@dadado/agent-kit-cli 6.3.0 → 6.5.0

package/dist/{chunk-NNKOWUWM.js → chunk-236IYK6L.js}

@@ -1,6 +1,7 @@
 import {
+  INTERACTIVE_ALLOW_RULES,
   INTERACTIVE_DENY_RULES
-} from "./chunk-MAPOQEA2.js";
+} from "./chunk-6RRG3WOE.js";
 import {
   assertRealContained,
   assertRealParentContained,
@@ -10,7 +11,7 @@ import {
   resolveContained,
   saveManagedHashLedger,
   shouldPreserveCustomizedOverlay
-} from "./chunk-6KUSG7BJ.js";
+} from "./chunk-5WSFO35Y.js";
 import {
   ensureDir,
   fileExists
@@ -149,17 +150,18 @@ var ClaudeSettingsLedgerInvalidError = class extends Error {
   path;
 };
 function emptyLedger() {
-  return { schemaVersion: 1, denyRowsWritten: [], hookEntriesWritten: [] };
+  return { schemaVersion: 1, denyRowsWritten: [], allowRowsWritten: [], hookEntriesWritten: [] };
 }
 function hookKey(r) {
   return `${r.event}\0${r.marker}`;
 }
-function normalize(denyRows, hooks) {
+function normalize(denyRows, allowRows, hooks) {
   const seen = /* @__PURE__ */ new Map();
   for (const h of hooks) seen.set(hookKey(h), { event: h.event, marker: h.marker });
   return {
     schemaVersion: 1,
     denyRowsWritten: [...new Set(denyRows)].sort(),
+    allowRowsWritten: [...new Set(allowRows)].sort(),
     hookEntriesWritten: [...seen.values()].sort(
       (a, b) => a.event.localeCompare(b.event) || a.marker.localeCompare(b.marker)
     )
@@ -178,6 +180,8 @@ function parseLedger(raw) {
   if (!Array.isArray(o.denyRowsWritten) || !o.denyRowsWritten.every((r) => typeof r === "string")) {
     return null;
   }
+  const allowRows = o.allowRowsWritten ?? [];
+  if (!Array.isArray(allowRows) || !allowRows.every((r) => typeof r === "string")) return null;
   if (!Array.isArray(o.hookEntriesWritten)) return null;
   const hooks = [];
   for (const h of o.hookEntriesWritten) {
@@ -189,7 +193,7 @@ function parseLedger(raw) {
       marker: h.marker
     });
   }
-  return normalize(o.denyRowsWritten, hooks);
+  return normalize(o.denyRowsWritten, allowRows, hooks);
 }
 async function readState(root) {
   const abs = resolveContained(root, CLAUDE_SETTINGS_LEDGER_REL);
@@ -224,6 +228,7 @@ async function saveClaudeSettingsLedger(root, additions, opts = {}) {
   const base = state.kind === "ok" ? state.ledger : emptyLedger();
   const merged = normalize(
     [...base.denyRowsWritten, ...additions.denyRowsWritten ?? []],
+    [...base.allowRowsWritten, ...additions.allowRowsWritten ?? []],
     [...base.hookEntriesWritten, ...additions.hookEntriesWritten ?? []]
   );
   await mkdir(path2.dirname(abs), { recursive: true });
@@ -300,8 +305,12 @@ function mergeSessionStartHookIntoSettings(existingRaw, opts = {}) {
       };
     }
   }
-  const pending = { denyRows: [], hookEntries: [] };
-  const additions = { denyRowsWritten: [], hookEntriesWritten: [] };
+  const pending = { denyRows: [], allowRows: [], hookEntries: [] };
+  const additions = {
+    denyRowsWritten: [],
+    allowRowsWritten: [],
+    hookEntriesWritten: []
+  };
   const hooks = isPlainObject(root.hooks) ? { ...root.hooks } : {};
   const sessionStart = Array.isArray(hooks.SessionStart) ? [...hooks.SessionStart] : [];
   const preToolUse = Array.isArray(hooks.PreToolUse) ? [...hooks.PreToolUse] : [];
@@ -342,8 +351,17 @@ function mergeSessionStartHookIntoSettings(existingRaw, opts = {}) {
     (acc, next, i) => i === 0 ? next : combineStatus(acc, next),
     "unchanged"
   );
-  const denyAdded = mergeKitDenyRules(root, { ledger, authorized }, pending, additions);
