@dreb/coding-agent 2.40.2 → 2.42.0

package/dist/modes/rpc/rpc-mode.js

@@ -7,13 +7,14 @@
  * Protocol:
  * - Commands: JSON objects with `type` field, optional `id` for correlation
  * - Responses: JSON objects with `type: "response"`, `command`, `success`, and optional `data`/`error`
- * - Events: AgentSessionEvent objects streamed as they occur
+ * - Events: RpcEvent objects streamed as they occur
  * - Extension UI: Extension UI requests are emitted, client responds with extension_ui_response
  */
 import * as crypto from "node:crypto";
 import { basename } from "node:path";
 import { isValidThinkingLevel, VALID_THINKING_LEVELS } from "../../cli/args.js";
 import { VERSION } from "../../config.js";
+import { canonicalizeTrustedRoots, matchContextTrust, validateTrustedContextFolder, validateTrustedContextFolders, } from "../../core/context-trust.js";
 import { DailyCostTracker } from "../../core/daily-cost-tracker.js";
 import { getGitBranch } from "../../core/git-branch.js";
 import { parseModelPattern } from "../../core/model-resolver.js";
@@ -87,6 +88,7 @@ export function getStateForRpc(session, modelFallbackMessage) {
     return {
         model: session.model,
         scopedModels: getScopedModelsForRpc(session),
+        tasks: session.tasks.map((task) => ({ ...task })),
         usingSubscription: session.model ? session.modelRegistry.isUsingOAuth(session.model) : false,
         thinkingLevel: session.thinkingLevel,
         isStreaming: session.isStreaming,
@@ -152,11 +154,14 @@ export function listAgentTypesForRpc(cwd) {
 /**
  * Handle the `get_settings` RPC command: snapshot the persistent default settings.
  *
- * Reads the SettingsManager's merged (global + project) view — these are the values that
- * seed fresh runtimes, NOT the live session state (`get_state` reports that). Extracted
+ * Most fields read the SettingsManager's merged (global + project) view. Context trust
+ * fields intentionally read global settings only, so projects cannot expand the policy.
+ * These seed fresh runtimes, NOT the live session state (`get_state` reports that). Extracted
  * (like {@link deleteSessionForRpc}) so it is unit-testable without a live RPC session.
  */
 export function getSettingsForRpc(settingsManager) {
+    const contextTrust = settingsManager.getGlobalContextTrustPolicy();
+    const configuredTrustedFolders = settingsManager.getConfiguredTrustedContextFolders();
     return {
         defaultProvider: settingsManager.getDefaultProvider(),
         defaultModel: settingsManager.getDefaultModel(),
@@ -168,12 +173,62 @@ export function getSettingsForRpc(settingsManager) {
         imageAutoResize: settingsManager.getImageAutoResize(),
         blockImages: settingsManager.getBlockImages(),
         enableSkillCommands: settingsManager.getEnableSkillCommands(),
-        autoLoadNestedContext: settingsManager.getAutoLoadNestedContext(),
+        autoLoadNestedContext: contextTrust.unrestricted,
+        trustedContextFolders: configuredTrustedFolders,
+        effectiveTrustedContextRoots: canonicalizeTrustedRoots(contextTrust.trustedFolders),
         transport: settingsManager.getTransport(),
         hideThinkingBlock: settingsManager.getHideThinkingBlock(),
         agentModels: settingsManager.getAgentModels(),
     };
 }
+function formatSettingsErrors(errors) {
+    return errors.map((entry) => `${entry.scope}: ${entry.error.message}`).join("; ");
+}
+/**
+ * Reload durable global and project settings before serving `get_settings`.
+ *
+ * The shared settings-operation lock prevents a refresh from discarding another RPC
+ * settings operation's queued modifications. A failed queued write is returned before
+ * reload so its in-memory changes remain intact rather than being replaced by stale disk
+ * content. Reload failures leave SettingsManager's previous values in memory, therefore
+ * they must be surfaced as an RPC error instead of producing a stale snapshot.
+ */
+export async function getFreshSettingsForRpc(settingsManager) {
+    return settingsWriteLock(async () => {
+        try {
+            // A runtime setter may have enqueued a write outside the RPC settings lock.
