@lotagate/cli 0.1.22 → 0.1.23

package/dist/application/protocol/jsonl-protocol.d.ts

@@ -1,52 +0,0 @@
-import type { Readable, Writable } from 'node:stream';
-export declare const JSONL_PROTOCOL_VERSION: 1;
-export interface JsonlExecRequest {
-    version: typeof JSONL_PROTOCOL_VERSION;
-    id: string;
-    method: 'exec';
-    params: {
-        prompt: string;
-        model?: string;
-    };
-}
-export interface JsonlCancelRequest {
-    version: typeof JSONL_PROTOCOL_VERSION;
-    id: string;
-    method: 'cancel';
-    params: {
-        requestId: string;
-    };
-}
-export type JsonlRequest = JsonlExecRequest | JsonlCancelRequest;
-export interface JsonlErrorPayload {
-    code: string;
-    category: string;
-    message: string;
-    retryable: boolean;
-}
-export type JsonlEvent = {
-    version: typeof JSONL_PROTOCOL_VERSION;
-    id: string;
-    type: 'started' | 'delta' | 'completed' | 'error';
-    content?: string;
-    error?: JsonlErrorPayload;
-};
-export interface JsonlProtocolOptions {
-    maxLineBytes?: number;
-    maxInFlight?: number;
-}
-export interface JsonlProtocolResult {
-    errorCount: number;
-}
-export type JsonlExecutor = (request: JsonlExecRequest, signal: AbortSignal) => AsyncIterable<{
-    type: 'delta' | 'completed';
-    content?: string;
-}>;
-export declare class JsonlProtocolRunner {
-    private readonly executor;
-    private readonly options;
-    constructor(executor: JsonlExecutor, options?: JsonlProtocolOptions);
-    run(input: Readable, output: Writable): Promise<JsonlProtocolResult>;
-    private executeOne;
-}
-export declare function readLinesBounded(input: Readable, maxBytes: number): AsyncGenerator<string>;

