@namzu/sdk 52.4.0 → 52.6.0

package/src/authorization/shell-paths.ts

@@ -38,6 +38,8 @@ export interface ShellInvocation {
 	readonly program: string
 	/** Its arguments, as the shell passes them. */
 	readonly args: readonly ShellWord[]
+	/** The redirections written on this command itself, when the lexer attached them. */
+	readonly redirections?: readonly ShellRedirection[]
 }
 
 /** What the lexer found, in the shape this module and the removal check share. */
@@ -50,13 +52,20 @@ export interface ShellReading {
 
 const EXEC_FLAGS = new Set(['-exec', '-execdir', '-ok', '-okdir'])
 
-function invocationOf(words: readonly ShellWord[]): ShellInvocation | undefined {
+function invocationOf(
+	words: readonly ShellWord[],
+	redirections?: readonly ShellRedirection[],
+): ShellInvocation | undefined {
 	if (words.length === 0) return undefined
 	const step = unwrapReexecChain(words)
 	if (!('rest' in step)) return undefined
 	const [head, ...args] = step.rest
 	if (head === undefined || head.expands) return undefined
-	return { program: basename(head.value), args }
+	return {
+		program: basename(head.value),
+		args,
+		...(redirections !== undefined ? { redirections } : {}),
+	}
 }
 
 /** Every program a line runs, and every redirection it carries. */
@@ -64,7 +73,7 @@ export function readShellLine(line: string, dialect: ShellDialect): ShellReading
 	const lexed = lexShellCommandLine(line, { dialect })
 	const invocations: ShellInvocation[] = []
 	for (const command of lexed.commands) {
-		const own = invocationOf(command.words.slice(command.assignments))
+		const own = invocationOf(command.words.slice(command.assignments), command.redirections)
 		if (own === undefined) continue
 		invocations.push(own)
 		if (own.program !== 'find') continue
@@ -102,8 +111,20 @@ export interface ShellPathUse {
 	readonly via: string
 	/** True when the word is decided at runtime and `path` is not what it will be. */
 	readonly unresolved: boolean
+	/**
+	 * Where a relative `path` starts from, when an earlier `cd` in the line moved
+	 * the shell. Absent: the directory the line began in. Only a `cd` to one
+	 * literal relative directory is followed; anything else is `unknown`.
+	 */
+	readonly directory?: ShellDirectory
 }
 
+/** Where a `cd` earlier in the line left the shell, relative to where the line began. */
+export type ShellDirectory =
+	| { readonly relative: string }
+	/** A `cd` to a runtime-decided, absolute, `~` or `-` target, or a `pushd`/`popd`/`chdir`. */
+	| { readonly unknown: true }
+
 export interface ShellPathAccess {
 	readonly uses: readonly ShellPathUse[]
 	/** A `cd`, `pushd`, `popd` or `chdir` runs somewhere in the line. */
@@ -150,6 +171,105 @@ function operands(args: Args): ShellWord[] {
 	return out
 }
 
