@code-yeongyu/senpi 2026.10.5 → 2026.10.6

package/dist/core/extensions/builtin/gpt-apply-patch/streaming-render.js

@@ -3,6 +3,9 @@ import { normalizeApplyPatchArguments } from "./params.js";
 import { renderPatchLine } from "./preview-format.js";
 import { StreamingPatchParser } from "./streaming-parser.js";
 import { extractPatchedPaths } from "./text.js";
+// Tail-window the streaming body so a long patch never takes over the viewport: a sticky
+// per-file header plus the last few lines of each file, with a "+N lines above" indicator.
+const STREAMING_TAIL_LINES_PER_FILE = 12;
 function hunkOperation(hunk) {
     if (hunk.type === "add")
         return "Added";
@@ -27,8 +30,44 @@ function hunkDiffLines(hunk) {
         ...chunk.newLines.map((line) => `  + ${line}`),
     ]);
 }
-function formatStreamingHunks(hunks) {
-    return hunks.flatMap((hunk) => [`• ${hunkOperation(hunk)} ${hunkPath(hunk)}`, ...hunkDiffLines(hunk)]).join("\n");
+function hunkChangeCounts(hunk) {
+    if (hunk.type === "add")
+        return { added: hunk.content.split("\n").filter(Boolean).length, removed: 0 };
+    if (hunk.type === "delete")
+        return { added: 0, removed: 0 };
+    // addedCount/removedCount are tracked by prefix at parse time, so context lines are excluded
+    // and a + line whose text equals a context line still counts as an addition (no set-membership
+    // or positional undercount).
+    let added = 0;
+    let removed = 0;
+    for (const chunk of hunk.chunks) {
+        added += chunk.addedCount;
+        removed += chunk.removedCount;
+    }
+    return { added, removed };
+}
+// One bounded block per file: sticky header with net counts, then the last N diff lines
+// with a "+N lines above" marker when the file outgrew the window.
+function formatStreamingHunks(hunks, partialLine) {
+    const blocks = [];
+    for (const hunk of hunks) {
+        const { added, removed } = hunkChangeCounts(hunk);
+        const counts = added + removed > 0 ? ` (+${added} -${removed})` : "";
+        const header = `• ${hunkOperation(hunk)} ${hunkPath(hunk)}${counts}`;
+        const lines = hunkDiffLines(hunk);
+        if (lines.length <= STREAMING_TAIL_LINES_PER_FILE) {
+            blocks.push([header, ...lines].join("\n"));
+            continue;
+        }
+        const hidden = lines.length - STREAMING_TAIL_LINES_PER_FILE;
+        const tail = lines.slice(-STREAMING_TAIL_LINES_PER_FILE);
+        blocks.push([header, `  … (+${hidden} lines above)`, ...tail].join("\n"));
+    }
+    // The in-flight, not-yet-newline-terminated line renders dimmed as the last row.
+    const partial = partialLine.trim();
+    if (partial.length > 0)
+        blocks.push(`  ${partial}`);
+    return blocks.join("\n");
 }
 function updateStreamingState(input, state) {
     if (!state.streamingParser || !input.startsWith(state.streamingInput ?? "")) {
@@ -39,8 +78,14 @@ function updateStreamingState(input, state) {
     }
     const previousInput = state.streamingInput ?? "";
     const delta = input.slice(previousInput.length);
+    // A zero-length delta (same render pass re-run with no new text) must not re-parse or re-render.
+    if (delta.length === 0)
+        return state.streamingHunks ?? [];
     try {
-        state.streamingHunks = state.streamingParser.pushDelta(delta);
+        // Parse the delta, then render the parser's live hunk list rather than the deep clone
+        // pushDelta returns; the per-delta structuredClone over every hunk is the O(n^2) cost.
+        state.streamingParser.pushDelta(delta);
+        state.streamingHunks = state.streamingParser.getLiveHunks?.() ?? state.streamingHunks;
         state.streamingInput = input;
         state.streamingError = undefined;
     }
@@ -49,30 +94,56 @@ function updateStreamingState(input, state) {
     }
     return state.streamingHunks ?? [];
 }
-function renderBox(title, body, theme) {
+function renderBox(title, body, theme, dimLastLine) {
     const component = new Container();
     const box = new Box(1, 1, (text) => theme.bg("toolPendingBg", text));
     box.addChild(new Text(theme.fg("toolTitle", theme.bold(title)), 0, 0));
     box.addChild(new Spacer(1));
-    box.addChild(new Text(body
-        .split("\n")
-        .map((line) => renderPatchLine(line, theme))
+    const lines = body.split("\n");
+    box.addChild(new Text(lines
+        .map((line, index) => dimLastLine && index === lines.length - 1
+        ? theme.fg("toolDiffContext", line)
+        : renderPatchLine(line, theme))
         .join("\n"), 0, 0));
     component.addChild(box);
     return component;
 }
+// A no-change delta keeps the already-rendered body; the component renders it on demand so the
+// box persists across a redraw without a rebuild.
+class MemoizedStreamingBox extends Container {
+    constructor(body, hasPartial, theme) {
+        super();
+        this.body = body;
+        this.hasPartial = hasPartial;
+        this.theme = theme;
+    }
+    render(width) {
+        this.built ??= renderBox("Applying patch", this.body, this.theme, this.hasPartial);
+        return this.built.render(width);
+    }
+}
 export function renderStreamingPatchCall(args, theme, state) {
     const input = normalizeApplyPatchArguments(args).input;
     if (!input)
         return undefined;
     const hunks = updateStreamingState(input, state);
     if (state.streamingError)
-        return renderBox("Invalid patch stream", state.streamingError, theme);
-    if (hunks.length > 0)
-        return renderBox("Applying patch", formatStreamingHunks(hunks), theme);
+        return renderBox("Invalid patch stream", state.streamingError, theme, false);
+    if (hunks.length > 0) {
+        const partialLine = state.streamingParser?.getPartialLine?.() ?? "";
+        const body = formatStreamingHunks(hunks, partialLine);
+        const hasPartial = partialLine.trim().length > 0;
+        // A no-change delta keeps the already-rendered box instead of rebuilding it; the box must
+        // still render (returning undefined here would blank the preview on any redraw).
+        if (body === state.streamingLastRenderKey && state.streamingLastRenderKey !== undefined) {
+            return new MemoizedStreamingBox(body, hasPartial, theme);
+        }
+        state.streamingLastRenderKey = body;
+        return renderBox("Applying patch", body, theme, hasPartial);
+    }
     const paths = extractPatchedPaths(input);
     if (paths.length === 0)
         return undefined;
-    return renderBox("Applying patch", paths.map((filePath) => `• ${filePath}`).join("\n"), theme);
+    return renderBox("Applying patch", paths.map((filePath) => `• ${filePath}`).join("\n"), theme, false);
 }
 //# sourceMappingURL=streaming-render.js.map