+            // Waiting for SettingsManager's own queue protects that update from reload().
+            await settingsManager.flush();
+        }
+        catch (error) {
+            return { ok: false, error: `Failed to refresh settings: ${error.message}` };
+        }
+        const writeErrors = settingsManager.drainErrors();
+        if (writeErrors.length > 0) {
+            return {
+                ok: false,
+                error: `Failed to refresh settings: pending settings write failed: ${formatSettingsErrors(writeErrors)}`,
+            };
+        }
+        try {
+            settingsManager.reload();
+        }
+        catch (error) {
+            return { ok: false, error: `Failed to reload settings: ${error.message}` };
+        }
+        const loadErrors = settingsManager.drainErrors();
+        if (loadErrors.length > 0 ||
+            settingsManager.hasGlobalSettingsLoadError() ||
+            settingsManager.hasProjectSettingsLoadError()) {
+            const detail = formatSettingsErrors(loadErrors);
+            return {
+                ok: false,
+                error: detail ? `Failed to reload settings: ${detail}` : "Failed to reload settings from durable storage",
+            };
+        }
+        return { ok: true, settings: getSettingsForRpc(settingsManager) };
+    });
+}
 const SETTINGS_UPDATE_KEYS = [
     "defaultProvider",
     "defaultModel",
@@ -186,6 +241,7 @@ const SETTINGS_UPDATE_KEYS = [
     "blockImages",
     "enableSkillCommands",
     "autoLoadNestedContext",
+    "trustedContextFolders",
     "transport",
     "hideThinkingBlock",
     "agentModels",
@@ -223,15 +279,36 @@ function validateAgentModels(value) {
     }
     return { ok: true };
 }
+/** Evaluate a strictly canonical, absolute directory through the core trust matcher. */
+export function evaluateContextTrustForRpc(settingsManager, path) {
+    let canonicalTarget;
+    try {
+        canonicalTarget = validateTrustedContextFolder(path);
+    }
+    catch (error) {
+        return { ok: false, error: `Invalid context trust path: ${error.message}` };
+    }
+    const policy = settingsManager.getGlobalContextTrustPolicy();
+    const match = matchContextTrust(policy, canonicalTarget);
+    if (!match) {
+        return { ok: true, evaluation: { canonicalTarget, state: "untrusted" } };
+    }
+    if (policy.unrestricted) {
+        return { ok: true, evaluation: { canonicalTarget, state: "unrestricted" } };
+    }
+    return {
+        ok: true,
+        evaluation: { canonicalTarget, state: "trusted-root", grantingRoot: match.trustedRoot },
+    };
+}
 /**
- * Simple promise-based mutex that serializes settings writes. RPC commands are dispatched
- * concurrently (`void handleInputLine(line)`) so two `set_settings` commands can overlap.
- * Without serialization, concurrent commands race on SettingsManager's shared error bucket
- * (`drainErrors()` clears the array for everyone): the first to drain takes all errors
- * (including the second's), and the second reports false success despite its write failing.
+ * Simple promise-based mutex that serializes durable settings operations. RPC commands are
+ * dispatched concurrently (`void handleInputLine(line)`) so settings writes and refreshes
+ * can overlap. Without serialization, a refresh could reload over queued modifications, and
+ * concurrent operations could race on SettingsManager's shared error bucket (`drainErrors()`
+ * clears the array for everyone).
  *
- * This lock ensures only one apply+flush+drain block runs at a time — each `set_settings`
- * gets an error window isolated from other `set_settings` commands and from stale errors.
+ * This lock ensures only one apply/flush/drain or flush/reload/drain block runs at a time.
  *
  * Known limitation: the lock does NOT cover the per-runtime commands (`set_model`,
  * `set_steering_mode`, etc.), which persist through the same SettingsManager write queue
@@ -249,6 +326,122 @@ function settingsWriteLock(fn) {
     settingsWriteQueue = next.catch(() => { });
     return next;
 }
+async function persistContextTrustMutationForRpc(settingsManager, folders, targetPath, mutation) {
+    settingsManager.drainErrors();
+    if (settingsManager.hasGlobalSettingsLoadError()) {
+        return {
+            ok: false,
+            error: "Cannot write settings: the global settings file failed to load (fix or remove the corrupt settings.json first)",
+        };
+    }
+    try {
+        settingsManager.setTrustedContextFolders(folders);
+        await settingsManager.flush();
+    }
+    catch (error) {
+        // A security-policy mutation must not remain effective solely in memory when its
+        // durable write fails. Reload restores the last persisted global policy.
