@joshuafolkken/kit 1.1784.0 → 1.2116.0

package/dist/hooks/pretool-guard.js

@@ -1,14 +1,15 @@
 #!/usr/bin/env tsx
 import {
   pretool_guard
-} from "./chunk-O2YBIDSI.js";
+} from "./chunk-CQD4LJE6.js";
 import {
   hook_decision
-} from "./chunk-CWMBGKYW.js";
-import "./chunk-PT5R6UJD.js";
-import "./chunk-YCDOIR3I.js";
-import "./chunk-WR2KQAYZ.js";
-import "./chunk-AZX4FGQ3.js";
+} from "./chunk-5PM2JRGV.js";
+import "./chunk-Z6DQJKH3.js";
+import "./chunk-3GKE653K.js";
+import "./chunk-7SIUNQXK.js";
+import "./chunk-VVNYJWEI.js";
+import "./chunk-45CJJOO7.js";
 
 // scripts/hooks/pretool-guard-cli.ts
 import { fileURLToPath } from "node:url";

package/dist/hooks/session-lang.js

@@ -4,27 +4,27 @@ import {
   agent_role_profile,
   detached_launch,
   distributed_paths,
+  document_section,
+  find_package_directory,
   josh_environment_file,
   run_headless,
   session_language
-} from "./chunk-YCDOIR3I.js";
+} from "./chunk-3GKE653K.js";
 import {
   agent_session_environment,
-  ancestor_directories,
-  file_reader,
-  git_common_directory,
+  durable_state,
   issue_cite,
   json_value,
-  package_manifest,
   process_identity,
   run_carry,
   run_event_stream,
   run_event_stream_emit
-} from "./chunk-WR2KQAYZ.js";
+} from "./chunk-7SIUNQXK.js";
 import {
   error_text,
+  git_common_directory,
   stamp_file
-} from "./chunk-AZX4FGQ3.js";
+} from "./chunk-45CJJOO7.js";
 
 // scripts/josh/session-language-main.ts
 import { fileURLToPath as fileURLToPath2 } from "node:url";
@@ -100,7 +100,7 @@ function check(profile, ports = default_ports) {
 var agent_diagnostics = { check };
 
 // scripts/agent/claude-agent-argv.ts
-import { existsSync as existsSync2 } from "node:fs";
+import { existsSync } from "node:fs";
 import path2 from "node:path";
 
 // scripts/agent/lane-instructions.ts
@@ -134,217 +134,6 @@ var cost_tokens = {
   ascii_bytes_to_tokens
 };
 
