@letrquan/book 0.2.0 → 0.3.0

package/dist/{chunk-MAQXCUR4.js → chunk-J62VZYOB.js}

@@ -1,15 +1,32 @@
+import {
+  globToRegex,
+  globWalkPlan,
+  sandboxCoverage
+} from "./chunk-JTPOI3KU.js";
+import {
+  containsPath,
+  pathHoldsHome,
+  rootHoldsHome
+} from "./chunk-525CAZPY.js";
+import {
+  canonicalizePath,
+  isBookLocalSettingsPath,
+  isUnderRoot,
+  pathOutsideWorkspaceResult,
+  resolveMutationPath,
+  resolveReadablePathDetail,
+  resolveWorkspacePath
+} from "./chunk-X66I2NQO.js";
 import {
   canonicalToolName,
   getPrimaryArg,
-  observeFile,
-  requireFreshObservation,
   toolFailure,
   toolSuccess
-} from "./chunk-5GDZ22YP.js";
-import {
-  globToRegex,
-  sandboxCoverage
-} from "./chunk-EYGD6X2T.js";
+} from "./chunk-224FJZLH.js";
+
+// src/permissions.ts
+import { realpathSync } from "fs";
+import { isAbsolute, relative as relative2, sep } from "path";
 
 // src/async.ts
 function throwIfAborted(signal) {
@@ -122,7 +139,9 @@ function hunkBounds(ops, context) {
       e++;
       ctxAfter++;
     }
-    bounds.push([s + 1, e]);
+    const previous = bounds.at(-1);
+    if (previous && s + 1 <= previous[1]) previous[1] = e;
+    else bounds.push([s + 1, e]);
     k = e;
   }
   return bounds;
@@ -203,52 +222,109 @@ async function renderDiffWithStatsAsync(oldText, newText, context = 3, signal) {
   return { diff: out.join("\n"), stats: diffStatsFromHunks(hunks) };
 }
 
-// src/tools/path-utils.ts
-import { existsSync, realpathSync } from "fs";
-import { dirname, isAbsolute, relative, resolve, sep } from "path";
-function isOutside(root, candidate) {
-  const rel = relative(root, candidate);
-  return rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel);
-}
-function nearestExistingPath(inputPath) {
-  let candidate = inputPath;
-  while (!existsSync(candidate)) {
-    const parent = dirname(candidate);
-    if (parent === candidate) return null;
-    candidate = parent;
-  }
-  return candidate;
-}
-function resolveWorkspacePath(workspaceRoot, inputPath) {
-  const lexicalRoot = resolve(workspaceRoot);
-  const filePath = resolve(isAbsolute(inputPath) ? inputPath : resolve(lexicalRoot, inputPath));
-  if (isOutside(lexicalRoot, filePath)) return null;
-  const existingPath = nearestExistingPath(filePath);
-  if (!existingPath) return null;
-  let realRoot;
-  let realExisting;
+// src/tools/file-provenance.ts
+import { createHash } from "crypto";
+import { readFile, stat } from "fs/promises";
+import { normalize, relative, resolve } from "path";
+function workspaceIdentity(workspaceRoot) {
+  const root = normalize(resolve(workspaceRoot));
+  const stable = process.platform === "win32" ? root.toLowerCase() : root;
+  return createHash("sha256").update(stable).digest("hex").slice(0, 24);
+}
+function normalizeObservedPath(path) {
+  const normalized = path.replace(/\\/g, "/");
+  return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+}
+function observationKey(workspaceId, path) {
+  return `${workspaceId}:${normalizeObservedPath(path)}`;
+}
+function observationPathFor(workspaceRoot, absolutePath) {
+  const root = canonicalizePath(resolve(workspaceRoot));
+  return relative(root, canonicalizePath(absolutePath)).replace(/\\/g, "/");
+}
+function isOutline(observation) {
+  return observation.operation === "outline";
+}
+function mayReplaceObservation(current, next) {
+  return !current || !isOutline(next) || isOutline(current);
+}
+function supersedesObservation(current, next) {
+  if (!current) return true;
+  if (isOutline(current) !== isOutline(next)) return isOutline(current);
+  return current.timestamp <= next.timestamp;
+}
+function seedObservationLedger(ledger, messages) {
+  for (const message of messages) {
+    for (const observation of message.fileObservations ?? []) {
+      const key = observationKey(observation.workspaceId, observation.path);
+      if (supersedesObservation(ledger.get(key), observation)) ledger.set(key, observation);
+    }
+  }
+  return ledger;
+}
+async function observeFile(ctx, absolutePath, operation, coverage) {
+  const bytes = await readFile(absolutePath);
+  const workspaceId = workspaceIdentity(ctx.workspaceRoot);
+  const path = observationPathFor(ctx.workspaceRoot, absolutePath);
