@bubblebrain-ai/bubble 0.0.58 → 0.0.60

package/dist/permissions/rule.js

@@ -1,6 +1,7 @@
 import { homedir } from "node:os";
 import { isAbsolute, resolve } from "node:path";
 import picomatch from "picomatch";
+import { analyzeShellCommand, effectiveCommandTokens, shellTokens } from "./shell-command.js";
 const KNOWN_TOOLS = new Set([
     "Bash",
     "Read",
@@ -80,11 +81,14 @@ export function parseRules(inputs) {
 /**
  * Does `rule` match `query`?
  *
- * Tool name must match (or rule.tool is "*"). If the rule has no pattern, it
- * matches any use of that tool. Otherwise the tool-specific matcher decides.
+ * Tool name must match (or rule.tool is "*"; `mcp__server` covers every
+ * `mcp__server__tool`). If the rule has no pattern, it matches any use of that
+ * tool. Otherwise the tool-specific matcher decides. `list` matters for Bash:
+ * an allow rule must cover every command a compound command runs, while a
+ * deny rule fires if it covers any of them.
  */
-export function matchRule(rule, query) {
-    if (rule.tool !== "*" && rule.tool !== query.tool) {
+export function matchRule(rule, query, list = "allow") {
+    if (rule.tool !== "*" && rule.tool !== query.tool && !isMcpServerRule(rule, query)) {
         return false;
     }
     if (rule.pattern === undefined) {
@@ -95,7 +99,9 @@ export function matchRule(rule, query) {
         case "Bash":
             if (!("command" in query) || typeof query.command !== "string")
                 return false;
-            return matchBash(rule.pattern, query.command);
+            return list === "deny"
+                ? bashDenyMatches(rule.pattern, query.command)
+                : bashAllowMatches(rule.pattern, query.command);
         case "Read":
         case "Write":
         case "Edit":
@@ -121,30 +127,83 @@ export function matchRule(rule, query) {
  */
 export function checkPermission(rules, query) {
     for (const rule of rules.deny) {
-        if (matchRule(rule, query)) {
+        if (matchRule(rule, query, "deny")) {
             return { decision: "deny", rule };
         }
     }
+    if (query.tool === "Bash" && "command" in query && typeof query.command === "string") {
+        return checkBashAllow(rules.allow, query.command);
+    }
     for (const rule of rules.allow) {
-        if (matchRule(rule, query)) {
+        if (matchRule(rule, query, "allow")) {
             return { decision: "allow", rule };
         }
     }
     return { decision: "ask" };
 }
+/**
+ * A compound command is allowed when every simple command in it is covered
+ * by some allow rule (different rules may cover different parts), and it has
+ * nothing opaque — unless a rule grants any command (`Bash`, `*`, `Bash(:*)`).
+ */
+function checkBashAllow(allowRules, command) {
+    const bashRules = allowRules.filter((rule) => rule.tool === "Bash" || rule.tool === "*");
+    const anyCommand = bashRules.find((rule) => rule.pattern === undefined || tokenize(rule.pattern).join(" ") === ":*");
+    if (anyCommand)
+        return { decision: "allow", rule: anyCommand };
+    const analysis = analyzeShellCommand(command);
+    if (analysis.opaque || analysis.segments.length === 0)
+        return { decision: "ask" };
+    let first;
+    for (const segment of analysis.segments) {
+        const tokens = shellTokens(segment);
+        const rule = bashRules.find((candidate) => matchBash(candidate.pattern, tokens));
+        if (!rule)
+            return { decision: "ask" };
+        first ??= rule;
+    }
+    return first ? { decision: "allow", rule: first } : { decision: "ask" };
+}
 // --- per-tool matchers ---------------------------------------------------
+/** `mcp__github` (no pattern) covers every tool of that MCP server. */
+function isMcpServerRule(rule, query) {
+    return rule.pattern === undefined
+        && rule.tool.startsWith("mcp__")
+        && query.tool.startsWith(`${rule.tool}__`);
+}
+/**
+ * Allow: every simple command the line runs must match, and nothing opaque
+ * (substitution, file redirection, heredoc) may ride along.