package/dist/application/protocol/jsonl-protocol.js

@@ -1,170 +0,0 @@
-import { once } from 'node:events';
-import { RESOURCE_LIMITS } from '../../domain/runtime/resource-limits.js';
-export const JSONL_PROTOCOL_VERSION = 1;
-export class JsonlProtocolRunner {
-    executor;
-    options;
-    constructor(executor, options = {}) {
-        this.executor = executor;
-        this.options = options;
-    }
-    async run(input, output) {
-        const controllers = new Map();
-        const active = new Set();
-        const maxLineBytes = this.options.maxLineBytes ?? RESOURCE_LIMITS.jsonlLineBytes;
-        const maxInFlight = this.options.maxInFlight ?? RESOURCE_LIMITS.jsonlMaxInFlight;
-        let errorCount = 0;
-        try {
-            for await (const line of readLinesBounded(input, maxLineBytes)) {
-                if (Buffer.byteLength(line, 'utf8') > maxLineBytes) {
-                    errorCount += 1;
-                    await writeJsonl(output, errorEvent('unknown', protocolError('JSONL_REQUEST_TOO_LARGE', 'Request line exceeds the maximum size.')));
-                    continue;
-                }
-                let request;
-                try {
-                    request = parseRequest(JSON.parse(line));
-                }
-                catch (error) {
-                    errorCount += 1;
-                    await writeJsonl(output, errorEvent('unknown', toJsonlError(error)));
-                    continue;
-                }
-                if (request.method === 'cancel') {
-                    controllers.get(request.params.requestId)?.abort();
-                    continue;
-                }
-                if (controllers.has(request.id)) {
-                    errorCount += 1;
-                    await writeJsonl(output, errorEvent(request.id, protocolError('JSONL_DUPLICATE_REQUEST', 'Request id is already in flight.')));
-                    continue;
-                }
-                if (active.size >= maxInFlight) {
-                    errorCount += 1;
-                    await writeJsonl(output, errorEvent(request.id, protocolError('JSONL_OVERLOADED', 'Too many in-flight requests.', true)));
-                    continue;
-                }
-                const controller = new AbortController();
-                controllers.set(request.id, controller);
-                const operation = this.executeOne(request, controller.signal, output).then((succeeded) => { if (!succeeded)
-                    errorCount += 1; }).finally(() => { controllers.delete(request.id); active.delete(operation); });
-                active.add(operation);
-            }
-            await Promise.allSettled(active);
-        }
-        catch (error) {
-            if (!(error instanceof JsonlLimitError))
-                throw error;
-            errorCount += 1;
-            await writeJsonl(output, errorEvent('unknown', toJsonlError(error)));
-        }
-        finally {
-            for (const controller of controllers.values())
-                controller.abort();
-            await Promise.allSettled([...active]);
-        }
-        return { errorCount };
-    }
-    async executeOne(request, signal, output) {
-        try {
-            await writeJsonl(output, { version: JSONL_PROTOCOL_VERSION, id: request.id, type: 'started' });
-            for await (const event of this.executor(request, signal))
-                await writeJsonl(output, { version: JSONL_PROTOCOL_VERSION, id: request.id, type: event.type, ...(event.content === undefined ? {} : { content: event.content }) });
-            return true;
-        }
-        catch (error) {
-            await writeJsonl(output, errorEvent(request.id, toJsonlError(error)));
-            return false;
-        }
-    }
-}
-function parseRequest(value) {
-    if (typeof value !== 'object' || value === null)
-        throw invalidRequest('Request must be an object.');
-    const record = value;
-    if (record['version'] !== 1 || typeof record['id'] !== 'string' || record['id'].length === 0 || Buffer.byteLength(record['id'], 'utf8') > RESOURCE_LIMITS.jsonlIdBytes || typeof record['method'] !== 'string' || typeof record['params'] !== 'object' || record['params'] === null)
-        throw invalidRequest('Invalid JSONL request envelope.');
-    if (record['method'] === 'cancel') {
-        const params = record['params'];
-        if (typeof params['requestId'] !== 'string' || params['requestId'].length === 0 || Buffer.byteLength(params['requestId'], 'utf8') > RESOURCE_LIMITS.jsonlIdBytes)
-            throw invalidRequest('Invalid cancel request.');
-        return { version: JSONL_PROTOCOL_VERSION, id: record['id'], method: 'cancel', params: { requestId: params['requestId'] } };
-    }
-    if (record['method'] !== 'exec')
-        throw invalidRequest('Unsupported JSONL method.');
-    const params = record['params'];
-    if (typeof params['prompt'] !== 'string' || params['prompt'].trim().length === 0 || Buffer.byteLength(params['prompt'], 'utf8') > RESOURCE_LIMITS.jsonlPromptBytes || (params['model'] !== undefined && (typeof params['model'] !== 'string' || Buffer.byteLength(params['model'], 'utf8') > RESOURCE_LIMITS.jsonlIdBytes)))
-        throw invalidRequest('Invalid exec params.');
-    return { version: JSONL_PROTOCOL_VERSION, id: record['id'], method: 'exec', params: { prompt: params['prompt'], ...(params['model'] === undefined ? {} : { model: params['model'] }) } };
-}
-async function writeJsonl(output, event) {
-    if (output.write(`${JSON.stringify(event)}\n`))
-        return;
-    await once(output, 'drain');
-}
-function errorEvent(id, error) {
-    return { version: JSONL_PROTOCOL_VERSION, id, type: 'error', error };
-}
-function invalidRequest(message) {
-    return new JsonlProtocolError(protocolError('JSONL_INVALID_REQUEST', message));
-}
-function protocolError(code, message, retryable = false) {
-    return { code, category: 'protocol', message, retryable };
-}
-function toJsonlError(error) {
-    if (error instanceof JsonlProtocolError)
-        return error.payload;
-    if (isCliErrorLike(error)) {
-        return {
-            code: error.code,
-            category: error.category,
-            message: error.userMessage,
-            retryable: error.retryable,
-        };
-    }
-    return protocolError('CLI_INTERNAL_ERROR', 'The request could not be completed. Retry the request or inspect CLI diagnostics.', true);
-}
-function isCliErrorLike(value) {
-    if (typeof value !== 'object' || value === null)
-        return false;
-    const error = value;
-    return typeof error['code'] === 'string' && typeof error['category'] === 'string' && typeof error['userMessage'] === 'string' && typeof error['retryable'] === 'boolean';
-}
-class JsonlProtocolError extends Error {
-    payload;
-    constructor(payload) {
-        super(payload.message);
-        this.payload = payload;
-    }
-}
-class JsonlLimitError extends JsonlProtocolError {
-    constructor(message) { super(protocolError('JSONL_REQUEST_TOO_LARGE', message)); }
-}
-export async function* readLinesBounded(input, maxBytes) {
-    let parts = [];
-    let lineBytes = 0;
-    for await (const chunk of input) {
-        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        let start = 0;
-        while (start < buffer.byteLength) {
-            const newline = buffer.indexOf(0x0a, start);
-            const end = newline < 0 ? buffer.byteLength : newline;
-            const segment = buffer.subarray(start, end);
-            if (lineBytes + segment.byteLength > maxBytes)
-                throw new JsonlLimitError('Request line exceeds the maximum size.');
-            if (segment.byteLength > 0)
-                parts.push(segment);
-            lineBytes += segment.byteLength;
-            if (newline < 0)
-                break;
-            const line = Buffer.concat(parts, lineBytes);
-            const content = line[line.byteLength - 1] === 0x0d ? line.subarray(0, line.byteLength - 1) : line;
-            yield content.toString('utf8');
-            parts = [];
-            lineBytes = 0;
-            start = newline + 1;
-        }
-    }
-    if (lineBytes > 0)
-        yield Buffer.concat(parts, lineBytes).toString('utf8');
-}

