefix must not be empty` };\n\t\t}\n\t\treturn { ok: true, rule: { kind: \"prefix\", source: rule, value: rule.prefix } };\n\t}\n\n\tif (hasGlob) {\n\t\tif (!hasOnlyRuleKeys(rule, [\"glob\"])) {\n\t\t\treturn { ok: false, message: `${listName}[${index}] glob rule must only contain glob` };\n\t\t}\n\t\tif (typeof rule.glob !== \"string\") {\n\t\t\treturn { ok: false, message: `${listName}[${index}].glob must be a string` };\n\t\t}\n\t\tif (rule.glob.length === 0) {\n\t\t\treturn { ok: false, message: `${listName}[${index}].glob must not be empty` };\n\t\t}\n\t\ttry {\n\t\t\treturn { ok: true, rule: { kind: \"glob\", source: rule, value: compileCommandStringGlob(rule.glob) } };\n\t\t} catch {\n\t\t\treturn { ok: false, message: `${listName}[${index}].glob is not a valid command string glob` };\n\t\t}\n\t}\n\n\tif (!hasOnlyRuleKeys(rule, [\"regex\", \"flags\"])) {\n\t\treturn { ok: false, message: `${listName}[${index}] regex rule must only contain regex and optional flags` };\n\t}\n\tif (typeof rule.regex !== \"string\") {\n\t\treturn { ok: false, message: `${listName}[${index}].regex must be a string` };\n\t}\n\tif (rule.regex.length === 0) {\n\t\treturn { ok: false, message: `${listName}[${index}].regex must not be empty` };\n\t}\n\tconst hasFlags = hasOwnRuleKey(rule, \"flags\");\n\tif (hasFlags && typeof rule.flags !== \"string\") {\n\t\treturn { ok: false, message: `${listName}[${index}].flags must be a string when present` };\n\t}\n\tconst flags = hasFlags && typeof rule.flags === \"string\" ? rule.flags : \"\";\n\tif (/[gy]/.test(flags)) {\n\t\treturn {\n\t\t\tok: false,\n\t\t\tmessage: `${listName}[${index}].flags must not include stateful g or y regex flags`,\n\t\t};\n\t}\n\ttry {\n\t\treturn { ok: true, rule: { kind: \"regex\", source: rule, value: new RegExp(rule.regex, flags) } };\n\t} catch {\n\t\treturn { ok: false, message: `${listName}[${index}].regex is not a valid JavaScript RegExp` };\n\t}\n}\n\nfunction compileRules(rules: readonly BashCommandRule[] | undefined, listName: \"allow\" | \"deny\"): CompileRulesResult {\n\tconst compiled: CompiledRule[] = [];\n\tif (rules === undefined) return { ok: true, rules: compiled };\n\tfor (let index = 0; index < rules.length; index += 1) {\n\t\tconst rule = rules[index]!;\n\t\tconst result = compileRule(rule, listName, index);\n\t\tif (!result.ok) return result;\n\t\tcompiled.push(result.rule);\n\t}\n\treturn { ok: true, rules: compiled };\n}\n\nexport function compilePolicy(policy: BashCommandPolicy): CompileResult {\n\tif (typeof policy !== \"object\" || policy === null || Array.isArray(policy)) {\n\t\treturn { ok: false, message: \"bash policy must be a non-null object\" };\n\t}\n\n\tconst unknownKeys = unknownBashPolicyTopLevelKeys(policy);\n\tif (unknownKeys.length > 0) {\n\t\tconst formattedKeys = unknownKeys.map((key) => JSON.stringify(key)).join(\", \");\n\t\treturn {\n\t\t\tok: false,\n\t\t\tmessage: `bash policy contains unknown top-level key${unknownKeys.length === 1 ? \"\" : \"s\"} ${formattedKeys}; allowed keys are default, allow, deny, and match`,\n\t\t};\n\t}\n\n\tconst defaultDecision = policy.default === undefined ? \"allow\" : policy.default;\n\tif (defaultDecision !== \"allow\" && defaultDecision !== \"deny\") {\n\t\treturn { ok: false, message: `bash policy default must be \"allow\" or \"deny\"` };\n\t}\n\tconst match = policy.match === undefined ? \"segments\" : policy.match;\n\tif (match !== \"whole\" && match !== \"segments\") {\n\t\treturn { ok: false, message: `bash policy match must be \"whole\" or \"segments\"` };\n\t}\n\tif (policy.allow !