+/** `value` as a word that keeps whether `from` will still be expanded by the shell. */
+function derived(from: ShellWord, value: string): ShellWord {
+	return { ...from, text: value, value }
+}
+
+/**
+ * Operands of `cp` and `mv`. GNU lets a flag follow an operand, and the
+ * destination can be a flag's value: `--target-directory=D`, `--target-directory D`,
+ * `-tD`, `-t D`, also inside a cluster (`-at D`, `-rtD`). Reading the operands
+ * alone would miss the attached and the trailing forms.
+ */
+function copyOperands(args: Args): ShellWord[] {
+	const out: ShellWord[] = []
+	let afterDashes = false
+	for (let i = 0; i < args.length; i += 1) {
+		const arg = args[i] as ShellWord
+		const text = arg.value
+		if (afterDashes || text === '-' || !text.startsWith('-')) {
+			out.push(arg)
+			continue
+		}
+		if (text === '--') {
+			afterDashes = true
+			continue
+		}
+		if (text.startsWith('--')) {
+			const eq = text.indexOf('=')
+			const name = eq >= 0 ? text.slice(0, eq) : text
+			if (name === '--target-directory') {
+				if (eq >= 0) out.push(derived(arg, text.slice(eq + 1)))
+				else if (args[i + 1] !== undefined) {
+					out.push(args[i + 1] as ShellWord)
+					i += 1
+				}
+			} else if (name === '--suffix' && eq < 0) i += 1
+			continue
+		}
+		for (let j = 1; j < text.length; j += 1) {
+			const letter = text[j] as string
+			if (letter !== 't' && letter !== 'S') continue
+			const rest = text.slice(j + 1)
+			if (letter === 't') {
+				if (rest !== '') out.push(derived(arg, rest))
+				else if (args[i + 1] !== undefined) {
+					out.push(args[i + 1] as ShellWord)
+					i += 1
+				}
+			} else if (rest === '') i += 1
+			break
+		}
+	}
+	return out
+}
+
+/**
+ * The files `touch` reads: `--reference=F`, `--reference F`, `-rF`, `-r F`
+ * (also in a cluster). They are not written, but a path outside the roots is
+ * the same question whichever way it is opened.
+ */
+function touchReferences(args: Args): ShellWord[] {
+	const out: ShellWord[] = []
+	let afterDashes = false
+	for (let i = 0; i < args.length; i += 1) {
+		const arg = args[i] as ShellWord
+		const text = arg.value
+		if (afterDashes || text === '-' || !text.startsWith('-')) continue
+		if (text === '--') {
+			afterDashes = true
+			continue
+		}
+		if (text.startsWith('--')) {
+			const eq = text.indexOf('=')
+			const name = eq >= 0 ? text.slice(0, eq) : text
+			if (name === '--reference') {
+				if (eq >= 0) out.push(derived(arg, text.slice(eq + 1)))
+				else if (args[i + 1] !== undefined) {
+					out.push(args[i + 1] as ShellWord)
+					i += 1
+				}
+			}
+			continue
+		}
+		for (let j = 1; j < text.length; j += 1) {
+			const letter = text[j] as string
+			if (letter !== 'r' && letter !== 'd' && letter !== 't') continue
+			const rest = text.slice(j + 1)
+			if (letter === 'r') {
+				if (rest !== '') out.push(derived(arg, rest))
+				else if (args[i + 1] !== undefined) {
+					out.push(args[i + 1] as ShellWord)
+					i += 1
+				}
+			} else if (rest === '') i += 1
+			break
+		}
+	}
+	return out
+}
+
 interface FlagTable {
 	readonly booleanShort: string
 	readonly valuedShort: string
@@ -681,11 +801,11 @@ const EXTRACTORS: Readonly<Record<string, (args: Args) => ShellWord[]>> = {
 	ls: lsOperands,
 	find: findOperands,
 	mkdir: operands,
-	touch: operands,
+	touch: touchOperands,
 	rm: operands,
 	rmdir: operands,
-	mv: operands,
-	cp: operands,
+	mv: copyOperands,
+	cp: copyOperands,
 	cat: operands,
 	head: operands,
 	tail: operands,
@@ -845,6 +965,38 @@ const EXTRACTORS: Readonly<Record<string, (args: Args) => ShellWord[]>> = {
 	git: gitOperands,
 }
 
