@lydia-agent/core 0.1.0 → 0.1.2

package/dist/index.js

@@ -529,6 +529,8 @@ var StrategyRegistry = class {
       // User Home
       path.join(os.homedir(), ".lydia", "strategies", "default.yml"),
       // Package Built-in
+      path.resolve(__dirname2, "../strategies/base-v1.yml"),
+      // Package Built-in (older path assumption)
       path.resolve(__dirname2, "../../strategies/base-v1.yml"),
       // Package Built-in (dev/src)
       path.resolve(__dirname2, "../../../strategies/base-v1.yml")
@@ -590,17 +592,20 @@ var StrategyRegistry = class {
 
 // src/strategy/approval-service.ts
 import * as os2 from "os";
-import * as path2 from "path";
+import * as path3 from "path";
 
 // src/memory/manager.ts
 import Database from "better-sqlite3";
 import { EventEmitter } from "events";
+import * as fs2 from "fs";
+import * as path2 from "path";
 var MemoryManager = class extends EventEmitter {
   db;
   checkpointTtlMs;
   observationFrameTtlMs;
   constructor(dbPath, options = {}) {
     super();
+    fs2.mkdirSync(path2.dirname(dbPath), { recursive: true });
     this.db = new Database(dbPath);
     this.checkpointTtlMs = options.checkpointTtlMs ?? 24 * 60 * 60 * 1e3;
     this.observationFrameTtlMs = options.observationFrameTtlMs ?? 24 * 7 * 60 * 60 * 1e3;
@@ -1484,7 +1489,7 @@ var StrategyApprovalService = class {
     if (memoryManager) {
       this.memory = memoryManager;
     } else {
-      const dbPath = path2.join(os2.homedir(), ".lydia", "memory.db");
+      const dbPath = path3.join(os2.homedir(), ".lydia", "memory.db");
       this.memory = new MemoryManager(dbPath);
     }
     this.configLoader = configLoader || new ConfigLoader();
@@ -1545,7 +1550,7 @@ var StrategyApprovalService = class {
 };
 
 // src/strategy/shadow-router.ts
-import * as path3 from "path";
+import * as path4 from "path";
 import * as os3 from "os";
 var ShadowRouter = class {
   memory;
@@ -1555,7 +1560,7 @@ var ShadowRouter = class {
     if (memoryManager) {
       this.memory = memoryManager;
     } else {
-      const dbPath = path3.join(os3.homedir(), ".lydia", "memory.db");
+      const dbPath = path4.join(os3.homedir(), ".lydia", "memory.db");
       this.memory = new MemoryManager(dbPath);
     }
     this.registry = strategyRegistry || new StrategyRegistry();
@@ -1826,39 +1831,39 @@ var StrategyReviewer = class {
 };
 
 // src/strategy/branch-manager.ts
-import * as fs2 from "fs/promises";
-import * as path4 from "path";
+import * as fs3 from "fs/promises";
+import * as path5 from "path";
 import * as os4 from "os";
 import { parse as parseYaml2, stringify as stringifyYaml2 } from "yaml";
 var StrategyBranchManager = class {
   baseDir;
   constructor(baseDir) {
-    this.baseDir = baseDir || path4.join(os4.homedir(), ".lydia", "strategies");
+    this.baseDir = baseDir || path5.join(os4.homedir(), ".lydia", "strategies");
   }
   async init() {
-    await fs2.mkdir(this.baseDir, { recursive: true });
-    await fs2.mkdir(path4.join(this.baseDir, "branches"), { recursive: true });
-    await fs2.mkdir(path4.join(this.baseDir, "archive"), { recursive: true });
+    await fs3.mkdir(this.baseDir, { recursive: true });
+    await fs3.mkdir(path5.join(this.baseDir, "branches"), { recursive: true });
+    await fs3.mkdir(path5.join(this.baseDir, "archive"), { recursive: true });
   }
   async listBranches() {
-    const branchesDir = path4.join(this.baseDir, "branches");
+    const branchesDir = path5.join(this.baseDir, "branches");
     try {
-      const entries = await fs2.readdir(branchesDir, { withFileTypes: true });
+      const entries = await fs3.readdir(branchesDir, { withFileTypes: true });
       const branches = [];
       for (const entry of entries) {
         if (!entry.isDirectory()) continue;
       }
-      const files = await fs2.readdir(branchesDir);
+      const files = await fs3.readdir(branchesDir);
       for (const file of files) {
         if (!file.endsWith(".yml")) continue;
-        const content = await fs2.readFile(path4.join(branchesDir, file), "utf-8");
+        const content = await fs3.readFile(path5.join(branchesDir, file), "utf-8");
         try {
           const strategy = StrategySchema.parse(parseYaml2(content));
           branches.push({
             name: strategy.metadata.id,
             // ID is used as branch name effectively
             version: strategy.metadata.version,
