@bubblebrain-ai/bubble 0.0.63 → 0.0.65

package/dist/permissions/settings.js

@@ -0,0 +1,289 @@
+/**
+ * Persistent permission settings.
+ *
+ * Three scopes, lowest to highest precedence:
+ *
+ *   user    — ~/.bubble/settings.json            (cross-project preferences)
+ *   project — <cwd>/.bubble/settings.json        (team-shared, check into git)
+ *   local   — <cwd>/.bubble/settings.local.json  (personal, gitignore)
+ *
+ * `defaultMode` uses last-wins precedence (local beats project beats user).
+ * `allow` / `deny` arrays are concatenated across scopes (with the rule text
+ * itself carrying provenance via `PermissionRule.source`).
+ *
+ * Allow rules and LSP server definitions from the project and local scopes
+ * live inside the repository, so they only take effect once the user trusts
+ * this folder (asked at startup, see trust.ts); until then they are reported in
+ * `untrusted` (MCP servers from those files are gated the same way by
+ * loadMcpConfig).
+ *
+ * Parse errors do not fail the load; they collect into `diagnostics` so callers
+ * can surface them in /permissions or on startup without taking the agent down.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { getBubbleHome } from "../bubble-home.js";
+import { normalizeLspConfig } from "../lsp/config.js";
+import { parseRules } from "./rule.js";
+import { isRepoConfigTrusted, repoCapabilities, trustRepoConfig } from "./trust.js";
+const KNOWN_MODES = new Set([
+    "default",
+    "plan",
+    "bypassPermissions",
+]);
+export class SettingsManager {
+    paths;
+    raw = {
+        user: null,
+        project: null,
+        local: null,
+    };
+    fileDiagnostics = [];
+    cwd;
+    bubbleHome;
+    /** Cached per load: whether the repository's capability settings are trusted. */
+    repoTrusted = false;
+    constructor(cwd, options = {}) {
+        const bubbleHome = options.bubbleHome ?? getBubbleHome();
+        this.cwd = cwd;
+        this.bubbleHome = bubbleHome;
+        this.paths = {
+            user: join(bubbleHome, "settings.json"),
+            project: join(cwd, ".bubble", "settings.json"),
+            local: join(cwd, ".bubble", "settings.local.json"),
+        };
+        this.reload();
+    }
+    /** Re-read all three files from disk. */
+    reload() {
+        this.fileDiagnostics = [];
+        for (const scope of ["user", "project", "local"]) {
+            this.raw[scope] = this.readFile(scope);
+        }
+        this.repoTrusted = isRepoConfigTrusted(this.cwd, this.repoRaw(), { bubbleHome: this.bubbleHome });
+    }
+    /**
+     * Trust the repository's current capability settings (allow rules, MCP
+     * servers, LSP servers from the project and local files).
+     */
+    trustRepoConfig() {
+        trustRepoConfig(this.cwd, this.repoRaw(), { bubbleHome: this.bubbleHome });
+        this.repoTrusted = true;
+    }
+    repoRaw() {
+        return { project: this.raw.project, local: this.raw.local };
+    }
+    /**
+     * Bubble's own /permissions edits keep an existing trust: rules the user
+     * adds through Bubble are their decision. An untrusted rule set stays
+     * untrusted — editing it must not launder rules the user never reviewed.