+  const observation = {
+    path,
+    workspaceId,
+    sha256: createHash("sha256").update(bytes).digest("hex"),
+    byteSize: bytes.byteLength,
+    lineStart: coverage?.lineStart,
+    lineEnd: coverage?.lineEnd,
+    operation,
+    sourceRef: ctx.currentToolTraceId ?? "runtime-tool",
+    timestamp: Date.now()
+  };
+  const key = observationKey(workspaceId, path);
+  const ledger = ctx.fileObservationLedger;
+  if (ledger && mayReplaceObservation(ledger.get(key), observation)) ledger.set(key, observation);
+  return observation;
+}
+async function requireFreshObservation(ctx, absolutePath, relativePath) {
+  const workspaceId = workspaceIdentity(ctx.workspaceRoot);
+  const normalizedPath = relativePath.replace(/\\/g, "/");
+  const remembered = ctx.fileObservationLedger?.get(
+    observationKey(workspaceId, observationPathFor(ctx.workspaceRoot, absolutePath))
+  );
+  if (!remembered || isOutline(remembered)) return void 0;
   try {
-    realRoot = realpathSync.native(lexicalRoot);
-    realExisting = realpathSync.native(existingPath);
+    const info = await stat(absolutePath);
+    if (!info.isFile()) return staleMessage(normalizedPath);
+    const bytes = await readFile(absolutePath);
+    const currentHash = createHash("sha256").update(bytes).digest("hex");
+    return currentHash === remembered.sha256 ? void 0 : staleMessage(normalizedPath);
   } catch {
-    return null;
+    return staleMessage(normalizedPath);
   }
-  if (isOutside(realRoot, realExisting)) return null;
-  const canonicalPath = resolve(realExisting, relative(existingPath, filePath));
-  if (isOutside(realRoot, canonicalPath)) return null;
-  const rel = relative(lexicalRoot, filePath);
-  return { filePath, canonicalPath, relativePath: rel.replace(/\\/g, "/") };
 }
-function pathOutsideWorkspaceResult(inputPath) {
-  return toolFailure(`Path outside workspace: ${inputPath}`, {
-    code: "path_outside_workspace"
-  });
+function staleMessage(path) {
+  return `SKIPPED: ${path} changed or disappeared since it was last shown to the model. Call Read (or mention the file again) before modifying it.`;
+}
+function requireObservationForMutation(ctx, absolutePath, relativePath, retryVerb) {
+  const ledger = ctx.fileObservationLedger;
+  if (!ledger) return void 0;
+  const workspaceId = workspaceIdentity(ctx.workspaceRoot);
+  const normalizedPath = relativePath.replace(/\\/g, "/");
+  const remembered = ledger.get(
+    observationKey(workspaceId, observationPathFor(ctx.workspaceRoot, absolutePath))
+  );
+  if (remembered && !isOutline(remembered)) return void 0;
+  const seen = remembered ? "has only been outlined in this session, and an outline is not the file's content" : "has not been read in this session";
+  return toolFailure(
+    `SKIPPED: ${normalizedPath} ${seen}. Call Read (or mention the file) before modifying it.`,
+    {
+      code: "file_not_observed",
+      remediation: `Read the file first, then retry the ${retryVerb}.`
+    }
+  );
 }
 
 // src/tools/mutation.ts
 import { randomUUID } from "crypto";
-import { mkdir, readFile, rename, rm, stat, writeFile } from "fs/promises";
-import { dirname as dirname2 } from "path";
+import { mkdir, readFile as readFile2, rename, rm, stat as stat2, writeFile } from "fs/promises";
+import { dirname } from "path";
 var pathLocks = /* @__PURE__ */ new Map();
 function looksBinary(bytes) {
   const sample = bytes.subarray(0, 8192);
@@ -262,7 +338,7 @@ function looksBinary(bytes) {
 async function readTextSnapshot(filePath, allowMissing = false) {
   let bytes;
   try {
-    bytes = await readFile(filePath);
+    bytes = await readFile2(filePath);
   } catch (error) {
     if (allowMissing && error.code === "ENOENT") {
       return {
@@ -292,7 +368,7 @@ async function readTextSnapshot(filePath, allowMissing = false) {
   const bareLfCount = (decoded.replace(/\r\n/g, "").match(/\n/g) ?? []).length;
   const bareCrCount = (decoded.replace(/\r\n/g, "").match(/\r/g) ?? []).length;
   const mixedLineEndings = crlfCount > 0 && bareLfCount > 0 || bareCrCount > 0;
-  const mode = (await stat(filePath)).mode & 511;
+  const mode = (await stat2(filePath)).mode & 511;
   return {
