@bubblebrain-ai/bubble 0.0.20 → 0.0.22

package/dist/tools/child-tools.js

@@ -0,0 +1,106 @@
+/**
+ * Per-child tool factory for write_worktree subagents (design doc §8).
+ *
+ * Parent tools close over the parent cwd at creation, so a write child needs
+ * fresh instances bound to its worktree — with their own FileStateTracker —
+ * plus a worktree-scoped approval policy: file operations are runtime-checked
+ * to stay under the worktree root (the tools' own workspace fence does this
+ * structurally), bash auto-approves inside the worktree when the command
+ * passes a deny-list of escaping operations, and everything else fails fast.
+ */
+import { isAbsolute, resolve, sep } from "node:path";
+import { createBashTool } from "./bash.js";
+import { createEditTool } from "./edit.js";
+import { createGlobTool } from "./glob.js";
+import { createGrepTool } from "./grep.js";
+import { createReadTool } from "./read.js";
+import { createWriteTool } from "./write.js";
+import { FileStateTracker } from "./file-state.js";
+/** Operations a worktree child may never run, regardless of cwd. */
+const WORKTREE_BASH_DENY_PATTERNS = [
+    { pattern: /\bgit\s+push\b/, reason: "pushing from a subagent worktree is not allowed; the parent reviews and applies changes." },
+    { pattern: /\bgit\s+remote\b/, reason: "remote configuration is not allowed inside a subagent worktree." },
+    { pattern: /\bgit\s+worktree\b/, reason: "managing worktrees from inside a subagent worktree is not allowed." },
+    { pattern: /\bsudo\b/, reason: "privileged commands are not allowed inside a subagent worktree." },
+];
+export function isPathInsideWorktree(worktreeRoot, candidate) {
+    const resolved = isAbsolute(candidate) ? resolve(candidate) : resolve(worktreeRoot, candidate);
+    const root = resolve(worktreeRoot);
+    return resolved === root || resolved.startsWith(root + sep);
+}
+/**
+ * Approval policy for a worktree child: containment is enforced by code
+ * (path checks, deny-list), never by prompt text. There is no interactive
+ * fallback — anything outside the policy fails fast (design §11).
+ */
+export class WorktreeApprovalController {
+    worktreeRoot;
+    constructor(worktreeRoot) {
+        this.worktreeRoot = worktreeRoot;
+    }
+    async request(req) {
+        switch (req.type) {
+            case "bash": {
+                for (const { pattern, reason } of WORKTREE_BASH_DENY_PATTERNS) {
+                    if (pattern.test(req.command)) {
+                        return { action: "reject", feedback: `Blocked by worktree policy: ${reason}` };
+                    }
+                }
+                if (!isPathInsideWorktree(this.worktreeRoot, req.cwd)) {
+                    return { action: "reject", feedback: "Blocked by worktree policy: commands must run inside the subagent worktree." };
+                }
+                // Absolute paths reaching outside the worktree are an escape attempt.
+                const absolutePaths = req.command.match(/(?<=^|[\s"'=])\/[^\s"';|&]+/g) ?? [];
+                for (const path of absolutePaths) {
+                    if (path.startsWith("/dev/") || path.startsWith("/tmp/") || path.startsWith("/usr/") || path.startsWith("/bin/") || path.startsWith("/opt/") || path.startsWith("/etc/"))
+                        continue;
+                    if (!isPathInsideWorktree(this.worktreeRoot, path)) {
+                        return {
+                            action: "reject",
+                            feedback: `Blocked by worktree policy: the command references a path outside the worktree (${path}).`,
+                        };
+                    }
+                }
+                return { action: "approve" };
+            }
+            case "edit":
+            case "write":
+                return isPathInsideWorktree(this.worktreeRoot, req.path)
+                    ? { action: "approve" }
+                    : { action: "reject", feedback: `Blocked by worktree policy: ${req.path} is outside the subagent worktree.` };
+            case "patch":
+                return req.paths.every((path) => isPathInsideWorktree(this.worktreeRoot, path))
+                    ? { action: "approve" }
+                    : { action: "reject", feedback: "Blocked by worktree policy: the patch touches paths outside the subagent worktree." };
+            case "lsp":
+                return { action: "approve" };
+            case "agent_profile":
+                return { action: "reject", feedback: "Subagents cannot approve agent profiles." };
+        }
+    }
+    checkRules() {
+        return { decision: "ask" };
+    }
+}
+const WORKTREE_TOOL_NAMES = new Set(["read", "glob", "grep", "edit", "write", "bash"]);
+/**
+ * Builds the write child's toolset bound to its worktree: fresh instances
+ * with their own FileStateTracker and the worktree approval policy. A
+ * profile's tools list can narrow the set but never widen it.
+ */
+export function createWorktreeChildTools(worktreeCwd, include) {
+    const approval = new WorktreeApprovalController(worktreeCwd);
+    const fileState = new FileStateTracker(worktreeCwd);
+    const tools = [
+        createReadTool(worktreeCwd, approval, undefined, fileState),
+        createGlobTool(worktreeCwd),
+        createGrepTool(worktreeCwd),
+        createEditTool(worktreeCwd, approval, undefined, fileState),
+        createWriteTool(worktreeCwd, {}, approval, undefined, fileState),
+        createBashTool(worktreeCwd, approval, fileState),
+    ];
+    if (!include || include.length === 0)
+        return tools;
+    const requested = new Set(include.filter((name) => WORKTREE_TOOL_NAMES.has(name)));
+    return requested.size > 0 ? tools.filter((tool) => requested.has(tool.name)) : tools;
+}