-// scripts/document/document-scan.ts
-var COMMAND_PATTERN = /`(?:pnpm )?josh ([a-z][a-z0-9:-]+)/gu;
-var LABEL_PATTERN = /(?:labels\[\]=|\/labels\/|labels -f name=)([a-z][a-z0-9:_-]*)/gu;
-var SECTION_PATTERN = /(?<![\w./:`-])(?<tick>`?)(?<file>[\w./-]+\.md)\k<tick>\s*→\s*(?:§\w+,\s*)?["「](?<heading>[^"」]+)["」]/gu;
-var ADJACENT_PATTERN = /["「](?<heading>[^"「」]+)["」]\s+(?:above|below)\b/gu;
-var BARE_ARROW_PATTERN = /→\s*(?:§\w+,\s*)?["「](?<heading>[^"「」]+)["」]/gu;
-var LINK_TARGET_PATTERN = /\]\([^)\s]*\)/gu;
-var LINK_PATTERN = /\]\(([\w./-]+\.(?:md|png|jpe?g|gif|svg|webp))(?:#[\w-]+)?\)/gu;
-var PLACEHOLDER_FILES = /* @__PURE__ */ new Set(["x.md", "foo.md", "file.md", "path.md"]);
-function matches(text, pattern) {
-  return [...text.matchAll(pattern)];
-}
-function command_references(text) {
-  return matches(text, COMMAND_PATTERN).map((match) => match[1] ?? "").filter((name) => !name.endsWith(":"));
-}
-function is_real_label(token) {
-  return token.length > 0 && !token.endsWith(":") && !token.includes("<");
-}
-function label_references(text) {
-  return matches(text, LABEL_PATTERN).map((match) => match[1] ?? "").filter((token) => is_real_label(token));
-}
-function base_name(path4) {
-  return path4.split("/").at(-1) ?? path4;
-}
-function is_placeholder_file(name) {
-  return name.includes("<") || PLACEHOLDER_FILES.has(base_name(name).toLowerCase());
-}
-function section_references(text) {
-  return matches(text.replaceAll(LINK_TARGET_PATTERN, ""), SECTION_PATTERN).map(({ groups }) => ({ file: groups?.["file"] ?? "", heading: groups?.["heading"] ?? "" })).filter((reference) => !is_placeholder_file(reference.file));
-}
-function headings_matching(text, pattern) {
-  return matches(text, pattern).map(({ groups }) => groups?.["heading"] ?? "");
-}
-function adjacent_references(text) {
-  return headings_matching(text, ADJACENT_PATTERN);
-}
-function bare_arrow_references(text) {
-  const unfiled = text.replaceAll(LINK_TARGET_PATTERN, "").replaceAll(SECTION_PATTERN, "");
-  return headings_matching(unfiled, BARE_ARROW_PATTERN);
-}
-function link_targets(text) {
-  return matches(text, LINK_PATTERN).map((match) => match[1] ?? "").filter((file) => !is_placeholder_file(file));
-}
-function normalize_reference(heading) {
-  return heading.replaceAll("`", "").split(/\s+/u).filter((word) => word !== ">").join(" ");
-}
-function reference_forms(title) {
-  const normalized = normalize_reference(title);
-  return [normalized, normalized.replace(/^\d+[a-z]?\. /u, "")];
-}
-var document_scan = {
-  adjacent_references,
-  bare_arrow_references,
-  command_references,
-  label_references,
-  link_targets,
-  normalize_reference,
-  reference_forms,
-  section_references
-};
-
-// scripts/document/document-section.ts
-var HEADING_PATTERN = /^(?<hashes>#{1,6}) (?<title>.*)$/u;
-var FENCE = "```";
-var SINGLE_MATCH = 1;
-var BOLD_LABEL_PATTERN = /\*\*([^*]+?)\*\*/gu;
-var BOLD_DELIMITER = "**";
-var CODE_SPAN_PATTERN = /``[^\n]*?``|`[^`\n]*`/gu;
-var LABEL_LEVEL = 7;
-var LIST_ITEM_PATTERN = /^(?<indent>\s*)(?:[-*]|\d+\.) /u;
-function to_heading(line, index) {
-  const groups = HEADING_PATTERN.exec(line)?.groups;
-  if (groups === void 0) return void 0;
-  const { hashes = "", title = "" } = groups;
-  return { level: hashes.length, title: title.trim(), line: index };
-}
-function push_heading(found, line, index) {
-  const heading = to_heading(line, index);
