@giovannijecha/jecode 0.1.8 → 0.2.0

package/dist/openai-oauth-callback.js

@@ -0,0 +1,186 @@
+// Loopback callback used by the browser OAuth flow.
+import { timingSafeEqual } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { createServer } from "node:http";
+const CALLBACK_PORTS = [1455, 1457];
+export const OPENAI_CALLBACK_PATH = "/auth/callback";
+export async function openAICallback(state) {
+    let resolveCode = () => { };
+    let rejectCode = () => { };
+    const code = new Promise((resolve, reject) => {
+        resolveCode = resolve;
+        rejectCode = reject;
+    });
+    // A bad callback can arrive before the TUI starts awaiting `complete()`.
+    // Mark the rejection handled here while preserving it for the real waiter.
+    void code.catch(() => undefined);
+    let response;
+    let finished = false;
+    const handler = (request, outgoing) => {
+        if (finished) {
+            outgoing.writeHead(409).end("Sign-in already completed.");
+            return;
+        }
+        if (request.method !== "GET" || request.url === undefined || request.url.length > 4_096) {
+            outgoing.writeHead(400).end("Invalid sign-in callback.");
+            return;
+        }
+        const incoming = new URL(request.url, "http://localhost");
+        if (incoming.pathname !== OPENAI_CALLBACK_PATH) {
+            outgoing.writeHead(404).end("Not found.");
+            return;
+        }
+        const receivedState = incoming.searchParams.get("state");
+        // A stale browser tab or another local client can reach the fixed callback
+        // port. Reject that one request without letting it terminate this login.
+        if (!sameState(state, receivedState)) {
+            outgoing.writeHead(400, { "cache-control": "no-store" }).end("Invalid sign-in state.");
+            return;
+        }
+        finished = true;
+        response = outgoing;
+        const authError = incoming.searchParams.get("error_description") ?? incoming.searchParams.get("error");
+        const authorizationCode = incoming.searchParams.get("code");
+        if (authError !== null) {
+            rejectCode(new Error(`ChatGPT sign-in was rejected · ${authError.slice(0, 300)}`));
+        }
+        else if (authorizationCode === null || authorizationCode === "") {
+            rejectCode(new Error("ChatGPT sign-in returned no authorization code"));
+        }
+        else {
+            resolveCode(authorizationCode);
+        }
+    };
+    const listening = await firstAvailableServer(handler);
+    return {
+        port: listening.port,
+        code,
+        async respond(success) {
+            if (response === undefined || response.writableEnded)
+                return;
+            const flushed = new Promise((resolve) => {
+                response?.once("finish", resolve);
+                response?.once("close", resolve);
+            });
+            response.writeHead(success ? 200 : 400, {
+                "cache-control": "no-store",
+                connection: "close",
+                "content-security-policy": "default-src 'none'; img-src data:; style-src 'unsafe-inline'; script-src 'unsafe-inline'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
+                "content-type": "text/html; charset=utf-8",
+                "referrer-policy": "no-referrer",
+                "x-content-type-options": "nosniff",
+            });
+            response.end(resultPage(success));
+            await flushed;
+        },
+        close: () => closeServer(listening.server),
+    };
+}
+async function firstAvailableServer(handler) {
+    for (const port of CALLBACK_PORTS) {
+        const server = createServer(handler);
+        server.maxHeadersCount = 40;
+        server.headersTimeout = 5_000;
+        server.keepAliveTimeout = 500;
+        server.requestTimeout = 5_000;
+        try {
+            await listen(server, port);
+            return { server, port };
+        }
+        catch (error) {
+            await closeServer(server);
+            if (error.code !== "EADDRINUSE")
+                throw error;
+        }
+    }
+    throw new Error("ChatGPT sign-in could not open callback ports 1455 or 1457");
+}
+function listen(server, port) {
+    return new Promise((resolve, reject) => {
+        const onError = (error) => reject(error);
+        server.once("error", onError);
+        server.listen(port, "127.0.0.1", () => {
+            server.off("error", onError);
+            resolve();
+        });
+    });
+}
+function closeServer(server) {
+    return new Promise((resolve) => {
+        if (!server.listening) {
+            resolve();
+            return;
+        }
+        let settled = false;
+        let fallback;
+        const finish = () => {
+            if (settled)
+                return;
+            settled = true;
+            if (fallback !== undefined)
+                clearTimeout(fallback);
+            resolve();
+        };
+        fallback = setTimeout(() => {
+            server.closeAllConnections();
+            finish();
+        }, 500);
+        server.close(finish);
+        server.closeIdleConnections();
+    });
+}
+function resultPage(success) {
+    const title = success ? "Signed in to Jecode" : "Jecode sign-in failed";
+    const status = success ? "Authentication complete" : "Authentication stopped";
+    const detail = success
+        ? "Return to your terminal. Jecode will continue automatically."
