@orchid-labs/pluxx 0.1.0 → 0.1.3

package/src/permissions.ts

@@ -1,258 +0,0 @@
-export const PERMISSION_SELECTOR_KINDS = ['Bash', 'Edit', 'Read', 'MCP', 'Skill'] as const
-
-export type PermissionRuleKind = typeof PERMISSION_SELECTOR_KINDS[number]
-export type PermissionAction = 'allow' | 'ask' | 'deny'
-
-export interface ParsedPermissionRule {
-  action: PermissionAction
-  raw: string
-  kind: PermissionRuleKind
-  pattern: string
-}
-
-export interface OpenCodePermissionMap {
-  [tool: string]: PermissionAction
-}
-
-const PERMISSION_RULE_REGEX = new RegExp(
-  `^(${PERMISSION_SELECTOR_KINDS.join('|')})\\((.+)\\)$`,
-)
-
-export function parsePermissionRule(raw: string): Omit<ParsedPermissionRule, 'action'> | null {
-  const trimmed = raw.trim()
-  const match = trimmed.match(PERMISSION_RULE_REGEX)
-  if (!match) return null
-
-  const kind = match[1] as PermissionRuleKind
-  const pattern = match[2].trim()
-  if (!pattern) return null
-
-  return {
-    raw: trimmed,
-    kind,
-    pattern,
-  }
-}
-
-export function collectPermissionRules(
-  permissions: Partial<Record<PermissionAction, string[]>> | undefined,
-): ParsedPermissionRule[] {
-  if (!permissions) return []
-
-  const actions: PermissionAction[] = ['allow', 'ask', 'deny']
-  const rules: ParsedPermissionRule[] = []
-
-  for (const action of actions) {
-    for (const raw of permissions[action] ?? []) {
-      const parsed = parsePermissionRule(raw)
-      if (!parsed) continue
-      rules.push({
-        ...parsed,
-        action,
-      })
-    }
-  }
-
-  return rules
-}
-
-const ACTION_PRIORITY: Record<PermissionAction, number> = {
-  allow: 0,
-  ask: 1,
-  deny: 2,
-}
-
-function mergeAction(current: PermissionAction | undefined, next: PermissionAction): PermissionAction {
-  if (!current) return next
-  return ACTION_PRIORITY[next] > ACTION_PRIORITY[current] ? next : current
-}
-
-export function permissionRulesNeedToolLevelDowngrade(
-  permissions: Partial<Record<PermissionAction, string[]>> | undefined,
-): boolean {
-  return collectPermissionRules(permissions).some((rule) => rule.pattern !== '*')
-}
-
-export function buildOpenCodePermissionMap(
-  permissions: Partial<Record<PermissionAction, string[]>> | undefined,
-): OpenCodePermissionMap {
-  const rules = collectPermissionRules(permissions)
-  const output: OpenCodePermissionMap = {}
-
-  const toolAliases: Record<PermissionRuleKind, string[]> = {
-    Bash: ['bash', 'shell'],
-    Edit: ['edit', 'write'],
-    Read: ['read'],
-    MCP: ['mcp'],
-    Skill: ['skill'],
-  }
-
-  for (const rule of rules) {
-    for (const tool of toolAliases[rule.kind]) {
-      output[tool] = mergeAction(output[tool], rule.action)
-    }
-  }
-
-  return output
-}
-
-export function buildGeneratedPermissionHookScript(
-  permissions: Partial<Record<PermissionAction, string[]>> | undefined,
-): string | null {
-  const rules = collectPermissionRules(permissions)
-  if (rules.length === 0) return null
-
-  return `#!/usr/bin/env node
-const RULES = ${JSON.stringify(rules, null, 2)};
-const ACTION_PRIORITY = { allow: 0, ask: 1, deny: 2 };
-
-function wildcardToRegExp(pattern) {
-  const escaped = pattern
-    .replace(/[.+^$(){}|[\\]\\\\]/g, "\\\\$&")
-    .replace(/\\*/g, ".*");
-  return new RegExp("^" + escaped + "$", "i");
-}
-
-function matchesPattern(pattern, value) {
-  if (!value) return false;
-  return wildcardToRegExp(pattern).test(String(value));
-}
-
-function firstValue(...values) {
-  return values.find((value) => typeof value === "string" && value.trim() !== "");
-}
-
-function parseJsonInput() {
-  const chunks = [];
-  process.stdin.setEncoding("utf8");