-            path: path4.join(branchesDir, file),
+            path: path5.join(branchesDir, file),
             parent: strategy.metadata.inheritFrom,
             createdAt: Date.now()
             // We might want to store this in metadata later
@@ -1874,8 +1879,8 @@ var StrategyBranchManager = class {
     }
   }
   async createBranch(sourceStrategy, newBranchName, modifications) {
-    const targetDir = path4.join(this.baseDir, "branches");
-    await fs2.mkdir(targetDir, { recursive: true });
+    const targetDir = path5.join(this.baseDir, "branches");
+    await fs3.mkdir(targetDir, { recursive: true });
     const newStrategy = {
       ...sourceStrategy,
       ...modifications,
@@ -1889,14 +1894,14 @@ var StrategyBranchManager = class {
         ...modifications.metadata
       }
     };
-    const filePath = path4.join(targetDir, `${newBranchName}.yml`);
-    await fs2.writeFile(filePath, stringifyYaml2(newStrategy), "utf-8");
+    const filePath = path5.join(targetDir, `${newBranchName}.yml`);
+    await fs3.writeFile(filePath, stringifyYaml2(newStrategy), "utf-8");
     return newStrategy;
   }
   async getBranch(branchName) {
-    const filePath = path4.join(this.baseDir, "branches", `${branchName}.yml`);
+    const filePath = path5.join(this.baseDir, "branches", `${branchName}.yml`);
     try {
-      const content = await fs2.readFile(filePath, "utf-8");
+      const content = await fs3.readFile(filePath, "utf-8");
       return StrategySchema.parse(parseYaml2(content));
     } catch {
       return null;
@@ -1907,12 +1912,12 @@ var StrategyBranchManager = class {
     if (!branch) throw new Error(`Branch ${branchName} not found`);
     const parentId = branch.metadata.inheritFrom;
     if (!parentId) throw new Error("Branch has no parent to merge into");
-    const files = await fs2.readdir(this.baseDir);
+    const files = await fs3.readdir(this.baseDir);
     let parentFile = null;
     for (const file of files) {
       if (file === "branches" || file === "archive") continue;
       try {
-        const content = await fs2.readFile(path4.join(this.baseDir, file), "utf-8");
+        const content = await fs3.readFile(path5.join(this.baseDir, file), "utf-8");
         const data = parseYaml2(content);
         if (data.metadata?.id === parentId) {
           parentFile = file;
@@ -1924,18 +1929,18 @@ var StrategyBranchManager = class {
     if (!parentFile) {
       throw new Error(`Parent strategy ${parentId} not found in ${this.baseDir}`);
     }
-    const parentPath = path4.join(this.baseDir, parentFile);
-    await fs2.copyFile(parentPath, path4.join(this.baseDir, "archive", `${parentId}-${Date.now()}.bak.yml`));
+    const parentPath = path5.join(this.baseDir, parentFile);
+    await fs3.copyFile(parentPath, path5.join(this.baseDir, "archive", `${parentId}-${Date.now()}.bak.yml`));
     const start = Date.now();
-    const branchContent = await fs2.readFile(path4.join(this.baseDir, "branches", `${branchName}.yml`), "utf-8");
-    await fs2.writeFile(parentPath, branchContent, "utf-8");
+    const branchContent = await fs3.readFile(path5.join(this.baseDir, "branches", `${branchName}.yml`), "utf-8");
+    await fs3.writeFile(parentPath, branchContent, "utf-8");
     await this.archiveBranch(branchName);
   }
   async archiveBranch(branchName) {
-    const srcPath = path4.join(this.baseDir, "branches", `${branchName}.yml`);
-    const destPath = path4.join(this.baseDir, "archive", `${branchName}-${Date.now()}.yml`);
+    const srcPath = path5.join(this.baseDir, "branches", `${branchName}.yml`);
+    const destPath = path5.join(this.baseDir, "archive", `${branchName}-${Date.now()}.yml`);
     try {
-      await fs2.rename(srcPath, destPath);
+      await fs3.rename(srcPath, destPath);
     } catch (e) {
       console.error(`Failed to archive branch ${branchName}:`, e);
       throw e;
@@ -2198,11 +2203,11 @@ var SkillRegistry = class {
 };
 
 // src/skills/loader.ts
-import * as fs3 from "fs/promises";
-import * as path5 from "path";
+import * as fs4 from "fs/promises";
+import * as path6 from "path";
 import * as os5 from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
-var __dirname3 = path5.dirname(fileURLToPath2(import.meta.url));
+var __dirname3 = path6.dirname(fileURLToPath2(import.meta.url));
 var SkillLoader = class {
   registry;
   /** Ordered list of directories to scan for skills */
@@ -2217,13 +2222,13 @@ var SkillLoader = class {