+        settingsManager.reload();
+        return { ok: false, error: `Failed to persist settings: ${error.message}` };
+    }
+    const writeErrors = settingsManager.drainErrors();
+    if (writeErrors.length > 0) {
+        const detail = writeErrors.map((e) => `${e.scope}: ${e.error.message}`).join("; ");
+        // SettingsManager records queued write failures rather than rejecting flush(). Its
+        // in-memory policy has already changed, so restore it from durable storage before
+        // reporting failure rather than leaving an undurable trusted root effective.
+        settingsManager.reload();
+        return { ok: false, error: `Failed to persist settings: ${detail}` };
+    }
+    const evaluated = evaluateContextTrustForRpc(settingsManager, targetPath);
+    if (!evaluated.ok)
+        return evaluated;
+    return {
+        ok: true,
+        result: { evaluation: evaluated.evaluation, settings: getSettingsForRpc(settingsManager), ...mutation },
+    };
+}
+/** Add a canonical directory to the global trusted roots and flush the change. */
+export async function trustContextFolderForRpc(settingsManager, path) {
+    return settingsWriteLock(async () => {
+        const evaluated = evaluateContextTrustForRpc(settingsManager, path);
+        if (!evaluated.ok)
+            return evaluated;
+        // Existing malformed entries are fail-closed. A trust mutation rewrites the configured
+        // list as the canonical configured roots plus this new canonical root.
+        const roots = canonicalizeTrustedRoots(settingsManager.getConfiguredTrustedContextFolders());
+        let folders;
+        try {
+            folders = validateTrustedContextFolders([...roots, evaluated.evaluation.canonicalTarget]);
+        }
+        catch (error) {
+            return { ok: false, error: error.message };
+        }
+        return persistContextTrustMutationForRpc(settingsManager, folders, evaluated.evaluation.canonicalTarget, {
+            ...(folders.includes(evaluated.evaluation.canonicalTarget)
+                ? { addedRoot: evaluated.evaluation.canonicalTarget }
+                : {}),
+        });
+    });
+}
+/** Remove the root actually granting a directory access, rather than the supplied descendant. */
+export async function untrustContextFolderForRpc(settingsManager, path) {
+    return settingsWriteLock(async () => {
+        const evaluated = evaluateContextTrustForRpc(settingsManager, path);
+        if (!evaluated.ok)
+            return evaluated;
+        if (evaluated.evaluation.state === "unrestricted") {
+            return {
+                ok: false,
+                error: "Cannot untrust a context folder while unrestricted nested context loading is enabled; disable autoLoadNestedContext first",
+            };
+        }
+        if (evaluated.evaluation.state === "untrusted") {
+            return {
+                ok: true,
+                result: { evaluation: evaluated.evaluation, settings: getSettingsForRpc(settingsManager) },
+            };
+        }
+        const removedRoot = evaluated.evaluation.grantingRoot;
+        const roots = canonicalizeTrustedRoots(settingsManager.getConfiguredTrustedContextFolders());
+        return persistContextTrustMutationForRpc(settingsManager, roots.filter((root) => root !== removedRoot), evaluated.evaluation.canonicalTarget, { removedRoot });
+    });
+}
+/** Remove a configured trusted-folder string exactly as stored and flush the change. */
+export async function removeTrustedContextFolderForRpc(settingsManager, path) {
+    return settingsWriteLock(async () => {
+        if (typeof path !== "string" || path.length === 0) {
+            return { ok: false, error: "remove_trusted_context_folder requires a non-empty string path" };
+        }
+        settingsManager.drainErrors();
+        if (settingsManager.hasGlobalSettingsLoadError()) {
+            return {
+                ok: false,
+                error: "Cannot write settings: the global settings file failed to load (fix or remove the corrupt settings.json first)",
+            };
+        }
+        try {
+            settingsManager.removeTrustedContextFolder(path);
+            await settingsManager.flush();
+        }
+        catch (error) {
+            // A security-policy mutation must not remain effective solely in memory when its
+            // durable write fails. Reload restores the last persisted global policy.
