@gaunt-sloth/agent 0.1.8 → 2.0.0-alpha.1

package/dist/core/GthDeepAgent.js

@@ -0,0 +1,368 @@
+import { GthAbstractAgent } from '@gaunt-sloth/core/core/GthAbstractAgent.js';
+import { StatusLevel } from '@gaunt-sloth/core/core/types.js';
+import { debugLog, debugLogObject } from '@gaunt-sloth/core/utils/debugUtils.js';
+import { buildSystemMessages, formatToolCalls, readChatPrompt, readCodePrompt, readExecPrompt, } from '@gaunt-sloth/core/utils/llmUtils.js';
+import { getCurrentWorkDir } from '@gaunt-sloth/core/utils/systemUtils.js';
+import { AIMessage, ToolMessage } from '@langchain/core/messages';
+import { createMiddleware } from 'langchain';
+import { createDeepAgent, FilesystemBackend } from 'deepagents';
+import { buildPermissions, FILESYSTEM_TOOL_NAMES, } from '#src/core/deepAgentPermissions.js';
+/**
+ * Deep agent: builds a `createDeepAgent` graph (deepagents). All run/stream/event
+ * plumbing lives in {@link GthAbstractAgent}; this class only knows how to construct
+ * the graph in {@link init}.
+ *
+ * Differences from the lean {@link GthLangChainAgent}:
+ * - deepagents provides the filesystem tools (`read_file`/`write_file`/`edit_file`/
+ *   `ls`/`glob`/`grep`/`execute`) via its own middleware, backed by a
+ *   {@link FilesystemBackend}. gsloth's `.aiignore` + `filesystem` config are mapped
+ *   onto deepagents `permissions` (see {@link buildPermissions}). Any resolved tool
+ *   that reuses a deepagents filesystem-tool name is therefore superseded and dropped
+ *   (`createDeepAgent` would otherwise throw on the collision).
+ * - todos / subagents / summarization come from deepagents' standard middleware.
+ *
+ * The transport-agnostic param assembly lives in {@link buildDeepAgentParams} so the ACP
+ * entry (`deepagents-acp`) can reuse the exact same tool resolution, permission mapping and
+ * middleware hardening without re-running `createDeepAgent` locally.
+ */
+export class GthDeepAgent extends GthAbstractAgent {
+    /**
+     * Opt-in debug sink for the TUI `/debug` panel. Set AFTER {@link init} via
+     * `runner.getAgent()`; read lazily inside the `wrapModelCall` middleware so that when it
+     * is `undefined` (the normal path) the middleware is a transparent pass-through. Never
+     * touched by the lean agent or the AG-UI server, so those contracts are unchanged.
+     */
+    debugCapture;
+    async init(command, configIn, checkpointer) {
+        const params = await this.buildDeepAgentParams(command, configIn);
+        // Runner-path only: surface requested tool calls to the console. This is intentionally
+        // NOT part of buildDeepAgentParams — it writes via statusUpdate (stdout) and the ACP
+        // server renders tool calls itself over its own protocol channel.
+        const statusUpdate = this.statusUpdate;
+        const toolCallStatusMiddleware = createMiddleware({
+            name: 'GthMiddlewareToolCallStatusUpdate',
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            afterModel: (state) => {
+                debugLogObject('postModel state', state);
+                const lastMessage = state.messages[state.messages.length - 1];
+                if (AIMessage.isInstance(lastMessage) &&
+                    lastMessage.tool_calls &&
+                    lastMessage.tool_calls?.length > 0) {
+                    statusUpdate(StatusLevel.INFO, `\nRequested tools: ${formatToolCalls(lastMessage.tool_calls)}\n`);
+                }
+                return state;
+            },
+        });
+        // Debug-capture middleware (TUI `/debug` panel). Always installed but lazy: it reads
+        // `this.debugCapture` per call, so until the TUI attaches a sink it is a transparent
+        // pass-through (one extra await around the handler — the normal path pays nothing).
+        // `request.messages` is the real history at call time (post-summarization/middleware),
+        // and `handler(request)` resolves to the AIMessage response (decision (a): whole
+        // resolved message, not per-chunk — the streaming core stays untouched).
+        const getDebugCapture = () => this.debugCapture;
+        const debugCaptureMiddleware = createMiddleware({
+            name: 'GthMiddlewareDebugCapture',
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            wrapModelCall: async (request, handler) => {
+                const capture = getDebugCapture();
+                if (!capture)
+                    return handler(request);
+                try {
+                    capture.onRequest?.(request.messages, extractDebugRequestExtras(request));
+                }
+                catch {
+                    /* a debug sink must never break the run */
+                }
+                const response = await handler(request);
+                try {
+                    capture.onResponse?.(response);
+                }
+                catch {
+                    /* a debug sink must never break the run */
+                }
+                return response;
+            },
+        });
+        const middleware = [...params.middleware, toolCallStatusMiddleware, debugCaptureMiddleware];
+        this.statusUpdate(StatusLevel.INFO, `Loaded middleware: ${middleware.map((m) => m.name).join(', ')}`);
+        // Default: a virtual-root sandbox anchored at cwd (absolute paths / `..` cannot escape).
+        // `--allow-dir` (config.allowDirs) opts into widening: drop virtualMode so the listed real
+        // directories are reachable, and rely on the permission allow-rules (built in
+        // buildDeepAgentParams) to constrain access to cwd + those dirs. This removes a guardrail,
+        // so it is announced loudly by the exec command and surfaced here in the status log.