+ */
+function bashAllowMatches(pattern, command) {
+    // `Bash(:*)` is an explicit "any command" grant.
+    if (tokenize(pattern).join(" ") === ":*")
+        return true;
+    const analysis = analyzeShellCommand(command);
+    if (analysis.opaque || analysis.segments.length === 0)
+        return false;
+    return analysis.segments.every((segment) => matchBash(pattern, shellTokens(segment)));
+}
+/**
+ * Deny: any simple command matching — as written, or with leading
+ * assignments/wrappers (`sudo`, `env`, ...) stripped — blocks the line.
+ */
+function bashDenyMatches(pattern, command) {
+    const analysis = analyzeShellCommand(command);
+    if (analysis.segments.length === 0)
+        return matchBash(pattern, shellTokens(command));
+    return analysis.segments.some((segment) => matchBash(pattern, shellTokens(segment)) || matchBash(pattern, effectiveCommandTokens(segment)));
+}
 /**
  * Bash pattern matching.
  *
  * - `git status`     → command tokens equal ["git","status"] exactly
  * - `git status:*`   → command tokens start with ["git","status"]
  *
- * Tokenization splits on whitespace. Shell control tokens (`&&`, `|`, `;`) are
- * treated as plain tokens; a rule that includes them would have to match them
- * literally. v1 does not try to parse shell grammar.
+ * Matches one simple command's tokens; bashAllowMatches / bashDenyMatches
+ * split compound commands first (see shell-command.ts).
  */
-function matchBash(pattern, command) {
-    const cmdTokens = tokenize(command);
+function matchBash(pattern, cmdTokens) {
     let ruleTokens = tokenize(pattern);
     let prefixMatch = false;
     if (ruleTokens.length > 0) {

package/dist/permissions/settings.d.ts

@@ -11,12 +11,19 @@
  * `allow` / `deny` arrays are concatenated across scopes (with the rule text
  * itself carrying provenance via `PermissionRule.source`).
  *
+ * Allow rules and LSP server definitions from the project and local scopes
+ * live inside the repository, so they only take effect once the user trusts
+ * this folder (asked at startup, see trust.ts); until then they are reported in
+ * `untrusted` (MCP servers from those files are gated the same way by
+ * loadMcpConfig).
+ *
  * Parse errors do not fail the load; they collect into `diagnostics` so callers
  * can surface them in /permissions or on startup without taking the agent down.
  */
 import type { PermissionMode } from "../types.js";
 import { type LspConfig } from "../lsp/config.js";
-import type { PermissionRuleSet } from "./types.js";
+import { type RepoCapabilities } from "./trust.js";
+import type { PermissionRule, PermissionRuleSet } from "./types.js";
 export type SettingsScope = "user" | "project" | "local";
 export type RuleList = "allow" | "deny";
 export interface RawSettings {
@@ -36,6 +43,10 @@ export interface MergedSettings {
     defaultMode?: PermissionMode;
     lsp?: LspConfig;
     ruleSet: PermissionRuleSet;
+    /** Project/local allow rules ignored until the user trusts them. */
+    untrustedAllow: PermissionRule[];
+    /** Everything in the repository settings that waits for trust (allow rules, MCP servers, LSP servers). */
+    untrusted: RepoCapabilities;
     diagnostics: SettingsDiagnostic[];
 }
 export interface SettingsManagerOptions {
@@ -46,9 +57,25 @@ export declare class SettingsManager {
     private readonly paths;
     private raw;
     private fileDiagnostics;
+    private readonly cwd;
+    private readonly bubbleHome?;
+    /** Cached per load: whether the repository's capability settings are trusted. */
+    private repoTrusted;
     constructor(cwd: string, options?: SettingsManagerOptions);
     /** Re-read all three files from disk. */
     reload(): void;
+    /**
+     * Trust the repository's current capability settings (allow rules, MCP
+     * servers, LSP servers from the project and local files).