-  return new Promise((resolve, reject) => {
-    process.stdin.on("data", (chunk) => chunks.push(chunk));
-    process.stdin.on("end", () => {
-      const raw = chunks.join("").trim();
-      if (!raw) return resolve({});
-      try {
-        resolve(JSON.parse(raw));
-      } catch (error) {
-        reject(error);
-      }
-    });
-    process.stdin.on("error", reject);
-  });
-}
-
-function parseMcpName(raw) {
-  if (!raw) return undefined;
-  if (raw.startsWith("mcp__")) {
-    const match = raw.match(/^mcp__([^_]+)__(.+)$/);
-    if (match) return match[1] + "." + match[2].replace(/__/g, ".");
-  }
-  return raw;
-}
-
-function inferCandidates(mode, event) {
-  const toolName = firstValue(event.tool_name, event.toolName, event.tool, event.matcher);
-  const input = event.tool_input ?? event.toolInput ?? event.input ?? {};
-  const candidates = [];
-
-  const filePath = firstValue(
-    event.file_path,
-    input.file_path,
-    input.path,
-    input.filePath,
-    input.target_file,
-    input.targetFile
-  );
-  const command = firstValue(event.command, input.command, input.cmd, input.shell_command);
-  const skillName = firstValue(input.name, input.skill_name, input.skillName);
-  const mcpName = parseMcpName(firstValue(event.tool_name, input.tool_name, input.name));
-
-  if (mode === "cursor-shell") {
-    if (command) candidates.push({ kind: "Bash", value: command });
-    return candidates;
-  }
-
-  if (mode === "cursor-read") {
-    if (filePath) candidates.push({ kind: "Read", value: filePath });
-    return candidates;
-  }
-
-  if (mode === "cursor-mcp") {
-    if (mcpName) candidates.push({ kind: "MCP", value: mcpName });
-    return candidates;
-  }
-
-  const normalizedTool = String(toolName || "").toLowerCase();
-
-  if (command && /(bash|shell|terminal|command)/i.test(normalizedTool)) {
-    candidates.push({ kind: "Bash", value: command });
-  }
-
-  if (filePath && /(edit|write|applypatch|replace|multiedit)/i.test(normalizedTool)) {
-    candidates.push({ kind: "Edit", value: filePath });
-  }
-
-  if (filePath && /(read|view|open)/i.test(normalizedTool)) {
-    candidates.push({ kind: "Read", value: filePath });
-  }
-
-  if ((normalizedTool.includes("mcp") || String(toolName || "").startsWith("mcp__")) && mcpName) {
-    candidates.push({ kind: "MCP", value: mcpName });
-  }
-
-  if (skillName && /skill/i.test(normalizedTool)) {
-    candidates.push({ kind: "Skill", value: skillName });
-  }
-
-  return candidates;
-}
-
-function evaluate(mode, event) {
-  const candidates = inferCandidates(mode, event);
-  let selected;
-
-  for (const rule of RULES) {
-    for (const candidate of candidates) {
-      if (candidate.kind !== rule.kind) continue;
-      if (!matchesPattern(rule.pattern, candidate.value)) continue;
-
-      if (!selected || ACTION_PRIORITY[rule.action] > ACTION_PRIORITY[selected.action]) {
-        selected = { rule, action: rule.action, candidate };
-      }
-    }
-  }
-
-  return selected;
-}
-
-function cursorResponse(match) {
-  if (!match) return {};
-  return {
-    permission: match.action,
-    user_message: "Pluxx permissions matched " + match.rule.raw,
-  };
-}
-
-function claudeResponse(match) {
-  if (!match) return {};
-  return {
-    hookSpecificOutput: {
-      permissionDecision: match.action,
-      permissionDecisionReason: "Pluxx permissions matched " + match.rule.raw,
-    },
-  };
-}
-
-async function main() {
-  const mode = process.argv[2];
-  const event = await parseJsonInput();
-  const match = evaluate(mode, event);
-  const payload = mode === "claude-pretool" ? claudeResponse(match) : cursorResponse(match);
-  process.stdout.write(JSON.stringify(payload));
