@mrclrchtr/supi-skills 8.0.1 → 9.0.0

package/node_modules/@mrclrchtr/supi-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrclrchtr/supi-core",
-  "version": "8.0.1",
+  "version": "9.0.0",
   "description": "Shared settings, configuration, reporting, and session infrastructure",
   "license": "MIT",
   "repository": {

package/node_modules/@mrclrchtr/supi-core/src/debug-registry.ts

@@ -6,6 +6,9 @@
 
 export type DebugLevel = "debug" | "info" | "warning" | "error";
 export type DebugAgentAccess = "off" | "sanitized" | "raw";
+
+/** Custom session-entry type used to persist sanitized debug events. */
+export const DEBUG_EVENT_ENTRY_TYPE = "supi-debug-event";
 export interface DebugRegistryConfig {
   /** Whether producers should retain debug events. */
   enabled: boolean;
@@ -212,7 +215,7 @@ function toSanitizedView(event: DebugEvent): DebugEventView {
     category: event.category,
     message: event.message,
     cwd: event.cwd,
-    data: event.data,
+    data: event.data === undefined ? undefined : redactDebugData(event.data),
   };
 }
 
@@ -241,15 +244,17 @@ export function recordDebugEvent(input: DebugEventInput): DebugEvent | null {
   };
   state.events.push(event);
   trimToMaxEvents(state);
-  const view = toSanitizedView(event);
   for (const listener of state.listeners) {
     try {
-      listener(view);
+      listener(toSanitizedView(event));
     } catch {
       // Debug-event consumers must not alter producer behavior.
     }
   }
-  return { ...event };
+  return {
+    ...event,
+    data: event.data === undefined ? undefined : redactDebugData(event.data),
+  };
 }
 
 /** Query retained debug events newest-first. Results are sanitized unless raw access is requested and allowed. */

package/node_modules/@mrclrchtr/supi-core/src/session-capabilities.ts

@@ -1,3 +1,9 @@
+import {
+  decodeSessionCapabilityProfileSnapshot,
+  type SessionCapabilityProfile,
+  type SessionCapabilityProfileSnapshot,
+} from "./session-capability-profiles.ts";
+
 /** Session-only tool and skill visibility state. */
 export interface SessionCapabilityState {
   version: 1;
@@ -7,6 +13,8 @@ export interface SessionCapabilityState {
   /** Tools that the user explicitly enabled for this session. */
   toolEnabledNames?: string[];
   hiddenSkillNames: string[];
+  /** Original profile identity and exclusions. Later configuration changes do not affect this copy. */
+  profileSnapshot?: SessionCapabilityProfileSnapshot;
 }
 
 /** A model-visible skill that a provider can offer to the selector. */
@@ -94,8 +102,9 @@ export function decodeSessionCapabilities(value: unknown): SessionCapabilityStat
     (name) => !initiallyInactive.has(name),
   );
   const eligible = new Set(eligibleToolNames);
-  const toolDenylist = stringList(record.toolDenylist).filter((name) => eligible.has(name));
+  const toolDenylist = stringList(record.toolDenylist);
   const denied = new Set(toolDenylist);
+  const profileSnapshot = decodeSessionCapabilityProfileSnapshot(record.profileSnapshot);
 
   return {
     version: 1,
@@ -106,9 +115,54 @@ export function decodeSessionCapabilities(value: unknown): SessionCapabilityStat
       (name) => eligible.has(name) && !denied.has(name),
     ),
     hiddenSkillNames: stringList(record.hiddenSkillNames),
+    ...(profileSnapshot ? { profileSnapshot } : {}),
+  };
+}
+
+/** Copy current exclusion sets for saving. Do not use inventory to remove names. */
+export function captureSessionCapabilityExclusions(
+  state: SessionCapabilityState,
+): SessionCapabilityProfile {
+  return {
+    excludedTools: [...new Set(state.toolDenylist)],
+    hiddenSkills: [...new Set(state.hiddenSkillNames)],
   };
 }
 