+     */
+    trustRepoConfig(): void;
+    private repoRaw;
+    /**
+     * Bubble's own /permissions edits keep an existing trust: rules the user
+     * adds through Bubble are their decision. An untrusted rule set stays
+     * untrusted — editing it must not launder rules the user never reviewed.
+     */
+    private keepRepoTrustAfterWrite;
     getPath(scope: SettingsScope): string;
     /** Merged view for runtime consumption. Does not hit disk — call `reload()` first if stale. */
     getMerged(): MergedSettings;

package/dist/permissions/settings.js

@@ -11,6 +11,12 @@
  * `allow` / `deny` arrays are concatenated across scopes (with the rule text
  * itself carrying provenance via `PermissionRule.source`).
  *
+ * Allow rules and LSP server definitions from the project and local scopes
+ * live inside the repository, so they only take effect once the user trusts
+ * this folder (asked at startup, see trust.ts); until then they are reported in
+ * `untrusted` (MCP servers from those files are gated the same way by
+ * loadMcpConfig).
+ *
  * Parse errors do not fail the load; they collect into `diagnostics` so callers
  * can surface them in /permissions or on startup without taking the agent down.
  */
@@ -19,6 +25,7 @@ import { dirname, join } from "node:path";
 import { getBubbleHome } from "../bubble-home.js";
 import { normalizeLspConfig } from "../lsp/config.js";
 import { parseRules } from "./rule.js";
+import { isRepoConfigTrusted, repoCapabilities, trustRepoConfig } from "./trust.js";
 const KNOWN_MODES = new Set([
     "default",
     "plan",
@@ -32,8 +39,14 @@ export class SettingsManager {
         local: null,
     };
     fileDiagnostics = [];
+    cwd;
+    bubbleHome;
+    /** Cached per load: whether the repository's capability settings are trusted. */
+    repoTrusted = false;
     constructor(cwd, options = {}) {
         const bubbleHome = options.bubbleHome ?? getBubbleHome();
+        this.cwd = cwd;
+        this.bubbleHome = bubbleHome;
         this.paths = {
             user: join(bubbleHome, "settings.json"),
             project: join(cwd, ".bubble", "settings.json"),
@@ -47,6 +60,31 @@ export class SettingsManager {
         for (const scope of ["user", "project", "local"]) {
             this.raw[scope] = this.readFile(scope);
         }
+        this.repoTrusted = isRepoConfigTrusted(this.cwd, this.repoRaw(), { bubbleHome: this.bubbleHome });
+    }
+    /**
+     * Trust the repository's current capability settings (allow rules, MCP
+     * servers, LSP servers from the project and local files).
+     */
+    trustRepoConfig() {
+        trustRepoConfig(this.cwd, this.repoRaw(), { bubbleHome: this.bubbleHome });
+        this.repoTrusted = true;
+    }
+    repoRaw() {
+        return { project: this.raw.project, local: this.raw.local };
+    }
+    /**
+     * Bubble's own /permissions edits keep an existing trust: rules the user
+     * adds through Bubble are their decision. An untrusted rule set stays
+     * untrusted — editing it must not launder rules the user never reviewed.