package/dist/core/extensions/builtin/gpt-apply-patch/types.d.ts

@@ -20,6 +20,10 @@ export type PatchChunk = {
     newLines: string[];
     contextLineIndices: ContextLineIndex[];
     isEndOfFile: boolean;
+    /** Real added/removed line counts by prefix, tracked at parse time (context lines excluded,
+     * so a `+` line whose text equals a context line still counts as an addition). */
+    addedCount: number;
+    removedCount: number;
 };
 export type ApplyPatchWireMode = "freeform" | "json" | "none";
 export type ApplyPatchToolVariant = Exclude<ApplyPatchWireMode, "none">;
@@ -111,9 +115,13 @@ export type ApplyPatchRenderState = {
     streamingInput?: string;
     streamingParser?: {
         pushDelta: (delta: string) => ParsedPatch[];
+        getLiveHunks?: () => readonly ParsedPatch[];
+        getPartialLine?: () => string;
     };
-    streamingHunks?: ParsedPatch[];
+    streamingHunks?: readonly ParsedPatch[];
     streamingError?: string;
+    /** Last rendered body fingerprint, so a delta that changes nothing skips the rebuild. */
+    streamingLastRenderKey?: string;
 };
 export type ApplyPatchToolDefinition = ToolDefinition<typeof APPLY_PATCH_PARAMS, ApplyPatchToolDetails | undefined, ApplyPatchRenderState>;
 export type ApplyPatchExtensionAPI = Pick<ExtensionAPI, "on" | "getActiveTools" | "getAllTools" | "setActiveTools"> & {

