@namzu/cli 29.0.1 → 30.0.0

package/dist/permissions/browser-sites.js

@@ -0,0 +1,270 @@
+/**
+ * `browser.sites`, compiled to the kernel's rule vocabulary.
+ *
+ * An operator writes one level per site:
+ *
+ * ```yaml
+ * browser:
+ *   sites:
+ *     "https://github.com": act
+ *     "https://*.example.com": read
+ *     "*": ask
+ * ```
+ *
+ * and the gate sees `argument_pattern` rules over the two arguments the
+ * browser tools canonicalise: `browser.url` (the address a navigation loads)
+ * and `browser_act.origin` (the page an action changes). The tools declare
+ * `url` as a URL argument, so a rule tests it whole; the SDK's input schema
+ * has already turned `HTTPS://GitHub.com.:443/x` into `https://github.com/x`,
+ * so one spelling per site is enough.
+ *
+ * | Level  | `browser` navigate / tabs new | `browser_act` |
+ * | ------ | ----------------------------- | ------------- |
+ * | `deny` | deny                          | deny          |
+ * | `read` | allow                         | deny          |
+ * | `ask`  | review                        | review        |
+ * | `act`  | allow                         | allow         |
+ *
+ * Order is the gate's first match: every `deny` first, then the other sites
+ * from most to least specific (the same order `@namzu/browser`'s host policy
+ * uses, so the gate and the host agree on which key decides), then `*`.
+ * Looking at the page (`snapshot`, `screenshot`, `scroll`, `wait_for`, and
+ * `tabs list|select|close`) is allowed: the browser tools are network tools,
+ * which are reviewed even when read-only unless a rule allows them, and the
+ * page being looked at is one the host already let stay loaded.
+ *
+ * The origin patterns are built here, from the SDK's canonical site key,
+ * rather than from a glob: `https://github.com` must not match
+ * `https://github.com.evil.example`, `https://evil.example/?https://github.com`
+ * or `https://github.com:8443`.
+ */
+import { BROWSER_ACT_TOOL_NAME, BROWSER_TOOL_NAME, canonicalizeBrowserSitePattern, canonicalizeBrowserUrl, } from '@namzu/sdk';
+export const BROWSER_SITE_LEVELS = ['deny', 'read', 'ask', 'act'];
+/** What an unlisted site gets when `*` is not written. */
+export const DEFAULT_BROWSER_SITE_LEVEL = 'ask';
+export function isBrowserSiteLevel(value) {
+    return typeof value === 'string' && BROWSER_SITE_LEVELS.includes(value);
+}
+/** A site key as the gate and the host read it: `*`, or the SDK's canonical pattern. */
+export function canonicalBrowserSiteKey(raw) {
+    if (raw.trim() === '*')
+        return { ok: true, key: '*' };
+    const verdict = canonicalizeBrowserSitePattern(raw);
+    return verdict.ok ? { ok: true, key: verdict.pattern } : { ok: false, reason: verdict.reason };
+}
+function parseSite(key, level) {
+    const match = /^(https?):\/\/(\*\.)?([^:]+)(?::(\*|\d+))?$/.exec(key);
+    if (!match)
+        return undefined;
+    return {
+        key,
+        level,
+        scheme: match[1] ?? '',
+        host: match[3] ?? '',
+        wildcardHost: match[2] !== undefined,
+        port: match[4] ?? '',
+    };
+}
+/** Higher is more specific: exact host over wildcard, longer suffix first, exact port over `*`. */
+function specificity(site) {
+    return (site.wildcardHost ? 0 : 1_000_000) + site.host.length * 10 + (site.port === '*' ? 0 : 1);
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * The regex source (unanchored) that matches exactly the canonical origins
+ * a site key names. `*.` is one or more whole labels; `:*` is any port or
+ * none; no port is the scheme's default only, which the canonical form
+ * leaves out.
+ */
+function originSource(site) {
+    const host = site.wildcardHost
+        ? `(?:[^./:?#@\\[\\]]+\\.)+${escapeRegExp(site.host)}`
+        : escapeRegExp(site.host);
+    const port = site.port === '*' ? '(?::\\d{1,5})?' : site.port === '' ? '' : `:${site.port}`;
+    return `${site.scheme}://${host}${port}`;
+}
+const NAVIGATE = {
+    deny: 'deny',
+    read: 'allow',
+    ask: 'review',
+    act: 'allow',
+};
+const ACT = {
+    deny: 'deny',
+    read: 'deny',
+    ask: 'review',
+    act: 'allow',
+};
+function rulesFor(origin, level) {
+    // `*`: any value. `^` alone matches every string the argument can hold.
