@cdoing/core 0.1.0

package/dist/rules/manager.js

@@ -0,0 +1,279 @@
+"use strict";
+/**
+ * Rules Manager — Loads, caches, and resolves project rules.
+ *
+ * Scans rule directories in priority order and returns rules
+ * that match the current file context.
+ *
+ * Learning note: The manager uses lazy loading — rules are only
+ * read from disk when first needed, then cached until the file
+ * system changes. This prevents slow startup on large projects.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RulesManager = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const minimatch_1 = require("minimatch");
+class RulesManager {
+    /** Cached rules, indexed by source directory */
+    cache = new Map();
+    /** Working directory (project root) */
+    workingDir;
+    constructor(workingDir) {
+        this.workingDir = workingDir;
+    }
+    /**
+     * Get all rules that apply to a given file path.
+     * Rules are returned in priority order (most specific first).
+     *
+     * @param filePath - The file being edited/created (for glob matching)
+     * @returns Array of matching rules
+     */
+    getRulesForFile(filePath) {
+        const allRules = this.loadAllRules();
+        if (!filePath) {
+            // No file context — return all rules without glob restrictions
+            return allRules.filter((r) => r.globs.length === 0);
+        }
+        // Resolve to relative path for glob matching
+        const relativePath = path.isAbsolute(filePath)
+            ? path.relative(this.workingDir, filePath)
+            : filePath;
+        return allRules.filter((rule) => {
+            // Rules without globs apply to everything
+            if (rule.globs.length === 0)
+                return true;
+            // Check if any glob pattern matches the file
+            return rule.globs.some((glob) => this.matchGlob(relativePath, glob));
+        });
+    }
+    /**
+     * Get all rules formatted as a single string for the system prompt.
+     *
+     * @param filePath - Optional file context for filtering
+     * @returns Formatted rules text, or empty string if no rules
+     */
+    formatForPrompt(filePath) {
+        const rules = this.getRulesForFile(filePath);
+        if (rules.length === 0)
+            return "";
+        const sections = rules.map((rule) => {
+            const header = rule.description
+                ? `### ${rule.description}`
+                : `### Rule from ${path.basename(rule.filePath)}`;
+            const scope = rule.globs.length > 0
+                ? `_Applies to: ${rule.globs.join(", ")}_\n`
+                : "";
+            return `${header}\n${scope}\n${rule.content}`;
+        });
+        return `# Project Rules\n\n${sections.join("\n\n---\n\n")}`;
+    }
+    /**
+     * Load all rules from all sources.
+     * Results are cached — call invalidateCache() to refresh.
+     */
+    loadAllRules() {
+        const rules = [];
+        // 1. Global rules (~/.cdoing/rules/)
+        const globalDir = path.join(os.homedir(), ".cdoing", "rules");
+        rules.push(...this.loadRulesFromDir(globalDir, "global"));
+        // 2. Project rules (.cdoing/rules/)
+        const projectDir = path.join(this.workingDir, ".cdoing", "rules");
+        rules.push(...this.loadRulesFromDir(projectDir, "path-specific"));
+        return rules;
+    }
+    /**
+     * Load rules from a directory of markdown files.
+     *
+     * Learning note: Each .md file in the rules directory becomes a rule.
+     * YAML frontmatter is parsed for glob patterns and descriptions.
+     */
+    loadRulesFromDir(dir, source) {
+        // Check cache
+        const cached = this.cache.get(dir);
+        if (cached)
+            return cached;
+        const rules = [];
+        if (!fs.existsSync(dir)) {
+            this.cache.set(dir, rules);
+            return rules;
+        }
+        let entries;
+        try {
+            entries = fs.readdirSync(dir).filter((f) => f.endsWith(".md"));
+        }
+        catch {
+            this.cache.set(dir, rules);
+            return rules;
+        }
+        for (const file of entries) {
+            const filePath = path.join(dir, file);
+            try {
+                const content = fs.readFileSync(filePath, "utf-8");
+                const parsed = this.parseRuleFile(content);
+                rules.push({
+                    source,
+                    filePath,
+                    globs: parsed.globs,
+                    description: parsed.description || file.replace(/\.md$/, ""),
+                    content: parsed.content,
+                });
+            }
+            catch {
+                // Skip unreadable files
+            }
+        }
+        this.cache.set(dir, rules);
+        return rules;
+    }
+    /**
+     * Parse a rule markdown file, extracting frontmatter and content.
+     *
+     * Frontmatter format:
+     *   ---
+     *   globs: ["*.ts", "src/**"]
+     *   description: TypeScript coding rules
+     *   ---
+     *
+     * Learning note: We use a simple regex-based parser instead of
+     * a YAML library to avoid adding dependencies. This handles
+     * the common cases well enough.
+     */
+    parseRuleFile(raw) {
+        const frontmatterMatch = raw.match(/^---\s*\n([\s\S]*?)\n---\s*\n([\s\S]*)$/);
+        if (!frontmatterMatch) {
+            // No frontmatter — entire file is content
+            return { globs: [], description: "", content: raw.trim() };
+        }
+        const [, frontmatterStr, content] = frontmatterMatch;
+        // Simple key-value parsing for frontmatter
+        let globs = [];
+        let description = "";
+        for (const line of frontmatterStr.split("\n")) {
+            const globMatch = line.match(/^globs:\s*\[(.+)\]$/);
+            if (globMatch) {
+                // Parse glob array: ["*.ts", "src/**"]
+                globs = globMatch[1]
+                    .split(",")
+                    .map((g) => g.trim().replace(/^["']|["']$/g, ""))
+                    .filter(Boolean);
+            }
+            const globSingle = line.match(/^globs:\s*["'](.+)["']$/);
+            if (globSingle) {
+                globs = [globSingle[1]];
+            }
+            const descMatch = line.match(/^description:\s*(.+)$/);
+            if (descMatch) {
+                description = descMatch[1].trim().replace(/^["']|["']$/g, "");
+            }
+        }
+        return { globs, description, content: content.trim() };
+    }
+    /**
+     * Check if a file path matches a glob pattern.
+     * Uses minimatch for proper glob matching.
+     */
+    matchGlob(filePath, pattern) {
+        try {
+            return (0, minimatch_1.minimatch)(filePath, pattern, { matchBase: true });
+        }
+        catch {
+            // If minimatch isn't available, fall back to simple extension matching
+            if (pattern.startsWith("*.")) {
+                const ext = pattern.slice(1); // e.g., ".ts"
+                return filePath.endsWith(ext);
+            }
+            return filePath.includes(pattern);
+        }
+    }
+    /**
+     * Format rules for CLI display, showing file paths and sources.
+     */
+    formatForDisplay() {
+        const allRules = this.loadAllRules();
+        if (allRules.length === 0)
+            return "No rules defined.";
+        const globalDir = path.join(os.homedir(), ".cdoing", "rules");
+        const projectDir = path.join(this.workingDir, ".cdoing", "rules");
+        const lines = ["# Rules\n"];
+        // Group by source
+        const globalRules = allRules.filter((r) => r.source === "global");
+        const projectRules = allRules.filter((r) => r.source === "path-specific");
+        if (globalRules.length > 0) {
+            lines.push(`## Global rules (${globalDir}/)`);
+            for (const rule of globalRules) {
+                const globs = rule.globs.length > 0 ? ` [${rule.globs.join(", ")}]` : "";
+                lines.push(`  - ${rule.filePath}${globs}`);
+            }
+            lines.push("");
+        }
+        else {
+            lines.push(`## Global rules — none found`);
+            lines.push(`  Directory: ${globalDir}/`);
+            lines.push("");
+        }
+        if (projectRules.length > 0) {
+            lines.push(`## Project rules (${projectDir}/)`);
+            for (const rule of projectRules) {
+                const globs = rule.globs.length > 0 ? ` [${rule.globs.join(", ")}]` : "";
+                lines.push(`  - ${rule.filePath}${globs}`);
+            }
+            lines.push("");
+        }
+        else {
+            lines.push(`## Project rules — none found`);
+            lines.push(`  Directory: ${projectDir}/`);
+            lines.push("");
+        }
+        return lines.join("\n");
+    }
+    /**
+     * Clear the rule cache (call after file changes).
+     */
+    invalidateCache() {
+        this.cache.clear();
+    }
+    /**
+     * Update the working directory.
+     */
+    setWorkingDir(dir) {
+        this.workingDir = dir;
+        this.invalidateCache();
+    }
+}
+exports.RulesManager = RulesManager;
+//# sourceMappingURL=manager.js.map

