@dexto/core 1.4.0 → 1.5.1

package/dist/filesystem/filesystem-service.cjs

@@ -91,6 +91,45 @@ class FileSystemService {
     this.initialized = true;
     this.logger.info("FileSystemService initialized successfully");
   }
+  /**
+   * Check if a file path is within the configured allowed paths.
+   * This is a public method for external consumers (like ToolManager) to check
+   * if a path requires directory approval before file operations.
+   *
+   * @param filePath The file path to check (can be relative or absolute)
+   * @returns true if the path is within allowed paths, false otherwise
+   */
+  isPathWithinAllowed(filePath) {
+    return this.pathValidator.isPathWithinAllowed(filePath);
+  }
+  /**
+   * Get the list of configured allowed paths.
+   * Useful for displaying to users when directory approval is needed.
+   *
+   * @returns Array of allowed path strings
+   */
+  getAllowedPaths() {
+    return this.pathValidator.getAllowedPaths();
+  }
+  /**
+   * Get the parent directory of a file path (resolved to absolute).
+   * Useful for directory approval requests.
+   *
+   * @param filePath The file path
+   * @returns The absolute parent directory path
+   */
+  getParentDirectory(filePath) {
+    return path.dirname(path.resolve(filePath));
+  }
+  /**
+   * Set a callback to check if a path is in an approved directory.
+   * This allows PathValidator to consult ApprovalManager without a direct dependency.
+   *
+   * @param checker Function that returns true if path is in an approved directory
+   */
+  setDirectoryApprovalChecker(checker) {
+    this.pathValidator.setDirectoryApprovalChecker(checker);
+  }
   /**
    * Read a file with validation and size limits
    */

package/dist/filesystem/filesystem-service.d.ts

@@ -4,6 +4,7 @@
  * Secure file system operations for Dexto internal tools
  */
 import { FileSystemConfig, FileContent, ReadFileOptions, GlobOptions, GlobResult, GrepOptions, SearchResult, WriteFileOptions, WriteResult, EditFileOptions, EditResult, EditOperation } from './types.js';
+import { type DirectoryApprovalChecker } from './path-validator.js';
 import type { IDextoLogger } from '../logger/v2/types.js';
 /**
  * FileSystemService - Handles all file system operations with security checks
@@ -25,6 +26,37 @@ export declare class FileSystemService {
      * Initialize the service
      */
     initialize(): Promise<void>;
+    /**
+     * Check if a file path is within the configured allowed paths.
+     * This is a public method for external consumers (like ToolManager) to check
+     * if a path requires directory approval before file operations.
+     *
+     * @param filePath The file path to check (can be relative or absolute)
+     * @returns true if the path is within allowed paths, false otherwise
+     */
+    isPathWithinAllowed(filePath: string): boolean;
+    /**
+     * Get the list of configured allowed paths.
+     * Useful for displaying to users when directory approval is needed.
+     *
+     * @returns Array of allowed path strings
+     */
+    getAllowedPaths(): string[];
+    /**
+     * Get the parent directory of a file path (resolved to absolute).
+     * Useful for directory approval requests.
+     *
+     * @param filePath The file path
+     * @returns The absolute parent directory path
+     */
+    getParentDirectory(filePath: string): string;
+    /**
+     * Set a callback to check if a path is in an approved directory.
+     * This allows PathValidator to consult ApprovalManager without a direct dependency.
+     *
+     * @param checker Function that returns true if path is in an approved directory
+     */
+    setDirectoryApprovalChecker(checker: DirectoryApprovalChecker): void;
     /**
      * Read a file with validation and size limits
      */