+    const url = origin === undefined ? '^' : `^${origin}(?:[/?#]|$)`;
+    const act = origin === undefined ? '^' : `^${origin}$`;
+    return [
+        {
+            type: 'argument_pattern',
+            toolNames: [BROWSER_TOOL_NAME],
+            argument: 'url',
+            pattern: url,
+            decision: NAVIGATE[level],
+        },
+        {
+            type: 'argument_pattern',
+            toolNames: [BROWSER_ACT_TOOL_NAME],
+            argument: 'origin',
+            pattern: act,
+            decision: ACT[level],
+        },
+    ];
+}
+/**
+ * Looking at the page the browser holds. These calls carry no address; the
+ * host only ever holds a page the site rules let stay (or `about:blank`).
+ * `tabs new` carries a `url` and is decided by the site rules instead.
+ */
+const LOOKING = [
+    {
+        type: 'argument_pattern',
+        toolNames: [BROWSER_TOOL_NAME],
+        argument: 'action',
+        pattern: '^(?:snapshot|screenshot|scroll|wait_for)$',
+        decision: 'allow',
+    },
+    {
+        type: 'argument_pattern',
+        toolNames: [BROWSER_TOOL_NAME],
+        argument: 'op',
+        pattern: '^(?:list|select|close)$',
+        decision: 'allow',
+    },
+];
+/** Canonical keys, `*` filled in, unreadable entries reported. */
+export function normalizeBrowserSites(sites) {
+    const out = {};
+    const diagnostics = [];
+    for (const [raw, level] of Object.entries(sites ?? {})) {
+        if (!isBrowserSiteLevel(level)) {
+            diagnostics.push(`browser.sites."${raw}": use deny, read, ask or act`);
+            continue;
+        }
+        const verdict = canonicalBrowserSiteKey(raw);
+        if (!verdict.ok) {
+            diagnostics.push(`browser.sites."${raw}": ${verdict.reason}`);
+            continue;
+        }
+        const existing = out[verdict.key];
+        // The same site written twice (`https://GitHub.com` and
+        // `https://github.com`): the narrower level holds, so a spelling can
+        // never widen what another spelling said.
+        out[verdict.key] = existing === undefined ? level : narrower(existing, level);
+    }
+    if (out['*'] === undefined)
+        out['*'] = DEFAULT_BROWSER_SITE_LEVEL;
+    return { sites: out, diagnostics };
+}
+/** The narrower of two levels: `deny`, then `read`, then `ask`, then `act`. */
+export function narrower(a, b) {
+    return BROWSER_SITE_LEVELS.indexOf(a) <= BROWSER_SITE_LEVELS.indexOf(b) ? a : b;
+}
+/** Compile `browser.sites` into gate rules, in the order the gate must try them. */
+export function compileBrowserSites(sites) {
+    const normalized = normalizeBrowserSites(sites);
+    const diagnostics = [...normalized.diagnostics];
+    const parsed = [];
+    for (const [key, level] of Object.entries(normalized.sites)) {
+        if (key === '*')
+            continue;
+        const site = parseSite(key, level);
+        if (site)
+            parsed.push(site);
+        else
+            diagnostics.push(`browser.sites."${key}": could not be read`);
+    }
+    const denies = parsed.filter((site) => site.level === 'deny');
+    const others = parsed
+        .filter((site) => site.level !== 'deny')
+        .sort((a, b) => specificity(b) - specificity(a) || (a.key < b.key ? -1 : 1));
+    const rules = [
+        // A blank tab is where the browser starts; it loads nothing.
+        {
+            type: 'argument_pattern',
+            toolNames: [BROWSER_TOOL_NAME],
+            argument: 'url',
+            pattern: '^about:blank$',
+            decision: 'allow',
+        },
+        ...denies.flatMap((site) => rulesFor(originSource(site), 'deny')),
+        ...others.flatMap((site) => rulesFor(originSource(site), site.level)),
+        ...rulesFor(undefined, normalized.sites['*'] ?? DEFAULT_BROWSER_SITE_LEVEL),
+        ...LOOKING,
+    ];
+    return { rules, sites: normalized.sites, diagnostics };
+}
+const BROWSER_TOOLS = new Set([BROWSER_TOOL_NAME, BROWSER_ACT_TOOL_NAME]);
+/** A `[permissions]` rule that denies a browser tool, which the site rules must not get ahead of. */
+function isBrowserDeny(rule) {
+    switch (rule.type) {
+        case 'deny_by_name':
+            return rule.toolNames.some((name) => BROWSER_TOOLS.has(name));
+        case 'argument_pattern':
+            return rule.decision === 'deny' && rule.toolNames.some((name) => BROWSER_TOOLS.has(name));
+        case 'custom_pattern':
+            return (rule.decision === 'deny' &&
+                (rule.pattern.startsWith(`^${BROWSER_TOOL_NAME}`) ||
+                    rule.pattern.startsWith(`^${BROWSER_ACT_TOOL_NAME}`)));
+        default:
+            return false;
+    }
+}
+/**
+ * The session's rules with the site rules in them: a `[permissions]` deny
+ * that names a browser tool first (it still wins), then the site rules, then
+ * the rest of the table. An `allow` or `ask` for `browser` in the table is
+ * reached only by a call no site rule decided (`back`, `forward`, `reload`).