package/dist/core/extensions/builtin/permission-system/auto-credentials.d.ts

@@ -0,0 +1,2 @@
+export declare function isCredentialPath(value: string): boolean;
+//# sourceMappingURL=auto-credentials.d.ts.map

package/dist/core/extensions/builtin/permission-system/auto-credentials.js

@@ -0,0 +1,17 @@
+const CREDENTIAL_PATH_PATTERNS = [
+    /(^|[/\\=])\.(ssh|aws|gnupg|kube|docker|azure|gcloud)([/\\]|$)/i,
+    /(^|[/\\=])\.config[/\\](gh|gcloud|hub|op)([/\\]|$)/i,
+    /(^|[/\\=])\.(netrc|npmrc|pypirc|pgpass|git-credentials|htpasswd|vault-token|envrc|terraformrc)$/i,
+    /(^|[/\\=])\.env(\.[^/\\]*)?$/i,
+    /(^|[/\\=])id_(rsa|dsa|ecdsa|ed25519)(\.pub)?$/i,
+    /\.(pem|key|p12|pfx|jks|keystore|kdbx|ppk|asc|gpg)$/i,
+    /(^|[/\\=])\.?credentials(\.json|\.toml|\.tfrc\.json)?$/i,
+    /(^|[/\\=])auth\.json$/i,
+    /(^|[/\\=])(\.[a-z]+_history|fish_history)$/i,
+    /(^|[/\\=])\.m2[/\\]settings\.xml$/i,
+    /(^|[/\\])Library[/\\]Keychains([/\\]|$)/i,
+];
+export function isCredentialPath(value) {
+    return CREDENTIAL_PATH_PATTERNS.some((pattern) => pattern.test(value));
+}
+//# sourceMappingURL=auto-credentials.js.map

package/dist/core/extensions/builtin/permission-system/auto-paths.d.ts

@@ -0,0 +1,14 @@
+export type TargetKind = "file" | "directory" | "missing" | "other";
+/** Whether something, even a dangling symlink, exists at `target` itself; git looks at the name. */
+export declare function existsAtName(target: string): boolean;
+/** Whether `cwd` is a root `auto` approves anything in (see `projectRoot`). */
+export declare function isProjectSession(cwd: string): boolean;
+/** What is at `target` after following every symlink, without opening anything. */
+export declare function targetKind(target: string): TargetKind;
+/**
+ * Whether `auto` may touch the absolute path `target` that a tool resolved: after following every
+ * symlink it is inside the project root, no component below the root is hidden (other than a
+ * short list of repository and formatter files), and nothing along it is credential-shaped.
+ */
+export declare function isApprovableTarget(target: string, cwd: string): boolean;
+//# sourceMappingURL=auto-paths.d.ts.map

