@code-yeongyu/senpi 0.74.0

package/dist/core/extensions/builtin/openai-web-search/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/openai-web-search/index.ts"],"names":[],"mappings":"AAKA,MAAM,qBAAqB,GAAqB,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,wBAAwB,CAAC,CAAC,CAAC;AACxG,MAAM,UAAU,GAAG,sBAAsB,CAAC;AAC1C,MAAM,6BAA6B,GAAG,oBAAoB,CAAC;AAE3D,SAAS,cAAc,CAAC,MAAc,EAAW;IAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;QACjG,OAAO,KAAK,CAAC;IACd,CAAC;IAED,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QAChG,OAAO,IAAI,CAAC;IACb,CAAC;IAED,mDAAmD;IACnD,OAAO,IAAI,CAAC;AAAA,CACZ;AAED,SAAS,QAAQ,CAAC,KAAc,EAAoC;IACnE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AAAA,CACnD;AAED,SAAS,oBAAoB,CAAC,GAAoB,EAAwD;IACzG,OAAO,GAAG,KAAK,SAAS,IAAI,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAAA,CAC3D;AAED,SAAS,2BAA2B,CAAC,KAAc,EAAmE;IACrH,OAAO,KAAK,KAAK,oBAAoB,IAAI,KAAK,KAAK,+BAA+B,CAAC;AAAA,CACnF;AAED,SAAS,0BAA0B,CAAC,KAAc,EAAW;IAC5D,OAAO,CACN,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,KAAK,KAAK,YAAY,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAC3D,CAAC,2BAA2B,CAAC,KAAK,CAAC,CACnC,CAAC;AAAA,CACF;AAED,SAAS,uBAAuB,CAAC,KAAc,EAAW;IACzD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AAAA,CACnE;AAWD,SAAS,aAAa,CAAC,KAAgB,EAAE,OAA6B,EAAkB;IACvF,MAAM,SAAS,GAAqB,EAAE,CAAC;IACvC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACV,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,MAAM,0BAA0B,GAC/B,OAAO,CAAC,sBAAsB,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACpG,MAAM,gCAAgC,GAAG,0BAA0B,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAC3G,IAAI,0BAA0B,IAAI,gCAAgC,EAAE,CAAC;YACpE,OAAO,GAAG,IAAI,CAAC;QAChB,CAAC;aAAM,CAAC;YACP,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAAA,CACrC;AAED,MAAM,UAAU,2BAA2B,CAAC,GAAoB,EAAE,OAAgB,EAAW;IAC5F,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,qBAAqB,GAAG,wBAAwB,EAAE,CAAC;IACzD,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,EAAE,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC1F,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,CAAC;IACvC,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC5B,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC;QAChB,CAAC;QAED,OAAO;YACN,GAAG,OAAO;YACV,KAAK,EAAE,cAAc;SACrB,CAAC;IACH,CAAC;IAED,MAAM,kBAAkB,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEjG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACzB,cAAc,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO;QACN,GAAG,OAAO;QACV,KAAK,EAAE,cAAc;KACrB,CAAC;AAAA,CACF;AAED,MAAM,UAAU,wBAAwB,GAAY;IACnD,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC;AAAA,CAClC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;;;CAMxC,CAAC;AAEF,MAAM,CAAC,OAAO,UAAU,wBAAwB,CAAC,EAAgB,EAAQ;IACxE,EAAE,CAAC,EAAE,CAAC,yBAAyB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;QAChD,OAAO,2BAA2B,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAAA,CAClE,CAAC,CAAC;IAEH,EAAE,CAAC,EAAE,CAAC,oBAAoB,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;QACjD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;YAC3C,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC;YACjC,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,OAAO;YACN,YAAY,EAAE,GAAG,KAAK,CAAC,YAAY,KAAK,yBAAyB,EAAE;SACnE,CAAC;IAAA,CACF,CAAC,CAAC;AAAA,CACH","sourcesContent":["import type { Api } from \"@earendil-works/pi-ai\";\nimport type { ExtensionAPI } from \"../../types.js\";\n\ntype ToolDefinition = Record<string, unknown>;\n\nconst OPENAI_RESPONSES_APIS: ReadonlySet<Api> = new Set([\"openai-responses\", \"azure-openai-responses\"]);\nconst ENABLE_ENV = \"PI_OPENAI_WEB_SEARCH\";\nconst NATIVE_OPENAI_WEB_SEARCH_TYPE = \"web_search_preview\";\n\nfunction parseEnableEnv(envVar: string): boolean {\n\tconst envValue = process.env[envVar];\n\tif (!envValue) {\n\t\treturn true;\n\t}\n\n\tconst normalized = envValue.trim().toLowerCase();\n\tif (normalized === \"0\" || normalized === \"false\" || normalized === \"no\" || normalized === \"off\") {\n\t\treturn false;\n\t}\n\n\tif (normalized === \"1\" || normalized === \"true\" || normalized === \"yes\" || normalized === \"on\") {\n\t\treturn true;\n\t}\n\n\t// Unknown values fall back to default-on behavior.\n\treturn true;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null;\n}\n\nfunction isOpenAiResponsesApi(api: Api | undefined): api is \"openai-responses\" | \"azure-openai-responses\" {\n\treturn api !== undefined && OPENAI_RESPONSES_APIS.has(api);\n}\n\nfunction isNativeOpenAiWebSearchType(value: unknown): value is \"web_search_preview\" | \"web_search_preview_2025_03_11\" {\n\treturn value === \"web_search_preview\" || value === \"web_search_preview_2025_03_11\";\n}\n\nfunction isUnsupportedWebSearchType(value: unknown): boolean {\n\treturn (\n\t\ttypeof value === \"string\" &&\n\t\t(value === \"web_search\" || value.startsWith(\"web_search_\")) &&\n\t\t!isNativeOpenAiWebSearchType(value)\n\t);\n}\n\nfunction isAnthropicWebFetchType(value: unknown): boolean {\n\treturn typeof value === \"string\" && value.startsWith(\"web_fetch_\");\n}\n\ntype SanitizedTools = {\n\tchanged: boolean;\n\ttools: ToolDefinition[];\n};\n\ntype SanitizeToolsOptions = {\n\tstripFunctionWebSearch: boolean;\n};\n\nfunction sanitizeTools(tools: unknown[], options: SanitizeToolsOptions): SanitizedTools {\n\tconst sanitized: ToolDefinition[] = [];\n\tlet changed = false;\n\tfor (const tool of tools) {\n\t\tif (!isRecord(tool)) {\n\t\t\tchanged = true;\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst type = tool.type;\n\t\tconst shouldStripFunctionVariant =\n\t\t\toptions.stripFunctionWebSearch && tool.name === \"web_search\" && !isNativeOpenAiWebSearchType(type);\n\t\tconst shouldStripProviderNativeVariant = isUnsupportedWebSearchType(type) || isAnthropicWebFetchType(type);\n\t\tif (shouldStripFunctionVariant || shouldStripProviderNativeVariant) {\n\t\t\tchanged = true;\n\t\t} else {\n\t\t\tsanitized.push(tool);\n\t\t}\n\t}\n\n\treturn { changed, tools: sanitized };\n}\n\nexport function addOpenAiWebSearchToPayload(api: Api | undefined, payload: unknown): unknown {\n\tif (!isOpenAiResponsesApi(api)) {\n\t\treturn payload;\n\t}\n\n\tif (!isRecord(payload)) {\n\t\treturn payload;\n\t}\n\n\tconst tools = Array.isArray(payload.tools) ? payload.tools : [];\n\tconst shouldInjectWebSearch = isOpenaiWebSearchEnabled();\n\tconst sanitized = sanitizeTools(tools, { stripFunctionWebSearch: shouldInjectWebSearch });\n\tconst sanitizedTools = sanitized.tools;\n\tif (!shouldInjectWebSearch) {\n\t\tif (!sanitized.changed) {\n\t\t\treturn payload;\n\t\t}\n\n\t\treturn {\n\t\t\t...payload,\n\t\t\ttools: sanitizedTools,\n\t\t};\n\t}\n\n\tconst hasNativeWebSearch = sanitizedTools.some((tool) => isNativeOpenAiWebSearchType(tool.type));\n\n\tif (!hasNativeWebSearch) {\n\t\tsanitizedTools.push({ type: NATIVE_OPENAI_WEB_SEARCH_TYPE });\n\t}\n\n\treturn {\n\t\t...payload,\n\t\ttools: sanitizedTools,\n\t};\n}\n\nexport function isOpenaiWebSearchEnabled(): boolean {\n\treturn parseEnableEnv(ENABLE_ENV);\n}\n\nexport const OPENAI_WEB_SEARCH_SECTION = `\n## Web Search\n\nNative web search is available in this session.\nUse web search when the user asks for current or online information.\nPrefer web search over guessing when freshness matters.\n`;\n\nexport default function openaiWebSearchExtension(pi: ExtensionAPI): void {\n\tpi.on(\"before_provider_request\", (event, ctx) => {\n\t\treturn addOpenAiWebSearchToPayload(ctx.model?.api, event.payload);\n\t});\n\n\tpi.on(\"before_agent_start\", async (event, ctx) => {\n\t\tif (!isOpenAiResponsesApi(ctx.model?.api)) {\n\t\t\treturn undefined;\n\t\t}\n\n\t\tif (!isOpenaiWebSearchEnabled()) {\n\t\t\treturn undefined;\n\t\t}\n\n\t\treturn {\n\t\t\tsystemPrompt: `${event.systemPrompt}\\n${OPENAI_WEB_SEARCH_SECTION}`,\n\t\t};\n\t});\n}\n"]}

package/dist/core/extensions/builtin/permission-system/arity.d.ts

@@ -0,0 +1,4 @@
+export declare namespace BashArity {
+    function prefix(tokens: string[]): string[];
+}
+//# sourceMappingURL=arity.d.ts.map