+            settingsManager.reload();
+            return { ok: false, error: `Failed to persist settings: ${error.message}` };
+        }
+        const writeErrors = settingsManager.drainErrors();
+        if (writeErrors.length > 0) {
+            const detail = writeErrors.map((e) => `${e.scope}: ${e.error.message}`).join("; ");
+            // SettingsManager records queued write failures rather than rejecting flush(). Its
+            // in-memory policy has already changed, so restore it from durable storage before
+            // reporting failure rather than leaving an undurable trust removal effective.
+            settingsManager.reload();
+            return { ok: false, error: `Failed to persist settings: ${detail}` };
+        }
+        return { ok: true, result: { settings: getSettingsForRpc(settingsManager), removedFolder: path } };
+    });
+}
 /**
  * Handle the `set_settings` RPC command: validate and persist default settings.
  *
@@ -329,6 +522,15 @@ export async function setSettingsForRpc(settingsManager, modelRegistry, update)
             return validation;
         }
     }
+    let trustedContextFolders;
+    if (update.trustedContextFolders !== undefined) {
+        try {
+            trustedContextFolders = validateTrustedContextFolders(update.trustedContextFolders);
+        }
+        catch (error) {
+            return { ok: false, error: error.message };
+        }
+    }
     const hasProvider = update.defaultProvider !== undefined;
     const hasModel = update.defaultModel !== undefined;
     if (hasProvider !== hasModel) {
@@ -350,6 +552,7 @@ export async function setSettingsForRpc(settingsManager, modelRegistry, update)
             };
         }
     }
+    const updatesContextTrustPolicy = update.autoLoadNestedContext !== undefined || trustedContextFolders !== undefined;
     // Serialize the apply+flush+drain block so concurrent set_settings commands
     // cannot race on the shared error bucket. See settingsWriteLock doc.
     return settingsWriteLock(async () => {
@@ -367,69 +570,95 @@ export async function setSettingsForRpc(settingsManager, modelRegistry, update)
                 error: "Cannot write settings: the global settings file failed to load (fix or remove the corrupt settings.json first)",
             };
         }
-        // --- Apply (validated) ---
-        if (update.defaultProvider !== undefined && update.defaultModel !== undefined) {
-            settingsManager.setDefaultModelAndProvider(update.defaultProvider, update.defaultModel);
-        }
-        if (update.defaultThinkingLevel !== undefined) {
-            settingsManager.setDefaultThinkingLevel(update.defaultThinkingLevel);
-        }
-        if (update.steeringMode !== undefined) {
-            settingsManager.setSteeringMode(update.steeringMode);
-        }
-        if (update.followUpMode !== undefined) {
-            settingsManager.setFollowUpMode(update.followUpMode);
-        }
-        if (update.compactionEnabled !== undefined) {
-            settingsManager.setCompactionEnabled(update.compactionEnabled);
-        }
-        if (update.retryEnabled !== undefined) {
-            settingsManager.setRetryEnabled(update.retryEnabled);
-        }
-        if (update.imageAutoResize !== undefined) {
-            settingsManager.setImageAutoResize(update.imageAutoResize);
-        }
-        if (update.blockImages !== undefined) {
-            settingsManager.setBlockImages(update.blockImages);
-        }
-        if (update.enableSkillCommands !== undefined) {
-            settingsManager.setEnableSkillCommands(update.enableSkillCommands);
-        }
-        if (update.autoLoadNestedContext !== undefined) {
-            settingsManager.setAutoLoadNestedContext(update.autoLoadNestedContext);
-        }
-        if (update.transport !== undefined) {
-            settingsManager.setTransport(update.transport);
-        }
-        if (update.hideThinkingBlock !== undefined) {
-            settingsManager.setHideThinkingBlock(update.hideThinkingBlock);
-        }
-        const warnings = [];
-        if (update.agentModels !== undefined) {
-            for (const [agentName, models] of Object.entries(update.agentModels)) {
-                if (settingsManager.hasProjectAgentModelOverride(agentName)) {
-                    warnings.push(`A project-level agentModels override for ${JSON.stringify(agentName)} (.dreb/settings.json) ` +
-                        "takes precedence — this change to global settings will have no effect. " +
-                        "Edit the project settings file to change it.");
-                }
-                if (models.length > 0) {
-                    settingsManager.setAgentModelsForAgent(agentName, models);
+        try {
+            // Phase 1: durably persist every ordinary setting before touching the
+            // security-sensitive context trust policy.