package/dist/tools/edit.d.ts

@@ -4,6 +4,7 @@
  * This is the safest way to edit files: old_string must exist exactly once.
  */
 import type { ApprovalController } from "../approval/types.js";
+import type { CheckpointStore } from "../checkpoints.js";
 import type { ToolRegistryEntry } from "../types.js";
 import { type LspService } from "../lsp/index.js";
 import { type FileStateTracker } from "./file-state.js";
@@ -14,4 +15,4 @@ export interface EditArgs {
         newText: string;
     }>;
 }
-export declare function createEditTool(cwd: string, approval?: ApprovalController, lsp?: LspService, fileState?: FileStateTracker): ToolRegistryEntry;
+export declare function createEditTool(cwd: string, approval?: ApprovalController, lsp?: LspService, fileState?: FileStateTracker, checkpoints?: () => CheckpointStore | undefined): ToolRegistryEntry;

package/dist/tools/edit.js

@@ -60,7 +60,7 @@ function firstString(...values) {
     }
     return undefined;
 }
-export function createEditTool(cwd, approval, lsp, fileState) {
+export function createEditTool(cwd, approval, lsp, fileState, checkpoints) {
     return {
         name: "edit",
         effect: "write_direct",
@@ -178,6 +178,7 @@ export function createEditTool(cwd, approval, lsp, fileState) {
                         },
                     };
                 }
+                await checkpoints?.()?.captureBefore(filePath, original);
                 await writeFile(filePath, applied.content, "utf-8");
                 await fileState?.observe(filePath, "edit", applied.content).catch(() => undefined);
                 let output = `Edited ${filePath}${formatEditMatchNotes(applied.matches)}\n\nDiff:\n${diff}`;

package/dist/tools/index.d.ts

@@ -28,6 +28,7 @@ import { type LspService } from "../lsp/index.js";
 import { type TodoStore } from "./todo.js";
 import { type ToolSearchController } from "./tool-search.js";
 import type { QuestionController } from "../question/index.js";
+import type { CheckpointStore } from "../checkpoints.js";
 import { FileStateTracker } from "./file-state.js";
 export interface CreateAllToolsOptions {
     todoStore?: TodoStore;
@@ -37,5 +38,11 @@ export interface CreateAllToolsOptions {
     toolSearchController?: ToolSearchController;
     lspService?: LspService;
     fileStateTracker?: FileStateTracker;
+    /**
+     * Lazy accessor for the session's checkpoint store (the session manager may
+     * not exist yet when tools are created). Used by edit/write to snapshot
+     * files before mutating them so /rewind can restore.
+     */
+    checkpoints?: () => CheckpointStore | undefined;
 }
 export declare function createAllTools(cwd: string, skillRegistry?: SkillRegistry, options?: CreateAllToolsOptions): ToolRegistryEntry[];

package/dist/tools/index.js

@@ -48,8 +48,8 @@ export function createAllTools(cwd, skillRegistry, options = {}) {
         createReadTool(cwd, approval, lsp, fileState),
         createBashTool(cwd, approval, fileState),
         ...createManagedServerTools(cwd, approval),
-        createWriteTool(cwd, {}, approval, lsp, fileState),
-        createEditTool(cwd, approval, lsp, fileState),
+        createWriteTool(cwd, {}, approval, lsp, fileState, options.checkpoints),
+        createEditTool(cwd, approval, lsp, fileState, options.checkpoints),
         createGlobTool(cwd),
         createGrepTool(cwd),
         createLspTool(cwd, lsp, approval),
@@ -57,7 +57,7 @@ export function createAllTools(cwd, skillRegistry, options = {}) {
         createWebFetchTool(approval),
         createMemorySearchTool(cwd),
         createMemoryReadSummaryTool(cwd),
-        ...createAgentLifecycleTools(),
+        ...createAgentLifecycleTools({ cwd, approval }),
         ...(options.questionController ? [createQuestionTool(options.questionController)] : []),
         ...(skillRegistry ? [createSkillSearchTool(skillRegistry), createSkillTool(skillRegistry)] : []),
         ...(options.todoStore ? [createTodoTool(options.todoStore)] : []),

