@bubblebrain-ai/bubble 0.0.63 → 0.0.65

package/dist/permissions/rule.d.ts

@@ -0,0 +1,42 @@
+import type { ParsedRule, PermissionCheckResult, PermissionDecision, PermissionQuery, PermissionRule, PermissionRuleSet } from "./types.js";
+/**
+ * Parse a single rule string, e.g. `Bash(git status:*)`.
+ *
+ * Whitespace around the whole expression is trimmed; whitespace inside the
+ * pattern is preserved (Bash patterns are tokenized later, paths may legitimately
+ * contain spaces inside globs).
+ */
+export declare function parseRule(input: string): ParsedRule;
+/**
+ * Parse a list of rule strings. Invalid entries are reported in `errors`; valid
+ * ones populate `rules`. Callers decide whether to surface errors or ignore.
+ */
+export declare function parseRules(inputs: string[]): {
+    rules: PermissionRule[];
+    errors: {
+        source: string;
+        message: string;
+    }[];
+};
+/**
+ * Does `rule` match `query`?
+ *
+ * Tool name must match (or rule.tool is "*"; `mcp__server` covers every
+ * `mcp__server__tool`). If the rule has no pattern, it matches any use of that
+ * tool. Otherwise the tool-specific matcher decides. `list` matters for Bash:
+ * an allow rule must cover every command a compound command runs, while a
+ * deny rule fires if it covers any of them.
+ */
+export declare function matchRule(rule: PermissionRule, query: PermissionQuery, list?: "allow" | "deny"): boolean;
+/**
+ * Evaluate a rule set against a query. Deny wins; otherwise first allow wins;
+ * otherwise "ask".
+ */
+export declare function checkPermission(rules: PermissionRuleSet, query: PermissionQuery): PermissionCheckResult;
+/**
+ * Convenience: given raw `allow`/`deny` string arrays from settings, produce a
+ * ready-to-use rule set (silently dropping parse errors — callers that want
+ * diagnostics should call parseRules directly).
+ */
+export declare function buildRuleSet(allow: string[], deny: string[]): PermissionRuleSet;
+export type { PermissionDecision };

package/dist/permissions/rule.js

@@ -0,0 +1,293 @@
+import { homedir } from "node:os";
+import { isAbsolute, resolve } from "node:path";
+import picomatch from "picomatch";
+import { analyzeShellCommand, effectiveCommandTokens, shellTokens } from "./shell-command.js";
+const KNOWN_TOOLS = new Set([
+    "Bash",
+    "Read",
+    "Write",
+    "Edit",
+    "Lsp",
+    "WebFetch",
+    "WebSearch",
+    "*",
+]);
+const RULE_SHAPE = /^([A-Za-z_*][A-Za-z0-9_]*)(?:\(([^)]*)\))?$/;
+/**
+ * Parse a single rule string, e.g. `Bash(git status:*)`.
+ *
+ * Whitespace around the whole expression is trimmed; whitespace inside the
+ * pattern is preserved (Bash patterns are tokenized later, paths may legitimately
+ * contain spaces inside globs).
+ */
+export function parseRule(input) {
+    const source = input;
+    const trimmed = input.trim();
+    if (!trimmed) {
+        return {
+            ok: false,
+            error: { source, message: "Rule is empty." },
+        };
+    }
+    const match = RULE_SHAPE.exec(trimmed);
+    if (!match) {
+        return {
+            ok: false,
+            error: {
+                source,
+                message: `Rule must look like "Tool" or "Tool(pattern)"; got: ${trimmed}`,
+            },
+        };
+    }
+    const tool = match[1];
+    const rawPattern = match[2];
+    if (tool !== "*" && !KNOWN_TOOLS.has(tool)) {
+        // Allow unknown tool names through — future MCP tools etc. can reuse this
+        // parser. But empty bodies with no paren and unknown names are fine too.
+    }
+    const pattern = rawPattern !== undefined ? rawPattern.trim() : undefined;
+    if (pattern !== undefined && pattern.length === 0) {
+        return {
+            ok: false,
+            error: {
+                source,
+                message: `Rule has empty parentheses; drop the parens to match all uses of ${tool}.`,
+            },
+        };
+    }
+    return {
+        ok: true,
+        rule: { tool, pattern, source },
+    };
+}
+/**
+ * Parse a list of rule strings. Invalid entries are reported in `errors`; valid
+ * ones populate `rules`. Callers decide whether to surface errors or ignore.
