@nail00749/agent-gvozd 0.1.7 → 0.2.0

package/dist/index.js

@@ -6100,6 +6100,14 @@ class FileLeaseManager {
     }
     return canonical;
   }
+  snapshot() {
+    const leases = [...this.leases.values()];
+    return leases.map((lease) => this.toStatus(lease)).sort((a, b) => {
+      if (a.state === "active" !== (b.state === "active"))
+        return a.state === "active" ? -1 : 1;
+      return a.expiresAt - b.expiresAt;
+    });
+  }
   toStatus(lease) {
     return {
       leaseId: lease.leaseId,
@@ -6354,6 +6362,200 @@ function loadConfig(projectDirectory, options = {}) {
   };
 }
 
+// src/permissions-rpc.ts
+import { Rpc } from "@opencode/plugin/rpc";
+var GvozdPermissions = Rpc.define({
+  id: "gvozd-permissions",
+  events: {},
+  methods: {
+    evaluate: {
+      input: {
+        type: "object",
+        properties: {
+          agent: { type: "string" },
+          checks: {
+            type: "array",
+            items: {
+              type: "object",
+              properties: {
+                action: { type: "string" },
+                resources: { type: "array", items: { type: "string" } }
+              },
+              required: ["action", "resources"],
+              additionalProperties: false
+            }
+          }
+        },
+        required: ["agent", "checks"],
+        additionalProperties: false
+      },
+      output: {
+        type: "object",
+        properties: {
+          results: {
+            type: "array",
+            items: {
+              type: "object",
+              properties: {
+                action: { type: "string" },
+                resource: { type: "string" },
+                effect: { type: "string", enum: ["allow", "ask", "deny", "unknown"] },
+                matchedRule: { type: ["string", "null"] }
+              },
+              required: ["action", "resource", "effect", "matchedRule"],
+              additionalProperties: false
+            }
+          }
+        },
+        required: ["results"],
+        additionalProperties: false
+      }
+    }
+  }
+});
+var GvozdLeases = Rpc.define({
+  id: "gvozd-leases",
+  events: {},
+  methods: {
+    list: {
+      input: {
+        type: "object",
+        properties: {},
+        additionalProperties: false
+      },
+      output: {
+        type: "object",
+        properties: {
+          leases: {
+            type: "array",
+            items: {
+              type: "object",
+              properties: {
+                leaseId: { type: "string" },
+                parentSessionID: { type: "string" },
+                sessionID: { type: "string" },
+                agent: { type: "string" },
+                label: { type: "string" },
+                state: { type: "string", enum: ["reserved", "active"] },
+                files: { type: "array", items: { type: "string" } },
+                expiresAt: { type: "number" },
+                lastActivityAt: { type: "number" }
+              },
+              required: ["leaseId", "parentSessionID", "agent", "label", "state", "files", "expiresAt", "lastActivityAt"],
+              additionalProperties: false
+            }
+          }
+        },
+        required: ["leases"],
+        additionalProperties: false
+      }
+    }
+  }
+});
+function evaluateEffect(rules, action, resource) {
+  let matched;
+  for (const rule of rules) {
+    if (match(rule.action, action) && match(rule.resource, resource))
+      matched = rule;
+  }
+  if (!matched)
+    return { effect: "unknown", matchedRule: null };
+  return { effect: matched.effect, matchedRule: `${matched.action} ${matched.resource}` };
+}
+function match(pattern, value) {
+  let source = "^";
+  for (const character of pattern) {
+    if (character === "*")
+      source += ".*";
+    else if (character === "?")
+      source += ".";
+    else
+      source += character.replace(/[\\^$.*+?()[\]{}|]/g, "\\$&");
+  }
+  return new RegExp(`${source}$`).test(value);
+}
+function evaluateInput(agentRules, input) {
+  const results = input.checks.flatMap((request) => (request.resources.length > 0 ? request.resources : ["*"]).map((resource) => {
+    const evaluation = agentRules ? evaluateEffect(agentRules, request.action, resource) : { effect: "unknown", matchedRule: null };
+    return {
+      action: request.action,
+      resource,
+      effect: evaluation.effect,
+      matchedRule: evaluation.matchedRule
+    };
+  }));
+  return { results };
+}
+
+// src/trusted-mode.ts
+import { Rpc as Rpc2 } from "@opencode/plugin/rpc";
+var TRUST_MODES = ["balanced", "trusted", "strict"];
+var GvozdMode = Rpc2.define({
+  id: "gvozd-mode",
+  events: {},
+  methods: {
+    set: {
+      input: {
+        type: "object",
+        properties: {
+          sessionID: { type: "string" },
+          mode: { type: "string", enum: [...TRUST_MODES] }
+        },
+        required: ["sessionID", "mode"],
+        additionalProperties: false
+      },
+      output: {
+        type: "object",
+        properties: {
+          mode: { type: "string", enum: [...TRUST_MODES] }
+        },
+        required: ["mode"],
+        additionalProperties: false
+      }
+    },
+    get: {
+      input: {
+        type: "object",
+        properties: { sessionID: { type: "string" } },
+        required: ["sessionID"],
+        additionalProperties: false
+      },