     exists: true,
     bytes,
@@ -310,7 +386,7 @@ function restoreTextEncoding(text, snapshot) {
 }
 async function writeFileAtomically(filePath, bytes, signal, mode) {
   throwIfAborted(signal);
-  await mkdir(dirname2(filePath), { recursive: true });
+  await mkdir(dirname(filePath), { recursive: true });
   const temporary = `${filePath}.book-tmp-${randomUUID()}`;
   try {
     await writeFile(temporary, bytes, { flag: "wx", mode });
@@ -378,6 +454,8 @@ function parsePatchUnsafe(patch) {
   if (lines.at(-1) === "") lines.pop();
   if (lines[0] !== "*** Begin Patch" || lines.at(-1) !== "*** End Patch")
     return invalid("Patch must start with *** Begin Patch and end with *** End Patch");
+  while (lines.length > 2 && lines[1] === "*** Begin Patch") lines.splice(1, 1);
+  while (lines.length > 2 && lines.at(-2) === "*** End Patch") lines.splice(-2, 1);
   const operations = [];
   let index = 1;
   let hunkCount = 0;
@@ -462,17 +540,13 @@ function linesOf(text) {
   if (lines.at(-1) === "") lines.pop();
   return lines;
 }
-function findUniqueSequence(haystack, needle) {
-  if (needle.length === 0) return { index: 0, count: 0 };
-  let index = -1;
-  let count = 0;
+function sequenceMatches(haystack, needle) {
+  if (needle.length === 0) return [];
+  const matches = [];
   for (let start = 0; start <= haystack.length - needle.length; start++) {
-    if (needle.every((line, offset) => haystack[start + offset] === line)) {
-      index = start;
-      count++;
-    }
+    if (needle.every((line, offset) => haystack[start + offset] === line)) matches.push(start);
   }
-  return { index, count };
+  return matches;
 }
 function candidateLine(haystack, line) {
   const matches = haystack.reduce((found, value, index) => {
@@ -484,12 +558,15 @@ function candidateLine(haystack, line) {
 function applyHunks(text, hunks) {
   let lines = linesOf(text);
   let trailingNewline = text.endsWith("\n");
+  let cursor = 0;
   for (let hunkIndex = 0; hunkIndex < hunks.length; hunkIndex++) {
     const hunk = hunks[hunkIndex];
     const oldLines = hunk.lines.filter((line) => line.kind !== "add").map((line) => line.text);
     const newLines = hunk.lines.filter((line) => line.kind !== "remove").map((line) => line.text);
-    const match = findUniqueSequence(lines, oldLines);
-    if (match.count === 0)
+    const matches = sequenceMatches(lines, oldLines);
+    const afterPrevious = matches.filter((start) => start >= cursor);
+    const index = matches.length === 1 ? matches[0] : afterPrevious.length === 1 ? afterPrevious[0] : -1;
+    if (matches.length === 0)
       return {
         text,
         mismatch: toolFailure(`Hunk ${hunkIndex + 1}: patch context not found`, {
@@ -507,21 +584,23 @@ function applyHunks(text, hunks) {
           }
         })
       };
-    if (match.count > 1)
+    if (index < 0)
       return {
         text,
         mismatch: toolFailure(`Hunk ${hunkIndex + 1}: patch context is ambiguous`, {
           code: "ambiguous_patch_context",
-          remediation: "Reread a narrower range and include more exact context lines.",
-          details: { hunkIndex: hunkIndex + 1, header: hunk.header, matches: match.count }
+          remediation: "Add surrounding lines, such as the enclosing function signature, until the hunk occurs once in the file or once after the previous hunk, then regenerate the patch.",
+          details: {
+            hunkIndex: hunkIndex + 1,
+            header: hunk.header,
+            matches: matches.length,
+            matchesAfterPreviousHunk: afterPrevious.length
+          }
         })
       };
-    const touchesEndOfFile = match.index + oldLines.length === lines.length;
-    lines = [
-      ...lines.slice(0, match.index),
-      ...newLines,
-      ...lines.slice(match.index + oldLines.length)
-    ];
+    const touchesEndOfFile = index + oldLines.length === lines.length;
+    lines = [...lines.slice(0, index), ...newLines, ...lines.slice(index + oldLines.length)];
+    cursor = index + newLines.length;
     if (touchesEndOfFile) {
       const oldNoNewline = hunk.lines.some((line) => line.kind !== "add" && line.noNewline);
       const newNoNewline = hunk.lines.some((line) => line.kind !== "remove" && line.noNewline);