-  if (heading !== void 0) found.push(heading);
-}
-function fenced_flags(lines) {
-  let is_inside_fence = false;
-  return lines.map(function is_fenced(line) {
-    if (!line.startsWith(FENCE)) return is_inside_fence;
-    is_inside_fence = !is_inside_fence;
-    return true;
-  });
-}
-function headings(markdown) {
-  const lines = markdown.split("\n");
-  const fenced = fenced_flags(lines);
-  const found = [];
-  for (const [index, line] of lines.entries()) {
-    if (fenced[index] !== true) push_heading(found, line, index);
-  }
-  return found;
-}
-function titles(markdown) {
-  return headings(markdown).map((heading) => heading.title);
-}
-function line_starts(markdown) {
-  return [...markdown.matchAll(/\n/gu)].map((match) => match.index + SINGLE_MATCH);
-}
-function line_of(starts, offset) {
-  return starts.filter((start2) => start2 <= offset).length;
-}
-function unfenced_text(markdown) {
-  const lines = markdown.split("\n");
-  const fenced = fenced_flags(lines);
-  return lines.map((line, index) => fenced[index] === true ? "" : line).join("\n");
-}
-function code_masked(text) {
-  return text.replaceAll(CODE_SPAN_PATTERN, (span) => span.replaceAll("*", " "));
-}
-function labels(markdown) {
-  const text = unfenced_text(markdown);
-  const starts = line_starts(text);
-  return [...code_masked(text).matchAll(BOLD_LABEL_PATTERN)].map((match) => ({
-    level: LABEL_LEVEL,
-    title: text.slice(
-      match.index + BOLD_DELIMITER.length,
-      match.index + match[0].length - BOLD_DELIMITER.length
-    ),
-    line: line_of(starts, match.index)
-  }));
-}
-function is_match(heading, wanted) {
-  return document_scan.reference_forms(heading.title).some((form) => form.startsWith(wanted));
-}
-function prefixed(found, wanted) {
-  const normalized = document_scan.normalize_reference(wanted);
-  return found.filter((heading) => is_match(heading, normalized));
-}
-function is_exact(heading, wanted) {
-  return document_scan.reference_forms(heading.title).includes(wanted);
-}
-function select(found, wanted) {
-  const normalized = document_scan.normalize_reference(wanted);
-  const exact = found.find((heading) => is_exact(heading, normalized));
-  if (exact !== void 0) return exact;
-  const near = prefixed(found, wanted);
-  return near.length === SINGLE_MATCH ? near[0] : void 0;
-}
-function last_line_of(found, chosen, total_lines) {
-  const next = found.find((heading) => heading.line > chosen.line && heading.level <= chosen.level);
-  return (next === void 0 ? total_lines : next.line) - SINGLE_MATCH;
-}
-function indent_of(line) {
-  return line.length - line.trimStart().length;
-}
-function is_sibling_item(line, depth) {
-  const { indent } = LIST_ITEM_PATTERN.exec(line)?.groups ?? {};
-  return indent !== void 0 && indent.length <= depth;
-}
-function ends_block(line, depth) {
-  if (line.trim() === "" || HEADING_PATTERN.test(line)) return true;
-  return is_sibling_item(line, depth);
-}
-function label_last_line(lines, label) {
-  const depth = indent_of(lines[label.line] ?? "");
-  const end = lines.findIndex((line, index) => index > label.line && ends_block(line, depth));
-  return (end === -1 ? lines.length : end) - SINGLE_MATCH;
-}
-function choose(markdown, wanted) {
-  const found = headings(markdown);
-  if (prefixed(found, wanted).length > 0) return select(found, wanted);
-  return select(labels(markdown), wanted);
-}
-function extent_of(markdown, chosen) {