+        : "Return to your terminal to see what stopped the connection.";
+    const state = success ? "success" : "failure";
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="color-scheme" content="dark">
+  <title>${title}</title>
+  <style>
+    :root{--night:#000;--steel:#669bd2;--steel-soft:#8db4dd;--bright:#ebeff4;--danger:#e87070}
+    *{box-sizing:border-box}
+    body{margin:0;min-height:100vh;display:grid;place-items:center;background:var(--night);color:var(--steel-soft);font-family:"Segoe UI",system-ui,sans-serif}
+    main{width:min(34rem,calc(100vw - 3rem));padding:3rem 1.5rem;text-align:center}
+    img{display:block;width:clamp(7.5rem,20vw,10rem);height:auto;margin:0 auto 1.75rem;filter:drop-shadow(0 1.25rem 2rem rgba(102,155,210,.16))}
+    .rail{width:min(18rem,70vw);height:1px;margin:0 auto 1.5rem;background:linear-gradient(90deg,transparent,var(--steel),transparent)}
+    .status{margin:0 0 .75rem;color:var(--steel);font:600 .72rem/1.2 ui-monospace,"Cascadia Mono",monospace;letter-spacing:.14em;text-transform:uppercase}
+    h1{margin:0;color:var(--steel);font-size:clamp(2rem,6vw,3.25rem);font-weight:720;letter-spacing:-.04em;line-height:1.05}
+    p:last-of-type{max-width:30rem;margin:1.25rem auto 0;color:var(--steel-soft);font-size:1.05rem;line-height:1.6}
+    .failure h1,.failure .status{color:var(--danger)}
+    @media (prefers-reduced-motion:no-preference){main{animation:arrive .45s ease-out both}@keyframes arrive{from{opacity:0;transform:translateY(.6rem)}to{opacity:1;transform:none}}}
+  </style>
+</head>
+<body>
+  <main class="${state}">
+    <img src="${mascotDataUri()}" alt="Jeco, the Jecode gecko">
+    <div class="rail" aria-hidden="true"></div>
+    <p class="status">${status}</p>
+    <h1>${title}</h1>
+    <p>${detail}</p>
+  </main>
+  <script>history.replaceState(null,"","/auth/complete")</script>
+</body>
+</html>`;
+}
+let mascot;
+function mascotDataUri() {
+    if (mascot === undefined) {
+        const file = new URL("../docs/assets/brand/jeco-256.png", import.meta.url);
+        mascot = `data:image/png;base64,${readFileSync(file).toString("base64")}`;
+    }
+    return mascot;
+}
+function sameState(expected, received) {
+    if (received === null)
+        return false;
+    const left = Buffer.from(expected);
+    const right = Buffer.from(received);
+    return left.length === right.length && timingSafeEqual(left, right);
+}

package/dist/openai-oauth-tokens.js

@@ -0,0 +1,65 @@
+// Validate OAuth token responses and extract the ChatGPT account claims.