@@ -547,7 +626,7 @@ async function applyPatch(args, ctx) {
   if (!("operations" in parsed)) return parsed;
   const paths = parsed.operations.map((operation) => operation.path);
   const resolved = parsed.operations.map((operation) => {
-    const result = resolveWorkspacePath(ctx.workspaceRoot, operation.path);
+    const result = resolveMutationPath(ctx, operation.path);
     return result ? { operation, ...result } : null;
   });
   if (resolved.some((entry) => !entry))
@@ -770,7 +849,13 @@ ${diff}`);
             }
           }
         );
-        return result;
+        if (!staged.every((file) => file.mutation.kind === "create")) return result;
+        return {
+          ...result,
+          maskedPlaceholder: `${staged.map(
+            (file, order) => `${order === 0 ? "Created" : "created"} ${file.relativePath} (${file.mutation.addedLines} lines, ${file.afterBytes?.byteLength ?? 0} bytes)`
+          ).join("; ")}.`
+        };
       } catch (error) {
         const code = errorCodeFor(error);
         return toolFailure(error instanceof Error ? error.message : String(error), {
@@ -809,6 +894,32 @@ var patchTools = [
 ];
 
 // src/permissions.ts
+function isUnreadablePattern(target) {
+  return typeof target === "object" && target !== null && target.target === "invalid";
+}
+var WORKSPACE_READ_TOOLS = /* @__PURE__ */ new Set(["Read", "Glob", "Grep"]);
+var PATH_RULE_TOOLS = /* @__PURE__ */ new Set([
+  "Read",
+  "Write",
+  "Edit",
+  "MultiEdit",
+  "NotebookEdit"
+]);
+var WORKSPACE_READ_JUDGING_MODES = /* @__PURE__ */ new Set([
+  "default",
+  "accept-edits",
+  "plan"
+]);
+var WORKSPACE_READ_REFUSAL_MODES = /* @__PURE__ */ new Set([
+  ...WORKSPACE_READ_JUDGING_MODES,
+  "dontAsk"
+]);
+var WORKSPACE_READ_ONLY_GIT_TOOLS = /* @__PURE__ */ new Set([
+  "GitStatus",
+  "GitDiff",
+  "GitLog",
+  "GitBranch"
+]);
 function parseRule(rule) {
   const parenIdx = rule.indexOf("(");
   if (parenIdx === -1) {
@@ -834,12 +945,19 @@ function toolNameMatchesRule(ruleToolName, toolName) {
     serverName && !serverName.includes("__") && toolName.startsWith(`${ruleToolName}__`)
   );
 }
-function ruleMatches(rule, toolName, primaryArg) {
+var caseFoldingPathRule = (value) => value.toLowerCase();
+function ruleMatchesCandidate(rule, toolName, primaryArg, fold) {
   if (!toolNameMatchesRule(rule.toolName, toolName)) return false;
   if (rule.pattern === null) return true;
   const normalizedArg = normalizePathArg(primaryArg);
   const normalizedPattern = rule.pattern.startsWith("./") ? rule.pattern.slice(2) : rule.pattern;
-  return globToRegex(normalizedPattern).test(normalizedArg);
+  if (!fold) return globToRegex(normalizedPattern).test(normalizedArg);
+  return globToRegex(caseFoldingPathRule(normalizedPattern)).test(
+    caseFoldingPathRule(normalizedArg)
+  );
+}
+function ruleMatches(rule, toolName, primaryArg) {
+  return ruleMatchesCandidate(rule, toolName, primaryArg, false);
 }
 function permissionRuleForToolCall(call) {
   const toolName = canonicalToolName(call.name);
@@ -852,7 +970,8 @@ function permissionRuleForToolCall(call) {
     } catch {
     }
   }
-  return primaryArg ? `${toolName}(${primaryArg})` : toolName;
+  if (!primaryArg) return void 0;
+  return `${toolName}(${primaryArg})`;
 }
 function permissionResultOf(decision) {
   return typeof decision === "string" ? decision : decision.result;
@@ -860,10 +979,14 @@ function permissionResultOf(decision) {
 function permissionRuleOf(decision) {
   return typeof decision === "string" ? void 0 : decision.rule;
 }
+function permissionReasonOf(decision) {
+  return typeof decision === "string" ? void 0 : decision.reason;
+}
 var RULE_LADDER_MAX = 3;
 var SHELL_CHAINING = /[;&|><`$(){}\n]/;
 function permissionRuleLadder(call) {
   const exact = permissionRuleForToolCall(call);
+  if (!exact) return [];
   if (canonicalToolName(call.name) !== "Bash") return [exact];
   const command = getPrimaryArg(call.arguments).trim();
   if (!command || SHELL_CHAINING.test(command)) return [exact];
@@ -890,8 +1013,8 @@ function patchOperations(args) {
   const parsed = parsePatch(args.patch);
   return "operations" in parsed ? parsed.operations : [];