package/dist/application/security/desktop-tool-scope-policy.d.ts

@@ -1,3 +0,0 @@
-import type { ToolApprovalRequest } from '@lotagate/agent-sdk';
-/** Matches Desktop's stable capability scopes against concrete CLI requests. */
-export declare function matchesDesktopToolScope(request: ToolApprovalRequest, scopes: readonly string[]): boolean;

package/dist/application/security/desktop-tool-scope-policy.js

@@ -1,52 +0,0 @@
-import { isReadOnlyShellRequest } from './tool-risk-classifier.js';
-/** Matches Desktop's stable capability scopes against concrete CLI requests. */
-export function matchesDesktopToolScope(request, scopes) {
-    return scopes.some((scope) => matchesScope(scope, request));
-}
-function matchesScope(scope, request) {
-    const toolName = request.toolName;
-    if (scope === toolName)
-        return true;
-    if (scope === 'filesystem.read')
-        return toolName === 'filesystem.read' || toolName === 'filesystem.list' || toolName === 'filesystem.exists';
-    if (scope === 'filesystem.write')
-        return toolName === 'filesystem.write';
-    if (toolName !== 'shell.exec')
-        return matchesBrowserScope(scope, toolName);
-    const command = shellCommand(request.input);
-    const args = shellArgs(request.input);
-    if (command === undefined || args === undefined)
-        return false;
-    if (scope === 'terminal.read')
-        return isReadOnlyShellRequest(command, args);
-    if (scope === 'terminal.execute')
-        return true;
-    if (!isGitCommand(command, args))
-        return false;
-    const subcommand = gitSubcommand(args);
-    if (scope === 'git.read')
-        return subcommand !== undefined && READ_ONLY_GIT_COMMANDS.has(subcommand) && isReadOnlyShellRequest(command, args);
-    if (scope === 'git.stage')
-        return subcommand === 'add';
-    if (scope === 'git.commit')
-        return subcommand === 'commit';
-    if (scope === 'git.push')
-        return subcommand === 'push';
-    return false;
-}
-function matchesBrowserScope(scope, toolName) {
-    if (!toolName.startsWith('browser.'))
-        return false;
-    if (scope === 'browser.navigate')
-        return ['browser.navigate', 'browser.back', 'browser.forward', 'browser.reload'].includes(toolName);
-    if (scope === 'browser.inspect')
-        return ['browser.inspect', 'browser.inspectElement', 'browser.console', 'browser.network', 'browser.accessibility', 'browser.setViewport', 'browser.resetViewport', 'browser.screenshot', 'browser.tabs', 'browser.readField'].includes(toolName);
-    if (scope === 'browser.interact')
-        return !['browser.navigate', 'browser.inspect', 'browser.inspectElement', 'browser.console', 'browser.network', 'browser.accessibility', 'browser.setViewport', 'browser.resetViewport', 'browser.screenshot', 'browser.tabs', 'browser.readField'].includes(toolName);
-    return false;
-}
-function shellCommand(input) { return typeof input['command'] === 'string' ? input['command'].trim() : undefined; }
-function shellArgs(input) { const args = input['args']; return Array.isArray(args) && args.every((value) => typeof value === 'string') ? args : undefined; }
-function isGitCommand(command, args) { return (command.split(/[\\/]/u).at(-1) ?? '').replace(/\.(?:exe|cmd|bat)$/iu, '').toLowerCase() === 'git' && gitSubcommand(args) !== undefined; }
-function gitSubcommand(args) { return args.find((value) => !value.startsWith('-'))?.toLowerCase(); }
-const READ_ONLY_GIT_COMMANDS = new Set(['status', 'diff', 'log', 'show', 'branch', 'tag', 'remote', 'rev-parse', 'ls-files']);