+            if (update.defaultProvider !== undefined && update.defaultModel !== undefined) {
+                settingsManager.setDefaultModelAndProvider(update.defaultProvider, update.defaultModel);
+            }
+            if (update.defaultThinkingLevel !== undefined) {
+                settingsManager.setDefaultThinkingLevel(update.defaultThinkingLevel);
+            }
+            if (update.steeringMode !== undefined) {
+                settingsManager.setSteeringMode(update.steeringMode);
+            }
+            if (update.followUpMode !== undefined) {
+                settingsManager.setFollowUpMode(update.followUpMode);
+            }
+            if (update.compactionEnabled !== undefined) {
+                settingsManager.setCompactionEnabled(update.compactionEnabled);
+            }
+            if (update.retryEnabled !== undefined) {
+                settingsManager.setRetryEnabled(update.retryEnabled);
+            }
+            if (update.imageAutoResize !== undefined) {
+                settingsManager.setImageAutoResize(update.imageAutoResize);
+            }
+            if (update.blockImages !== undefined) {
+                settingsManager.setBlockImages(update.blockImages);
+            }
+            if (update.enableSkillCommands !== undefined) {
+                settingsManager.setEnableSkillCommands(update.enableSkillCommands);
+            }
+            if (update.transport !== undefined) {
+                settingsManager.setTransport(update.transport);
+            }
+            if (update.hideThinkingBlock !== undefined) {
+                settingsManager.setHideThinkingBlock(update.hideThinkingBlock);
+            }
+            const warnings = [];
+            if (update.agentModels !== undefined) {
+                for (const [agentName, models] of Object.entries(update.agentModels)) {
+                    if (settingsManager.hasProjectAgentModelOverride(agentName)) {
+                        warnings.push(`A project-level agentModels override for ${JSON.stringify(agentName)} (.dreb/settings.json) ` +
+                            "takes precedence — this change to global settings will have no effect. " +
+                            "Edit the project settings file to change it.");
+                    }
+                    if (models.length > 0) {
+                        settingsManager.setAgentModelsForAgent(agentName, models);
+                    }
+                    else {
+                        settingsManager.removeAgentModelsForAgent(agentName);
+                    }
                 }
-                else {
-                    settingsManager.removeAgentModelsForAgent(agentName);
+            }
+            await settingsManager.flush();
+            const writeErrors = settingsManager.drainErrors();
+            if (writeErrors.length > 0) {
+                const detail = writeErrors.map((e) => `${e.scope}: ${e.error.message}`).join("; ");
+                // Context trust has not yet been modified, so do not reload: doing so
+                // could discard unrelated pending in-memory state.
+                return { ok: false, error: `Failed to persist settings: ${detail}` };
+            }
+            // Phase 2: apply both context fields in one queued, atomic write only after
+            // phase 1 is durably successful.
+            if (updatesContextTrustPolicy) {
+                settingsManager.setContextTrust({
+                    ...(update.autoLoadNestedContext !== undefined ? { autoLoadNested: update.autoLoadNestedContext } : {}),
+                    ...(trustedContextFolders !== undefined ? { trustedFolders: trustedContextFolders } : {}),
+                });
+                await settingsManager.flush();
+                const ctxErrors = settingsManager.drainErrors();
+                if (ctxErrors.length > 0) {
+                    const detail = ctxErrors.map((e) => `${e.scope}: ${e.error.message}`).join("; ");
+                    // The context write failed, so durable storage retains its previous,
+                    // fail-closed policy. Restore that policy in memory before returning.
+                    settingsManager.reload();
+                    return { ok: false, error: `Failed to persist settings: ${detail}` };
                 }
             }
+            return warnings.length > 0
+                ? { ok: true, settings: getSettingsForRpc(settingsManager), warnings }
+                : { ok: true, settings: getSettingsForRpc(settingsManager) };
         }
-        // Ensure durability and surface write errors instead of losing them.