package/dist/filesystem/filesystem-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"filesystem-service.d.ts","sourceRoot":"","sources":["../../src/filesystem/filesystem-service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,EACH,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,WAAW,EACX,UAAU,EACV,WAAW,EACX,YAAY,EAEZ,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,UAAU,EACV,aAAa,EAGhB,MAAM,YAAY,CAAC;AAGpB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAQ1D;;;;GAIG;AACH,qBAAa,iBAAiB;IAC1B,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,WAAW,CAAkB;IACrC,OAAO,CAAC,MAAM,CAAe;gBAEjB,MAAM,EAAE,OAAO,CAAC,gBAAgB,CAAC,YAAK,EAAE,MAAM,EAAE,YAAY;IAiBxE;;;OAGG;IACH,OAAO,CAAC,YAAY;IAKpB;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAuBjC;;OAEG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,WAAW,CAAC;IA+ErF;;OAEG;IACG,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;IAwEhF;;OAEG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,YAAY,CAAC;IAqGtF;;OAEG;IACG,SAAS,CACX,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,gBAAqB,GAC/B,OAAO,CAAC,WAAW,CAAC;IA0DvB;;OAEG;IACG,QAAQ,CACV,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,aAAa,EACxB,OAAO,GAAE,eAAoB,GAC9B,OAAO,CAAC,UAAU,CAAC;IAoEtB;;OAEG;YACW,YAAY;IA0B1B;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;IA6D1C;;OAEG;IACH,SAAS,IAAI,QAAQ,CAAC,gBAAgB,CAAC;IAIvC;;OAEG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;CAI3C"}
+{"version":3,"file":"filesystem-service.d.ts","sourceRoot":"","sources":["../../src/filesystem/filesystem-service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,EACH,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,WAAW,EACX,UAAU,EACV,WAAW,EACX,YAAY,EAEZ,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,UAAU,EACV,aAAa,EAGhB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAiB,KAAK,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAEnF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAQ1D;;;;GAIG;AACH,qBAAa,iBAAiB;IAC1B,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,WAAW,CAAkB;IACrC,OAAO,CAAC,MAAM,CAAe;gBAEjB,MAAM,EAAE,OAAO,CAAC,gBAAgB,CAAC,YAAK,EAAE,MAAM,EAAE,YAAY;IAiBxE;;;OAGG;IACH,OAAO,CAAC,YAAY;IAKpB;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAuBjC;;;;;;;OAOG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAI9C;;;;;OAKG;IACH,eAAe,IAAI,MAAM,EAAE;IAI3B;;;;;;OAMG;IACH,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAI5C;;;;;OAKG;IACH,2BAA2B,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI;IAIpE;;OAEG;IACG,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,WAAW,CAAC;IA+ErF;;OAEG;IACG,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;IAwEhF;;OAEG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,YAAY,CAAC;IAqGtF;;OAEG;IACG,SAAS,CACX,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,gBAAqB,GAC/B,OAAO,CAAC,WAAW,CAAC;IA0DvB;;OAEG;IACG,QAAQ,CACV,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,aAAa,EACxB,OAAO,GAAE,eAAoB,GAC9B,OAAO,CAAC,UAAU,CAAC;IAoEtB;;OAEG;YACW,YAAY;IA0B1B;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;IA6D1C;;OAEG;IACH,SAAS,IAAI,QAAQ,CAAC,gBAAgB,CAAC;IAIvC;;OAEG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;CAI3C"}

package/dist/filesystem/filesystem-service.js

@@ -59,6 +59,45 @@ class FileSystemService {
     this.initialized = true;
     this.logger.info("FileSystemService initialized successfully");
   }
+  /**
+   * Check if a file path is within the configured allowed paths.
+   * This is a public method for external consumers (like ToolManager) to check
+   * if a path requires directory approval before file operations.
+   *
+   * @param filePath The file path to check (can be relative or absolute)
+   * @returns true if the path is within allowed paths, false otherwise
+   */
+  isPathWithinAllowed(filePath) {
+    return this.pathValidator.isPathWithinAllowed(filePath);
+  }
+  /**
+   * Get the list of configured allowed paths.
+   * Useful for displaying to users when directory approval is needed.
+   *
+   * @returns Array of allowed path strings
+   */
+  getAllowedPaths() {
+    return this.pathValidator.getAllowedPaths();
+  }
+  /**
+   * Get the parent directory of a file path (resolved to absolute).
+   * Useful for directory approval requests.
+   *
+   * @param filePath The file path
+   * @returns The absolute parent directory path
+   */
+  getParentDirectory(filePath) {
+    return path.dirname(path.resolve(filePath));
+  }
+  /**
+   * Set a callback to check if a path is in an approved directory.
+   * This allows PathValidator to consult ApprovalManager without a direct dependency.
+   *
+   * @param checker Function that returns true if path is in an approved directory
+   */
+  setDirectoryApprovalChecker(checker) {
+    this.pathValidator.setDirectoryApprovalChecker(checker);
+  }
   /**
    * Read a file with validation and size limits
    */