+     */
+    keepRepoTrustAfterWrite(scope, wasTrusted) {
+        if (scope === "user")
+            return;
+        if (wasTrusted)
+            this.trustRepoConfig();
+        else
+            this.repoTrusted = isRepoConfigTrusted(this.cwd, this.repoRaw(), { bubbleHome: this.bubbleHome });
+    }
+    getPath(scope) {
+        return this.paths[scope];
+    }
+    /** Merged view for runtime consumption. Does not hit disk — call `reload()` first if stale. */
+    getMerged() {
+        const diagnostics = [...this.fileDiagnostics];
+        let defaultMode;
+        let lsp;
+        const allow = [];
+        const deny = [];
+        const untrustedAllow = [];
+        for (const scope of ["user", "project", "local"]) {
+            const data = this.raw[scope];
+            if (!data)
+                continue;
+            if ("lsp" in data) {
+                const trustedLsp = scope === "user" || this.repoTrusted;
+                const parsed = trustedLsp ? normalizeLspConfig(data.lsp) : untrustedLspSwitches(data.lsp);
+                if (!trustedLsp && repoCapabilities(data).lspServers.length > 0) {
+                    diagnostics.push({
+                        scope,
+                        path: this.paths[scope],
+                        message: `Ignored LSP server definitions from this repository (${repoCapabilities(data).lspServers.join(", ")}): the folder is not trusted (Bubble asks at startup).`,
+                    });
+                }
+                if (parsed === undefined) {
+                    diagnostics.push({
+                        scope,
+                        path: this.paths[scope],
+                        message: "Ignored lsp setting — expected boolean or object.",
+                    });
+                }
+                else if (parsed !== null) {
+                    lsp = parsed;
+                }
+            }
+            if (!data.permissions)
+                continue;
+            const perms = data.permissions;
+            if (typeof perms.defaultMode === "string") {
+                const rawMode = perms.defaultMode === "acceptEdits" ? "default" : perms.defaultMode;
+                if (KNOWN_MODES.has(rawMode)) {
+                    defaultMode = rawMode;
+                }
+                else {
+                    diagnostics.push({
+                        scope,
+                        path: this.paths[scope],
+                        message: `Ignored defaultMode "${perms.defaultMode}" — not one of: ${[...KNOWN_MODES].join(", ")}.`,
+                    });
+                }
+            }
+            if (Array.isArray(perms.allow)) {
+                const parsed = parseRules(perms.allow);
+                if (scope === "user" || this.repoTrusted) {
+                    allow.push(...parsed.rules);
+                }
+                else {
+                    untrustedAllow.push(...parsed.rules);
+                    if (parsed.rules.length > 0) {
+                        diagnostics.push({
+                            scope,
+                            path: this.paths[scope],
+                            message: `Ignored ${parsed.rules.length} allow rule${parsed.rules.length === 1 ? "" : "s"} from this repository: the folder is not trusted (Bubble asks at startup).`,
+                        });
+                    }
+                }
+                for (const err of parsed.errors) {
+                    diagnostics.push({
+                        scope,
+                        path: this.paths[scope],
+                        message: `Invalid allow rule "${err.source.trim()}": ${err.message}`,
+                    });
+                }
+            }
+            if (Array.isArray(perms.deny)) {
+                const parsed = parseRules(perms.deny);
+                deny.push(...parsed.rules);
+                for (const err of parsed.errors) {
+                    diagnostics.push({
+                        scope,
+                        path: this.paths[scope],
+                        message: `Invalid deny rule "${err.source.trim()}": ${err.message}`,
+                    });
+                }
+            }
+        }
+        return {
+            defaultMode,
+            lsp,
+            ruleSet: { allow, deny },
+            untrustedAllow,
+            untrusted: this.repoTrusted
+                ? { allow: [], mcpServers: [], lspServers: [] }
+                : mergeCapabilities(repoCapabilities(this.raw.project), repoCapabilities(this.raw.local)),
+            diagnostics,
+        };
+    }
+    /**
+     * Add a rule to the specified list in the specified scope. Creates the file
+     * and parent directories if needed. Silently skips if the exact string is
+     * already present.
+     *
+     * Returns true if the file was written.
+     */
+    addRule(scope, list, rule) {
+        const raw = this.raw[scope] ?? {};
+        const permissions = { ...(raw.permissions ?? {}) };
+        const current = Array.isArray(permissions[list]) ? [...permissions[list]] : [];
+        if (current.includes(rule)) {
+            return false;
+        }
+        current.push(rule);
+        permissions[list] = current;
+        const wasTrusted = this.repoTrusted;
+        const next = { ...raw, permissions };
+        this.writeFile(scope, next);
+        this.raw[scope] = next;
+        this.keepRepoTrustAfterWrite(scope, wasTrusted);
+        return true;
+    }
+    /**
+     * Remove the first matching rule (by exact string) from the specified list
+     * in the specified scope. Returns true if a rule was removed.
