@gaunt-sloth/agent 2.0.0-alpha.2 → 2.0.0-alpha.21

package/dist/tools/gthChecklistTool.js

@@ -0,0 +1,81 @@
+/**
+ * @module gthChecklistTool
+ * The `gth_checklist` planning tool — the lean agent's first-party equivalent of the deepagents
+ * `write_todos` capability. Gives the model a durable, structured task list for multi-step work so
+ * it can plan, track progress, and stay oriented across a long run.
+ *
+ * Design (mirrors Claude Code's `TodoWrite` / opencode's todo tools): the model sends the WHOLE
+ * list every call and it REPLACES the previous one (no incremental add/remove verbs to keep in
+ * sync). State is a closure private to each `get()` result, i.e. one list per agent init / session,
+ * so concurrent sessions (e.g. the AG-UI server) never share a checklist. The tool returns a
+ * rendered markdown checklist as its observation; the TUI additionally folds it into a live
+ * checkbox panel (see {@link file://../../../app/src/tui/viewModel.ts} `CHECKLIST_TOOL_NAME`).
+ *
+ * The name is deliberately NOT `write_todos` (nor `task`/`read_file`/`write_file`/`edit_file`/`ls`):
+ * on the experimental deep backend `createDeepAgent` throws on a name collision with its built-ins,
+ * and both backends share the same resolved toolset.
+ */
+import { tool } from '@langchain/core/tools';
+import { z } from 'zod';
+export const CHECKLIST_TOOL_NAME = 'gth_checklist';
+const itemSchema = z.object({
+    content: z
+        .string()
+        .min(1)
+        .describe('Short, imperative description of the task, e.g. "Add tests"'),
+    status: z
+        .enum(['pending', 'in_progress', 'completed'])
+        .describe('pending = not started, in_progress = being worked on now, completed = finished'),
+});
+const schema = z.object({
+    items: z
+        .array(itemSchema)
+        .describe('The FULL checklist. This replaces any previous checklist entirely.'),
+});
+const description = [
+    'Record and update a checklist (todo list) for the current task. Use it to plan multi-step',
+    'work and to show the user your progress. Send the ENTIRE list every time — it replaces the',
+    'previous checklist, so include already-completed items too.',
+    '',
+    'When to use: any task with 3+ distinct steps, or when the user gives several requirements.',
+    'Skip it for a single trivial step.',
+    '',
+    'Rules:',
+    '- Keep at most ONE item "in_progress" at a time.',
+    '- Mark an item "completed" as soon as it is done — do not batch completions.',
+    '- Keep item text short and outcome-focused.',
+].join('\n');
+const STATUS_GLYPH = {
+    completed: '[x]',
+    in_progress: '[~]',
+    pending: '[ ]',
+};
+/** Render a checklist as a markdown observation the model (and a plain terminal) can read back. */
+export function formatChecklist(items) {
+    if (items.length === 0) {
+        return 'Checklist cleared (no items).';
+    }
+    const completed = items.filter((i) => i.status === 'completed').length;
+    const header = `Checklist (${completed}/${items.length} completed):`;
+    const lines = items.map((i) => `${STATUS_GLYPH[i.status]} ${i.content}`);
+    return [header, ...lines].join('\n');
+}
+export function get(_config) {
+    // Session-scoped state: one list per tool instance (== per agent init). Whole-list-replace
+    // semantics mean each call overwrites this; it is kept so the tool can render the current
+    // state back as its observation.
+    let items = [];
+    const impl = async ({ items: next }) => {
+        const inProgress = next.filter((i) => i.status === 'in_progress').length;
+        if (inProgress > 1) {
+            // Do NOT mutate state on a malformed update — return guidance so the model can retry.