+/**
+ * Operands of `touch`: the files it changes, with the values of `-d`, `-t` and
+ * `-r`/`--reference` taken out (they are a date, a stamp and a file that is read).
+ */
+function touchOperands(args: Args): ShellWord[] {
+	const out: ShellWord[] = []
+	let afterDashes = false
+	for (let i = 0; i < args.length; i += 1) {
+		const arg = args[i] as ShellWord
+		const text = arg.value
+		if (afterDashes || text === '-' || !text.startsWith('-')) {
+			out.push(arg)
+			continue
+		}
+		if (text === '--') {
+			afterDashes = true
+			continue
+		}
+		if (text.startsWith('--')) {
+			if (/^--(?:reference|date|time)$/.test(text)) i += 1
+			continue
+		}
+		for (let j = 1; j < text.length; j += 1) {
+			if ('rdt'.includes(text[j] as string)) {
+				if (j === text.length - 1) i += 1
+				break
+			}
+		}
+	}
+	return out
+}
+
 /** Commands that create or change what their operands name. `sed` is added per call when it edits in place. */
 const WRITERS = new Set(['mkdir', 'touch', 'rm', 'rmdir', 'mv', 'cp', 'tee'])
 
@@ -860,68 +1012,129 @@ function editsInPlace(args: Args): boolean {
 	})
 }
 
+/** The directory a line is in after `invocation`, given the one before it. */
+function directoryAfter(
+	before: ShellDirectory | undefined,
+	invocation: ShellInvocation,
+): ShellDirectory {
+	if (before !== undefined && 'unknown' in before) return before
+	if (invocation.program !== 'cd') return { unknown: true }
+	const operands = invocation.args.filter((a) => a.expands || !/^-[LPe@]+$/.test(a.value))
+	const [target, ...extra] = operands
+	if (target === undefined || extra.length > 0 || target.expands || target.value === '') {
+		return { unknown: true }
+	}
+	const value = target.value
+	if (value === '-' || value === '--' || value.startsWith('/') || value.startsWith('~')) {
+		return { unknown: true }
+	}
+	const base = before?.relative
+	return { relative: base === undefined ? value : `${base}/${value}` }
+}
+
 /**
  * The paths `reading` names: positional arguments of the commands in the
  * table, and the targets of its redirections.
+ *
+ * Each use carries the directory an earlier literal `cd` left the shell in
+ * (see {@link ShellPathUse.directory}), so a caller can tell
+ * `cd packages/sdk && echo x > out.txt` from `cd "$X" && echo x > out.txt`.
  */
 export function shellPathAccess(reading: ShellReading): ShellPathAccess {
 	const uses: ShellPathUse[] = []
 	let changesDirectory = false
-	for (const { program, args } of reading.invocations) {
+	let directory: ShellDirectory | undefined
+	const covered = new Set<ShellRedirection>()
+	for (const invocation of reading.invocations) {
+		const { program, args } = invocation
 		if (CD_PROGRAMS.has(program)) changesDirectory = true
 		const extract = EXTRACTORS[program]
-		if (extract === undefined) continue
-		const access: PathAccess =
-			WRITERS.has(program) || (program === 'sed' && editsInPlace(args)) ? 'write' : 'read'
-		for (const arg of extract(args)) {
-			if (arg.value === '' || isHarmlessTarget(arg.value)) continue
-			uses.push({
-				path: arg.value,
-				access,
-				via: program,
-				unresolved: expandsAtRuntime(arg),
-			})
+		if (extract !== undefined) {
+			const access: PathAccess =
+				WRITERS.has(program) || (program === 'sed' && editsInPlace(args)) ? 'write' : 'read'
+			for (const arg of extract(args)) {
+				if (arg.value === '' || isHarmlessTarget(arg.value)) continue
+				uses.push({
+					path: arg.value,
+					access,
+					via: program,
+					unresolved: expandsAtRuntime(arg),
+					...(directory !== undefined ? { directory } : {}),
+				})
+			}
+		}
+		if (program === 'touch') {
+			for (const arg of touchReferences(args)) {
+				if (arg.value === '' || isHarmlessTarget(arg.value)) continue
+				uses.push({
+					path: arg.value,
+					access: 'read',
+					via: program,
+					unresolved: expandsAtRuntime(arg),
+					...(directory !== undefined ? { directory } : {}),
+				})
+			}
+		}
+		for (const redirection of invocation.redirections ?? []) {
+			covered.add(redirection)
+			pushRedirection(uses, redirection, directory)
 		}
+		if (CD_PROGRAMS.has(program)) directory = directoryAfter(directory, invocation)
 	}
 	for (const redirection of reading.redirections) {
-		const target = redirection.target
-		if (target.value === '' || isHarmlessTarget(target.value)) continue
-		switch (redirection.operator) {
-			case '>':
-			case '>>':
-			case '>|':
-			case '&>':
-			case '&>>':
-			case '<>':
+		if (covered.has(redirection)) continue
+		// Not tied to a command the reader saw (a compound command's own), so
+		// where it runs cannot be told once a `cd` is in the line.
+		pushRedirection(uses, redirection, changesDirectory ? { unknown: true } : undefined)
+	}
+	return { uses, changesDirectory }
+}
+
+function pushRedirection(
+	uses: ShellPathUse[],
+	redirection: ShellRedirection,
+	directory: ShellDirectory | undefined,
+): void {
+	const target = redirection.target
+	if (target.value === '' || isHarmlessTarget(target.value)) return
+	const where = directory !== undefined ? { directory } : {}
+	switch (redirection.operator) {
+		case '>':
+		case '>>':
+		case '>|':
+		case '&>':
+		case '&>>':
+		case '<>':
+			uses.push({
+				path: target.value,
+				access: 'write',
+				via: 'redirect',
+				unresolved: expandsAtRuntime(target),
+				...where,
+			})
+			break
+		case '>&':
+			// `>&2` and `>&-` duplicate or close a descriptor; any other word is a file.
+			if (!/^(?:\d+-?|-)$/.test(target.value)) {
 				uses.push({
 					path: target.value,
 					access: 'write',
 					via: 'redirect',
 					unresolved: expandsAtRuntime(target),
+					...where,
 				})
-				break
-			case '>&':
-				// `>&2` and `>&-` duplicate or close a descriptor; any other word is a file.
-				if (!/^(?:\d+-?|-)$/.test(target.value)) {
-					uses.push({
-						path: target.value,
-						access: 'write',
-						via: 'redirect',
-						unresolved: expandsAtRuntime(target),
-					})
-				}
-				break
-			case '<':
-				uses.push({
-					path: target.value,
-					access: 'read',
-					via: 'redirect',
-					unresolved: expandsAtRuntime(target),
-				})
-				break
-			default:
-				break
-		}
+			}
+			break
+		case '<':
+			uses.push({
+				path: target.value,
+				access: 'read',
+				via: 'redirect',
+				unresolved: expandsAtRuntime(target),
+				...where,
+			})
+			break
+		default:
+			break
 	}
-	return { uses, changesDirectory }
 }