-  const lines = markdown.split("\n");
-  if (chosen.level === LABEL_LEVEL) return label_last_line(lines, chosen);
-  return last_line_of(headings(markdown), chosen, lines.length);
-}
-function section(markdown, wanted) {
-  const chosen = choose(markdown, wanted);
-  if (chosen === void 0) return void 0;
-  const last_line = extent_of(markdown, chosen);
-  const lines = markdown.split("\n").slice(chosen.line, last_line + SINGLE_MATCH);
-  return {
-    title: chosen.title,
-    level: chosen.level,
-    first_line: chosen.line,
-    last_line,
-    text: lines.join("\n")
-  };
-}
-function candidates(markdown, wanted) {
-  const near = prefixed(headings(markdown), wanted);
-  const listed = near.length > 0 ? near : prefixed(labels(markdown), wanted);
-  return listed.map((heading) => heading.title);
-}
-function read_optional(file_path) {
-  return file_reader.read_if_readable(file_path);
-}
-var document_section = {
-  candidates,
-  headings,
-  read_optional,
-  section,
-  titles
-};
-
-// scripts/josh/package-directory.ts
-import { existsSync } from "node:fs";
-function find_package_directory(start_directory) {
-  return ancestor_directories.nearest(
-    start_directory,
-    (directory) => existsSync(package_manifest.manifest_path(directory))
-  ) ?? start_directory;
-}
-
 // scripts/agent/lane-instructions.ts
 var LANE_DOCUMENT = "prompts/collaboration-workflow/lane-instructions.md";
 var RULES_FILE = "CLAUDE.md";
@@ -449,10 +238,9 @@ var LAUNCHED_TOOLS = [
   "SendMessage",
   "TaskStop",
   "Monitor",
-  "TodoWrite",
-  "WebSearch",
-  "WebFetch"
+  "TodoWrite"
 ];
+var NESTING_TOOLS = /* @__PURE__ */ new Set(["Agent", "Skill"]);
 var TOOLS_FLAG = "--tools";
 var STRICT_MCP_FLAG = "--strict-mcp-config";
 var MCP_CONFIG_FLAG = "--mcp-config";
@@ -460,10 +248,14 @@ var PROJECT_MCP_FILE = ".mcp.json";
 function session_id_flags(session_id) {
   return session_id === void 0 ? [] : [SESSION_ID_FLAG, session_id];
 }
-function tool_flags(cwd = process.cwd()) {
+function launched_tools(role) {
+  if (role !== agent_role_profile.REVIEWER) return LAUNCHED_TOOLS;
+  return LAUNCHED_TOOLS.filter((tool) => !NESTING_TOOLS.has(tool));
+}
+function tool_flags(role, cwd = process.cwd()) {
   const mcp_config = path2.join(cwd, PROJECT_MCP_FILE);
-  const mcp_flags = existsSync2(mcp_config) ? [STRICT_MCP_FLAG, MCP_CONFIG_FLAG, mcp_config] : [STRICT_MCP_FLAG];
-  return [TOOLS_FLAG, LAUNCHED_TOOLS.join(","), ...mcp_flags];
+  const mcp_flags = existsSync(mcp_config) ? [STRICT_MCP_FLAG, MCP_CONFIG_FLAG, mcp_config] : [STRICT_MCP_FLAG];
+  return [TOOLS_FLAG, launched_tools(role).join(","), ...mcp_flags];
 }
 function instruction_flags(profile, cwd) {
   if (profile.role === agent_role_profile.SCHEDULER) return [];
@@ -474,7 +266,7 @@ function build(invocation, profile, session_id, cwd) {
     command: AGENT_COMMAND,
     args: [
       ...AGENT_FLAGS,
-      ...tool_flags(cwd),
+      ...tool_flags(profile.role, cwd),
       ...instruction_flags(profile, cwd),
       ...session_id_flags(session_id),
       MODEL_FLAG,
@@ -491,7 +283,7 @@ function build_resume(invocation, profile, session_id, cwd) {
     command: AGENT_COMMAND,
     args: [
       ...AGENT_FLAGS,
-      ...tool_flags(cwd),
+      ...tool_flags(profile.role, cwd),
       ...instruction_flags(profile, cwd),
       RESUME_FLAG,
       session_id,
@@ -522,19 +314,32 @@ var claude_agent_argv = {
 };
 