+     */
+    removeRule(scope, list, rule) {
+        const raw = this.raw[scope];
+        if (!raw || !raw.permissions)
+            return false;
+        const current = Array.isArray(raw.permissions[list]) ? [...raw.permissions[list]] : [];
+        const index = current.indexOf(rule);
+        if (index < 0)
+            return false;
+        current.splice(index, 1);
+        const nextPermissions = { ...raw.permissions, [list]: current };
+        // Drop the key if empty, keep file readable
+        if (current.length === 0)
+            delete nextPermissions[list];
+        const wasTrusted = this.repoTrusted;
+        const next = { ...raw, permissions: nextPermissions };
+        this.writeFile(scope, next);
+        this.raw[scope] = next;
+        this.keepRepoTrustAfterWrite(scope, wasTrusted);
+        return true;
+    }
+    // -- internal --------------------------------------------------------
+    readFile(scope) {
+        const path = this.paths[scope];
+        if (!existsSync(path))
+            return null;
+        try {
+            const text = readFileSync(path, "utf-8");
+            const parsed = JSON.parse(text);
+            if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+                this.fileDiagnostics.push({
+                    scope,
+                    path,
+                    message: "Settings file must contain a JSON object at the top level.",
+                });
+                return null;
+            }
+            return parsed;
+        }
+        catch (err) {
+            this.fileDiagnostics.push({
+                scope,
+                path,
+                message: `Failed to parse settings: ${err.message}`,
+            });
+            return null;
+        }
+    }
+    writeFile(scope, data) {
+        const path = this.paths[scope];
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, JSON.stringify(data, null, 2) + "\n", "utf-8");
+    }
+}
+/**
+ * What an untrusted repository may still say about LSP: turning it off, or
+ * turning individual servers off. Commands, env and options need trust.
+ * Returns null when nothing usable is left (the scope then does not override).
+ */
+function untrustedLspSwitches(value) {
+    if (typeof value === "boolean")
+        return value === false ? false : null;
+    const parsed = normalizeLspConfig(value);
+    if (parsed === undefined || typeof parsed === "boolean")
+        return parsed;
+    const switches = Object.fromEntries(Object.entries(parsed)
+        .filter(([, server]) => server.disabled === true)
+        .map(([id]) => [id, { disabled: true }]));
+    return Object.keys(switches).length > 0 ? switches : null;
+}
+function mergeCapabilities(a, b) {
+    return {
+        allow: [...a.allow, ...b.allow],
+        mcpServers: [...new Set([...a.mcpServers, ...b.mcpServers])],
+        lspServers: [...new Set([...a.lspServers, ...b.lspServers])],
+    };
+}

package/dist/permissions/shell-command.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Just enough shell grammar for permission matching.
+ *
+ * Prefix rules ("git status", `Bash(npm run:*)`) used to compare against the
+ * raw command string, so an approved `git status` also approved
+ * `git status && rm -rf ~`, and a `Bash(rm:*)` deny rule missed
+ * `echo ok && rm -rf x`. This splits a command into the simple commands it
+ * runs and flags constructs whose effect cannot be judged from the visible
+ * command words. It is deliberately not a full parser: anything it does not
+ * understand is marked opaque, and opaque commands are never auto-allowed.
+ */
+export interface ShellCommandAnalysis {
+    /**
+     * Simple commands in source order, including ones nested inside command
+     * substitution, backticks and process substitution. Leading control
+     * keywords (`then`, `do`, `!`, `{`, ...) are stripped.
+     */
+    segments: string[];
+    /**
+     * The command contains something an allow rule cannot vouch for: command
+     * or process substitution, backticks, a redirection to anything but
+     * /dev/null or another fd, a heredoc, a compound statement header
+     * (for/case/function), or unterminated quoting.
+     */
+    opaque: boolean;
+}
+export declare function analyzeShellCommand(command: string): ShellCommandAnalysis;
+export declare function shellTokens(segment: string): string[];
+/**
+ * The words of a segment with leading `VAR=value` assignments and command
+ * wrappers (`sudo -u x`, `env`, `nohup`, ...) removed. Deny rules match
+ * against this too, so `sudo rm -rf x` and `FOO=1 rm -rf x` still hit a
+ * `Bash(rm:*)` deny. Best effort — deny rules on shell commands can always be
+ * evaded by a determined command (e.g. `bash -c`), and are documented as such.