+            return (`Rejected: ${inProgress} items are "in_progress" but only one may be in progress at a ` +
+                'time. Set all but the current task to "pending" or "completed" and call gth_checklist ' +
+                'again.');
+        }
+        items = next;
+        return formatChecklist(items);
+    };
+    return tool(impl, { name: CHECKLIST_TOOL_NAME, description, schema });
+}
+//# sourceMappingURL=gthChecklistTool.js.map

package/dist/tools/gthChecklistTool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gthChecklistTool.js","sourceRoot":"","sources":["../../src/tools/gthChecklistTool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC;AASnD,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,6DAA6D,CAAC;IAC1E,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;SAC7C,QAAQ,CAAC,gFAAgF,CAAC;CAC9F,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACtB,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,UAAU,CAAC;SACjB,QAAQ,CAAC,oEAAoE,CAAC;CAClF,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG;IAClB,2FAA2F;IAC3F,4FAA4F;IAC5F,6DAA6D;IAC7D,EAAE;IACF,4FAA4F;IAC5F,oCAAoC;IACpC,EAAE;IACF,QAAQ;IACR,kDAAkD;IAClD,8EAA8E;IAC9E,6CAA6C;CAC9C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,YAAY,GAAoC;IACpD,SAAS,EAAE,KAAK;IAChB,WAAW,EAAE,KAAK;IAClB,OAAO,EAAE,KAAK;CACf,CAAC;AAEF,mGAAmG;AACnG,MAAM,UAAU,eAAe,CAAC,KAAsB;IACpD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,+BAA+B,CAAC;IACzC,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,MAAM,CAAC;IACvE,MAAM,MAAM,GAAG,cAAc,SAAS,IAAI,KAAK,CAAC,MAAM,cAAc,CAAC;IACrE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACzE,OAAO,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,OAAkB;IACpC,2FAA2F;IAC3F,0FAA0F;IAC1F,iCAAiC;IACjC,IAAI,KAAK,GAAoB,EAAE,CAAC;IAEhC,MAAM,IAAI,GAAG,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAA0B,EAAmB,EAAE;QAC9E,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,MAAM,CAAC;QACzE,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACnB,sFAAsF;YACtF,OAAO,CACL,aAAa,UAAU,gEAAgE;gBACvF,wFAAwF;gBACxF,QAAQ,CACT,CAAC;QACJ,CAAC;QACD,KAAK,GAAG,IAAI,CAAC;QACb,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC;IAEF,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;AACxE,CAAC"}

package/dist/tools/gthGrepTool.d.ts

@@ -0,0 +1,54 @@
+import { z } from 'zod';
+import { GthConfig } from '@gaunt-sloth/core/config.js';
+export declare const GREP_TOOL_NAME = "gth_grep";
+/**
+ * GS2-51 — which corpus `gth_grep` scans, applied consistently to BOTH engines:
+ * - `gitignore` (default): respect `.gitignore`/`.ignore` and skip hidden dot-files (rg's default);
+ * - `all`: scan everything but the {@link IGNORED_DIRS} noise set (rg gets `--no-ignore --hidden`).
+ */
+export type GrepFileSet = 'gitignore' | 'all';
+/**
+ * Resolve the effective {@link GrepFileSet} from config. Reads the `gth_grep` entry of the SAME
+ * `builtInTools` registry that {@link file://../builtInToolsConfig.ts} uses to decide enablement, so
+ * the corpus selection and the tool's presence resolve from one source. Defaults to `gitignore`
+ * (the coordinator-set default, and already rg's native default — so rg-present machines see no
+ * behaviour change; only the selection becomes explicit).
+ */
+export declare function resolveGrepFileSet(config: GthConfig): GrepFileSet;
+/** A single content match. `path` is relative to the search root; `line` is 1-based. */
+export interface GrepMatch {
+    path: string;
+    line: number;
+    /** The matching line's text, untruncated (bounded at format time). */
+    text: string;
+}
+/**
+ * Render matches in the concise, opencode-style grouped form. Shared by BOTH execution paths so
+ * the rg and JS-fallback outputs are provably identical.
+ */
+export declare function formatGrepOutput(matches: GrepMatch[]): string;
+/**
+ * Compile an include glob (matched against a file's basename in the JS fallback) to a RegExp.
+ * Supports `*`, `?`, and `{a,b,c}` brace alternation, e.g. `*.ts`, `*.{ts,tsx}`.
+ *
+ * NOTE (rg-vs-JS divergence): this matches the basename only, whereas rg applies `--glob` with full
+ * gitignore-style path-glob semantics (a glob can match against the path, not just the basename).
+ * For the common `*.ext` case the two agree; more elaborate globs may differ between the two paths.
+ */
+export declare function globToRegExp(glob: string): RegExp;
+export declare function get(config: GthConfig): import("@langchain/core/tools").DynamicStructuredTool<z.ZodObject<{
+    pattern: z.ZodString;
+    path: z.ZodOptional<z.ZodString>;
+    include: z.ZodOptional<z.ZodString>;
+    limit: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>, {
+    pattern: string;
+    path?: string | undefined;
+    include?: string | undefined;
+    limit?: number | undefined;
+}, {
+    pattern: string;
+    path?: string | undefined;
+    include?: string | undefined;
+    limit?: number | undefined;
+}, string, unknown, "gth_grep">;

package/dist/tools/gthGrepTool.js

@@ -0,0 +1,482 @@
+/**
+ * @module gthGrepTool
+ * The `gth_grep` content-search tool — a structured, permission-light regex search over file
+ * CONTENTS. Complements `search_files` (which only matches file NAMES) and gives the lean agent a
+ * grep primitive without falling back to the shell-approval-gated `run_shell_command`. Being a
+ * built-in (not a dev tool) it is available in every mode, unlike `run_shell_command`.
+ *
+ * Two execution paths, ONE output shape:
+ *  - shell out to ripgrep (`rg`) when it is on PATH;
+ *  - fall back to an in-process JS scanner when `rg` is absent (CI machines may not have ripgrep).
+ * Both sandbox to the current work-dir boundary ({@link getCurrentWorkDir}), bound each matching
+ * line's preview, cap the total match count, and enforce the `.aiignore` privacy boundary on BOTH
+ * engines ({@link makeAiignoreFilter}) — since the tool reads file contents through its own path, it
+ * must honour `.aiignore` itself rather than rely on the filesystem toolkit.