+ */
+export function parseRules(inputs) {
+    const rules = [];
+    const errors = [];
+    for (const input of inputs) {
+        const parsed = parseRule(input);
+        if (parsed.ok) {
+            rules.push(parsed.rule);
+        }
+        else {
+            errors.push(parsed.error);
+        }
+    }
+    return { rules, errors };
+}
+/**
+ * Does `rule` match `query`?
+ *
+ * Tool name must match (or rule.tool is "*"; `mcp__server` covers every
+ * `mcp__server__tool`). If the rule has no pattern, it matches any use of that
+ * tool. Otherwise the tool-specific matcher decides. `list` matters for Bash:
+ * an allow rule must cover every command a compound command runs, while a
+ * deny rule fires if it covers any of them.
+ */
+export function matchRule(rule, query, list = "allow") {
+    if (rule.tool !== "*" && rule.tool !== query.tool && !isMcpServerRule(rule, query)) {
+        return false;
+    }
+    if (rule.pattern === undefined) {
+        return true;
+    }
+    const toolKey = rule.tool === "*" ? query.tool : rule.tool;
+    switch (toolKey) {
+        case "Bash":
+            if (!("command" in query) || typeof query.command !== "string")
+                return false;
+            return list === "deny"
+                ? bashDenyMatches(rule.pattern, query.command)
+                : bashAllowMatches(rule.pattern, query.command);
+        case "Read":
+        case "Write":
+        case "Edit":
+        case "Lsp":
+            if (!("path" in query) || !("cwd" in query))
+                return false;
+            return matchPath(rule.pattern, query.path, query.cwd);
+        case "WebFetch":
+            if (!("url" in query) || typeof query.url !== "string")
+                return false;
+            return matchDomain(rule.pattern, query.url);
+        case "WebSearch":
+            // WebSearch rules only support tool-level match for v1.
+            return false;
+        default:
+            // Unknown tool with a pattern: be conservative, don't match.
+            return false;
+    }
+}
+/**
+ * Evaluate a rule set against a query. Deny wins; otherwise first allow wins;
+ * otherwise "ask".
+ */
+export function checkPermission(rules, query) {
+    for (const rule of rules.deny) {
+        if (matchRule(rule, query, "deny")) {
+            return { decision: "deny", rule };
+        }
+    }
+    if (query.tool === "Bash" && "command" in query && typeof query.command === "string") {
+        return checkBashAllow(rules.allow, query.command);
+    }
+    for (const rule of rules.allow) {
+        if (matchRule(rule, query, "allow")) {
+            return { decision: "allow", rule };
+        }
+    }
+    return { decision: "ask" };
+}
+/**
+ * A compound command is allowed when every simple command in it is covered
+ * by some allow rule (different rules may cover different parts), and it has
+ * nothing opaque — unless a rule grants any command (`Bash`, `*`, `Bash(:*)`).
+ */
+function checkBashAllow(allowRules, command) {
+    const bashRules = allowRules.filter((rule) => rule.tool === "Bash" || rule.tool === "*");
+    const anyCommand = bashRules.find((rule) => rule.pattern === undefined || tokenize(rule.pattern).join(" ") === ":*");
+    if (anyCommand)
+        return { decision: "allow", rule: anyCommand };
+    const analysis = analyzeShellCommand(command);
+    if (analysis.opaque || analysis.segments.length === 0)
+        return { decision: "ask" };
+    let first;
+    for (const segment of analysis.segments) {
+        const tokens = shellTokens(segment);
+        const rule = bashRules.find((candidate) => matchBash(candidate.pattern, tokens));
+        if (!rule)
+            return { decision: "ask" };
+        first ??= rule;
+    }
+    return first ? { decision: "allow", rule: first } : { decision: "ask" };
+}
+// --- per-tool matchers ---------------------------------------------------
+/** `mcp__github` (no pattern) covers every tool of that MCP server. */
+function isMcpServerRule(rule, query) {
+    return rule.pattern === undefined
+        && rule.tool.startsWith("mcp__")
+        && query.tool.startsWith(`${rule.tool}__`);
+}
+/**
+ * Allow: every simple command the line runs must match, and nothing opaque
+ * (substitution, file redirection, heredoc) may ride along.