package/dist/core/extensions/builtin/permission-system/auto-paths.js

@@ -0,0 +1,93 @@
+import { lstatSync } from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { realpathWithoutOpenStrict } from "../../../../utils/paths.js";
+import { isCredentialPath } from "./auto-credentials.js";
+/** Hidden project entries `auto` may touch: repository metadata and formatter/linter configs. */
+const SAFE_HIDDEN_NAMES = new Set([
+    ".github",
+    ".gitignore",
+    ".gitattributes",
+    ".editorconfig",
+    ".nvmrc",
+    ".node-version",
+    ".prettierrc",
+    ".prettierignore",
+    ".eslintrc",
+    ".eslintignore",
+    ".stylelintrc",
+    ".markdownlint.json",
+]);
+const physicalPath = (target) => {
+    try {
+        const resolved = realpathWithoutOpenStrict(target);
+        return resolved.split(path.sep).includes("..") ? undefined : resolved;
+    }
+    catch {
+        return undefined;
+    }
+};
+/**
+ * The project root `auto` works in, or undefined when the session root is `/`, the home directory, any
+ * ancestor of it (`/Users`, `/home`), or inside a hidden directory (`~/.config`): from there login
+ * items, app stores and tool configs would count as project files.
+ */
+function projectRoot(cwd) {
+    const root = physicalPath(path.resolve(cwd));
+    const home = physicalPath(os.homedir());
+    if (root === undefined || home === undefined)
+        return undefined;
+    const homeFromRoot = path.relative(root, home);
+    const rootContainsHome = homeFromRoot === "" || (!homeFromRoot.startsWith("..") && !path.isAbsolute(homeFromRoot));
+    const hiddenRoot = root.split(path.sep).some((segment) => segment.startsWith("."));
+    return root === path.parse(root).root || rootContainsHome || hiddenRoot ? undefined : root;
+}
+/** Whether something, even a dangling symlink, exists at `target` itself; git looks at the name. */
+export function existsAtName(target) {
+    try {
+        return lstatSync(target, { throwIfNoEntry: false }) !== undefined;
+    }
+    catch {
+        // A name the filesystem refuses (too long, a loop, no permission) is not a plain ref either:
+        // report it as existing so the caller checks it as a path, and that check asks.
+        return true;
+    }
+}
+/** Whether `cwd` is a root `auto` approves anything in (see `projectRoot`). */
+export function isProjectSession(cwd) {
+    return projectRoot(cwd) !== undefined;
+}
+/** What is at `target` after following every symlink, without opening anything. */
+export function targetKind(target) {
+    const physical = physicalPath(target);
+    if (physical === undefined)
+        return "other";
+    try {
+        const stats = lstatSync(physical);
+        return stats.isFile() ? "file" : stats.isDirectory() ? "directory" : "other";
+    }
+    catch (error) {
+        return error.code === "ENOENT" ? "missing" : "other";
+    }
+}
+/**
+ * Whether `auto` may touch the absolute path `target` that a tool resolved: after following every
+ * symlink it is inside the project root, no component below the root is hidden (other than a
+ * short list of repository and formatter files), and nothing along it is credential-shaped.
+ */
+export function isApprovableTarget(target, cwd) {
+    const root = projectRoot(cwd);
+    const physical = physicalPath(target);
+    if (root === undefined || physical === undefined)
+        return false;
+    const below = path.relative(root, physical);
+    if (below === "")
+        return true;
+    if (below.startsWith("..") || path.isAbsolute(below))
+        return false;
+    if (below.split(path.sep).some((segment) => segment.startsWith(".") && !SAFE_HIDDEN_NAMES.has(segment))) {
+        return false;
+    }
+    return !isCredentialPath(physical) && !isCredentialPath(target);
+}
+//# sourceMappingURL=auto-paths.js.map

package/dist/core/extensions/builtin/permission-system/auto-policy.d.ts

@@ -0,0 +1,20 @@
+import type { PermissionRequest } from "./parsers.ts";
+export type AutoCommandVerdict = "allow" | "ask";
+export interface AutoDecision {
+    /** Approve an ask that comes only from the preset's own rule (a user's rules still win). */
+    readonly approveBlanketAsk: boolean;
+}
+/**
+ * Judges a shell command for the `auto` preset: every simple command must be a listed read-only
+ * program run in the project root, whose every word the program grammar classifies, and every
+ * path word must name an approvable project file or directory. Anything else asks.
+ */
+export declare function judgeAutoCommand(command: string, cwd: string): AutoCommandVerdict;
+/**
+ * The `auto` preset's allowlist (decision table on senpi#2614). Each decision is made on the exact
+ * target the tool will open, obtained from the tool's own resolver (`resolveReadPathAsync` for `read`,
+ * `resolveToCwd` for `write`, `edit`, `ls`, `find` and `grep`, `parsePatch` + `resolvePatchPath` for `apply_patch`).
+ * Every other call keeps the preset's ask.
+ */
+export declare function decideAuto(toolName: string, input: Record<string, unknown>, request: PermissionRequest, cwd: string): Promise<AutoDecision>;
+//# sourceMappingURL=auto-policy.d.ts.map