   getDirectories(extraDirs = []) {
     return [
       // 1. Built-in skills (relative to this file in dist/skills)
-      path5.resolve(__dirname3, "../../skills"),
+      path6.resolve(__dirname3, "../../skills"),
       // 1.5 Built-in skills in source tree (dev mode)
-      path5.resolve(__dirname3, "../skills"),
+      path6.resolve(__dirname3, "../skills"),
       // 2. User global skills
-      path5.join(os5.homedir(), ".lydia", "skills"),
+      path6.join(os5.homedir(), ".lydia", "skills"),
       // 3. Project local skills
-      path5.join(process.cwd(), ".lydia", "skills"),
+      path6.join(process.cwd(), ".lydia", "skills"),
       // 4. Extra directories from config
       ...extraDirs
     ];
@@ -2244,11 +2249,11 @@ var SkillLoader = class {
    */
   async loadMetadataFromDirectory(dirPath) {
     try {
-      const stats = await fs3.stat(dirPath);
+      const stats = await fs4.stat(dirPath);
       if (!stats.isDirectory()) return;
-      const entries = await fs3.readdir(dirPath, { withFileTypes: true });
+      const entries = await fs4.readdir(dirPath, { withFileTypes: true });
       for (const entry of entries) {
-        const fullPath = path5.join(dirPath, entry.name);
+        const fullPath = path6.join(dirPath, entry.name);
         if (entry.isDirectory()) {
           await this.loadMetadataFromDirectory(fullPath);
         } else if (entry.isFile() && entry.name.endsWith(".md")) {
@@ -2264,7 +2269,7 @@ var SkillLoader = class {
    */
   async loadSkillMeta(filePath) {
     try {
-      const content = await fs3.readFile(filePath, "utf-8");
+      const content = await fs4.readFile(filePath, "utf-8");
       if (content.startsWith("---")) {
         const meta = SkillParser.parseMeta(content, filePath);
         this.registry.register(meta);
@@ -2285,7 +2290,7 @@ var SkillLoader = class {
     const meta = this.registry.get(name);
     if (!meta?.path) return null;
     try {
-      const fileContent = await fs3.readFile(meta.path, "utf-8");
+      const fileContent = await fs4.readFile(meta.path, "utf-8");
       const skill = SkillParser.parse(fileContent, meta.path);
       return skill.content;
     } catch (error) {
@@ -2301,7 +2306,7 @@ var SkillLoader = class {
     const meta = this.registry.get(name);
     if (!meta?.path) return null;
     try {
-      const fileContent = await fs3.readFile(meta.path, "utf-8");
+      const fileContent = await fs4.readFile(meta.path, "utf-8");
       return SkillParser.parse(fileContent, meta.path);
     } catch (error) {
       console.warn(`Failed to load full skill "${name}":`, error);
@@ -2314,7 +2319,7 @@ var SkillLoader = class {
    */
   async reloadSkillMeta(filePath) {
     try {
-      const content = await fs3.readFile(filePath, "utf-8");
+      const content = await fs4.readFile(filePath, "utf-8");
       if (content.startsWith("---")) {
         const meta = SkillParser.parseMeta(content, filePath);
         this.registry.register(meta);
@@ -2329,9 +2334,9 @@ var SkillLoader = class {
 
 // src/skills/watcher.ts
 import { EventEmitter as EventEmitter2 } from "events";
-import * as fs4 from "fs";
+import * as fs5 from "fs";
 import * as fsPromises from "fs/promises";
-import * as path6 from "path";
+import * as path7 from "path";
 var SkillWatcher = class extends EventEmitter2 {
   constructor(directories, registry, loader, options) {
     super();
@@ -2341,7 +2346,7 @@ var SkillWatcher = class extends EventEmitter2 {
     this.debounceMs = options?.debounceMs ?? 300;
     for (const skill of this.registry.list()) {
       if (skill.path) {
-        this.pathToName.set(path6.resolve(skill.path), skill.name);
+        this.pathToName.set(path7.resolve(skill.path), skill.name);
       }
     }
   }
@@ -2380,12 +2385,12 @@ var SkillWatcher = class extends EventEmitter2 {
   }
   watchDirectory(dirPath) {
     try {
-      if (!fs4.existsSync(dirPath) || !fs4.statSync(dirPath).isDirectory()) {
+      if (!fs5.existsSync(dirPath) || !fs5.statSync(dirPath).isDirectory()) {
         return;
       }
-      const watcher = fs4.watch(dirPath, { recursive: true }, (eventType, filename) => {
+      const watcher = fs5.watch(dirPath, { recursive: true }, (eventType, filename) => {
         if (!filename) return;
-        const fullPath = path6.resolve(dirPath, filename);
+        const fullPath = path7.resolve(dirPath, filename);