package/dist/application/security/tool-action-risk-analyzer.d.ts

@@ -1,13 +0,0 @@
-import type { ToolApprovalRequest } from '@lotagate/agent-sdk';
-export type ToolActionRisk = 'review' | 'deny';
-export interface ToolActionRiskAssessment {
-    risk: ToolActionRisk;
-    category: 'sensitive-target' | 'download-and-execute' | 'credential-exfiltration' | 'hidden-control-data';
-    reason: string;
-}
-/**
- * Performs a small, deterministic preflight at the CLI action boundary.
- * This is intentionally additive: the approval policy remains authoritative,
- * and the analyzer never treats a model-provided description as permission.
- */
-export declare function assessToolAction(request: ToolApprovalRequest): ToolActionRiskAssessment | undefined;

package/dist/application/security/tool-action-risk-analyzer.js

@@ -1,64 +0,0 @@
-/**
- * Performs a small, deterministic preflight at the CLI action boundary.
- * This is intentionally additive: the approval policy remains authoritative,
- * and the analyzer never treats a model-provided description as permission.
- */
-export function assessToolAction(request) {
-    const target = typeof request.input['path'] === 'string' ? request.input['path'].trim() : undefined;
-    if (target !== undefined && isSensitiveTarget(target)) {
-        return { risk: 'review', category: 'sensitive-target', reason: 'sensitive-target-review' };
-    }
-    const commandLine = shellCommandLine(request);
-    if (commandLine !== undefined) {
-        if (DOWNLOAD_AND_EXECUTE.test(commandLine))
-            return { risk: 'review', category: 'download-and-execute', reason: 'download-and-execute-review' };
-        if (CREDENTIAL_EXFILTRATION.test(commandLine))
-            return { risk: 'deny', category: 'credential-exfiltration', reason: 'credential-exfiltration-deny' };
-    }
-    if (containsHiddenControlData(request))
-        return { risk: 'review', category: 'hidden-control-data', reason: 'hidden-control-data-review' };
-    return undefined;
-}
-function shellCommandLine(request) {
-    if (request.toolName !== 'shell.exec')
-        return undefined;
-    const command = request.input['command'];
-    const args = request.input['args'];
-    if (typeof command !== 'string' || !Array.isArray(args) || args.some((value) => typeof value !== 'string'))
-        return undefined;
-    return [command, ...args].join(' ');
-}
-function isSensitiveTarget(target) {
-    const normalized = target.replace(/\\/gu, '/').toLowerCase();
-    return normalized === '.env'
-        || normalized.endsWith('/.env')
-        || normalized.includes('/.git/config')
-        || normalized.includes('/.git/credentials')
-        || normalized.includes('/.lotagate/auth')
-        || normalized.includes('/.lotagate/credentials')
-        || normalized.includes('/.codex/auth')
-        || normalized.includes('/.ssh/')
-        || normalized.endsWith('/id_rsa')
-        || normalized.endsWith('/id_ed25519');
-}
-function containsHiddenControlData(request) {
-    return flattenStrings(request.input).some((value) => [...value].some((character) => HIDDEN_CONTROL_POINTS.has(character.codePointAt(0) ?? 0)));
-}
-function flattenStrings(value) {
-    if (typeof value === 'string')
-        return [value];
-    if (Array.isArray(value))
-        return value.flatMap(flattenStrings);
-    if (value !== null && typeof value === 'object')
-        return Object.values(value).flatMap(flattenStrings);
-    return [];
-}
-const DOWNLOAD_AND_EXECUTE = /(?:curl|wget|invoke-webrequest|irm)\b[^\n|]*\|\s*(?:sh|bash|zsh|pwsh|powershell|cmd)\b|(?:powershell|pwsh)\b[^\n]*-(?:enc|encodedcommand)\b|\b(?:invoke-expression|iex)\b/iu;
-const CREDENTIAL_EXFILTRATION = /(?:curl|wget|invoke-webrequest|irm)\b[^\n]*(?:api[_-]?key|token|secret|password|credential|\.env|process\.env|\$env:)/iu;
-const HIDDEN_CONTROL_POINTS = new Set([
-    0x061c,
-    0x200b, 0x200c, 0x200d, 0x200e, 0x200f,
-    0x202a, 0x202b, 0x202c, 0x202d, 0x202e,
-    0x2060, 0x2061, 0x2062, 0x2063, 0x2064, 0x2066, 0x2067, 0x2069, 0x206a, 0x206b, 0x206c, 0x206d, 0x206e, 0x206f,
-    0xfeff,
-]);