+const CLAIMS = "https://api.openai.com/auth";
+export function openAITokenReply(value, previousRefresh) {
+    if (!record(value))
+        throw new Error("OpenAI sign-in returned an invalid token response");
+    const accessToken = required(value["access_token"], "access token");
+    const refreshToken = optional(value["refresh_token"]) ?? previousRefresh;
+    const expiresIn = value["expires_in"];
+    if (refreshToken === undefined)
+        throw new Error("OpenAI sign-in did not return a refresh token");
+    if (typeof expiresIn !== "number" || !Number.isFinite(expiresIn) || expiresIn <= 0) {
+        throw new Error("OpenAI sign-in did not return a valid token lifetime");
+    }
+    const idToken = optional(value["id_token"]);
+    return {
+        accessToken,
+        refreshToken,
+        expiresAt: Date.now() + Math.floor(expiresIn * 1_000),
+        ...(idToken === undefined ? {} : { idToken }),
+    };
+}
+export function openAIAccountFromTokens(token) {
+    const access = jwt(token.accessToken);
+    const identity = token.idToken === undefined ? undefined : jwt(token.idToken);
+    const auth = record(access[CLAIMS]) ? access[CLAIMS] : {};
+    const accountId = optional(auth["chatgpt_account_id"]) ?? optional(identity?.["chatgpt_account_id"]);
+    if (accountId === undefined)
+        throw new Error("OpenAI sign-in did not identify a ChatGPT account");
+    const email = optional(identity?.["email"]);
+    const plan = optional(auth["chatgpt_plan_type"]) ?? optional(identity?.["chatgpt_plan_type"]);
+    return {
+        accessToken: token.accessToken,
+        refreshToken: token.refreshToken,
+        expiresAt: token.expiresAt,
+        accountId,
+        ...(email === undefined ? {} : { email }),
+        ...(plan === undefined ? {} : { plan }),
+    };
+}
+function jwt(token) {
+    const part = token.split(".")[1];
+    if (part === undefined)
+        throw new Error("OpenAI sign-in returned an unreadable token");
+    try {
+        const value = JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
+        if (!record(value))
+            throw new Error("invalid payload");
+        return value;
+    }
+    catch {
+        throw new Error("OpenAI sign-in returned an unreadable token");
+    }
+}
+function required(value, label) {
+    const found = optional(value);
+    if (found === undefined)
+        throw new Error(`OpenAI sign-in returned no ${label}`);
+    return found;
+}
+function optional(value) {
+    return typeof value === "string" && value !== "" ? value : undefined;
+}
+function record(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/openai-oauth.js

@@ -0,0 +1,203 @@
+// OpenAI's ChatGPT OAuth protocol, implemented with Node primitives only.
+//
+// This module owns the authority handshake. It does not know about the TUI or
+// persist anything; callers decide when an explicitly completed login becomes
+// an account on disk.
+import { createHash, randomBytes } from "node:crypto";
+import { oauthRequest } from "./oauth-http.js";
+import { OPENAI_CALLBACK_PATH, openAICallback } from "./openai-oauth-callback.js";
+import { openAIAccountFromTokens, openAITokenReply, } from "./openai-oauth-tokens.js";
+const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+const AUTHORITY = "https://auth.openai.com";
+const AUTHORIZE = `${AUTHORITY}/oauth/authorize`;
+const TOKEN = `${AUTHORITY}/oauth/token`;
+const REVOKE = `${AUTHORITY}/oauth/revoke`;
+const DEVICE_CODE = `${AUTHORITY}/api/accounts/deviceauth/usercode`;
+const DEVICE_POLL = `${AUTHORITY}/api/accounts/deviceauth/token`;
+const DEVICE_VERIFY = `${AUTHORITY}/codex/device`;
+const DEVICE_REDIRECT = `${AUTHORITY}/deviceauth/callback`;
+const LOGIN_LIMIT_MS = 15 * 60_000;
+export async function beginBrowserLogin() {
+    const verifier = randomBytes(64).toString("base64url");
+    const challenge = createHash("sha256").update(verifier).digest("base64url");
+    const state = randomBytes(32).toString("base64url");
+    const callback = await openAICallback(state);
+    const redirectUri = `http://localhost:${callback.port}${OPENAI_CALLBACK_PATH}`;
+    const authorize = new URL(AUTHORIZE);
+    authorize.search = new URLSearchParams({
+        response_type: "code",
+        client_id: CLIENT_ID,
+        redirect_uri: redirectUri,
+        scope: "openid profile email offline_access",
+        code_challenge: challenge,
+        code_challenge_method: "S256",
+        state,
+        id_token_add_organizations: "true",
+        codex_cli_simplified_flow: "true",
+        originator: "jecode",
+    }).toString();
+    return {
+        url: authorize.href,
+        async complete(signal) {
+            try {
+                const code = await abortable(callback.code, signal);
+                const account = openAIAccountFromTokens(await exchange({
+                    authorizationCode: code,
+                    verifier,
+                    redirectUri,
+                }, signal));
+                await callback.respond(true);
+                return account;
+            }
+            catch (error) {
+                await callback.respond(false);
+                throw error;
+            }
+            finally {
+                await callback.close();
+            }
+        },
+        close: callback.close,
+    };
+}
+export async function beginDeviceLogin(signal) {