+      output: {
+        type: "object",
+        properties: {
+          mode: { type: "string", enum: [...TRUST_MODES] }
+        },
+        required: ["mode"],
+        additionalProperties: false
+      }
+    }
+  }
+});
+function modePermissions(mode) {
+  if (mode === "trusted") {
+    return [
+      { action: "shell", resource: "*", effect: "allow" },
+      { action: "edit", resource: "*", effect: "allow" },
+      { action: "shell", resource: "git push --force*", effect: "deny" },
+      { action: "shell", resource: "git push -f*", effect: "deny" },
+      { action: "shell", resource: "git reset --hard*", effect: "deny" },
+      { action: "shell", resource: "git clean*", effect: "deny" },
+      { action: "shell", resource: "git filter-branch*", effect: "deny" },
+      { action: "shell", resource: "git filter-repo*", effect: "deny" },
+      { action: "shell", resource: "git rebase*", effect: "deny" },
+      { action: "shell", resource: "git checkout --*", effect: "deny" },
+      { action: "shell", resource: "git restore*", effect: "deny" }
+    ];
+  }
+  if (mode === "strict") {
+    return [
+      { action: "shell", resource: "*", effect: "ask" },
+      { action: "edit", resource: "*", effect: "ask" }
+    ];
+  }
+  return [];
+}
+
 // src/file-lease-plugin.ts
 var GVOZD_LEASE_TOOL = "gvozd_lease";
 var GVOZD_CLAIM_TOOL = "gvozd_claim";
@@ -6426,7 +6628,9 @@ function enforceFileLeasePermission(event, config, manager) {
   const role = roleOf(config, event.agent);
   if (event.action === "edit") {
     if (!role) {
-      return deny(event, event.agent ? `Agent ${event.agent} has no configured file lease role` : "OpenCode supplied no agent identity for this mutation; the write is denied");
+      if (event.agent && !manager.hasActiveLeases())
+        return false;
+      return deny(event, event.agent ? `Agent ${event.agent} has no configured file lease role; edits are allowed only while no writer leases are active` : "OpenCode supplied no agent identity for this mutation; the write is denied");
     }
     if (role === "readonly")
       return deny(event, `Agent ${event.agent} is readonly and cannot mutate project files`);
@@ -6440,9 +6644,15 @@ function enforceFileLeasePermission(event, config, manager) {
   }
   if (event.action !== "shell" && event.action !== "bash")
     return false;
-  if (role === "coordinator" || role === "writer") {
+  if (role === "coordinator") {
     return deny(event, `Agent ${event.agent} cannot use shell while file leases enforce structured mutations`);
   }
+  if (role === "writer" && safeReadonlyShell(event.agent, event.resources)) {
+    return false;
+  }
+  if (role === "writer") {
+    return deny(event, `Agent ${event.agent} cannot use shell beyond read-only verification while file leases enforce structured mutations`);
+  }
   if (manager.hasActiveLeases() && !(role === "readonly" && safeReadonlyShell(event.agent, event.resources))) {
     return deny(event, "Shell commands are paused until all active writer file leases are released");
   }
@@ -6706,6 +6916,55 @@ var src_default = Plugin.define({
     try {
       const fileLeases = await installFileLeaseRuntime(ctx, config, { caseInsensitive });
       resources.push(fileLeases);
+      if (ctx.rpc && typeof ctx.rpc.register === "function") {
+        const sessionModes = new Map;
+        const defaultMode = () => "balanced";
+        const modeRpc = await ctx.rpc.register(GvozdMode, {
+          set: async (raw) => {
+            const input = raw;
+            sessionModes.set(input.sessionID, input.mode);
+            if (typeof ctx.permission.rules === "function") {
+              await ctx.permission.rules({
+                sessionID: input.sessionID,
+                permissions: modePermissions(input.mode)
+              });
+            }
+            return { mode: input.mode };
+          },
+          get: async (raw) => {
+            const input = raw;
+            return { mode: sessionModes.get(input.sessionID) ?? defaultMode() };
+          }
+        });
+        resources.push(modeRpc);
+        const leasesRpc = await ctx.rpc.register(GvozdLeases, {
+          list: async () => {
+            const output = {
+              leases: fileLeases.manager.snapshot().map((lease) => ({
+                leaseId: lease.leaseId,
+                parentSessionID: lease.parentSessionID,
+                ...lease.sessionID ? { sessionID: lease.sessionID } : {},
+                agent: lease.agent,
+                label: lease.label,
+                state: lease.state,
+                files: [...lease.files],
+                expiresAt: lease.expiresAt,
+                lastActivityAt: lease.lastActivityAt
+              }))
+            };
+            return output;
+          }
+        });
+        resources.push(leasesRpc);
+        const permissionRpc = await ctx.rpc.register(GvozdPermissions, {
+          evaluate: async (raw) => {
+            const input = raw;
+            const agent = config.agents[input.agent];
+            return evaluateInput(agent && !agent.disabled ? agent.permissions : undefined, input);
+          }
+        });
+        resources.push(permissionRpc);
+      }
       const agentTransform = await ctx.agent.transform((agents) => {
         applyAgentConfiguration(agents, config, models.data, mcpServers);
       });