package/dist/filesystem/index.d.ts

@@ -4,7 +4,7 @@
  * Exports file system service, types, errors, and utilities
  */
 export { FileSystemService } from './filesystem-service.js';
-export { PathValidator } from './path-validator.js';
+export { PathValidator, type DirectoryApprovalChecker } from './path-validator.js';
 export { FileSystemError } from './errors.js';
 export { FileSystemErrorCode } from './error-codes.js';
 export type { FileSystemConfig, FileContent, ReadFileOptions, GlobOptions, GlobResult, GrepOptions, SearchResult, SearchMatch, WriteFileOptions, WriteResult, EditFileOptions, EditResult, EditOperation, FileMetadata, PathValidation, BufferEncoding, } from './types.js';

package/dist/filesystem/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/filesystem/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,YAAY,EACR,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,WAAW,EACX,UAAU,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,UAAU,EACV,aAAa,EACb,YAAY,EACZ,cAAc,EACd,cAAc,GACjB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/filesystem/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,KAAK,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,YAAY,EACR,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,WAAW,EACX,UAAU,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,UAAU,EACV,aAAa,EACb,YAAY,EACZ,cAAc,EACd,cAAc,GACjB,MAAM,YAAY,CAAC"}

package/dist/filesystem/path-validator.cjs

@@ -39,6 +39,7 @@ class PathValidator {
   normalizedBlockedPaths;
   normalizedBlockedExtensions;
   logger;
+  directoryApprovalChecker;
   constructor(config, logger) {
     this.config = config;
     this.logger = logger;
@@ -53,6 +54,16 @@ class PathValidator {
       `PathValidator initialized with ${this.normalizedAllowedPaths.length} allowed paths`
     );
   }
+  /**
+   * Set a callback to check if a path is in an approved directory.
+   * This allows PathValidator to consult ApprovalManager without a direct dependency.
+   *
+   * @param checker Function that returns true if path is in an approved directory
+   */
+  setDirectoryApprovalChecker(checker) {
+    this.directoryApprovalChecker = checker;
+    this.logger.debug("Directory approval checker configured");
+  }
   /**
    * Validate a file path for security and policy compliance
    */
@@ -123,15 +134,23 @@ class PathValidator {
   }
   /**
    * Check if path is within allowed paths (whitelist check)
+   * Also consults the directory approval checker if configured.
    */
   isPathAllowed(normalizedPath) {
     if (this.normalizedAllowedPaths.length === 0) {
       return true;
     }
-    return this.normalizedAllowedPaths.some((allowedPath) => {
+    const isInConfigPaths = this.normalizedAllowedPaths.some((allowedPath) => {
       const relative = path.relative(allowedPath, normalizedPath);
       return !relative.startsWith("..") && !path.isAbsolute(relative);
     });
+    if (isInConfigPaths) {
+      return true;
+    }
+    if (this.directoryApprovalChecker) {
+      return this.directoryApprovalChecker(normalizedPath);
+    }
+    return false;
   }
   /**
    * Check if path matches blocked patterns (blacklist check)
@@ -154,6 +173,55 @@ class PathValidator {
   isPathAllowedQuick(normalizedPath) {
     return this.isPathAllowed(normalizedPath) && !this.isPathBlocked(normalizedPath);
   }
+  /**
+   * Check if a file path is within the configured allowed paths (from config only).
+   * This method does NOT consult ApprovalManager - it only checks the static config paths.
+   *
+   * This is used by ToolManager.checkDirectoryAccess() to determine if a path
+   * needs directory approval. Paths within config-allowed directories don't need
+   * directory approval prompts.
+   *
+   * @param filePath The file path to check (can be relative or absolute)
+   * @returns true if the path is within config-allowed paths, false otherwise
+   *
+   * @example
+   * ```typescript
+   * // Check if path needs directory approval
+   * if (!pathValidator.isPathWithinAllowed('/external/project/file.ts')) {
+   *   // Request directory access approval
+   * }
+   * ```
+   */
+  isPathWithinAllowed(filePath) {
+    if (!filePath || filePath.trim() === "") {
+      return false;
+    }
+    const workingDir = this.config.workingDirectory || process.cwd();
+    let normalizedPath;
+    try {
+      normalizedPath = path.isAbsolute(filePath) ? path.resolve(filePath) : path.resolve(workingDir, filePath);
+      try {
+        normalizedPath = import_node_fs.realpathSync.native(normalizedPath);
+      } catch {
+      }
+    } catch {
+      return false;
+    }
+    return this.isInConfigAllowedPaths(normalizedPath);
+  }
+  /**
+   * Check if path is within config-allowed paths only (no approval checker).
+   * Used for prompting decisions.
+   */
+  isInConfigAllowedPaths(normalizedPath) {
+    if (this.normalizedAllowedPaths.length === 0) {
+      return true;
+    }
+    return this.normalizedAllowedPaths.some((allowedPath) => {
+      const relative = path.relative(allowedPath, normalizedPath);
+      return !relative.startsWith("..") && !path.isAbsolute(relative);
+    });
+  }
   /**
    * Get normalized allowed paths
    */