+ */
+export function withBrowserSiteRules(tableRules, siteRules) {
+    return [
+        ...tableRules.filter(isBrowserDeny),
+        ...siteRules,
+        ...tableRules.filter((rule) => !isBrowserDeny(rule)),
+    ];
+}
+/**
+ * Which key of `sites` decides `origin`, and at what level: a matching
+ * `deny` first, else the most specific match, else `*`. The same answer the
+ * compiled rules give; used to show the rule on the review screen.
+ */
+export function browserSiteRuleFor(sites, origin) {
+    const normalized = normalizeBrowserSites(sites).sites;
+    const parsed = Object.entries(normalized)
+        .filter(([key]) => key !== '*')
+        .map(([key, level]) => parseSite(key, level))
+        .filter((site) => site !== undefined);
+    const hits = parsed.filter((site) => new RegExp(`^${originSource(site)}$`).test(origin));
+    const deny = hits.find((site) => site.level === 'deny');
+    if (deny)
+        return { site: deny.key, level: 'deny' };
+    const best = hits.sort((a, b) => specificity(b) - specificity(a))[0];
+    if (best)
+        return { site: best.key, level: best.level };
+    return { site: '*', level: normalized['*'] ?? DEFAULT_BROWSER_SITE_LEVEL };
+}
+/**
+ * The origin a browser call opens or acts on, canonical, or `undefined` for
+ * one that names none (`snapshot`, `back`, …).
+ */
+export function browserCallOrigin(toolName, input) {
+    if (typeof input !== 'object' || input === null)
+        return undefined;
+    const record = input;
+    if (toolName === BROWSER_ACT_TOOL_NAME) {
+        return typeof record.origin === 'string' ? record.origin : undefined;
+    }
+    if (toolName === BROWSER_TOOL_NAME && typeof record.url === 'string') {
+        const verdict = canonicalizeBrowserUrl(record.url);
+        return verdict.ok && verdict.url !== 'about:blank' ? verdict.origin : undefined;
+    }
+    return undefined;
+}
+//# sourceMappingURL=browser-sites.js.map

package/dist/permissions/browser-sites.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-sites.js","sourceRoot":"","sources":["../../src/permissions/browser-sites.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAEN,qBAAqB,EACrB,iBAAiB,EACjB,8BAA8B,EAC9B,sBAAsB,GACtB,MAAM,YAAY,CAAA;AAOnB,MAAM,CAAC,MAAM,mBAAmB,GAAgC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;AAE9F,0DAA0D;AAC1D,MAAM,CAAC,MAAM,0BAA0B,GAAqB,KAAK,CAAA;AAEjE,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,mBAAyC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAC/F,CAAC;AAMD,wFAAwF;AACxF,MAAM,UAAU,uBAAuB,CAAC,GAAW;IAClD,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;IACrD,MAAM,OAAO,GAAG,8BAA8B,CAAC,GAAG,CAAC,CAAA;IACnD,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;AAC/F,CAAC;AAaD,SAAS,SAAS,CAAC,GAAW,EAAE,KAAuB;IACtD,MAAM,KAAK,GAAG,6CAA6C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrE,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,OAAO;QACN,GAAG;QACH,KAAK;QACL,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QACtB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QACpB,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QACpC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;KACpB,CAAA;AACF,CAAC;AAED,mGAAmG;AACnG,SAAS,WAAW,CAAC,IAAgB;IACpC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACjG,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;AACpD,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,IAAgB;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY;QAC7B,CAAC,CAAC,2BAA2B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACtD,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3F,OAAO,GAAG,IAAI,CAAC,MAAM,MAAM,IAAI,GAAG,IAAI,EAAE,CAAA;AACzC,CAAC;AAID,MAAM,QAAQ,GAAuC;IACpD,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,OAAO;IACb,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,OAAO;CACZ,CAAA;AAED,MAAM,GAAG,GAAuC;IAC/C,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,OAAO;CACZ,CAAA;AAED,SAAS,QAAQ,CAAC,MAA0B,EAAE,KAAuB;IACpE,wEAAwE;IACxE,MAAM,GAAG,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,MAAM,aAAa,CAAA;IAChE,MAAM,GAAG,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,MAAM,GAAG,CAAA;IACtD,OAAO;QACN;YACC,IAAI,EAAE,kBAAkB;YACxB,SAAS,EAAE,CAAC,iBAAiB,CAAC;YAC9B,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,GAAG;YACZ,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC;SACzB;QACD;YACC,IAAI,EAAE,kBAAkB;YACxB,SAAS,EAAE,CAAC,qBAAqB,CAAC;YAClC,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,GAAG;YACZ,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC;SACpB;KACD,CAAA;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,GAAiC;IAC7C;QACC,IAAI,EAAE,kBAAkB;QACxB,SAAS,EAAE,CAAC,iBAAiB,CAAC;QAC9B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,2CAA2C;QACpD,QAAQ,EAAE,OAAO;KACjB;IACD;QACC,IAAI,EAAE,kBAAkB;QACxB,SAAS,EAAE,CAAC,iBAAiB,CAAC;QAC9B,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,OAAO;KACjB;CACD,CAAA;AAUD,kEAAkE;AAClE,MAAM,UAAU,qBAAqB,CAAC,KAAqC;IAI1E,MAAM,GAAG,GAAqC,EAAE,CAAA;IAChD,MAAM,WAAW,GAAa,EAAE,CAAA;IAChC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,WAAW,CAAC,IAAI,CAAC,kBAAkB,GAAG,+BAA+B,CAAC,CAAA;YACtE,SAAQ;QACT,CAAC;QACD,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAA;QAC5C,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YACjB,WAAW,CAAC,IAAI,CAAC,kBAAkB,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;YAC7D,SAAQ;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACjC,wDAAwD;QACxD,qEAAqE;QACrE,0CAA0C;QAC1C,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAC9E,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;QAAE,GAAG,CAAC,GAAG,CAAC,GAAG,0BAA0B,CAAA;IACjE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,CAAA;AACnC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,QAAQ,CAAC,CAAmB,EAAE,CAAmB;IAChE,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAChF,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,mBAAmB,CAAC,KAAqC;IACxE,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;IAC/C,MAAM,WAAW,GAAG,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7D,IAAI,GAAG,KAAK,GAAG;YAAE,SAAQ;QACzB,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAClC,IAAI,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;;YACtB,WAAW,CAAC,IAAI,CAAC,kBAAkB,GAAG,sBAAsB,CAAC,CAAA;IACnE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAA;IAC7D,MAAM,MAAM,GAAG,MAAM;SACnB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC;SACvC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7E,MAAM,KAAK,GAAwB;QAClC,6DAA6D;QAC7D;YACC,IAAI,EAAE,kBAAkB;YACxB,SAAS,EAAE,CAAC,iBAAiB,CAAC;YAC9B,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,eAAe;YACxB,QAAQ,EAAE,OAAO;SACjB;QACD,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QACjE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACrE,GAAG,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;QAC3E,GAAG,OAAO;KACV,CAAA;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,CAAA;AACvD,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC,CAAA;AAEjF,qGAAqG;AACrG,SAAS,aAAa,CAAC,IAAuB;IAC7C,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,cAAc;YAClB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;QAC9D,KAAK,kBAAkB;YACtB,OAAO,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;QAC1F,KAAK,gBAAgB;YACpB,OAAO,CACN,IAAI,CAAC,QAAQ,KAAK,MAAM;gBACxB,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,iBAAiB,EAAE,CAAC;oBAChD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,qBAAqB,EAAE,CAAC,CAAC,CACtD,CAAA;QACF;YACC,OAAO,KAAK,CAAA;IACd,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CACnC,UAAwC,EACxC,SAAuC;IAEvC,OAAO;QACN,GAAG,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC;QACnC,GAAG,SAAS;QACZ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;KACpD,CAAA;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CACjC,KAAyB,EACzB,MAAc;IAEd,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAA;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;SACvC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,GAAG,CAAC;SAC9B,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;SAC5C,MAAM,CAAC,CAAC,IAAI,EAAsB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;IAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;IACxF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAA;IACvD,IAAI,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACpE,IAAI,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAA;IACtD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,0BAA0B,EAAE,CAAA;AAC3E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,KAAc;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IACjE,MAAM,MAAM,GAAG,KAAgC,CAAA;IAC/C,IAAI,QAAQ,KAAK,qBAAqB,EAAE,CAAC;QACxC,OAAO,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IACrE,CAAC;IACD,IAAI,QAAQ,KAAK,iBAAiB,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACtE,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAClD,OAAO,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAChF,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC"}

package/dist/schedule/build.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Turning what an operator (or a confirmed model proposal) asked for into a
+ * job, and what they are shown before they confirm it.
+ *
+ * Shared by `schedule add`, the TUI and the `schedule` tool's host, so every
+ * surface refuses the same things and shows the same preview:
+ *
+ * - an explicit permission set is required; there is no default;
+ * - `unmatched: allow` beside host execution needs `allowUnattendedHost`,
+ *   which only the CLI flag sets (the tool can never);
+ * - the folder is canonicalised and may not be `/`, the home directory, or
+ *   anything containing or inside `NAMZU_HOME`;
+ * - the token budget and the wall clock are always above zero;
+ * - the schedule parses in the job's zone and fires at least once.
+ *
+ * A built job is inert (`pending-confirmation`, no trust) until
+ * {@link confirmJob} records who confirmed it and on which surface.