package/dist/rules/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/rules/manager.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AACzB,yCAAsC;AAGtC,MAAa,YAAY;IACvB,gDAAgD;IACxC,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE1C,uCAAuC;IAC/B,UAAU,CAAS;IAE3B,YAAY,UAAkB;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,QAAiB;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAErC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,+DAA+D;YAC/D,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;QACtD,CAAC;QAED,6CAA6C;QAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAC5C,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC;YAC1C,CAAC,CAAC,QAAQ,CAAC;QAEb,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YAC9B,0CAA0C;YAC1C,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAEzC,6CAA6C;YAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,eAAe,CAAC,QAAiB;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAElC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAClC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW;gBAC7B,CAAC,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE;gBAC3B,CAAC,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAEpD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;gBACjC,CAAC,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;gBAC5C,CAAC,CAAC,EAAE,CAAC;YAEP,OAAO,GAAG,MAAM,KAAK,KAAK,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,OAAO,sBAAsB,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;IAC9D,CAAC;IAED;;;OAGG;IACK,YAAY;QAClB,MAAM,KAAK,GAAW,EAAE,CAAC;QAEzB,qCAAqC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC9D,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;QAE1D,oCAAoC;QACpC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAClE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC;QAElE,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACK,gBAAgB,CAAC,GAAW,EAAE,MAAkB;QACtD,cAAc;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,KAAK,GAAW,EAAE,CAAC;QAEzB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBACnD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;gBAE3C,KAAK,CAAC,IAAI,CAAC;oBACT,MAAM;oBACN,QAAQ;oBACR,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;oBAC5D,OAAO,EAAE,MAAM,CAAC,OAAO;iBACxB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,aAAa,CAAC,GAAW;QAC/B,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAE9E,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,0CAA0C;YAC1C,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7D,CAAC;QAED,MAAM,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,GAAG,gBAAgB,CAAC;QAErD,2CAA2C;QAC3C,IAAI,KAAK,GAAa,EAAE,CAAC;QACzB,IAAI,WAAW,GAAG,EAAE,CAAC;QAErB,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACpD,IAAI,SAAS,EAAE,CAAC;gBACd,uCAAuC;gBACvC,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC;qBACjB,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;qBAChD,MAAM,CAAC,OAAO,CAAC,CAAC;YACrB,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;YACzD,IAAI,UAAU,EAAE,CAAC;gBACf,KAAK,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1B,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;YACtD,IAAI,SAAS,EAAE,CAAC;gBACd,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IACzD,CAAC;IAED;;;OAGG;IACK,SAAS,CAAC,QAAgB,EAAE,OAAe;QACjD,IAAI,CAAC;YACH,OAAO,IAAA,qBAAS,EAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc;gBAC5C,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAChC,CAAC;YACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,mBAAmB,CAAC;QAEtD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAElE,MAAM,KAAK,GAAa,CAAC,WAAW,CAAC,CAAC;QAEtC,kBAAkB;QAClB,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;QAClE,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC;QAE1E,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,oBAAoB,SAAS,IAAI,CAAC,CAAC;YAC9C,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;gBAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC;YAC7C,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,gBAAgB,SAAS,GAAG,CAAC,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,qBAAqB,UAAU,IAAI,CAAC,CAAC;YAChD,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;gBAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC;YAC7C,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YAC5C,KAAK,CAAC,IAAI,CAAC,gBAAgB,UAAU,GAAG,CAAC,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,eAAe;QACb,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,GAAW;QACvB,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC;QACtB,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;CACF;AAlQD,oCAkQC"}