+ *
+ * Named `gth_grep`, NOT `grep`: the experimental deep backend (deepagents) registers its own `grep`
+ * built-in and `createDeepAgent` throws on a name collision because both backends share the resolved
+ * toolset — the same reason {@link file://./gthChecklistTool.ts} is not called `write_todos`.
+ */
+import { tool } from '@langchain/core/tools';
+import { z } from 'zod';
+import { execFile } from 'node:child_process';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { normalizeBuiltInTools } from '@gaunt-sloth/core/config.js';
+import { getCurrentWorkDir } from '@gaunt-sloth/core/utils/systemUtils.js';
+import { shouldIgnoreFile } from '@gaunt-sloth/core/utils/aiignoreUtils.js';
+export const GREP_TOOL_NAME = 'gth_grep';
+/**
+ * Resolve the effective {@link GrepFileSet} from config. Reads the `gth_grep` entry of the SAME
+ * `builtInTools` registry that {@link file://../builtInToolsConfig.ts} uses to decide enablement, so
+ * the corpus selection and the tool's presence resolve from one source. Defaults to `gitignore`
+ * (the coordinator-set default, and already rg's native default — so rg-present machines see no
+ * behaviour change; only the selection becomes explicit).
+ */
+export function resolveGrepFileSet(config) {
+    const entry = normalizeBuiltInTools(config?.builtInTools)[GREP_TOOL_NAME];
+    if (entry && typeof entry === 'object' && entry.fileSet === 'all')
+        return 'all';
+    return 'gitignore';
+}
+/**
+ * Build the `.aiignore` privacy filter for a grep run.
+ *
+ * SECURITY (GS2-51): `gth_grep` reads file CONTENTS through its OWN ripgrep / `fs.readFile` path,
+ * so — unlike the gsloth filesystem toolkit — it must enforce `.aiignore` ITSELF. Otherwise, being
+ * on by default, it would be a default-on bypass of that boundary on BOTH backends: the deep backend
+ * deliberately disables its fs toolkit precisely so a model cannot read an `.aiignore`-protected file
+ * (see {@link file://../core/GthDeepAgent.ts}), and `gth_grep` would re-open exactly that hole.
+ * `.gitignore` means "don't commit" (build junk); `.aiignore` means "don't let the AI read this,
+ * even though it is a real tracked file" — so an `.aiignore`'d-but-tracked-and-not-hidden file is the
+ * PRIMARY case, and is enforced on BOTH engines and under BOTH {@link GrepFileSet} corpora (the
+ * privacy boundary is orthogonal to the gitignore/all selection).
+ *
+ * Reuses the SAME {@link shouldIgnoreFile} matcher and the SAME rootDir (the work-dir) the fs toolkit
+ * uses, so a file is treated identically here as there — no hand-rolled `.aiignore` parsing.
+ *
+ * @returns predicate that is TRUE when `absPath` is ALLOWED (not aiignored).
+ */
+function makeAiignoreFilter(workDir, aiignore) {
+    return (absPath) => !shouldIgnoreFile(absPath, workDir, aiignore?.patterns, aiignore?.enabled);
+}
+/** Default cap on the number of matches returned when the caller does not pass `limit`. */
+const DEFAULT_LIMIT = 100;
+/** Noise directories both paths skip: the JS fallback walk, and rg via `--glob !<dir>` excludes. */
+const IGNORED_DIRS = new Set(['.git', 'node_modules', 'dist', '.idea']);
+/** Longest matching-line preview kept before truncation, so one minified line can't blow context. */
+const MAX_LINE_LENGTH = 250;
+const TRUNCATION_MARKER = ' … (line truncated)';
+/**
+ * JS-fallback only: cap the length of text fed to the regex per line. A single huge/minified line
+ * would otherwise let a model-supplied pattern block the event loop (large linear scans, and
+ * catastrophic backtracking grows with input length). rg (native, non-backtracking) is immune, so
+ * this bounds the fallback only. Matches beyond the cap on such a line are not found.