+ */
+import { type ScheduleSpec } from '@namzu/sdk';
+import type { NamzuCliConfig } from '../config/schema.js';
+import type { SchedulePaths } from './paths.js';
+import { type CompiledJobPolicy, type PermissionInput } from './policy.js';
+import type { ConfirmationSurface, ScheduleBudget, ScheduleJob } from './types.js';
+export declare const DEFAULT_TOKEN_BUDGET = 500000;
+export declare const DEFAULT_TIMEOUT_MS: number;
+export declare const DEFAULT_MAX_ITERATIONS = 50;
+/** Below this many iterations a run's preview warns that it may stop unfinished. */
+export declare const FEW_ITERATIONS = 10;
+/** Below this token budget a run's preview warns: one model call resends the whole prompt. */
+export declare const FEW_TOKENS = 50000;
+export declare const DEFAULT_WAIT_FOR_PROVIDER_MS: number;
+export declare const DEFAULT_APPROVAL_TTL_MS: number;
+export declare const DEFAULT_KEEP_SESSIONS = 20;
+export declare const DEFAULT_PAUSE_AFTER_FAILURES = 5;
+export interface JobRequest {
+    readonly name: string;
+    readonly prompt: string;
+    readonly when: string;
+    /** A spec already parsed (an edit that keeps its schedule); `when` is then ignored. */
+    readonly spec?: ScheduleSpec;
+    readonly folder: string;
+    readonly tz?: string;
+    readonly permissions: PermissionInput;
+    readonly budget?: Partial<ScheduleBudget>;
+    /** `provider` or `provider/model`; absent: the operator's configured primary. */
+    readonly model?: string;
+    readonly effort?: string;
+    readonly includeSummary?: boolean;
+    readonly keepSessions?: number;
+    readonly pauseAfterFailures?: number;
+    readonly approvalTtlMs?: number;
+    readonly createdBy: ScheduleJob['createdBy'];
+    /** Only the CLI's `--allow-unattended-host` sets this. */
+    readonly allowUnattendedHost?: boolean;
+}
+export declare class JobRequestError extends Error {
+    readonly name = "JobRequestError";
+}
+/** The model a job pins: `provider[/model]`, or the configured primary. */
+export declare function resolveJobModel(spec: string | undefined, home?: string): ScheduleJob['model'];
+export declare function buildJob(request: JobRequest, context: {
+    readonly paths: SchedulePaths;
+    readonly config: Pick<NamzuCliConfig, 'limits'>;
+    readonly now: Date;
+    readonly osHome?: string;
+}): ScheduleJob;
+/**
+ * Record a confirmation: trust for the job's folder (for this job only —
+ * `trust.json` is not touched), the digest of what was confirmed, and the
+ * surface it happened on. A non-interactive surface confirms nothing.
+ */
+export declare function confirmJob(job: ScheduleJob, surface: ConfirmationSurface, now: Date, options?: {
+    readonly paused?: boolean;
+}): ScheduleJob;
+/**
+ * An edit: `current` with what `rebuilt` (the job built again from the
+ * edited request) says, and everything that makes it the same job kept —
+ * its id, name, creation, revision and state. The caller confirms it again
+ * and writes it with `updateJob`, so its history carries on.
+ */
+export declare function editedJob(current: ScheduleJob, rebuilt: ScheduleJob): ScheduleJob;
+/** At most how many times a day the schedule fires (the busiest of the next seven days). */
+export declare function runsPerDay(spec: ScheduleSpec, now: Date): number;
+/** The job as a person is asked to confirm it. Every line is computed here, never taken from a proposal. */
+export declare function previewLines(job: ScheduleJob, policy: CompiledJobPolicy, now: Date): string[];
+//# sourceMappingURL=build.d.ts.map

package/dist/schedule/build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/schedule/build.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAEN,KAAK,YAAY,EAQjB,MAAM,YAAY,CAAA;AACnB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAOzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,eAAe,EAAqB,MAAM,aAAa,CAAA;AAG7F,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAElF,eAAO,MAAM,oBAAoB,SAAU,CAAA;AAC3C,eAAO,MAAM,kBAAkB,QAAc,CAAA;AAC7C,eAAO,MAAM,sBAAsB,KAAK,CAAA;AACxC,oFAAoF;AACpF,eAAO,MAAM,cAAc,KAAK,CAAA;AAChC,8FAA8F;AAC9F,eAAO,MAAM,UAAU,QAAS,CAAA;AAChC,eAAO,MAAM,4BAA4B,QAAc,CAAA;AACvD,eAAO,MAAM,uBAAuB,QAAuB,CAAA;AAC3D,eAAO,MAAM,qBAAqB,KAAK,CAAA;AACvC,eAAO,MAAM,4BAA4B,IAAI,CAAA;AAE7C,MAAM,WAAW,UAAU;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,uFAAuF;IACvF,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAA;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;IACzC,iFAAiF;IACjF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;IACpC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,WAAW,CAAC,CAAA;IAC5C,0DAA0D;IAC1D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;CACtC;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACzC,SAAkB,IAAI,qBAAoB;CAC1C;AASD,2EAA2E;AAC3E,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAyB7F;AAED,wBAAgB,QAAQ,CACvB,OAAO,EAAE,UAAU,EACnB,OAAO,EAAE;IACR,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;IAC/C,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAA;IAClB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACxB,GACC,WAAW,CAqGb;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CACzB,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,mBAAmB,EAC5B,GAAG,EAAE,IAAI,EACT,OAAO,GAAE;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACzC,WAAW,CAeb;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,GAAG,WAAW,CAcjF;AAED,4FAA4F;AAC5F,wBAAgB,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,IAAI,GAAG,MAAM,CAUhE;AASD,4GAA4G;AAC5G,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,IAAI,GAAG,MAAM,EAAE,CA8C7F"}

package/dist/schedule/build.js

@@ -0,0 +1,267 @@
+/**
+ * Turning what an operator (or a confirmed model proposal) asked for into a
+ * job, and what they are shown before they confirm it.