+        const allowDirs = this.config?.allowDirs;
+        const widenFs = Array.isArray(allowDirs) && allowDirs.length > 0;
+        if (widenFs) {
+            this.statusUpdate(StatusLevel.WARNING, `Filesystem sandbox widened beyond cwd (--allow-dir): ${allowDirs.join(', ')}`);
+        }
+        const backend = new FilesystemBackend({
+            rootDir: getCurrentWorkDir(),
+            virtualMode: !widenFs,
+        });
+        this.agent = createDeepAgent({
+            model: params.model,
+            tools: params.tools,
+            // gsloth's composed prompt, combined ADDITIVELY by deepagents with its base + fs prompts
+            // into a single system message (avoids the two-system-message Anthropic rejection).
+            systemPrompt: params.systemPrompt,
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            middleware: middleware,
+            backend,
+            permissions: params.permissions,
+            checkpointer,
+        });
+        debugLog('Deep agent created successfully');
+    }
+    /**
+     * Assemble the transport-agnostic {@link GthDeepAgentParams}: resolve tools (with the
+     * filesystem disabled so deepagents owns fs access), apply the allowedTools allow-list and
+     * the deepagents fs-name supersession safety-net, map `.aiignore` + filesystem mode onto
+     * deepagents permissions, and build the fs-denial-softening middleware. Shared by the local
+     * runner ({@link init}) and the `deepagents-acp` ACP entry.
+     */
+    async buildDeepAgentParams(command, configIn) {
+        this.command = command;
+        debugLog(`GthDeepAgent.buildDeepAgentParams called with command: ${command || 'default'}`);
+        // Merge command-specific filesystem config if provided
+        this.config = this.getEffectiveConfig(configIn, command);
+        debugLogObject('Effective Config', {
+            filesystem: this.config.filesystem,
+            builtInTools: this.config.builtInTools,
+            streamOutput: this.config.streamOutput,
+            debugLog: this.config.debugLog,
+        });
+        this.statusUpdate(StatusLevel.INFO, `Workdir: ${getCurrentWorkDir()}`);
+        if (this.config.modelDisplayName) {
+            this.statusUpdate(StatusLevel.INFO, `Model: ${this.config.modelDisplayName}`);
+        }
+        // An empty allowedTools allow-list disables every tool. Skip resolution entirely so we
+        // don't contact MCP servers (and trigger OAuth) just to discard the result.
+        const allowedTools = this.config.allowedTools;
+        const toolsDisabled = Array.isArray(allowedTools) && allowedTools.length === 0;
+        if (toolsDisabled) {
+            this.statusUpdate(StatusLevel.INFO, 'Tool loading disabled by allowedTools: []; MCP/A2A servers will not be contacted. Omit allowedTools for no filtering.');
+        }
+        // Resolve tools with filesystem access disabled. deepagents OWNS the filesystem
+        // (its fs middleware + the `permissions` built below); gsloth's filesystem toolkit
+        // must NOT be loaded here, because its non-colliding tools (read_multiple_files,
+        // delete_file, search_files, …) would otherwise bypass deepagents' permission
+        // enforcement entirely — a model could read an .aiignore-protected file through them.
+        debugLog('Resolving tools (filesystem disabled; deepagents provides fs)...');
+        const toolResolutionConfig = { ...this.config, filesystem: 'none' };
+        const resolvedTools = !toolsDisabled && this.resolvers?.resolveTools
+            ? await this.resolvers.resolveTools(toolResolutionConfig, command)
+            : [];
+        debugLog(`Resolved tools loaded: ${resolvedTools.length}`);
+        // Get user config tools (toolkit-flattened; client tools get interrupt() stubs)
+        const flattenedConfigTools = toolsDisabled
+            ? []
+            : this.extractAndFlattenTools(this.config.tools || []);
+        debugLog(`User config tools loaded: ${flattenedConfigTools.length}`);
+        // Combine all tools, then apply the allowedTools name allow-list when configured.
+        let tools = [...resolvedTools, ...flattenedConfigTools];
+        if (Array.isArray(allowedTools)) {
+            const allowed = new Set(allowedTools);
+            tools = tools.filter((tool) => !tool.name || allowed.has(tool.name));
+        }
+        // Safety net: a custom/dev/MCP tool may still reuse a deepagents filesystem-tool
+        // name (createDeepAgent throws on such a collision). Drop the colliding tool — the
+        // deep agent's built-in fs tool wins. With filesystem disabled above this is normally
+        // empty; it only fires for a genuine user/MCP name clash.
+        const reserved = new Set(FILESYSTEM_TOOL_NAMES);
+        const superseded = tools.filter((tool) => tool.name && reserved.has(tool.name));
+        const passThroughTools = tools.filter((tool) => !tool.name || !reserved.has(tool.name));
+        if (superseded.length > 0) {
+            const names = superseded.map((tool) => tool.name).join(', ');
+            this.statusUpdate(StatusLevel.WARNING, `Dropping tool(s) that collide with deepagents built-in filesystem tools: ${names}`);
+        }
+        if (passThroughTools.length > 0) {
+            const toolNames = passThroughTools
+                .map((tool) => tool.name)
+                .filter((name) => name)
+                .join(', ');
+            this.statusUpdate(StatusLevel.INFO, `Loaded tools: ${toolNames}`);
+            debugLog(`Total tools available: ${passThroughTools.length}`);
+            debugLogObject('All Tools', toolNames.split(', '));
+        }
+        debugLog('Creating deep agent...');
+        // Resolve middleware via resolver or fall back to empty. These are applied AFTER
+        // deepagents' standard middleware (todos, subagents, summarization, filesystem).
+        const resolvedMiddleware = this.resolvers?.resolveMiddleware
+            ? await this.resolvers.resolveMiddleware(
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            this.config.middleware, this.config)
+            : [];
+        // deepagents' standard middleware already summarizes long conversations; drop any
+        // gsloth-configured summarization middleware so the deep agent doesn't summarize twice.