+     */
+    keepRepoTrustAfterWrite(scope, wasTrusted) {
+        if (scope === "user")
+            return;
+        if (wasTrusted)
+            this.trustRepoConfig();
+        else
+            this.repoTrusted = isRepoConfigTrusted(this.cwd, this.repoRaw(), { bubbleHome: this.bubbleHome });
     }
     getPath(scope) {
         return this.paths[scope];
@@ -58,12 +96,21 @@ export class SettingsManager {
         let lsp;
         const allow = [];
         const deny = [];
+        const untrustedAllow = [];
         for (const scope of ["user", "project", "local"]) {
             const data = this.raw[scope];
             if (!data)
                 continue;
             if ("lsp" in data) {
-                const parsed = normalizeLspConfig(data.lsp);
+                const trustedLsp = scope === "user" || this.repoTrusted;
+                const parsed = trustedLsp ? normalizeLspConfig(data.lsp) : untrustedLspSwitches(data.lsp);
+                if (!trustedLsp && repoCapabilities(data).lspServers.length > 0) {
+                    diagnostics.push({
+                        scope,
+                        path: this.paths[scope],
+                        message: `Ignored LSP server definitions from this repository (${repoCapabilities(data).lspServers.join(", ")}): the folder is not trusted (Bubble asks at startup).`,
+                    });
+                }
                 if (parsed === undefined) {
                     diagnostics.push({
                         scope,
@@ -71,7 +118,7 @@ export class SettingsManager {
                         message: "Ignored lsp setting — expected boolean or object.",
                     });
                 }
-                else {
+                else if (parsed !== null) {
                     lsp = parsed;
                 }
             }
@@ -93,7 +140,19 @@ export class SettingsManager {
             }
             if (Array.isArray(perms.allow)) {
                 const parsed = parseRules(perms.allow);
-                allow.push(...parsed.rules);
+                if (scope === "user" || this.repoTrusted) {
+                    allow.push(...parsed.rules);
+                }
+                else {
+                    untrustedAllow.push(...parsed.rules);
+                    if (parsed.rules.length > 0) {
+                        diagnostics.push({
+                            scope,
+                            path: this.paths[scope],
+                            message: `Ignored ${parsed.rules.length} allow rule${parsed.rules.length === 1 ? "" : "s"} from this repository: the folder is not trusted (Bubble asks at startup).`,
+                        });
+                    }
+                }
                 for (const err of parsed.errors) {
                     diagnostics.push({
                         scope,
@@ -118,6 +177,10 @@ export class SettingsManager {
             defaultMode,
             lsp,
             ruleSet: { allow, deny },
+            untrustedAllow,
+            untrusted: this.repoTrusted
+                ? { allow: [], mcpServers: [], lspServers: [] }
+                : mergeCapabilities(repoCapabilities(this.raw.project), repoCapabilities(this.raw.local)),
             diagnostics,
         };
     }
@@ -137,9 +200,11 @@ export class SettingsManager {
         }
         current.push(rule);
         permissions[list] = current;
+        const wasTrusted = this.repoTrusted;
         const next = { ...raw, permissions };
         this.writeFile(scope, next);
         this.raw[scope] = next;
+        this.keepRepoTrustAfterWrite(scope, wasTrusted);
         return true;
     }
     /**
@@ -159,9 +224,11 @@ export class SettingsManager {
         // Drop the key if empty, keep file readable
         if (current.length === 0)
             delete nextPermissions[list];
+        const wasTrusted = this.repoTrusted;
         const next = { ...raw, permissions: nextPermissions };
         this.writeFile(scope, next);
         this.raw[scope] = next;
+        this.keepRepoTrustAfterWrite(scope, wasTrusted);
         return true;
     }
     // -- internal --------------------------------------------------------
@@ -197,3 +264,26 @@ export class SettingsManager {
         writeFileSync(path, JSON.stringify(data, null, 2) + "\n", "utf-8");
     }
 }
+/**
+ * What an untrusted repository may still say about LSP: turning it off, or
+ * turning individual servers off. Commands, env and options need trust.
+ * Returns null when nothing usable is left (the scope then does not override).
+ */
+function untrustedLspSwitches(value) {
+    if (typeof value === "boolean")
+        return value === false ? false : null;
+    const parsed = normalizeLspConfig(value);
+    if (parsed === undefined || typeof parsed === "boolean")
+        return parsed;
+    const switches = Object.fromEntries(Object.entries(parsed)
+        .filter(([, server]) => server.disabled === true)
+        .map(([id]) => [id, { disabled: true }]));
+    return Object.keys(switches).length > 0 ? switches : null;
+}
+function mergeCapabilities(a, b) {
+    return {
+        allow: [...a.allow, ...b.allow],
+        mcpServers: [...new Set([...a.mcpServers, ...b.mcpServers])],
+        lspServers: [...new Set([...a.lspServers, ...b.lspServers])],
+    };
+}

package/dist/permissions/shell-command.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Just enough shell grammar for permission matching.
