@ericsanchezok/synergy-util 2.4.5 → 3.0.0

package/dist/capability.js

@@ -12,14 +12,6 @@ export const SYNERGY_CAPABILITY_CATEGORIES = [
     "communication",
     "platform",
 ];
-export function publicToolNames(manifest) {
-    return (manifest.contributes?.tools ?? [])
-        .filter((tool) => tool.exposure?.mode !== "internal")
-        .map((tool) => tool.name);
-}
-export function hasPublicTools(manifest) {
-    return publicToolNames(manifest).length > 0;
-}
 export const SYNERGY_CAPABILITY_DETAILS = {
     shell_read: {
         category: "runtime",
@@ -33,17 +25,30 @@ export const SYNERGY_CAPABILITY_DETAILS = {
         title: "Run shell commands",
         description: "Can execute non-destructive shell commands in the current workspace.",
     },
+    shell_branch_mutation: {
+        category: "runtime",
+        severity: "medium",
+        title: "Change active branch in workspace",
+        description: "Can run git checkout / git switch to change the active branch, which is safe in worktrees but can corrupt concurrent sessions on the main checkout.",
+    },
     shell_remote_write: {
         category: "runtime",
         severity: "medium",
         title: "Run remote-write shell commands",
         description: "Can modify existing remote state outside ordinary branch/PR publication workflows.",
     },
+    shell_remote_execute: {
+        category: "runtime",
+        severity: "high",
+        title: "Execute commands on remote host",
+        description: "Can run bash/process commands on a remote Synergy Link host.",
+        nonBypassable: true,
+    },
     shell_remote_publish: {
         category: "runtime",
         severity: "medium",
         title: "Publish development changes",
-        description: "Can push explicit non-protected branches or create pull requests without destructive remote updates.",
+        description: "Can push explicit non-protected branches, create pull requests, comment on PRs/issues, and create issues without destructive remote updates.",
     },
     shell_destructive: {
         category: "runtime",
@@ -143,9 +148,21 @@ export const SYNERGY_CAPABILITY_DETAILS = {
     },
     task: {
         category: "tools",
-        severity: "medium",
+        severity: "low",
         title: "Delegate tasks to subagents",
-        description: "Can launch approved Synergy subagents from plugin tools.",
+        description: "Runtime control-profile permission to launch an approved Synergy subagent.",
+    },
+    "blueprint.delegate": {
+        category: "runtime",
+        severity: "high",
+        title: "Delegate Blueprint runs",
+        description: "Can create and control BlueprintLoop executions in an existing Session.",
+    },
+    "lightloop.delegate": {
+        category: "runtime",
+        severity: "high",
+        title: "Enable Light Loop",
+        description: "Can enable the Light Loop workflow in an existing Session.",
     },
     prompt_transform: {
         category: "hooks",
@@ -220,17 +237,30 @@ export const SYNERGY_CAPABILITY_DETAILS = {
         title: "Use browser clipboard",
         description: "Can read from or write to browser clipboard state.",
     },
+    browser_upload: {
+        category: "browser",
+        severity: "high",
+        title: "Upload files to browser",
+        description: "Can transfer approved workspace file content into the current browser page.",
+        nonBypassable: true,
+    },
+    browser_coordinate: {
+        category: "browser",
+        severity: "medium",
+        title: "Use browser coordinates",
+        description: "Can interact with a browser page using visual coordinates instead of semantic locators.",
+    },
     browser_download: {
         category: "browser",
         severity: "medium",
         title: "Download browser files",
         description: "Can download files through the browser workspace.",
     },
-    browser_viewport: {
+    browser_emulation: {
         category: "browser",
         severity: "low",
-        title: "Resize browser viewport",
-        description: "Can change the browser workspace viewport.",
+        title: "Emulate a browser environment",
+        description: "Can change browser viewport, device, locale, media, CPU, and network emulation.",
     },
     identity_act: {
         category: "identity",
@@ -273,8 +303,10 @@ export const SYNERGY_PROFILE_CAPABILITIES = [
     "file_write",
     "shell_read",
     "shell",
-    "shell_remote_write",
+    "shell_branch_mutation",
+    "shell_remote_execute",
     "shell_remote_publish",
+    "shell_remote_write",