package/src/bridge/acp/server.ts

@@ -142,6 +142,14 @@ export interface AcpServerOptions {
 	readonly supportsPromptAttachments?: boolean
 	/** The host applies optional effort and permission settings to the exact turn. */
 	readonly supportsPromptOptions?: boolean
+	/**
+	 * Which of the newer review modes, `bypass` and `classify`, the gateway
+	 * applies when a prompt asks for one in its options. Omitted, a prompt that
+	 * asks for either is refused with an error that says so, before any turn
+	 * starts, rather than reaching a gateway that cannot honour it. Advertised
+	 * as `promptPermissionModes` at initialization.
+	 */
+	readonly promptPermissionModes?: readonly ('bypass' | 'classify')[]
 	/** Emit planning notifications only to clients declaring namzu/tasks. */
 	readonly supportsTaskNotifications?: boolean
 	readonly transport: MCPTransport
@@ -465,6 +473,9 @@ export class ACPServer {
 			protocolVersion: ACP_PROTOCOL_VERSION,
 			...(this.options.supportsPromptAttachments ? { promptAttachments: true } : {}),
 			...(this.options.supportsPromptOptions ? { promptOptions: true } : {}),
+			...(this.options.supportsPromptOptions && this.options.promptPermissionModes?.length
+				? { promptPermissionModes: [...this.options.promptPermissionModes] }
+				: {}),
 			agentInfo: this.options.agentInfo,
 			// From the registry, per call. A hard-coded list here would be a
 			// second definition of the command surface.
@@ -850,6 +861,15 @@ export class ACPServer {
 			(permissionMode !== undefined && !isReviewMode(permissionMode))
 		)
 			throw new AcpError(ACP_ERROR_CODES.INVALID_PARAMS, 'Invalid prompt settings.')
+		if (
+			(permissionMode === 'bypass' || permissionMode === 'classify') &&
+			this.options.promptPermissionModes?.includes(permissionMode) !== true
+		) {
+			throw new AcpError(
+				ACP_ERROR_CODES.INVALID_PARAMS,
+				`This agent does not accept the "${permissionMode}" permission mode in prompt settings.`,
+			)
+		}
 		return {
 			...(effort
 				? { effort: effort as NonNullable<AcpSessionPromptParams['options']>['effort'] }