+        const configuredMiddleware = resolvedMiddleware.filter((m) => {
+            const name = m.name ?? '';
+            if (/summar/i.test(name)) {
+                debugLog(`Dropping duplicate summarization middleware '${name}' (deepagents provides it)`);
+                return false;
+            }
+            return true;
+        });
+        // Soften deepagents' fail-hard filesystem permission denials. By default a denied
+        // read/write THROWS, which aborts the whole run; wrap tool calls so a denial becomes
+        // a recoverable ToolMessage instead, letting the model continue and report it. This
+        // preserves gsloth's recoverable-denial UX (the old GthFileSystemToolkit returned a
+        // message rather than throwing).
+        const fsDenialSoftening = createMiddleware({
+            name: 'GthDeepFsDenialSoftening',
+            wrapToolCall: async (request, handler) => {
+                try {
+                    return await handler(request);
+                }
+                catch (e) {
+                    const message = e instanceof Error ? e.message : String(e);
+                    if (/permission denied for (read|write)/i.test(message)) {
+                        debugLog(`Softened fs permission denial into a ToolMessage: ${message}`);
+                        return new ToolMessage({
+                            content: message,
+                            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                            tool_call_id: request.toolCall?.id ?? '',
+                            status: 'error',
+                        });
+                    }
+                    throw e;
+                }
+            },
+        });
+        // fsDenialSoftening first so it is the outermost wrapToolCall — it must see the throw
+        // from deepagents' permission-enforcing fs tools. The console-bound tool-call-status
+        // middleware is NOT added here (see GthDeepAgentParams.middleware); the runner appends it.
+        const middleware = [fsDenialSoftening, ...configuredMiddleware];
+        // Map gsloth's .aiignore + filesystem mode onto deepagents permission rules. When
+        // `--allow-dir` widens the sandbox, the backend runs without virtualMode, so paths are REAL
+        // absolute paths: constrain read+write to cwd + the allowed dirs (everything else denied),
+        // layered under the .aiignore deny rules.
+        const permissions = buildPermissions({
+            filesystem: this.config.filesystem,
+            aiignore: this.config.aiignore,
+            allowDirs: Array.isArray(this.config.allowDirs) && this.config.allowDirs.length > 0
+                ? this.config.allowDirs
+                : undefined,
+        });
+        debugLogObject('Filesystem permissions', permissions);
+        // Compose gsloth's system prompt (backstory + guidelines + per-command mode prompt +
+        // system prompt) so identity profiles (Gaunt Sloth, sorcerer, fisher-alt, …) and
+        // `.gsloth.*.md` are honored. This is passed to createDeepAgent as `systemPrompt` — combined
+        // additively with deepagents' base + fs prompts into ONE system message — rather than injected
+        // as a separate SystemMessage per turn (which produced a non-first system message that
+        // Anthropic rejects). 'code' uses the code-mode prompt; 'exec' uses the prompt-as-script
+        // exec-mode prompt; chat/api/others use the chat prompt.
+        const modePrompt = this.command === 'code'
+            ? readCodePrompt(this.config)
+            : this.command === 'exec'
+                ? readExecPrompt(this.config)
+                : readChatPrompt(this.config);
+        const systemMessages = buildSystemMessages(this.config, modePrompt);
+        const systemPrompt = typeof systemMessages[0]?.content === 'string' ? systemMessages[0].content : undefined;
+        return {
+            model: this.config.llm,
+            tools: passThroughTools,
+            permissions,
+            middleware,
+            systemPrompt,
+        };
+    }
+}
+/**
+ * Scalar model-param fields worth surfacing in the `/debug` panel. Deliberately an
+ * allowlist (NOT a whole-object dump) so no credential field (`apiKey`, `accessToken`, …)
+ * can ever leak into the rendered debug view.
+ *
+ * `streaming` is intentionally NOT here: it is the model instance's static flag, which is
+ * usually `false` even when the turn streams — the GthAgentRunner decides streaming by calling
+ * `.stream()` vs `.invoke()`, not by this property — so surfacing it just misleads.
+ */
+const DEBUG_MODEL_PARAM_KEYS = [
+    'model',
+    'modelName',
+    'modelId',
+    'deploymentName',
+    'temperature',
+    'topP',
+    'topK',
+    'maxTokens',
+    'maxOutputTokens',
+    'maxReasoningTokens',
+    'reasoningEffort',
+    'thinkingBudget',
+    'stop',
+    'provider',
+];
+/** Pull the key-free scalar model params from the (provider-specific) model instance. */
+function extractModelParams(model) {
+    if (!model || typeof model !== 'object')
+        return undefined;
+    const src = model;
+    const out = {};
+    for (const key of DEBUG_MODEL_PARAM_KEYS) {
+        const value = src[key];
+        if (value === undefined || value === null)
+            continue;
+        // Only scalars / scalar arrays — never nested objects that could carry credentials.
+        if (typeof value === 'object' && !Array.isArray(value))
+            continue;
+        out[key] = value;
+    }
+    // `model` / `modelName` / `modelId` are langchain aliases for the same value; collapse the
+    // duplicates so the panel shows the model id once instead of two identical lines.