package/dist/rules/types.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Rule Types — Shared type definitions for the rules system.
+ *
+ * Learning note: Separating types from implementation keeps
+ * the codebase clean and prevents circular imports.
+ */
+/**
+ * A single rule definition loaded from a .md file.
+ */
+export interface Rule {
+    /** Where the rule was loaded from */
+    source: RuleSource;
+    /** Absolute path to the rule file */
+    filePath: string;
+    /** Glob patterns this rule applies to (empty = applies to all files) */
+    globs: string[];
+    /** Human-readable description of what the rule enforces */
+    description: string;
+    /** The actual rule content (markdown text) */
+    content: string;
+}
+/**
+ * Where a rule was loaded from — determines priority.
+ * path-specific > project > global
+ */
+export type RuleSource = "global" | "project" | "path-specific";
+/**
+ * Frontmatter parsed from a rule markdown file.
+ */
+export interface RuleFrontmatter {
+    globs?: string | string[];
+    description?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/rules/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/rules/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,qCAAqC;IACrC,MAAM,EAAE,UAAU,CAAC;IAEnB,qCAAqC;IACrC,QAAQ,EAAE,MAAM,CAAC;IAEjB,wEAAwE;IACxE,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB,2DAA2D;IAC3D,WAAW,EAAE,MAAM,CAAC;IAEpB,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,eAAe,CAAC;AAEhE;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}