package/dist/application/security/tool-approval-service.d.ts

@@ -1,35 +0,0 @@
-import type { ToolApprovalRequest, ToolPolicyOptions } from '@lotagate/agent-sdk';
-import type { SkillScopeStore } from '../extensions/skill-scope-store.js';
-import type { WorkspacePermissionPolicy } from '../../domain/workspace/workspace-settings.js';
-export type CliApprovalMode = 'ask' | 'auto' | 'deny' | 'review' | 'autonomous';
-export interface ToolApprovalServiceOptions {
-    mode: CliApprovalMode;
-    trustedProject: boolean;
-    prompt?: (request: ToolApprovalRequest) => boolean | Promise<boolean>;
-    rememberApproval?: (request: ToolApprovalRequest) => void | Promise<void>;
-    onRememberApprovalFailure?: (request: ToolApprovalRequest, error: unknown) => void | Promise<void>;
-    audit?: (decision: ToolApprovalDecision) => void | Promise<void>;
-    skillScopes?: SkillScopeStore;
-    workspacePermissions?: WorkspacePermissionPolicy;
-    desktopToolScopes?: readonly string[];
-}
-export interface ToolApprovalDecision {
-    toolName: string;
-    source?: string;
-    decision: 'allow' | 'deny';
-    reason: string;
-    skillName?: string;
-    riskCategory?: string;
-}
-export declare class ToolApprovalService {
-    private readonly options;
-    constructor(options: ToolApprovalServiceOptions);
-    policy(): Pick<ToolPolicyOptions, 'authorizationRules' | 'authorizationObserver' | 'requireApproval' | 'approvalHandler'>;
-    private authorizeDesktopScope;
-    private authorizeWorkspace;
-    private authorizeActionRisk;
-    private authorizeSkill;
-    private requestApproval;
-    private rememberApproval;
-    private observe;
-}