package/dist/core/extensions/builtin/permission-system/auto-policy.js

@@ -0,0 +1,126 @@
+import * as path from "node:path";
+import { resolveReadPathAsync, resolveToCwd } from "../../../tools/path-utils.js";
+import { normalizeApplyPatchArguments } from "../gpt-apply-patch/params.js";
+import { parsePatch } from "../gpt-apply-patch/parser.js";
+import { resolvePatchPath } from "../gpt-apply-patch/workspace.js";
+import { isCredentialPath } from "./auto-credentials.js";
+import { existsAtName, isApprovableTarget, isProjectSession, targetKind } from "./auto-paths.js";
+import { PROGRAM_RULES } from "./auto-program-rules.js";
+import { splitShellSegments } from "./auto-shell-segments.js";
+const WRITE_TOOLS = new Set(["write", "edit"]);
+const LIST_TOOLS = new Set(["ls", "find"]);
+const NO = { approveBlanketAsk: false };
+const YES = { approveBlanketAsk: true };
+const approvedTarget = (target, cwd, kinds) => isApprovableTarget(target, cwd) && kinds.includes(targetKind(target));
+function shellWordAllowed(entry, cwd) {
+    if (entry.role === "text")
+        return true;
+    const text = entry.word.text;
+    if (text === "" || text === "-" || text.split("/").includes(".."))
+        return false;
+    const target = path.resolve(cwd, text);
+    if (entry.role === "read-file")
+        return approvedTarget(target, cwd, ["file"]);
+    if (entry.role === "list")
+        return approvedTarget(target, cwd, ["file", "directory"]);
+    if (entry.role === "ref-or-path") {
+        if (isCredentialPath(target))
+            return false;
+        return !existsAtName(target) || approvedTarget(target, cwd, ["file", "directory"]);
+    }
+    return false;
+}
+/**
+ * Judges a shell command for the `auto` preset: every simple command must be a listed read-only
+ * program run in the project root, whose every word the program grammar classifies, and every
+ * path word must name an approvable project file or directory. Anything else asks.
+ */
+export function judgeAutoCommand(command, cwd) {
+    const segments = splitShellSegments(command);
+    if (!segments || segments.length === 0)
+        return "ask";
+    for (const segment of segments) {
+        const [program, ...args] = segment;
+        if (!program || program.text.includes("/") || program.text.includes("="))
+            return "ask";
+        const classified = PROGRAM_RULES.get(program.text)?.(args);
+        if (classified === undefined || !classified.every((entry) => shellWordAllowed(entry, cwd)))
+            return "ask";
+    }
+    return "allow";
+}
+const stringPaths = (value) => {
+    if (value === undefined)
+        return ["."];
+    if (typeof value === "string")
+        return [value];
+    if (Array.isArray(value) && value.every((item) => typeof item === "string"))
+        return value;
+    return undefined;
+};
+/** The paths an `apply_patch` call will write, resolved by the patch tool's own parser and resolver. */
+function patchTargets(input, cwd) {
+    const { input: patchText } = normalizeApplyPatchArguments(input);
+    if (!patchText)
+        return undefined;
+    try {
+        const hunks = parsePatch(patchText);
+        // A delete asks, the same as `rm` in the shell.
+        if (hunks.length === 0 || hunks.some((hunk) => hunk.type === "delete"))
+            return undefined;
+        return hunks.flatMap((hunk) => {
+            const targets = [resolvePatchPath(cwd, hunk.filePath)];
+            if (hunk.type === "update" && hunk.movePath)
+                targets.push(resolvePatchPath(cwd, hunk.movePath));
+            return targets;
+        });
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The `auto` preset's allowlist (decision table on senpi#2614). Each decision is made on the exact
+ * target the tool will open, obtained from the tool's own resolver (`resolveReadPathAsync` for `read`,
+ * `resolveToCwd` for `write`, `edit`, `ls`, `find` and `grep`, `parsePatch` + `resolvePatchPath` for `apply_patch`).
+ * Every other call keeps the preset's ask.
+ */
+export async function decideAuto(toolName, input, request, cwd) {
+    if (!isProjectSession(cwd))
+        return NO;
+    if (toolName === "bash" || (toolName === "monitor" && typeof input.command === "string")) {
+        if (request.permission !== "bash" || typeof input.command !== "string")
+            return NO;
+        return judgeAutoCommand(input.command, cwd) === "allow" ? YES : NO;
+    }
+    if (toolName === "read") {
+        const raw = input.path ?? input.file_path;
+        if (typeof raw !== "string")
+            return NO;
+        return approvedTarget(await resolveReadPathAsync(raw, cwd), cwd, ["file", "missing"]) ? YES : NO;
+    }
+    if (toolName === "grep") {
+        const raws = stringPaths(input.path);
+        if (raws?.length === 0)
+            return NO;
+        return raws?.every((raw) => approvedTarget(resolveToCwd(raw, cwd), cwd, ["file"])) ? YES : NO;
+    }
+    if (LIST_TOOLS.has(toolName)) {
+        const raw = input.path ?? ".";
+        if (typeof raw !== "string")
+            return NO;
+        return approvedTarget(resolveToCwd(raw || ".", cwd), cwd, ["directory"]) ? YES : NO;
+    }
+    if (WRITE_TOOLS.has(toolName)) {
+        const raw = input.path ?? input.file_path;
+        if (typeof raw !== "string")
+            return NO;
+        return approvedTarget(resolveToCwd(raw, cwd), cwd, ["file", "missing"]) ? YES : NO;
+    }
+    if (toolName === "apply_patch") {
+        const targets = patchTargets(input, cwd);
+        return targets?.every((target) => approvedTarget(target, cwd, ["file", "missing"])) ? YES : NO;
+    }
+    return NO;
+}
+//# sourceMappingURL=auto-policy.js.map