+ *
+ * Shared by `schedule add`, the TUI and the `schedule` tool's host, so every
+ * surface refuses the same things and shows the same preview:
+ *
+ * - an explicit permission set is required; there is no default;
+ * - `unmatched: allow` beside host execution needs `allowUnattendedHost`,
+ *   which only the CLI flag sets (the tool can never);
+ * - the folder is canonicalised and may not be `/`, the home directory, or
+ *   anything containing or inside `NAMZU_HOME`;
+ * - the token budget and the wall clock are always above zero;
+ * - the schedule parses in the job's zone and fires at least once.
+ *
+ * A built job is inert (`pending-confirmation`, no trust) until
+ * {@link confirmJob} records who confirmed it and on which surface.
+ */
+import { SCHEDULE_CATCH_UP_WINDOW_MS, countOccurrences, describeSchedule, generateScheduleJobId, hostTimeZone, parseScheduleSpec, upcomingFireTimes, validateTimeZone, } from '@namzu/sdk';
+import { PROVIDER_REGISTRY, readPreferences, } from '../integrations/providers/index.js';
+import { checkJobFolder } from './folder.js';
+import { expandPermissions } from './policy.js';
+import { computeProjectDigest } from './store/digest.js';
+import { JOB_NAME, jobSecurityDigest } from './store/jobs.js';
+export const DEFAULT_TOKEN_BUDGET = 500_000;
+export const DEFAULT_TIMEOUT_MS = 30 * 60_000;
+export const DEFAULT_MAX_ITERATIONS = 50;
+/** Below this many iterations a run's preview warns that it may stop unfinished. */
+export const FEW_ITERATIONS = 10;
+/** Below this token budget a run's preview warns: one model call resends the whole prompt. */
+export const FEW_TOKENS = 50_000;
+export const DEFAULT_WAIT_FOR_PROVIDER_MS = 10 * 60_000;
+export const DEFAULT_APPROVAL_TTL_MS = 7 * 24 * 60 * 60_000;
+export const DEFAULT_KEEP_SESSIONS = 20;
+export const DEFAULT_PAUSE_AFTER_FAILURES = 5;
+export class JobRequestError extends Error {
+    name = 'JobRequestError';
+}
+function positive(label, value, fallback) {
+    const v = value ?? fallback;
+    if (!Number.isSafeInteger(v) || v <= 0)
+        throw new JobRequestError(`${label} must be a whole number above zero`);
+    return v;
+}
+/** The model a job pins: `provider[/model]`, or the configured primary. */
+export function resolveJobModel(spec, home) {
+    if (spec) {
+        const [provider = '', ...rest] = spec.split('/');
+        if (!(provider in PROVIDER_REGISTRY)) {
+            throw new JobRequestError(`unknown provider "${provider}" (known: ${Object.keys(PROVIDER_REGISTRY).join(', ')})`);
+        }
+        const model = rest.join('/');
+        return {
+            provider,
+            ...(model ? { model } : { model: PROVIDER_REGISTRY[provider].defaultModel }),
+        };
+    }
+    const read = readPreferences(home);
+    const primary = read.status === 'ok' ? read.prefs.providers[0] : undefined;
+    if (!primary) {
+        throw new JobRequestError('no provider is configured; pass --model <provider>/<model> or pick one in namzu first');
+    }
+    return {
+        provider: primary.id,
+        model: primary.model ?? PROVIDER_REGISTRY[primary.id].defaultModel,
+    };
+}
+export function buildJob(request, context) {
+    if (!JOB_NAME.test(request.name)) {
+        throw new JobRequestError(`"${request.name}" is not a job name: lowercase letters, digits and dashes, starting with a letter or digit`);
+    }
+    if (!request.prompt.trim())
+        throw new JobRequestError('the prompt is empty');
+    const permissions = (() => {
+        try {
+            return expandPermissions(request.permissions);
+        }
+        catch (error) {
+            throw new JobRequestError(error instanceof Error ? error.message : String(error));
+        }
+    })();
+    if (permissions.unmatched === 'allow' &&
+        permissions.execution === 'host' &&
+        !request.allowUnattendedHost) {
+        throw new JobRequestError('unmatched: allow with execution on the host lets an unattended run do anything no rule forbids; pass --allow-unattended-host to mean it, or use --execution sandbox');
+    }
+    const folder = checkJobFolder(request.folder, {
+        namzuHome: context.paths.home,