== undefined && !Array.isArray(policy.allow)) {\n\t\treturn { ok: false, message: \"bash policy allow must be an array\" };\n\t}\n\tif (policy.deny !== undefined && !Array.isArray(policy.deny)) {\n\t\treturn { ok: false, message: \"bash policy deny must be an array\" };\n\t}\n\n\tconst allow = compileRules(policy.allow, \"allow\");\n\tif (!allow.ok) return allow;\n\tconst deny = compileRules(policy.deny, \"deny\");\n\tif (!deny.ok) return deny;\n\n\treturn {\n\t\tok: true,\n\t\tpolicy: {\n\t\t\tdefaultDecision,\n\t\t\tmatch,\n\t\t\tallow: allow.rules,\n\t\t\tdeny: deny.rules,\n\t\t},\n\t};\n}\n\nexport function validateBashCommandPolicy(policy: BashCommandPolicy): void {\n\tconst compiled = compilePolicy(policy);\n\tif (!compiled.ok) {\n\t\tthrow new Error(`Invalid bash command policy: ${compiled.message}`);\n\t}\n}\n\nexport function invalidPolicyMode(policy: BashCommandPolicy): BashCommandPolicyMatchMode {\n\tif (typeof policy !== \"object\" || policy === null || Array.isArray(policy)) return \"segments\";\n\treturn policy.match === \"whole\" ? \"whole\" : \"segments\";\n}\n"]}

package/dist/core/tools/bash-policy-evaluate.d.ts

@@ -0,0 +1,3 @@
+import type { BashCommandPolicy, BashCommandPolicyDecision } from "./bash-policy-types.ts";
+export declare function evaluateBashCommandPolicy(command: string, policy: BashCommandPolicy | undefined): BashCommandPolicyDecision;
+//# sourceMappingURL=bash-policy-evaluate.d.ts.map

package/dist/core/tools/bash-policy-evaluate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bash-policy-evaluate.d.ts","sourceRoot":"","sources":["../../../src/core/tools/bash-policy-evaluate.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAEX,iBAAiB,EACjB,yBAAyB,EAIzB,MAAM,wBAAwB,CAAC;AA0BhC,wBAAgB,yBAAyB,CACxC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,yBAAyB,CA0E3B","sourcesContent":["import { compilePolicy, invalidPolicyMode } from \"./bash-policy-compile.ts\";\nimport { parseBashCommandSegments, wholeCommandTarget } from \"./bash-policy-parser.ts\";\nimport type {\n\tBashCommandParseResult,\n\tBashCommandPolicy,\n\tBashCommandPolicyDecision,\n\tBashCommandRule,\n\tCompiledBashCommandPolicy,\n\tCompiledRule,\n} from \"./bash-policy-types.ts\";\n\nfunction ruleMatches(rule: CompiledRule, target: string): boolean {\n\tswitch (rule.kind) {\n\t\tcase \"exact\":\n\t\t\treturn target === rule.value;\n\t\tcase \"prefix\":\n\t\t\treturn target.startsWith(rule.value);\n\t\tcase \"glob\":\n\t\t\treturn rule.value.test(target);\n\t\tcase \"regex\":\n\t\t\treturn rule.value.test(target);\n\t}\n}\n\nfunction firstMatchingRule(rules: readonly CompiledRule[], target: string): BashCommandRule | undefined {\n\tfor (const rule of rules) {\n\t\tif (ruleMatches(rule, target)) return rule.source;\n\t}\n\treturn undefined;\n}\n\nfunction isNoRuleDefaultAllowPolicy(policy: CompiledBashCommandPolicy): boolean {\n\treturn policy.defaultDecision === \"allow\" && policy.allow.length === 0 && policy.deny.length === 0;\n}\n\nexport function evaluateBashCommandPolicy(\n\tcommand: string,\n\tpolicy: BashCommandPolicy | undefined,\n): BashCommandPolicyDecision {\n\tif (policy === undefined) {\n\t\treturn { allowed: true, mode: \"segments\", targets: [] };\n\t}\n\n\tconst compiled = compilePolicy(policy);\n\tif (!compiled.ok) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tmode: invalidPolicyMode(policy),\n\t\t\ttargets: [],\n\t\t\trejection: {\n\t\t\t\treason: \"invalid-policy\",\n\t\t\t\tmessage: compiled.message,\n\t\t\t},\n\t\t};\n\t}\n\n\tconst activePolicy = compiled.policy;\n\tif (isNoRuleDefaultAllowPolicy(activePolicy)) {\n\t\treturn { allowed: true, mode: activePolicy.match, targets: [] };\n\t}\n\n\tconst targetsResult: BashCommandParseResult = activePolicy.match === \"whole\"\n\t\t? { ok: true, segments: [wholeCommandTarget(command)] }\n\t\t: parseBashCommandSegments(command);\n\n\tif (!targetsResult.ok) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tmode: activePolicy.match,\n\t\t\ttargets: [],\n\t\t\trejection: {\n\t\t\t\treason: \"unsupported-shell-syntax\",\n\t\t\t\tmessage: targetsResult.error.reason,\n\t\t\t\tparseError: targetsResult.error,\n\t\t\t},\n\t\t};\n\t}\n\n\tfor (const target of targetsResult.segments) {\n\t\tconst denyRule = firstMatchingRule(activePolicy.deny, target.target);\n\t\tif (denyRule !== undefined) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\tmode: activePolicy.match,\n\t\t\t\ttargets: targetsResult.segments,\n\t\t\t\trejection: {\n\t\t\t\t\treason: \"matched-deny\",\n\t\t\t\t\tmessage: `command ${JSON.stringify(target.head)} matched a deny rule`,\n\t\t\t\t\ttarget,\n\t\t\t\t\tmatchedRule: denyRule,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tconst allowRule = firstMatchingRule(activePolicy.allow, target.target);\n\t\tif (allowRule !== undefined || activePolicy.defaultDecision === \"allow\") {\n\t\t\tcontinue;\n\t\t}\n\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tmode: activePolicy.match,\n\t\t\ttargets: targetsResult.segments,\n\t\t\trejection: {\n\t\t\t\treason: \"default-deny\",\n\t\t\t\tmessage: `command ${JSON.stringify(target.head)} is not permitted by default-deny bash policy`,\n\t\t\t\ttarget,\n\t\t\t},\n\t\t};\n\t}\n\n\treturn { allowed: true, mode: activePolicy.match, targets: targetsResult.segments };\n}\n"]}

package/dist/core/tools/bash-policy-evaluate.js

@@ -0,0 +1,92 @@
+import { compilePolicy, invalidPolicyMode } from "./bash-policy-compile.js";
+import { parseBashCommandSegments, wholeCommandTarget } from "./bash-policy-parser.js";
+function ruleMatches(rule, target) {
+    switch (rule.kind) {
+        case "exact":
+            return target === rule.value;
+        case "prefix":
+            return target.startsWith(rule.value);
+        case "glob":
+            return rule.value.test(target);
+        case "regex":
+            return rule.value.test(target);
+    }
+}
+function firstMatchingRule(rules, target) {
+    for (const rule of rules) {
+        if (ruleMatches(rule, target))
+            return rule.source;
+    }
+    return undefined;
+}
+function isNoRuleDefaultAllowPolicy(policy) {
+    return policy.defaultDecision === "allow" && policy.allow.length === 0 && policy.deny.length === 0;
+}
+export function evaluateBashCommandPolicy(command, policy) {
+    if (policy === undefined) {
+        return { allowed: true, mode: "segments", targets: [] };
+    }
+    const compiled = compilePolicy(policy);
+    if (!compiled.ok) {
+        return {
+            allowed: false,
+            mode: invalidPolicyMode(policy),
+            targets: [],
+            rejection: {
+                reason: "invalid-policy",
+                message: compiled.message,
+            },
+        };
+    }
+    const activePolicy = compiled.policy;
+    if (isNoRuleDefaultAllowPolicy(activePolicy)) {
+        return { allowed: true, mode: activePolicy.match, targets: [] };
+    }
+    const targetsResult = activePolicy.match === "whole"
+        ? { ok: true, segments: [wholeCommandTarget(command)] }
+        : parseBashCommandSegments(command);
+    if (!targetsResult.ok) {
+        return {
+            allowed: false,
+            mode: activePolicy.match,