package/dist/filesystem/path-validator.d.ts

@@ -5,16 +5,23 @@
  */
 import { FileSystemConfig, PathValidation } from './types.js';
 import type { IDextoLogger } from '../logger/v2/types.js';
+/**
+ * Callback type for checking if a path is in an approved directory.
+ * Used to consult ApprovalManager without creating a direct dependency.
+ */
+export type DirectoryApprovalChecker = (filePath: string) => boolean;
 /**
  * PathValidator - Validates file paths for security and policy compliance
  *
  * Security checks:
  * 1. Path traversal detection (../, symbolic links)
- * 2. Allowed paths enforcement (whitelist)
+ * 2. Allowed paths enforcement (whitelist + approved directories)
  * 3. Blocked paths detection (blacklist)
  * 4. File extension restrictions
  * 5. Absolute path normalization
- * TODO: Add tests
+ *
+ * PathValidator can optionally consult an external approval checker (e.g., ApprovalManager)
+ * to determine if paths outside the config's allowed paths are accessible.
  */
 export declare class PathValidator {
     private config;
@@ -22,7 +29,15 @@ export declare class PathValidator {
     private normalizedBlockedPaths;
     private normalizedBlockedExtensions;
     private logger;
+    private directoryApprovalChecker;
     constructor(config: FileSystemConfig, logger: IDextoLogger);
+    /**
+     * Set a callback to check if a path is in an approved directory.
+     * This allows PathValidator to consult ApprovalManager without a direct dependency.
+     *
+     * @param checker Function that returns true if path is in an approved directory
+     */
+    setDirectoryApprovalChecker(checker: DirectoryApprovalChecker): void;
     /**
      * Validate a file path for security and policy compliance
      */
@@ -33,6 +48,7 @@ export declare class PathValidator {
     private hasPathTraversal;
     /**
      * Check if path is within allowed paths (whitelist check)
+     * Also consults the directory approval checker if configured.
      */
     private isPathAllowed;
     /**
@@ -43,6 +59,31 @@ export declare class PathValidator {
      * Quick check if a path is allowed (for internal use)
      */
     isPathAllowedQuick(normalizedPath: string): boolean;
+    /**
+     * Check if a file path is within the configured allowed paths (from config only).
+     * This method does NOT consult ApprovalManager - it only checks the static config paths.
+     *
+     * This is used by ToolManager.checkDirectoryAccess() to determine if a path
+     * needs directory approval. Paths within config-allowed directories don't need
+     * directory approval prompts.
+     *
+     * @param filePath The file path to check (can be relative or absolute)
+     * @returns true if the path is within config-allowed paths, false otherwise
+     *
+     * @example
+     * ```typescript
+     * // Check if path needs directory approval
+     * if (!pathValidator.isPathWithinAllowed('/external/project/file.ts')) {
+     *   // Request directory access approval
+     * }
+     * ```
+     */
+    isPathWithinAllowed(filePath: string): boolean;
+    /**
+     * Check if path is within config-allowed paths only (no approval checker).
+     * Used for prompting decisions.
+     */
+    private isInConfigAllowedPaths;
     /**
      * Get normalized allowed paths
      */