+ */
+function bashAllowMatches(pattern, command) {
+    // `Bash(:*)` is an explicit "any command" grant.
+    if (tokenize(pattern).join(" ") === ":*")
+        return true;
+    const analysis = analyzeShellCommand(command);
+    if (analysis.opaque || analysis.segments.length === 0)
+        return false;
+    return analysis.segments.every((segment) => matchBash(pattern, shellTokens(segment)));
+}
+/**
+ * Deny: any simple command matching — as written, or with leading
+ * assignments/wrappers (`sudo`, `env`, ...) stripped — blocks the line.
+ */
+function bashDenyMatches(pattern, command) {
+    const analysis = analyzeShellCommand(command);
+    if (analysis.segments.length === 0)
+        return matchBash(pattern, shellTokens(command));
+    return analysis.segments.some((segment) => matchBash(pattern, shellTokens(segment)) || matchBash(pattern, effectiveCommandTokens(segment)));
+}
+/**
+ * Bash pattern matching.
+ *
+ * - `git status`     → command tokens equal ["git","status"] exactly
+ * - `git status:*`   → command tokens start with ["git","status"]
+ *
+ * Matches one simple command's tokens; bashAllowMatches / bashDenyMatches
+ * split compound commands first (see shell-command.ts).
+ */
+function matchBash(pattern, cmdTokens) {
+    let ruleTokens = tokenize(pattern);
+    let prefixMatch = false;
+    if (ruleTokens.length > 0) {
+        const last = ruleTokens[ruleTokens.length - 1];
+        if (last === ":*") {
+            prefixMatch = true;
+            ruleTokens = ruleTokens.slice(0, -1);
+        }
+        else if (last.endsWith(":*")) {
+            prefixMatch = true;
+            ruleTokens = ruleTokens.slice(0, -1).concat([last.slice(0, -2)]);
+        }
+    }
+    if (ruleTokens.length === 0) {
+        return prefixMatch; // `Bash(:*)` would match anything; keep behavior defined
+    }
+    if (prefixMatch) {
+        if (ruleTokens.length > cmdTokens.length)
+            return false;
+        return ruleTokens.every((tok, i) => tok === cmdTokens[i]);
+    }
+    if (ruleTokens.length !== cmdTokens.length)
+        return false;
+    return ruleTokens.every((tok, i) => tok === cmdTokens[i]);
+}
+/**
+ * Path pattern matching via picomatch (glob). The rule pattern is expanded for
+ * `~` (home) and resolved relative to cwd if not absolute. The query path is
+ * resolved the same way to compare canonical absolute paths.
+ */
+function matchPath(pattern, queryPath, cwd) {
+    const expandedPattern = expandHome(pattern);
+    const absolutePattern = isAbsolute(expandedPattern)
+        ? expandedPattern
+        : resolve(cwd, expandedPattern);
+    const absoluteQuery = isAbsolute(queryPath)
+        ? queryPath
+        : resolve(cwd, queryPath);
+    const matcher = picomatch(absolutePattern, { dot: true });
+    return matcher(absoluteQuery);
+}
+/**
+ * WebFetch domain matching. Pattern must be `domain:<host>`. Match is true if
+ * the URL host equals `<host>` or is a subdomain of it.
+ *
+ *   domain:github.com → matches https://github.com/... and https://api.github.com/...
+ */
+function matchDomain(pattern, url) {
+    const prefix = "domain:";
+    if (!pattern.startsWith(prefix))
+        return false;
+    const expectedHost = pattern.slice(prefix.length).trim().toLowerCase();
+    if (!expectedHost)
+        return false;
+    let host;
+    try {
+        host = new URL(url).hostname.toLowerCase();
+    }
+    catch {
+        return false;
+    }
+    if (host === expectedHost)
+        return true;
+    return host.endsWith("." + expectedHost);
+}
+// --- small helpers -------------------------------------------------------
+function tokenize(input) {
+    return input.trim().split(/\s+/).filter(Boolean);
+}
+function expandHome(p) {
+    if (p === "~")
+        return homedir();
+    if (p.startsWith("~/"))
+        return resolve(homedir(), p.slice(2));
+    return p;
+}
+/**
+ * Convenience: given raw `allow`/`deny` string arrays from settings, produce a
+ * ready-to-use rule set (silently dropping parse errors — callers that want
+ * diagnostics should call parseRules directly).