-}
-
-main().catch((error) => {
-  process.stderr.write(String(error instanceof Error ? error.message : error));
-  process.exit(1);
-});
-`
-}

package/src/schema.ts

@@ -1,312 +0,0 @@
-import { z } from 'zod'
-import { PERMISSION_SELECTOR_KINDS, parsePermissionRule } from './permissions'
-
-// ── MCP Server Auth ──────────────────────────────────────────────
-
-const McpAuthNoneSchema = z.object({
-  type: z.literal('none'),
-}).strict()
-
-const McpAuthBearerSchema = z.object({
-  type: z.literal('bearer'),
-  envVar: z.string(),
-  headerName: z.string().default('Authorization'),
-  headerTemplate: z.string().default('Bearer ${value}'),
-}).strict()
-
-const McpAuthHeaderSchema = z.object({
-  type: z.literal('header'),
-  envVar: z.string(),
-  headerName: z.string(),
-  headerTemplate: z.string().default('Bearer ${value}'),
-}).strict()
-
-const McpAuthPlatformSchema = z.object({
-  type: z.literal('platform'),
-  mode: z.enum(['oauth']).default('oauth'),
-}).strict()
-
-export const McpAuthSchema = z.preprocess(
-  (value) => {
-    if (value && typeof value === 'object' && !('type' in (value as Record<string, unknown>))) {
-      return { ...(value as Record<string, unknown>), type: 'bearer' }
-    }
-    return value
-  },
-  z.discriminatedUnion('type', [McpAuthNoneSchema, McpAuthBearerSchema, McpAuthHeaderSchema, McpAuthPlatformSchema])
-)
-
-const McpServerHttpSchema = z.object({
-  transport: z.literal('http'),
-  url: z.string().url(),
-  command: z.never().optional(),
-  args: z.array(z.string()).optional(),
-  env: z.record(z.string()).optional(),
-  auth: McpAuthSchema.optional(),
-}).strict()
-
-const McpServerSseSchema = z.object({
-  transport: z.literal('sse'),
-  url: z.string().url(),
-  command: z.never().optional(),
-  args: z.array(z.string()).optional(),
-  env: z.record(z.string()).optional(),
-  auth: McpAuthSchema.optional(),
-}).strict()
-
-const McpServerStdioSchema = z.object({
-  transport: z.literal('stdio'),
-  command: z.string(),
-  url: z.never().optional(),
-  args: z.array(z.string()).optional(),
-  env: z.record(z.string()).optional(),
-  auth: McpAuthSchema.optional(),
-}).strict()
-
-export const McpServerSchema = z.preprocess(
-  (value) => {
-    if (value && typeof value === 'object' && !('transport' in (value as Record<string, unknown>))) {
-      return { ...(value as Record<string, unknown>), transport: 'http' }
-    }
-    return value
-  },
-  z.discriminatedUnion('transport', [McpServerHttpSchema, McpServerSseSchema, McpServerStdioSchema])
-)
-
-// ── Hooks ────────────────────────────────────────────────────────
-
-export const HookEntrySchema = z.object({
-  type: z.enum(['command', 'prompt']).default('command'),
-  command: z.string().optional(),
-  prompt: z.string().optional(),
-  model: z.string().optional(),
-  timeout: z.number().optional(),
-  matcher: z.union([z.string(), z.record(z.unknown())]).optional(),
-  failClosed: z.boolean().optional(),
-  loop_limit: z.number().nullable().optional(),
-}).superRefine((entry, ctx) => {
-  if (entry.type === 'command' && !entry.command) {
-    ctx.addIssue({
-      code: z.ZodIssueCode.custom,
-      path: ['command'],
-      message: 'Command hooks require a command.',
-    })
-  }
-
-  if (entry.type === 'prompt' && !entry.prompt) {
-    ctx.addIssue({
-      code: z.ZodIssueCode.custom,
-      path: ['prompt'],
-      message: 'Prompt hooks require a prompt.',
-    })
-  }
-})
-
-export const HooksSchema = z.object({
-  sessionStart: z.array(HookEntrySchema).optional(),
-  sessionEnd: z.array(HookEntrySchema).optional(),
-  preToolUse: z.array(HookEntrySchema).optional(),