package/dist/filesystem/path-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path-validator.d.ts","sourceRoot":"","sources":["../../src/filesystem/path-validator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,qBAAa,aAAa;IACtB,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,sBAAsB,CAAW;IACzC,OAAO,CAAC,sBAAsB,CAAW;IACzC,OAAO,CAAC,2BAA2B,CAAW;IAC9C,OAAO,CAAC,MAAM,CAAe;gBAEjB,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,YAAY;IAsB1D;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc;IA0E9C;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;OAEG;IACH,OAAO,CAAC,aAAa;IAcrB;;OAEG;IACH,OAAO,CAAC,aAAa;IAyBrB;;OAEG;IACH,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO;IAInD;;OAEG;IACH,eAAe,IAAI,MAAM,EAAE;IAI3B;;OAEG;IACH,eAAe,IAAI,MAAM,EAAE;CAG9B"}
+{"version":3,"file":"path-validator.d.ts","sourceRoot":"","sources":["../../src/filesystem/path-validator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1D;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;AAErE;;;;;;;;;;;;GAYG;AACH,qBAAa,aAAa;IACtB,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,sBAAsB,CAAW;IACzC,OAAO,CAAC,sBAAsB,CAAW;IACzC,OAAO,CAAC,2BAA2B,CAAW;IAC9C,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,wBAAwB,CAAuC;gBAE3D,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,YAAY;IAsB1D;;;;;OAKG;IACH,2BAA2B,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI;IAKpE;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc;IA0E9C;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAyBrB;;OAEG;IACH,OAAO,CAAC,aAAa;IAyBrB;;OAEG;IACH,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO;IAInD;;;;;;;;;;;;;;;;;;OAkBG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IA8B9C;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAY9B;;OAEG;IACH,eAAe,IAAI,MAAM,EAAE;IAI3B;;OAEG;IACH,eAAe,IAAI,MAAM,EAAE;CAG9B"}

package/dist/filesystem/path-validator.js

@@ -7,6 +7,7 @@ class PathValidator {
   normalizedBlockedPaths;
   normalizedBlockedExtensions;
   logger;
+  directoryApprovalChecker;
   constructor(config, logger) {
     this.config = config;
     this.logger = logger;
@@ -21,6 +22,16 @@ class PathValidator {
       `PathValidator initialized with ${this.normalizedAllowedPaths.length} allowed paths`
     );
   }
+  /**
+   * Set a callback to check if a path is in an approved directory.
+   * This allows PathValidator to consult ApprovalManager without a direct dependency.
+   *
+   * @param checker Function that returns true if path is in an approved directory
+   */
+  setDirectoryApprovalChecker(checker) {
+    this.directoryApprovalChecker = checker;
+    this.logger.debug("Directory approval checker configured");
+  }
   /**
    * Validate a file path for security and policy compliance
    */
@@ -91,15 +102,23 @@ class PathValidator {
   }
   /**
    * Check if path is within allowed paths (whitelist check)
+   * Also consults the directory approval checker if configured.
    */
   isPathAllowed(normalizedPath) {
     if (this.normalizedAllowedPaths.length === 0) {
       return true;
     }
-    return this.normalizedAllowedPaths.some((allowedPath) => {
+    const isInConfigPaths = this.normalizedAllowedPaths.some((allowedPath) => {
       const relative = path.relative(allowedPath, normalizedPath);
       return !relative.startsWith("..") && !path.isAbsolute(relative);
     });
+    if (isInConfigPaths) {
+      return true;
+    }
+    if (this.directoryApprovalChecker) {
+      return this.directoryApprovalChecker(normalizedPath);
+    }
+    return false;
   }
   /**
    * Check if path matches blocked patterns (blacklist check)
@@ -122,6 +141,55 @@ class PathValidator {
   isPathAllowedQuick(normalizedPath) {
     return this.isPathAllowed(normalizedPath) && !this.isPathBlocked(normalizedPath);
   }
+  /**
+   * Check if a file path is within the configured allowed paths (from config only).
+   * This method does NOT consult ApprovalManager - it only checks the static config paths.
+   *
+   * This is used by ToolManager.checkDirectoryAccess() to determine if a path
+   * needs directory approval. Paths within config-allowed directories don't need
+   * directory approval prompts.
+   *
+   * @param filePath The file path to check (can be relative or absolute)
+   * @returns true if the path is within config-allowed paths, false otherwise
+   *
+   * @example
+   * ```typescript
+   * // Check if path needs directory approval
+   * if (!pathValidator.isPathWithinAllowed('/external/project/file.ts')) {
+   *   // Request directory access approval
+   * }
+   * ```
+   */
+  isPathWithinAllowed(filePath) {
+    if (!filePath || filePath.trim() === "") {
+      return false;
+    }
+    const workingDir = this.config.workingDirectory || process.cwd();
+    let normalizedPath;
+    try {
+      normalizedPath = path.isAbsolute(filePath) ? path.resolve(filePath) : path.resolve(workingDir, filePath);
+      try {
+        normalizedPath = realpathSync.native(normalizedPath);
+      } catch {
+      }
+    } catch {
+      return false;
+    }
+    return this.isInConfigAllowedPaths(normalizedPath);
+  }
+  /**
+   * Check if path is within config-allowed paths only (no approval checker).
+   * Used for prompting decisions.
+   */
+  isInConfigAllowedPaths(normalizedPath) {
+    if (this.normalizedAllowedPaths.length === 0) {
+      return true;
+    }
+    return this.normalizedAllowedPaths.some((allowedPath) => {
+      const relative = path.relative(allowedPath, normalizedPath);
+      return !relative.startsWith("..") && !path.isAbsolute(relative);
+    });
+  }
   /**
    * Get normalized allowed paths
    */

