@dadado/agent-kit-cli 6.2.0 → 6.4.0

package/dist/{chunk-C2SJDYAM.js → chunk-H46W7NHC.js}

@@ -5,7 +5,7 @@ import {
   DEFAULT_REGISTRY_REF,
   DEFAULT_REGISTRY_URL,
   resolveRegistryRoot
-} from "./chunk-NSSXSZLL.js";
+} from "./chunk-7BEHUBEJ.js";
 
 // src/lifecycle/resolve-cli.ts
 async function resolveRegistryFromCli(options) {

package/dist/{chunk-SPYIP76F.js → chunk-HHR56LJQ.js}

@@ -1,6 +1,7 @@
 import {
+  INTERACTIVE_ALLOW_RULES,
   INTERACTIVE_DENY_RULES
-} from "./chunk-MAPOQEA2.js";
+} from "./chunk-6RRG3WOE.js";
 import {
   assertRealContained,
   assertRealParentContained,
@@ -10,7 +11,7 @@ import {
   resolveContained,
   saveManagedHashLedger,
   shouldPreserveCustomizedOverlay
-} from "./chunk-NSSXSZLL.js";
+} from "./chunk-7BEHUBEJ.js";
 import {
   ensureDir,
   fileExists
@@ -149,17 +150,18 @@ var ClaudeSettingsLedgerInvalidError = class extends Error {
   path;
 };
 function emptyLedger() {
-  return { schemaVersion: 1, denyRowsWritten: [], hookEntriesWritten: [] };
+  return { schemaVersion: 1, denyRowsWritten: [], allowRowsWritten: [], hookEntriesWritten: [] };
 }
 function hookKey(r) {
   return `${r.event}\0${r.marker}`;
 }
-function normalize(denyRows, hooks) {
+function normalize(denyRows, allowRows, hooks) {
   const seen = /* @__PURE__ */ new Map();
   for (const h of hooks) seen.set(hookKey(h), { event: h.event, marker: h.marker });
   return {
     schemaVersion: 1,
     denyRowsWritten: [...new Set(denyRows)].sort(),
+    allowRowsWritten: [...new Set(allowRows)].sort(),
     hookEntriesWritten: [...seen.values()].sort(
       (a, b) => a.event.localeCompare(b.event) || a.marker.localeCompare(b.marker)
     )
@@ -178,6 +180,8 @@ function parseLedger(raw) {
   if (!Array.isArray(o.denyRowsWritten) || !o.denyRowsWritten.every((r) => typeof r === "string")) {
     return null;
   }
+  const allowRows = o.allowRowsWritten ?? [];
+  if (!Array.isArray(allowRows) || !allowRows.every((r) => typeof r === "string")) return null;
   if (!Array.isArray(o.hookEntriesWritten)) return null;
   const hooks = [];
   for (const h of o.hookEntriesWritten) {
@@ -189,7 +193,7 @@ function parseLedger(raw) {
       marker: h.marker
     });
   }
-  return normalize(o.denyRowsWritten, hooks);
+  return normalize(o.denyRowsWritten, allowRows, hooks);
 }
 async function readState(root) {
   const abs = resolveContained(root, CLAUDE_SETTINGS_LEDGER_REL);
@@ -224,6 +228,7 @@ async function saveClaudeSettingsLedger(root, additions, opts = {}) {
   const base = state.kind === "ok" ? state.ledger : emptyLedger();
   const merged = normalize(
     [...base.denyRowsWritten, ...additions.denyRowsWritten ?? []],
+    [...base.allowRowsWritten, ...additions.allowRowsWritten ?? []],
     [...base.hookEntriesWritten, ...additions.hookEntriesWritten ?? []]
   );
   await mkdir(path2.dirname(abs), { recursive: true });
@@ -300,8 +305,12 @@ function mergeSessionStartHookIntoSettings(existingRaw, opts = {}) {
       };
     }
   }
-  const pending = { denyRows: [], hookEntries: [] };
-  const additions = { denyRowsWritten: [], hookEntriesWritten: [] };
+  const pending = { denyRows: [], allowRows: [], hookEntries: [] };
+  const additions = {
+    denyRowsWritten: [],
+    allowRowsWritten: [],
+    hookEntriesWritten: []
+  };
   const hooks = isPlainObject(root.hooks) ? { ...root.hooks } : {};
   const sessionStart = Array.isArray(hooks.SessionStart) ? [...hooks.SessionStart] : [];