-  postToolUse: z.array(HookEntrySchema).optional(),
-  postToolUseFailure: z.array(HookEntrySchema).optional(),
-  subagentStart: z.array(HookEntrySchema).optional(),
-  subagentStop: z.array(HookEntrySchema).optional(),
-  beforeShellExecution: z.array(HookEntrySchema).optional(),
-  afterShellExecution: z.array(HookEntrySchema).optional(),
-  beforeMCPExecution: z.array(HookEntrySchema).optional(),
-  afterMCPExecution: z.array(HookEntrySchema).optional(),
-  afterFileEdit: z.array(HookEntrySchema).optional(),
-  beforeReadFile: z.array(HookEntrySchema).optional(),
-  beforeSubmitPrompt: z.array(HookEntrySchema).optional(),
-  preCompact: z.array(HookEntrySchema).optional(),
-  stop: z.array(HookEntrySchema).optional(),
-  afterAgentResponse: z.array(HookEntrySchema).optional(),
-  afterAgentThought: z.array(HookEntrySchema).optional(),
-  beforeTabFileRead: z.array(HookEntrySchema).optional(),
-  afterTabFileEdit: z.array(HookEntrySchema).optional(),
-}).catchall(z.array(HookEntrySchema))
-
-// ── Brand / Interface ────────────────────────────────────────────
-
-export const BrandSchema = z.object({
-  displayName: z.string(),
-  shortDescription: z.string().optional(),
-  longDescription: z.string().optional(),
-  category: z.string().default('Productivity'),
-  color: z.string().optional(),
-  icon: z.string().optional(),
-  logo: z.string().optional(),
-  screenshots: z.array(z.string()).optional(),
-  defaultPrompts: z.array(z.string()).optional(),
-  websiteURL: z.string().url().optional(),
-  privacyPolicyURL: z.string().url().optional(),
-  termsOfServiceURL: z.string().url().optional(),
-})
-
-// ── Targets / User Config ───────────────────────────────────────
-
-export const TargetPlatform = z.enum([
-  'claude-code',
-  'cursor',
-  'codex',
-  'opencode',
-  'github-copilot',
-  'openhands',
-  'warp',
-  'gemini-cli',
-  'roo-code',
-  'cline',
-  'amp',
-])
-export type TargetPlatform = z.infer<typeof TargetPlatform>
-
-const UserConfigValueSchema = z.union([z.string(), z.number(), z.boolean()])
-
-export const UserConfigEntrySchema = z.object({
-  key: z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, 'Use lowercase kebab-case for user config keys'),
-  title: z.string(),
-  description: z.string(),
-  type: z.enum(['secret', 'string', 'number', 'boolean']).default('string'),
-  required: z.boolean().default(true),
-  envVar: z.string().optional(),
-  defaultValue: UserConfigValueSchema.optional(),
-  placeholder: z.string().optional(),
-  targets: z.array(TargetPlatform).optional(),
-}).superRefine((entry, ctx) => {
-  if (entry.type === 'secret' && entry.defaultValue !== undefined) {
-    ctx.addIssue({
-      code: z.ZodIssueCode.custom,
-      path: ['defaultValue'],
-      message: 'Secret userConfig entries should not define a defaultValue.',
-    })
-  }
-
-  if (entry.type === 'number' && entry.defaultValue !== undefined && typeof entry.defaultValue !== 'number') {
-    ctx.addIssue({
-      code: z.ZodIssueCode.custom,
-      path: ['defaultValue'],
-      message: 'Number userConfig entries require a numeric defaultValue.',
-    })
-  }
-
-  if (entry.type === 'boolean' && entry.defaultValue !== undefined && typeof entry.defaultValue !== 'boolean') {
-    ctx.addIssue({
-      code: z.ZodIssueCode.custom,
-      path: ['defaultValue'],
-      message: 'Boolean userConfig entries require a boolean defaultValue.',
-    })
-  }
-})
-
-export const UserConfigSchema = z.array(UserConfigEntrySchema)
-
-// ── Permissions ─────────────────────────────────────────────────
-
-export const PermissionRuleSchema = z.string().superRefine((value, ctx) => {
-  if (!parsePermissionRule(value)) {