package/dist/image/define-image.cjs

@@ -0,0 +1,146 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var define_image_exports = {};
+__export(define_image_exports, {
+  defineImage: () => defineImage,
+  defineProviderCategory: () => defineProviderCategory,
+  validateImageDefinition: () => validateImageDefinition
+});
+module.exports = __toCommonJS(define_image_exports);
+function defineImage(definition) {
+  if (!definition.name) {
+    throw new Error("Image definition must have a name");
+  }
+  if (!definition.version) {
+    throw new Error("Image definition must have a version");
+  }
+  if (!definition.description) {
+    throw new Error("Image definition must have a description");
+  }
+  for (const [category, config] of Object.entries(definition.providers)) {
+    if (!config) continue;
+    if (!config.providers && !config.register) {
+      throw new Error(
+        `Provider category '${category}' must have either 'providers' array or 'register' function`
+      );
+    }
+  }
+  return definition;
+}
+function defineProviderCategory(config) {
+  if (!config.providers && !config.register) {
+    throw new Error("Provider category must have either providers or register function");
+  }
+  return config;
+}
+function validateImageDefinition(definition) {
+  if (!definition.name || typeof definition.name !== "string") {
+    throw new Error("Image name must be a non-empty string");
+  }
+  if (!definition.version || typeof definition.version !== "string") {
+    throw new Error("Image version must be a non-empty string");
+  }
+  if (!definition.description || typeof definition.description !== "string") {
+    throw new Error("Image description must be a non-empty string");
+  }
+  const versionRegex = /^\d+\.\d+\.\d+(-[a-zA-Z0-9.-]+)?$/;
+  if (!versionRegex.test(definition.version)) {
+    throw new Error(
+      `Image version '${definition.version}' is not valid semver. Expected format: x.y.z`
+    );
+  }
+  const validTargets = [
+    "local-development",
+    "cloud-production",
+    "edge-serverless",
+    "embedded-iot",
+    "enterprise",
+    "custom"
+  ];
+  if (definition.target && !validTargets.includes(definition.target)) {
+    throw new Error(
+      `Invalid target '${definition.target}'. Valid targets: ${validTargets.join(", ")}`
+    );
+  }
+  const hasProviders = definition.providers && Object.values(definition.providers).some((config) => config !== void 0);
+  if (!hasProviders && !definition.extends) {
+    throw new Error(
+      "Image must either define at least one provider category or extend a base image"
+    );
+  }
+  for (const [category, config] of Object.entries(definition.providers)) {
+    if (!config) continue;
+    if (!config.providers && !config.register) {
+      throw new Error(
+        `Provider category '${category}' must have either 'providers' array or 'register' function`
+      );
+    }
+    if (config.providers && !Array.isArray(config.providers)) {
+      throw new Error(`Provider category '${category}' providers must be an array`);
+    }
+    if (config.register && typeof config.register !== "function") {
+      throw new Error(`Provider category '${category}' register must be a function`);
+    }
+  }
+  const validConstraints = [
+    "filesystem-required",
+    "network-required",
+    "offline-capable",
+    "serverless-compatible",
+    "cold-start-optimized",
+    "low-memory",
+    "edge-compatible",
+    "browser-compatible"
+  ];
+  if (definition.constraints) {
+    if (!Array.isArray(definition.constraints)) {
+      throw new Error("Image constraints must be an array");
+    }
+    for (const constraint of definition.constraints) {
+      if (!validConstraints.includes(constraint)) {
+        throw new Error(
+          `Invalid constraint '${constraint}'. Valid constraints: ${validConstraints.join(", ")}`
+        );
+      }
+    }
+  }
+  if (definition.utils) {
+    for (const [name, path] of Object.entries(definition.utils)) {
+      if (typeof path !== "string") {
+        throw new Error(`Utility '${name}' path must be a string`);
+      }
+      if (!path.startsWith("./")) {
+        throw new Error(
+          `Utility '${name}' path must be relative (start with './'). Got: ${path}`
+        );
+      }
+    }
+  }
+  if (definition.extends) {
+    if (typeof definition.extends !== "string") {
+      throw new Error("Image extends must be a string (parent image name)");
+    }
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  defineImage,
+  defineProviderCategory,
+  validateImageDefinition
+});