+ *
+ * Prefix rules ("git status", `Bash(npm run:*)`) used to compare against the
+ * raw command string, so an approved `git status` also approved
+ * `git status && rm -rf ~`, and a `Bash(rm:*)` deny rule missed
+ * `echo ok && rm -rf x`. This splits a command into the simple commands it
+ * runs and flags constructs whose effect cannot be judged from the visible
+ * command words. It is deliberately not a full parser: anything it does not
+ * understand is marked opaque, and opaque commands are never auto-allowed.
+ */
+export interface ShellCommandAnalysis {
+    /**
+     * Simple commands in source order, including ones nested inside command
+     * substitution, backticks and process substitution. Leading control
+     * keywords (`then`, `do`, `!`, `{`, ...) are stripped.
+     */
+    segments: string[];
+    /**
+     * The command contains something an allow rule cannot vouch for: command
+     * or process substitution, backticks, a redirection to anything but
+     * /dev/null or another fd, a heredoc, a compound statement header
+     * (for/case/function), or unterminated quoting.
+     */
+    opaque: boolean;
+}
+export declare function analyzeShellCommand(command: string): ShellCommandAnalysis;
+export declare function shellTokens(segment: string): string[];
+/**
+ * The words of a segment with leading `VAR=value` assignments and command
+ * wrappers (`sudo -u x`, `env`, `nohup`, ...) removed. Deny rules match
+ * against this too, so `sudo rm -rf x` and `FOO=1 rm -rf x` still hit a
+ * `Bash(rm:*)` deny. Best effort — deny rules on shell commands can always be
+ * evaded by a determined command (e.g. `bash -c`), and are documented as such.
+ */
+export declare function effectiveCommandTokens(segment: string): string[];

package/dist/permissions/shell-command.js

@@ -0,0 +1,226 @@
+/**
+ * Just enough shell grammar for permission matching.
+ *
+ * Prefix rules ("git status", `Bash(npm run:*)`) used to compare against the
+ * raw command string, so an approved `git status` also approved
+ * `git status && rm -rf ~`, and a `Bash(rm:*)` deny rule missed
+ * `echo ok && rm -rf x`. This splits a command into the simple commands it
+ * runs and flags constructs whose effect cannot be judged from the visible
+ * command words. It is deliberately not a full parser: anything it does not
+ * understand is marked opaque, and opaque commands are never auto-allowed.
+ */
+/** Reserved words that may precede a command without changing what it runs. */
+const LEADING_KEYWORDS = new Set([
+    "if", "then", "else", "elif", "fi", "do", "done", "while", "until", "!", "{", "}", "time",
+]);
+/** Statement headers whose words are not a command at all. */
+const OPAQUE_HEADERS = new Set(["for", "case", "select", "function", "esac"]);
+const WORD_BREAK = /[\s;&|()<>]/;
+export function analyzeShellCommand(command) {
+    const segments = [];
+    let opaque = false;
+    let current = "";
+    // Open contexts: a double quote, a `$(`/`<(`/`>(`/subshell closed by `)`,
+    // or a backtick substitution.
+    const stack = [];
+    const flush = () => {
+        const tokens = current.trim().split(/\s+/).filter(Boolean);
+        current = "";
+        while (tokens.length > 0 && LEADING_KEYWORDS.has(tokens[0]))
+            tokens.shift();
+        if (tokens.length === 0)
+            return;
+        if (OPAQUE_HEADERS.has(tokens[0]))
+            opaque = true;
+        segments.push(tokens.join(" "));
+    };
+    const n = command.length;
+    for (let i = 0; i < n; i++) {
+        const c = command[i];
+        const next = command[i + 1];
+        const top = stack[stack.length - 1];
+        if (top === '"') {
+            if (c === "\\") {
+                current += c + (next ?? "");
+                i++;
+                continue;
+            }
+            if (c === '"') {
+                stack.pop();
+                current += c;
+                continue;
+            }
+            if (c === "$" && next === "(") {
+                opaque = true;
+                flush();
+                stack.push(")");
+                i++;
+                continue;
+            }
+            if (c === "`") {
+                opaque = true;
+                flush();
+                stack.push("`");
+                continue;
+            }
+            current += c;
+            continue;
+        }
+        if (c === "'") {
+            const end = command.indexOf("'", i + 1);
+            if (end < 0) {
+                opaque = true;
+                current += command.slice(i);
+                break;
+            }
+            current += command.slice(i, end + 1);
+            i = end;
+            continue;
+        }
+        if (c === "\\") {
+            current += c + (next ?? "");
+            i++;
+            continue;
+        }
+        if (c === '"') {
+            stack.push('"');
+            current += c;
+            continue;
+        }
+        if (c === "`") {
+            opaque = true;
+            flush();
+            if (top === "`")
+                stack.pop();
+            else
+                stack.push("`");
+            continue;
+        }
+        if (c === "$" && next === "(") {
+            opaque = true;
+            flush();
+            stack.push(")");
+            i++;
+            continue;
+        }
+        if ((c === "<" || c === ">") && next === "(") {
+            opaque = true;
+            flush();
+            stack.push(")");
+            i++;
+            continue;
+        }
+        if (c === "<" || c === ">" || (c === "&" && next === ">")) {
+            // A redirection. Drop an fd number glued to the operator ("2>").