+    const start = await oauthRequest(DEVICE_CODE, { contentType: "application/json", value: { client_id: CLIENT_ID } }, signal);
+    const value = record(start.value) ? start.value : {};
+    const deviceAuthId = required(value["device_auth_id"], "device authorization id");
+    const code = required(value["user_code"] ?? value["usercode"], "device code");
+    const interval = intervalSeconds(value["interval"]);
+    return {
+        url: DEVICE_VERIFY,
+        code,
+        async complete(waitSignal) {
+            const combined = combine(signal, waitSignal);
+            const pending = await pollDevice(deviceAuthId, code, interval, combined);
+            return openAIAccountFromTokens(await exchange(pending, combined));
+        },
+        close: async () => { },
+    };
+}
+export async function refreshOpenAITokens(account, signal) {
+    const response = await oauthRequest(TOKEN, {
+        contentType: "application/json",
+        value: {
+            client_id: CLIENT_ID,
+            grant_type: "refresh_token",
+            refresh_token: account.refreshToken,
+        },
+    }, signal);
+    const token = openAITokenReply(response.value, account.refreshToken);
+    const refreshed = openAIAccountFromTokens(token);
+    if (refreshed.accountId !== account.accountId) {
+        throw new Error("OpenAI refreshed a different ChatGPT account · sign in again");
+    }
+    return {
+        ...refreshed,
+        ...(refreshed.email === undefined && account.email !== undefined ? { email: account.email } : {}),
+        ...(refreshed.plan === undefined && account.plan !== undefined ? { plan: account.plan } : {}),
+    };
+}
+export async function revokeOpenAITokens(account, signal) {
+    await oauthRequest(REVOKE, {
+        contentType: "application/json",
+        value: {
+            token: account.refreshToken,
+            token_type_hint: "refresh_token",
+            client_id: CLIENT_ID,
+        },
+    }, signal);
+}
+async function exchange(code, signal) {
+    const response = await oauthRequest(TOKEN, {
+        contentType: "application/x-www-form-urlencoded",
+        value: new URLSearchParams({
+            grant_type: "authorization_code",
+            client_id: CLIENT_ID,
+            code: code.authorizationCode,
+            code_verifier: code.verifier,
+            redirect_uri: code.redirectUri,
+        }),
+    }, signal);
+    return openAITokenReply(response.value);
+}
+async function pollDevice(deviceAuthId, userCode, interval, signal) {
+    const started = Date.now();
+    while (Date.now() - started < LOGIN_LIMIT_MS) {
+        const response = await oauthRequest(DEVICE_POLL, {
+            contentType: "application/json",
+            value: { device_auth_id: deviceAuthId, user_code: userCode },
+        }, signal, [200, 403, 404]);
+        if (response.status === 200) {
+            const value = record(response.value) ? response.value : {};
+            return {
+                authorizationCode: required(value["authorization_code"], "authorization code"),
+                verifier: required(value["code_verifier"], "code verifier"),
+                redirectUri: DEVICE_REDIRECT,
+            };
+        }
+        await sleep(interval * 1_000, signal);
+    }
+    throw new Error("ChatGPT device sign-in timed out after 15 minutes");
+}
+function intervalSeconds(value) {
+    const parsed = typeof value === "string" ? Number(value.trim()) : value;
+    return typeof parsed === "number" && Number.isFinite(parsed)
+        ? Math.max(1, Math.min(30, Math.floor(parsed)))
+        : 5;
+}
+function required(value, label) {
+    const found = optional(value);
+    if (found === undefined)
+        throw new Error(`OpenAI sign-in returned no ${label}`);
+    return found;
+}
+function optional(value) {
+    return typeof value === "string" && value !== "" ? value : undefined;
+}
+function record(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function combine(left, right) {
+    if (left === undefined)
+        return right;
+    if (right === undefined)
+        return left;
+    return AbortSignal.any([left, right]);
+}
+function abortable(promise, signal) {
+    if (signal === undefined)
+        return promise;
+    if (signal.aborted)
+        return Promise.reject(abortReason(signal));
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(abortReason(signal));
+        signal.addEventListener("abort", onAbort, { once: true });
+        promise.then((value) => {
+            signal.removeEventListener("abort", onAbort);
+            resolve(value);
+        }, (error) => {
+            signal.removeEventListener("abort", onAbort);
+            reject(error);
+        });
+    });
+}
+function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted === true) {
+            reject(abortReason(signal));
+            return;
+        }
+        const timer = setTimeout(() => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        const onAbort = () => {
+            clearTimeout(timer);
+            reject(signal === undefined ? new Error("cancelled") : abortReason(signal));
+        };
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+}
+function abortReason(signal) {
+    return signal.reason instanceof Error ? signal.reason : new Error("cancelled");
+}

package/dist/permission-command.js

@@ -0,0 +1,107 @@
+// The session-local permission control plane exposed through /permissions.