package/dist/core/extensions/builtin/permission-system/arity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"arity.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/permission-system/arity.ts"],"names":[],"mappings":"AAAA,yBAAiB,SAAS,CAAC,CAAC;IAC3B,SAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,YAQtC;CAyJD","sourcesContent":["export namespace BashArity {\n\texport function prefix(tokens: string[]) {\n\t\tfor (let len = tokens.length; len > 0; len--) {\n\t\t\tconst prefix = tokens.slice(0, len).join(\" \");\n\t\t\tconst arity = ARITY[prefix];\n\t\t\tif (arity !== undefined) return tokens.slice(0, arity);\n\t\t}\n\t\tif (tokens.length === 0) return [];\n\t\treturn tokens.slice(0, 1);\n\t}\n\n\t/* Generated with following prompt:\nYou are generating a dictionary of command-prefix arities for bash-style commands.\nThis dictionary is used to identify the \"human-understandable command\" from an input shell command.### **RULES (follow strictly)**1. Each entry maps a **command prefix string → number**, representing how many **tokens** define the command.\n2. **Flags NEVER count as tokens**. Only subcommands count.\n3. **Longest matching prefix wins**.\n4. **Only include a longer prefix if its arity is different from what the shorter prefix already implies**.   * Example: If `git` is 2, then do **not** include `git checkout`, `git commit`, etc. unless they require *different* arity.\n5. The output must be a **single JSON object**. Each entry should have a comment with an example real world matching command. DO NOT MAKE ANY OTHER COMMENTS. Should be alphabetical\n6. Include the **most commonly used commands** across many stacks and languages. More is better.### **Semantics examples*** `touch foo.txt` → `touch` (arity 1, explicitly listed)\n* `git checkout main` → `git checkout` (because `git` has arity 2)\n* `npm install` → `npm install` (because `npm` has arity 2)\n* `npm run dev` → `npm run dev` (because `npm run` has arity 3)\n* `python script.py` → `python script.py` (default: whole input, not in dictionary)### **Now generate the dictionary.**\n*/\n\tconst ARITY: Record<string, number> = {\n\t\tcat: 1, // cat file.txt\n\t\tcd: 1, // cd /path/to/dir\n\t\tchmod: 1, // chmod 755 script.sh\n\t\tchown: 1, // chown user:group file.txt\n\t\tcp: 1, // cp source.txt dest.txt\n\t\techo: 1, // echo \"hello world\"\n\t\tenv: 1, // env\n\t\texport: 1, // export PATH=/usr/bin\n\t\tgrep: 1, // grep pattern file.txt\n\t\tkill: 1, // kill 1234\n\t\tkillall: 1, // killall process\n\t\tln: 1, // ln -s source target\n\t\tls: 1, // ls -la\n\t\tmkdir: 1, // mkdir new-dir\n\t\tmv: 1, // mv old.txt new.txt\n\t\tps: 1, // ps aux\n\t\tpwd: 1, // pwd\n\t\trm: 1, // rm file.txt\n\t\trmdir: 1, // rmdir empty-dir\n\t\tsleep: 1, // sleep 5\n\t\tsource: 1, // source ~/.bashrc\n\t\ttail: 1, // tail -f log.txt\n\t\ttouch: 1, // touch file.txt\n\t\tunset: 1, // unset VAR\n\t\twhich: 1, // which node\n\t\taws: 3, // aws s3 ls\n\t\taz: 3, // az storage blob list\n\t\tbazel: 2, // bazel build\n\t\tbrew: 2, // brew install node\n\t\tbun: 2, // bun install\n\t\t\"bun run\": 3, // bun run dev\n\t\t\"bun x\": 3, // bun x vite\n\t\tcargo: 2, // cargo build\n\t\t\"cargo add\": 3, // cargo add tokio\n\t\t\"cargo run\": 3, // cargo run main\n\t\tcdk: 2, // cdk deploy\n\t\tcf: 2, // cf push app\n\t\tcmake: 2, // cmake build\n\t\tcomposer: 2, // composer require laravel\n\t\tconsul: 2, // consul members\n\t\t\"consul kv\": 3, // consul kv get config/app\n\t\tcrictl: 2, // crictl ps\n\t\tdeno: 2, // deno run server.ts\n\t\t\"deno task\": 3, // deno task dev\n\t\tdoctl: 3, // doctl kubernetes cluster list\n\t\tdocker: 2, // docker run nginx\n\t\t\"docker builder\": 3, // docker builder prune\n\t\t\"docker compose\": 3, // docker compose up\n\t\t\"docker container\": 3, // docker container ls\n\t\t\"docker image\": 3, // docker image prune\n\t\t\"docker network\": 3, // docker network inspect\n\t\t\"docker volume\": 3, // docker volume ls\n\t\teksctl: 2, // eksctl get clusters\n\t\t\"eksctl create\": 3, // eksctl create cluster\n\t\tfirebase: 2, // firebase deploy\n\t\tflyctl: 2, // flyctl deploy\n\t\tgcloud: 3, // gcloud compute instances list\n\t\tgh: 3, // gh pr list\n\t\tgit: 2, // git checkout main\n\t\t\"git config\": 3, // git config user.name\n\t\t\"git remote\": 3, // git remote add origin\n\t\t\"git stash\": 3, // git stash pop\n\t\tgo: 2, // go build\n\t\tgradle: 2, // gradle build\n\t\thelm: 2, // helm install mychart\n\t\theroku: 2, // heroku logs\n\t\thugo: 2, // hugo new site blog\n\t\tip: 2, // ip link show\n\t\t\"ip addr\": 3, // ip addr show\n\t\t\"ip link\": 3, // ip link set eth0 up\n\t\t\"ip netns\": 3, // ip netns exec foo bash\n\t\t\"ip route\": 3, // ip route add default via 1.1.1.1\n\t\tkind: 2, // kind delete cluster\n\t\t\"kind create\": 3, // kind create cluster\n\t\tkubectl: 2, // kubectl get pods\n\t\t\"kubectl kustomize\": 3, // kubectl kustomize overlays/dev\n\t\t\"kubectl rollout\": 3, // kubectl rollout restart deploy/api\n\t\tkustomize: 2, // kustomize build .\n\t\tmake: 2, // make build\n\t\tmc: 2, // mc ls myminio\n\t\t\"mc admin\": 3, // mc admin info myminio\n\t\tminikube: 2, // minikube start\n\t\tmongosh: 2, // mongosh test\n\t\tmysql: 2, // mysql -u root\n\t\tmvn: 2, // mvn compile\n\t\tng: 2, // ng generate component home\n\t\tnpm: 2, // npm install\n\t\t\"npm exec\": 3, // npm exec vite\n\t\t\"npm init\": 3, // npm init vue\n\t\t\"npm run\": 3, // npm run dev\n\t\t\"npm view\": 3, // npm view react version\n\t\tnvm: 2, // nvm use 18\n\t\tnx: 2, // nx build\n\t\topenssl: 2, // openssl genrsa 2048\n\t\t\"openssl req\": 3, // openssl req -new -key key.pem\n\t\t\"openssl x509\": 3, // openssl x509 -in cert.pem\n\t\tpip: 2, // pip install numpy\n\t\tpipenv: 2, // pipenv install flask\n\t\tpnpm: 2, // pnpm install\n\t\t\"pnpm dlx\": 3, // pnpm dlx create-next-app\n\t\t\"pnpm exec\": 3, // pnpm exec vite\n\t\t\"pnpm run\": 3, // pnpm run dev\n\t\tpoetry: 2, // poetry add requests\n\t\tpodman: 2, // podman run alpine\n\t\t\"podman container\": 3, // podman container ls\n\t\t\"podman image\": 3, // podman image prune\n\t\tpsql: 2, // psql -d mydb\n\t\tpulumi: 2, // pulumi up\n\t\t\"pulumi stack\": 3, // pulumi stack output\n\t\tpyenv: 2, // pyenv install 3.11\n\t\tpython: 2, // python -m venv env\n\t\trake: 2, // rake db:migrate\n\t\trbenv: 2, // rbenv install 3.2.0\n\t\t\"redis-cli\": 2, // redis-cli ping\n\t\trustup: 2, // rustup update\n\t\tserverless: 2, // serverless invoke\n\t\tsfdx: 3, // sfdx force:org:list\n\t\tskaffold: 2, // skaffold dev\n\t\tsls: 2, // sls deploy\n\t\tsst: 2, // sst deploy\n\t\tswift: 2, // swift build\n\t\tsystemctl: 2, // systemctl restart nginx\n\t\tterraform: 2, // terraform apply\n\t\t\"terraform workspace\": 3, // terraform workspace select prod\n\t\ttmux: 2, // tmux new -s dev\n\t\tturbo: 2, // turbo run build\n\t\tufw: 2, // ufw allow 22\n\t\tvault: 2, // vault login\n\t\t\"vault auth\": 3, // vault auth list\n\t\t\"vault kv\": 3, // vault kv get secret/api\n\t\tvercel: 2, // vercel deploy\n\t\tvolta: 2, // volta install node\n\t\twp: 2, // wp plugin install\n\t\tyarn: 2, // yarn add react\n\t\t\"yarn dlx\": 3, // yarn dlx create-react-app\n\t\t\"yarn run\": 3, // yarn run dev\n\t};\n}\n"]}