 // scripts/agent/codex-agent-argv.ts
-import { lstatSync, mkdirSync } from "node:fs";
+import { existsSync as existsSync2, lstatSync, mkdirSync, readdirSync, realpathSync } from "node:fs";
 import path3 from "node:path";
 var AGENT_COMMAND2 = "codex";
-var AGENT_FLAGS2 = ["exec", "--sandbox", "workspace-write"];
+var AGENT_FLAGS2 = ["exec"];
 var MODEL_FLAG2 = "--model";
 var CONFIG_FLAG = "-c";
 var JSON_FLAG = "--json";
-var NETWORK_CONFIG = "sandbox_workspace_write.network_access=true";
 var SQLITE_CACHE_PATH = ["node_modules", ".cache", "josh", "openai"];
 var EPHEMERAL_FLAG = "--ephemeral";
-var ADD_DIRECTORY_FLAG = "--add-dir";
 var GIT_DIRECTORY = ".git";
 var LEDGER_DIRECTORY = path3.dirname(OBSERVATION_LEDGER_DIRECTORY);
+var WORKTREE_REGISTRY = "worktrees";
+var READ = "read";
+var WRITE = "write";
+var PERMISSION_PROFILE = "josh_lane";
+var PROFILE_CONFIG = `default_permissions="${PERMISSION_PROFILE}"`;
+var NETWORK_CONFIG = `permissions.${PERMISSION_PROFILE}.network.enabled=true`;
+var FILESYSTEM_KEY = `permissions.${PERMISSION_PROFILE}.filesystem`;
+var BASE_GRANTS = [
+  [":root", READ],
+  [":workspace_roots", WRITE],
+  [":slash_tmp", WRITE],
+  [":tmpdir", WRITE]
+];
+var PINNED_WORKTREE_ENTRIES = ["commondir", "config.worktree"];
+var PINNED_ENTRIES = ["hooks", "config", ...PINNED_WORKTREE_ENTRIES];
 function effort_config(profile) {
   return `model_reasoning_effort="${profile.effort}"`;
 }
@@ -544,32 +349,72 @@ function sqlite_config(cwd) {
 function persistence_arguments(profile) {
   return profile.role === agent_role_profile.WORKER ? [] : [EPHEMERAL_FLAG];
 }
-function ensure_ledger_directory(directory) {
+function ensure_writable_directory(directory, mode) {
   const current = lstatSync(directory, { throwIfNoEntry: false });
-  if (current === void 0) mkdirSync(directory, { recursive: true });
+  if (current === void 0) mkdirSync(directory, { recursive: true, mode });
   else if (!current.isDirectory() || current.isSymbolicLink()) {
-    throw new Error(`Ledger directory must be a real directory: ${directory}`);
+    throw new Error(`Writable root must be a real directory: ${directory}`);
   }
 }
-function ledger_arguments(common_directory, profile) {
+function pinned(directory, entries) {
+  return entries.map((entry) => [path3.join(directory, entry), READ]);
+}
+function registered_worktrees(common_directory) {
+  const registry = path3.join(common_directory, WORKTREE_REGISTRY);
+  if (!existsSync2(registry)) return [];
+  return readdirSync(registry, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => path3.join(registry, entry.name));
+}
+function git_grants(common_directory) {
+  if (common_directory === void 0) return [];
+  const root = realpathSync(common_directory);
+  return [
+    [root, WRITE],
+    ...pinned(root, PINNED_ENTRIES),
+    ...registered_worktrees(root).flatMap((worktree) => pinned(worktree, PINNED_WORKTREE_ENTRIES))
+  ];
+}
+function ledger_grants(common_directory, profile) {
   if (common_directory === void 0 || profile.role !== agent_role_profile.WORKER || path3.basename(common_directory) !== GIT_DIRECTORY) {
     return [];
   }
-  const directory = path3.join(path3.dirname(common_directory), LEDGER_DIRECTORY);
-  ensure_ledger_directory(directory);
-  return [ADD_DIRECTORY_FLAG, directory];
+  const ledger = path3.join(path3.dirname(common_directory), LEDGER_DIRECTORY);
+  ensure_writable_directory(ledger);
+  return [[realpathSync(ledger), WRITE]];
 }
-function lane_arguments(cwd, profile) {
+function filesystem_config(grants) {
+  const pairs = grants.map(
+    ([target, access]) => `${JSON.stringify(target)}=${JSON.stringify(access)}`
+  );
+  return `${FILESYSTEM_KEY}={${pairs.join(",")}}`;
+}
+function state_grants(cwd) {
+  const repository = git_common_directory.repository(cwd);
+  if (repository === void 0) return [];
+  const state = durable_state.root_for(repository);
+  ensure_writable_directory(state, durable_state.STATE_DIRECTORY_MODE);
+  return [[realpathSync(state), WRITE]];
+}
+function lane_grants(cwd, profile) {
+  if (cwd === void 0) return [];
   const common_directory = git_common_directory.resolve(cwd);
-  const additional_directory = common_directory === void 0 ? [] : [ADD_DIRECTORY_FLAG, common_directory];
+  if (common_directory === void 0) return state_grants(cwd);
+  return [...git_grants(common_directory), ...ledger_grants(common_directory, profile)];
+}
+function permission_arguments(cwd, profile) {
+  const grants = [...BASE_GRANTS, ...lane_grants(cwd, profile)];
   return [
     CONFIG_FLAG,
-    sqlite_config(cwd),
-    ...persistence_arguments(profile),
-    ...additional_directory,
-    ...ledger_arguments(common_directory, profile)
+    PROFILE_CONFIG,
+    CONFIG_FLAG,
+    filesystem_config(grants),
+    CONFIG_FLAG,
+    NETWORK_CONFIG
   ];
 }
+function lane_arguments(cwd, profile) {
+  if (cwd === void 0) return [];
+  return [CONFIG_FLAG, sqlite_config(cwd), ...persistence_arguments(profile)];
+}
 function build2(invocation, profile, cwd) {
   return {
     command: AGENT_COMMAND2,
@@ -579,9 +424,8 @@ function build2(invocation, profile, cwd) {
       profile.model,
       CONFIG_FLAG,
       effort_config(profile),
-      CONFIG_FLAG,
-      NETWORK_CONFIG,
-      ...cwd === void 0 ? [] : lane_arguments(cwd, profile),
+      ...permission_arguments(cwd, profile),
+      ...lane_arguments(cwd, profile),
       JSON_FLAG,
       invocation
     ],
@@ -616,16 +460,13 @@ function resolve2(invocation, role, environment = process.env) {
   const resolved = agent_role_profile.resolve(role, environment);
   return resolved.kind === "rejected" ? resolved : with_profile2(invocation, resolved.profile);
 }
-function resume_argv(invocation, profile, phase, cwd) {
-  if (profile !== void 0) {
-    return with_profile_in(invocation, agent_role_profile.with_phase_effort(profile, phase), cwd);
-  }
-  const resolved = agent_role_profile.resolve(agent_role_profile.WORKER, process.env, phase);
-  return resolved.kind === "rejected" ? resolved : with_profile_in(invocation, resolved.profile, cwd);
-}
 function profiled_in(invocation, resolved, cwd) {
   return resolved.kind === "rejected" ? resolved : with_profile_in(invocation, resolved.profile, cwd);
 }
+function resume_argv(invocation, profile, phase, cwd) {
+  const resolved = profile === void 0 ? agent_role_profile.resolve(agent_role_profile.WORKER, process.env, phase) : agent_role_profile.with_phase(profile, phase);
+  return profiled_in(invocation, resolved, cwd);
+}
 function resolve_in(invocation, role, cwd, environment = process.env) {
   return profiled_in(invocation, agent_role_profile.resolve(role, environment), cwd);
 }
@@ -703,8 +544,8 @@ var run_event_setup = {
 