+import { heading } from "./tui/picker.js";
+export async function permissionsCommand(session, host) {
+    const choose = host.choose;
+    const control = host.permissions;
+    if (choose === undefined || control === undefined) {
+        host.emit({ kind: "notice", text: "permissions need the interactive screen", tone: "warn" });
+        return;
+    }
+    let selected = 0;
+    while (true) {
+        const tools = control.listTools();
+        const index = await choose(permissionsPicker(tools, session.palette, selected));
+        if (index === undefined)
+            return;
+        const tool = tools[index];
+        if (tool === undefined)
+            return;
+        selected = index;
+        await configureTool(tool, control, choose, session.palette);
+    }
+}
+export function permissionsPicker(tools, pal, index = 0) {
+    const launchOverride = tools.some((tool) => tool.locked);
+    return {
+        title: heading("permissions", launchOverride ? "session only · auto approve at launch" : "session only", pal),
+        description: "Changes apply now · /new resets them",
+        options: tools.map((tool) => ({ label: tool.name, hint: toolHint(tool) })),
+        index: Math.min(Math.max(0, index), Math.max(0, tools.length - 1)),
+    };
+}
+async function configureTool(tool, control, choose, pal) {
+    if (tool.locked) {
+        await choose({
+            title: heading(tool.name, "launch override", pal),
+            description: "Restart without --auto-approve to change this tool",
+            options: [{ label: "allow", hint: "locked for this process" }],
+            index: 0,
+        });
+        return;
+    }
+    const modes = tool.dangerous ? ["ask", "allow", "deny"] : ["allow", "deny"];
+    const grants = control.listGrants(tool.name);
+    const index = await choose({
+        title: heading(tool.name, tool.dangerous ? "dangerous tool" : "read-only tool", pal),
+        description: tool.dangerous
+            ? "Session only · ask is the safe default"
+            : "Session only · deny hides this tool from the model",
+        options: [
+            ...modes.map((mode) => ({ label: mode, hint: modeHint(mode, tool.dangerous) })),
+            ...(grants.length === 0
+                ? []
+                : [{ label: "remembered approvals", hint: String(grants.length) }]),
+        ],
+        index: Math.max(0, modes.indexOf(tool.mode)),
+    });
+    if (index === undefined)
+        return;
+    const mode = modes[index];
+    if (mode !== undefined) {
+        control.set(tool.name, mode);
+        return;
+    }
+    await reviewGrants(tool.name, control, choose, pal);
+}
+async function reviewGrants(tool, control, choose, pal) {
+    let selected = 0;
+    while (true) {
+        const grants = control.listGrants(tool);
+        if (grants.length === 0)
+            return;
+        const options = [
+            ...grants.map((grant) => ({ label: grant.label, hint: "revoke" })),
+            ...(grants.length > 1 ? [{ label: "all remembered approvals", hint: "revoke all" }] : []),
+        ];
+        const index = await choose({
+            title: heading("remembered", tool, pal),
+            description: "Allowed without asking · this session",
+            options,
+            index: Math.min(selected, options.length - 1),
+        });
+        if (index === undefined)
+            return;
+        if (index === grants.length) {
+            control.revokeTool(tool);
+            return;
+        }
+        const grant = grants[index];
+        if (grant === undefined)
+            return;
+        control.revoke(grant.key);
+        selected = index;
+    }
+}
+function toolHint(tool) {
+    const kind = tool.dangerous ? "" : " · read only";
+    const remembered = tool.remembered === 0 ? "" : ` · ${tool.remembered} remembered`;
+    const locked = tool.locked ? " · launch override" : "";
+    return `${tool.mode}${kind}${remembered}${locked}`;
+}
+function modeHint(mode, dangerous) {
+    if (mode === "deny")
+        return "hide from the model";
+    if (mode === "ask")
+        return "prompt when needed";
+    return dangerous ? "every call this session" : "offer to the model";
+}

package/dist/permissions.js

@@ -0,0 +1,113 @@
+// Session-local tool policies and remembered approval scopes.