package/dist/core/extensions/builtin/permission-system/auto-program-rules.d.ts

@@ -0,0 +1,6 @@
+import { type ClassifiedWord } from "./auto-shell-grammar.ts";
+import type { ShellWord } from "./auto-shell-segments.ts";
+/** Classifies a command's words, or undefined when the program or any word is not understood. */
+export type ProgramRule = (args: readonly ShellWord[]) => ClassifiedWord[] | undefined;
+export declare const PROGRAM_RULES: ReadonlyMap<string, ProgramRule>;
+//# sourceMappingURL=auto-program-rules.d.ts.map

package/dist/core/extensions/builtin/permission-system/auto-program-rules.js

@@ -0,0 +1,139 @@
+import { classifyWords } from "./auto-shell-grammar.js";
+const all = (role) => () => role;
+const firstIs = (first, rest) => (index) => index === 0 ? first : rest;
+const flags = (names, role = true) => Object.fromEntries(names.split(" ").map((name) => [name, role]));
+const spec = (value) => (args) => classifyWords(args, value);
+/**
+ * grep and rg: the first operand is the pattern unless a pattern came from `-e`/`--regexp`, in
+ * which case every operand is a file to read.
+ */
+const searchSpec = (value) => (args) => {
+    const patternFromFlag = args.some((word) => word.text === "--regexp" || word.text.startsWith("--regexp=") || /^-[^-]*e/.test(word.text));
+    return classifyWords(args, patternFromFlag ? { ...value, operand: all("read-file"), minOperands: 1 } : value);
+};
+const READ_FILES = { flags: {}, operand: all("read-file"), minOperands: 1 };
+const SPECS = [
+    ["pwd", spec({ flags: {}, operand: all("text"), maxOperands: 0 })],
+    ["true", spec({ flags: {}, operand: all("text"), maxOperands: 0 })],
+    ["echo", spec({ flags: flags("-n -e -E"), operand: all("text") })],
+    ["which", spec({ flags: flags("-a"), operand: all("text"), minOperands: 1 })],
+    [
+        "ls",
+        spec({
+            flags: flags("-a -A -l -h -1 -R -t -S -r -d -F -p --all --almost-all --human-readable --recursive"),
+            operand: all("list"),
+        }),
+    ],
+    ["cat", spec({ ...READ_FILES, flags: flags("-n -b -s -A -e -t -v") })],
+    ["head", spec({ ...READ_FILES, flags: { ...flags("-n -c --lines --bytes", "text"), ...flags("-q -v --quiet") } })],
+    ["tail", spec({ ...READ_FILES, flags: { ...flags("-n -c --lines --bytes", "text"), ...flags("-q -v --quiet") } })],
+    ["wc", spec({ ...READ_FILES, flags: flags("-l -w -c -m -L --lines --words --bytes --chars") })],
+    [
+        "diff",
+        spec({
+            ...READ_FILES,
+            flags: { ...flags("-u -q -s -w -b -B -i --brief"), ...flags("-U --unified", "text") },
+            minOperands: 2,
+            maxOperands: 2,
+        }),
+    ],
+    ["stat", spec({ flags: flags("-L"), operand: all("list"), minOperands: 1 })],
+    ["file", spec({ flags: flags("-b -i -L --brief --mime"), operand: all("read-file"), minOperands: 1 })],
+    [
+        "cut",
+        spec({
+            ...READ_FILES,
+            flags: {
+                ...flags("-d -f -c -b --delimiter --fields --characters --bytes", "text"),
+                ...flags("-s --only-delimited"),
+            },
+        }),
+    ],
+    [
+        "grep",
+        searchSpec({
+            flags: {
+                ...flags("-i -n -c -l -L -v -w -x -o -q -s -H -h -F -E --ignore-case --line-number --count --fixed-strings --extended-regexp --files-with-matches"),
+                ...flags("-e -m -A -B -C --regexp --max-count --after-context --before-context --context", "text"),
+            },