package/dist/application/security/tool-approval-service.js

@@ -1,97 +0,0 @@
-import { requiresMutationApproval } from './tool-risk-classifier.js';
-import { assessToolAction } from './tool-action-risk-analyzer.js';
-import { workspacePermissionDecision } from './workspace-permission-policy.js';
-import { matchesDesktopToolScope } from './desktop-tool-scope-policy.js';
-export class ToolApprovalService {
-    options;
-    constructor(options) {
-        this.options = options;
-    }
-    policy() {
-        const authorizationRules = [
-            ...(this.options.desktopToolScopes === undefined ? [] : [{ id: 'desktop-tool-scope', authorize: (request) => this.authorizeDesktopScope(request) }]),
-            ...(this.options.skillScopes === undefined ? [] : [{ id: 'cli-skill-scope', authorize: (request) => this.authorizeSkill(request) }]),
-            { id: 'cli-action-risk', authorize: (request) => this.authorizeActionRisk(request) },
-            { id: 'cli-workspace-policy', authorize: (request) => this.authorizeWorkspace(request) },
-        ];
-        return {
-            authorizationRules,
-            authorizationObserver: (event) => this.observe(event),
-            // Agent SDK's approval flag applies to every tool invocation. Keep the
-            // decision in the CLI authorization rule so read-only filesystem tools
-            // remain non-interactive while mutations retain an explicit prompt.
-            requireApproval: false,
-        };
-    }
-    authorizeDesktopScope(request) {
-        return matchesDesktopToolScope(request, this.options.desktopToolScopes ?? [])
-            ? { decision: 'allow', reason: 'desktop-tool-scope-allow' }
-            : { decision: 'deny', reason: 'desktop-tool-scope-deny' };
-    }
-    async authorizeWorkspace(request) {
-        if (!this.options.trustedProject)
-            return { decision: 'deny', reason: 'project-untrusted' };
-        if (this.options.mode === 'deny')
-            return { decision: 'deny', reason: 'mode-deny' };
-        if (this.options.mode === 'review')
-            return this.requestApproval(request, 'review-policy');
-        const configured = this.options.workspacePermissions === undefined
-            ? undefined
-            : workspacePermissionDecision(this.options.workspacePermissions, request.toolName, request.input);
-        if (configured === 'deny')
-            return { decision: 'deny', reason: 'workspace-policy-deny' };
-        if (configured === 'allow')
-            return { decision: 'allow', reason: 'workspace-policy-allow' };
-        if (configured === 'ask')
-            return this.requestApproval(request, 'workspace-policy-ask');
-        if (requiresMutationApproval(request) && this.options.mode !== 'autonomous')
-            return this.requestApproval(request, 'mutation-approval');
-        return { decision: 'allow', reason: this.options.mode === 'auto' ? 'mode-auto' : 'read-only' };
-    }
-    async authorizeActionRisk(request) {
-        const assessment = assessToolAction(request);
-        if (assessment === undefined)
-            return { decision: 'allow', reason: 'action-risk-clear' };
-        if (assessment.risk === 'deny')
-            return { decision: 'deny', reason: assessment.reason, metadata: { riskCategory: assessment.category } };
-        const approved = await this.options.prompt?.(request) ?? false;
-        return approved
-            ? { decision: 'allow', reason: `${assessment.reason}-allow`, metadata: { riskCategory: assessment.category } }
-            : { decision: 'deny', reason: `${assessment.reason}-deny`, metadata: { riskCategory: assessment.category } };
-    }
-    authorizeSkill(request) {
-        const scope = this.options.skillScopes?.get(request.context.runId);
-        if (scope === undefined || isSkillControlTool(request.toolName))
-            return { decision: 'allow', reason: 'skill-policy-not-active' };
-        if (!scope.allowedTools.includes(request.toolName))
-            return { decision: 'deny', reason: 'skill-policy-deny', metadata: { skillName: scope.skillName } };
-        return { decision: 'allow', reason: 'skill-policy-allow', metadata: { skillName: scope.skillName } };
-    }
-    async requestApproval(request, reason) {
-        const approved = await this.options.prompt?.(request) ?? false;
-        if (approved)
-            await this.rememberApproval(request);
-        return approved
-            ? { decision: 'allow', reason: `${reason}-allow` }
-            : { decision: 'deny', reason: `${reason}-deny` };
-    }
-    async rememberApproval(request) {
-        try {
-            await this.options.rememberApproval?.(request);
-        }
-        catch (error) {
-            try {
-                await this.options.onRememberApprovalFailure?.(request, error);
-            }
-            catch { /* Observability must not turn an already-approved action into a failed action. */ }
-        }
-    }
-    async observe(event) {
-        const skillName = typeof event.metadata?.['skillName'] === 'string' ? event.metadata['skillName'] : undefined;
-        const riskCategory = typeof event.metadata?.['riskCategory'] === 'string' ? event.metadata['riskCategory'] : undefined;
-        await this.options.audit?.({ toolName: event.toolName, ...(event.source === undefined ? {} : { source: event.source }), decision: event.decision, reason: event.reason, ...(skillName === undefined ? {} : { skillName }), ...(riskCategory === undefined ? {} : { riskCategory }) });
-    }
-}
-function isSkillControlTool(toolName) {
-    return toolName === 'skill.list' || toolName === 'skill.load';
-}

package/dist/application/security/tool-risk-classifier.d.ts

@@ -1,11 +0,0 @@
-import type { ToolApprovalRequest } from '@lotagate/agent-sdk';
-export type ToolRisk = 'read' | 'write' | 'unknown';
-/** Classifies a tool request conservatively before it crosses the approval boundary. */
-export declare function classifyToolRisk(request: ToolApprovalRequest): ToolRisk;
-export declare function requiresMutationApproval(request: ToolApprovalRequest): boolean;
-/**
- * Returns true only for commands whose executable and arguments are known not
- * to mutate files or execute a helper. Unknown shell invocations deliberately
- * require approval instead of relying on an executable-name allowlist.
- */
-export declare function isReadOnlyShellRequest(commandValue: unknown, inputArgs: unknown): boolean;