+/** One permission control plane for one interactive process. */
+export function sessionPermissions(tools, autoApprove) {
+    const catalogue = [...tools];
+    const byName = new Map(catalogue.map((tool) => [tool.name, tool]));
+    const modes = new Map();
+    const grants = new Map();
+    const configured = (tool) => modes.get(tool.name) ?? defaultMode(tool);
+    const effective = (tool) => autoApprove && tool.dangerous ? "allow" : configured(tool);
+    const revokeTool = (name) => {
+        for (const [key, grant] of grants) {
+            if (grant.tools.includes(name))
+                grants.delete(key);
+        }
+    };
+    return {
+        listTools() {
+            return catalogue.map((tool) => ({
+                name: tool.name,
+                dangerous: tool.dangerous,
+                mode: effective(tool),
+                remembered: [...grants.values()].filter((grant) => grant.tools.includes(tool.name)).length,
+                locked: autoApprove && tool.dangerous,
+            }));
+        },
+        set(name, mode) {
+            const tool = byName.get(name);
+            if (tool === undefined || (autoApprove && tool.dangerous))
+                return false;
+            if (!tool.dangerous && mode === "ask")
+                return false;
+            if (configured(tool) === mode)
+                return true;
+            if (mode === defaultMode(tool))
+                modes.delete(name);
+            else
+                modes.set(name, mode);
+            revokeTool(name);
+            return true;
+        },
+        listGrants(name) {
+            return [...grants.values()].filter((grant) => name === undefined || grant.tools.includes(name));
+        },
+        revoke(key) {
+            grants.delete(key);
+        },
+        revokeTool,
+        reset() {
+            modes.clear();
+            grants.clear();
+        },
+        availableTools() {
+            return catalogue.filter((tool) => effective(tool) !== "deny");
+        },
+        approved(call) {
+            const tool = byName.get(call.name);
+            if (tool === undefined)
+                return false;
+            const mode = effective(tool);
+            if (mode === "allow")
+                return true;
+            if (mode === "deny")
+                return false;
+            return grants.has(scopeFor(call).key);
+        },
+        remember(call) {
+            const tool = byName.get(call.name);
+            if (tool === undefined || effective(tool) !== "ask")
+                return;
+            const scope = scopeFor(call);
+            grants.set(scope.key, { key: scope.key, tools: grantTools(call), label: scope.summary });
+        },
+    };
+}
+/** The narrow permission represented by "for the session" in an approval. */
+export function scopeFor(call) {
+    const path = typeof call.input.path === "string" ? call.input.path : undefined;
+    if ((call.name === "write_file" || call.name === "edit_file") && path !== undefined) {
+        return { key: `file\0${path}`, label: `changes to ${path}`, summary: `file changes · ${path}` };
+    }
+    const command = typeof call.input.command === "string" ? call.input.command : undefined;
+    if (call.name === "run_command" && command !== undefined) {
+        return { key: `command\0${command}`, label: "this exact command", summary: `command · ${command}` };
+    }
+    return {
+        key: `${call.name}\0${stable(call.input)}`,
+        label: "this exact call",
+        summary: `${call.name} · ${target(call.input)}`,
+    };
+}
+function defaultMode(tool) {
+    return tool.dangerous ? "ask" : "allow";
+}
+function grantTools(call) {
+    return call.name === "write_file" || call.name === "edit_file"
+        ? ["edit_file", "write_file"]
+        : [call.name];
+}
+function stable(value) {
+    if (Array.isArray(value))
+        return `[${value.map(stable).join(",")}]`;
+    if (value !== null && typeof value === "object") {
+        return `{${Object.entries(value)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([key, item]) => `${JSON.stringify(key)}:${stable(item)}`)
+            .join(",")}}`;
+    }
+    return JSON.stringify(value);
+}
+function target(input) {
+    const value = input.path ?? input.command;
+    return typeof value === "string" ? value : stable(input);
+}