package/dist/rules/types.js

@@ -0,0 +1,9 @@
+"use strict";
+/**
+ * Rule Types — Shared type definitions for the rules system.
+ *
+ * Learning note: Separating types from implementation keeps
+ * the codebase clean and prevents circular imports.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/rules/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/rules/types.ts"],"names":[],"mappings":";AAAA;;;;;GAKG"}

package/dist/sandbox/filesystem.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Sandbox Filesystem — checks read/write access against sandbox rules.
+ */
+import type { SandboxConfig, SandboxCheckResult } from "./types";
+/**
+ * Check whether reading a file is allowed by sandbox rules.
+ * Only blocks paths listed in denyRead.
+ */
+export declare function checkReadAccess(filePath: string, config: SandboxConfig, workingDir: string, projectDir: string): SandboxCheckResult;
+/**
+ * Check whether writing to a file is allowed by sandbox rules.
+ * DenyWrite takes priority, then path must be within workingDir or allowWrite paths.
+ */
+export declare function checkWriteAccess(filePath: string, config: SandboxConfig, workingDir: string, projectDir: string): SandboxCheckResult;
+/**
+ * Best-effort heuristic: parse a shell command to detect read/write targets.
+ * Returns denied if any detected target violates sandbox rules.
+ */
+export declare function checkShellCommandPaths(command: string, config: SandboxConfig, workingDir: string, projectDir: string): SandboxCheckResult;
+//# sourceMappingURL=filesystem.d.ts.map

package/dist/sandbox/filesystem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem.d.ts","sourceRoot":"","sources":["../../src/sandbox/filesystem.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAEjE;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,aAAa,EACrB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,kBAAkB,CAYpB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,aAAa,EACrB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,kBAAkB,CA0BpB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,aAAa,EACrB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,kBAAkB,CAoBpB"}

