@kolisachint/hoocode-agent 0.4.21 → 0.4.24

package/dist/extensions/core/hoo-core.js

@@ -11,8 +11,8 @@
  *                         and /approve commands
  *
  * Config merge order (lowest → highest priority):
- *   1. ~/.hoocode/agent/hoo-config.json   (global defaults)
- *   2. ./.hoocode/config.json             (project overrides — scalars win; arrays union)
+ *   1. ~/.hoocode/hoo-config.json    (global defaults)
+ *   2. ./.hoocode/hoo-config.json   (project overrides — scalars win; arrays union)
  */
 import { spawn } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
@@ -53,7 +53,7 @@ To fix, switch to /mode build.`,
 // Shared paths
 // ============================================================================
 const HOOCODE_DIR = getHooCodeDir();
-const GLOBAL_CONFIG_PATH = join(HOOCODE_DIR, "agent", "hoo-config.json");
+const GLOBAL_CONFIG_PATH = join(HOOCODE_DIR, "hoo-config.json");
 /**
  * Per-session plan file path. Keying on sessionId lets concurrent or resumed
  * plan sessions keep distinct plans instead of clobbering each other.
@@ -77,9 +77,8 @@ function readConfig() {
     }
 }
 function writeConfig(config) {
-    const dir = join(HOOCODE_DIR, "agent");
-    if (!existsSync(dir))
-        mkdirSync(dir, { recursive: true });
+    if (!existsSync(HOOCODE_DIR))
+        mkdirSync(HOOCODE_DIR, { recursive: true });
     writeFileSync(GLOBAL_CONFIG_PATH, `${JSON.stringify(config, null, 2)}\n`, "utf8");
 }
 /**
@@ -109,6 +108,12 @@ export function mergeConfigs(global, project) {
                 allowed_write_paths: Array.from(new Set([...(globalCfg.allowed_write_paths ?? []), ...(projectCfg.allowed_write_paths ?? [])])),
                 // enabled_tools: project wins if set, else falls back to global
                 enabled_tools: projectCfg.enabled_tools ?? globalCfg.enabled_tools,
+                // denied_tools: union so project can add more denied tools on top of global
+                denied_tools: Array.from(new Set([...(globalCfg.denied_tools ?? []), ...(projectCfg.denied_tools ?? [])])),
+                // allowed_bash_commands: project wins if set, else falls back to global
+                allowed_bash_commands: projectCfg.allowed_bash_commands ?? globalCfg.allowed_bash_commands,
+                // denied_bash_commands: union so project can add more denied patterns on top of global
+                denied_bash_commands: Array.from(new Set([...(globalCfg.denied_bash_commands ?? []), ...(projectCfg.denied_bash_commands ?? [])])),
             };
         }
     }
@@ -140,12 +145,12 @@ function mergeSearchPaths(...sources) {
 }
 /**
  * Reads the global config and optionally overlays the project-local config at
- * `./.hoocode/config.json`. Project values win on all scalar fields; arrays are
+ * `./.hoocode/hoo-config.json`. Project values win on all scalar fields; arrays are
  * unioned (see mergeConfigs for full rules).
  */
 export function readMergedConfig(cwd) {
     const global = readConfig();
-    const projectPath = join(cwd, ".hoocode", "config.json");
+    const projectPath = join(cwd, ".hoocode", "hoo-config.json");
     if (!existsSync(projectPath))
         return global;
     try {
@@ -180,6 +185,18 @@ function matchesAllowedPath(filePath, allowedPatterns) {
     }
     return false;
 }
+/**
+ * Tests a bash command string against a regex pattern string.
+ * Returns false (no match) if the pattern is an invalid regex.