package/dist/image/define-image.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Image definition helper
+ *
+ * Provides type-safe API for defining base images.
+ */
+import type { ImageDefinition } from './types.js';
+/**
+ * Define a Dexto base image.
+ *
+ * This function provides type checking and validation for image definitions.
+ * Use this in your dexto.image.ts file.
+ *
+ * @example
+ * ```typescript
+ * // dexto.image.ts
+ * import { defineImage } from '@dexto/core';
+ * import { localBlobProvider } from './providers/blob.js';
+ *
+ * export default defineImage({
+ *   name: 'local',
+ *   version: '1.0.0',
+ *   description: 'Local development base image',
+ *   target: 'local-development',
+ *
+ *   providers: {
+ *     blobStore: {
+ *       providers: [localBlobProvider],
+ *     },
+ *   },
+ *
+ *   defaults: {
+ *     storage: {
+ *       blob: { type: 'local', storePath: './data/blobs' },
+ *     },
+ *   },
+ *
+ *   constraints: ['filesystem-required', 'offline-capable'],
+ * });
+ * ```
+ *
+ * @param definition - Image definition object
+ * @returns The same definition (for type inference)
+ */
+export declare function defineImage(definition: ImageDefinition): ImageDefinition;
+/**
+ * Helper to create a provider category configuration.
+ *
+ * @example
+ * ```typescript
+ * import { defineProviderCategory } from '@dexto/core';
+ *
+ * const blobStore = defineProviderCategory({
+ *   providers: [localBlobProvider, s3BlobProvider],
+ * });
+ * ```
+ */
+export declare function defineProviderCategory(config: {
+    providers?: any[];
+    register?: () => void | Promise<void>;
+}): {
+    providers?: any[];
+    register?: () => void | Promise<void>;
+};
+/**
+ * Validate an image definition.
+ * Throws if the definition is invalid.
+ *
+ * Used by bundler to validate images before building.
+ */
+export declare function validateImageDefinition(definition: ImageDefinition): void;
+//# sourceMappingURL=define-image.d.ts.map

package/dist/image/define-image.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-image.d.ts","sourceRoot":"","sources":["../../src/image/define-image.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,eAAe,GAAG,eAAe,CAuBxE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC3C,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzC;gBAFe,GAAG,EAAE;eACN,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;EAMxC;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,eAAe,GAAG,IAAI,CAiHzE"}