package/dist/core/extensions/builtin/permission-system/arity.js

@@ -0,0 +1,168 @@
+export { BashArity };
+var BashArity;
+(function (BashArity) {
+    function prefix(tokens) {
+        for (let len = tokens.length; len > 0; len--) {
+            const prefix = tokens.slice(0, len).join(" ");
+            const arity = ARITY[prefix];
+            if (arity !== undefined)
+                return tokens.slice(0, arity);
+        }
+        if (tokens.length === 0)
+            return [];
+        return tokens.slice(0, 1);
+    }
+    BashArity.prefix = prefix;
+    /* Generated with following prompt:
+    You are generating a dictionary of command-prefix arities for bash-style commands.
+    This dictionary is used to identify the "human-understandable command" from an input shell command.### **RULES (follow strictly)**1. Each entry maps a **command prefix string → number**, representing how many **tokens** define the command.
+    2. **Flags NEVER count as tokens**. Only subcommands count.
+    3. **Longest matching prefix wins**.
+    4. **Only include a longer prefix if its arity is different from what the shorter prefix already implies**.   * Example: If `git` is 2, then do **not** include `git checkout`, `git commit`, etc. unless they require *different* arity.
+    5. The output must be a **single JSON object**. Each entry should have a comment with an example real world matching command. DO NOT MAKE ANY OTHER COMMENTS. Should be alphabetical
+    6. Include the **most commonly used commands** across many stacks and languages. More is better.### **Semantics examples*** `touch foo.txt` → `touch` (arity 1, explicitly listed)
+    * `git checkout main` → `git checkout` (because `git` has arity 2)
+    * `npm install` → `npm install` (because `npm` has arity 2)
+    * `npm run dev` → `npm run dev` (because `npm run` has arity 3)
+    * `python script.py` → `python script.py` (default: whole input, not in dictionary)### **Now generate the dictionary.**
+    */
+    const ARITY = {
+        cat: 1, // cat file.txt
+        cd: 1, // cd /path/to/dir
+        chmod: 1, // chmod 755 script.sh
+        chown: 1, // chown user:group file.txt
+        cp: 1, // cp source.txt dest.txt
+        echo: 1, // echo "hello world"
+        env: 1, // env
+        export: 1, // export PATH=/usr/bin
+        grep: 1, // grep pattern file.txt
+        kill: 1, // kill 1234
+        killall: 1, // killall process
+        ln: 1, // ln -s source target
+        ls: 1, // ls -la
+        mkdir: 1, // mkdir new-dir
+        mv: 1, // mv old.txt new.txt
+        ps: 1, // ps aux
+        pwd: 1, // pwd
+        rm: 1, // rm file.txt
+        rmdir: 1, // rmdir empty-dir
+        sleep: 1, // sleep 5
+        source: 1, // source ~/.bashrc
+        tail: 1, // tail -f log.txt
+        touch: 1, // touch file.txt
+        unset: 1, // unset VAR
+        which: 1, // which node
+        aws: 3, // aws s3 ls
+        az: 3, // az storage blob list
+        bazel: 2, // bazel build
+        brew: 2, // brew install node
+        bun: 2, // bun install
+        "bun run": 3, // bun run dev
+        "bun x": 3, // bun x vite
+        cargo: 2, // cargo build
+        "cargo add": 3, // cargo add tokio
+        "cargo run": 3, // cargo run main
+        cdk: 2, // cdk deploy
+        cf: 2, // cf push app
+        cmake: 2, // cmake build
+        composer: 2, // composer require laravel
+        consul: 2, // consul members
+        "consul kv": 3, // consul kv get config/app
+        crictl: 2, // crictl ps
+        deno: 2, // deno run server.ts
+        "deno task": 3, // deno task dev
+        doctl: 3, // doctl kubernetes cluster list
+        docker: 2, // docker run nginx
+        "docker builder": 3, // docker builder prune
+        "docker compose": 3, // docker compose up
+        "docker container": 3, // docker container ls
+        "docker image": 3, // docker image prune
+        "docker network": 3, // docker network inspect
+        "docker volume": 3, // docker volume ls
+        eksctl: 2, // eksctl get clusters
+        "eksctl create": 3, // eksctl create cluster
+        firebase: 2, // firebase deploy
+        flyctl: 2, // flyctl deploy
+        gcloud: 3, // gcloud compute instances list
+        gh: 3, // gh pr list
+        git: 2, // git checkout main
+        "git config": 3, // git config user.name
+        "git remote": 3, // git remote add origin
+        "git stash": 3, // git stash pop
+        go: 2, // go build
+        gradle: 2, // gradle build
+        helm: 2, // helm install mychart
+        heroku: 2, // heroku logs
+        hugo: 2, // hugo new site blog
+        ip: 2, // ip link show
+        "ip addr": 3, // ip addr show
+        "ip link": 3, // ip link set eth0 up
+        "ip netns": 3, // ip netns exec foo bash
+        "ip route": 3, // ip route add default via 1.1.1.1
+        kind: 2, // kind delete cluster
+        "kind create": 3, // kind create cluster
+        kubectl: 2, // kubectl get pods
+        "kubectl kustomize": 3, // kubectl kustomize overlays/dev
+        "kubectl rollout": 3, // kubectl rollout restart deploy/api
+        kustomize: 2, // kustomize build .
+        make: 2, // make build
+        mc: 2, // mc ls myminio
+        "mc admin": 3, // mc admin info myminio
+        minikube: 2, // minikube start
+        mongosh: 2, // mongosh test
+        mysql: 2, // mysql -u root
+        mvn: 2, // mvn compile
+        ng: 2, // ng generate component home
+        npm: 2, // npm install
+        "npm exec": 3, // npm exec vite
+        "npm init": 3, // npm init vue
+        "npm run": 3, // npm run dev
+        "npm view": 3, // npm view react version
+        nvm: 2, // nvm use 18
+        nx: 2, // nx build
+        openssl: 2, // openssl genrsa 2048
+        "openssl req": 3, // openssl req -new -key key.pem
+        "openssl x509": 3, // openssl x509 -in cert.pem
+        pip: 2, // pip install numpy
+        pipenv: 2, // pipenv install flask
+        pnpm: 2, // pnpm install
+        "pnpm dlx": 3, // pnpm dlx create-next-app
+        "pnpm exec": 3, // pnpm exec vite
+        "pnpm run": 3, // pnpm run dev
+        poetry: 2, // poetry add requests
+        podman: 2, // podman run alpine
+        "podman container": 3, // podman container ls
+        "podman image": 3, // podman image prune
+        psql: 2, // psql -d mydb
+        pulumi: 2, // pulumi up
+        "pulumi stack": 3, // pulumi stack output
+        pyenv: 2, // pyenv install 3.11
+        python: 2, // python -m venv env
+        rake: 2, // rake db:migrate
+        rbenv: 2, // rbenv install 3.2.0
+        "redis-cli": 2, // redis-cli ping
+        rustup: 2, // rustup update
+        serverless: 2, // serverless invoke
+        sfdx: 3, // sfdx force:org:list
+        skaffold: 2, // skaffold dev
+        sls: 2, // sls deploy
+        sst: 2, // sst deploy
+        swift: 2, // swift build
+        systemctl: 2, // systemctl restart nginx
+        terraform: 2, // terraform apply
+        "terraform workspace": 3, // terraform workspace select prod
+        tmux: 2, // tmux new -s dev
+        turbo: 2, // turbo run build
+        ufw: 2, // ufw allow 22
+        vault: 2, // vault login
+        "vault auth": 3, // vault auth list
+        "vault kv": 3, // vault kv get secret/api
+        vercel: 2, // vercel deploy
+        volta: 2, // volta install node
+        wp: 2, // wp plugin install
+        yarn: 2, // yarn add react
+        "yarn dlx": 3, // yarn dlx create-react-app
+        "yarn run": 3, // yarn run dev
+    };
+})(BashArity || (BashArity = {}));
+//# sourceMappingURL=arity.js.map