 }
-function ruleMatchesPatch(rule, path) {
-  return ruleMatches(rule, rule.toolName, path);
+function ruleMatchesPatch(rule, paths, fold) {
+  return paths.some((path) => ruleMatchesCandidate(rule, rule.toolName, path, fold));
 }
 function patchRuleSupportsOperation(rule, operation) {
   if (rule.toolName === "ApplyPatch") return true;
@@ -899,11 +1022,11 @@ function patchRuleSupportsOperation(rule, operation) {
   if (rule.toolName === "Write") return operation.kind === "update" || operation.kind === "add";
   return false;
 }
-function compatiblePatchRuleMatches(rule, operations) {
+function compatiblePatchRuleMatches(rule, operations, spellingsOf, fold) {
   if (!["ApplyPatch", "Edit", "Write"].includes(rule.toolName)) return false;
   if (rule.toolName === "ApplyPatch" && rule.pattern === null) return true;
   return operations.some(
-    (operation) => patchRuleSupportsOperation(rule, operation) && (rule.pattern === null || ruleMatchesPatch(rule, operation.path))
+    (operation) => patchRuleSupportsOperation(rule, operation) && (rule.pattern === null || ruleMatchesPatch(rule, spellingsOf(operation.path, fold), fold))
   );
 }
 function primaryArgForRule(_toolName, args) {
@@ -920,63 +1043,260 @@ function sandboxAutoAllows(toolName, args, settings, options) {
   if (!command) return false;
   return sandboxCoverage(command, settings.sandbox, options.sandboxBackendAvailable).sandboxed;
 }
+var toPosix = (value) => value.replace(/\\/g, "/");
+function realRootOf(scope) {
+  if (scope.realRoot) return scope.realRoot;
+  try {
+    return realpathSync.native(scope.root);
+  } catch {
+    return void 0;
+  }
+}
+function pathArgument(toolName, args) {
+  const value = toolName === "NotebookEdit" ? args.notebook_path : args.filePath;
+  return typeof value === "string" && value.trim() !== "" ? value : void 0;
+}
+function rulesName(lists, toolName) {
+  return [...lists.deny, ...lists.ask, ...lists.allow].some(
+    ({ parsed }) => parsed.toolName === toolName
+  );
+}
+function resolvedPathScope(scope) {
+  const detailCache = /* @__PURE__ */ new Map();
+  const rootsFor = (includeReadOnly) => ({
+    workspaceRoot: scope.root,
+    readOnlyRoots: includeReadOnly ? scope.readOnlyRoots : void 0,
+    additionalRoots: scope.additionalRoots
+  });
+  const holdsHomeByRoot = /* @__PURE__ */ new Map();
+  const holdsHome = (root) => {
+    let known = holdsHomeByRoot.get(root);
+    if (known === void 0) {
+      known = rootHoldsHome(root, scope.homeGuards ?? []);
+      holdsHomeByRoot.set(root, known);
+    }
+    return known;
+  };
+  const guardedRoots = [scope.root, ...scope.additionalRoots ?? []].filter(holdsHome);
+  const servingRootOf = (canonicalPath) => [realRootOf(scope), ...scope.additionalRoots ?? []].find(
+    (root) => typeof root === "string" && root.length > 0 && isUnderRoot(canonicalPath, root)
+  );
+  return {
+    scope,
+    roots: rootsFor,
+    detail: (raw, includeReadOnly) => {
+      const key = `${includeReadOnly ? "r" : "w"}\0${raw}`;
+      let known = detailCache.get(key);
+      if (!known) {
+        known = resolveReadablePathDetail(rootsFor(includeReadOnly), raw);
+        detailCache.set(key, known);
+      }
+      return known;
+    },
+    isGuarded: (canonicalPath) => {
+      const roots = [realRootOf(scope), ...scope.additionalRoots ?? []].filter(
+        (root) => typeof root === "string" && root.length > 0
+      );
+      if (roots.some((root) => isBookLocalSettingsPath(canonicalPath, root, { directory: true })))
+        return true;
+      if (guardedRoots.length === 0) return false;
+      if (!pathHoldsHome(canonicalPath, scope.homeGuards ?? [])) return false;
+      const serving = servingRootOf(canonicalPath);
+      return serving !== void 0 && holdsHome(serving);
+    },
+    /**
+     * Whether a Grep or Glob *scope* can reach a guarded home. A scope is a subtree, not a file,
+     * so it is guarded when the guarded home is inside it as well as when it is inside the home:
+     * `Grep {path: "/home"}` reads `~/.ssh` without naming a single file under it (PR #334
+     * finding 4). Compared canonically, both ways, because either side may be reached by a link.