-  const finalStatus = denyAdded && status === "unchanged" ? "refreshed" : status;
+  const ctx = { ledger, authorized };
+  const denyAdded = mergeKitRuleRows(root, "deny", INTERACTIVE_DENY_RULES, ctx, pending, additions);
+  const allowAdded = mergeKitRuleRows(
+    root,
+    "allow",
+    INTERACTIVE_ALLOW_RULES,
+    ctx,
+    pending,
+    additions
+  );
+  const finalStatus = (denyAdded || allowAdded) && status === "unchanged" ? "refreshed" : status;
   return {
     content: `${JSON.stringify(root, null, 2)}
 `,
@@ -355,23 +373,25 @@ function mergeSessionStartHookIntoSettings(existingRaw, opts = {}) {
 function combineStatus(a, b) {
   return a === "unchanged" && b !== "unchanged" ? "refreshed" : a;
 }
-function mergeKitDenyRules(root, ctx, pending, additions) {
+function mergeKitRuleRows(root, kind, rules, ctx, pending, additions) {
   if (root.permissions !== void 0 && !isPlainObject(root.permissions)) return false;
   const permissions = isPlainObject(root.permissions) ? { ...root.permissions } : {};
-  if (permissions.deny !== void 0 && !Array.isArray(permissions.deny)) return false;
-  const deny = Array.isArray(permissions.deny) ? [...permissions.deny] : [];
-  const written = new Set(ctx.ledger?.denyRowsWritten ?? []);
-  for (const rule of INTERACTIVE_DENY_RULES) {
-    if (deny.includes(rule)) additions.denyRowsWritten.push(rule);
-  }
-  const missing = INTERACTIVE_DENY_RULES.filter(
-    (rule) => !deny.includes(rule) && !written.has(rule)
+  if (permissions[kind] !== void 0 && !Array.isArray(permissions[kind])) return false;
+  const list = Array.isArray(permissions[kind]) ? [...permissions[kind]] : [];
+  const pendingRows = kind === "deny" ? pending.denyRows : pending.allowRows;
+  const written = kind === "deny" ? additions.denyRowsWritten : additions.allowRowsWritten;
+  const ledgerRows = new Set(
+    (kind === "deny" ? ctx.ledger?.denyRowsWritten : ctx.ledger?.allowRowsWritten) ?? []
   );
+  for (const rule of rules) {
+    if (list.includes(rule)) written.push(rule);
+  }
+  const missing = rules.filter((rule) => !list.includes(rule) && !ledgerRows.has(rule));
   const toAdd = ctx.ledger === null && !ctx.authorized ? [] : missing;
-  if (ctx.ledger === null && !ctx.authorized) pending.denyRows.push(...missing);
+  if (ctx.ledger === null && !ctx.authorized) pendingRows.push(...missing);
   if (toAdd.length === 0) return false;
-  additions.denyRowsWritten.push(...toAdd);
-  permissions.deny = [...deny, ...toAdd];
+  written.push(...toAdd);
+  permissions[kind] = [...list, ...toAdd];
   root.permissions = permissions;
   return true;
 }
@@ -425,7 +445,7 @@ async function writeClaudeSessionStartHook(rootDir, opts = {}) {
     relativePath: CLAUDE_SETTINGS_REL,
     status: merged.status
   };
-  if (merged.pending && (merged.pending.denyRows.length || merged.pending.hookEntries.length)) {
+  if (merged.pending && (merged.pending.denyRows.length || merged.pending.allowRows.length || merged.pending.hookEntries.length)) {
     result.pending = merged.pending;
   }
   if (authorized && merged.ledgerAdditions && ledgerGrows(ledger, merged.ledgerAdditions)) {
@@ -437,8 +457,9 @@ async function writeClaudeSessionStartHook(rootDir, opts = {}) {
 function ledgerGrows(ledger, add) {
   if (ledger === null) return true;
   const rows = new Set(ledger.denyRowsWritten);
+  const allowRows = new Set(ledger.allowRowsWritten);
   const hooks = new Set(ledger.hookEntriesWritten.map((h) => `${h.event}\0${h.marker}`));