 // scripts/backlog/backlogrun-launch.ts
 import { z } from "zod";
-var LAUNCH_PREFIX = "josh-backlogrun-launch-";
-var LOG_PREFIX = "josh-backlogrun-log-";
+var LAUNCH_PREFIX = durable_state.PREFIX.BACKLOGRUN_LAUNCH;
+var LOG_PREFIX = durable_state.PREFIX.BACKLOGRUN_LOG;
 var LOG_SUFFIX = ".log";
 var launch_schema = z.object({
   pid: z.number(),
@@ -716,10 +557,10 @@ var launch_schema = z.object({
   started_at: z.string().optional()
 });
 function launch_path(git_directory) {
-  return stamp_file.stamp_path(LAUNCH_PREFIX, git_directory);
+  return durable_state.path(LAUNCH_PREFIX, git_directory);
 }
 function log_path(git_directory) {
-  return stamp_file.stamp_path(LOG_PREFIX, git_directory, LOG_SUFFIX);
+  return durable_state.path(LOG_PREFIX, git_directory, LOG_SUFFIX);
 }
 function read_launch(target) {
   return json_value.parse_with(stamp_file.read_stamp_text(target) ?? "", launch_schema);
@@ -826,6 +667,8 @@ var backlogrun_launch = {
   argv_of,
   chosen_environment,
   is_running,
+  launch_path,
+  log_path,
   pending_launch,
   running_parent,
   start,