@orchid-labs/pluxx 0.1.0

package/src/permissions.ts

@@ -0,0 +1,258 @@
+export const PERMISSION_SELECTOR_KINDS = ['Bash', 'Edit', 'Read', 'MCP', 'Skill'] as const
+
+export type PermissionRuleKind = typeof PERMISSION_SELECTOR_KINDS[number]
+export type PermissionAction = 'allow' | 'ask' | 'deny'
+
+export interface ParsedPermissionRule {
+  action: PermissionAction
+  raw: string
+  kind: PermissionRuleKind
+  pattern: string
+}
+
+export interface OpenCodePermissionMap {
+  [tool: string]: PermissionAction
+}
+
+const PERMISSION_RULE_REGEX = new RegExp(
+  `^(${PERMISSION_SELECTOR_KINDS.join('|')})\\((.+)\\)$`,
+)
+
+export function parsePermissionRule(raw: string): Omit<ParsedPermissionRule, 'action'> | null {
+  const trimmed = raw.trim()
+  const match = trimmed.match(PERMISSION_RULE_REGEX)
+  if (!match) return null
+
+  const kind = match[1] as PermissionRuleKind
+  const pattern = match[2].trim()
+  if (!pattern) return null
+
+  return {
+    raw: trimmed,
+    kind,
+    pattern,
+  }
+}
+
+export function collectPermissionRules(
+  permissions: Partial<Record<PermissionAction, string[]>> | undefined,
+): ParsedPermissionRule[] {
+  if (!permissions) return []
+
+  const actions: PermissionAction[] = ['allow', 'ask', 'deny']
+  const rules: ParsedPermissionRule[] = []
+
+  for (const action of actions) {
+    for (const raw of permissions[action] ?? []) {
+      const parsed = parsePermissionRule(raw)
+      if (!parsed) continue
+      rules.push({
+        ...parsed,
+        action,
+      })
+    }
+  }
+
+  return rules
+}
+
+const ACTION_PRIORITY: Record<PermissionAction, number> = {
+  allow: 0,
+  ask: 1,
+  deny: 2,
+}
+
+function mergeAction(current: PermissionAction | undefined, next: PermissionAction): PermissionAction {
+  if (!current) return next
+  return ACTION_PRIORITY[next] > ACTION_PRIORITY[current] ? next : current
+}
+
+export function permissionRulesNeedToolLevelDowngrade(
+  permissions: Partial<Record<PermissionAction, string[]>> | undefined,
+): boolean {
+  return collectPermissionRules(permissions).some((rule) => rule.pattern !== '*')
+}
+
+export function buildOpenCodePermissionMap(
+  permissions: Partial<Record<PermissionAction, string[]>> | undefined,
+): OpenCodePermissionMap {
+  const rules = collectPermissionRules(permissions)
+  const output: OpenCodePermissionMap = {}
+
+  const toolAliases: Record<PermissionRuleKind, string[]> = {
+    Bash: ['bash', 'shell'],
+    Edit: ['edit', 'write'],
+    Read: ['read'],
+    MCP: ['mcp'],
+    Skill: ['skill'],
+  }
+
+  for (const rule of rules) {
+    for (const tool of toolAliases[rule.kind]) {
+      output[tool] = mergeAction(output[tool], rule.action)
+    }
+  }
+
+  return output
+}
+
+export function buildGeneratedPermissionHookScript(
+  permissions: Partial<Record<PermissionAction, string[]>> | undefined,
+): string | null {
+  const rules = collectPermissionRules(permissions)
+  if (rules.length === 0) return null
+
+  return `#!/usr/bin/env node
+const RULES = ${JSON.stringify(rules, null, 2)};
+const ACTION_PRIORITY = { allow: 0, ask: 1, deny: 2 };
+
+function wildcardToRegExp(pattern) {
+  const escaped = pattern
+    .replace(/[.+^$(){}|[\\]\\\\]/g, "\\\\$&")
+    .replace(/\\*/g, ".*");
+  return new RegExp("^" + escaped + "$", "i");
+}
+
+function matchesPattern(pattern, value) {
+  if (!value) return false;
+  return wildcardToRegExp(pattern).test(String(value));
+}
+
+function firstValue(...values) {
+  return values.find((value) => typeof value === "string" && value.trim() !== "");
+}
+
+function parseJsonInput() {
+  const chunks = [];
+  process.stdin.setEncoding("utf8");
+  return new Promise((resolve, reject) => {
+    process.stdin.on("data", (chunk) => chunks.push(chunk));
+    process.stdin.on("end", () => {
+      const raw = chunks.join("").trim();
+      if (!raw) return resolve({});
+      try {
+        resolve(JSON.parse(raw));
+      } catch (error) {
+        reject(error);
+      }
+    });
+    process.stdin.on("error", reject);
+  });
+}
+
+function parseMcpName(raw) {
+  if (!raw) return undefined;
+  if (raw.startsWith("mcp__")) {
+    const match = raw.match(/^mcp__([^_]+)__(.+)$/);
+    if (match) return match[1] + "." + match[2].replace(/__/g, ".");
+  }
+  return raw;
+}
+
+function inferCandidates(mode, event) {
+  const toolName = firstValue(event.tool_name, event.toolName, event.tool, event.matcher);
+  const input = event.tool_input ?? event.toolInput ?? event.input ?? {};
+  const candidates = [];
+
+  const filePath = firstValue(
+    event.file_path,
+    input.file_path,
+    input.path,
+    input.filePath,
+    input.target_file,
+    input.targetFile
+  );
+  const command = firstValue(event.command, input.command, input.cmd, input.shell_command);
+  const skillName = firstValue(input.name, input.skill_name, input.skillName);
+  const mcpName = parseMcpName(firstValue(event.tool_name, input.tool_name, input.name));
+
+  if (mode === "cursor-shell") {
+    if (command) candidates.push({ kind: "Bash", value: command });
+    return candidates;
+  }
+
+  if (mode === "cursor-read") {
+    if (filePath) candidates.push({ kind: "Read", value: filePath });
+    return candidates;
+  }
+
+  if (mode === "cursor-mcp") {
+    if (mcpName) candidates.push({ kind: "MCP", value: mcpName });
+    return candidates;
+  }
+
+  const normalizedTool = String(toolName || "").toLowerCase();
+
+  if (command && /(bash|shell|terminal|command)/i.test(normalizedTool)) {
+    candidates.push({ kind: "Bash", value: command });
+  }
+
+  if (filePath && /(edit|write|applypatch|replace|multiedit)/i.test(normalizedTool)) {
+    candidates.push({ kind: "Edit", value: filePath });
+  }
+
+  if (filePath && /(read|view|open)/i.test(normalizedTool)) {
+    candidates.push({ kind: "Read", value: filePath });
+  }
+
+  if ((normalizedTool.includes("mcp") || String(toolName || "").startsWith("mcp__")) && mcpName) {
+    candidates.push({ kind: "MCP", value: mcpName });
+  }
+
+  if (skillName && /skill/i.test(normalizedTool)) {
+    candidates.push({ kind: "Skill", value: skillName });
+  }
+
+  return candidates;
+}
+
+function evaluate(mode, event) {
+  const candidates = inferCandidates(mode, event);
+  let selected;
+
+  for (const rule of RULES) {
+    for (const candidate of candidates) {
+      if (candidate.kind !== rule.kind) continue;
+      if (!matchesPattern(rule.pattern, candidate.value)) continue;
+
+      if (!selected || ACTION_PRIORITY[rule.action] > ACTION_PRIORITY[selected.action]) {
+        selected = { rule, action: rule.action, candidate };
+      }
+    }
+  }
+
+  return selected;
+}
+
+function cursorResponse(match) {
+  if (!match) return {};
+  return {
+    permission: match.action,
+    user_message: "Pluxx permissions matched " + match.rule.raw,
+  };
+}
+
+function claudeResponse(match) {
+  if (!match) return {};
+  return {
+    hookSpecificOutput: {
+      permissionDecision: match.action,
+      permissionDecisionReason: "Pluxx permissions matched " + match.rule.raw,
+    },
+  };
+}
+
+async function main() {
+  const mode = process.argv[2];
+  const event = await parseJsonInput();
+  const match = evaluate(mode, event);
+  const payload = mode === "claude-pretool" ? claudeResponse(match) : cursorResponse(match);
+  process.stdout.write(JSON.stringify(payload));
+}
+
+main().catch((error) => {
+  process.stderr.write(String(error instanceof Error ? error.message : error));
+  process.exit(1);
+});
+`
+}