+            current = current.replace(/(^|\s)\d+$/, "$1");
+            let j = i + 1;
+            let operator = c;
+            while (j < n && /[<>&|]/.test(command[j])) {
+                operator += command[j];
+                j++;
+            }
+            if (operator.startsWith("<<"))
+                opaque = true; // heredoc / herestring
+            while (j < n && (command[j] === " " || command[j] === "\t"))
+                j++;
+            let k = j;
+            while (k < n && !WORD_BREAK.test(command[k]))
+                k++;
+            const target = command.slice(j, k);
+            const harmless = target === "/dev/null" || (operator.endsWith("&") && /^(\d+|-)$/.test(target));
+            if (!harmless)
+                opaque = true;
+            i = k - 1;
+            continue;
+        }
+        if (c === ")") {
+            flush();
+            if (top === ")")
+                stack.pop();
+            continue;
+        }
+        if (c === "(") {
+            flush();
+            stack.push(")");
+            continue;
+        }
+        if (c === ";" || c === "\n" || c === "&" || c === "|") {
+            flush();
+            continue;
+        }
+        current += c;
+    }
+    flush();
+    if (stack.length > 0)
+        opaque = true;
+    return { segments, opaque };
+}
+export function shellTokens(segment) {
+    return segment.trim().split(/\s+/).filter(Boolean);
+}
+/** Wrappers that run their argument as the real command. */
+const COMMAND_WRAPPERS = new Set(["command", "exec", "nohup", "builtin", "env", "sudo", "doas", "nice", "xargs"]);
+/**
+ * Wrapper options that take a separate argument (`sudo -u root`), so that
+ * argument is not mistaken for the command. `env -S` is deliberately absent:
+ * its argument is the command line itself.
+ */
+const WRAPPER_OPTION_ARGS = {
+    sudo: { short: "CDghpRrTtUu", long: ["chdir", "chroot", "close-from", "command-timeout", "group", "host", "other-user", "prompt", "role", "type", "user"] },
+    doas: { short: "Cu", long: [] },
+    env: { short: "aCPu", long: ["argv0", "chdir", "unset"] },
+    nice: { short: "n", long: ["adjustment"] },
+    // GNU --eof/--replace/--max-lines take a value only as `--opt=value`.
+    xargs: { short: "adEIJLnPRSs", long: ["arg-file", "delimiter", "max-args", "max-chars", "max-procs", "process-slot-var"] },
+    exec: { short: "a", long: [] },
+};
+/** getopt rules: in `-Eu root` the last letter takes the next word; in `-uroot` it is attached. */
+function optionTakesNextWord(wrapper, option) {
+    const spec = WRAPPER_OPTION_ARGS[wrapper];
+    if (!spec)
+        return false;
+    if (option.startsWith("--"))
+        return !option.includes("=") && spec.long.includes(option.slice(2));
+    for (let index = 1; index < option.length; index++) {
+        if (spec.short.includes(option[index]))
+            return index === option.length - 1;
+    }
+    return false;
+}
+/**
+ * The words of a segment with leading `VAR=value` assignments and command
+ * wrappers (`sudo -u x`, `env`, `nohup`, ...) removed. Deny rules match
+ * against this too, so `sudo rm -rf x` and `FOO=1 rm -rf x` still hit a
+ * `Bash(rm:*)` deny. Best effort — deny rules on shell commands can always be
+ * evaded by a determined command (e.g. `bash -c`), and are documented as such.