         if (!filename.endsWith(".md")) return;
         this.handleFileChange(fullPath, eventType);
       });
@@ -2397,7 +2402,7 @@ var SkillWatcher = class extends EventEmitter2 {
     }
   }
   handleFileChange(filePath, _eventType) {
-    const resolvedPath = path6.resolve(filePath);
+    const resolvedPath = path7.resolve(filePath);
     const existingTimer = this.debounceTimers.get(resolvedPath);
     if (existingTimer) {
       clearTimeout(existingTimer);
@@ -2454,7 +2459,7 @@ var ShellServer = class {
     this.server = new Server(
       {
         name: "internal-shell",
-        version: "0.1.0"
+        version: "0.1.2"
       },
       {
         capabilities: {
@@ -2521,18 +2526,18 @@ ${error.stderr || ""}`
 // src/mcp/servers/filesystem.ts
 import { Server as Server2 } from "@modelcontextprotocol/sdk/server/index.js";
 import { CallToolRequestSchema as CallToolRequestSchema2, ListToolsRequestSchema as ListToolsRequestSchema2 } from "@modelcontextprotocol/sdk/types.js";
-import * as fs5 from "fs/promises";
-import * as path7 from "path";
+import * as fs6 from "fs/promises";
+import * as path8 from "path";
 import { gunzipSync, gzipSync } from "zlib";
 var FileSystemServer = class {
   server;
   allowedRootDir;
   constructor(allowedRootDir = process.cwd()) {
-    this.allowedRootDir = path7.resolve(allowedRootDir);
+    this.allowedRootDir = path8.resolve(allowedRootDir);
     this.server = new Server2(
       {
         name: "internal-fs",
-        version: "0.1.0"
+        version: "0.1.2"
       },
       {
         capabilities: {
@@ -2543,7 +2548,7 @@ var FileSystemServer = class {
     this.setupHandlers();
   }
   validatePath(requestedPath) {
-    const resolvedPath = path7.resolve(this.allowedRootDir, requestedPath);
+    const resolvedPath = path8.resolve(this.allowedRootDir, requestedPath);
     const root = process.platform === "win32" ? this.allowedRootDir.toLowerCase() : this.allowedRootDir;
     const target = process.platform === "win32" ? resolvedPath.toLowerCase() : resolvedPath;
     if (!target.startsWith(root)) {
@@ -2665,22 +2670,22 @@ var FileSystemServer = class {
         switch (request.params.name) {
           case "fs_read_file": {
             const filePath = this.validatePath(args.path);
-            const content = await fs5.readFile(filePath, "utf-8");
+            const content = await fs6.readFile(filePath, "utf-8");
             return {
               content: [{ type: "text", text: content }]
             };
           }
           case "fs_write_file": {
             const filePath = this.validatePath(args.path);
-            await fs5.mkdir(path7.dirname(filePath), { recursive: true });
-            await fs5.writeFile(filePath, args.content, "utf-8");
+            await fs6.mkdir(path8.dirname(filePath), { recursive: true });
+            await fs6.writeFile(filePath, args.content, "utf-8");
             return {
               content: [{ type: "text", text: `Successfully wrote to ${filePath}` }]
             };
           }
           case "fs_list_directory": {
             const dirPath = this.validatePath(args.path);
-            const entries = await fs5.readdir(dirPath, { withFileTypes: true });
+            const entries = await fs6.readdir(dirPath, { withFileTypes: true });
             const list = entries.map((e) => `${e.isDirectory() ? "[DIR]" : "[FILE]"} ${e.name}`).join("\n");
             return {
               content: [{ type: "text", text: list }]
@@ -2691,8 +2696,8 @@ var FileSystemServer = class {
             const toPath = this.validatePath(args.to);
             const overwrite = Boolean(args.overwrite);
             await this.ensureDestWritable(toPath, overwrite);
-            await fs5.mkdir(path7.dirname(toPath), { recursive: true });
-            await fs5.copyFile(fromPath, toPath);
+            await fs6.mkdir(path8.dirname(toPath), { recursive: true });
+            await fs6.copyFile(fromPath, toPath);
             return {
               content: [{ type: "text", text: `Successfully copied ${fromPath} -> ${toPath}` }]
             };
@@ -2702,7 +2707,7 @@ var FileSystemServer = class {
             const toPath = this.validatePath(args.to);
             const overwrite = Boolean(args.overwrite);
             await this.ensureDestWritable(toPath, overwrite);
-            await fs5.mkdir(path7.dirname(toPath), { recursive: true });