   const preToolUse = Array.isArray(hooks.PreToolUse) ? [...hooks.PreToolUse] : [];
@@ -342,8 +351,17 @@ function mergeSessionStartHookIntoSettings(existingRaw, opts = {}) {
     (acc, next, i) => i === 0 ? next : combineStatus(acc, next),
     "unchanged"
   );
-  const denyAdded = mergeKitDenyRules(root, { ledger, authorized }, pending, additions);
-  const finalStatus = denyAdded && status === "unchanged" ? "refreshed" : status;
+  const ctx = { ledger, authorized };
+  const denyAdded = mergeKitRuleRows(root, "deny", INTERACTIVE_DENY_RULES, ctx, pending, additions);
+  const allowAdded = mergeKitRuleRows(
+    root,
+    "allow",
+    INTERACTIVE_ALLOW_RULES,
+    ctx,
+    pending,
+    additions
+  );
+  const finalStatus = (denyAdded || allowAdded) && status === "unchanged" ? "refreshed" : status;
   return {
     content: `${JSON.stringify(root, null, 2)}
 `,
@@ -355,23 +373,25 @@ function mergeSessionStartHookIntoSettings(existingRaw, opts = {}) {
 function combineStatus(a, b) {
   return a === "unchanged" && b !== "unchanged" ? "refreshed" : a;
 }
-function mergeKitDenyRules(root, ctx, pending, additions) {
+function mergeKitRuleRows(root, kind, rules, ctx, pending, additions) {
   if (root.permissions !== void 0 && !isPlainObject(root.permissions)) return false;
   const permissions = isPlainObject(root.permissions) ? { ...root.permissions } : {};
-  if (permissions.deny !== void 0 && !Array.isArray(permissions.deny)) return false;
-  const deny = Array.isArray(permissions.deny) ? [...permissions.deny] : [];
-  const written = new Set(ctx.ledger?.denyRowsWritten ?? []);
-  for (const rule of INTERACTIVE_DENY_RULES) {
-    if (deny.includes(rule)) additions.denyRowsWritten.push(rule);
-  }
-  const missing = INTERACTIVE_DENY_RULES.filter(
-    (rule) => !deny.includes(rule) && !written.has(rule)
+  if (permissions[kind] !== void 0 && !Array.isArray(permissions[kind])) return false;
+  const list = Array.isArray(permissions[kind]) ? [...permissions[kind]] : [];
+  const pendingRows = kind === "deny" ? pending.denyRows : pending.allowRows;
+  const written = kind === "deny" ? additions.denyRowsWritten : additions.allowRowsWritten;
+  const ledgerRows = new Set(
+    (kind === "deny" ? ctx.ledger?.denyRowsWritten : ctx.ledger?.allowRowsWritten) ?? []
   );
+  for (const rule of rules) {
+    if (list.includes(rule)) written.push(rule);
+  }
+  const missing = rules.filter((rule) => !list.includes(rule) && !ledgerRows.has(rule));
   const toAdd = ctx.ledger === null && !ctx.authorized ? [] : missing;
-  if (ctx.ledger === null && !ctx.authorized) pending.denyRows.push(...missing);
+  if (ctx.ledger === null && !ctx.authorized) pendingRows.push(...missing);
   if (toAdd.length === 0) return false;
-  additions.denyRowsWritten.push(...toAdd);
-  permissions.deny = [...deny, ...toAdd];
+  written.push(...toAdd);
+  permissions[kind] = [...list, ...toAdd];
   root.permissions = permissions;
   return true;
 }
@@ -425,7 +445,7 @@ async function writeClaudeSessionStartHook(rootDir, opts = {}) {
     relativePath: CLAUDE_SETTINGS_REL,
     status: merged.status
   };
-  if (merged.pending && (merged.pending.denyRows.length || merged.pending.hookEntries.length)) {
+  if (merged.pending && (merged.pending.denyRows.length || merged.pending.allowRows.length || merged.pending.hookEntries.length)) {
     result.pending = merged.pending;
   }
   if (authorized && merged.ledgerAdditions && ledgerGrows(ledger, merged.ledgerAdditions)) {