+ */
+const MAX_SCAN_LINE_LENGTH = 4096;
+/** Ceiling on rg stdout we buffer (matches are sliced to `limit` anyway). */
+const RG_MAX_BUFFER = 32 * 1024 * 1024;
+const schema = z.object({
+    pattern: z.string().min(1).describe('Regular expression to search file CONTENTS for.'),
+    path: z
+        .string()
+        .optional()
+        .describe('Relative directory or file to search, within the working directory. Defaults to the ' +
+        'current working directory.'),
+    include: z
+        .string()
+        .optional()
+        .describe('Optional file glob to filter matched files, e.g. "*.ts" or "*.{ts,tsx}".'),
+    limit: z
+        .number()
+        .int()
+        .min(1)
+        .optional()
+        .describe(`Maximum number of matches to return (default ${DEFAULT_LIMIT}).`),
+});
+const description = [
+    'Search file CONTENTS by regular expression (ripgrep-backed, with an in-process fallback).',
+    'Use this to find WHERE a symbol, string, or pattern appears across files — unlike search_files,',
+    'which matches file NAMES only. Returns matching files with 1-based line numbers and a bounded',
+    'preview of each matching line.',
+    '',
+    'Args: pattern (regex, required); path (relative dir/file, defaults to the working directory);',
+    'include (file glob such as "*.ts" or "*.{ts,tsx}"); limit (max matches). Searches are confined',
+    'to the working directory.',
+].join('\n');
+/** Error whose message is safe to return to the model as the tool observation. */
+class GrepError extends Error {
+}
+/** Sentinel: `rg` is not installed — the orchestrator must use the JS fallback. */
+class RipgrepUnavailableError extends Error {
+}
+/** Truncate an over-long matching-line preview with a clear marker. */
+function truncateLine(text) {
+    if (text.length <= MAX_LINE_LENGTH)
+        return text;
+    return text.slice(0, MAX_LINE_LENGTH) + TRUNCATION_MARKER;
+}
+/**
+ * Render matches in the concise, opencode-style grouped form. Shared by BOTH execution paths so
+ * the rg and JS-fallback outputs are provably identical.
+ */
+export function formatGrepOutput(matches) {
+    if (matches.length === 0)
+        return 'No matches found';
+    const lines = [`Found ${matches.length} matches`];
+    let currentPath = '';
+    for (const m of matches) {
+        if (m.path !== currentPath) {
+            if (currentPath)
+                lines.push('');
+            currentPath = m.path;
+            lines.push(`${m.path}:`);
+        }
+        lines.push(`  Line ${m.line}: ${truncateLine(m.text)}`);
+    }
+    return lines.join('\n');
+}
+/** rg prints `./foo` for the cwd root; normalise to bare relative paths to match the JS scanner. */
+function normalizeRelPath(p) {
+    return p.startsWith('./') ? p.slice(2) : p;
+}
+/** Escape the literal parts of a glob for use inside a RegExp. */
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Compile an include glob (matched against a file's basename in the JS fallback) to a RegExp.
+ * Supports `*`, `?`, and `{a,b,c}` brace alternation, e.g. `*.ts`, `*.{ts,tsx}`.
+ *
+ * NOTE (rg-vs-JS divergence): this matches the basename only, whereas rg applies `--glob` with full
+ * gitignore-style path-glob semantics (a glob can match against the path, not just the basename).
+ * For the common `*.ext` case the two agree; more elaborate globs may differ between the two paths.
+ */
+export function globToRegExp(glob) {
+    let re = '';
+    let i = 0;
+    while (i < glob.length) {
+        const c = glob[i];
+        if (c === '*') {
+            re += '[^/]*';
+        }
+        else if (c === '?') {
+            re += '[^/]';
+        }
+        else if (c === '{') {
+            const end = glob.indexOf('}', i);
+            if (end === -1) {
+                re += '\\{';
+            }
+            else {
+                const options = glob
+                    .slice(i + 1, end)
+                    .split(',')
+                    .map(escapeRegExp);
+                re += '(?:' + options.join('|') + ')';
+                i = end + 1;
+                continue;
+            }
+        }
+        else {
+            re += escapeRegExp(c);
+        }
+        i++;
+    }
+    return new RegExp('^' + re + '$');
+}
+/**
+ * Resolve a path to its real, symlink-free location, walking up to the nearest EXISTING ancestor
+ * when the path itself does not exist yet. Only an existing component can be (or sit behind) a
+ * symlink, so resolving the nearest real ancestor is enough to catch an intermediate symlinked
+ * directory. Terminates because `path.dirname` strictly shortens the path to the filesystem root.
+ */
+async function realpathNearestExisting(absPath) {
+    let current = absPath;
+    for (;;) {
+        try {
+            return await fs.realpath(current);
+        }
+        catch {
+            const parent = path.dirname(current);
+            if (parent === current)
+                return current; // filesystem root; nothing left to resolve
+            current = parent;
+        }
+    }
+}
+/** True when `child` equals `root` or is a descendant of it. */
+function isWithin(child, root) {
+    return child === root || child.startsWith(`${root}${path.sep}`);
+}
+/**
+ * Resolve `path` under the working directory and refuse anything that escapes it. The whole tool
+ * is sandboxed to this boundary.
+ */
+async function resolveTarget(inputPath, workDir) {
+    const absWorkDir = path.resolve(workDir);
+    const requested = path.resolve(absWorkDir, inputPath ?? '.');
+    const rel = path.relative(absWorkDir, requested);
+    if (rel.startsWith('..') || path.isAbsolute(rel)) {
+        throw new GrepError(`Refusing to search '${inputPath}': path escapes the working directory (${absWorkDir}).`);
+    }
+    // Symlink containment: the lexical check above cannot catch a symlink INSIDE the workdir that
+    // points outside it (rel would not start with `..`, and stat/rg/the walk would then follow it out
+    // of the sandbox). Resolve real paths and re-assert containment. The workdir root is realpath'd
+    // too, since its own path may contain symlinks (e.g. /tmp -> /private/tmp). A not-yet-existing
+    // target resolves via its nearest existing ancestor, so a missing path is contained here and then
+    // reported as "not found" by the stat below, rather than crashing.