+            targets: [],
+            rejection: {
+                reason: "unsupported-shell-syntax",
+                message: targetsResult.error.reason,
+                parseError: targetsResult.error,
+            },
+        };
+    }
+    for (const target of targetsResult.segments) {
+        const denyRule = firstMatchingRule(activePolicy.deny, target.target);
+        if (denyRule !== undefined) {
+            return {
+                allowed: false,
+                mode: activePolicy.match,
+                targets: targetsResult.segments,
+                rejection: {
+                    reason: "matched-deny",
+                    message: `command ${JSON.stringify(target.head)} matched a deny rule`,
+                    target,
+                    matchedRule: denyRule,
+                },
+            };
+        }
+        const allowRule = firstMatchingRule(activePolicy.allow, target.target);
+        if (allowRule !== undefined || activePolicy.defaultDecision === "allow") {
+            continue;
+        }
+        return {
+            allowed: false,
+            mode: activePolicy.match,
+            targets: targetsResult.segments,
+            rejection: {
+                reason: "default-deny",
+                message: `command ${JSON.stringify(target.head)} is not permitted by default-deny bash policy`,
+                target,
+            },
+        };
+    }
+    return { allowed: true, mode: activePolicy.match, targets: targetsResult.segments };
+}
+//# sourceMappingURL=bash-policy-evaluate.js.map

package/dist/core/tools/bash-policy-evaluate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bash-policy-evaluate.js","sourceRoot":"","sources":["../../../src/core/tools/bash-policy-evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAUvF,SAAS,WAAW,CAAC,IAAkB,EAAE,MAAc;IACtD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,OAAO;YACX,OAAO,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC;QAC9B,KAAK,QAAQ;YACZ,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,KAAK,MAAM;YACV,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChC,KAAK,OAAO;YACX,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA8B,EAAE,MAAc;IACxE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;IACnD,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAiC;IACpE,OAAO,MAAM,CAAC,eAAe,KAAK,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,UAAU,yBAAyB,CACxC,OAAe,EACf,MAAqC;IAErC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC;YAC/B,OAAO,EAAE,EAAE;YACX,SAAS,EAAE;gBACV,MAAM,EAAE,gBAAgB;gBACxB,OAAO,EAAE,QAAQ,CAAC,OAAO;aACzB;SACD,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC;IACrC,IAAI,0BAA0B,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,aAAa,GAA2B,YAAY,CAAC,KAAK,KAAK,OAAO;QAC3E,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,EAAE;QACvD,CAAC,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAErC,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QACvB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,YAAY,CAAC,KAAK;YACxB,OAAO,EAAE,EAAE;YACX,SAAS,EAAE;gBACV,MAAM,EAAE,0BAA0B;gBAClC,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,MAAM;gBACnC,UAAU,EAAE,aAAa,CAAC,KAAK;aAC/B;SACD,CAAC;IACH,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,YAAY,CAAC,KAAK;gBACxB,OAAO,EAAE,aAAa,CAAC,QAAQ;gBAC/B,SAAS,EAAE;oBACV,MAAM,EAAE,cAAc;oBACtB,OAAO,EAAE,WAAW,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB;oBACrE,MAAM;oBACN,WAAW,EAAE,QAAQ;iBACrB;aACD,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACvE,IAAI,SAAS,KAAK,SAAS,IAAI,YAAY,CAAC,eAAe,KAAK,OAAO,EAAE,CAAC;YACzE,SAAS;QACV,CAAC;QAED,OAAO;YACN,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,YAAY,CAAC,KAAK;YACxB,OAAO,EAAE,aAAa,CAAC,QAAQ;YAC/B,SAAS,EAAE;gBACV,MAAM,EAAE,cAAc;gBACtB,OAAO,EAAE,WAAW,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C;gBAC9F,MAAM;aACN;SACD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC;AACrF,CAAC","sourcesContent":["import { compilePolicy, invalidPolicyMode } from \"./bash-policy-compile.ts\";\nimport { parseBashCommandSegments, wholeCommandTarget } from \"./bash-policy-parser.ts\";\nimport type {\n\tBashCommandParseResult,\n\tBashCommandPolicy,\n\tBashCommandPolicyDecision,\n\tBashCommandRule,\n\tCompiledBashCommandPolicy,\n\tCompiledRule,\n} from \"./bash-policy-types.ts\";\n\nfunction ruleMatches(rule: CompiledRule, target: string): boolean {\n\tswitch (rule.kind) {\n\t\tcase \"exact\":\n\t\t\treturn target === rule.value;\n\t\tcase \"prefix\":\n\t\t\treturn target.startsWith(rule.value);\n\t\tcase \"glob\":\n\t\t\treturn rule.value.test(target);\n\t\tcase \"regex\":\n\t\t\treturn rule.value.test(target);\n\t}\n}\n\nfunction firstMatchingRule(rules: readonly CompiledRule[], target: string): BashCommandRule | undefined {\n\tfor (const rule of rules) {\n\t\tif (ruleMatches(rule, target)) return rule.source;\n\t}\n\treturn undefined;\n}\n\nfunction isNoRuleDefaultAllowPolicy(policy: CompiledBashCommandPolicy): boolean {\n\treturn policy.defaultDecision === \"allow\" && policy.allow.length === 0 && policy.deny.length === 0;\n}\n\nexport function evaluateBashCommandPolicy(\n\tcommand: string,\n\tpolicy: BashCommandPolicy | undefined,\n): BashCommandPolicyDecision {\n\tif (policy === undefined) {\n\t\treturn { allowed: true, mode: \"segments\", targets: [] };\n\t}\n\n\tconst compiled = compilePolicy(policy);\n\tif (!compiled.ok) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tmode: invalidPolicyMode(policy),\n\t\t\ttargets: [],\n\t\t\trejection: {\n\t\t\t\treason: \"invalid-policy\",\n\t\t\t\tmessage: compiled.message,\n\t\t\t},\n\t\t};\n\t}\n\n\tconst activePolicy = compiled.policy;\n\tif (isNoRuleDefaultAllowPolicy(activePolicy)) {\n\t\treturn { allowed: true, mode: activePolicy.match, targets: [] };\n\t}\n\n\tconst targetsResult: BashCommandParseResult = activePolicy.match === \"whole\"\n\t\t? { ok: true, segments: [wholeCommandTarget(command)] }\n\t\t: parseBashCommandSegments(command);\n\n\tif (!targetsResult.ok) {\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tmode: activePolicy.match,\n\t\t\ttargets: [],\n\t\t\trejection: {\n\t\t\t\treason: \"unsupported-shell-syntax\",\n\t\t\t\tmessage: targetsResult.error.reason,\n\t\t\t\tparseError: targetsResult.error,\n\t\t\t},\n\t\t};\n\t}\n\n\tfor (const target of targetsResult.segments) {\n\t\tconst denyRule = firstMatchingRule(activePolicy.deny, target.target);\n\t\tif (denyRule !== undefined) {\n\t\t\treturn {\n\t\t\t\tallowed: false,\n\t\t\t\tmode: activePolicy.match,\n\t\t\t\ttargets: targetsResult.segments,\n\t\t\t\trejection: {\n\t\t\t\t\treason: \"matched-deny\",\n\t\t\t\t\tmessage: `command ${JSON.stringify(target.head)} matched a deny rule`,\n\t\t\t\t\ttarget,\n\t\t\t\t\tmatchedRule: denyRule,\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\tconst allowRule = firstMatchingRule(activePolicy.allow, target.target);\n\t\tif (allowRule !== undefined || activePolicy.defaultDecision === \"allow\") {\n\t\t\tcontinue;\n\t\t}\n\n\t\treturn {\n\t\t\tallowed: false,\n\t\t\tmode: activePolicy.match,\n\t\t\ttargets: targetsResult.segments,\n\t\t\trejection: {\n\t\t\t\treason: \"default-deny\",\n\t\t\t\tmessage: `command ${JSON.stringify(target.head)} is not permitted by default-deny bash policy`,\n\t\t\t\ttarget,\n\t\t\t},\n\t\t};\n\t}\n\n\treturn { allowed: true, mode: activePolicy.match, targets: targetsResult.segments };\n}\n"]}