+     */
+    scopeReachesHome: (canonicalScope) => {
+      const homes = scope.homeGuards ?? [];
+      if (homes.some((home) => containsPath(canonicalScope, home))) return true;
+      return guardedRoots.some((root) => containsPath(root, canonicalScope));
+    }
+  };
+}
+function spellingsOfPath(paths, raw, includeReadOnly, restrictive) {
+  const spellings = [];
+  const detail = paths.detail(raw, includeReadOnly);
+  if (!("path" in detail)) return [];
+  const resolved = detail.path;
+  const inWorkspace = resolveWorkspacePath(paths.scope.root, raw) !== null;
+  if (inWorkspace) {
+    spellings.push(
+      resolved.relativePath,
+      toPosix(resolved.filePath),
+      toPosix(resolved.canonicalPath)
+    );
+    const realRoot = realRootOf(paths.scope);
+    if (realRoot) spellings.push(toPosix(relative2(realRoot, resolved.canonicalPath)));
+  } else {
+    spellings.push(toPosix(resolved.filePath), toPosix(resolved.canonicalPath));
+    if (restrictive) {
+      for (const root of paths.scope.additionalRoots ?? []) {
+        const fromRoot = relative2(canonicalizePath(root), resolved.canonicalPath);
+        if (!fromRoot || isAbsolute(fromRoot) || fromRoot === ".." || fromRoot.startsWith(`..${sep}`)) {
+          continue;
+        }
+        spellings.push(toPosix(fromRoot));
+      }
+    }
+  }
+  return [...new Set(spellings)].filter((spelling) => spelling !== "" && spelling !== raw);
+}
+function pathRuleSpellings(paths, toolName, args, restrictive) {
+  const raw = pathArgument(toolName, args);
+  return raw ? spellingsOfPath(paths, raw, toolName === "Read", restrictive) : [];
+}
+function globTarget(pattern, paths) {
+  const { refusal, scopes } = globWalkPlan(pattern, paths.scope.root);
+  if (refusal) return { target: "invalid", reason: refusal };
+  if (scopes === null) return "outside";
+  let guarded = false;
+  for (const scope of scopes) {
+    const detail = paths.detail(scope, false);
+    if (!("path" in detail)) return "outside";
+    if (paths.scopeReachesHome(detail.path.canonicalPath)) guarded = true;
+  }
+  return guarded ? "guarded" : "servable";
+}
+function readToolTarget(toolName, args, paths) {
+  if (toolName === "Read") {
+    const raw2 = pathArgument(toolName, args);
+    if (!raw2) return "none";
+    const detail2 = paths.detail(raw2, true);
+    if (!("path" in detail2)) return detail2.reason === "excluded" ? "hidden" : "outside";
+    return paths.isGuarded(detail2.path.canonicalPath) ? "guarded" : "servable";
+  }
+  if (toolName === "Glob") {
+    const pattern = typeof args.pattern === "string" ? args.pattern.trim() : "";
+    if (!pattern) return "none";
+    return globTarget(pattern, paths);
+  }
+  const raw = typeof args.path === "string" ? args.path.trim() : "";
+  if (raw === "" || raw === ".") return "servable";
+  const detail = paths.detail(raw, false);
+  if (!("path" in detail)) return detail.reason === "excluded" ? "hidden" : "outside";
+  if (paths.isGuarded(detail.path.canonicalPath)) return "guarded";
+  return paths.scopeReachesHome(detail.path.canonicalPath) ? "guarded" : "servable";
+}
+function parseRuleLists(settings) {
+  const list = (texts) => texts.map((text) => ({ text, parsed: parseRule(text) }));
+  return {
+    deny: list(settings.permissions.deny),
+    ask: list(settings.permissions.ask),
+    allow: list(settings.permissions.allow)
+  };
+}
+function hasReadAdjudication(lists) {
+  return [...lists.deny, ...lists.ask].some(
+    ({ parsed }) => WORKSPACE_READ_TOOLS.has(parsed.toolName)
+  );
+}
 function evaluatePermission(toolName, args, settings, options = {}) {
   return evaluatePermissionDetail(toolName, args, settings, options).decision;
 }
 function evaluatePermissionDetail(toolName, args, settings, options = {}) {