+            await fs6.mkdir(path8.dirname(toPath), { recursive: true });
             await this.moveFile(fromPath, toPath);
             return {
               content: [{ type: "text", text: `Successfully moved ${fromPath} -> ${toPath}` }]
@@ -2724,9 +2729,9 @@ var FileSystemServer = class {
             const overwrite = Boolean(args.overwrite);
             const maxBytes = Math.max(1024, Number(args.maxBytes) || 20 * 1024 * 1024);
             await this.ensureDestWritable(outputPath, overwrite);
-            await fs5.mkdir(path7.dirname(outputPath), { recursive: true });
+            await fs6.mkdir(path8.dirname(outputPath), { recursive: true });
             const bundle = await this.createArchiveBundle(sourcePath, maxBytes);
-            await fs5.writeFile(outputPath, bundle.buffer);
+            await fs6.writeFile(outputPath, bundle.buffer);
             return {
               content: [{ type: "text", text: `Successfully archived ${bundle.fileCount} file(s) to ${outputPath}` }]
             };
@@ -2736,7 +2741,7 @@ var FileSystemServer = class {
             const outputDir = this.validatePath(args.outputDir);
             const overwrite = Boolean(args.overwrite);
             const maxBytes = Math.max(1024, Number(args.maxBytes) || 20 * 1024 * 1024);
-            const archiveBuffer = await fs5.readFile(archivePath);
+            const archiveBuffer = await fs6.readFile(archivePath);
             const bundle = this.parseArchiveBundle(archiveBuffer);
             const written = await this.extractArchiveBundle(bundle, outputDir, overwrite, maxBytes);
             return {
@@ -2756,11 +2761,11 @@ var FileSystemServer = class {
   }
   async ensureDestWritable(destPath, overwrite) {
     try {
-      await fs5.access(destPath);
+      await fs6.access(destPath);
       if (!overwrite) {
         throw new Error(`Destination already exists: ${destPath}. Pass overwrite=true to replace.`);
       }
-      await fs5.rm(destPath, { recursive: true, force: true });
+      await fs6.rm(destPath, { recursive: true, force: true });
     } catch (error) {
       if (error?.code === "ENOENT") return;
       throw error;
@@ -2768,11 +2773,11 @@ var FileSystemServer = class {
   }
   async moveFile(fromPath, toPath) {
     try {
-      await fs5.rename(fromPath, toPath);
+      await fs6.rename(fromPath, toPath);
     } catch (error) {
       if (error?.code !== "EXDEV") throw error;
-      await fs5.copyFile(fromPath, toPath);
-      await fs5.unlink(fromPath);
+      await fs6.copyFile(fromPath, toPath);
+      await fs6.unlink(fromPath);
     }
   }
   async searchByName(basePath, pattern, maxResults) {
@@ -2782,10 +2787,10 @@ var FileSystemServer = class {
     while (queue.length > 0 && results.length < maxResults) {
       const current = queue.shift();
       if (!current) break;
-      const entries = await fs5.readdir(current, { withFileTypes: true });
+      const entries = await fs6.readdir(current, { withFileTypes: true });
       for (const entry of entries) {
-        const fullPath = path7.join(current, entry.name);
-        const relative3 = path7.relative(this.allowedRootDir, fullPath) || ".";
+        const fullPath = path8.join(current, entry.name);
+        const relative3 = path8.relative(this.allowedRootDir, fullPath) || ".";
         if (matcher(entry.name)) {
           results.push(`${entry.isDirectory() ? "[DIR]" : "[FILE]"} ${relative3}`);
           if (results.length >= maxResults) break;
@@ -2809,11 +2814,11 @@ var FileSystemServer = class {
     return (name) => name.toLowerCase().includes(lowered);
   }
   async createArchiveBundle(sourcePath, maxBytes) {
-    const stat3 = await fs5.stat(sourcePath);
+    const stat3 = await fs6.stat(sourcePath);
     const files = [];
     let totalBytes = 0;
     const readAndAppend = async (absolutePath, relativePath) => {
-      const data = await fs5.readFile(absolutePath);
+      const data = await fs6.readFile(absolutePath);
       totalBytes += data.length;
       if (totalBytes > maxBytes) {
         throw new Error(`Archive exceeds maxBytes limit (${maxBytes}).`);
@@ -2826,28 +2831,28 @@ var FileSystemServer = class {
       });
     };
     if (stat3.isFile()) {
-      await readAndAppend(sourcePath, path7.basename(sourcePath));
+      await readAndAppend(sourcePath, path8.basename(sourcePath));
     } else if (stat3.isDirectory()) {
       const queue = [sourcePath];