package/dist/core/extensions/builtin/permission-system/arity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arity.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/permission-system/arity.ts"],"names":[],"mappings":"SAAiB,SAAS;AAA1B,IAAiB,SAkKhB;AAlKD,WAAiB,SAAS,EAAC;IAC1B,SAAgB,MAAM,CAAC,MAAgB,EAAE;QACxC,KAAK,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YAC5B,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAAA,CAC1B;IARe,UAAA,MAAM,SAQrB,CAAA;IAED;;;;;;;;;;;;MAYC;IACD,MAAM,KAAK,GAA2B;QACrC,GAAG,EAAE,CAAC,EAAE,eAAe;QACvB,EAAE,EAAE,CAAC,EAAE,kBAAkB;QACzB,KAAK,EAAE,CAAC,EAAE,sBAAsB;QAChC,KAAK,EAAE,CAAC,EAAE,4BAA4B;QACtC,EAAE,EAAE,CAAC,EAAE,yBAAyB;QAChC,IAAI,EAAE,CAAC,EAAE,qBAAqB;QAC9B,GAAG,EAAE,CAAC,EAAE,MAAM;QACd,MAAM,EAAE,CAAC,EAAE,uBAAuB;QAClC,IAAI,EAAE,CAAC,EAAE,wBAAwB;QACjC,IAAI,EAAE,CAAC,EAAE,YAAY;QACrB,OAAO,EAAE,CAAC,EAAE,kBAAkB;QAC9B,EAAE,EAAE,CAAC,EAAE,sBAAsB;QAC7B,EAAE,EAAE,CAAC,EAAE,SAAS;QAChB,KAAK,EAAE,CAAC,EAAE,gBAAgB;QAC1B,EAAE,EAAE,CAAC,EAAE,qBAAqB;QAC5B,EAAE,EAAE,CAAC,EAAE,SAAS;QAChB,GAAG,EAAE,CAAC,EAAE,MAAM;QACd,EAAE,EAAE,CAAC,EAAE,cAAc;QACrB,KAAK,EAAE,CAAC,EAAE,kBAAkB;QAC5B,KAAK,EAAE,CAAC,EAAE,UAAU;QACpB,MAAM,EAAE,CAAC,EAAE,mBAAmB;QAC9B,IAAI,EAAE,CAAC,EAAE,kBAAkB;QAC3B,KAAK,EAAE,CAAC,EAAE,iBAAiB;QAC3B,KAAK,EAAE,CAAC,EAAE,YAAY;QACtB,KAAK,EAAE,CAAC,EAAE,aAAa;QACvB,GAAG,EAAE,CAAC,EAAE,YAAY;QACpB,EAAE,EAAE,CAAC,EAAE,uBAAuB;QAC9B,KAAK,EAAE,CAAC,EAAE,cAAc;QACxB,IAAI,EAAE,CAAC,EAAE,oBAAoB;QAC7B,GAAG,EAAE,CAAC,EAAE,cAAc;QACtB,SAAS,EAAE,CAAC,EAAE,cAAc;QAC5B,OAAO,EAAE,CAAC,EAAE,aAAa;QACzB,KAAK,EAAE,CAAC,EAAE,cAAc;QACxB,WAAW,EAAE,CAAC,EAAE,kBAAkB;QAClC,WAAW,EAAE,CAAC,EAAE,iBAAiB;QACjC,GAAG,EAAE,CAAC,EAAE,aAAa;QACrB,EAAE,EAAE,CAAC,EAAE,cAAc;QACrB,KAAK,EAAE,CAAC,EAAE,cAAc;QACxB,QAAQ,EAAE,CAAC,EAAE,2BAA2B;QACxC,MAAM,EAAE,CAAC,EAAE,iBAAiB;QAC5B,WAAW,EAAE,CAAC,EAAE,2BAA2B;QAC3C,MAAM,EAAE,CAAC,EAAE,YAAY;QACvB,IAAI,EAAE,CAAC,EAAE,qBAAqB;QAC9B,WAAW,EAAE,CAAC,EAAE,gBAAgB;QAChC,KAAK,EAAE,CAAC,EAAE,gCAAgC;QAC1C,MAAM,EAAE,CAAC,EAAE,mBAAmB;QAC9B,gBAAgB,EAAE,CAAC,EAAE,uBAAuB;QAC5C,gBAAgB,EAAE,CAAC,EAAE,oBAAoB;QACzC,kBAAkB,EAAE,CAAC,EAAE,sBAAsB;QAC7C,cAAc,EAAE,CAAC,EAAE,qBAAqB;QACxC,gBAAgB,EAAE,CAAC,EAAE,yBAAyB;QAC9C,eAAe,EAAE,CAAC,EAAE,mBAAmB;QACvC,MAAM,EAAE,CAAC,EAAE,sBAAsB;QACjC,eAAe,EAAE,CAAC,EAAE,wBAAwB;QAC5C,QAAQ,EAAE,CAAC,EAAE,kBAAkB;QAC/B,MAAM,EAAE,CAAC,EAAE,gBAAgB;QAC3B,MAAM,EAAE,CAAC,EAAE,gCAAgC;QAC3C,EAAE,EAAE,CAAC,EAAE,aAAa;QACpB,GAAG,EAAE,CAAC,EAAE,oBAAoB;QAC5B,YAAY,EAAE,CAAC,EAAE,uBAAuB;QACxC,YAAY,EAAE,CAAC,EAAE,wBAAwB;QACzC,WAAW,EAAE,CAAC,EAAE,gBAAgB;QAChC,EAAE,EAAE,CAAC,EAAE,WAAW;QAClB,MAAM,EAAE,CAAC,EAAE,eAAe;QAC1B,IAAI,EAAE,CAAC,EAAE,uBAAuB;QAChC,MAAM,EAAE,CAAC,EAAE,cAAc;QACzB,IAAI,EAAE,CAAC,EAAE,qBAAqB;QAC9B,EAAE,EAAE,CAAC,EAAE,eAAe;QACtB,SAAS,EAAE,CAAC,EAAE,eAAe;QAC7B,SAAS,EAAE,CAAC,EAAE,sBAAsB;QACpC,UAAU,EAAE,CAAC,EAAE,yBAAyB;QACxC,UAAU,EAAE,CAAC,EAAE,mCAAmC;QAClD,IAAI,EAAE,CAAC,EAAE,sBAAsB;QAC/B,aAAa,EAAE,CAAC,EAAE,sBAAsB;QACxC,OAAO,EAAE,CAAC,EAAE,mBAAmB;QAC/B,mBAAmB,EAAE,CAAC,EAAE,iCAAiC;QACzD,iBAAiB,EAAE,CAAC,EAAE,qCAAqC;QAC3D,SAAS,EAAE,CAAC,EAAE,oBAAoB;QAClC,IAAI,EAAE,CAAC,EAAE,aAAa;QACtB,EAAE,EAAE,CAAC,EAAE,gBAAgB;QACvB,UAAU,EAAE,CAAC,EAAE,wBAAwB;QACvC,QAAQ,EAAE,CAAC,EAAE,iBAAiB;QAC9B,OAAO,EAAE,CAAC,EAAE,eAAe;QAC3B,KAAK,EAAE,CAAC,EAAE,gBAAgB;QAC1B,GAAG,EAAE,CAAC,EAAE,cAAc;QACtB,EAAE,EAAE,CAAC,EAAE,6BAA6B;QACpC,GAAG,EAAE,CAAC,EAAE,cAAc;QACtB,UAAU,EAAE,CAAC,EAAE,gBAAgB;QAC/B,UAAU,EAAE,CAAC,EAAE,eAAe;QAC9B,SAAS,EAAE,CAAC,EAAE,cAAc;QAC5B,UAAU,EAAE,CAAC,EAAE,yBAAyB;QACxC,GAAG,EAAE,CAAC,EAAE,aAAa;QACrB,EAAE,EAAE,CAAC,EAAE,WAAW;QAClB,OAAO,EAAE,CAAC,EAAE,sBAAsB;QAClC,aAAa,EAAE,CAAC,EAAE,gCAAgC;QAClD,cAAc,EAAE,CAAC,EAAE,4BAA4B;QAC/C,GAAG,EAAE,CAAC,EAAE,oBAAoB;QAC5B,MAAM,EAAE,CAAC,EAAE,uBAAuB;QAClC,IAAI,EAAE,CAAC,EAAE,eAAe;QACxB,UAAU,EAAE,CAAC,EAAE,2BAA2B;QAC1C,WAAW,EAAE,CAAC,EAAE,iBAAiB;QACjC,UAAU,EAAE,CAAC,EAAE,eAAe;QAC9B,MAAM,EAAE,CAAC,EAAE,sBAAsB;QACjC,MAAM,EAAE,CAAC,EAAE,oBAAoB;QAC/B,kBAAkB,EAAE,CAAC,EAAE,sBAAsB;QAC7C,cAAc,EAAE,CAAC,EAAE,qBAAqB;QACxC,IAAI,EAAE,CAAC,EAAE,eAAe;QACxB,MAAM,EAAE,CAAC,EAAE,YAAY;QACvB,cAAc,EAAE,CAAC,EAAE,sBAAsB;QACzC,KAAK,EAAE,CAAC,EAAE,qBAAqB;QAC/B,MAAM,EAAE,CAAC,EAAE,qBAAqB;QAChC,IAAI,EAAE,CAAC,EAAE,kBAAkB;QAC3B,KAAK,EAAE,CAAC,EAAE,sBAAsB;QAChC,WAAW,EAAE,CAAC,EAAE,iBAAiB;QACjC,MAAM,EAAE,CAAC,EAAE,gBAAgB;QAC3B,UAAU,EAAE,CAAC,EAAE,oBAAoB;QACnC,IAAI,EAAE,CAAC,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,CAAC,EAAE,eAAe;QAC5B,GAAG,EAAE,CAAC,EAAE,aAAa;QACrB,GAAG,EAAE,CAAC,EAAE,aAAa;QACrB,KAAK,EAAE,CAAC,EAAE,cAAc;QACxB,SAAS,EAAE,CAAC,EAAE,0BAA0B;QACxC,SAAS,EAAE,CAAC,EAAE,kBAAkB;QAChC,qBAAqB,EAAE,CAAC,EAAE,kCAAkC;QAC5D,IAAI,EAAE,CAAC,EAAE,kBAAkB;QAC3B,KAAK,EAAE,CAAC,EAAE,kBAAkB;QAC5B,GAAG,EAAE,CAAC,EAAE,eAAe;QACvB,KAAK,EAAE,CAAC,EAAE,cAAc;QACxB,YAAY,EAAE,CAAC,EAAE,kBAAkB;QACnC,UAAU,EAAE,CAAC,EAAE,0BAA0B;QACzC,MAAM,EAAE,CAAC,EAAE,gBAAgB;QAC3B,KAAK,EAAE,CAAC,EAAE,qBAAqB;QAC/B,EAAE,EAAE,CAAC,EAAE,oBAAoB;QAC3B,IAAI,EAAE,CAAC,EAAE,iBAAiB;QAC1B,UAAU,EAAE,CAAC,EAAE,4BAA4B;QAC3C,UAAU,EAAE,CAAC,EAAE,eAAe;KAC9B,CAAC;AAAA,CACF,EAlKgB,SAAS,KAAT,SAAS,QAkKzB","sourcesContent":["export namespace BashArity {\n\texport function prefix(tokens: string[]) {\n\t\tfor (let len = tokens.length; len > 0; len--) {\n\t\t\tconst prefix = tokens.slice(0, len).join(\" \");\n\t\t\tconst arity = ARITY[prefix];\n\t\t\tif (arity !== undefined) return tokens.slice(0, arity);\n\t\t}\n\t\tif (tokens.length === 0) return [];\n\t\treturn tokens.slice(0, 1);\n\t}\n\n\t/* Generated with following prompt:\nYou are generating a dictionary of command-prefix arities for bash-style commands.\nThis dictionary is used to identify the \"human-understandable command\" from an input shell command.### **RULES (follow strictly)**1. Each entry maps a **command prefix string → number**, representing how many **tokens** define the command.\n2. **Flags NEVER count as tokens**. Only subcommands count.\n3. **Longest matching prefix wins**.\n4. **Only include a longer prefix if its arity is different from what the shorter prefix already implies**.   * Example: If `git` is 2, then do **not** include `git checkout`, `git commit`, etc. unless they require *different* arity.\n5. The output must be a **single JSON object**. Each entry should have a comment with an example real world matching command. DO NOT MAKE ANY OTHER COMMENTS. Should be alphabetical\n6. Include the **most commonly used commands** across many stacks and languages. More is better.### **Semantics examples*** `touch foo.txt` → `touch` (arity 1, explicitly listed)\n* `git checkout main` → `git checkout` (because `git` has arity 2)\n* `npm install` → `npm install` (because `npm` has arity 2)\n* `npm run dev` → `npm run dev` (because `npm run` has arity 3)\n* `python script.py` → `python script.py` (default: whole input, not in dictionary)### **Now generate the dictionary.**\n*/\n\tconst ARITY: Record<string, number> = {\n\t\tcat: 1, // cat file.txt\n\t\tcd: 1, // cd /path/to/dir\n\t\tchmod: 1, // chmod 755 script.sh\n\t\tchown: 1, // chown user:group file.txt\n\t\tcp: 1, // cp source.txt dest.txt\n\t\techo: 1, // echo \"hello world\"\n\t\tenv: 1, // env\n\t\texport: 1, // export PATH=/usr/bin\n\t\tgrep: 1, // grep pattern file.txt\n\t\tkill: 1, // kill 1234\n\t\tkillall: 1, // killall process\n\t\tln: 1, // ln -s source target\n\t\tls: 1, // ls -la\n\t\tmkdir: 1, // mkdir new-dir\n\t\tmv: 1, // mv old.txt new.txt\n\t\tps: 1, // ps aux\n\t\tpwd: 1, // pwd\n\t\trm: 1, // rm file.txt\n\t\trmdir: 1, // rmdir empty-dir\n\t\tsleep: 1, // sleep 5\n\t\tsource: 1, // source ~/.bashrc\n\t\ttail: 1, // tail -f log.txt\n\t\ttouch: 1, // touch file.txt\n\t\tunset: 1, // unset VAR\n\t\twhich: 1, // which node\n\t\taws: 3, // aws s3 ls\n\t\taz: 3, // az storage blob list\n\t\tbazel: 2, // bazel build\n\t\tbrew: 2, // brew install node\n\t\tbun: 2, // bun install\n\t\t\"bun run\": 3, // bun run dev\n\t\t\"bun x\": 3, // bun x vite\n\t\tcargo: 2, // cargo build\n\t\t\"cargo add\": 3, // cargo add tokio\n\t\t\"cargo run\": 3, // cargo run main\n\t\tcdk: 2, // cdk deploy\n\t\tcf: 2, // cf push app\n\t\tcmake: 2, // cmake build\n\t\tcomposer: 2, // composer require laravel\n\t\tconsul: 2, // consul members\n\t\t\"consul kv\": 3, // consul kv get config/app\n\t\tcrictl: 2, // crictl ps\n\t\tdeno: 2, // deno run server.ts\n\t\t\"deno task\": 3, // deno task dev\n\t\tdoctl: 3, // doctl kubernetes cluster list\n\t\tdocker: 2, // docker run nginx\n\t\t\"docker builder\": 3, // docker builder prune\n\t\t\"docker compose\": 3, // docker compose up\n\t\t\"docker container\": 3, // docker container ls\n\t\t\"docker image\": 3, // docker image prune\n\t\t\"docker network\": 3, // docker network inspect\n\t\t\"docker volume\": 3, // docker volume ls\n\t\teksctl: 2, // eksctl get clusters\n\t\t\"eksctl create\": 3, // eksctl create cluster\n\t\tfirebase: 2, // firebase deploy\n\t\tflyctl: 2, // flyctl deploy\n\t\tgcloud: 3, // gcloud compute instances list\n\t\tgh: 3, // gh pr list\n\t\tgit: 2, // git checkout main\n\t\t\"git config\": 3, // git config user.name\n\t\t\"git remote\": 3, // git remote add origin\n\t\t\"git stash\": 3, // git stash pop\n\t\tgo: 2, // go build\n\t\tgradle: 2, // gradle build\n\t\thelm: 2, // helm install mychart\n\t\theroku: 2, // heroku logs\n\t\thugo: 2, // hugo new site blog\n\t\tip: 2, // ip link show\n\t\t\"ip addr\": 3, // ip addr show\n\t\t\"ip link\": 3, // ip link set eth0 up\n\t\t\"ip netns\": 3, // ip netns exec foo bash\n\t\t\"ip route\": 3, // ip route add default via 1.1.1.1\n\t\tkind: 2, // kind delete cluster\n\t\t\"kind create\": 3, // kind create cluster\n\t\tkubectl: 2, // kubectl get pods\n\t\t\"kubectl kustomize\": 3, // kubectl kustomize overlays/dev\n\t\t\"kubectl rollout\": 3, // kubectl rollout restart deploy/api\n\t\tkustomize: 2, // kustomize build .\n\t\tmake: 2, // make build\n\t\tmc: 2, // mc ls myminio\n\t\t\"mc admin\": 3, // mc admin info myminio\n\t\tminikube: 2, // minikube start\n\t\tmongosh: 2, // mongosh test\n\t\tmysql: 2, // mysql -u root\n\t\tmvn: 2, // mvn compile\n\t\tng: 2, // ng generate component home\n\t\tnpm: 2, // npm install\n\t\t\"npm exec\": 3, // npm exec vite\n\t\t\"npm init\": 3, // npm init vue\n\t\t\"npm run\": 3, // npm run dev\n\t\t\"npm view\": 3, // npm view react version\n\t\tnvm: 2, // nvm use 18\n\t\tnx: 2, // nx build\n\t\topenssl: 2, // openssl genrsa 2048\n\t\t\"openssl req\": 3, // openssl req -new -key key.pem\n\t\t\"openssl x509\": 3, // openssl x509 -in cert.pem\n\t\tpip: 2, // pip install numpy\n\t\tpipenv: 2, // pipenv install flask\n\t\tpnpm: 2, // pnpm install\n\t\t\"pnpm dlx\": 3, // pnpm dlx create-next-app\n\t\t\"pnpm exec\": 3, // pnpm exec vite\n\t\t\"pnpm run\": 3, // pnpm run dev\n\t\tpoetry: 2, // poetry add requests\n\t\tpodman: 2, // podman run alpine\n\t\t\"podman container\": 3, // podman container ls\n\t\t\"podman image\": 3, // podman image prune\n\t\tpsql: 2, // psql -d mydb\n\t\tpulumi: 2, // pulumi up\n\t\t\"pulumi stack\": 3, // pulumi stack output\n\t\tpyenv: 2, // pyenv install 3.11\n\t\tpython: 2, // python -m venv env\n\t\trake: 2, // rake db:migrate\n\t\trbenv: 2, // rbenv install 3.2.0\n\t\t\"redis-cli\": 2, // redis-cli ping\n\t\trustup: 2, // rustup update\n\t\tserverless: 2, // serverless invoke\n\t\tsfdx: 3, // sfdx force:org:list\n\t\tskaffold: 2, // skaffold dev\n\t\tsls: 2, // sls deploy\n\t\tsst: 2, // sst deploy\n\t\tswift: 2, // swift build\n\t\tsystemctl: 2, // systemctl restart nginx\n\t\tterraform: 2, // terraform apply\n\t\t\"terraform workspace\": 3, // terraform workspace select prod\n\t\ttmux: 2, // tmux new -s dev\n\t\tturbo: 2, // turbo run build\n\t\tufw: 2, // ufw allow 22\n\t\tvault: 2, // vault login\n\t\t\"vault auth\": 3, // vault auth list\n\t\t\"vault kv\": 3, // vault kv get secret/api\n\t\tvercel: 2, // vercel deploy\n\t\tvolta: 2, // volta install node\n\t\twp: 2, // wp plugin install\n\t\tyarn: 2, // yarn add react\n\t\t\"yarn dlx\": 3, // yarn dlx create-react-app\n\t\t\"yarn run\": 3, // yarn run dev\n\t};\n}\n"]}