+    const realRoot = await realpathNearestExisting(absWorkDir);
+    const realTarget = await realpathNearestExisting(requested);
+    if (!isWithin(realTarget, realRoot)) {
+        throw new GrepError(`Refusing to search '${inputPath}': path escapes the working directory (${absWorkDir}).`);
+    }
+    let stat;
+    try {
+        stat = await fs.stat(requested);
+    }
+    catch {
+        throw new GrepError(`Path not found: ${inputPath ?? '.'}`);
+    }
+    if (stat.isDirectory()) {
+        return { searchRoot: requested };
+    }
+    return { searchRoot: path.dirname(requested), file: path.basename(requested) };
+}
+/** Parse ripgrep's `path:line:text` output (with `--with-filename --line-number --no-heading`). */
+function parseRipgrepOutput(stdout) {
+    const matches = [];
+    for (const raw of stdout.split('\n')) {
+        if (!raw)
+            continue;
+        const first = raw.indexOf(':');
+        if (first < 0)
+            continue;
+        const second = raw.indexOf(':', first + 1);
+        if (second < 0)
+            continue;
+        const lineNum = Number(raw.slice(first + 1, second));
+        if (!Number.isInteger(lineNum))
+            continue;
+        matches.push({
+            path: normalizeRelPath(raw.slice(0, first)),
+            line: lineNum,
+            text: raw.slice(second + 1),
+        });
+    }
+    return matches;
+}
+function buildRipgrepArgs(pattern, target, include, fileSet) {
+    // GS2-51 — the searched corpus is a resolved config choice ({@link GrepFileSet}), applied
+    // consistently to both engines. `gitignore` (default) keeps rg's native behaviour: honour
+    // `.gitignore`/`.ignore` and skip hidden dot-files — so nothing is added here. `all` scans
+    // everything but the noise dirs, so pass `--no-ignore --hidden` (the IGNORED_DIRS excludes below
+    // still apply). NOTE (residual rg-vs-JS divergence): under `gitignore` the JS fallback
+    // ({@link collectFiles}) is only a best-effort approximation (skips IGNORED_DIRS + hidden
+    // dot-files); it does NOT read arbitrary `.gitignore` rules the way rg does, so the searched
+    // file-set can still differ when rg is absent. A full gitignore parser is deliberately out of
+    // scope — see the note on {@link collectFiles}.
+    const args = ['--line-number', '--no-heading', '--with-filename', '--color=never'];
+    if (fileSet === 'all') {
+        args.push('--no-ignore', '--hidden');
+    }
+    // Exclude the same noise dirs the JS fallback skips, so the two paths stay consistent. rg only
+    // auto-skips node_modules etc. when a .gitignore says so; outside a git repo (or under
+    // `--no-ignore`) it descends into them, so we exclude them explicitly here.
+    for (const dir of IGNORED_DIRS) {
+        args.push('--glob', `!${dir}`);
+    }
+    if (include) {
+        args.push('--glob', include);
+    }
+    args.push('-e', pattern, '--', target.file ?? '.');
+    return args;
+}
+/**
+ * Run ripgrep. Resolves to matches (empty on rg exit 1 = "no matches"). Rejects with
+ * {@link RipgrepUnavailableError} when `rg` is not on PATH, or {@link GrepError} on a real rg error
+ * (e.g. an invalid regex → rg exit 2).
+ */
+function runRipgrep(pattern, target, include, fileSet, isAllowed) {
+    const args = buildRipgrepArgs(pattern, target, include, fileSet);
+    return new Promise((resolve, reject) => {
+        execFile('rg', args, { cwd: target.searchRoot, maxBuffer: RG_MAX_BUFFER }, (error, stdout, stderr) => {
+            if (error) {
+                const code = error
+                    .code;
+                if (code === 'ENOENT') {
+                    reject(new RipgrepUnavailableError('ripgrep (rg) not found on PATH'));
+                    return;
+                }
+                // rg exit code 1 == no matches (execFile surfaces the non-zero exit as an error).
+                if (code === 1) {
+                    resolve([]);
+                    return;
+                }
+                const detail = (stderr ?? '').toString().trim();
+                reject(new GrepError(`Search failed: ${detail || error.message}`));
+                return;
+            }
+            // rg does not consult `.aiignore` — post-filter its matched paths through the SAME hook the
+            // JS fallback uses, so both engines enforce the privacy boundary identically. A match whose
+            // file is aiignored is dropped before it can reach the model.
+            resolve(parseRipgrepOutput(stdout.toString()).filter((m) => isAllowed(path.join(target.searchRoot, m.path))));
+        });
+    });
+}
+/**
+ * Recursively collect regular files under `dir`, skipping {@link IGNORED_DIRS}. Symlinked entries
+ * (dirs and files) report `isDirectory()`/`isFile()` as false here, so the walk never follows them
+ * out of the sandbox — only the explicit target path needs the realpath guard in {@link resolveTarget}.