       while (queue.length > 0) {
         const current = queue.shift();
         if (!current) break;
-        const entries = await fs5.readdir(current, { withFileTypes: true });
+        const entries = await fs6.readdir(current, { withFileTypes: true });
         for (const entry of entries) {
-          const fullPath = path7.join(current, entry.name);
+          const fullPath = path8.join(current, entry.name);
           if (entry.isDirectory()) {
             queue.push(fullPath);
             continue;
           }
           if (!entry.isFile()) continue;
-          const relativePath = path7.relative(sourcePath, fullPath) || entry.name;
+          const relativePath = path8.relative(sourcePath, fullPath) || entry.name;
           await readAndAppend(fullPath, relativePath.replace(/\\/g, "/"));
         }
       }
     } else {
       throw new Error("Only files and directories can be archived.");
     }
-    const sourceRelative = path7.relative(this.allowedRootDir, sourcePath).replace(/\\/g, "/");
+    const sourceRelative = path8.relative(this.allowedRootDir, sourcePath).replace(/\\/g, "/");
     const bundle = {
       format: "lydia-archive-v1",
       source: sourceRelative || ".",
@@ -2880,13 +2885,13 @@ var FileSystemServer = class {
     let count = 0;
     for (const file of bundle.files) {
       const relPath = String(file.path || "").replace(/\\/g, "/");
-      if (!relPath || path7.isAbsolute(relPath) || relPath.includes("..")) {
+      if (!relPath || path8.isAbsolute(relPath) || relPath.includes("..")) {
         throw new Error(`Unsafe archive entry path: ${relPath || "<empty>"}`);
       }
-      const targetPath = path7.resolve(outputDir, relPath);
+      const targetPath = path8.resolve(outputDir, relPath);
       const safeOutputDir = process.platform === "win32" ? outputDir.toLowerCase() : outputDir;
       const safeTarget = process.platform === "win32" ? targetPath.toLowerCase() : targetPath;
-      if (!safeTarget.startsWith(safeOutputDir + path7.sep) && safeTarget !== safeOutputDir) {
+      if (!safeTarget.startsWith(safeOutputDir + path8.sep) && safeTarget !== safeOutputDir) {
         throw new Error(`Archive entry escapes destination: ${relPath}`);
       }
       const data = this.decodeArchiveEntry(file);
@@ -2894,8 +2899,8 @@ var FileSystemServer = class {
       if (totalBytes > maxBytes) {
         throw new Error(`Unarchive exceeds maxBytes limit (${maxBytes}).`);
       }
-      await fs5.mkdir(path7.dirname(targetPath), { recursive: true });
-      await fs5.writeFile(targetPath, data);
+      await fs6.mkdir(path8.dirname(targetPath), { recursive: true });
+      await fs6.writeFile(targetPath, data);
       count += 1;
     }
     return count;
@@ -2915,22 +2920,22 @@ var FileSystemServer = class {
   }
   async prepareOutputDirectory(outputDir, overwrite) {
     try {
-      const stat3 = await fs5.stat(outputDir);
+      const stat3 = await fs6.stat(outputDir);
       if (!stat3.isDirectory()) {
         throw new Error(`Output path is not a directory: ${outputDir}`);
       }
       if (!overwrite) {
-        const entries = await fs5.readdir(outputDir);
+        const entries = await fs6.readdir(outputDir);
         if (entries.length > 0) {
           throw new Error(`Output directory is not empty: ${outputDir}. Pass overwrite=true to replace.`);
         }
       } else {
-        await fs5.rm(outputDir, { recursive: true, force: true });
-        await fs5.mkdir(outputDir, { recursive: true });
+        await fs6.rm(outputDir, { recursive: true, force: true });
+        await fs6.mkdir(outputDir, { recursive: true });
       }
     } catch (error) {
       if (error?.code === "ENOENT") {
-        await fs5.mkdir(outputDir, { recursive: true });
+        await fs6.mkdir(outputDir, { recursive: true });
         return;
       }
       throw error;
@@ -2950,7 +2955,7 @@ var GitServer = class {
     this.server = new Server3(
       {
         name: "internal-git",
-        version: "0.1.0"
+        version: "0.1.2"
       },
       {
         capabilities: {
@@ -3127,7 +3132,7 @@ var MemoryServer = class {
     this.server = new Server4(
       {
         name: "internal-memory",
-        version: "0.1.0"
+        version: "0.1.2"
       },
       {
         capabilities: {
@@ -3253,7 +3258,7 @@ var InteractionServer = class extends EventEmitter3 {
   constructor() {
     super();