+ */
+export function buildRuleSet(allow, deny) {
+    return {
+        allow: parseRules(allow).rules,
+        deny: parseRules(deny).rules,
+    };
+}

package/dist/permissions/settings.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Persistent permission settings.
+ *
+ * Three scopes, lowest to highest precedence:
+ *
+ *   user    — ~/.bubble/settings.json            (cross-project preferences)
+ *   project — <cwd>/.bubble/settings.json        (team-shared, check into git)
+ *   local   — <cwd>/.bubble/settings.local.json  (personal, gitignore)
+ *
+ * `defaultMode` uses last-wins precedence (local beats project beats user).
+ * `allow` / `deny` arrays are concatenated across scopes (with the rule text
+ * itself carrying provenance via `PermissionRule.source`).
+ *
+ * Allow rules and LSP server definitions from the project and local scopes
+ * live inside the repository, so they only take effect once the user trusts
+ * this folder (asked at startup, see trust.ts); until then they are reported in
+ * `untrusted` (MCP servers from those files are gated the same way by
+ * loadMcpConfig).
+ *
+ * Parse errors do not fail the load; they collect into `diagnostics` so callers
+ * can surface them in /permissions or on startup without taking the agent down.
+ */
+import type { PermissionMode } from "../types.js";
+import { type LspConfig } from "../lsp/config.js";
+import { type RepoCapabilities } from "./trust.js";
+import type { PermissionRule, PermissionRuleSet } from "./types.js";
+export type SettingsScope = "user" | "project" | "local";
+export type RuleList = "allow" | "deny";
+export interface RawSettings {
+    lsp?: unknown;
+    permissions?: {
+        defaultMode?: string;
+        allow?: string[];
+        deny?: string[];
+    };
+}
+export interface SettingsDiagnostic {
+    scope: SettingsScope;
+    path: string;
+    message: string;
+}
+export interface MergedSettings {
+    defaultMode?: PermissionMode;
+    lsp?: LspConfig;
+    ruleSet: PermissionRuleSet;
+    /** Project/local allow rules ignored until the user trusts them. */
+    untrustedAllow: PermissionRule[];
+    /** Everything in the repository settings that waits for trust (allow rules, MCP servers, LSP servers). */
+    untrusted: RepoCapabilities;
+    diagnostics: SettingsDiagnostic[];
+}
+export interface SettingsManagerOptions {
+    /** Override for Bubble home. Respects BUBBLE_HOME/BUBBLE_DEV env vars by default. */
+    bubbleHome?: string;
+}
+export declare class SettingsManager {
+    private readonly paths;
+    private raw;
+    private fileDiagnostics;
+    private readonly cwd;
+    private readonly bubbleHome?;
+    /** Cached per load: whether the repository's capability settings are trusted. */
+    private repoTrusted;
+    constructor(cwd: string, options?: SettingsManagerOptions);
+    /** Re-read all three files from disk. */
+    reload(): void;
+    /**
+     * Trust the repository's current capability settings (allow rules, MCP
+     * servers, LSP servers from the project and local files).
+     */
+    trustRepoConfig(): void;
+    private repoRaw;
+    /**
+     * Bubble's own /permissions edits keep an existing trust: rules the user
+     * adds through Bubble are their decision. An untrusted rule set stays
+     * untrusted — editing it must not launder rules the user never reviewed.
+     */
+    private keepRepoTrustAfterWrite;
+    getPath(scope: SettingsScope): string;
+    /** Merged view for runtime consumption. Does not hit disk — call `reload()` first if stale. */
+    getMerged(): MergedSettings;
+    /**
+     * Add a rule to the specified list in the specified scope. Creates the file
+     * and parent directories if needed. Silently skips if the exact string is
+     * already present.
+     *
+     * Returns true if the file was written.
+     */
+    addRule(scope: SettingsScope, list: RuleList, rule: string): boolean;
+    /**
+     * Remove the first matching rule (by exact string) from the specified list
+     * in the specified scope. Returns true if a rule was removed.
+     */
+    removeRule(scope: SettingsScope, list: RuleList, rule: string): boolean;
+    private readFile;
+    private writeFile;
+}