package/dist/core/extensions/builtin/permission-system/cli.d.ts

@@ -0,0 +1,6 @@
+import type { ExtensionAPI } from "../../types.js";
+import type { Ruleset } from "./types.js";
+export declare function parsePermissionFlag(value: string): Ruleset;
+export declare function registerPermissionFlag(pi: ExtensionAPI): Ruleset;
+export declare function loadPermissionFlag(pi: ExtensionAPI): Ruleset;
+//# sourceMappingURL=cli.d.ts.map

package/dist/core/extensions/builtin/permission-system/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/permission-system/cli.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAgB,OAAO,EAAE,MAAM,YAAY,CAAC;AAExD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAoB1D;AAED,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,YAAY,GAAG,OAAO,CAOhE;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,YAAY,GAAG,OAAO,CAI5D","sourcesContent":["import type { ExtensionAPI } from \"../../types.js\";\nimport type { Action, Rule, Ruleset } from \"./types.js\";\n\nexport function parsePermissionFlag(value: string): Ruleset {\n\tconst rules: Rule[] = [];\n\tconst entries = value.split(\",\");\n\n\tfor (const entry of entries) {\n\t\tconst trimmed = entry.trim();\n\t\tif (!trimmed) continue;\n\n\t\tconst match = trimmed.match(/^([^:=]+)(?::([^=]+))?=(.+)$/);\n\t\tif (!match) continue;\n\n\t\tconst [, permission, pattern, action] = match;\n\t\trules.push({\n\t\t\tpermission: permission.trim(),\n\t\t\tpattern: pattern ? pattern.trim() : \"*\",\n\t\t\taction: action.trim() as Action,\n\t\t});\n\t}\n\n\treturn rules;\n}\n\nexport function registerPermissionFlag(pi: ExtensionAPI): Ruleset {\n\tpi.registerFlag(\"permission\", {\n\t\tdescription: \"Set permission rules (format: tool=action or tool:pattern=action)\",\n\t\ttype: \"string\",\n\t});\n\n\treturn [];\n}\n\nexport function loadPermissionFlag(pi: ExtensionAPI): Ruleset {\n\tconst flagValue = pi.getFlag(\"permission\") as string | undefined;\n\tif (!flagValue) return [];\n\treturn parsePermissionFlag(flagValue);\n}\n"]}

package/dist/core/extensions/builtin/permission-system/cli.js

@@ -0,0 +1,33 @@
+export function parsePermissionFlag(value) {
+    const rules = [];
+    const entries = value.split(",");
+    for (const entry of entries) {
+        const trimmed = entry.trim();
+        if (!trimmed)
+            continue;
+        const match = trimmed.match(/^([^:=]+)(?::([^=]+))?=(.+)$/);
+        if (!match)
+            continue;
+        const [, permission, pattern, action] = match;
+        rules.push({
+            permission: permission.trim(),
+            pattern: pattern ? pattern.trim() : "*",
+            action: action.trim(),
+        });
+    }
+    return rules;
+}
+export function registerPermissionFlag(pi) {
+    pi.registerFlag("permission", {
+        description: "Set permission rules (format: tool=action or tool:pattern=action)",
+        type: "string",
+    });
+    return [];
+}
+export function loadPermissionFlag(pi) {
+    const flagValue = pi.getFlag("permission");
+    if (!flagValue)
+        return [];
+    return parsePermissionFlag(flagValue);
+}
+//# sourceMappingURL=cli.js.map

package/dist/core/extensions/builtin/permission-system/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/permission-system/cli.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAW;IAC3D,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEjC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC;YACV,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE;YAC7B,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG;YACvC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAY;SAC/B,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AAAA,CACb;AAED,MAAM,UAAU,sBAAsB,CAAC,EAAgB,EAAW;IACjE,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE;QAC7B,WAAW,EAAE,mEAAmE;QAChF,IAAI,EAAE,QAAQ;KACd,CAAC,CAAC;IAEH,OAAO,EAAE,CAAC;AAAA,CACV;AAED,MAAM,UAAU,kBAAkB,CAAC,EAAgB,EAAW;IAC7D,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,CAAuB,CAAC;IACjE,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1B,OAAO,mBAAmB,CAAC,SAAS,CAAC,CAAC;AAAA,CACtC","sourcesContent":["import type { ExtensionAPI } from \"../../types.js\";\nimport type { Action, Rule, Ruleset } from \"./types.js\";\n\nexport function parsePermissionFlag(value: string): Ruleset {\n\tconst rules: Rule[] = [];\n\tconst entries = value.split(\",\");\n\n\tfor (const entry of entries) {\n\t\tconst trimmed = entry.trim();\n\t\tif (!trimmed) continue;\n\n\t\tconst match = trimmed.match(/^([^:=]+)(?::([^=]+))?=(.+)$/);\n\t\tif (!match) continue;\n\n\t\tconst [, permission, pattern, action] = match;\n\t\trules.push({\n\t\t\tpermission: permission.trim(),\n\t\t\tpattern: pattern ? pattern.trim() : \"*\",\n\t\t\taction: action.trim() as Action,\n\t\t});\n\t}\n\n\treturn rules;\n}\n\nexport function registerPermissionFlag(pi: ExtensionAPI): Ruleset {\n\tpi.registerFlag(\"permission\", {\n\t\tdescription: \"Set permission rules (format: tool=action or tool:pattern=action)\",\n\t\ttype: \"string\",\n\t});\n\n\treturn [];\n}\n\nexport function loadPermissionFlag(pi: ExtensionAPI): Ruleset {\n\tconst flagValue = pi.getFlag(\"permission\") as string | undefined;\n\tif (!flagValue) return [];\n\treturn parsePermissionFlag(flagValue);\n}\n"]}

package/dist/core/extensions/builtin/permission-system/config.d.ts

@@ -0,0 +1,7 @@
+import type { PermissionConfig, Ruleset } from "./types.js";
+export declare const EDIT_TOOLS: string[];
+export declare function expand(path: string): string;
+export declare function fromConfig(config: PermissionConfig): Ruleset;
+export declare function merge(...rulesets: Ruleset[]): Ruleset;
+export declare function disabled(tools: string[], ruleset: Ruleset): Set<string>;
+//# sourceMappingURL=config.d.ts.map