package/src/public-runtime.ts

@@ -1431,7 +1431,11 @@ export { AUTO_APPROVE_POLICY_NAME } from './runtime/query/approval-policy.js'
 // accept-edits, plan, strict — as an `ApprovalPolicy`. See
 // `runtime/query/review-policy.ts`.
 export {
+	ACCEPT_EDITS_SHELL_COMMANDS,
 	ACCEPT_EDITS_TOOLS,
+	ASK_RULE_UNATTENDED_REFUSAL,
+	CLASSIFIER_SAFE_TOOLS,
+	CLASSIFIER_TRANSCRIPT_TOO_LONG_FEEDBACK,
 	OUTSIDE_ROOTS_UNATTENDED_REFUSAL,
 	PLAN_MODE_REFUSAL,
 	REVIEW_EXEMPT_WRITES,
@@ -1440,12 +1444,26 @@ export {
 	SCREEN_CONSENT_DECLINED_FEEDBACK,
 	SCREEN_CONSENT_UNATTENDED_REFUSAL,
 	STRICT_MODE_REFUSAL,
+	UNFINISHED_CHECK_UNATTENDED_REFUSAL,
 	batchNeedsReview,
 	createReviewHandler,
 	createReviewPolicy,
 	isReviewExempt,
 	isReviewMode,
+	modeReviewsAllowedCalls,
 } from './runtime/query/review-policy.js'
+// The model that decides, in the `classify` review mode, what a person would
+// otherwise be asked. See `runtime/query/auto-review/`.
+export {
+	AUTO_REVIEW_DEFAULTS_MARKER,
+	DEFAULT_ALLOW as DEFAULT_AUTO_REVIEW_ALLOW,
+	DEFAULT_AUTO_REVIEW_LIMITS,
+	DEFAULT_HARD_DENY as DEFAULT_AUTO_REVIEW_HARD_DENY,
+	DEFAULT_SOFT_DENY as DEFAULT_AUTO_REVIEW_SOFT_DENY,
+	autoReviewBlockedFeedback,
+	createAutoReviewClassifier,
+	resolveAutoReviewRules,
+} from './runtime/query/auto-review/index.js'
 // What the model is told when a person declines a call without words of their own.
 export { DECLINED_TOOL_CALL_FEEDBACK } from './runtime/query/declined.js'
 

package/src/public-types.ts

@@ -436,6 +436,17 @@ export type {
 	CompactionSkipReason,
 } from './compaction/plan.js'
 
+export type {
+	AutoReviewClassifier,
+	AutoReviewClassifierOptions,
+	AutoReviewDecision,
+	AutoReviewLimits,
+	AutoReviewRequest,
+	AutoReviewRules,
+	AutoReviewStage,
+	ResolvedAutoReviewRules,
+} from './runtime/query/auto-review/index.js'
+
 export type {
 	ReviewExemption,
 	ReviewMode,