package/dist/tools/write.d.ts

@@ -2,8 +2,9 @@
  * Write tool - create files or replace full file contents.
  */
 import type { ApprovalController } from "../approval/types.js";
+import type { CheckpointStore } from "../checkpoints.js";
 import type { ToolRegistryEntry } from "../types.js";
 import { type LspService } from "../lsp/index.js";
 import { type FileStateTracker } from "./file-state.js";
 export type WriteToolOptions = Record<string, never>;
-export declare function createWriteTool(cwd: string, _options?: WriteToolOptions, approval?: ApprovalController, lsp?: LspService, fileState?: FileStateTracker): ToolRegistryEntry;
+export declare function createWriteTool(cwd: string, _options?: WriteToolOptions, approval?: ApprovalController, lsp?: LspService, fileState?: FileStateTracker, checkpoints?: () => CheckpointStore | undefined): ToolRegistryEntry;

package/dist/tools/write.js

@@ -18,7 +18,7 @@ function prepareWriteArguments(input) {
     }
     return args;
 }
-export function createWriteTool(cwd, _options = {}, approval, lsp, fileState) {
+export function createWriteTool(cwd, _options = {}, approval, lsp, fileState, checkpoints) {
     return {
         name: "write",
         effect: "write_direct",
@@ -76,6 +76,7 @@ export function createWriteTool(cwd, _options = {}, approval, lsp, fileState) {
                     return changedDuringApprovalResult(filePath, changed);
                 }
                 try {
+                    await checkpoints?.()?.captureBefore(filePath, existed ? oldContent : null);
                     await mkdir(dirname(filePath), { recursive: true });
                     await writeFile(filePath, args.content, "utf-8");
                     await fileState?.observe(filePath, "write", args.content).catch(() => undefined);

package/dist/tui/image-paste.d.ts

@@ -44,6 +44,12 @@ export declare function isImageFilePath(raw: string): boolean;
 export declare function extractImagePathTokens(input: string): ImagePathToken[];
 export declare function removeImagePathTokens(input: string, tokens: ImagePathToken[]): string;
 export declare function imageAttachmentLabel(att: ImageAttachment, index: number): string;
+/**
+ * Label for an image path before ingestion runs. Matches what
+ * imageAttachmentLabel produces for the same file, so a label inserted at
+ * paste time stays a valid key once the attachment is registered.
+ */
+export declare function imageLabelForPath(rawPath: string, index: number): string;
 export declare function imageAttachmentReference(att: ImageAttachment, index: number): string;
 export declare function imageAttachmentLabelPattern(): RegExp;
 export declare function buildImageContentParts(promptText: string, attachments: ImageAttachment[]): ContentPart[];
@@ -61,6 +67,18 @@ export declare function buildImageContentPartsFromLabels(input: string, attachme
  * only on a space that is followed by the start of a new absolute path.
  */
 export declare function splitPastedPaths(pasted: string): string[];
+/**
+ * True when a pasted blob consists solely of image file paths (drag from
+ * Finder, or a terminal that converts clipboard images to temp-file paths).
+ */
+export declare function isImagePathPaste(pasted: string): boolean;
+/**
+ * Bare image filename with no directory, e.g. "Screenshot ... AM.png".
+ * Copying an image file in Finder puts only the file's NAME in the
+ * clipboard's plain-text flavor — the actual bits arrive as a file-url or
+ * image flavor that must be read from the clipboard separately.
+ */
+export declare function bareImageFilenameFromPaste(pasted: string): string | null;
 export declare function readImageFromPath(rawPath: string): Promise<ImageAttachment | null>;
 /** macOS screenshot shortcut writes to these paths and they may be auto-cleaned. */
 export declare function isScreenshotTempPath(s: string): boolean;