+/**
+ * Replace exclusions and capture a profile copy. Return undefined for an invalid profile.
+ * Do not mutate the input state or activate tools. The caller owns runtime restoration.
+ */
+export function applySessionCapabilityProfile(
+  state: SessionCapabilityState,
+  profile: unknown,
+): SessionCapabilityState | undefined {
+  const profileSnapshot = decodeSessionCapabilityProfileSnapshot(profile);
+  if (!profileSnapshot) return undefined;
+  return decodeSessionCapabilities({
+    ...state,
+    toolDenylist: profileSnapshot.excludedTools,
+    hiddenSkillNames: profileSnapshot.hiddenSkills,
+    profileSnapshot,
+  });
+}
+
+function equalNameSets(left: readonly string[], right: readonly string[]): boolean {
+  const leftSet = new Set(left);
+  const rightSet = new Set(right);
+  return leftSet.size === rightSet.size && [...leftSet].every((name) => rightSet.has(name));
+}
+
+/** Compare current exclusions with the applied copy. No profile means no Modified marker. */
+export function isSessionCapabilityProfileModified(state: SessionCapabilityState): boolean {
+  const snapshot = state.profileSnapshot;
+  return (
+    snapshot !== undefined &&
+    (!equalNameSets(state.toolDenylist, snapshot.excludedTools) ||
+      !equalNameSets(state.hiddenSkillNames, snapshot.hiddenSkills))
+  );
+}
+
 /** Return a safe copy of the latest valid snapshot in all session entries. */
 export function findSessionCapabilities(
   entries: readonly unknown[],