+    if (typeof out.model !== 'string' && typeof out.modelName === 'string') {
+        out.model = out.modelName;
+    }
+    if (out.modelName === out.model)
+        delete out.modelName;
+    if (out.modelId === out.model)
+        delete out.modelId;
+    return Object.keys(out).length > 0 ? out : undefined;
+}
+/** Best-effort tool definition (name + description + schema) for the debug view. */
+function extractToolDefs(tools) {
+    if (!Array.isArray(tools) || tools.length === 0)
+        return undefined;
+    const defs = [];
+    for (const tool of tools) {
+        if (!tool || typeof tool !== 'object')
+            continue;
+        const t = tool;
+        const name = typeof t.name === 'string' ? t.name : undefined;
+        if (!name)
+            continue;
+        const description = typeof t.description === 'string' ? t.description : undefined;
+        // LangChain StructuredTools expose a Zod/JSON `schema`; some carry it on `lc_kwargs`.
+        const schema = t.schema ?? undefined;
+        defs.push({ name, description, schema });
+    }
+    return defs.length > 0 ? defs : undefined;
+}
+/**
+ * Assemble the non-message request parts ({@link DebugRequestExtras}) for the `/debug`
+ * panel from a `wrapModelCall` request, defensively and key-free. Never throws (the caller
+ * already guards, but a debug sink must never break a run) and never dumps the raw model.
+ */
+export function extractDebugRequestExtras(request) {
+    if (!request || typeof request !== 'object')
+        return undefined;
+    const req = request;
+    const systemMessage = req.systemMessage;
+    const systemPrompt = typeof req.systemPrompt === 'string' && req.systemPrompt
+        ? req.systemPrompt
+        : typeof systemMessage?.content === 'string'
+            ? systemMessage.content
+            : undefined;
+    const extras = {
+        systemPrompt,
+        tools: extractToolDefs(req.tools),
+        modelParams: extractModelParams(req.model),
+        toolChoice: req.toolChoice,
+    };
+    // Return undefined when nothing useful was captured so the renderer can show a clear empty state.
+    const hasAny = extras.systemPrompt !== undefined ||
+        extras.tools !== undefined ||
+        extras.modelParams !== undefined ||
+        extras.toolChoice !== undefined;
+    return hasAny ? extras : undefined;
+}
+//# sourceMappingURL=GthDeepAgent.js.map

package/dist/core/GthDeepAgent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GthDeepAgent.js","sourceRoot":"","sources":["../../src/core/GthDeepAgent.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,4CAA4C,CAAC;AAC9E,OAAO,EAAmB,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,cAAc,EACd,cAAc,GACf,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGlE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EACL,gBAAgB,EAChB,qBAAqB,GAEtB,MAAM,mCAAmC,CAAC;AAiC3C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,YAAa,SAAQ,gBAAgB;IAChD;;;;;OAKG;IACI,YAAY,CAA2B;IAE9C,KAAK,CAAC,IAAI,CACR,OAA+B,EAC/B,QAAmB,EACnB,YAA8C;QAE9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAElE,uFAAuF;QACvF,qFAAqF;QACrF,kEAAkE;QAClE,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACvC,MAAM,wBAAwB,GAAG,gBAAgB,CAAC;YAChD,IAAI,EAAE,mCAAmC;YACzC,8DAA8D;YAC9D,UAAU,EAAE,CAAC,KAAU,EAAE,EAAE;gBACzB,cAAc,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;gBACzC,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBAC9D,IACE,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC;oBACjC,WAAW,CAAC,UAAU;oBACtB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,CAAC,EAClC,CAAC;oBACD,YAAY,CACV,WAAW,CAAC,IAAI,EAChB,sBAAsB,eAAe,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAClE,CAAC;gBACJ,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;SACF,CAAC,CAAC;QAEH,qFAAqF;QACrF,qFAAqF;QACrF,oFAAoF;QACpF,uFAAuF;QACvF,iFAAiF;QACjF,yEAAyE;QACzE,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;QAChD,MAAM,sBAAsB,GAAG,gBAAgB,CAAC;YAC9C,IAAI,EAAE,2BAA2B;YACjC,8DAA8D;YAC9D,aAAa,EAAE,KAAK,EAAE,OAAY,EAAE,OAAY,EAAE,EAAE;gBAClD,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;gBAClC,IAAI,CAAC,OAAO;oBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;gBACtC,IAAI,CAAC;oBACH,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC5E,CAAC;gBAAC,MAAM,CAAC;oBACP,2CAA2C;gBAC7C,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;gBACxC,IAAI,CAAC;oBACH,OAAO,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC;gBACjC,CAAC;gBAAC,MAAM,CAAC;oBACP,2CAA2C;gBAC7C,CAAC;gBACD,OAAO,QAAQ,CAAC;YAClB,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,UAAU,EAAE,wBAAwB,EAAE,sBAAsB,CAAC,CAAC;QAC5F,IAAI,CAAC,YAAY,CACf,WAAW,CAAC,IAAI,EAChB,sBAAsB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjE,CAAC;QAEF,yFAAyF;QACzF,2FAA2F;QAC3F,8EAA8E;QAC9E,2FAA2F;QAC3F,qFAAqF;QACrF,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;QACjE,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,YAAY,CACf,WAAW,CAAC,OAAO,EACnB,wDAAwD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/E,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC;YACpC,OAAO,EAAE,iBAAiB,EAAE;YAC5B,WAAW,EAAE,CAAC,OAAO;SACtB,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,GAAG,eAAe,CAAC;YAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAkC;YAChD,yFAAyF;YACzF,oFAAoF;YACpF,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