package/dist/sandbox/filesystem.js

@@ -0,0 +1,141 @@
+"use strict";
+/**
+ * Sandbox Filesystem — checks read/write access against sandbox rules.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkReadAccess = checkReadAccess;
+exports.checkWriteAccess = checkWriteAccess;
+exports.checkShellCommandPaths = checkShellCommandPaths;
+const path = __importStar(require("path"));
+const path_matching_1 = require("../utils/path-matching");
+/**
+ * Check whether reading a file is allowed by sandbox rules.
+ * Only blocks paths listed in denyRead.
+ */
+function checkReadAccess(filePath, config, workingDir, projectDir) {
+    if (!config.enabled)
+        return { allowed: true };
+    const resolved = path.resolve(filePath);
+    for (const deny of config.filesystem.denyRead) {
+        if ((0, path_matching_1.matchPath)(resolved, deny, projectDir, workingDir)) {
+            return { allowed: false, reason: `Sandbox: read access denied for ${resolved} (matches denyRead rule "${deny}")` };
+        }
+    }
+    return { allowed: true };
+}
+/**
+ * Check whether writing to a file is allowed by sandbox rules.
+ * DenyWrite takes priority, then path must be within workingDir or allowWrite paths.
+ */
+function checkWriteAccess(filePath, config, workingDir, projectDir) {
+    if (!config.enabled)
+        return { allowed: true };
+    const resolved = path.resolve(filePath);
+    const normalizedWorkingDir = path.resolve(workingDir);
+    // Check denyWrite first (deny always wins)
+    for (const deny of config.filesystem.denyWrite) {
+        if ((0, path_matching_1.matchPath)(resolved, deny, projectDir, workingDir)) {
+            return { allowed: false, reason: `Sandbox: write access denied for ${resolved} (matches denyWrite rule "${deny}")` };
+        }
+    }
+    // Allow writes within workingDir
+    if (resolved === normalizedWorkingDir || resolved.startsWith(normalizedWorkingDir + path.sep)) {
+        return { allowed: true };
+    }
+    // Check allowWrite paths
+    for (const allow of config.filesystem.allowWrite) {
+        if ((0, path_matching_1.matchPath)(resolved, allow, projectDir, workingDir)) {
+            return { allowed: true };
+        }
+    }
+    return { allowed: false, reason: `Sandbox: write access denied for ${resolved} (outside working directory and not in allowWrite)` };
+}
+/**
+ * Best-effort heuristic: parse a shell command to detect read/write targets.
+ * Returns denied if any detected target violates sandbox rules.
+ */
+function checkShellCommandPaths(command, config, workingDir, projectDir) {
+    if (!config.enabled)
+        return { allowed: true };
+    // Detect write targets: >, >>, tee
+    const writeTargets = extractWriteTargets(command);
+    for (const target of writeTargets) {
+        const resolved = path.isAbsolute(target) ? target : path.resolve(workingDir, target);
+        const check = checkWriteAccess(resolved, config, workingDir, projectDir);
+        if (!check.allowed)
+            return check;
+    }
+    // Detect read targets: cat, less, head, tail, more
+    const readTargets = extractReadTargets(command);
+    for (const target of readTargets) {
+        const resolved = path.isAbsolute(target) ? target : path.resolve(workingDir, target);
+        const check = checkReadAccess(resolved, config, workingDir, projectDir);
+        if (!check.allowed)
+            return check;
+    }
+    return { allowed: true };
+}
+/** Extract file paths that appear as write targets in a shell command */
+function extractWriteTargets(command) {
+    const targets = [];
+    // Match >> or > followed by optional space and a file path
+    const redirectRegex = />{1,2}\s*([^\s;|&]+)/g;
+    let match;
+    while ((match = redirectRegex.exec(command)) !== null) {
+        targets.push(match[1]);
+    }
+    // Match tee followed by optional flags and file path
+    const teeRegex = /\btee\s+(?:-[a-zA-Z]\s+)*([^\s;|&]+)/g;
+    while ((match = teeRegex.exec(command)) !== null) {
+        targets.push(match[1]);
+    }
+    return targets;
+}
+/** Extract file paths that appear as read targets in a shell command */
+function extractReadTargets(command) {
+    const targets = [];
+    // Match cat, less, head, tail, more followed by optional flags and file path
+    const readRegex = /\b(?:cat|less|head|tail|more)\s+(?:-[a-zA-Z0-9]+\s+)*([^\s;|&]+)/g;
+    let match;
+    while ((match = readRegex.exec(command)) !== null) {
+        // Skip if it looks like a flag
+        if (!match[1].startsWith("-")) {
+            targets.push(match[1]);
+        }
+    }
+    return targets;
+}
+//# sourceMappingURL=filesystem.js.map

package/dist/sandbox/filesystem.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem.js","sourceRoot":"","sources":["../../src/sandbox/filesystem.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUH,0CAiBC;AAMD,4CA+BC;AAMD,wDAyBC;AA7FD,2CAA6B;AAC7B,0DAAmD;AAGnD;;;GAGG;AACH,SAAgB,eAAe,CAC7B,QAAgB,EAChB,MAAqB,EACrB,UAAkB,EAClB,UAAkB;IAElB,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAE9C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAExC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC9C,IAAI,IAAA,yBAAS,EAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;YACtD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,QAAQ,4BAA4B,IAAI,IAAI,EAAE,CAAC;QACrH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAC9B,QAAgB,EAChB,MAAqB,EACrB,UAAkB,EAClB,UAAkB;IAElB,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAE9C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,oBAAoB,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAEtD,2CAA2C;IAC3C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;QAC/C,IAAI,IAAA,yBAAS,EAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;YACtD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,QAAQ,6BAA6B,IAAI,IAAI,EAAE,CAAC;QACvH,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,IAAI,QAAQ,KAAK,oBAAoB,IAAI,QAAQ,CAAC,UAAU,CAAC,oBAAoB,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,yBAAyB;IACzB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QACjD,IAAI,IAAA,yBAAS,EAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;YACvD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,QAAQ,oDAAoD,EAAE,CAAC;AACtI,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB,CACpC,OAAe,EACf,MAAqB,EACrB,UAAkB,EAClB,UAAkB;IAElB,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAE9C,mCAAmC;IACnC,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAClD,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACrF,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;IACnC,CAAC;IAED,mDAAmD;IACnD,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAChD,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACrF,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QACxE,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;IACnC,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,yEAAyE;AACzE,SAAS,mBAAmB,CAAC,OAAe;IAC1C,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,2DAA2D;IAC3D,MAAM,aAAa,GAAG,uBAAuB,CAAC;IAC9C,IAAI,KAAK,CAAC;IACV,OAAO,CAAC,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAED,qDAAqD;IACrD,MAAM,QAAQ,GAAG,uCAAuC,CAAC;IACzD,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,wEAAwE;AACxE,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,6EAA6E;IAC7E,MAAM,SAAS,GAAG,mEAAmE,CAAC;IACtF,IAAI,KAAK,CAAC;IACV,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAClD,+BAA+B;QAC/B,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/sandbox/index.d.ts