package/dist/core/extensions/builtin/permission-system/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/permission-system/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAQ,OAAO,EAAE,MAAM,YAAY,CAAC;AAGlE,eAAO,MAAM,UAAU,UAAgD,CAAC;AAExE,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAc3C;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAc5D;AAED,wBAAgB,KAAK,CAAC,GAAG,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAErD;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAgBvE","sourcesContent":["import os from \"node:os\";\nimport type { PermissionConfig, Rule, Ruleset } from \"./types.js\";\nimport { Wildcard } from \"./wildcard.js\";\n\nexport const EDIT_TOOLS = [\"edit\", \"write\", \"apply_patch\", \"multiedit\"];\n\nexport function expand(path: string): string {\n\tif (path.startsWith(\"~/\")) {\n\t\treturn os.homedir() + path.slice(1);\n\t}\n\tif (path === \"~\") {\n\t\treturn os.homedir();\n\t}\n\tif (path.startsWith(\"$HOME/\")) {\n\t\treturn os.homedir() + path.slice(5);\n\t}\n\tif (path.startsWith(\"$HOME\")) {\n\t\treturn os.homedir() + path.slice(5);\n\t}\n\treturn path;\n}\n\nexport function fromConfig(config: PermissionConfig): Ruleset {\n\tconst rules: Rule[] = [];\n\n\tfor (const [permission, value] of Object.entries(config)) {\n\t\tif (typeof value === \"string\") {\n\t\t\trules.push({ permission, pattern: \"*\", action: value });\n\t\t} else {\n\t\t\tfor (const [pattern, action] of Object.entries(value)) {\n\t\t\t\trules.push({ permission, pattern: expand(pattern), action });\n\t\t\t}\n\t\t}\n\t}\n\n\treturn rules;\n}\n\nexport function merge(...rulesets: Ruleset[]): Ruleset {\n\treturn rulesets.flat();\n}\n\nexport function disabled(tools: string[], ruleset: Ruleset): Set<string> {\n\tconst result = new Set<string>();\n\n\tfor (const tool of tools) {\n\t\tconst permission = EDIT_TOOLS.includes(tool) ? \"edit\" : tool;\n\n\t\tconst rule = ruleset.findLast((rule) => {\n\t\t\treturn Wildcard.match(permission, rule.permission);\n\t\t});\n\n\t\tif (rule && rule.pattern === \"*\" && rule.action === \"deny\") {\n\t\t\tresult.add(tool);\n\t\t}\n\t}\n\n\treturn result;\n}\n"]}

package/dist/core/extensions/builtin/permission-system/config.js

@@ -0,0 +1,49 @@
+import os from "node:os";
+import { Wildcard } from "./wildcard.js";
+export const EDIT_TOOLS = ["edit", "write", "apply_patch", "multiedit"];
+export function expand(path) {
+    if (path.startsWith("~/")) {
+        return os.homedir() + path.slice(1);
+    }
+    if (path === "~") {
+        return os.homedir();
+    }
+    if (path.startsWith("$HOME/")) {
+        return os.homedir() + path.slice(5);
+    }
+    if (path.startsWith("$HOME")) {
+        return os.homedir() + path.slice(5);
+    }
+    return path;
+}
+export function fromConfig(config) {
+    const rules = [];
+    for (const [permission, value] of Object.entries(config)) {
+        if (typeof value === "string") {
+            rules.push({ permission, pattern: "*", action: value });
+        }
+        else {
+            for (const [pattern, action] of Object.entries(value)) {
+                rules.push({ permission, pattern: expand(pattern), action });
+            }
+        }
+    }
+    return rules;
+}
+export function merge(...rulesets) {
+    return rulesets.flat();
+}
+export function disabled(tools, ruleset) {
+    const result = new Set();
+    for (const tool of tools) {
+        const permission = EDIT_TOOLS.includes(tool) ? "edit" : tool;
+        const rule = ruleset.findLast((rule) => {
+            return Wildcard.match(permission, rule.permission);
+        });
+        if (rule && rule.pattern === "*" && rule.action === "deny") {
+            result.add(tool);
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=config.js.map

package/dist/core/extensions/builtin/permission-system/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/permission-system/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;AAExE,MAAM,UAAU,MAAM,CAAC,IAAY,EAAU;IAC5C,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC;IACrB,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC;AAAA,CACZ;AAED,MAAM,UAAU,UAAU,CAAC,MAAwB,EAAW;IAC7D,MAAM,KAAK,GAAW,EAAE,CAAC;IAEzB,KAAK,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,CAAC;aAAM,CAAC;YACP,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvD,KAAK,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9D,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,KAAK,CAAC;AAAA,CACb;AAED,MAAM,UAAU,KAAK,CAAC,GAAG,QAAmB,EAAW;IACtD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;AAAA,CACvB;AAED,MAAM,UAAU,QAAQ,CAAC,KAAe,EAAE,OAAgB,EAAe;IACxE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IAEjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAE7D,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACvC,OAAO,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAAA,CACnD,CAAC,CAAC;QAEH,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5D,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC;AAAA,CACd","sourcesContent":["import os from \"node:os\";\nimport type { PermissionConfig, Rule, Ruleset } from \"./types.js\";\nimport { Wildcard } from \"./wildcard.js\";\n\nexport const EDIT_TOOLS = [\"edit\", \"write\", \"apply_patch\", \"multiedit\"];\n\nexport function expand(path: string): string {\n\tif (path.startsWith(\"~/\")) {\n\t\treturn os.homedir() + path.slice(1);\n\t}\n\tif (path === \"~\") {\n\t\treturn os.homedir();\n\t}\n\tif (path.startsWith(\"$HOME/\")) {\n\t\treturn os.homedir() + path.slice(5);\n\t}\n\tif (path.startsWith(\"$HOME\")) {\n\t\treturn os.homedir() + path.slice(5);\n\t}\n\treturn path;\n}\n\nexport function fromConfig(config: PermissionConfig): Ruleset {\n\tconst rules: Rule[] = [];\n\n\tfor (const [permission, value] of Object.entries(config)) {\n\t\tif (typeof value === \"string\") {\n\t\t\trules.push({ permission, pattern: \"*\", action: value });\n\t\t} else {\n\t\t\tfor (const [pattern, action] of Object.entries(value)) {\n\t\t\t\trules.push({ permission, pattern: expand(pattern), action });\n\t\t\t}\n\t\t}\n\t}\n\n\treturn rules;\n}\n\nexport function merge(...rulesets: Ruleset[]): Ruleset {\n\treturn rulesets.flat();\n}\n\nexport function disabled(tools: string[], ruleset: Ruleset): Set<string> {\n\tconst result = new Set<string>();\n\n\tfor (const tool of tools) {\n\t\tconst permission = EDIT_TOOLS.includes(tool) ? \"edit\" : tool;\n\n\t\tconst rule = ruleset.findLast((rule) => {\n\t\t\treturn Wildcard.match(permission, rule.permission);\n\t\t});\n\n\t\tif (rule && rule.pattern === \"*\" && rule.action === \"deny\") {\n\t\t\tresult.add(tool);\n\t\t}\n\t}\n\n\treturn result;\n}\n"]}

package/dist/core/extensions/builtin/permission-system/evaluate.d.ts

@@ -0,0 +1,9 @@
+import type { Rule, Ruleset } from "../permission-system/types.js";
+declare global {
+    interface Array<T> {
+        findLast<S extends T>(predicate: (value: T, index: number, array: T[]) => value is S, thisArg?: unknown): S | undefined;
+        findLast(predicate: (value: T, index: number, array: T[]) => unknown, thisArg?: unknown): T | undefined;
+    }
+}
+export declare function evaluate(permission: string, pattern: string, ...rulesets: Ruleset[]): Rule;
+//# sourceMappingURL=evaluate.d.ts.map

package/dist/core/extensions/builtin/permission-system/evaluate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/permission-system/evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAC;AAGnE,OAAO,CAAC,MAAM,CAAC,CAAC;IACf,UAAU,KAAK,CAAC,CAAC;QAChB,QAAQ,CAAC,CAAC,SAAS,CAAC,EACnB,SAAS,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,EAC9D,OAAO,CAAC,EAAE,OAAO,GACf,CAAC,GAAG,SAAS,CAAC;QACjB,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC;KACxG;CACD;AAED,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,GAAG,IAAI,CAU1F","sourcesContent":["import type { Rule, Ruleset } from \"../permission-system/types.js\";\nimport { Wildcard } from \"./wildcard.js\";\n\ndeclare global {\n\tinterface Array<T> {\n\t\tfindLast<S extends T>(\n\t\t\tpredicate: (value: T, index: number, array: T[]) => value is S,\n\t\t\tthisArg?: unknown,\n\t\t): S | undefined;\n\t\tfindLast(predicate: (value: T, index: number, array: T[]) => unknown, thisArg?: unknown): T | undefined;\n\t}\n}\n\nexport function evaluate(permission: string, pattern: string, ...rulesets: Ruleset[]): Rule {\n\tconst matchedRule = rulesets.flat().findLast((rule) => {\n\t\treturn Wildcard.match(permission, rule.permission) && matchesPattern(pattern, rule.pattern);\n\t});\n\n\tif (matchedRule) {\n\t\treturn matchedRule;\n\t}\n\n\treturn { action: \"ask\", permission, pattern: \"*\" };\n}\n\nfunction matchesPattern(value: string, pattern: string): boolean {\n\treturn Wildcard.match(value, pattern) || (pattern.endsWith(\" *\") && Wildcard.match(value, pattern.slice(0, -2)));\n}\n"]}

package/dist/core/extensions/builtin/permission-system/evaluate.js

@@ -0,0 +1,14 @@
+import { Wildcard } from "./wildcard.js";
+export function evaluate(permission, pattern, ...rulesets) {
+    const matchedRule = rulesets.flat().findLast((rule) => {
+        return Wildcard.match(permission, rule.permission) && matchesPattern(pattern, rule.pattern);
+    });
+    if (matchedRule) {
+        return matchedRule;
+    }
+    return { action: "ask", permission, pattern: "*" };
+}
+function matchesPattern(value, pattern) {
+    return Wildcard.match(value, pattern) || (pattern.endsWith(" *") && Wildcard.match(value, pattern.slice(0, -2)));
+}
+//# sourceMappingURL=evaluate.js.map

package/dist/core/extensions/builtin/permission-system/evaluate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/permission-system/evaluate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAYzC,MAAM,UAAU,QAAQ,CAAC,UAAkB,EAAE,OAAe,EAAE,GAAG,QAAmB,EAAQ;IAC3F,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACtD,OAAO,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAAA,CAC5F,CAAC,CAAC;IAEH,IAAI,WAAW,EAAE,CAAC;QACjB,OAAO,WAAW,CAAC;IACpB,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAAA,CACnD;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,OAAe,EAAW;IAChE,OAAO,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAAA,CACjH","sourcesContent":["import type { Rule, Ruleset } from \"../permission-system/types.js\";\nimport { Wildcard } from \"./wildcard.js\";\n\ndeclare global {\n\tinterface Array<T> {\n\t\tfindLast<S extends T>(\n\t\t\tpredicate: (value: T, index: number, array: T[]) => value is S,\n\t\t\tthisArg?: unknown,\n\t\t): S | undefined;\n\t\tfindLast(predicate: (value: T, index: number, array: T[]) => unknown, thisArg?: unknown): T | undefined;\n\t}\n}\n\nexport function evaluate(permission: string, pattern: string, ...rulesets: Ruleset[]): Rule {\n\tconst matchedRule = rulesets.flat().findLast((rule) => {\n\t\treturn Wildcard.match(permission, rule.permission) && matchesPattern(pattern, rule.pattern);\n\t});\n\n\tif (matchedRule) {\n\t\treturn matchedRule;\n\t}\n\n\treturn { action: \"ask\", permission, pattern: \"*\" };\n}\n\nfunction matchesPattern(value: string, pattern: string): boolean {\n\treturn Wildcard.match(value, pattern) || (pattern.endsWith(\" *\") && Wildcard.match(value, pattern.slice(0, -2)));\n}\n"]}