+ */
+export declare function effectiveCommandTokens(segment: string): string[];

package/dist/permissions/shell-command.js

@@ -0,0 +1,226 @@
+/**
+ * Just enough shell grammar for permission matching.
+ *
+ * Prefix rules ("git status", `Bash(npm run:*)`) used to compare against the
+ * raw command string, so an approved `git status` also approved
+ * `git status && rm -rf ~`, and a `Bash(rm:*)` deny rule missed
+ * `echo ok && rm -rf x`. This splits a command into the simple commands it
+ * runs and flags constructs whose effect cannot be judged from the visible
+ * command words. It is deliberately not a full parser: anything it does not
+ * understand is marked opaque, and opaque commands are never auto-allowed.
+ */
+/** Reserved words that may precede a command without changing what it runs. */
+const LEADING_KEYWORDS = new Set([
+    "if", "then", "else", "elif", "fi", "do", "done", "while", "until", "!", "{", "}", "time",
+]);
+/** Statement headers whose words are not a command at all. */
+const OPAQUE_HEADERS = new Set(["for", "case", "select", "function", "esac"]);
+const WORD_BREAK = /[\s;&|()<>]/;
+export function analyzeShellCommand(command) {
+    const segments = [];
+    let opaque = false;
+    let current = "";
+    // Open contexts: a double quote, a `$(`/`<(`/`>(`/subshell closed by `)`,
+    // or a backtick substitution.
+    const stack = [];
+    const flush = () => {
+        const tokens = current.trim().split(/\s+/).filter(Boolean);
+        current = "";
+        while (tokens.length > 0 && LEADING_KEYWORDS.has(tokens[0]))
+            tokens.shift();
+        if (tokens.length === 0)
+            return;
+        if (OPAQUE_HEADERS.has(tokens[0]))
+            opaque = true;
+        segments.push(tokens.join(" "));
+    };
+    const n = command.length;
+    for (let i = 0; i < n; i++) {
+        const c = command[i];
+        const next = command[i + 1];
+        const top = stack[stack.length - 1];
+        if (top === '"') {
+            if (c === "\\") {
+                current += c + (next ?? "");
+                i++;
+                continue;
+            }
+            if (c === '"') {
+                stack.pop();
+                current += c;
+                continue;
+            }
+            if (c === "$" && next === "(") {
+                opaque = true;
+                flush();
+                stack.push(")");
+                i++;
+                continue;
+            }
+            if (c === "`") {
+                opaque = true;
+                flush();
+                stack.push("`");
+                continue;
+            }
+            current += c;
+            continue;
+        }
+        if (c === "'") {
+            const end = command.indexOf("'", i + 1);
+            if (end < 0) {
+                opaque = true;
+                current += command.slice(i);
+                break;
+            }
+            current += command.slice(i, end + 1);
+            i = end;
+            continue;
+        }
+        if (c === "\\") {
+            current += c + (next ?? "");
+            i++;
+            continue;
+        }
+        if (c === '"') {
+            stack.push('"');
+            current += c;
+            continue;
+        }
+        if (c === "`") {
+            opaque = true;
+            flush();
+            if (top === "`")
+                stack.pop();
+            else
+                stack.push("`");
+            continue;
+        }
+        if (c === "$" && next === "(") {
+            opaque = true;
+            flush();
+            stack.push(")");
+            i++;
+            continue;
+        }
+        if ((c === "<" || c === ">") && next === "(") {
+            opaque = true;
+            flush();
+            stack.push(")");
+            i++;
+            continue;
+        }
+        if (c === "<" || c === ">" || (c === "&" && next === ">")) {
+            // A redirection. Drop an fd number glued to the operator ("2>").