     this.server = new Server5(
-      { name: "internal-interaction", version: "0.1.0" },
+      { name: "internal-interaction", version: "0.1.2" },
       { capabilities: { tools: {} } }
     );
     this.setupHandlers();
@@ -3634,7 +3639,7 @@ var McpClientManager = class {
     const client = new Client(
       {
         name: "lydia-client",
-        version: "0.1.0"
+        version: "0.1.2"
       },
       {
         capabilities: {
@@ -3742,7 +3747,7 @@ var McpClientManager = class {
 };
 
 // src/gate/risk.ts
-import * as path8 from "path";
+import * as path9 from "path";
 import * as os6 from "os";
 var DEFAULT_USER_DATA_DIRS = [
   "~/.lydia",
@@ -3772,13 +3777,13 @@ var COMPUTER_USE_HIGH_RISK_ACTIONS = /* @__PURE__ */ new Set([
 ]);
 function expandHome(p) {
   if (p.startsWith("~/") || p === "~") {
-    return path8.join(os6.homedir(), p.slice(2));
+    return path9.join(os6.homedir(), p.slice(2));
   }
   return p;
 }
 function normalizePath(p) {
   const expanded = expandHome(p);
-  const normalized = path8.resolve(expanded);
+  const normalized = path9.resolve(expanded);
   return process.platform === "win32" ? normalized.toLowerCase() : normalized;
 }
 function buildProtectedDirs(config) {
@@ -3791,7 +3796,7 @@ function buildProtectedDirs(config) {
 }
 function isInProtectedDir(targetPath, protectedDirs) {
   const normalizedTarget = normalizePath(targetPath);
-  return protectedDirs.some((dir) => normalizedTarget === dir || normalizedTarget.startsWith(dir + path8.sep));
+  return protectedDirs.some((dir) => normalizedTarget === dir || normalizedTarget.startsWith(dir + path9.sep));
 }
 function extractPathsFromCommand(command) {
   const paths = [];
@@ -3813,7 +3818,7 @@ function hasRelativePathTraversal(input) {
   return /(^|[\\\/])\.\.([\\\/]|$)/.test(input);
 }
 function isRelativePath(input) {
-  return !path8.isAbsolute(input);
+  return !path9.isAbsolute(input);
 }
 function resolveCanonicalComputerUseAction(toolName) {
   const direct = resolveCanonicalComputerUseToolName(toolName);
@@ -3878,7 +3883,7 @@ function assessRisk(toolName, args, mcp, config) {
         return {
           level: "high",
           reason: `${opLabel} with relative path traversal`,
-          signature: `fs_write_rel:${normalizePath(path8.resolve(targetPath))}`,
+          signature: `fs_write_rel:${normalizePath(path9.resolve(targetPath))}`,
           details: targetPath
         };
       }
@@ -3909,6 +3914,14 @@ function assessRisk(toolName, args, mcp, config) {
   if (toolName === "shell_execute") {
     const command = typeof args?.command === "string" ? args.command : "";
     if (command && (isDestructiveShellCommand(command) || isPermissionChangeCommand(command))) {
+      if (isPermissionChangeCommand(command)) {
+        return {
+          level: "high",
+          reason: "Permission change shell command",
+          signature: `shell_permission:${command.toLowerCase().slice(0, 80)}`,
+          details: command
+        };
+      }
       const targets = extractPathsFromCommand(command);
       const hasTraversal = hasRelativePathTraversal(command);
       if (targets.length === 0 || hasTraversal) {
@@ -4147,7 +4160,7 @@ var StrategyUpdateGate = class {
 };
 
 // src/gate/review-manager.ts
-import * as path9 from "path";
+import * as path10 from "path";
 import * as os7 from "os";
 var ReviewManager = class {
   memory;
@@ -4156,7 +4169,7 @@ var ReviewManager = class {
       this.memory = memoryManager;
       return;
     }
-    const dbPath = path9.join(os7.homedir(), ".lydia", "memory.db");
+    const dbPath = path10.join(os7.homedir(), ".lydia", "memory.db");
     this.memory = new MemoryManager(dbPath);
   }
   async init() {
@@ -4335,7 +4348,7 @@ ${this.originalPlan}
 };
 
 // src/replay/mcp.ts
-import * as path10 from "path";
+import * as path11 from "path";
 var ReplayMcpClientManager = class extends McpClientManager {
   traces;
   callIndex = 0;
@@ -4490,12 +4503,12 @@ var ReplayMcpClientManager = class extends McpClientManager {
       const loweredPattern = rawPattern.toLowerCase();
       const names = /* @__PURE__ */ new Set();
       for (const storedPath of this.virtualFiles.keys()) {
-        const rel = path10.relative(normalized, storedPath);
+        const rel = path11.relative(normalized, storedPath);
         if (rel.startsWith("..")) continue;
         const parts = rel.split("/").filter(Boolean);