package/dist/core/extensions/builtin/permission-system/events.d.ts

@@ -0,0 +1,67 @@
+import type { ExtensionAPI } from "../../types.js";
+import type { PermissionDecision, Request } from "./types.js";
+/**
+ * Event type for when a permission is asked.
+ * Contains the full request information.
+ */
+export type PermissionAskedEvent = Request;
+/**
+ * Event type for when a permission is replied to.
+ * Contains the reply and identifiers to correlate with the request.
+ */
+export type PermissionRepliedEvent = {
+    requestID: string;
+    sessionID: string;
+    reply: PermissionDecision;
+};
+/**
+ * Event emitter interface for permission events.
+ * Injectable into services for loose coupling.
+ */
+export interface PermissionEventEmitter {
+    /**
+     * Emit a permission_asked event.
+     * @param request - The permission request being asked
+     */
+    emitAsked(request: Request): void;
+    /**
+     * Emit a permission_replied event.
+     * @param requestID - The ID of the request being replied to
+     * @param sessionID - The session ID associated with the request
+     * @param reply - The user's reply (once, always, or reject)
+     */
+    emitReplied(requestID: string, sessionID: string, reply: PermissionDecision): void;
+}
+/**
+ * Creates an event emitter that wraps pi.events for inter-extension communication.
+ * Use this when running within the pi extension system.
+ *
+ * @param pi - The ExtensionAPI provided by the pi extension system
+ * @returns PermissionEventEmitter that emits via pi.events
+ */
+export declare function createEventEmitter(pi: ExtensionAPI): PermissionEventEmitter;
+/**
+ * Local event emitter implementation for standalone or test usage.
+ * Uses a simple callback registry when pi.events is not available.
+ *
+ * @returns PermissionEventEmitter with local event handling
+ */
+export declare function createLocalEventEmitter(): PermissionEventEmitter & {
+    /**
+     * Register a handler for permission_asked events.
+     * @param handler - Callback invoked when a permission is asked
+     * @returns Unsubscribe function
+     */
+    onAsked(handler: (request: Request) => void): () => void;
+    /**
+     * Register a handler for permission_replied events.
+     * @param handler - Callback invoked when a permission is replied to
+     * @returns Unsubscribe function
+     */
+    onReplied(handler: (event: PermissionRepliedEvent) => void): () => void;
+    /**
+     * Clear all registered handlers.
+     */
+    clear(): void;
+};
+//# sourceMappingURL=events.d.ts.map

package/dist/core/extensions/builtin/permission-system/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/permission-system/events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE9D;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAE3C;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,kBAAkB,CAAC;CAC1B,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACtC;;;OAGG;IACH,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IAElC;;;;;OAKG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACnF;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,YAAY,GAAG,sBAAsB,CAS3E;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,sBAAsB,GAAG;IACnE;;;;OAIG;IACH,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAEzD;;;;OAIG;IACH,SAAS,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,sBAAsB,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IAExE;;OAEG;IACH,KAAK,IAAI,IAAI,CAAC;CACd,CAyCA","sourcesContent":["import type { ExtensionAPI } from \"../../types.js\";\nimport type { PermissionDecision, Request } from \"./types.js\";\n\n/**\n * Event type for when a permission is asked.\n * Contains the full request information.\n */\nexport type PermissionAskedEvent = Request;\n\n/**\n * Event type for when a permission is replied to.\n * Contains the reply and identifiers to correlate with the request.\n */\nexport type PermissionRepliedEvent = {\n\trequestID: string;\n\tsessionID: string;\n\treply: PermissionDecision;\n};\n\n/**\n * Event emitter interface for permission events.\n * Injectable into services for loose coupling.\n */\nexport interface PermissionEventEmitter {\n\t/**\n\t * Emit a permission_asked event.\n\t * @param request - The permission request being asked\n\t */\n\temitAsked(request: Request): void;\n\n\t/**\n\t * Emit a permission_replied event.\n\t * @param requestID - The ID of the request being replied to\n\t * @param sessionID - The session ID associated with the request\n\t * @param reply - The user's reply (once, always, or reject)\n\t */\n\temitReplied(requestID: string, sessionID: string, reply: PermissionDecision): void;\n}\n\n/**\n * Creates an event emitter that wraps pi.events for inter-extension communication.\n * Use this when running within the pi extension system.\n *\n * @param pi - The ExtensionAPI provided by the pi extension system\n * @returns PermissionEventEmitter that emits via pi.events\n */\nexport function createEventEmitter(pi: ExtensionAPI): PermissionEventEmitter {\n\treturn {\n\t\temitAsked: (request: Request) => {\n\t\t\tpi.events.emit(\"permission_asked\", request);\n\t\t},\n\t\temitReplied: (requestID: string, sessionID: string, reply: PermissionDecision) => {\n\t\t\tpi.events.emit(\"permission_replied\", { requestID, sessionID, reply });\n\t\t},\n\t};\n}\n\n/**\n * Local event emitter implementation for standalone or test usage.\n * Uses a simple callback registry when pi.events is not available.\n *\n * @returns PermissionEventEmitter with local event handling\n */\nexport function createLocalEventEmitter(): PermissionEventEmitter & {\n\t/**\n\t * Register a handler for permission_asked events.\n\t * @param handler - Callback invoked when a permission is asked\n\t * @returns Unsubscribe function\n\t */\n\tonAsked(handler: (request: Request) => void): () => void;\n\n\t/**\n\t * Register a handler for permission_replied events.\n\t * @param handler - Callback invoked when a permission is replied to\n\t * @returns Unsubscribe function\n\t */\n\tonReplied(handler: (event: PermissionRepliedEvent) => void): () => void;\n\n\t/**\n\t * Clear all registered handlers.\n\t */\n\tclear(): void;\n} {\n\tconst askedHandlers = new Set<(request: Request) => void>();\n\tconst repliedHandlers = new Set<(event: PermissionRepliedEvent) => void>();\n\n\treturn {\n\t\temitAsked: (request: Request) => {\n\t\t\tfor (const handler of askedHandlers) {\n\t\t\t\ttry {\n\t\t\t\t\thandler(request);\n\t\t\t\t} catch (err) {\n\t\t\t\t\tconsole.error(\"Error in permission_asked handler:\", err);\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\n\t\temitReplied: (requestID: string, sessionID: string, reply: PermissionDecision) => {\n\t\t\tconst event: PermissionRepliedEvent = { requestID, sessionID, reply };\n\t\t\tfor (const handler of repliedHandlers) {\n\t\t\t\ttry {\n\t\t\t\t\thandler(event);\n\t\t\t\t} catch (err) {\n\t\t\t\t\tconsole.error(\"Error in permission_replied handler:\", err);\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\n\t\tonAsked: (handler: (request: Request) => void): (() => void) => {\n\t\t\taskedHandlers.add(handler);\n\t\t\treturn () => askedHandlers.delete(handler);\n\t\t},\n\n\t\tonReplied: (handler: (event: PermissionRepliedEvent) => void): (() => void) => {\n\t\t\trepliedHandlers.add(handler);\n\t\t\treturn () => repliedHandlers.delete(handler);\n\t\t},\n\n\t\tclear: () => {\n\t\t\taskedHandlers.clear();\n\t\t\trepliedHandlers.clear();\n\t\t},\n\t};\n}\n"]}

package/dist/core/extensions/builtin/permission-system/events.js

@@ -0,0 +1,63 @@
+/**
+ * Creates an event emitter that wraps pi.events for inter-extension communication.
+ * Use this when running within the pi extension system.
+ *
+ * @param pi - The ExtensionAPI provided by the pi extension system
+ * @returns PermissionEventEmitter that emits via pi.events
+ */
+export function createEventEmitter(pi) {
+    return {
+        emitAsked: (request) => {
+            pi.events.emit("permission_asked", request);
+        },
+        emitReplied: (requestID, sessionID, reply) => {
+            pi.events.emit("permission_replied", { requestID, sessionID, reply });
+        },
+    };
+}
+/**
+ * Local event emitter implementation for standalone or test usage.
+ * Uses a simple callback registry when pi.events is not available.
+ *
+ * @returns PermissionEventEmitter with local event handling
+ */
+export function createLocalEventEmitter() {
+    const askedHandlers = new Set();
+    const repliedHandlers = new Set();
+    return {
+        emitAsked: (request) => {
+            for (const handler of askedHandlers) {
+                try {
+                    handler(request);
+                }
+                catch (err) {
+                    console.error("Error in permission_asked handler:", err);
+                }
+            }
+        },
+        emitReplied: (requestID, sessionID, reply) => {
+            const event = { requestID, sessionID, reply };
+            for (const handler of repliedHandlers) {
+                try {
+                    handler(event);
+                }
+                catch (err) {
+                    console.error("Error in permission_replied handler:", err);
+                }
+            }
+        },
+        onAsked: (handler) => {
+            askedHandlers.add(handler);
+            return () => askedHandlers.delete(handler);
+        },
+        onReplied: (handler) => {
+            repliedHandlers.add(handler);
+            return () => repliedHandlers.delete(handler);
+        },
+        clear: () => {
+            askedHandlers.clear();
+            repliedHandlers.clear();
+        },
+    };
+}
+//# sourceMappingURL=events.js.map