+            current = current.replace(/(^|\s)\d+$/, "$1");
+            let j = i + 1;
+            let operator = c;
+            while (j < n && /[<>&|]/.test(command[j])) {
+                operator += command[j];
+                j++;
+            }
+            if (operator.startsWith("<<"))
+                opaque = true; // heredoc / herestring
+            while (j < n && (command[j] === " " || command[j] === "\t"))
+                j++;
+            let k = j;
+            while (k < n && !WORD_BREAK.test(command[k]))
+                k++;
+            const target = command.slice(j, k);
+            const harmless = target === "/dev/null" || (operator.endsWith("&") && /^(\d+|-)$/.test(target));
+            if (!harmless)
+                opaque = true;
+            i = k - 1;
+            continue;
+        }
+        if (c === ")") {
+            flush();
+            if (top === ")")
+                stack.pop();
+            continue;
+        }
+        if (c === "(") {
+            flush();
+            stack.push(")");
+            continue;
+        }
+        if (c === ";" || c === "\n" || c === "&" || c === "|") {
+            flush();
+            continue;
+        }
+        current += c;
+    }
+    flush();
+    if (stack.length > 0)
+        opaque = true;
+    return { segments, opaque };
+}
+export function shellTokens(segment) {
+    return segment.trim().split(/\s+/).filter(Boolean);
+}
+/** Wrappers that run their argument as the real command. */
+const COMMAND_WRAPPERS = new Set(["command", "exec", "nohup", "builtin", "env", "sudo", "doas", "nice", "xargs"]);
+/**
+ * Wrapper options that take a separate argument (`sudo -u root`), so that
+ * argument is not mistaken for the command. `env -S` is deliberately absent:
+ * its argument is the command line itself.
+ */
+const WRAPPER_OPTION_ARGS = {
+    sudo: { short: "CDghpRrTtUu", long: ["chdir", "chroot", "close-from", "command-timeout", "group", "host", "other-user", "prompt", "role", "type", "user"] },
+    doas: { short: "Cu", long: [] },
+    env: { short: "aCPu", long: ["argv0", "chdir", "unset"] },
+    nice: { short: "n", long: ["adjustment"] },
+    // GNU --eof/--replace/--max-lines take a value only as `--opt=value`.
+    xargs: { short: "adEIJLnPRSs", long: ["arg-file", "delimiter", "max-args", "max-chars", "max-procs", "process-slot-var"] },
+    exec: { short: "a", long: [] },
+};
+/** getopt rules: in `-Eu root` the last letter takes the next word; in `-uroot` it is attached. */
+function optionTakesNextWord(wrapper, option) {
+    const spec = WRAPPER_OPTION_ARGS[wrapper];
+    if (!spec)
+        return false;
+    if (option.startsWith("--"))
+        return !option.includes("=") && spec.long.includes(option.slice(2));
+    for (let index = 1; index < option.length; index++) {
+        if (spec.short.includes(option[index]))
+            return index === option.length - 1;
+    }
+    return false;
+}
+/**
+ * The words of a segment with leading `VAR=value` assignments and command
+ * wrappers (`sudo -u x`, `env`, `nohup`, ...) removed. Deny rules match
+ * against this too, so `sudo rm -rf x` and `FOO=1 rm -rf x` still hit a
+ * `Bash(rm:*)` deny. Best effort — deny rules on shell commands can always be
+ * evaded by a determined command (e.g. `bash -c`), and are documented as such.
+ */
+export function effectiveCommandTokens(segment) {
+    const tokens = shellTokens(segment).map(unquoteWord);
+    let changed = true;
+    while (changed && tokens.length > 0) {
+        changed = false;
+        while (tokens.length > 0 && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[0])) {
+            tokens.shift();
+            changed = true;
+        }
+        if (tokens.length > 0 && COMMAND_WRAPPERS.has(tokens[0])) {
+            const wrapper = tokens.shift();
+            while (tokens.length > 0 && tokens[0].startsWith("-")) {
+                const option = tokens.shift();
+                if (option === "--")
+                    break;
+                if (optionTakesNextWord(wrapper, option))
+                    tokens.shift();
+            }
+            changed = true;
+        }
+    }
+    // `/bin/rm` and `./rm` run the same program a `Bash(rm:*)` deny names.