     "shell_destructive",
     "shell_hardline",
     "file_external_read",
@@ -306,8 +338,10 @@ export const SYNERGY_PROFILE_CAPABILITIES = [
     "browser_eval_readonly",
     "browser_eval_trusted",
     "browser_clipboard",
+    "browser_upload",
+    "browser_coordinate",
     "browser_download",
-    "browser_viewport",
+    "browser_emulation",
 ];
 export const SYNERGY_PERMISSION_CAPABILITY = {
     read: "file_read",
@@ -332,6 +366,7 @@ export const SYNERGY_PERMISSION_CAPABILITY = {
     network_request: "network_request",
     scan_document: "file_read",
     look_at: "file_read",
+    view_image: "file_read",
     attach: "file_read",
     ast_grep: "file_read",
     lsp: "file_read",
@@ -370,7 +405,7 @@ export const SYNERGY_PERMISSION_CAPABILITY = {
     email_read: "communication_email",
     email_send: "communication_email",
     communication_email: "communication_email",
-    session_send: "channel_outbound",
+    session_send: "identity_act",
     channel_outbound: "channel_outbound",
     identity_act: "identity_act",
     platform_control: "platform_control",
@@ -381,375 +416,8 @@ export function permissionCapability(permission) {
 export function capabilityNonBypassable(capability) {
     return SYNERGY_CAPABILITY_DETAILS[capability]?.nonBypassable === true;
 }
-export function capabilityRisk(capability, manifest) {
-    if (capability === "network_request" && manifest) {
-        return (manifest.permissions?.network?.connectDomains ?? []).length > 0 ? "medium" : "high";
-    }
-    const details = SYNERGY_CAPABILITY_DETAILS[capability];
-    if (details)
-        return details.severity;
-    return "high";
-}
-function maxRisk(current, next) {
-    if (current === "high" || next === "high")
-        return "high";
-    if (current === "medium" || next === "medium")
-        return "medium";
-    return "low";
-}
-function sortKeys(value) {
-    if (Array.isArray(value))
-        return value.map(sortKeys);
-    if (value !== null && typeof value === "object") {
-        const entries = Object.entries(value).sort(([a], [b]) => a.localeCompare(b));
-        const result = {};
-        for (const [key, item] of entries) {
-            result[key] = sortKeys(item);
-        }
-        return result;
-    }
-    return value;
-}
-function buildCapabilitySet(permissions, toolOverrides) {
-    const caps = new Set();
-    const pt = permissions?.tools;
-    const pd = permissions?.data;
-    const tc = toolOverrides;
-    const fs = tc?.filesystem ?? pt?.filesystem ?? "none";
-    if (fs === "read")
-        caps.add("file_read");
-    if (fs === "write") {
-        caps.add("file_read");
-        caps.add("file_write");
-    }
-    if (tc?.shell ?? pt?.shell ?? false)
-        caps.add("shell");
-    if (tc?.network ?? pt?.network ?? false)
-        caps.add("network_request");
-    if (pt?.mcp === "invoke")
-        caps.add("mcp_invoke");
-    if (pt?.mcp === "spawn") {
-        caps.add("mcp_invoke");
-        caps.add("mcp_spawn");
-    }
-    if (pt?.task)
-        caps.add("task");
-    const sess = tc?.session ?? pd?.session ?? "none";
-    if (sess === "read")
-        caps.add("session_data");
-    const ws = tc?.workspace ?? pd?.workspace ?? "none";
-    if (ws === "read")
-        caps.add("workspace_data");
-    const cfg = tc?.config ?? pd?.config ?? "none";
-    if (cfg === "global") {
-        caps.add("config:read");
-        caps.add("config:write");
-    }
-    if (cfg === "plugin")
-        caps.add("config:read");
-    if (pd?.secrets === "own")
-        caps.add("secrets");
-    const hooks = permissions?.hooks;
-    if (hooks?.promptTransform)
-        caps.add("prompt_transform");
-    if (hooks?.compactionTransform)
-        caps.add("compaction_transform");
-    if (hooks?.config)
-        caps.add("config_hook");
-    if (hooks?.toolExecute && hooks.toolExecute !== "none")
-        caps.add("tool_execution_hook");
-    if (hooks?.permissionAsk && hooks.permissionAsk !== "none")
-        caps.add("permission_hook");
-    if (hooks?.events === "all" || (hooks?.events === "selected" && (hooks.eventNames?.length ?? 0) > 0)) {
-        caps.add("event_hook");
-    }
-    return [...caps].sort();
-}
-export function baseCapabilities(manifest) {
-    return buildCapabilitySet(manifest.permissions);
-}
-export function toolCapabilities(manifest, tool) {
-    return buildCapabilitySet(manifest.permissions, tool.capabilities);
-}
-export function publicToolCapabilities(manifest) {
-    const caps = new Set();
-    for (const tool of manifest.contributes?.tools ?? []) {