@@ -437,8 +457,9 @@ async function writeClaudeSessionStartHook(rootDir, opts = {}) {
 function ledgerGrows(ledger, add) {
   if (ledger === null) return true;
   const rows = new Set(ledger.denyRowsWritten);
+  const allowRows = new Set(ledger.allowRowsWritten);
   const hooks = new Set(ledger.hookEntriesWritten.map((h) => `${h.event}\0${h.marker}`));
-  return add.denyRowsWritten.some((r) => !rows.has(r)) || add.hookEntriesWritten.some((h) => !hooks.has(`${h.event}\0${h.marker}`));
+  return add.denyRowsWritten.some((r) => !rows.has(r)) || add.allowRowsWritten.some((r) => !allowRows.has(r)) || add.hookEntriesWritten.some((h) => !hooks.has(`${h.event}\0${h.marker}`));
 }
 async function planClaudeSettingsDrift(rootDir) {
   const abs = resolveContained(rootDir, CLAUDE_SETTINGS_REL);
@@ -477,17 +498,23 @@ async function planClaudeSettingsDrift(rootDir) {
   const merged = mergeSessionStartHookIntoSettings(raw, { ledger, authorized: false });
   if (merged.content === null) return null;
   const next = JSON.parse(merged.content);
-  const deny = (r) => isPlainObject(r.permissions) && Array.isArray(r.permissions.deny) ? r.permissions.deny.filter((x) => typeof x === "string") : [];
-  const had = new Set(deny(existing));
-  const denyRows = deny(next).filter((r) => !had.has(r));
+  const rowsOf = (r, kind) => {
+    const list = isPlainObject(r.permissions) ? r.permissions[kind] : void 0;
+    return Array.isArray(list) ? list.filter((x) => typeof x === "string") : [];
+  };
+  const hadDeny = new Set(rowsOf(existing, "deny"));
+  const hadAllow = new Set(rowsOf(existing, "allow"));
+  const denyRows = rowsOf(next, "deny").filter((r) => !hadDeny.has(r));
+  const allowRows = rowsOf(next, "allow").filter((r) => !hadAllow.has(r));
   const ambiguousDenyRows = merged.pending?.denyRows ?? [];
+  const ambiguousAllowRows = merged.pending?.allowRows ?? [];
   const missingEntries = kitEntries.filter((e) => !present.includes(e));
   const ledgerHas = (e) => Boolean(ledger?.hookEntriesWritten.some((h) => h.event === e.event && h.marker === e.marker));
   const hookEntries = missingEntries.filter((e) => !ledgerHas(e));
-  if (denyRows.length === 0 && ambiguousDenyRows.length === 0 && hookEntries.length === 0) {
+  if (denyRows.length === 0 && ambiguousDenyRows.length === 0 && allowRows.length === 0 && ambiguousAllowRows.length === 0 && hookEntries.length === 0) {
     return null;
   }
-  return { denyRows, ambiguousDenyRows, hookEntries };
+  return { denyRows, ambiguousDenyRows, allowRows, ambiguousAllowRows, hookEntries };
 }
 function formatClaudeSettingsDrift(report, opts) {
   const rows = [...report.denyRows, ...report.ambiguousDenyRows];
@@ -502,6 +529,15 @@ function formatClaudeSettingsDrift(report, opts) {
       );
     }
   }
+  const allowRows = [...report.allowRows, ...report.ambiguousAllowRows];
+  if (allowRows.length > 0) {
+    lines.push("Add to permissions.allow:", JSON.stringify(allowRows, null, 2));
+    if (report.ambiguousAllowRows.length > 0) {
+      lines.push(
+        `(${report.ambiguousAllowRows.length} row(s) ambiguous: no ${CLAUDE_SETTINGS_LEDGER_REL} ledger, so a deliberate deletion cannot be told apart.)`
+      );
+    }
+  }
   if (report.hookEntries.length > 0) {
     lines.push("Missing hook entries (add by hand or use the command below):");
     for (const e of report.hookEntries) lines.push(`  ${e.event}: ${e.marker}`);