-  return add.denyRowsWritten.some((r) => !rows.has(r)) || add.hookEntriesWritten.some((h) => !hooks.has(`${h.event}\0${h.marker}`));
+  return add.denyRowsWritten.some((r) => !rows.has(r)) || add.allowRowsWritten.some((r) => !allowRows.has(r)) || add.hookEntriesWritten.some((h) => !hooks.has(`${h.event}\0${h.marker}`));
 }
 async function planClaudeSettingsDrift(rootDir) {
   const abs = resolveContained(rootDir, CLAUDE_SETTINGS_REL);
@@ -477,17 +498,23 @@ async function planClaudeSettingsDrift(rootDir) {
   const merged = mergeSessionStartHookIntoSettings(raw, { ledger, authorized: false });
   if (merged.content === null) return null;
   const next = JSON.parse(merged.content);
-  const deny = (r) => isPlainObject(r.permissions) && Array.isArray(r.permissions.deny) ? r.permissions.deny.filter((x) => typeof x === "string") : [];
-  const had = new Set(deny(existing));
-  const denyRows = deny(next).filter((r) => !had.has(r));
+  const rowsOf = (r, kind) => {
+    const list = isPlainObject(r.permissions) ? r.permissions[kind] : void 0;
+    return Array.isArray(list) ? list.filter((x) => typeof x === "string") : [];
+  };
+  const hadDeny = new Set(rowsOf(existing, "deny"));
+  const hadAllow = new Set(rowsOf(existing, "allow"));
+  const denyRows = rowsOf(next, "deny").filter((r) => !hadDeny.has(r));
+  const allowRows = rowsOf(next, "allow").filter((r) => !hadAllow.has(r));
   const ambiguousDenyRows = merged.pending?.denyRows ?? [];
+  const ambiguousAllowRows = merged.pending?.allowRows ?? [];
   const missingEntries = kitEntries.filter((e) => !present.includes(e));
   const ledgerHas = (e) => Boolean(ledger?.hookEntriesWritten.some((h) => h.event === e.event && h.marker === e.marker));
   const hookEntries = missingEntries.filter((e) => !ledgerHas(e));
-  if (denyRows.length === 0 && ambiguousDenyRows.length === 0 && hookEntries.length === 0) {
+  if (denyRows.length === 0 && ambiguousDenyRows.length === 0 && allowRows.length === 0 && ambiguousAllowRows.length === 0 && hookEntries.length === 0) {
     return null;
   }
-  return { denyRows, ambiguousDenyRows, hookEntries };
+  return { denyRows, ambiguousDenyRows, allowRows, ambiguousAllowRows, hookEntries };
 }
 function formatClaudeSettingsDrift(report, opts) {
   const rows = [...report.denyRows, ...report.ambiguousDenyRows];
@@ -502,6 +529,15 @@ function formatClaudeSettingsDrift(report, opts) {
       );
     }
   }
+  const allowRows = [...report.allowRows, ...report.ambiguousAllowRows];
+  if (allowRows.length > 0) {
+    lines.push("Add to permissions.allow:", JSON.stringify(allowRows, null, 2));
+    if (report.ambiguousAllowRows.length > 0) {
+      lines.push(
+        `(${report.ambiguousAllowRows.length} row(s) ambiguous: no ${CLAUDE_SETTINGS_LEDGER_REL} ledger, so a deliberate deletion cannot be told apart.)`
+      );
+    }
+  }
   if (report.hookEntries.length > 0) {
     lines.push("Missing hook entries (add by hand or use the command below):");
     for (const e of report.hookEntries) lines.push(`  ${e.event}: ${e.marker}`);

package/dist/{chunk-YRFSTHR5.js → chunk-2OIPMQHA.js}

@@ -1,7 +1,13 @@
+import {
+  DRIVER_PROTOCOL_VERSION,
+  DriverAgentSink,
+  createDriverAnswerReader,
+  createDriverEmitter
+} from "./chunk-R6WH5P7R.js";
 import {
   classifyGateExit,
   landGateExit
-} from "./chunk-KVY425NM.js";
+} from "./chunk-GIZNM73K.js";
 import {
   InputLine,
   ScrollRegion,
@@ -14,16 +20,17 @@ import {
   parsePlanFrontmatter
 } from "./chunk-L5V3W3DY.js";
 import {
-  LineSplitter,
   RedactingStreamBuffer,