-  const { deny, ask, allow } = settings.permissions;
+  const scope = options.workspace;
+  const paths = scope ? resolvedPathScope(scope) : void 0;
+  const parsed = parseRuleLists(settings);
   if (toolName === "ApplyPatch") {
     const operations = patchOperations(args);
-    const compatible = (ruleStr) => {
-      const rule = parseRule(ruleStr);
-      return rule.toolName === "ApplyPatch" || rule.toolName === "Edit" || rule.toolName === "Write";
+    const spellings = /* @__PURE__ */ new Map();
+    const restrictiveSpellings = /* @__PURE__ */ new Map();
+    const spellingsOf = (path, restrictive) => {
+      const cache = restrictive ? restrictiveSpellings : spellings;
+      let known = cache.get(path);
+      if (!known) {
+        known = paths ? [path, ...spellingsOfPath(paths, path, false, restrictive)] : [path];
+        cache.set(path, known);
+      }
+      return known;
     };
-    for (const ruleStr of deny) {
-      if (!compatible(ruleStr)) continue;
-      const rule = parseRule(ruleStr);
-      if (compatiblePatchRuleMatches(rule, operations))
-        return { decision: "deny", matchedRule: ruleStr, source: "deny" };
-    }
-    for (const ruleStr of ask) {
-      if (!compatible(ruleStr)) continue;
-      const rule = parseRule(ruleStr);
-      if (compatiblePatchRuleMatches(rule, operations))
-        return { decision: "ask", matchedRule: ruleStr, source: "ask" };
+    const isCompatible = (rule) => rule.toolName === "ApplyPatch" || rule.toolName === "Edit" || rule.toolName === "Write";
+    for (const list of ["deny", "ask"]) {
+      for (const entry of parsed[list]) {
+        if (!isCompatible(entry.parsed)) continue;
+        if (compatiblePatchRuleMatches(entry.parsed, operations, spellingsOf, true)) {
+          return { decision: list, matchedRule: entry.text, source: list };
+        }
+      }
     }
-    const allowRules = allow.filter(compatible).map(parseRule);
+    const allowRules = parsed.allow.filter(({ parsed: rule }) => isCompatible(rule));
+    const firstCompatible = allowRules[0]?.text;
     if (operations.length > 0 && operations.every(
       (operation) => allowRules.some(
-        (rule) => patchRuleSupportsOperation(rule, operation) && (rule.pattern === null || ruleMatchesPatch(rule, operation.path))
+        ({ parsed: rule }) => patchRuleSupportsOperation(rule, operation) && (rule.pattern === null || ruleMatchesPatch(rule, spellingsOf(operation.path, false), false))
       )
     )) {
-      return { decision: "allow", matchedRule: allow.find(compatible), source: "allow" };
+      return { decision: "allow", matchedRule: firstCompatible, source: "allow" };
     }
-    if (allowRules.some((rule) => rule.toolName === "ApplyPatch" && rule.pattern === null)) {
-      return { decision: "allow", matchedRule: allow.find(compatible), source: "allow" };
+    if (allowRules.some(({ parsed: rule }) => rule.toolName === "ApplyPatch" && rule.pattern === null)) {
+      return { decision: "allow", matchedRule: firstCompatible, source: "allow" };
     }
     return { decision: "ask", source: "default" };
   }
-  const call = { id: "permission-evaluation", name: toolName, arguments: args };
-  for (const ruleStr of deny) {
-    if (permissionRuleMatchesCall(ruleStr, call)) {
-      return { decision: "deny", matchedRule: ruleStr, source: "deny" };
+  const tool = canonicalToolName(toolName);
+  const candidates = [getPrimaryArg(args)];
+  let restrictiveCandidates = candidates;
+  if (scope && paths && PATH_RULE_TOOLS.has(tool) && rulesName(parsed, tool)) {
+    restrictiveCandidates = [...candidates, ...pathRuleSpellings(paths, tool, args, true)];
+    candidates.push(...pathRuleSpellings(paths, tool, args, false));