package/node_modules/@mrclrchtr/supi-core/src/session-capability-profiles.ts

@@ -0,0 +1,240 @@
+/** Exact names to exclude. Omitted configuration lists mean empty sets. */
+export interface SessionCapabilityProfileDefinition {
+  excludedTools?: string[];
+  hiddenSkills?: string[];
+}
+
+/** Validated exclusion sets. Names need not match the current inventory. */
+export interface SessionCapabilityProfile {
+  excludedTools: string[];
+  hiddenSkills: string[];
+}
+
+/** A profile is available only when validation has no errors. */
+export interface SessionCapabilityProfileValidation {
+  profile?: SessionCapabilityProfile;
+  errors: string[];
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+
+function readNames(value: unknown): string[] | undefined {
+  if (!Array.isArray(value)) return undefined;
+  const names: unknown[] = [...new Set(value)];
+  return names.every((name): name is string => typeof name === "string") ? names : undefined;
+}
+
+/** Validate and copy a complete definition. Do not check inventory or expand patterns. */
+export function validateSessionCapabilityProfile(
+  value: unknown,
+): SessionCapabilityProfileValidation {
+  if (!isRecord(value)) return { errors: ["Profile must be an object."] };
+  const excludedTools = Object.hasOwn(value, "excludedTools") ? readNames(value.excludedTools) : [];
+  const hiddenSkills = Object.hasOwn(value, "hiddenSkills") ? readNames(value.hiddenSkills) : [];
+  const errors = Object.keys(value)
+    .filter((key) => key !== "excludedTools" && key !== "hiddenSkills")
+    .map((key) => `Unknown profile field: ${key}.`);
+  if (!excludedTools) errors.push("excludedTools must be an array of strings.");
+  if (!hiddenSkills) errors.push("hiddenSkills must be an array of strings.");
+  if (errors.length || !excludedTools || !hiddenSkills) return { errors };
+  return { profile: { excludedTools, hiddenSkills }, errors };
+}
+
+/** Configuration scope that supplied a profile or default. */
+export type SessionCapabilityProfileScope = "global" | "project";
+
+/** Configuration values for the sessionCapabilities section. */
+export interface SessionCapabilityProfilesSection {
+  profiles?: Record<string, SessionCapabilityProfileDefinition>;
+  defaultProfile?: string | null;
+}
+
+/** Session-owned identity and original exclusion sets, independent of configuration. */
+export interface SessionCapabilityProfileSnapshot extends SessionCapabilityProfile {
+  id: string;
+  source: SessionCapabilityProfileScope;
+}
+
+/** A configuration error with a scope and field path for display. */
+export interface SessionCapabilityProfileDiagnostic {
+  scope: SessionCapabilityProfileScope;
+  path: string;
+  message: string;
+}
+
+/** A scoped definition, including invalid definitions and hidden global definitions. */
+export interface SessionCapabilityProfileEntry {
+  id: string;
+  source: SessionCapabilityProfileScope;
+  shadowed: boolean;
+  profile?: SessionCapabilityProfile;
+  errors: SessionCapabilityProfileDiagnostic[];
+}
+
+/** Default selection source can differ from the effective profile source. */
+export type SessionCapabilityProfileDefault =
+  | { status: "none"; source?: SessionCapabilityProfileScope }
+  | {
+      status: "resolved";
+      source: SessionCapabilityProfileScope;
+      id: string;
+      profile: SessionCapabilityProfileSnapshot;
+    }
+  | { status: "invalid"; source: SessionCapabilityProfileScope; id?: string };
+
+/** Raw sections, not merged configuration. Callers must check trust before project reads. */
+export interface ResolveSessionCapabilityProfilesOptions {
+  global?: unknown;
+  project?: unknown;
+  projectTrusted: boolean;
+}
+
+/** Data for profile rows, scoped actions, and default warnings. No I/O is performed. */
+export interface SessionCapabilityProfilesResolution {
+  entries: SessionCapabilityProfileEntry[];
+  effectiveProfiles: SessionCapabilityProfileSnapshot[];
+  default: SessionCapabilityProfileDefault;
+  errors: SessionCapabilityProfileDiagnostic[];
+}
+
+/** IDs contain lowercase ASCII words separated by single hyphens. */
+export function isSessionCapabilityProfileId(value: unknown): value is string {
+  return typeof value === "string" && /^[a-z]+(?:-[a-z]+)*$/.test(value);
+}
+
+/** Validate and copy stored identity and original lists. Invalid metadata has no identity. */
+export function decodeSessionCapabilityProfileSnapshot(
+  value: unknown,
+): SessionCapabilityProfileSnapshot | undefined {
+  if (!isRecord(value) || !isSessionCapabilityProfileId(value.id)) return undefined;
+  if (value.source !== "global" && value.source !== "project") return undefined;
+  const { id, source, ...definition } = value;
+  if (!Object.hasOwn(definition, "excludedTools") || !Object.hasOwn(definition, "hiddenSkills"))
+    return undefined;
+  const result = validateSessionCapabilityProfile(definition);
+  return result.profile ? { id, source, ...result.profile } : undefined;
+}
+
+function readEntries(
+  value: unknown,
+  source: SessionCapabilityProfileScope,
+): SessionCapabilityProfileEntry[] {
+  if (!isRecord(value) || !isRecord(value.profiles)) return [];
+  return Object.entries(value.profiles).map(([id, definition]) => {
+    const result = validateSessionCapabilityProfile(definition);
+    if (!isSessionCapabilityProfileId(id))
+      result.errors.push("Invalid profile ID: use lowercase words with single hyphens.");
+    return {
+      id,
+      source,
+      shadowed: false,
+      profile: result.errors.length ? undefined : result.profile,
+      errors: result.errors.map((message) => ({ scope: source, path: `profiles.${id}`, message })),
+    };
+  });
+}
+
+type DefaultReference =
+  | SessionCapabilityProfileDefault
+  | { status: "pending"; source: SessionCapabilityProfileScope; id: string };
+
+function readDefault(
+  value: unknown,
+  source: SessionCapabilityProfileScope,
+  errors: SessionCapabilityProfileDiagnostic[],
+): DefaultReference | undefined {
+  if (!isRecord(value) || !Object.hasOwn(value, "defaultProfile")) return undefined;
+  if (value.defaultProfile === null) return { status: "none", source };
+  if (isSessionCapabilityProfileId(value.defaultProfile)) {
+    return { status: "pending", source, id: value.defaultProfile };
+  }
+  errors.push({
+    scope: source,
+    path: "defaultProfile",
+    message: "defaultProfile must be null or a valid profile ID.",
+  });
+  return { status: "invalid", source };
+}
+
+function resolveDefault(
+  selected: DefaultReference | undefined,
+  profiles: SessionCapabilityProfileSnapshot[],
+  errors: SessionCapabilityProfileDiagnostic[],
+): SessionCapabilityProfileDefault {
+  if (!selected) return { status: "none" };
+  if (selected.status !== "pending") return selected;
+  const { source, id } = selected;
+  const profile = profiles.find((entry) => entry.id === id);
+  if (profile) return { status: "resolved", source, id, profile };
+  errors.push({
+    scope: source,
+    path: "defaultProfile",
+    message: `Default profile ${id} is missing or invalid. No profile will be applied.`,
+  });
+  return { status: "invalid", source, id };
+}
+
+interface ScopedProfiles {
+  entries: SessionCapabilityProfileEntry[];
+  errors: SessionCapabilityProfileDiagnostic[];
+  default?: DefaultReference;
+}
+
+/** Reject malformed sections, but retain known IDs to prevent global fallback. */
+function readSection(value: unknown, scope: SessionCapabilityProfileScope): ScopedProfiles {
+  if (value === undefined) return { entries: [], errors: [] };
+  if (!isRecord(value)) {
+    return {
+      entries: [],
+      default: { status: "invalid", source: scope },
+      errors: [
+        { scope, path: "sessionCapabilities", message: "sessionCapabilities must be an object." },
+      ],
+    };
+  }
+  const sectionErrors = Object.keys(value)
+    .filter((key) => key !== "profiles" && key !== "defaultProfile")
+    .map((key) => ({ scope, path: key, message: `Unknown section field: ${key}.` }));
+  if (Object.hasOwn(value, "profiles") && !isRecord(value.profiles)) {
+    sectionErrors.push({ scope, path: "profiles", message: "profiles must be an object." });
+  }
+  const entries = readEntries(value, scope);
+  const errors = [...sectionErrors, ...entries.flatMap((entry) => entry.errors)];
+  const selection = readDefault(value, scope, errors);
+  if (sectionErrors.length) {
+    for (const entry of entries) {
+      entry.profile = undefined;
+      entry.errors.push(...sectionErrors);
+    }
+    return { entries, errors, default: { status: "invalid", source: scope } };
+  }
+  return { entries, errors, default: selection };
+}
+
+/**
+ * Resolve whole profiles by ID. Ignore project data unless projectTrusted is true.
+ * An absent section is undefined. Malformed sections cannot supply profiles or a default.
+ */
+export function resolveSessionCapabilityProfiles(
+  options: ResolveSessionCapabilityProfilesOptions,
+): SessionCapabilityProfilesResolution {
+  const global = readSection(options.global, "global");
+  const project = readSection(options.projectTrusted ? options.project : undefined, "project");
+  const entries = [...global.entries, ...project.entries];
+  const errors = [...global.errors, ...project.errors];
+  const selected = new Map(entries.map((entry) => [entry.id, entry]));
+  for (const entry of entries) entry.shadowed = selected.get(entry.id) !== entry;
+  const effectiveProfiles = [...selected.values()].flatMap((entry) =>
+    entry.profile ? [{ id: entry.id, source: entry.source, ...entry.profile }] : [],
+  );
+  return {
+    entries,
+    effectiveProfiles,
+    default: resolveDefault(project.default ?? global.default, effectiveProfiles, errors),
+    errors,
+  };
+}