-        if (tool.exposure?.mode === "internal")
-            continue;
-        for (const capability of toolCapabilities(manifest, tool))
-            caps.add(capability);
-    }
-    return [...caps].sort();
-}
-export function computeRisk(capabilities, manifest) {
-    if (capabilities.length === 0)
-        return "low";
-    let risk = "low";
-    for (const cap of capabilities) {
-        risk = maxRisk(risk, capabilityRisk(cap, manifest));
-    }
-    return risk;
-}
-export function capabilitiesForRiskScope(manifest, scope) {
-    return scope === "agent" ? publicToolCapabilities(manifest) : baseCapabilities(manifest);
-}
-export function pluginRisk(manifest, input) {
-    return computeRisk(capabilitiesForRiskScope(manifest, input.scope), manifest);
-}
-export function toolRisk(manifest, tool) {
-    return computeRisk(toolCapabilities(manifest, tool), manifest);
-}
-function networkPermissionItem(manifest) {
-    const domains = manifest.permissions?.network?.connectDomains ?? [];
-    const severity = capabilityRisk("network_request", manifest);
-    return {
-        key: "network_request",
-        category: "network",
-        severity,
-        title: "Access network",
-        description: domains.length > 0
-            ? `Can make network requests to: ${domains.join(", ")}.`
-            : "Can make outbound network requests to any domain.",
-        technical: domains.length > 0 ? `domains: ${domains.join(", ")}` : undefined,
-    };
-}
-function contributionPermissionItems(manifest) {
-    const ui = manifest.contributes?.ui;
-    const perms = manifest.permissions?.ui;
-    const items = [];
-    if (ui?.toolRenderers || perms?.toolRenderers) {
-        items.push({
-            key: "ui.toolRenderers",
-            category: "ui",
-            severity: "low",
-            title: "Custom tool renderers",
-            description: "Overrides how tool outputs appear in the chat UI.",
-        });
-    }
-    if (ui?.partRenderers || perms?.partRenderers) {
-        items.push({
-            key: "ui.partRenderers",
-            category: "ui",
-            severity: "low",
-            title: "Custom part renderers",
-            description: "Overrides how message parts appear in the chat UI.",
-        });
-    }
-    if (ui?.workbenchPanels || perms?.workbenchPanels) {
-        items.push({
-            key: "ui.workbenchPanels",
-            category: "ui",
-            severity: "low",
-            title: "Workbench panels",
-            description: "Adds custom panels to the side workspace or BottomSpace.",
-        });
-    }
-    if (ui?.appPanels || perms?.appPanels) {
-        items.push({
-            key: "ui.appPanels",
-            category: "ui",
-            severity: "low",
-            title: "App panels",
-            description: "Adds top-level sidebar panels to the app.",
-        });
-    }
-    if (ui?.settings || perms?.settings) {
-        items.push({
-            key: "ui.settings",
-            category: "ui",
-            severity: "low",
-            title: "Settings page",
-            description: "Adds a custom settings page or form.",
-        });
-    }
-    if (ui?.themes || perms?.themes) {
-        items.push({
-            key: "ui.themes",
-            category: "ui",
-            severity: "low",
-            title: "Custom themes",
-            description: "Adds custom color themes to the UI.",
-        });
-    }
-    if (ui?.icons || perms?.icons) {
-        items.push({
-            key: "ui.icons",
-            category: "ui",
-            severity: "low",
-            title: "Custom icons",
-            description: "Adds custom icon sets to the UI.",
-        });
-    }
-    if (ui?.messageSlots || perms?.messageSlots) {
-        items.push({
-            key: "ui.messageSlots",
-            category: "ui",
-            severity: "low",
-            title: "Message slots",
-            description: "Adds custom components around reasoning and tool timeline sections.",
-        });
-    }
-    if (ui?.appRoutes || perms?.appRoutes) {
-        items.push({
-            key: "ui.appRoutes",
-            category: "ui",
-            severity: "low",
-            title: "App routes",
-            description: "Adds custom plugin pages to the app.",
-        });
-    }
-    if (ui?.commands || perms?.commands) {
-        items.push({
-            key: "ui.commands",
-            category: "ui",
-            severity: "low",
-            title: "Custom commands",
-            description: "Adds custom UI commands to the command palette.",
-        });
-    }
-    return items;