+    if (tokens.length > 0 && tokens[0].includes("/"))
+        tokens[0] = tokens[0].slice(tokens[0].lastIndexOf("/") + 1);
+    return tokens;
+}
+/** `'rm'`, `"rm"` and `r\m` are all the word rm to the shell. */
+function unquoteWord(word) {
+    return word.replace(/\\(.)/g, "$1").replace(/['"]/g, "");
+}

package/dist/permissions/trust-prompt.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Folder trust, the Kimi Code way: when the repository's `.bubble` settings
+ * would grant something (allow rules, MCP servers, LSP servers), ask once at
+ * startup before any of it loads. Trusting records the exact settings; any
+ * later change asks again. Declining keeps them off for this run only.
+ */
+export declare function promptRepoTrust(cwd: string, io?: {
+    input: NodeJS.ReadableStream;
+    output: NodeJS.WritableStream;
+}): Promise<boolean>;

package/dist/permissions/trust-prompt.js

@@ -0,0 +1,34 @@
+import { createInterface } from "node:readline/promises";
+import chalk from "chalk";
+import { describeRepoCapabilities, isRepoConfigTrusted, mergedRepoCapabilities, readRepoSettings, trustRepoConfig, } from "./trust.js";
+/**
+ * Folder trust, the Kimi Code way: when the repository's `.bubble` settings
+ * would grant something (allow rules, MCP servers, LSP servers), ask once at
+ * startup before any of it loads. Trusting records the exact settings; any
+ * later change asks again. Declining keeps them off for this run only.
+ */
+export async function promptRepoTrust(cwd, io = { input: process.stdin, output: process.stdout }) {
+    // Read once: what gets trusted is exactly what was shown.
+    const raw = readRepoSettings(cwd);
+    if (isRepoConfigTrusted(cwd, raw))
+        return true;
+    const say = (line) => io.output.write(`${line}\n`);
+    say(chalk.bold(`\nThis folder's .bubble settings would enable:`));
+    for (const line of describeRepoCapabilities(mergedRepoCapabilities(raw)))
+        say(`  ${line}`);
+    say(chalk.dim("Only trust folders whose settings you have reviewed; MCP servers run commands on your machine."));
+    const rl = createInterface({ input: io.input, output: io.output });
+    try {
+        const answer = (await rl.question("Trust this folder? [Y/n] ")).trim().toLowerCase();
+        const trusted = answer === "" || answer === "y" || answer === "yes";
+        if (trusted)
+            trustRepoConfig(cwd, raw);
+        say(chalk.dim(trusted
+            ? "Trusted. Any change to these settings will ask again.\n"
+            : "Not trusted: these settings stay off this session.\n"));
+        return trusted;
+    }
+    finally {
+        rl.close();
+    }
+}

package/dist/permissions/trust.d.ts

@@ -0,0 +1,26 @@
+export interface PermissionTrustOptions {
+    bubbleHome?: string;
+}
+/** Parsed contents of the two repository settings files (null when absent). */
+export interface RepoSettingsRaw {
+    project: unknown;
+    local: unknown;
+}
+export interface RepoCapabilities {
+    allow: string[];
+    mcpServers: string[];
+    /** LSP server ids whose definition carries more than an on/off switch. */
+    lspServers: string[];
+}
+export declare function getPermissionTrustPath(options?: PermissionTrustOptions): string;
+export declare function repoCapabilities(raw: unknown): RepoCapabilities;
+/** Everything the given repository settings would enable, both scopes merged. */
+export declare function mergedRepoCapabilities(raw: RepoSettingsRaw): RepoCapabilities;
+export declare function describeRepoCapabilities(caps: RepoCapabilities): string[];
+export declare function hasRepoCapabilities(raw: RepoSettingsRaw): boolean;
+export declare function repoConfigFingerprint(cwd: string, raw: RepoSettingsRaw): string;
+/** True when the repository grants nothing, or the user trusted exactly this content. */
+export declare function isRepoConfigTrusted(cwd: string, raw: RepoSettingsRaw, options?: PermissionTrustOptions): boolean;
+export declare function trustRepoConfig(cwd: string, raw: RepoSettingsRaw, options?: PermissionTrustOptions): void;
+/** Reads both repository settings files; unparsable files count as absent. */
+export declare function readRepoSettings(cwd: string): RepoSettingsRaw;