,8DAA8D;YAC9D,UAAU,EAAE,UAAiB;YAC7B,OAAO;YACP,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY;SACb,CAAC,CAAC;QACH,QAAQ,CAAC,iCAAiC,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAA+B,EAC/B,QAAmB;QAEnB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,QAAQ,CAAC,0DAA0D,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC;QAE3F,uDAAuD;QACvD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACzD,cAAc,CAAC,kBAAkB,EAAE;YACjC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;YAClC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACtC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACtC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;SAC/B,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,EAAE,YAAY,iBAAiB,EAAE,EAAE,CAAC,CAAC;QAEvE,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YACjC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,uFAAuF;QACvF,4EAA4E;QAC5E,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QAC9C,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC;QAC/E,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC,YAAY,CACf,WAAW,CAAC,IAAI,EAChB,uHAAuH,CACxH,CAAC;QACJ,CAAC;QAED,gFAAgF;QAChF,mFAAmF;QACnF,iFAAiF;QACjF,8EAA8E;QAC9E,sFAAsF;QACtF,QAAQ,CAAC,kEAAkE,CAAC,CAAC;QAC7E,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,MAAe,EAAE,CAAC;QAC7E,MAAM,aAAa,GACjB,CAAC,aAAa,IAAI,IAAI,CAAC,SAAS,EAAE,YAAY;YAC5C,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,oBAAoB,EAAE,OAAO,CAAC;YAClE,CAAC,CAAC,EAAE,CAAC;QACT,QAAQ,CAAC,0BAA0B,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;QAE3D,gFAAgF;QAChF,MAAM,oBAAoB,GAAG,aAAa;YACxC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACzD,QAAQ,CAAC,6BAA6B,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC;QAErE,kFAAkF;QAClF,IAAI,KAAK,GAAG,CAAC,GAAG,aAAa,EAAE,GAAG,oBAAoB,CAAC,CAAC;QACxD,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;YACtC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACvE,CAAC;QAED,iFAAiF;QACjF,mFAAmF;QACnF,sFAAsF;QACtF,0DAA0D;QAC1D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,qBAAqB,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAChF,MAAM,gBAAgB,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACxF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7D,IAAI,CAAC,YAAY,CACf,WAAW,CAAC,OAAO,EACnB,4EAA4E,KAAK,EAAE,CACpF,CAAC;QACJ,CAAC;QAED,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,SAAS,GAAG,gBAAgB;iBAC/B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;iBACxB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;iBACtB,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,EAAE,iBAAiB,SAAS,EAAE,CAAC,CAAC;YAClE,QAAQ,CAAC,0BAA0B,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9D,cAAc,CAAC,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,CAAC;QAED,QAAQ,CAAC,wBAAwB,CAAC,CAAC;QAEnC,iFAAiF;QACjF,iFAAiF;QACjF,MAAM,kBAAkB,GAAG,IAAI,CAAC,SAAS,EAAE,iBAAiB;YAC1D,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,iBAAiB;YACpC,8DAA8D;YAC9D,IAAI,CAAC,MAAM,CAAC,UAA+B,EAC3C,IAAI,CAAC,MAAM,CACZ;YACH,CAAC,CAAC,EAAE,CAAC;QAEP,kFAAkF;QAClF,wFAAwF;QACxF,MAAM,oBAAoB,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3D,MAAM,IAAI,GAAI,CAAuB,CAAC,IAAI,IAAI,EAAE,CAAC;YACjD,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,QAAQ,CAAC,gDAAgD,IAAI,4BAA4B,CAAC,CAAC;gBAC3F,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,kFAAkF;QAClF,qFAAqF;QACrF,oFAAoF;QACpF,oFAAoF;QACpF,iCAAiC;QACjC,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;YACzC,IAAI,EAAE,0BAA0B;YAChC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;gBACvC,IAAI,CAAC;oBACH,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAC3D,IAAI,qCAAqC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;wBACxD,QAAQ,CAAC,qDAAqD,OAAO,EAAE,CAAC,CAAC;wBACzE,OAAO,IAAI,WAAW,CAAC;4BACrB,OAAO,EAAE,OAAO;4BAChB,8DAA8D;4BAC9D,YAAY,EAAG,OAAO,CAAC,QAAgB,EAAE,EAAE,IAAI,EAAE;4BACjD,MAAM,EAAE,OAAO;yBAChB,CAAC,CAAC;oBACL,CAAC;oBACD,MAAM,CAAC,CAAC;gBACV,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QAEH,sFAAsF;QACtF,qFAAqF;QACrF,2FAA2F;QAC3F,MAAM,UAAU,GAAG,CAAC,iBAAiB,EAAE,GAAG,oBAAoB,CAAC,CAAC;QAEhE,kFAAkF;QAClF,4FAA4F;QAC5F,2FAA2F;QAC3F,0CAA0C;QAC1C,MAAM,WAAW,GAAG,gBAAgB,CAAC;YACnC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;YAClC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,SAAS,EACP,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;gBACtE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS;gBACvB,CAAC,CAAC,SAAS;SAChB,CAAC,CAAC;QACH,cAAc,CAAC,wBAAwB,EAAE,WAAW,CAAC,CAAC;QAEtD,qFAAqF;QACrF,iFAAiF;QACjF,6FAA6F;QAC7F,+FAA+F;QAC/F,uFAAuF;QACvF,yFAAyF;QACzF,yDAAyD;QACzD,MAAM,UAAU,GACd,IAAI,CAAC,OAAO,KAAK,MAAM;YACrB,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;YAC7B,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,MAAM;gBACvB,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC7B,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACpE,MAAM,YAAY,GAChB,OAAO,cAAc,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAEzF,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG;YACtB,KAAK,EAAE,gBAA6C;YACpD,WAAW;YACX,UAAU;YACV,YAAY;SACb,CAAC;IACJ,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAAG;IAC7B,OAAO;IACP,WAAW;IACX,SAAS;IACT,gBAAgB;IAChB,aAAa;IACb,MAAM;IACN,MAAM;IACN,WAAW;IACX,iBAAiB;IACjB,oBAAoB;IACpB,iBAAiB;IACjB,gBAAgB;IAChB,MAAM;IACN,UAAU;CACF,CAAC;AAEX,yFAAyF;AACzF,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,sBAAsB,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QACpD,oFAAoF;QACpF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,SAAS;QACjE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,2FAA2F;IAC3F,kFAAkF;IAClF,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACvE,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC;IAC5B,CAAC;IACD,IAAI,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC,SAAS,CAAC;IACtD,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAClD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,oFAAoF;AACpF,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,IAAI,GAAmB,EAAE,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS;QAChD,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAClF,sFAAsF;QACtF,MAAM,MAAM,GAAI,CAAC,CAAC,MAAkB,IAAI,SAAS,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAgB;IACxD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,GAAG,GAAG,OAAkC,CAAC;IAC/C,MAAM,aAAa,GAAG,GAAG,CAAC,aAAkD,CAAC;IAC7E,MAAM,YAAY,GAChB,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY;QACtD,CAAC,CAAC,GAAG,CAAC,YAAY;QAClB,CAAC,CAAC,OAAO,aAAa,EAAE,OAAO,KAAK,QAAQ;YAC1C,CAAC,CAAC,aAAa,CAAC,OAAO;YACvB,CAAC,CAAC,SAAS,CAAC;IAClB,MAAM,MAAM,GAAuB;QACjC,YAAY;QACZ,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC;QACjC,WAAW,EAAE,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC;QAC1C,UAAU,EAAE,GAAG,CAAC,UAAU;KAC3B,CAAC;IACF,kGAAkG;IAClG,MAAM,MAAM,GACV,MAAM,CAAC,YAAY,KAAK,SAAS;QACjC,MAAM,CAAC,KAAK,KAAK,SAAS;QAC1B,MAAM,CAAC,WAAW,KAAK,SAAS;QAChC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC;IAClC,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACrC,CAAC"}

package/dist/core/debugCapture.d.ts

@@ -0,0 +1,51 @@
+import type { BaseMessage } from '@langchain/core/messages';
+/**
+ * The non-message parts of a `wrapModelCall` request that also shape a turn: the tool
+ * definitions, the system prompt, and the model params. Captured alongside the message
+ * history so the `/debug` panel can show the full picture of what was sent to the model.
+ *
+ * SECURITY: these are assembled from an explicit allowlist at the capture site
+ * (see `GthDeepAgent`); the raw model instance (which can carry an `apiKey`) is never
+ * passed through here.
+ */
+export interface DebugRequestExtras {
+    /** The composed system prompt string sent to the model for this call. */
+    systemPrompt?: string;
+    /** The tool definitions made available for this call (name + description + JSON schema). */
+    tools?: DebugToolDef[];
+    /** Scalar model params (model id, temperature, …) — a key-free allowlist. */
+    modelParams?: Record<string, unknown>;
+    /** The tool-choice configuration for this call, if any. */
+    toolChoice?: unknown;
+}
+/** A single tool's debug-renderable definition. */
+export interface DebugToolDef {
+    name: string;
+    description?: string;
+    /** The tool's JSON-schema parameters, when resolvable. */
+    schema?: unknown;
+}
+/**
+ * Debug-capture sink for the TUI's `/debug` panel.
+ *
+ * A {@link DebugCapture} is an OPT-IN callback the TUI sets on a live
+ * {@link import('#src/core/GthDeepAgent.js').GthDeepAgent} after `init`. When present,
+ * the deep agent's `wrapModelCall` middleware reports, per model call:
+ *
+ * - `request` — `request.messages: BaseMessage[]`, the real history sent to the model at
+ *   call time (post-summarization / post-middleware), plus the {@link DebugRequestExtras}
+ *   (tools, system prompt, model params) that also shape the turn. This supersedes any
+ *   `getState`/`getMessageHistory` snapshot idea: it is exactly what the model saw.
+ * - `response` — the resolved `AIMessage` returned by the handler, captured as a whole
+ *   (decision (a): resolved message, not per-chunk frames; keeps the streaming core
+ *   untouched).
+ *
+ * The sink is read lazily inside the middleware (per call), so when no TUI debug panel is
+ * attached the middleware is a transparent pass-through and the normal path pays nothing.
+ */
+export interface DebugCapture {
+    /** The full message history sent to the model for this call, plus the request extras. */
+    onRequest?(messages: BaseMessage[], extras?: DebugRequestExtras): void;
+    /** The resolved model response for this call (an `AIMessage`). */
+    onResponse?(response: unknown): void;
+}

package/dist/core/debugCapture.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=debugCapture.js.map

package/dist/core/debugCapture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"debugCapture.js","sourceRoot":"","sources":["../../src/core/debugCapture.ts"],"names":[],"mappings":""}

package/dist/core/deepAgentPermissions.d.ts

@@ -0,0 +1,55 @@
+import type { FilesystemPermission } from 'deepagents';
+export type { FilesystemPermission };
+/**
+ * Tool names deepagents' filesystem middleware registers. This mirrors deepagents'
+ * internal `FILESYSTEM_TOOL_NAMES` (which is declared in its types but not exported
+ * at runtime). `createDeepAgent` throws on a name collision with any of these, so a
+ * gsloth-supplied tool sharing one of these names is superseded by the deep agent's
+ * built-in filesystem tool. Kept here as the single place the deep path references it.