+            operand: firstIs("text", "read-file"),
+            minOperands: 2,
+        }),
+    ],
+    [
+        "rg",
+        searchSpec({
+            flags: {
+                ...flags("-i -n -c -l -v -w -x -o -F -S -N --ignore-case --line-number --count --fixed-strings --smart-case --files-with-matches --no-heading"),
+                ...flags("-e -m -A -B -C --regexp --max-count --after-context --before-context --context", "text"),
+            },
+            operand: firstIs("text", "read-file"),
+            minOperands: 2,
+        }),
+    ],
+];
+const GIT_REF = /^[A-Za-z0-9_][A-Za-z0-9_.@-]*$/;
+/**
+ * A git operand that is not shaped like a ref is a path; a ref-shaped one (`HEAD`, `main`, `notes`)
+ * is still a path when something exists at that name, which the judge checks.
+ */
+const gitOperand = (_index, _count, text) => GIT_REF.test(text) && !text.includes("..") ? "ref-or-path" : "list";
+const GIT_READ_SUBCOMMANDS = {
+    status: { flags: flags("-s -b -u --short --branch --porcelain --untracked-files"), operand: all("list") },
+    diff: {
+        flags: flags("--stat --cached --staged --name-only --name-status --numstat --no-color --color -w"),
+        operand: gitOperand,
+    },
+    log: {
+        flags: {
+            ...flags("--oneline --graph --decorate --stat --no-color --all --reverse --name-only --name-status"),
+            ...flags("-n --max-count --since --until --author --format --pretty", "text"),
+        },
+        operand: gitOperand,
+    },
+    "rev-parse": { flags: flags("--abbrev-ref --short --show-toplevel --verify"), operand: gitOperand },
+    "ls-files": {
+        flags: flags("-m -o -d -s --modified --others --deleted --stage --exclude-standard"),
+        operand: all("list"),
+    },
+    blame: {
+        flags: { ...flags("-w -s --porcelain"), ...flags("-L", "text") },
+        operand: all("read-file"),
+        minOperands: 1,
+    },
+    branch: {
+        flags: flags("-a -r -v -vv --all --remotes --verbose --list --show-current"),
+        operand: all("text"),
+        maxOperands: 0,
+    },
+};
+const SUMMARY_ONLY = new Set(["--stat", "--name-only", "--name-status", "--numstat"]);
+/**
+ * Read-only git subcommands only; any global option (`-c`, `-C`, `--git-dir`, a pager) asks.
+ * `diff` prints file contents, which can include a tracked secret, so it passes only in a summary
+ * form; `show` is not listed (`git show <blob id>` prints any tracked file), no operand may name an
+ * object path or a full object id, and an operand that is not a plain ref is checked as a path.
+ */
+const gitRule = (args) => {
+    const [sub, ...rest] = args;
+    if (sub === undefined)
+        return undefined;
+    const subSpec = GIT_READ_SUBCOMMANDS[sub.text];
+    // A flag's value (`-n 1000`) is not an object id; every other word is checked.
+    const isFlagValue = (index) => {
+        const previous = rest[index - 1]?.text;
+        return previous !== undefined && typeof subSpec?.flags[previous] === "string";
+    };
+    if (subSpec === undefined ||
+        rest.some((word, index) => word.text.includes(":") || (!isFlagValue(index) && /^[0-9a-f]{4,64}$/i.test(word.text)))) {
+        return undefined;
+    }
+    if (sub.text === "diff" && !rest.some((word) => SUMMARY_ONLY.has(word.text)))
+        return undefined;
+    return classifyWords(rest, subSpec);
+};
+export const PROGRAM_RULES = new Map([
+    ...SPECS,
+    ["git", gitRule],
+]);
+//# sourceMappingURL=auto-program-rules.js.map