package/dist/core/extensions/builtin/permission-system/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/permission-system/events.ts"],"names":[],"mappings":"AAuCA;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAgB,EAA0B;IAC5E,OAAO;QACN,SAAS,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC;YAChC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;QAAA,CAC5C;QACD,WAAW,EAAE,CAAC,SAAiB,EAAE,SAAiB,EAAE,KAAyB,EAAE,EAAE,CAAC;YACjF,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAAA,CACtE;KACD,CAAC;AAAA,CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,GAmBrC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC5D,MAAM,eAAe,GAAG,IAAI,GAAG,EAA2C,CAAC;IAE3E,OAAO;QACN,SAAS,EAAE,CAAC,OAAgB,EAAE,EAAE,CAAC;YAChC,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACJ,OAAO,CAAC,OAAO,CAAC,CAAC;gBAClB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACd,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;gBAC1D,CAAC;YACF,CAAC;QAAA,CACD;QAED,WAAW,EAAE,CAAC,SAAiB,EAAE,SAAiB,EAAE,KAAyB,EAAE,EAAE,CAAC;YACjF,MAAM,KAAK,GAA2B,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YACtE,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;gBACvC,IAAI,CAAC;oBACJ,OAAO,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACd,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;gBAC5D,CAAC;YACF,CAAC;QAAA,CACD;QAED,OAAO,EAAE,CAAC,OAAmC,EAAgB,EAAE,CAAC;YAC/D,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC3B,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAAA,CAC3C;QAED,SAAS,EAAE,CAAC,OAAgD,EAAgB,EAAE,CAAC;YAC9E,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC7B,OAAO,GAAG,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAAA,CAC7C;QAED,KAAK,EAAE,GAAG,EAAE,CAAC;YACZ,aAAa,CAAC,KAAK,EAAE,CAAC;YACtB,eAAe,CAAC,KAAK,EAAE,CAAC;QAAA,CACxB;KACD,CAAC;AAAA,CACF","sourcesContent":["import type { ExtensionAPI } from \"../../types.js\";\nimport type { PermissionDecision, Request } from \"./types.js\";\n\n/**\n * Event type for when a permission is asked.\n * Contains the full request information.\n */\nexport type PermissionAskedEvent = Request;\n\n/**\n * Event type for when a permission is replied to.\n * Contains the reply and identifiers to correlate with the request.\n */\nexport type PermissionRepliedEvent = {\n\trequestID: string;\n\tsessionID: string;\n\treply: PermissionDecision;\n};\n\n/**\n * Event emitter interface for permission events.\n * Injectable into services for loose coupling.\n */\nexport interface PermissionEventEmitter {\n\t/**\n\t * Emit a permission_asked event.\n\t * @param request - The permission request being asked\n\t */\n\temitAsked(request: Request): void;\n\n\t/**\n\t * Emit a permission_replied event.\n\t * @param requestID - The ID of the request being replied to\n\t * @param sessionID - The session ID associated with the request\n\t * @param reply - The user's reply (once, always, or reject)\n\t */\n\temitReplied(requestID: string, sessionID: string, reply: PermissionDecision): void;\n}\n\n/**\n * Creates an event emitter that wraps pi.events for inter-extension communication.\n * Use this when running within the pi extension system.\n *\n * @param pi - The ExtensionAPI provided by the pi extension system\n * @returns PermissionEventEmitter that emits via pi.events\n */\nexport function createEventEmitter(pi: ExtensionAPI): PermissionEventEmitter {\n\treturn {\n\t\temitAsked: (request: Request) => {\n\t\t\tpi.events.emit(\"permission_asked\", request);\n\t\t},\n\t\temitReplied: (requestID: string, sessionID: string, reply: PermissionDecision) => {\n\t\t\tpi.events.emit(\"permission_replied\", { requestID, sessionID, reply });\n\t\t},\n\t};\n}\n\n/**\n * Local event emitter implementation for standalone or test usage.\n * Uses a simple callback registry when pi.events is not available.\n *\n * @returns PermissionEventEmitter with local event handling\n */\nexport function createLocalEventEmitter(): PermissionEventEmitter & {\n\t/**\n\t * Register a handler for permission_asked events.\n\t * @param handler - Callback invoked when a permission is asked\n\t * @returns Unsubscribe function\n\t */\n\tonAsked(handler: (request: Request) => void): () => void;\n\n\t/**\n\t * Register a handler for permission_replied events.\n\t * @param handler - Callback invoked when a permission is replied to\n\t * @returns Unsubscribe function\n\t */\n\tonReplied(handler: (event: PermissionRepliedEvent) => void): () => void;\n\n\t/**\n\t * Clear all registered handlers.\n\t */\n\tclear(): void;\n} {\n\tconst askedHandlers = new Set<(request: Request) => void>();\n\tconst repliedHandlers = new Set<(event: PermissionRepliedEvent) => void>();\n\n\treturn {\n\t\temitAsked: (request: Request) => {\n\t\t\tfor (const handler of askedHandlers) {\n\t\t\t\ttry {\n\t\t\t\t\thandler(request);\n\t\t\t\t} catch (err) {\n\t\t\t\t\tconsole.error(\"Error in permission_asked handler:\", err);\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\n\t\temitReplied: (requestID: string, sessionID: string, reply: PermissionDecision) => {\n\t\t\tconst event: PermissionRepliedEvent = { requestID, sessionID, reply };\n\t\t\tfor (const handler of repliedHandlers) {\n\t\t\t\ttry {\n\t\t\t\t\thandler(event);\n\t\t\t\t} catch (err) {\n\t\t\t\t\tconsole.error(\"Error in permission_replied handler:\", err);\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\n\t\tonAsked: (handler: (request: Request) => void): (() => void) => {\n\t\t\taskedHandlers.add(handler);\n\t\t\treturn () => askedHandlers.delete(handler);\n\t\t},\n\n\t\tonReplied: (handler: (event: PermissionRepliedEvent) => void): (() => void) => {\n\t\t\trepliedHandlers.add(handler);\n\t\t\treturn () => repliedHandlers.delete(handler);\n\t\t},\n\n\t\tclear: () => {\n\t\t\taskedHandlers.clear();\n\t\t\trepliedHandlers.clear();\n\t\t},\n\t};\n}\n"]}

package/dist/core/extensions/builtin/permission-system/external-dir.d.ts

@@ -0,0 +1,4 @@
+export declare function expandHome(inputPath: string): string;
+export declare function isExternalPath(inputPath: string, cwd: string): boolean;
+export declare function extractExternalPaths(command: string, cwd: string): string[];
+//# sourceMappingURL=external-dir.d.ts.map

package/dist/core/extensions/builtin/permission-system/external-dir.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-dir.d.ts","sourceRoot":"","sources":["../../../../../src/core/extensions/builtin/permission-system/external-dir.ts"],"names":[],"mappings":"AAIA,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAcpD;AAWD,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAatE;AAgFD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAgC3E","sourcesContent":["import * as fs from \"node:fs\";\nimport * as os from \"node:os\";\nimport * as path from \"node:path\";\n\nexport function expandHome(inputPath: string): string {\n\tif (inputPath === \"~\") {\n\t\treturn os.homedir();\n\t}\n\tif (inputPath.startsWith(\"~/\") || inputPath.startsWith(\"~\\\\\")) {\n\t\treturn path.join(os.homedir(), inputPath.slice(2));\n\t}\n\tif (inputPath.startsWith(\"$HOME/\") || inputPath.startsWith(\"$HOME\\\\\")) {\n\t\treturn path.join(os.homedir(), inputPath.slice(6));\n\t}\n\tif (inputPath === \"$HOME\") {\n\t\treturn os.homedir();\n\t}\n\treturn inputPath;\n}\n\nfunction normalizePath(inputPath: string): string {\n\ttry {\n\t\tif (fs.existsSync(inputPath)) {\n\t\t\treturn fs.realpathSync(inputPath);\n\t\t}\n\t} catch {}\n\treturn path.normalize(inputPath);\n}\n\nexport function isExternalPath(inputPath: string, cwd: string): boolean {\n\tconst expandedPath = expandHome(inputPath);\n\tconst absolutePath = path.resolve(cwd, expandedPath);\n\tconst normalizedTarget = normalizePath(absolutePath);\n\tconst normalizedCwd = normalizePath(cwd);\n\n\tif (normalizedTarget === normalizedCwd) {\n\t\treturn false;\n\t}\n\n\tconst cwdWithSeparator = normalizedCwd.endsWith(path.sep) ? normalizedCwd : normalizedCwd + path.sep;\n\n\treturn !normalizedTarget.startsWith(cwdWithSeparator);\n}\n\nfunction tokenizeCommand(command: string): string[] {\n\tconst tokens: string[] = [];\n\tlet current = \"\";\n\tlet inQuotes: string | null = null;\n\tlet escaped = false;\n\n\tfor (let i = 0; i < command.length; i++) {\n\t\tconst char = command[i];\n\n\t\tif (escaped) {\n\t\t\tcurrent += char;\n\t\t\tescaped = false;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \"\\\\\") {\n\t\t\tescaped = true;\n\t\t\tcurrent += char;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (inQuotes) {\n\t\t\tif (char === inQuotes) {\n\t\t\t\tinQuotes = null;\n\t\t\t}\n\t\t\tcurrent += char;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === '\"' || char === \"'\") {\n\t\t\tinQuotes = char;\n\t\t\tcurrent += char;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (char === \" \" || char === \"\\t\") {\n\t\t\tif (current.length > 0) {\n\t\t\t\ttokens.push(current);\n\t\t\t\tcurrent = \"\";\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tcurrent += char;\n\t}\n\n\tif (current.length > 0) {\n\t\ttokens.push(current);\n\t}\n\n\treturn tokens;\n}\n\nfunction unquote(token: string): string {\n\tif (token.length < 2) return token;\n\tconst first = token[0];\n\tconst last = token[token.length - 1];\n\tif ((first === '\"' || first === \"'\") && first === last) {\n\t\treturn token.slice(1, -1);\n\t}\n\treturn token;\n}\n\nfunction looksLikePath(token: string): boolean {\n\tif (token.startsWith(\"-\")) return false;\n\tif (/^[A-Za-z_][A-Za-z0-9_]*=/.test(token)) return false;\n\tif ([\"|\", \"||\", \"&&\", \";\", \"&\", \"$(\", \"${\", \"`\"].some((op) => token.includes(op))) {\n\t\treturn false;\n\t}\n\tif (token.startsWith(\"/\")) return true;\n\tif (token.startsWith(\"~\")) return true;\n\tif (token.startsWith(\"$HOME\")) return true;\n\tif (token.startsWith(\"./\") || token.startsWith(\"../\")) return true;\n\tif (token.includes(\"/\")) return true;\n\n\treturn false;\n}\n\nexport function extractExternalPaths(command: string, cwd: string): string[] {\n\tconst tokens = tokenizeCommand(command);\n\tconst externalPaths: string[] = [];\n\n\tlet startIndex = 0;\n\tif (tokens.length > 0) {\n\t\tconst firstToken = unquote(tokens[0]);\n\t\tif (\n\t\t\t!firstToken.startsWith(\"/\") &&\n\t\t\t!firstToken.startsWith(\"~\") &&\n\t\t\t!firstToken.startsWith(\"$\") &&\n\t\t\t!firstToken.startsWith(\"./\") &&\n\t\t\t!firstToken.startsWith(\"../\") &&\n\t\t\t!firstToken.includes(\"/\")\n\t\t) {\n\t\t\tstartIndex = 1;\n\t\t}\n\t}\n\n\tfor (let i = startIndex; i < tokens.length; i++) {\n\t\tconst token = unquote(tokens[i]);\n\n\t\tif (!looksLikePath(token)) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (isExternalPath(token, cwd)) {\n\t\t\texternalPaths.push(token);\n\t\t}\n\t}\n\n\treturn externalPaths;\n}\n"]}