+ */
+export function effectiveCommandTokens(segment) {
+    const tokens = shellTokens(segment).map(unquoteWord);
+    let changed = true;
+    while (changed && tokens.length > 0) {
+        changed = false;
+        while (tokens.length > 0 && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[0])) {
+            tokens.shift();
+            changed = true;
+        }
+        if (tokens.length > 0 && COMMAND_WRAPPERS.has(tokens[0])) {
+            const wrapper = tokens.shift();
+            while (tokens.length > 0 && tokens[0].startsWith("-")) {
+                const option = tokens.shift();
+                if (option === "--")
+                    break;
+                if (optionTakesNextWord(wrapper, option))
+                    tokens.shift();
+            }
+            changed = true;
+        }
+    }
+    // `/bin/rm` and `./rm` run the same program a `Bash(rm:*)` deny names.
+    if (tokens.length > 0 && tokens[0].includes("/"))
+        tokens[0] = tokens[0].slice(tokens[0].lastIndexOf("/") + 1);
+    return tokens;
+}
+/** `'rm'`, `"rm"` and `r\m` are all the word rm to the shell. */
+function unquoteWord(word) {
+    return word.replace(/\\(.)/g, "$1").replace(/['"]/g, "");
+}

package/dist/permissions/trust-prompt.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Folder trust, the Kimi Code way: when the repository's `.bubble` settings
+ * would grant something (allow rules, MCP servers, LSP servers), ask once at
+ * startup before any of it loads. Trusting records the exact settings; any
+ * later change asks again. Declining keeps them off for this run only.
+ */
+export declare function promptRepoTrust(cwd: string, io?: {
+    input: NodeJS.ReadableStream;
+    output: NodeJS.WritableStream;
+}): Promise<boolean>;

package/dist/permissions/trust-prompt.js

@@ -0,0 +1,34 @@
+import { createInterface } from "node:readline/promises";
+import chalk from "chalk";
+import { describeRepoCapabilities, isRepoConfigTrusted, mergedRepoCapabilities, readRepoSettings, trustRepoConfig, } from "./trust.js";
+/**
+ * Folder trust, the Kimi Code way: when the repository's `.bubble` settings
+ * would grant something (allow rules, MCP servers, LSP servers), ask once at
+ * startup before any of it loads. Trusting records the exact settings; any
+ * later change asks again. Declining keeps them off for this run only.
+ */
+export async function promptRepoTrust(cwd, io = { input: process.stdin, output: process.stdout }) {
+    // Read once: what gets trusted is exactly what was shown.
+    const raw = readRepoSettings(cwd);
+    if (isRepoConfigTrusted(cwd, raw))
+        return true;
+    const say = (line) => io.output.write(`${line}\n`);
+    say(chalk.bold(`\nThis folder's .bubble settings would enable:`));
+    for (const line of describeRepoCapabilities(mergedRepoCapabilities(raw)))
+        say(`  ${line}`);
+    say(chalk.dim("Only trust folders whose settings you have reviewed; MCP servers run commands on your machine."));
+    const rl = createInterface({ input: io.input, output: io.output });
+    try {
+        const answer = (await rl.question("Trust this folder? [Y/n] ")).trim().toLowerCase();
+        const trusted = answer === "" || answer === "y" || answer === "yes";
+        if (trusted)
+            trustRepoConfig(cwd, raw);
+        say(chalk.dim(trusted
+            ? "Trusted. Any change to these settings will ask again.\n"
+            : "Not trusted: these settings stay off this session.\n"));
+        return trusted;
+    }
+    finally {
+        rl.close();
+    }
+}