+ *
+ * GS2-51 — corpus selection ({@link GrepFileSet}), applied consistently with the rg path:
+ * - `skipHidden` true (the `gitignore` default): additionally skip hidden dot-files/dirs, moving the
+ *   fallback CLOSER to rg's default of honouring `.gitignore` + hiding dot-files;
+ * - `skipHidden` false (`all`): skip only IGNORED_DIRS — everything-but-noise (the historical
+ *   behaviour), matching rg's `--no-ignore --hidden`.
+ *
+ * NOTE (residual rg-vs-JS divergence — deliberate, bounded scope): even under `gitignore` this is
+ * only a best-effort approximation. It does NOT parse arbitrary `.gitignore`/`.ignore` rules the way
+ * rg does — a file gitignored by a custom pattern (but not a dot-file and not under IGNORED_DIRS) is
+ * still searched by the fallback though rg would skip it. Implementing a full gitignore engine here
+ * is out of scope; this is documented, not fixed — exactly like the regex-dialect divergence noted
+ * in {@link runJsScanner}.
+ */
+async function collectFiles(dir, out, skipHidden) {
+    let entries;
+    try {
+        entries = (await fs.readdir(dir, { withFileTypes: true }));
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        // Hidden-skip is checked first so it covers BOTH hidden files and hidden dirs.
+        if (skipHidden && entry.name.startsWith('.'))
+            continue;
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            if (IGNORED_DIRS.has(entry.name))
+                continue;
+            await collectFiles(full, out, skipHidden);
+        }
+        else if (entry.isFile()) {
+            out.push(full);
+        }
+    }
+}
+/**
+ * In-process fallback used when `rg` is absent: walk files under the target (respecting `include`
+ * and the ignore list) and apply the regex per line. Produces the identical {@link GrepMatch} shape
+ * as the ripgrep path.
+ */
+async function runJsScanner(pattern, target, include, limit, fileSet, isAllowed) {
+    let regex;
+    try {
+        // NOTE (rg-vs-JS divergence): the fallback uses the ECMAScript regex dialect (`new RegExp`),
+        // whereas rg uses the Rust `regex` crate. Host-specific features differ — notably lookaround
+        // and backreferences work here but are unsupported by rg — so the same pattern can behave
+        // differently depending on which path runs.
+        regex = new RegExp(pattern);
+    }
+    catch (e) {
+        throw new GrepError(`Search failed: invalid regular expression: ${e.message}`);
+    }
+    const includeRe = include ? globToRegExp(include) : undefined;
+    const files = [];
+    if (target.file) {
+        // An explicitly-named target file is searched even if it is a hidden dot-file — the corpus
+        // selection only governs directory discovery, matching rg's behaviour on an explicit arg. The
+        // one exception is `.aiignore`: an aiignored file named by hand is still blocked below (hidden ≠
+        // aiignored), so naming the file cannot be used as a bypass.
+        files.push(path.join(target.searchRoot, target.file));
+    }
+    else {
+        await collectFiles(target.searchRoot, files, fileSet === 'gitignore');
+    }
+    const matches = [];
+    for (const file of files) {
+        if (matches.length >= limit)
+            break;
+        if (includeRe && !includeRe.test(path.basename(file)))
+            continue;
+        // `.aiignore` privacy boundary (GS2-51): skip BEFORE reading, so an aiignored file's contents
+        // are never even loaded — covers both the walk and an explicitly-named single-file target.
+        if (!isAllowed(file))
+            continue;
+        let content;
+        try {
+            content = await fs.readFile(file, 'utf8');
+        }
+        catch {
+            continue; // unreadable / non-text; skip
+        }
+        const rel = normalizeRelPath(path.relative(target.searchRoot, file));
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+            if (matches.length >= limit)
+                break;
+            const line = lines[i];
+            // Bound the regex input per line (see MAX_SCAN_LINE_LENGTH): a huge/minified line must not
+            // block the event loop. We test a truncated view but store the original line (its preview is
+            // bounded again at format time); a match beyond the cap on such a line is not reported.
+            const scanText = line.length > MAX_SCAN_LINE_LENGTH ? line.slice(0, MAX_SCAN_LINE_LENGTH) : line;
+            if (regex.test(scanText)) {
+                matches.push({ path: rel, line: i + 1, text: line });
+            }
+        }
+    }
+    return matches;
+}
+async function grepImpl(args, workDir, fileSet, aiignore) {
+    const limit = args.limit ?? DEFAULT_LIMIT;
+    let target;
+    try {
+        target = await resolveTarget(args.path, workDir);
+    }
+    catch (e) {
+        if (e instanceof GrepError)
+            return e.message;
+        throw e;
+    }
+    // The `.aiignore` privacy filter is resolved against the work-dir root (matching the fs toolkit)
+    // and enforced on whichever engine runs — see makeAiignoreFilter.