+ */
+function matchesBashPattern(pattern, command) {
+    try {
+        return new RegExp(pattern).test(command);
+    }
+    catch {
+        return false;
+    }
+}
 function describeTool(event) {
     if (isToolCallEventType("bash", event)) {
         return `$ ${event.input.command.replace(/\s+/g, " ").slice(0, 100)}`;
@@ -196,12 +213,57 @@ function describeTool(event) {
 }
 export function setupPermissionGate(pi) {
     pi.on("tool_call", async (event, ctx) => {
-        if (!GATED_TOOLS.has(event.toolName) || !ctx.hasUI)
-            return;
-        // Use the merged config so project-local auto_allow entries are respected
+        // Use the merged config so project-local entries are respected
         const config = readMergedConfig(ctx.cwd);
         const mode = config.active_mode ?? "build";
         const modeCfg = config.modes?.[mode];
+        // ── Hard enforcement (always applies, regardless of UI) ───────────────────
+        // Explicitly denied tools are blocked unconditionally
+        if (modeCfg?.denied_tools?.includes(event.toolName)) {
+            return {
+                block: true,
+                reason: `Tool "${event.toolName}" is denied in mode "${mode}".`,
+            };
+        }
+        // enabled_tools acts as a strict allowlist: only listed tools may execute
+        if (modeCfg?.enabled_tools &&
+            modeCfg.enabled_tools.length > 0 &&
+            !modeCfg.enabled_tools.includes(event.toolName)) {
+            return {
+                block: true,
+                reason: `Tool "${event.toolName}" is not enabled in mode "${mode}" ` +
+                    `(enabled: ${modeCfg.enabled_tools.join(", ")}).`,
+            };
+        }
+        // Bash command-level filtering
+        if (isToolCallEventType("bash", event)) {
+            const command = event.input.command ?? "";
+            // denied_bash_commands: block if any pattern matches
+            if (modeCfg?.denied_bash_commands?.length) {
+                for (const pattern of modeCfg.denied_bash_commands) {
+                    if (matchesBashPattern(pattern, command)) {
+                        return {
+                            block: true,
+                            reason: `Bash command matches a denied pattern in mode "${mode}": ${pattern}`,
+                        };
+                    }
+                }
+            }
+            // allowed_bash_commands: block unless at least one pattern matches
+            if (modeCfg?.allowed_bash_commands?.length) {
+                const permitted = modeCfg.allowed_bash_commands.some((p) => matchesBashPattern(p, command));
+                if (!permitted) {
+                    return {
+                        block: true,
+                        reason: `Bash command is not permitted in mode "${mode}". ` +
+                            `Allowed patterns: ${modeCfg.allowed_bash_commands.join(", ")}`,
+                    };
+                }
+            }
+        }
+        // ── UI-based permission prompting (interactive sessions only) ─────────────
+        if (!GATED_TOOLS.has(event.toolName) || !ctx.hasUI)
+            return;
         const autoAllow = modeCfg?.auto_allow ?? [];
         // Check allowed_write_paths for write/edit operations
         if ((event.toolName === "write" || event.toolName === "edit") && modeCfg?.allowed_write_paths) {
@@ -521,8 +583,8 @@ export function setupMode(pi) {
     let cachedPlanPath;
     // ── session_start ─────────────────────────────────────────────────────────
     // Config resolution order:
-    //   1. Read global config  (~/.hoocode/agent/hoo-config.json)
-    //   2. Read project config (./.hoocode/config.json) if present
+    //   1. Read global config  (~/.hoocode/hoo-config.json)
+    //   2. Read project config (./.hoocode/hoo-config.json) if present
     //   3. Merge — project scalars win; arrays are unioned
     //   4. Re-resolve active_mode from the merged result
     pi.on("session_start", (_event, ctx) => {
@@ -700,12 +762,191 @@ export function setupMode(pi) {
     });
 }
 // ============================================================================
+// Scaffold commands — /new-skill and /new-agent
+// ============================================================================
+/** Validates a resource name: lowercase a-z, 0-9, hyphens, no leading/trailing/double hyphens. */
+function validateResourceName(name) {
+    if (!name)
+        return "name is required";
+    if (!/^[a-z0-9-]+$/.test(name))
+        return "name must be lowercase a-z, 0-9, and hyphens only";
+    if (name.startsWith("-") || name.endsWith("-"))
+        return "name must not start or end with a hyphen";
+    if (name.includes("--"))
+        return "name must not contain consecutive hyphens";
+    return null;
+}
+function setupScaffold(pi) {
+    // ── /new-skill <name> ─────────────────────────────────────────────────────
+    // Creates .hoocode/skills/<name>/SKILL.md with a valid Agent Skills frontmatter
+    // template so the file is ready to edit and will be picked up on next reload.
+    pi.registerCommand("new-skill", {
+        description: "Scaffold a new skill. Usage: /new-skill <name>",
+        getArgumentCompletions: () => [],
+        handler: async (args, ctx) => {
+            const name = args.trim();
+            const error = validateResourceName(name);
+            if (error) {
+                ctx.ui.notify(`/new-skill: ${error}. Usage: /new-skill <name>`, "warning");
+                return;
+            }
+            const skillDir = join(ctx.cwd, ".hoocode", "skills", name);
+            const skillFile = join(skillDir, "SKILL.md");
+            if (existsSync(skillFile)) {
+                ctx.ui.notify(`/new-skill: ${skillFile} already exists`, "warning");
+                return;
+            }
+            mkdirSync(skillDir, { recursive: true });
+            writeFileSync(skillFile, [
+                "---",
+                `name: ${name}`,
+                "description: |",
+                "  TODO: describe when to use this skill — one clear sentence per bullet.",
+                "  The model reads this to decide whether to load the skill.",
+                "allowed-tools: read, bash",
+                "---",
+                "",
+                `# ${name}`,
+                "",
+                "TODO: write the skill instructions here.",
+                "",
+                "When relative paths appear below, they are resolved from this file's directory.",
+                "",
+            ].join("\n"), "utf8");
+            ctx.ui.notify(`Skill created: ${join(".hoocode", "skills", name, "SKILL.md")}\nEdit the file, then run /reload to activate it.`, "info");
+        },
+    });
+    // ── /new-agent <name> ─────────────────────────────────────────────────────
+    // Creates .hoocode/agents/<name>.md following the Claude Code subagent standard
+    // (name, description, tools comma-string, model alias, optional background).