package/dist/{chunk-IR7FFPUU.js → chunk-IMIVTDMK.js}

@@ -1,8 +1,12 @@
 import {
   NON_INTERACTIVE_ROOT_ARGS,
+  StaleCliError,
+  detectStaleCli,
+  formatRerunFlags,
+  formatStaleCliRefusal,
   installL0,
   syncFromManifest
-} from "./chunk-TGNFGMPV.js";
+} from "./chunk-6OTJEQEC.js";
 import {
   SkippedSymlinkError,
   formatPersonalizationSkippedSymlinks,
@@ -11,11 +15,11 @@ import {
 import {
   REGISTRY_CLI_ARGS,
   resolveRegistryFromCli
-} from "./chunk-C2SJDYAM.js";
+} from "./chunk-H46W7NHC.js";
 import {
   assessClaudeCommandAdapters,
   executeSafeReadinessFixes
-} from "./chunk-BEKQ6PVD.js";
+} from "./chunk-AXLXEAVJ.js";
 import {
   writeReadinessSnapshot
 } from "./chunk-HAFRAXGV.js";
@@ -23,7 +27,7 @@ import {
   CLAUDE_HITL_FALLBACK,
   generateClaudeCommandAdapters,
   writeClaudeSessionStartHook
-} from "./chunk-SPYIP76F.js";
+} from "./chunk-HHR56LJQ.js";
 import {
   shouldUseWelcomeColor,
   withCliProgress
@@ -50,13 +54,13 @@ import {
   npxPinned,
   pathCliStatus,
   syncPathCliToRuntime
-} from "./chunk-VO73OL5V.js";
+} from "./chunk-SE7ZIRLX.js";
 import {
   assessEnvironment
 } from "./chunk-B3VR5YBQ.js";
 import {
   warnIfRunningCliBehindNpm
-} from "./chunk-TW4BF5OE.js";
+} from "./chunk-3OM7JODZ.js";
 import {
   DOMAIN_PACK_IDS,
   allPacks,
@@ -73,7 +77,7 @@ import {
   resolveProtectedGlobs,
   saveManifest,
   skillTargetDir
-} from "./chunk-NSSXSZLL.js";
+} from "./chunk-7BEHUBEJ.js";
 import {
   KIT_VERSION,
   pinnedCliSpec
@@ -791,6 +795,8 @@ async function performInstall(options) {
     manifest: existing
   });
   try {
+    const stale = await detectStaleCli(registry.root, { warn: logger.warn });
+    if (stale && !options.allowStaleCli) throw new StaleCliError(stale);
     const draft = buildManifest({
       version: KIT_VERSION,
       profile: options.profile ?? existing?.profile ?? "default",
@@ -856,6 +862,17 @@ async function performInstall(options) {
     await registry.unlock?.();
   }
 }
+var INSTALL_RERUN_FLAGS = [
+  "pack",
+  "claude",
+  "yes",
+  "force-root",
+  "cwd",
+  "registry",
+  "url",
+  "ref",
+  "refresh"
+];
 var installCommand = defineCommand({
   meta: {
     name: "install",
@@ -872,6 +889,11 @@ var installCommand = defineCommand({
       description: `Comma-separated L1 pack ids (e.g. cybersec,devops). Known: ${DOMAIN_PACK_IDS.join(", ")}`
     },
     ...NON_INTERACTIVE_ROOT_ARGS,
+    "allow-stale-cli": {
+      type: "boolean",
+      description: "Install even when this CLI is older than the registry it is syncing from; the manifest is then stamped with this CLI's version, not the registry's (factory/dev only)",
+      default: false
+    },
     claude: {
       type: "boolean",
       description: "Opt-in: generate .claude/commands/*.md thin pointer adapters for the installed .cursor/commands set, and merge a SessionStart context hook into .claude/settings.json (default install behavior is unchanged without this flag)",
@@ -926,7 +948,8 @@ ${err.recovery}
           url: args.url,
           ref: args.ref,
           refresh: args.refresh,
-          claudeAdapters: args.claude
+          claudeAdapters: args.claude,
+          allowStaleCli: args["allow-stale-cli"]
         })
       );
       logApplyStats(result.stats);
@@ -941,6 +964,18 @@ ${result.claudeSessionStartInstructions}
       }
       if (result.claudeAdapterHint) logger.info(result.claudeAdapterHint);
     } catch (err) {
+      if (err instanceof StaleCliError) {
+        const profile = typeof args.profile === "string" && args.profile ? `${args.profile} ` : "";
+        const refusal = formatStaleCliRefusal({
+          command: "install",
+          stale: err.stale,
+          rerun: `${profile}${formatRerunFlags(args, INSTALL_RERUN_FLAGS)}`.trim()
+        });
+        logger.error(refusal.error);
+        console.error(refusal.recovery);
+        process.exitCode = 1;
+        return;
+      }
       if (err instanceof SkippedSymlinkError) {
         logApplyStats(err.stats);
         logger.error(err.message);