-}
-function dataPermissionItems(manifest) {
-    const data = manifest.permissions?.data;
-    const items = [];
-    if (data?.session === "read") {
-        items.push({
-            key: "data.session",
-            category: "data",
-            severity: "medium",
-            title: "Read session data",
-            description: "Can access session history and metadata across all sessions.",
-        });
-    }
-    else if (data?.session === "metadata") {
-        items.push({
-            key: "data.session",
-            category: "data",
-            severity: "low",
-            title: "Read session metadata",
-            description: "Can access session metadata but not message content.",
-        });
-    }
-    if (data?.workspace === "read") {
-        items.push({
-            key: "data.workspace",
-            category: "data",
-            severity: "low",
-            title: "Read workspace metadata",
-            description: "Can access workspace metadata and directory information.",
-        });
-    }
-    if (data?.secrets === "own") {
-        items.push({
-            key: "data.secrets",
-            category: "data",
-            severity: "high",
-            title: "Own credential store",
-            description: "Can read and write its own stored credentials.",
-        });
-    }
-    return items;
-}
-function hookPermissionItems(manifest) {
-    const hooks = manifest.permissions?.hooks;
-    const items = [];
-    if (hooks?.promptTransform) {
-        items.push({
-            key: "hooks.promptTransform",
-            category: "hooks",
-            severity: "high",
-            title: "Transform prompts",
-            description: "Can modify the system prompt and message context sent to the LLM.",
-        });
-    }
-    if (hooks?.config) {
-        items.push({
-            key: "hooks.config",
-            category: "hooks",
-            severity: "medium",
-            title: "Observe runtime config",
-            description: "Can observe redacted runtime configuration snapshots when Synergy starts or reloads config.",
-        });
-    }
-    if (hooks?.toolExecute === "all") {
-        items.push({
-            key: "hooks.toolExecute",
-            category: "hooks",
-            severity: "medium",
-            title: "Intercept all tool execution",
-            description: "Can rewrite arguments and outputs for all tool calls, including from other plugins.",
-        });
-    }
-    else if (hooks?.toolExecute === "declared") {
-        items.push({
-            key: "hooks.toolExecute",
-            category: "hooks",
-            severity: "low",
-            title: "Intercept declared tool execution",
-            description: "Can rewrite arguments and outputs for tools declared in its manifest.",
-        });
-    }
-    else if (hooks?.toolExecute === "own") {
-        items.push({
-            key: "hooks.toolExecute",
-            category: "hooks",
-            severity: "low",
-            title: "Intercept own tool execution",
-            description: "Can rewrite arguments and outputs for its own tool calls.",
-        });
-    }
-    if (hooks?.permissionAsk === "all") {
-        items.push({
-            key: "hooks.permissionAsk",
-            category: "hooks",
-            severity: "high",
-            title: "Override all permission decisions",
-            description: "Can allow or deny any permission request, including from other plugins.",
-        });
-    }
-    else if (hooks?.permissionAsk === "own") {
-        items.push({
-            key: "hooks.permissionAsk",
-            category: "hooks",
-            severity: "medium",
-            title: "Override own permission decisions",
-            description: "Can allow or deny its own permission requests.",
-        });
-    }
-    return items;
-}
-export function permissionItems(manifest, capabilities) {
-    const items = [];
-    const seen = new Set();
-    const add = (item) => {
-        if (seen.has(item.key))
-            return;
-        seen.add(item.key);
-        items.push(item);
-    };
-    for (const capability of capabilities) {
-        if (capability === "network_request") {
-            add(networkPermissionItem(manifest));
-            continue;
-        }
-        const details = SYNERGY_CAPABILITY_DETAILS[capability];
-        if (details)
-            add({ key: capability, ...details });
-    }
-    for (const item of contributionPermissionItems(manifest))
-        add(item);
-    for (const item of dataPermissionItems(manifest))
-        add(item);