package/dist/core/tools/bash-policy-format.d.ts

@@ -0,0 +1,5 @@
+import type { BashCommandPolicyDecision } from "./bash-policy-types.ts";
+export declare function formatBashCommandPolicyRejection(decision: Extract<BashCommandPolicyDecision, {
+    readonly allowed: false;
+}>, policyLabel?: string): string;
+//# sourceMappingURL=bash-policy-format.d.ts.map

package/dist/core/tools/bash-policy-format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bash-policy-format.d.ts","sourceRoot":"","sources":["../../../src/core/tools/bash-policy-format.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAmB,MAAM,wBAAwB,CAAC;AAkBzF,wBAAgB,gCAAgC,CAC/C,QAAQ,EAAE,OAAO,CAAC,yBAAyB,EAAE;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAA;CAAE,CAAC,EACzE,WAAW,SAAwB,GACjC,MAAM,CAsCR","sourcesContent":["import type { BashCommandPolicyDecision, BashCommandRule } from \"./bash-policy-types.ts\";\n\nconst DIAGNOSTIC_TEXT_LIMIT = 220;\n\nfunction truncateDiagnostic(text: string): string {\n\tif (text.length <= DIAGNOSTIC_TEXT_LIMIT) return text;\n\treturn `${text.slice(0, DIAGNOSTIC_TEXT_LIMIT - 1)}…`;\n}\n\nfunction formatRule(rule: BashCommandRule): string {\n\tif (typeof rule === \"string\") return JSON.stringify(rule);\n\tif (\"prefix\" in rule) return `{ prefix: ${JSON.stringify(rule.prefix)} }`;\n\tif (\"glob\" in rule) return `{ glob: ${JSON.stringify(rule.glob)} }`;\n\treturn rule.flags === undefined\n\t\t? `{ regex: ${JSON.stringify(rule.regex)} }`\n\t\t: `{ regex: ${JSON.stringify(rule.regex)}, flags: ${JSON.stringify(rule.flags)} }`;\n}\n\nexport function formatBashCommandPolicyRejection(\n\tdecision: Extract<BashCommandPolicyDecision, { readonly allowed: false }>,\n\tpolicyLabel = \"bash command policy\",\n): string {\n\tconst lines = [`Bash command blocked by ${policyLabel}.`, \"\"];\n\tconst rejection = decision.rejection;\n\n\tif (rejection.reason === \"unsupported-shell-syntax\") {\n\t\tlines.push(\n\t\t\t\"The command uses shell syntax that Atomic cannot safely parse in `segments` mode.\",\n\t\t\t`Reason: ${rejection.message}.`,\n\t\t);\n\t\tif (rejection.parseError) {\n\t\t\tlines.push(`Parser source: ${rejection.parseError.source} at offset ${rejection.parseError.offset}.`);\n\t\t}\n\t\tlines.push(\n\t\t\t\"Use match: \\\"whole\\\" only if the caller intentionally accepts raw-command matching semantics.\",\n\t\t);\n\t} else if (rejection.reason === \"invalid-policy\") {\n\t\tlines.push(\"The configured bash command policy is invalid.\", `Reason: ${rejection.message}.`);\n\t} else {\n\t\tconst target = rejection.target;\n\t\tif (target) {\n\t\t\tlines.push(\n\t\t\t\t`Command head: \\`${truncateDiagnostic(target.head)}\\``,\n\t\t\t\t`Rejected ${decision.mode === \"whole\" ? \"command\" : \"segment\"}: \\`${truncateDiagnostic(target.target)}\\``,\n\t\t\t\t`Segment source: ${target.source}`,\n\t\t\t);\n\t\t}\n\t\tif (rejection.reason === \"matched-deny\") {\n\t\t\tlines.push(\"Reason: matched a deny rule; deny rules take precedence over allow rules.\");\n\t\t\tif (rejection.matchedRule !== undefined) {\n\t\t\t\tlines.push(`Matched deny rule: ${formatRule(rejection.matchedRule)}`);\n\t\t\t}\n\t\t} else {\n\t\t\tlines.push(\"Reason: no allow rule matched and the policy default is deny.\");\n\t\t}\n\t}\n\n\tlines.push(`Policy mode: ${decision.mode}.`, \"\", \"No shell process was started.\");\n\treturn lines.join(\"\\n\");\n}\n"]}