+    const isAllowed = makeAiignoreFilter(workDir, aiignore);
+    let matches;
+    try {
+        matches = await runRipgrep(args.pattern, target, args.include, fileSet, isAllowed);
+    }
+    catch (e) {
+        if (e instanceof RipgrepUnavailableError) {
+            try {
+                matches = await runJsScanner(args.pattern, target, args.include, limit, fileSet, isAllowed);
+            }
+            catch (inner) {
+                if (inner instanceof GrepError)
+                    return inner.message;
+                throw inner;
+            }
+        }
+        else if (e instanceof GrepError) {
+            return e.message;
+        }
+        else {
+            throw e;
+        }
+    }
+    // ripgrep has no total-match cap of its own; bound the count here so both paths agree.
+    if (matches.length > limit)
+        matches = matches.slice(0, limit);
+    return formatGrepOutput(matches);
+}
+export function get(config) {
+    // Resolve the corpus selection once at tool-construction time from the same config that decided
+    // this tool is enabled (GS2-51); the searched file-set is a config choice, not a per-call arg.
+    const fileSet = resolveGrepFileSet(config);
+    // The `.aiignore` privacy boundary (GS2-51) is read from the SAME config the fs toolkit reads it
+    // from, so gth_grep enforces it identically — see makeAiignoreFilter.
+    const aiignore = config?.aiignore;
+    const impl = async (args) => grepImpl(args, getCurrentWorkDir(), fileSet, aiignore);
+    return tool(impl, { name: GREP_TOOL_NAME, description, schema });
+}
+//# sourceMappingURL=gthGrepTool.js.map

package/dist/tools/gthGrepTool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gthGrepTool.js","sourceRoot":"","sources":["../../src/tools/gthGrepTool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAElC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAa,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAE5E,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC;AASzC;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAiB;IAClD,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,cAAc,CAAC,CAAC;IAC1E,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAChF,OAAO,WAAW,CAAC;AACrB,CAAC;AAKD;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,kBAAkB,CAAC,OAAe,EAAE,QAA+B;IAC1E,OAAO,CAAC,OAAe,EAAW,EAAE,CAClC,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC/E,CAAC;AAED,2FAA2F;AAC3F,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,oGAAoG;AACpG,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AACxE,qGAAqG;AACrG,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AAChD;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAClC,6EAA6E;AAC7E,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAUvC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iDAAiD,CAAC;IACtF,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,sFAAsF;QACpF,4BAA4B,CAC/B;IACH,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,0EAA0E,CAAC;IACvF,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CAAC,gDAAgD,aAAa,IAAI,CAAC;CAC/E,CAAC,CAAC;AAIH,MAAM,WAAW,GAAG;IAClB,2FAA2F;IAC3F,iGAAiG;IACjG,+FAA+F;IAC/F,gCAAgC;IAChC,EAAE;IACF,+FAA+F;IAC/F,gGAAgG;IAChG,2BAA2B;CAC5B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,kFAAkF;AAClF,MAAM,SAAU,SAAQ,KAAK;CAAG;AAChC,mFAAmF;AACnF,MAAM,uBAAwB,SAAQ,KAAK;CAAG;AAE9C,uEAAuE;AACvE,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,IAAI,CAAC,MAAM,IAAI,eAAe;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,GAAG,iBAAiB,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAoB;IACnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,kBAAkB,CAAC;IACpD,MAAM,KAAK,GAAa,CAAC,SAAS,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC;IAC5D,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC3B,IAAI,WAAW;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChC,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,oGAAoG;AACpG,SAAS,gBAAgB,CAAC,CAAS;IACjC,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,kEAAkE;AAClE,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,EAAE,IAAI,OAAO,CAAC;QAChB,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,EAAE,IAAI,MAAM,CAAC;QACf,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACjC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,EAAE,IAAI,KAAK,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GAAG,IAAI;qBACjB,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC;qBACjB,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,YAAY,CAAC,CAAC;gBACrB,EAAE,IAAI,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;gBACtC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;gBACZ,SAAS;YACX,CAAC;QACH,CAAC;aAAM,CAAC;YACN,EAAE,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,GAAG,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC;AACpC,CAAC;AASD;;;;;GAKG;AACH,KAAK,UAAU,uBAAuB,CAAC,OAAe;IACpD,IAAI,OAAO,GAAG,OAAO,CAAC;IACtB,SAAS,CAAC;QACR,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,MAAM,KAAK,OAAO;gBAAE,OAAO,OAAO,CAAC,CAAC,2CAA2C;YACnF,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;IACH,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,SAAS,QAAQ,CAAC,KAAa,EAAE,IAAY;IAC3C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,aAAa,CAC1B,SAA6B,EAC7B,OAAe;IAEf,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,IAAI,GAAG,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACjD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,SAAS,CACjB,uBAAuB,SAAS,0CAA0C,UAAU,IAAI,CACzF,CAAC;IACJ,CAAC