+  }
+  const matchesRule = (rule, fold) => {
+    const pool = fold ? restrictiveCandidates : candidates;
+    if (tool === "WebFetch") {
+      try {
+        const url = new URL(candidates[0]).toString();
+        return ruleMatchesCandidate(rule, tool, url, false);
+      } catch {
+      }
+    }
+    return pool.some((candidate) => ruleMatchesCandidate(rule, tool, candidate, fold));
+  };
+  const readTarget = scope && paths && (scope.judgeReads || scope.refuseUnreachableReads) && WORKSPACE_READ_TOOLS.has(tool) ? readToolTarget(tool, args, paths) : void 0;
+  const unreadablePattern = readTarget !== void 0 && isUnreadablePattern(readTarget) ? readTarget.reason : void 0;
+  const outside = readTarget === "outside" ? { outsideWorkspace: true } : {};
+  for (const entry of parsed.deny) {
+    if (matchesRule(entry.parsed, true)) {
+      return { decision: "deny", matchedRule: entry.text, source: "deny" };
     }
   }
-  for (const ruleStr of ask) {
-    if (permissionRuleMatchesCall(ruleStr, call)) {
-      return { decision: "ask", matchedRule: ruleStr, source: "ask" };
+  for (const entry of parsed.ask) {
+    if (matchesRule(entry.parsed, true)) {
+      return { decision: "ask", matchedRule: entry.text, source: "ask", ...outside };
     }
   }
-  for (const ruleStr of allow) {
-    if (permissionRuleMatchesCall(ruleStr, call)) {
-      return { decision: "allow", matchedRule: ruleStr, source: "allow" };
+  for (const entry of parsed.allow) {
+    if (matchesRule(entry.parsed, false)) {
+      return { decision: "allow", matchedRule: entry.text, source: "allow" };
     }
   }
   if (sandboxAutoAllows(toolName, args, settings, options)) {
     return { decision: "allow", source: "sandbox" };
   }
+  if (scope?.autoAllowReads && (readTarget === "none" || readTarget === "servable" && (tool === "Read" || !hasReadAdjudication(parsed)))) {
+    return { decision: "allow", source: "workspace" };
+  }
+  if (scope?.autoAllowReads && WORKSPACE_READ_ONLY_GIT_TOOLS.has(tool)) {
+    return { decision: "allow", source: "workspace" };
+  }
+  if (ALWAYS_ALLOWED_TOOLS.has(tool)) {
+    return { decision: "allow", source: "default" };
+  }
+  if (unreadablePattern !== void 0) {
+    return { decision: "refuse", source: "default", unreadablePattern };
+  }
+  if (readTarget === "outside") {
+    return { decision: "refuse", source: "default", outsideWorkspace: true };
+  }
+  if (readTarget === "hidden") {
+    return { decision: "refuse", source: "default", excludedPath: true };
+  }
   return { decision: "ask", source: "default" };
 }
+var ALWAYS_ALLOWED_TOOLS = /* @__PURE__ */ new Set(["MemorySave", "TodoWrite"]);
 
 export {
   throwIfAborted,
@@ -984,8 +1304,14 @@ export {
   delay,
   yieldToEventLoop,
   renderDiffWithStatsAsync,
-  resolveWorkspacePath,
-  pathOutsideWorkspaceResult,
+  workspaceIdentity,
+  normalizeObservedPath,
+  observationKey,
+  supersedesObservation,
+  seedObservationLedger,
+  observeFile,
+  requireFreshObservation,
+  requireObservationForMutation,
   readTextSnapshot,
   restoreTextEncoding,
   writeFileAtomically,
@@ -993,15 +1319,21 @@ export {
   parsePatch,
   applyHunks,
   patchTools,
+  WORKSPACE_READ_TOOLS,
+  WORKSPACE_READ_JUDGING_MODES,
+  WORKSPACE_READ_REFUSAL_MODES,
+  WORKSPACE_READ_ONLY_GIT_TOOLS,
   parseRule,
   permissionRuleForToolCall,
   permissionResultOf,
   permissionRuleOf,
+  permissionReasonOf,
   permissionRuleLadder,
   permissionRuleMatchesCall,
   primaryArgForRule,
   hasAdjudicationPolicy,
   evaluatePermission,
-  evaluatePermissionDetail
+  evaluatePermissionDetail,
+  ALWAYS_ALLOWED_TOOLS
 };
-//# sourceMappingURL=chunk-MAQXCUR4.js.map
+//# sourceMappingURL=chunk-J62VZYOB.js.map