+ */
+export declare const FILESYSTEM_TOOL_NAMES: readonly ["ls", "read_file", "write_file", "edit_file", "glob", "grep", "execute"];
+/** The slice of GthConfig the permission mapping consumes. */
+export interface PermissionConfigSlice {
+    filesystem: string[] | 'all' | 'read' | 'none';
+    aiignore?: {
+        enabled?: boolean;
+        patterns?: string[];
+    };
+    /**
+     * Extra real filesystem roots to allow (`gth exec --allow-dir`). When present, the backend runs
+     * WITHOUT virtualMode, so permission paths are real absolute paths: access is allow-listed to
+     * cwd + these dirs and everything else is denied. Undefined/empty keeps the cwd-only sandbox.
+     */
+    allowDirs?: string[];
+}
+/**
+ * Build allow+deny rules for the widened (`--allow-dir`) sandbox. Because the backend runs
+ * without virtualMode, paths are REAL absolute paths, so we anchor allow rules at the resolved
+ * absolute cwd and each allowed dir, then deny everything else. First-match-wins, so the allow
+ * rules must come before the catch-all deny.
+ */
+export declare function allowDirsToPermissions(allowDirs: string[]): FilesystemPermission[];
+/**
+ * Convert `.aiignore` patterns (relative, .gitignore-ish) into deepagents deny rules.
+ *
+ * deepagents matches the path argument the model passes to a fs tool — resolved by the
+ * backend — against ABSOLUTE globs. With `virtualMode` the backend treats paths as
+ * virtual-absolute under `rootDir`, so we anchor at "/".
+ *
+ * A bare pattern (`*.env`, `secret.txt`) should match at any depth, so we emit both a
+ * top-level (`/secret.txt`) and a recursive (`/**/secret.txt`) rule. A pattern already
+ * containing "/" (`config/secrets.json`) is anchored as-is (plus a `/**` subtree rule).
+ *
+ * `base` defaults to "" so paths are anchored at the virtual root "/". When the sandbox is
+ * widened (`--allow-dir`, no virtualMode) the backend uses REAL absolute paths, so the caller
+ * passes the absolute cwd as `base` to anchor these deny rules there.
+ */
+export declare function aiignoreToPermissions(patterns: string[], base?: string): FilesystemPermission[];
+/** Map gsloth's filesystem mode onto deepagents permission rules. */
+export declare function filesystemModeToPermissions(fs: string[] | 'all' | 'read' | 'none'): FilesystemPermission[];
+/**
+ * Compose the full permission list. `.aiignore` deny rules go FIRST so they win over
+ * any allow rule (first-match-wins). Then the filesystem-mode rules. `.aiignore` is
+ * skipped when explicitly disabled (`aiignore.enabled === false`) or has no patterns.
+ */
+export declare function buildPermissions(config: PermissionConfigSlice): FilesystemPermission[];

package/dist/core/deepAgentPermissions.js

@@ -0,0 +1,120 @@
+import path from 'node:path';
+import { getCurrentWorkDir } from '@gaunt-sloth/core/utils/systemUtils.js';
+/**
+ * Tool names deepagents' filesystem middleware registers. This mirrors deepagents'
+ * internal `FILESYSTEM_TOOL_NAMES` (which is declared in its types but not exported
+ * at runtime). `createDeepAgent` throws on a name collision with any of these, so a
+ * gsloth-supplied tool sharing one of these names is superseded by the deep agent's
+ * built-in filesystem tool. Kept here as the single place the deep path references it.
+ */
+export const FILESYSTEM_TOOL_NAMES = [
+    'ls',
+    'read_file',
+    'write_file',
+    'edit_file',
+    'glob',
+    'grep',
+    'execute',
+];
+/**
+ * Build allow+deny rules for the widened (`--allow-dir`) sandbox. Because the backend runs
+ * without virtualMode, paths are REAL absolute paths, so we anchor allow rules at the resolved
+ * absolute cwd and each allowed dir, then deny everything else. First-match-wins, so the allow
+ * rules must come before the catch-all deny.
+ */
+export function allowDirsToPermissions(allowDirs) {
+    const cwd = getCurrentWorkDir();
+    const roots = [cwd, ...allowDirs.map((d) => path.resolve(cwd, d))];
+    // De-dupe resolved roots (e.g. an --allow-dir pointing back at cwd).
+    const uniqueRoots = Array.from(new Set(roots));
+    const allow = uniqueRoots.map((root) => ({
+        operations: ['read', 'write'],
+        paths: [`${root}/**`, root],
+        mode: 'allow',
+    }));
+    return [...allow, { operations: ['read', 'write'], paths: ['/**'], mode: 'deny' }];
+}
+/**
+ * Strip a single leading "./" or "/" and any trailing slashes, using linear string
+ * ops rather than regex. The previous `/\/+$/` trailing-slash regex was flagged by
+ * CodeQL as a polynomial ReDoS (the `$` anchor makes the greedy `\/+` retry from every
+ * start position → quadratic on a long run of slashes); plain slicing is O(n) and safe.
+ */
+function normalizePathFragment(p) {
+    let start = 0;
+    if (p.startsWith('./'))
+        start = 2;
+    else if (p.startsWith('/'))
+        start = 1;
+    let end = p.length;
+    while (end > start && p[end - 1] === '/')
+        end--;
+    return p.slice(start, end);
+}
+/**
+ * Convert `.aiignore` patterns (relative, .gitignore-ish) into deepagents deny rules.
+ *
+ * deepagents matches the path argument the model passes to a fs tool — resolved by the
+ * backend — against ABSOLUTE globs. With `virtualMode` the backend treats paths as
+ * virtual-absolute under `rootDir`, so we anchor at "/".