         for (const part of parts) {
           if (part.toLowerCase().includes(loweredPattern)) {
-            names.add(`[FILE] ${path10.posix.join(path10.posix.relative(this.virtualRoot, normalized), rel)}`);
+            names.add(`[FILE] ${path11.posix.join(path11.posix.relative(this.virtualRoot, normalized), rel)}`);
             break;
           }
         }
@@ -4523,12 +4536,12 @@ var ReplayMcpClientManager = class extends McpClientManager {
         createdAt: 0,
         totalBytes: sourceFile ? sourceFile.length : sourceEntries.reduce((acc, [, text]) => acc + text.length, 0),
         files: sourceFile ? [{
-          path: path10.posix.basename(source),
+          path: path11.posix.basename(source),
           size: sourceFile.length,
           encoding: "base64",
           data: Buffer.from(sourceFile, "utf-8").toString("base64")
         }] : sourceEntries.map(([filePath, text]) => ({
-          path: path10.posix.relative(source, filePath),
+          path: path11.posix.relative(source, filePath),
           size: text.length,
           encoding: "base64",
           data: Buffer.from(text, "utf-8").toString("base64")
@@ -4583,7 +4596,7 @@ var ReplayMcpClientManager = class extends McpClientManager {
       for (const item of parsed.files) {
         const rel = typeof item?.path === "string" ? item.path.replace(/\\/g, "/") : "";
         if (!rel || rel.includes("..") || rel.startsWith("/")) continue;
-        const target = this.normalizeFsPath(path10.posix.join(outputDir, rel));
+        const target = this.normalizeFsPath(path11.posix.join(outputDir, rel));
         const base64 = typeof item?.data === "string" ? item.data : "";
         const text = base64 ? Buffer.from(base64, "base64").toString("utf-8") : "";
         this.virtualFiles.set(target, text);
@@ -4876,12 +4889,12 @@ var ReplayMcpClientManager = class extends McpClientManager {
     if (driveMatch) {
       const drive = driveMatch[1].toLowerCase();
       const rest = driveMatch[2] || "/";
-      return path10.posix.normalize(`/${drive}${rest}`);
+      return path11.posix.normalize(`/${drive}${rest}`);
     }
     if (source.startsWith("/")) {
-      return path10.posix.normalize(source);
+      return path11.posix.normalize(source);
     }
-    return path10.posix.normalize(path10.posix.join(this.virtualRoot, source));
+    return path11.posix.normalize(path11.posix.join(this.virtualRoot, source));
   }
   listDirectoryEntries(directory) {
     const normalizedDir = this.normalizeFsPath(directory);
@@ -5072,7 +5085,7 @@ var StrategyEvaluator = class {
 };
 
 // src/replay/manager.ts
-import * as path11 from "path";
+import * as path12 from "path";
 import * as os8 from "os";
 var ReplayManager = class {
   memoryManager;
@@ -5081,7 +5094,7 @@ var ReplayManager = class {
     if (memoryManager) {
       this.memoryManager = memoryManager;
     } else {
-      const dbPath = path11.join(os8.homedir(), ".lydia", "memory.db");
+      const dbPath = path12.join(os8.homedir(), ".lydia", "memory.db");
       this.memoryManager = new MemoryManager(dbPath);
     }
     this.evaluator = new StrategyEvaluator();
@@ -5101,7 +5114,7 @@ var ReplayManager = class {
     const agent = new Agent(mockLLM);
     agent.mcpClientManager = mockMcp;
     agent.isInitialized = true;
-    const tempDb = path11.join(os8.tmpdir(), `lydia-replay-${Date.now()}-${episodeId}.db`);
+    const tempDb = path12.join(os8.tmpdir(), `lydia-replay-${Date.now()}-${episodeId}.db`);
     agent.memoryManager = new MemoryManager(tempDb);
     try {
       const config = await agent.configLoader.load();
@@ -5421,7 +5434,7 @@ var FeedbackCollector = class {
 };
 
 // src/execution/agent.ts
-import * as path12 from "path";
+import * as path13 from "path";
 import * as os9 from "os";
 var Agent = class extends EventEmitter5 {
   llm;
@@ -5518,7 +5531,7 @@ var Agent = class extends EventEmitter5 {
     await this.reviewManager.init();
     const config = await this.configLoader.load();
     this.config = config;
-    const dbPath = path12.join(os9.homedir(), ".lydia", "memory.db");
+    const dbPath = path13.join(os9.homedir(), ".lydia", "memory.db");
     this.memoryManager = new MemoryManager(dbPath, {
       checkpointTtlMs: Math.max(1, config.memory?.checkpointTtlHours ?? 24) * 60 * 60 * 1e3,
       observationFrameTtlMs: Math.max(1, config.memory?.observationFrameTtlHours ?? 24 * 7) * 60 * 60 * 1e3