   claudeRedactions,
-  formatHitlGateLine,
-  formatHitlSummary,
-  operatorQuitStop,
   parseStreamLine,
   redactSecrets,
   renderStreamEvent
-} from "./chunk-JEI6HACW.js";
+} from "./chunk-2TCRKQHD.js";
+import {
+  LineSplitter,
+  formatHitlSummary,
+  operatorQuitStop
+} from "./chunk-MTLQN57O.js";
 import {
   TtySpinner,
   shouldUseVisualMotion,
@@ -491,218 +498,6 @@ async function withLiveTui(opts, run) {
   }
 }
 
-// src/plan-loop/driver-events.ts
-import { createInterface } from "readline";
-import { StringDecoder as StringDecoder2 } from "string_decoder";
-var DRIVER_PROTOCOL_MAJOR = 1;
-var DRIVER_PROTOCOL_VERSION = "1.1.0";
-var DRIVER_EVENTS_FORMATS = ["ndjson"];
-var INBOUND_MAX_CHARS = 64 * 1024;
-var AGENT_PENDING_MAX_CHARS = 4 * 1024 * 1024;
-function formatDriverEvent(event, now = () => /* @__PURE__ */ new Date()) {
-  return `${JSON.stringify({ v: DRIVER_PROTOCOL_MAJOR, ts: now().toISOString(), ...event })}
-`;
-}
-function createDriverEmitter(write = (text) => {
-  process.stdout.write(text);
-}, now) {
-  return {
-    emit(event) {
-      try {
-        write(formatDriverEvent(event, now));
-      } catch {
-      }
-    }
-  };
-}
-function parseDriverInbound(line) {
-  const text = line.trim();
-  if (text.length > INBOUND_MAX_CHARS) return { ok: false, error: "line too long" };
-  let value;
-  try {
-    value = JSON.parse(text);
-  } catch {
-    return { ok: false, error: "not JSON" };
-  }
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    return { ok: false, error: "not a JSON object" };
-  }
-  const msg = value;
-  if (msg.v !== void 0 && msg.v !== DRIVER_PROTOCOL_MAJOR) {
-    return { ok: false, error: `unsupported protocol v${String(msg.v)}` };
-  }
-  if (msg.type === "stop") {
-    return {
-      ok: true,
-      message: { type: "stop", ...typeof msg.reason === "string" ? { reason: msg.reason } : {} }
-    };
-  }
-  if (msg.type !== "hitl_reply")
-    return { ok: false, error: `unknown type ${JSON.stringify(msg.type)}` };
-  if (typeof msg.askId !== "string" || !/^[a-z0-9-]+$/.test(msg.askId)) {
-    return { ok: false, error: "hitl_reply.askId must be a kebab-case string" };
-  }
-  if (typeof msg.reply === "number") {
-    if (!Number.isInteger(msg.reply) || msg.reply < 1) {
-      return { ok: false, error: "hitl_reply.reply number must be a positive integer" };
-    }
-    return { ok: true, message: { type: "hitl_reply", askId: msg.askId, reply: msg.reply } };
-  }
-  if (typeof msg.reply === "string" && msg.reply.trim() && !/[\r\n]/.test(msg.reply)) {
-    return { ok: true, message: { type: "hitl_reply", askId: msg.askId, reply: msg.reply.trim() } };
-  }
-  return { ok: false, error: "hitl_reply.reply must be a number or a one-line non-empty string" };
-}
-function inboundToRawAnswer(gate, parsed) {
-  if (!parsed.ok) return { kind: "stop", cause: "protocol error", detail: parsed.error };
-  const message = parsed.message;
-  if (message.type === "stop") return { kind: "stop", cause: "driver stop" };
-  if (message.askId !== gate.askId) {
-    return {
-      kind: "stop",
-      cause: "protocol error",
-      detail: `reply for ${message.askId} while gate ${gate.askId} is open`
-    };
-  }
-  return { kind: "line", text: String(message.reply) };
-}
-function createDriverAnswerReader(opts) {
-  const input = opts.input ?? process.stdin;
-  const queue = [];
-  let ended = false;
-  let waiter = null;
-  let rl = null;
-  const ensure = () => {
-    if (rl) return;