;IACD,8FAA8F;IAC9F,kGAAkG;IAClG,gGAAgG;IAChG,+FAA+F;IAC/F,kGAAkG;IAClG,mEAAmE;IACnE,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,SAAS,CACjB,uBAAuB,SAAS,0CAA0C,UAAU,IAAI,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,mBAAmB,SAAS,IAAI,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACvB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,mGAAmG;AACnG,SAAS,kBAAkB,CAAC,MAAc;IACxC,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,GAAG,CAAC;YAAE,SAAS;QACxB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC3C,IAAI,MAAM,GAAG,CAAC;YAAE,SAAS;QACzB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;YAAE,SAAS;QACzC,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAe,EACf,MAAsB,EACtB,OAA2B,EAC3B,OAAoB;IAEpB,0FAA0F;IAC1F,0FAA0F;IAC1F,2FAA2F;IAC3F,iGAAiG;IACjG,uFAAuF;IACvF,0FAA0F;IAC1F,6FAA6F;IAC7F,8FAA8F;IAC9F,gDAAgD;IAChD,MAAM,IAAI,GAAG,CAAC,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,eAAe,CAAC,CAAC;IACnF,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACvC,CAAC;IACD,+FAA+F;IAC/F,uFAAuF;IACvF,4EAA4E;IAC5E,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CACjB,OAAe,EACf,MAAsB,EACtB,OAA2B,EAC3B,OAAoB,EACpB,SAAoB;IAEpB,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACjE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ,CACN,IAAI,EACJ,IAAI,EACJ,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,EACpD,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACxB,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,IAAI,GAAiC,KAA+C;qBACvF,IAAI,CAAC;gBACR,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtB,MAAM,CAAC,IAAI,uBAAuB,CAAC,gCAAgC,CAAC,CAAC,CAAC;oBACtE,OAAO;gBACT,CAAC;gBACD,kFAAkF;gBAClF,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBACf,OAAO,CAAC,EAAE,CAAC,CAAC;oBACZ,OAAO;gBACT,CAAC;gBACD,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;gBAChD,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBACnE,OAAO;YACT,CAAC;YACD,4FAA4F;YAC5F,4FAA4F;YAC5F,8DAA8D;YAC9D,OAAO,CACL,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACjD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAChD,CACF,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,GAAa,EAAE,UAAmB;IACzE,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAa,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,+EAA+E;QAC/E,IAAI,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC3C,MAAM,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,OAAe,EACf,MAAsB,EACtB,OAA2B,EAC3B,KAAa,EACb,OAAoB,EACpB,SAAoB;IAEpB,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,6FAA6F;QAC7F,6FAA6F;QAC7F,0FAA0F;QAC1F,4CAA4C;QAC5C,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,SAAS,CAAC,8CAA+C,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE9D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,2FAA2F;QAC3F,8FAA8F;QAC9F,iGAAiG;QACjG,6DAA6D;QAC7D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;SAAM,CAAC;QACN,MAAM,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,KAAK,WAAW,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK;YAAE,MAAM;QACnC,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAAE,SAAS;QAChE,8FAA8F;QAC9F,2FAA2F;QAC3F,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/B,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,8BAA8B;QAC1C,CAAC;QACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK;gBAAE,MAAM;YACnC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,2FAA2F;YAC3F,6FAA6F;YAC7F,wFAAwF;YACxF,MAAM,QAAQ,GACZ,IAAI,CAAC,MAAM,GAAG,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAClF,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,IAAc,EACd,OAAe,EACf,OAAoB,EACpB,QAA+B;IAE/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC;IAC1C,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,SAAS;YAAE,OAAO,CAAC,CAAC,OAAO,CAAC;QAC7C,MAAM,CAAC,CAAC;IACV,CAAC;IAED,iGAAiG;IACjG,kEAAkE;IAClE,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAExD,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,uBAAuB,EAAE,CAAC;YACzC,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;YAC9F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,SAAS;oBAAE,OAAO,KAAK,CAAC,OAAO,CAAC;gBACrD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,YAAY,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,OAAO,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,uFAAuF;IACvF,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK;QAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9D,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,MAAiB;IACnC,gGAAgG;IAChG,+FAA+F;IAC/F,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3C,iGAAiG;IACjG,sEAAsE;IACtE,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,CAAC;IAClC,MAAM,IAAI,GAAG,KAAK,EAAE,IAAc,EAAmB,EAAE,CACrD,QAAQ,CAAC,IAAI,EAAE,iBAAiB,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;AACnE,CAAC"}

package/dist/tools/shell/allowlist.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @module tools/shell/allowlist
+ *
+ * Re-export of the EXT-9 Tier-2 allow-list engine. The implementation lives in
+ * `@gaunt-sloth/core` (`core/shell/allowlist`) because the core {@link GthAgentRunner}
+ * owns the per-instance session store and the loaded persisted store and consults
+ * `matchesApproval` before prompting (core cannot import from `@gaunt-sloth/agent`).
+ *
+ * See the core module for the exact safe-bin / anti-widening matching rule.
+ */
+export { matchesApproval, hasWideningFlag, AllowlistStore, PersistedAllowlist, type ApprovalScope, type ApprovalStores, } from '@gaunt-sloth/core/core/shell/allowlist.js';