+ *
+ * A bare pattern (`*.env`, `secret.txt`) should match at any depth, so we emit both a
+ * top-level (`/secret.txt`) and a recursive (`/**/secret.txt`) rule. A pattern already
+ * containing "/" (`config/secrets.json`) is anchored as-is (plus a `/**` subtree rule).
+ *
+ * `base` defaults to "" so paths are anchored at the virtual root "/". When the sandbox is
+ * widened (`--allow-dir`, no virtualMode) the backend uses REAL absolute paths, so the caller
+ * passes the absolute cwd as `base` to anchor these deny rules there.
+ */
+export function aiignoreToPermissions(patterns, base = '') {
+    const rules = [];
+    for (const raw of patterns) {
+        const clean = normalizePathFragment(raw);
+        if (clean.length === 0)
+            continue;
+        const paths = clean.includes('/')
+            ? [`${base}/${clean}`, `${base}/${clean}/**`]
+            : [`${base}/${clean}`, `${base}/**/${clean}`];
+        rules.push({ operations: ['read', 'write'], paths, mode: 'deny' });
+    }
+    return rules;
+}
+/** Map gsloth's filesystem mode onto deepagents permission rules. */
+export function filesystemModeToPermissions(fs) {
+    if (fs === 'all')
+        return [];
+    if (fs === 'read')
+        return [{ operations: ['write'], paths: ['/**'], mode: 'deny' }];
+    if (fs === 'none')
+        return [{ operations: ['read', 'write'], paths: ['/**'], mode: 'deny' }];
+    // string[] — explicit allow-list of directories. Allow read+write within each,
+    // deny everything else. Allow rules first (first-match-wins), deny catch-all last.
+    const allow = fs
+        .filter((d) => d !== 'all' && d !== 'read')
+        .map((d) => {
+        const dir = `/${normalizePathFragment(d)}`;
+        return { operations: ['read', 'write'], paths: [`${dir}/**`, dir], mode: 'allow' };
+    });
+    return [...allow, { operations: ['read', 'write'], paths: ['/**'], mode: 'deny' }];
+}
+/**
+ * Compose the full permission list. `.aiignore` deny rules go FIRST so they win over
+ * any allow rule (first-match-wins). Then the filesystem-mode rules. `.aiignore` is
+ * skipped when explicitly disabled (`aiignore.enabled === false`) or has no patterns.
+ */
+export function buildPermissions(config) {
+    const widen = Array.isArray(config.allowDirs) && config.allowDirs.length > 0;
+    const aiignoreEnabled = config.aiignore?.enabled !== false && !!config.aiignore?.patterns?.length;
+    // When widening, the backend uses real absolute paths — anchor aiignore deny rules at the
+    // absolute cwd so they keep matching project-relative ignore patterns.
+    const aiignore = aiignoreEnabled
+        ? aiignoreToPermissions(config.aiignore.patterns, widen ? getCurrentWorkDir() : '')
+        : [];
+    // `--allow-dir` replaces the filesystem-mode rules with the cwd + allowed-dirs allow-list,
+    // since the model now sees real absolute paths rather than virtual ones.
+    const modeRules = widen
+        ? allowDirsToPermissions(config.allowDirs)
+        : filesystemModeToPermissions(config.filesystem);
+    return [...aiignore, ...modeRules];
+}
+//# sourceMappingURL=deepAgentPermissions.js.map

package/dist/core/deepAgentPermissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deepAgentPermissions.js","sourceRoot":"","sources":["../../src/core/deepAgentPermissions.ts"],"names":[],"mappings":"AACA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAI3E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,IAAI;IACJ,WAAW;IACX,YAAY;IACZ,WAAW;IACX,MAAM;IACN,MAAM;IACN,SAAS;CACD,CAAC;AAcX;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAmB;IACxD,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,qEAAqE;IACrE,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/C,MAAM,KAAK,GAA2B,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/D,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QAC7B,KAAK,EAAE,CAAC,GAAG,IAAI,KAAK,EAAE,IAAI,CAAC;QAC3B,IAAI,EAAE,OAAO;KACd,CAAC,CAAC,CAAC;IACJ,OAAO,CAAC,GAAG,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AACrF,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,CAAS;IACtC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,KAAK,GAAG,CAAC,CAAC;SAC7B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,KAAK,GAAG,CAAC,CAAC;IACtC,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,OAAO,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,GAAG,EAAE,CAAC;IAChD,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAkB,EAAE,IAAI,GAAG,EAAE;IACjE,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC/B,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,KAAK,CAAC;YAC7C,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,GAAG,IAAI,OAAO,KAAK,EAAE,CAAC,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,2BAA2B,CACzC,EAAsC;IAEtC,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAC5B,IAAI,EAAE,KAAK,MAAM;QAAE,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACpF,IAAI,EAAE,KAAK,MAAM;QAAE,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5F,+EAA+E;IAC/E,mFAAmF;IACnF,MAAM,KAAK,GAA2B,EAAE;SACrC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,MAAM,CAAC;SAC1C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,GAAG,GAAG,IAAI,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,GAAG,KAAK,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACrF,CAAC,CAAC,CAAC;IACL,OAAO,CAAC,GAAG,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AACrF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAA6B;IAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7E,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,EAAE,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;IAClG,0FAA0F;IAC1F,uEAAuE;IACvE,MAAM,QAAQ,GAAG,eAAe;QAC9B,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,QAAS,CAAC,QAAS,EAAE,KAAK,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,CAAC,CAAC,EAAE,CAAC;IACP,2FAA2F;IAC3F,yEAAyE;IACzE,MAAM,SAAS,GAAG,KAAK;QACrB,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,SAAU,CAAC;QAC3C,CAAC,CAAC,2BAA2B,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,SAAS,CAAC,CAAC;AACrC,CAAC"}