+    pi.registerCommand("new-agent", {
+        description: "Scaffold a new subagent. Usage: /new-agent <name>",
+        getArgumentCompletions: () => [],
+        handler: async (args, ctx) => {
+            const name = args.trim();
+            const error = validateResourceName(name);
+            if (error) {
+                ctx.ui.notify(`/new-agent: ${error}. Usage: /new-agent <name>`, "warning");
+                return;
+            }
+            const agentsDir = join(ctx.cwd, ".hoocode", "agents");
+            const agentFile = join(agentsDir, `${name}.md`);
+            if (existsSync(agentFile)) {
+                ctx.ui.notify(`/new-agent: ${agentFile} already exists`, "warning");
+                return;
+            }
+            mkdirSync(agentsDir, { recursive: true });
+            writeFileSync(agentFile, [
+                "---",
+                `name: ${name}`,
+                "description: |",
+                "  Use this subagent ONLY when:",
+                "  - TODO: describe the task(s) to delegate here",
+                "",
+                "  DO NOT use for:",
+                "  - TODO: describe what this agent should NOT handle",
+                "tools: read, bash",
+                "model: sonnet",
+                "---",
+                `You are a ${name} subagent running inside hoocode.`,
+                "You run in an isolated context and cannot see the parent conversation.",
+                "",
+                "TODO: write the system prompt here.",
+                "",
+                "Your final message must contain ONLY your answer — it is the only output",
+                "the caller receives. Do not include intermediate reasoning or tool logs.",
+                "",
+            ].join("\n"), "utf8");
+            ctx.ui.notify(`Agent created: ${join(".hoocode", "agents", `${name}.md`)}\nEdit the file, then run /reload to activate it.`, "info");
+        },
+    });
+}
+// ============================================================================
+// D. Options pane — ask_options tool
+// ============================================================================
+// The model calls this tool when it needs the user to make a decision before
+// continuing. Each question is shown in an inline options pane where the user
+// moves with up/down, advances with right, and may type a custom answer.
+const askOptionsSchema = Type.Object({
+    questions: Type.Array(Type.Object({
+        question: Type.String({ description: "The question to ask the user." }),
+        detail: Type.Optional(Type.String({ description: "Optional clarifying sub-text shown under the question." })),
+        options: Type.Array(Type.Object({
+            label: Type.String({ description: "The option text; returned verbatim when chosen." }),
+            description: Type.Optional(Type.String({ description: "Optional short description shown next to the option." })),
+        }), { description: "The options the user can choose from." }),
+        allow_custom: Type.Optional(Type.Boolean({
+            description: "When true, the user can type a free-form answer instead of choosing an option.",
+        })),
+    }), { description: "One or more decisions to ask the user, in order." }),
+});
+export function setupAskOptions(pi) {
+    // Capture the latest context so the tool can reach the interactive UI.
+    let activeCtx;
+    pi.on("session_start", (_event, ctx) => {
+        activeCtx = ctx;
+    });
+    pi.registerTool({
+        name: "ask_options",
+        label: "Ask the user",
+        description: "Ask the user to make one or more decisions before continuing. Each question is presented " +
+            "in an interactive options pane where the user selects an option (or types a custom answer). " +
+            "Use this when you genuinely need input to proceed and cannot reasonably decide yourself. " +
+            "Returns the user's answer for each question; if the user skips, no answers are returned.",
+        parameters: askOptionsSchema,
+        async execute(_toolCallId, params, signal, _onUpdate) {
+            if (!activeCtx || !activeCtx.hasUI) {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: "Cannot ask the user: no interactive UI is available in this session. Proceed using your best judgement.",
+                        },
+                    ],
+                    details: undefined,
+                };
+            }
+            if (!params.questions.length) {
+                return {
+                    content: [{ type: "text", text: "No questions were provided." }],
+                    details: undefined,
+                };
+            }
+            const questions = params.questions.map((q) => ({
+                question: q.question,
+                detail: q.detail,
+                options: q.options.map((o) => ({ label: o.label, description: o.description })),
+                allowCustom: q.allow_custom,
+            }));
+            const answers = await activeCtx.ui.askOptions(questions, { signal });
+            if (!answers) {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: "The user skipped the question(s) without answering. Ask how they would like to proceed.",
+                        },
+                    ],
+                    details: undefined,
+                };
+            }
+            const text = questions.map((q, i) => `${q.question}\n  \u2192 ${answers[i] ?? "(no answer)"}`).join("\n\n");
+            return {
+                content: [{ type: "text", text }],
+                details: undefined,
+            };
+        },
+    });
+}
+// ============================================================================
 // Extension entry point
 // ============================================================================
 function hooCore(pi) {
     setupPermissionGate(pi);
     setupMcpLoader(pi);
     setupMode(pi);
+    setupScaffold(pi);
+    setupAskOptions(pi);
 }
 hooCore.displayName = "hoo-core";
 export default hooCore;