package/node_modules/@mrclrchtr/supi-core/src/session.ts

@@ -7,17 +7,39 @@ export type {
   SessionCapabilityState,
 } from "./session-capabilities.ts";
 export {
+  applySessionCapabilityProfile,
+  captureSessionCapabilityExclusions,
   clearPendingSessionCapabilityForks,
   createEmptySessionCapabilityState,
   decodeSessionCapabilities,
   findSessionCapabilities,
   getSessionCapabilitySkillProvider,
+  isSessionCapabilityProfileModified,
   readPendingSessionCapabilityFork,
   registerSessionCapabilitySkillProvider,
   SESSION_CAPABILITIES_ENTRY,
   sessionCapabilityState,
   setPendingSessionCapabilityFork,
 } from "./session-capabilities.ts";
+export type {
+  ResolveSessionCapabilityProfilesOptions,
+  SessionCapabilityProfile,
+  SessionCapabilityProfileDefault,
+  SessionCapabilityProfileDefinition,
+  SessionCapabilityProfileDiagnostic,
+  SessionCapabilityProfileEntry,
+  SessionCapabilityProfileScope,
+  SessionCapabilityProfileSnapshot,
+  SessionCapabilityProfilesResolution,
+  SessionCapabilityProfilesSection,
+  SessionCapabilityProfileValidation,
+} from "./session-capability-profiles.ts";
+export {
+  decodeSessionCapabilityProfileSnapshot,
+  isSessionCapabilityProfileId,
+  resolveSessionCapabilityProfiles,
+  validateSessionCapabilityProfile,
+} from "./session-capability-profiles.ts";
 export type { SessionNameTrackerHost } from "./session-utils.ts";
 export {
   createSessionNameTracker,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrclrchtr/supi-skills",
-  "version": "8.0.1",
+  "version": "9.0.0",
   "description": "Scoped skill controls and skill input shortcuts for PI",
   "license": "MIT",
   "repository": {
@@ -30,7 +30,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@mrclrchtr/supi-core": "8.0.1"
+    "@mrclrchtr/supi-core": "9.0.0"
   },
   "bundledDependencies": [
     "@mrclrchtr/supi-core"