@@ -0,0 +1,4 @@
+export { SandboxManager } from "./manager";
+export type { SandboxConfig, SandboxMode, SandboxFilesystemConfig, SandboxNetworkConfig, SandboxCheckResult, } from "./types";
+export { defaultSandboxConfig } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/sandbox/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,YAAY,EACV,aAAa,EACb,WAAW,EACX,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC"}

package/dist/sandbox/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultSandboxConfig = exports.SandboxManager = void 0;
+var manager_1 = require("./manager");
+Object.defineProperty(exports, "SandboxManager", { enumerable: true, get: function () { return manager_1.SandboxManager; } });
+var types_1 = require("./types");
+Object.defineProperty(exports, "defaultSandboxConfig", { enumerable: true, get: function () { return types_1.defaultSandboxConfig; } });
+//# sourceMappingURL=index.js.map

package/dist/sandbox/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":";;;AAAA,qCAA2C;AAAlC,yGAAA,cAAc,OAAA;AAQvB,iCAA+C;AAAtC,6GAAA,oBAAoB,OAAA"}

package/dist/sandbox/manager.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Sandbox Manager — orchestrates filesystem and network sandbox enforcement.
+ *
+ * Loads sandbox configuration from .claude/settings.json files using the
+ * same hierarchy as the permission system (local → shared → user).
+ */
+import type { SandboxConfig, SandboxCheckResult, SandboxMode } from "./types";
+export declare class SandboxManager {
+    private config;
+    private workingDir;
+    private projectDir;
+    private sessionApprovedDomains;
+    private domainPromptFn;
+    constructor(workingDir: string, projectDir?: string);
+    /**
+     * Load and merge sandbox config from settings files.
+     * Precedence: local project → shared project → user (highest to lowest).
+     * Arrays are merged (not replaced) across scopes.
+     */
+    loadConfig(): void;
+    getConfig(): Readonly<SandboxConfig>;
+    isEnabled(): boolean;
+    getMode(): SandboxMode;
+    setDomainPromptFn(fn: (domain: string) => Promise<boolean>): void;
+    approveDomain(domain: string): void;
+    checkFileRead(filePath: string): SandboxCheckResult;
+    checkFileWrite(filePath: string): SandboxCheckResult;
+    /**
+     * Check if a shell command is allowed by sandbox rules.
+     * Returns denied if dangerouslyDisableSandbox is used but not allowed.
+     */
+    checkShellCommand(command: string, dangerouslyDisableSandbox?: boolean): SandboxCheckResult;
+    /**
+     * Check if network access to a URL is allowed.
+     * If the domain needs user approval, triggers the domain prompt.
+     */
+    checkNetworkAccess(url: string): Promise<SandboxCheckResult>;
+    /**
+     * Check if a command prefix matches any excluded command.
+     */
+    isExcludedCommand(command: string): boolean;
+    /**
+     * Get a sandboxed environment for shell command execution.
+     */
+    getShellEnv(): NodeJS.ProcessEnv;
+}
+//# sourceMappingURL=manager.d.ts.map

package/dist/sandbox/manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/sandbox/manager.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAQ9E,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,sBAAsB,CAAqB;IACnD,OAAO,CAAC,cAAc,CAAuD;gBAEjE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;IASnD;;;;OAIG;IACH,UAAU,IAAI,IAAI;IA0ElB,SAAS,IAAI,QAAQ,CAAC,aAAa,CAAC;IAIpC,SAAS,IAAI,OAAO;IAIpB,OAAO,IAAI,WAAW;IAItB,iBAAiB,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI;IAIjE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAMnC,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,kBAAkB;IAInD,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,kBAAkB;IAIpD;;;OAGG;IACH,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,yBAAyB,CAAC,EAAE,OAAO,GAAG,kBAAkB;IAwB3F;;;OAGG;IACG,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAkBlE;;OAEG;IACH,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAU3C;;OAEG;IACH,WAAW,IAAI,MAAM,CAAC,UAAU;CAGjC"}