package/dist/application/security/tool-risk-classifier.js

@@ -1,65 +0,0 @@
-/** Classifies a tool request conservatively before it crosses the approval boundary. */
-export function classifyToolRisk(request) {
-    const declared = request.toolInfo?.metadata?.['risk'];
-    if ((request.toolInfo?.source === 'filesystem' || request.toolInfo?.executorId === 'desktop-browser-host') && (declared === 'read' || declared === 'write' || declared === 'unknown'))
-        return declared;
-    if (request.toolName === 'filesystem.read' || request.toolName === 'filesystem.list' || request.toolName === 'filesystem.exists' || request.toolName === 'skill.list' || request.toolName === 'skill.load' || request.toolName === 'agent.wait')
-        return 'read';
-    if (request.toolName === 'agent.spawn')
-        return request.input['mode'] === 'worker' ? 'unknown' : 'read';
-    if (request.toolName === 'filesystem.write' || /(?:^|[._-])(delete|remove|move|copy|rename)(?:$|[._-])/iu.test(request.toolName))
-        return 'write';
-    if (request.toolName === 'shell.exec')
-        return isReadOnlyShellRequest(request.input['command'], request.input['args']) ? 'read' : 'unknown';
-    return 'unknown';
-}
-export function requiresMutationApproval(request) {
-    return classifyToolRisk(request) !== 'read';
-}
-/**
- * Returns true only for commands whose executable and arguments are known not
- * to mutate files or execute a helper. Unknown shell invocations deliberately
- * require approval instead of relying on an executable-name allowlist.
- */
-export function isReadOnlyShellRequest(commandValue, inputArgs) {
-    if (typeof commandValue !== 'string' || !Array.isArray(inputArgs) || inputArgs.some((value) => typeof value !== 'string'))
-        return false;
-    const command = commandValue.trim();
-    const args = inputArgs;
-    const executable = command.split(/[\\/]/u).at(-1)?.toLowerCase().replace(/\.(?:exe|cmd|bat|ps1)$/u, '') ?? '';
-    const normalizedArgs = args.map((value) => value.toLowerCase());
-    if (READ_ONLY_EXECUTABLES.has(executable))
-        return !containsUnsafeReadOnlyFlag(executable, normalizedArgs);
-    return executable === 'git' && isReadOnlyGit(normalizedArgs);
-}
-function isReadOnlyGit(args) {
-    if (args.some((value) => GIT_GLOBAL_EXECUTION_FLAGS.has(value) || value.startsWith('--config-env=') || value.startsWith('-c')))
-        return false;
-    const subcommand = args.find((value) => !value.startsWith('-'));
-    if (subcommand === undefined || !READ_ONLY_GIT_COMMANDS.has(subcommand))
-        return false;
-    if (args.some((value) => MUTATING_GIT_FLAGS.has(value)))
-        return false;
-    if ((subcommand === 'remote' || subcommand === 'tag') && args.some((value) => MUTATING_GIT_SUBCOMMANDS.has(value)))
-        return false;
-    const subcommandIndex = args.indexOf(subcommand);
-    const trailing = args.slice(subcommandIndex + 1).filter((value) => !value.startsWith('-'));
-    if ((subcommand === 'branch' || subcommand === 'tag' || subcommand === 'remote') && trailing.length > 0)
-        return false;
-    if (args.some((value) => GIT_UNSAFE_READ_FLAGS.has(value) || value.startsWith('--output=')))
-        return false;
-    return true;
-}
-const READ_ONLY_EXECUTABLES = new Set([
-    'cat', 'type', 'more', 'head', 'tail', 'rg', 'grep', 'ls', 'dir', 'pwd', 'where', 'which', 'stat', 'wc', 'uniq', 'file',
-]);
-const READ_ONLY_GIT_COMMANDS = new Set(['status', 'diff', 'log', 'show', 'branch', 'tag', 'remote', 'rev-parse', 'ls-files']);
-const MUTATING_GIT_FLAGS = new Set(['-d', '-D', '-m', '-M', '-c', '-C', '--delete', '--move', '--force', '--unset-upstream']);
-const MUTATING_GIT_SUBCOMMANDS = new Set(['add', 'remove', 'rename', 'set-url', 'set-head', 'delete', '-d']);
-const GIT_GLOBAL_EXECUTION_FLAGS = new Set(['-c', '--config-env', '--exec-path']);
-const GIT_UNSAFE_READ_FLAGS = new Set(['-o', '--output', '--ext-diff', '--textconv']);
-function containsUnsafeReadOnlyFlag(executable, args) {
-    if (executable === 'rg')
-        return args.some((value) => value === '--pre' || value.startsWith('--pre='));
-    return false;
-}