package/dist/tui/image-paste.js

@@ -65,6 +65,15 @@ export function removeImagePathTokens(input, tokens) {
 export function imageAttachmentLabel(att, index) {
     return `image#${index}${imageExtension(att)}`;
 }
+/**
+ * Label for an image path before ingestion runs. Matches what
+ * imageAttachmentLabel produces for the same file, so a label inserted at
+ * paste time stays a valid key once the attachment is registered.
+ */
+export function imageLabelForPath(rawPath, index) {
+    const ext = path.extname(unescapeShell(rawPath.trim())).toLowerCase() || ".png";
+    return `image#${index}${ext}`;
+}
 export function imageAttachmentReference(att, index) {
     return `[${imageAttachmentLabel(att, index)}]`;
 }
@@ -155,6 +164,30 @@ export function splitPastedPaths(pasted) {
     }
     return out;
 }
+/**
+ * True when a pasted blob consists solely of image file paths (drag from
+ * Finder, or a terminal that converts clipboard images to temp-file paths).
+ */
+export function isImagePathPaste(pasted) {
+    const pieces = splitPastedPaths(pasted);
+    return pieces.length > 0 && pieces.every((piece) => isImageFilePath(piece));
+}
+/**
+ * Bare image filename with no directory, e.g. "Screenshot ... AM.png".
+ * Copying an image file in Finder puts only the file's NAME in the
+ * clipboard's plain-text flavor — the actual bits arrive as a file-url or
+ * image flavor that must be read from the clipboard separately.
+ */
+export function bareImageFilenameFromPaste(pasted) {
+    const s = pasted.trim();
+    if (!s || s.length > 255)
+        return null;
+    if (/[\n\r/\\]/.test(s))
+        return null;
+    if (!IMAGE_EXT.test(s))
+        return null;
+    return s;
+}
 function mediaTypeFromExt(p) {
     const ext = path.extname(p).toLowerCase();
     if (ext === ".jpg" || ext === ".jpeg")
@@ -384,6 +417,14 @@ export async function ingestImagePath(p) {
     return { attachment: sized };
 }
 export async function ingestClipboardImage() {
+    // A file reference wins over bitmap flavors: for a copied FILE, coercing
+    // the clipboard to PNGf yields the file's generic ICON, not the image.
+    const filePath = await getClipboardFilePath();
+    if (filePath) {
+        if (isImageFilePath(filePath))
+            return ingestImagePath(filePath);
+        return { error: `clipboard file is not an image: ${filePath}` };
+    }
     const raw = await getImageFromClipboard();
     if (!raw)
         return { error: "clipboard has no image" };
@@ -393,6 +434,25 @@ export async function ingestClipboardImage() {
         return { error: validation.reason };
     return { attachment: sized };
 }
+async function getClipboardFilePath() {
+    if (process.platform !== "darwin")
+        return null;
+    try {
+        // Probe first — AppleScript happily coerces plain TEXT into a file URL,
+        // so only trust «class furl» when the clipboard really carries one.
+        const probe = await execFileAsync("osascript", ["-e", "clipboard info for «class furl»"], {
+            timeout: 5000,
+        });
+        if (!String(probe.stdout).includes("furl"))
+            return null;
+        const result = await execFileAsync("osascript", ["-e", "POSIX path of (the clipboard as «class furl»)"], { timeout: 5000 });
+        const p = String(result.stdout).trim();
+        return p || null;
+    }
+    catch {
+        return null;
+    }
+}
 export async function resolveImageInput(input, options = {}) {
     const tokens = extractImagePathTokens(input);
     if (tokens.length === 0) {

package/dist/tui/run.d.ts

@@ -2,7 +2,7 @@ import { type Agent } from "../agent.js";
 import type { CliArgs } from "../cli.js";
 import type { ThemeMode } from "../config.js";
 import type { ExternalHookController } from "../hooks/controller.js";
-import type { SessionManager } from "../session.js";
+import { SessionManager } from "../session.js";
 import type { PlanDecision, Provider } from "../types.js";
 import type { ProviderRegistry } from "../provider-registry.js";
 import type { SkillRegistry } from "../skills/registry.js";
@@ -45,5 +45,15 @@ export interface RunTuiOptions {
     runMemoryRefresh?: (scope?: MemoryScope) => Promise<string>;
     /** One-line "update available" notice shown on the home screen, if any. */
     updateNotice?: string;
+    /**
+     * Swap the active session in place (driven by the /session picker).
+     * Rebinds persistence to the picked session file and replaces the agent's
+     * message history; the TUI rebuilds its transcript from the result.
+     */
+    switchSession?: (sessionFile: string) => {
+        manager: SessionManager;
+    } | {
+        error: string;
+    };
 }
 export declare function runTui(agent: Agent, args: CliArgs, options?: RunTuiOptions): Promise<void>;