+        ...(context.osHome ? { osHome: context.osHome } : {}),
+    });
+    if (!folder.ok)
+        throw new JobRequestError(folder.reason);
+    const extra = (permissions.additionalDirectories ?? []).map((dir) => {
+        const checked = checkJobFolder(dir, {
+            namzuHome: context.paths.home,
+            ...(context.osHome ? { osHome: context.osHome } : {}),
+        });
+        if (!checked.ok)
+            throw new JobRequestError(`additional directory: ${checked.reason}`);
+        return checked.canonical;
+    });
+    const tz = validateTimeZone(request.tz ?? hostTimeZone());
+    let spec;
+    try {
+        spec = request.spec ?? parseScheduleSpec(request.when, { now: context.now, tz });
+    }
+    catch (error) {
+        throw new JobRequestError(error instanceof Error ? error.message : String(error));
+    }
+    const limits = context.config.limits ?? {};
+    const budget = {
+        maxIterations: positive('max iterations', request.budget?.maxIterations, limits.maxIterations || DEFAULT_MAX_ITERATIONS),
+        tokenBudget: positive('the token budget', request.budget?.tokenBudget, limits.tokenBudget || DEFAULT_TOKEN_BUDGET),
+        timeoutMs: positive('the timeout', request.budget?.timeoutMs, limits.timeoutMs || DEFAULT_TIMEOUT_MS),
+        waitForProviderMs: request.budget?.waitForProviderMs ?? limits.waitForProviderMs ?? DEFAULT_WAIT_FOR_PROVIDER_MS,
+    };
+    if (budget.timeoutMs > 2_147_483_647 - 60_000)
+        throw new JobRequestError('the timeout is too long');
+    const at = context.now.toISOString();
+    return {
+        v: 1,
+        kind: 'schedule-job',
+        id: generateScheduleJobId(),
+        name: request.name,
+        revision: 0,
+        createdAt: at,
+        updatedAt: at,
+        createdBy: request.createdBy,
+        prompt: request.prompt,
+        folder: { path: request.folder, canonical: folder.canonical },
+        trust: null,
+        schedule: spec,
+        permissions: { ...permissions, ...(extra.length > 0 ? { additionalDirectories: extra } : {}) },
+        budget,
+        model: {
+            ...resolveJobModel(request.model, context.paths.home),
+            ...(request.effort ? { effort: request.effort } : {}),
+        },
+        catchUp: { windowMs: SCHEDULE_CATCH_UP_WINDOW_MS },
+        notify: {
+            finished: true,
+            failed: true,
+            awaitingApproval: true,
+            includeSummary: request.includeSummary === true,
+        },
+        failurePolicy: {
+            pauseAfterFailures: request.pauseAfterFailures ?? DEFAULT_PAUSE_AFTER_FAILURES,
+        },
+        retention: { keepSessions: request.keepSessions ?? DEFAULT_KEEP_SESSIONS },
+        state: 'pending-confirmation',
+        approvalTtlMs: request.approvalTtlMs ?? DEFAULT_APPROVAL_TTL_MS,
+        projectDigest: computeProjectDigest(folder.canonical),
+        confirmation: null,
+    };
+}
+/**
+ * Record a confirmation: trust for the job's folder (for this job only —
+ * `trust.json` is not touched), the digest of what was confirmed, and the
+ * surface it happened on. A non-interactive surface confirms nothing.
+ */
+export function confirmJob(job, surface, now, options = {}) {
+    if (surface === 'cli-noninteractive')
+        return { ...job, state: 'pending-confirmation', confirmation: null };
+    const at = now.toISOString();
+    const trusted = {
+        ...job,
+        trust: { canonical: job.folder.canonical, grantedAt: at, by: 'operator-confirmation' },
+        projectDigest: computeProjectDigest(job.folder.canonical),
+    };
+    return {
+        ...trusted,
+        state: options.paused ? 'paused' : 'active',
+        ...(options.paused ? { pausedAt: at, pausedBy: 'operator' } : {}),
+        confirmation: { at, surface, digest: jobSecurityDigest(trusted) },
+    };
+}
+/**
+ * An edit: `current` with what `rebuilt` (the job built again from the
+ * edited request) says, and everything that makes it the same job kept —
+ * its id, name, creation, revision and state. The caller confirms it again
+ * and writes it with `updateJob`, so its history carries on.