package/dist/application/security/workspace-permission-policy.d.ts

@@ -1,10 +0,0 @@
-import type { WorkspacePermissionPolicy } from '../../domain/workspace/workspace-settings.js';
-export declare function workspacePermissionDecision(policy: WorkspacePermissionPolicy, toolName: string, input: Readonly<Record<string, unknown>>): 'allow' | 'ask' | 'deny' | undefined;
-/**
- * Returns the narrowest readable rule that represents an approved request.
- * File operations are scoped to their path. Shell operations are scoped to
- * the executable and its first subcommand so approval does not persist raw
- * arguments (which may contain secrets or large file contents). Generated
- * rules are exact; wildcard rules remain an explicit user configuration.
- */
-export declare function permissionRuleForRequest(toolName: string, input: Readonly<Record<string, unknown>>): string;

package/dist/application/security/workspace-permission-policy.js

@@ -1,50 +0,0 @@
-export function workspacePermissionDecision(policy, toolName, input) {
-    const candidates = permissionCandidates(toolName, input);
-    if (policy.deny.some((rule) => candidates.some((candidate) => matches(rule, candidate))))
-        return 'deny';
-    if (policy.ask.some((rule) => candidates.some((candidate) => matches(rule, candidate))))
-        return 'ask';
-    if (policy.allow.some((rule) => candidates.some((candidate) => matches(rule, candidate))))
-        return 'allow';
-    return undefined;
-}
-/**
- * Returns the narrowest readable rule that represents an approved request.
- * File operations are scoped to their path. Shell operations are scoped to
- * the executable and its first subcommand so approval does not persist raw
- * arguments (which may contain secrets or large file contents). Generated
- * rules are exact; wildcard rules remain an explicit user configuration.
- */
-export function permissionRuleForRequest(toolName, input) {
-    if (typeof input['path'] === 'string' && input['path'].trim().length > 0) {
-        return `${toolName}:${input['path'].trim()}`;
-    }
-    if (typeof input['command'] === 'string' && input['command'].trim().length > 0) {
-        const command = input['command'].trim();
-        const args = Array.isArray(input['args']) ? input['args'].filter((value) => typeof value === 'string' && value.trim().length > 0) : [];
-        const subcommand = args.find((value) => !value.startsWith('-'))?.trim();
-        return `${toolName}:${command}${subcommand === undefined ? '' : ` ${subcommand}`}`;
-    }
-    return toolName;
-}
-function permissionCandidates(toolName, input) {
-    const candidates = [toolName];
-    if (typeof input['command'] === 'string') {
-        const args = Array.isArray(input['args']) ? input['args'].filter((value) => typeof value === 'string') : [];
-        candidates.push(`${toolName}:${input['command']}${args.length === 0 ? '' : ` ${args.join(' ')}`}`);
-        const subcommand = args.find((value) => !value.startsWith('-'));
-        if (subcommand !== undefined)
-            candidates.push(`${toolName}:${input['command']} ${subcommand}`);
-    }
-    if (typeof input['path'] === 'string')
-        candidates.push(`${toolName}:${input['path']}`);
-    return candidates;
-}
-function matches(rule, candidate) {
-    if (rule === candidate)
-        return true;
-    if (!rule.includes('*'))
-        return false;
-    const escaped = rule.replace(/[.+?^${}()|[\]\\]/gu, '\\$&').replaceAll('*', '.*');
-    return new RegExp(`^${escaped}$`, 'u').test(candidate);
-}

package/dist/application/session/project-session-access.d.ts

@@ -1,8 +0,0 @@
-import type { SessionMetadata } from '../../domain/session/session.js';
-import type { SessionStore } from '../../ports/session-store.js';
-/** Enforces project ownership before a session can be read or mutated. */
-export declare class ProjectSessionAccess {
-    private readonly sessionStore;
-    constructor(sessionStore: SessionStore);
-    require(sessionId: string, projectFingerprint: string): Promise<SessionMetadata>;
-}