-        await settingsManager.flush();
-        const writeErrors = settingsManager.drainErrors();
-        if (writeErrors.length > 0) {
-            const detail = writeErrors.map((e) => `${e.scope}: ${e.error.message}`).join("; ");
-            return { ok: false, error: `Failed to persist settings: ${detail}` };
+        catch (error) {
+            if (updatesContextTrustPolicy) {
+                // Setters and flush() can also fail synchronously. The same fail-closed
+                // rollback is required before returning that persistence failure.
+                settingsManager.reload();
+            }
+            return { ok: false, error: `Failed to persist settings: ${error.message}` };
         }
-        return warnings.length > 0
-            ? { ok: true, settings: getSettingsForRpc(settingsManager), warnings }
-            : { ok: true, settings: getSettingsForRpc(settingsManager) };
     });
 }
 function normalizePreview(text) {
@@ -873,6 +1102,16 @@ export async function runRpcMode(session, modelFallbackMessage) {
             case "get_state": {
                 return success(id, "get_state", getStateForRpc(session, modelFallbackMessage));
             }
+            case "get_dashboard_snapshot": {
+                const snapshotId = id ?? crypto.randomUUID();
+                const data = {
+                    snapshotId,
+                    state: getStateForRpc(session, modelFallbackMessage),
+                    messages: [...session.messages],
+                    backgroundAgents: getBackgroundAgents().map(toRpcBackgroundAgentInfo),
+                };
+                return success(id, "get_dashboard_snapshot", data);
+            }
             case "get_resources": {
                 return success(id, "get_resources", getResourcesForRpc(session));
             }
@@ -1117,7 +1356,8 @@ export async function runRpcMode(session, modelFallbackMessage) {
             // Settings (persistent defaults)
             // =================================================================
             case "get_settings": {
-                return success(id, "get_settings", getSettingsForRpc(session.settingsManager));
+                const result = await getFreshSettingsForRpc(session.settingsManager);
+                return result.ok ? success(id, "get_settings", result.settings) : error(id, "get_settings", result.error);
             }
             case "set_settings": {
                 const result = await setSettingsForRpc(session.settingsManager, session.modelRegistry, command.settings);
@@ -1128,6 +1368,30 @@ export async function runRpcMode(session, modelFallbackMessage) {
                     ? { ...result.settings, warnings: result.warnings }
                     : result.settings);
             }
+            case "evaluate_context_trust": {
+                const result = evaluateContextTrustForRpc(session.settingsManager, command.path);
+                return result.ok
+                    ? success(id, "evaluate_context_trust", result.evaluation)
+                    : error(id, "evaluate_context_trust", result.error);
+            }
+            case "trust_context_folder": {
+                const result = await trustContextFolderForRpc(session.settingsManager, command.path);
+                return result.ok
+                    ? success(id, "trust_context_folder", result.result)
+                    : error(id, "trust_context_folder", result.error);
+            }
+            case "untrust_context_folder": {
+                const result = await untrustContextFolderForRpc(session.settingsManager, command.path);
+                return result.ok
+                    ? success(id, "untrust_context_folder", result.result)
+                    : error(id, "untrust_context_folder", result.error);
+            }
+            case "remove_trusted_context_folder": {
+                const result = await removeTrustedContextFolderForRpc(session.settingsManager, command.path);
+                return result.ok
+                    ? success(id, "remove_trusted_context_folder", result.result)
+                    : error(id, "remove_trusted_context_folder", result.error);
+            }
             // =================================================================
             // Version
             // =================================================================
@@ -1211,6 +1475,13 @@ export async function runRpcMode(session, modelFallbackMessage) {
             // Handle regular commands
             const command = parsed;
             const response = await handleCommand(command);
+            // Emit the barrier before the response. Stdout preserves byte order even
+            // when these lines arrive in separate chunks, so RuntimePool always records
+            // the EventHub sequence before the response promise can resume.
+            if (command.type === "get_dashboard_snapshot" && response.success) {
+                const snapshot = response;
+                output({ type: "dashboard_snapshot_barrier", snapshotId: snapshot.data.snapshotId });
+            }
             output(response);
             // Check for deferred shutdown request (idle between commands)
             await checkShutdownRequested();