+ */
+export function editedJob(current, rebuilt) {
+    return {
+        ...current,
+        prompt: rebuilt.prompt,
+        folder: rebuilt.folder,
+        schedule: rebuilt.schedule,
+        permissions: rebuilt.permissions,
+        budget: rebuilt.budget,
+        model: rebuilt.model,
+        notify: rebuilt.notify,
+        failurePolicy: rebuilt.failurePolicy,
+        retention: rebuilt.retention,
+        approvalTtlMs: rebuilt.approvalTtlMs,
+    };
+}
+/** At most how many times a day the schedule fires (the busiest of the next seven days). */
+export function runsPerDay(spec, now) {
+    if (spec.kind === 'at')
+        return 1;
+    if (spec.kind === 'every')
+        return Math.ceil((24 * 60 * 60_000) / spec.everyMs);
+    let most = 0;
+    for (let d = 0; d < 7; d++) {
+        const from = new Date(now.getTime() + d * 24 * 60 * 60_000);
+        const to = new Date(from.getTime() + 24 * 60 * 60_000);
+        most = Math.max(most, countOccurrences(spec, from, to).count);
+    }
+    return most;
+}
+function duration(ms) {
+    if (ms % 86_400_000 === 0)
+        return `${ms / 86_400_000} d`;
+    if (ms % 3_600_000 === 0)
+        return `${ms / 3_600_000} h`;
+    if (ms % 60_000 === 0)
+        return `${ms / 60_000} min`;
+    return `${Math.round(ms / 1000)} s`;
+}
+/** The job as a person is asked to confirm it. Every line is computed here, never taken from a proposal. */
+export function previewLines(job, policy, now) {
+    const tz = job.schedule.kind === 'cron' ? job.schedule.tz : hostTimeZone();
+    const next = upcomingFireTimes(job.schedule, now, 3).map((t) => new Intl.DateTimeFormat('en-GB', {
+        dateStyle: 'medium',
+        timeStyle: 'short',
+        timeZone: tz,
+    }).format(t));
+    const perDay = runsPerDay(job.schedule, now);
+    return [
+        `Job         ${job.name}`,
+        `Folder      ${job.folder.canonical}`,
+        `When        ${describeSchedule(job.schedule, { tz })}`,
+        `Next        ${next.length > 0 ? next.join(' · ') : 'never'}`,
+        `Model       ${job.model.provider}${job.model.model ? `/${job.model.model}` : ''}${job.model.effort ? ` (${job.model.effort})` : ''}`,
+        `Budget      ${job.budget.tokenBudget.toLocaleString('en-US')} tokens, ${job.budget.maxIterations} iterations, ${duration(job.budget.timeoutMs)} per run`,
+        // A proposal once set 1, read as "one post per run": the first run
+        // stopped after its first model call, with nothing done.
+        ...(job.budget.maxIterations < FEW_ITERATIONS
+            ? [
+                `Warning     ${job.budget.maxIterations} iteration${job.budget.maxIterations === 1 ? '' : 's'} is one model call${job.budget.maxIterations === 1 ? '' : ' each'} with its tool calls; most tasks need more (the default is ${DEFAULT_MAX_ITERATIONS}), and a run that runs out stops unfinished`,
+            ]
+            : []),
+        // A proposal once set 4,000 tokens for a job whose runs each took
+        // about 110,000: every model call resends the whole prompt.
+        ...(job.budget.tokenBudget < FEW_TOKENS
+            ? [
+                `Warning     ${job.budget.tokenBudget.toLocaleString('en-US')} tokens may not cover even a few model calls, each of which resends the whole prompt; a run that runs out stops unfinished (the default is ${DEFAULT_TOKEN_BUDGET.toLocaleString('en-US')})`,
+            ]
+            : []),
+        `Ceiling     up to ${perDay} run${perDay === 1 ? '' : 's'} a day × ${job.budget.tokenBudget.toLocaleString('en-US')} tokens = ${(perDay * job.budget.tokenBudget).toLocaleString('en-US')} tokens a day`,
+        `Runs on     ${job.permissions.execution === 'host' ? 'this machine (host)' : 'the sandbox'}`,
+        ...(policy.network ? ['Network     THIS RUN CAN REACH THE NETWORK'] : []),
+        ...(job.permissions.browser
+            ? [
+                `Browser     SIGNED IN AS YOU: profile ${job.permissions.browser.profile}, only ${Object.keys(job.permissions.browser.sites).join(', ')}`,
+            ]
+            : []),
+        ...(job.permissions.unmatched === 'allow'
+            ? ['Unmatched   CALLS NO RULE COVERS RUN WITHOUT ASKING']
+            : []),
+        'Permissions',
+        ...policy.lines.map((line) => `  ${line}`),
+        `Approvals   a call that waits for you expires after ${duration(job.approvalTtlMs)}`,
+    ];
+}
+//# sourceMappingURL=build.js.map