-    rl = createInterface({ input, terminal: false, crlfDelay: Number.POSITIVE_INFINITY });
-    rl.on("line", (line) => {
-      if (!line.trim()) return;
-      if (waiter) {
-        const w = waiter;
-        waiter = null;
-        w(line);
-      } else queue.push(line);
-    });
-    rl.on("close", () => {
-      ended = true;
-      if (waiter) {
-        const w = waiter;
-        waiter = null;
-        w(null);
-      }
-    });
-  };
-  const nextLine = (signal) => new Promise((resolve) => {
-    const queued = queue.shift();
-    if (queued !== void 0) {
-      resolve(queued);
-      return;
-    }
-    if (ended) {
-      resolve(null);
-      return;
-    }
-    const onAbort = () => {
-      if (waiter === settle) waiter = null;
-      resolve(null);
-    };
-    const settle = (line) => {
-      signal?.removeEventListener("abort", onAbort);
-      resolve(line);
-    };
-    if (signal?.aborted) {
-      resolve(null);
-      return;
-    }
-    signal?.addEventListener("abort", onAbort, { once: true });
-    waiter = settle;
-  });
-  return {
-    read: async (gate, readOpts) => {
-      ensure();
-      opts.emitter.emit({
-        type: "hitl_gate",
-        tick: opts.tick(),
-        askId: gate.askId,
-        labels: [...gate.labels],
-        detection: gate.detection,
-        line: formatHitlGateLine(gate)
-      });
-      const line = await nextLine(readOpts.signal);
-      if (line === null) return { kind: "eof" };
-      return inboundToRawAnswer(gate, parseDriverInbound(line));
-    },
-    close: () => {
-      const r = rl;
-      rl = null;
-      r?.close();
-      if (typeof input.pause === "function") {
-        input.pause();
-      }
-    }
-  };
-}
-var DriverAgentSink = class {
-  constructor(emitter, tick) {
-    this.emitter = emitter;
-    this.tick = tick;
-  }
-  emitter;
-  tick;
-  pending = "";
-  dropped = false;
-  decoder = new StringDecoder2("utf8");
-  feed(chunk) {
-    try {
-      const text = typeof chunk === "string" ? chunk : this.decoder.write(chunk);
-      if (!text) return;
-      const lines = (this.pending + text).split("\n");
-      this.pending = lines.pop() ?? "";
-      for (const line of lines) {
-        if (this.dropped) {
-          this.dropped = false;
-          continue;
-        }
-        this.take(line);
-      }
-      if (this.pending.length > AGENT_PENDING_MAX_CHARS) {
-        this.pending = "";
-        this.dropped = true;
-      }
-    } catch {
-    }
-  }
-  end() {
-    try {
-      const rest = this.pending + this.decoder.end();
-      this.pending = "";
-      if (rest && !this.dropped) this.take(rest);
-      this.dropped = false;
-    } catch {
-    }
-  }
-  take(raw) {
-    const line = raw.replace(/\r$/, "");
-    if (!line.trim()) return;
-    const trimmed = line.trim();
-    if (trimmed.startsWith("{")) {
-      try {
-        const event = JSON.parse(trimmed);
-        if (typeof event === "object" && event !== null && !Array.isArray(event)) {
-          this.emitter.emit({
-            type: "agent_event",
-            tick: this.tick,
-            event
-          });
-          return;
-        }
-      } catch {
-      }
-    }
-    this.emitter.emit({ type: "agent_text", tick: this.tick, text: line });
-  }
-};
-
 // src/plan-loop/run-loop.ts
 import { readFile as readFile4, rm, unlink } from "fs/promises";
 import path5 from "path";
@@ -1525,6 +1320,5 @@ async function runPlanLoop(opts) {
 export {
   shouldUseLiveTui,
   withLiveTui,
-  DRIVER_EVENTS_FORMATS,
   runPlanLoop
 };