-    ctx.addIssue({
-      code: z.ZodIssueCode.custom,
-      message: `Permission rules must use the canonical DSL: ${PERMISSION_SELECTOR_KINDS.map(kind => `${kind}(...)`).join(', ')}`,
-    })
-  }
-})
-
-export const PermissionsSchema = z.object({
-  allow: z.array(PermissionRuleSchema).optional(),
-  ask: z.array(PermissionRuleSchema).optional(),
-  deny: z.array(PermissionRuleSchema).optional(),
-}).refine(
-  permissions => (permissions.allow?.length ?? 0) + (permissions.ask?.length ?? 0) + (permissions.deny?.length ?? 0) > 0,
-  {
-    message: 'Permissions must declare at least one allow/ask/deny rule.',
-  },
-)
-
-// ── Platform Overrides ───────────────────────────────────────────
-
-export const ClaudeCodeOverridesSchema = z.object({
-  skillDefaults: z.record(z.unknown()).optional(),
-  mcpAuth: z.enum(['inline', 'platform']).optional(),
-}).catchall(z.unknown())
-
-export const CursorOverridesSchema = z.object({
-  mcpAuth: z.enum(['inline', 'platform']).optional(),
-  rules: z.array(z.object({
-    description: z.string(),
-    globs: z.union([z.string(), z.array(z.string())]).optional(),
-    alwaysApply: z.boolean().optional(),
-    content: z.string().optional(),
-  })).optional(),
-}).catchall(z.unknown())
-
-export const CodexOverridesSchema = z.object({
-  interface: z.record(z.unknown()).optional(),
-}).catchall(z.unknown())
-
-export const OpenCodeOverridesSchema = z.object({
-  npmPackage: z.string().optional(),
-}).catchall(z.unknown())
-
-export const PlatformOverridesSchema = z.object({
-  'claude-code': ClaudeCodeOverridesSchema.optional(),
-  cursor: CursorOverridesSchema.optional(),
-  codex: CodexOverridesSchema.optional(),
-  opencode: OpenCodeOverridesSchema.optional(),
-})
-
-// ── Main Plugin Config ───────────────────────────────────────────
-
-export const PluginConfigSchema = z.object({
-  // Identity
-  name: z.string().regex(/^[a-z0-9-]+$/, 'Must be lowercase with hyphens only'),
-  version: z.string().default('0.1.0'),
-  description: z.string(),
-  author: z.object({
-    name: z.string(),
-    url: z.string().url().optional(),
-    email: z.string().email().optional(),
-  }),
-  repository: z.string().optional(),
-  license: z.string().default('MIT'),
-  keywords: z.array(z.string()).optional(),
-
-  // Brand
-  brand: BrandSchema.optional(),
-  userConfig: UserConfigSchema.optional(),
-  permissions: PermissionsSchema.optional(),
-
-  // Plugin components (paths relative to config file)
-  skills: z.string().default('./skills/'),
-  commands: z.string().optional(),
-  agents: z.string().optional(),
-  instructions: z.string().optional(),
-
-  // MCP servers
-  mcp: z.record(McpServerSchema).optional(),
-
-  // Hooks
-  hooks: HooksSchema.optional(),
-
-  // Scripts (copied to all targets)
-  scripts: z.string().optional(),
-
-  // Assets (copied to all targets)
-  assets: z.string().optional(),
-
-  // Platform-specific overrides
-  platforms: PlatformOverridesSchema.optional(),
-
-  // Which platforms to generate
-  targets: z.array(TargetPlatform).default(['claude-code', 'cursor', 'codex', 'opencode']),
-
-  // Output directory
-  outDir: z.string().default('./dist'),
-})
-
-export type PluginConfig = z.infer<typeof PluginConfigSchema>
-export type McpServer = z.infer<typeof McpServerSchema>
-export type McpAuth = z.infer<typeof McpAuthSchema>
-export type HookEntry = z.infer<typeof HookEntrySchema>
-export type Brand = z.infer<typeof BrandSchema>
-export type UserConfigEntry = z.infer<typeof UserConfigEntrySchema>
-export type PermissionRule = z.infer<typeof PermissionRuleSchema>
-export type Permissions = z.infer<typeof PermissionsSchema>