package/dist/core/extensions/builtin/permission-system/auto-shell-grammar.d.ts

@@ -0,0 +1,29 @@
+import type { ShellWord } from "./auto-shell-segments.ts";
+/**
+ * What a word means to the program, so the judge knows how to check it: `read-file` is read from
+ * (must be a regular project file), `list` only has its name shown, `text` is never used as a path
+ * (a pattern, a count, a format), and `ref-or-path` is a git revision unless something exists at
+ * that name, in which case it is checked like `list` (git reads it as a path).
+ */
+export type WordRole = "read-file" | "list" | "text" | "ref-or-path";
+export interface ClassifiedWord {
+    readonly role: WordRole;
+    readonly word: ShellWord;
+}
+export interface ProgramSpec {
+    /** Every flag the program may take; `true` = no value, a role = takes one value. */
+    readonly flags: Readonly<Record<string, true | WordRole>>;
+    /** The role of operand `index` out of `count` operands, given its text. */
+    readonly operand: (index: number, count: number, text: string) => WordRole;
+    readonly minOperands?: number;
+    readonly maxOperands?: number;
+}
+/**
+ * Classifies every word of one simple command against `spec`, or returns undefined when any word
+ * is not understood: an unknown flag (short or long), a flag in a form the spec does not list, a
+ * value-taking flag with no value, or an operand count out of range. Short flags may be
+ * clustered (`-la`), and a value-taking short flag takes the rest of its word as the value
+ * (`-o/x`, `-ro/x`) or else the next word; a long flag takes `--name=value` or `--name value`.
+ */
+export declare function classifyWords(words: readonly ShellWord[], spec: ProgramSpec): ClassifiedWord[] | undefined;
+//# sourceMappingURL=auto-shell-grammar.d.ts.map