-    for (const item of hookPermissionItems(manifest))
-        add(item);
-    return items;
-}
-export function registryPermissionSummary(manifest, capabilities) {
-    return permissionItems(manifest, capabilities).map((item) => ({
-        key: item.key,
-        description: item.description,
-        risk: item.severity,
-    }));
+export function capabilityRisk(capability) {
+    return SYNERGY_CAPABILITY_DETAILS[capability]?.severity ?? "high";
 }
 export function permissionCategoryForKey(key) {
     const details = SYNERGY_CAPABILITY_DETAILS[key];
@@ -769,91 +437,3 @@ export function permissionCategoryForKey(key) {
         return "browser";
     return "tools";
 }
-export function permissionsHashPayload(manifest, capabilities) {
-    return {
-        capabilities: [...capabilities].sort(),
-        permissions: manifest.permissions ?? {},
-        contributes: permissionsRelevantContributes(manifest),
-        lifecycle: manifest.lifecycle ?? {},
-    };
-}
-function permissionsRelevantContributes(manifest) {
-    const contributes = manifest.contributes;
-    if (!contributes)
-        return undefined;
-    return {
-        ...(contributes.permissions ? { permissions: contributes.permissions } : {}),
-        ...(contributes.tools
-            ? {
-                tools: contributes.tools.map((tool) => ({
-                    id: tool.id,
-                    name: tool.name,
-                    exposure: tool.exposure,
-                    capabilities: tool.capabilities,
-                })),
-            }
-            : {}),
-        ...(contributes.agents
-            ? {
-                agents: contributes.agents.map((agent) => ({
-                    name: agent.name,
-                    mode: agent.mode,
-                    hidden: agent.hidden,
-                    model: agent.model,
-                    modelRole: agent.modelRole,
-                    permission: agent.permission,
-                })),
-            }
-            : {}),
-        ...(contributes.mcp ? { mcp: contributes.mcp } : {}),
-        ...(contributes.ui
-            ? {
-                ui: {
-                    toolRenderers: Boolean(contributes.ui.toolRenderers?.length),
-                    partRenderers: Boolean(contributes.ui.partRenderers?.length),
-                    workbenchPanels: Boolean(contributes.ui.workbenchPanels?.length),
-                    appPanels: Boolean(contributes.ui.appPanels?.length),
-                    settings: Boolean(contributes.ui.settings?.length),
-                    messageSlots: Boolean(contributes.ui.messageSlots?.length),
-                    themes: Boolean(contributes.ui.themes?.length),
-                    icons: Boolean(contributes.ui.icons?.length),
-                    appRoutes: Boolean(contributes.ui.appRoutes?.length),
-                    commands: Boolean(contributes.ui.commands?.length),
-                },
-            }
-            : {}),
-    };
-}
-export function manifestHashPayload(manifest) {
-    return manifest;
-}
-export function stablePluginJson(value) {
-    return JSON.stringify(sortKeys(value));
-}
-export const SYNERGY_BRIDGE_METHOD_POLICY = {
-    "config.get": { type: "capability", capability: "config:read" },
-    "config.set": { type: "capability", capability: "config:write" },
-    "config.replace": { type: "capability", capability: "config:write" },
-    "secret.get": { type: "capability", capability: "secrets" },
-    "secret.set": { type: "capability", capability: "secrets" },
-    "secret.delete": { type: "capability", capability: "secrets" },
-    "cache.get": { type: "unprivileged" },
-    "cache.set": { type: "unprivileged" },
-    "cache.delete": { type: "unprivileged" },
-    "file.read": { type: "capability", capability: "file_read" },
-    "file.write": { type: "capability", capability: "file_write" },
-    "network.fetch": { type: "capability", capability: "network_request" },
-    "shell.run": { type: "capability", capability: "shell" },
-    "session.getMetadata": { type: "capability", capability: "session_data" },
-    "workspace.getMetadata": { type: "capability", capability: "workspace_data" },
-    "task.run": { type: "capability", capability: "task" },
-    "tool.invoke": { type: "unprivileged" },
-    "permission.request": { type: "unprivileged" },
-};
-export function bridgeMethodPolicy(method) {
-    return SYNERGY_BRIDGE_METHOD_POLICY[method] ?? { type: "unknown" };
-}
-export function bridgeCapability(method) {
-    const policy = bridgeMethodPolicy(method);
-    return policy.type === "capability" ? policy.capability : undefined;
-}