package/src/schema.ts

@@ -0,0 +1,312 @@
+import { z } from 'zod'
+import { PERMISSION_SELECTOR_KINDS, parsePermissionRule } from './permissions'
+
+// ── MCP Server Auth ──────────────────────────────────────────────
+
+const McpAuthNoneSchema = z.object({
+  type: z.literal('none'),
+}).strict()
+
+const McpAuthBearerSchema = z.object({
+  type: z.literal('bearer'),
+  envVar: z.string(),
+  headerName: z.string().default('Authorization'),
+  headerTemplate: z.string().default('Bearer ${value}'),
+}).strict()
+
+const McpAuthHeaderSchema = z.object({
+  type: z.literal('header'),
+  envVar: z.string(),
+  headerName: z.string(),
+  headerTemplate: z.string().default('Bearer ${value}'),
+}).strict()
+
+const McpAuthPlatformSchema = z.object({
+  type: z.literal('platform'),
+  mode: z.enum(['oauth']).default('oauth'),
+}).strict()
+
+export const McpAuthSchema = z.preprocess(
+  (value) => {
+    if (value && typeof value === 'object' && !('type' in (value as Record<string, unknown>))) {
+      return { ...(value as Record<string, unknown>), type: 'bearer' }
+    }
+    return value
+  },
+  z.discriminatedUnion('type', [McpAuthNoneSchema, McpAuthBearerSchema, McpAuthHeaderSchema, McpAuthPlatformSchema])
+)
+
+const McpServerHttpSchema = z.object({
+  transport: z.literal('http'),
+  url: z.string().url(),
+  command: z.never().optional(),
+  args: z.array(z.string()).optional(),
+  env: z.record(z.string()).optional(),
+  auth: McpAuthSchema.optional(),
+}).strict()
+
+const McpServerSseSchema = z.object({
+  transport: z.literal('sse'),
+  url: z.string().url(),
+  command: z.never().optional(),
+  args: z.array(z.string()).optional(),
+  env: z.record(z.string()).optional(),
+  auth: McpAuthSchema.optional(),
+}).strict()
+
+const McpServerStdioSchema = z.object({
+  transport: z.literal('stdio'),
+  command: z.string(),
+  url: z.never().optional(),
+  args: z.array(z.string()).optional(),
+  env: z.record(z.string()).optional(),
+  auth: McpAuthSchema.optional(),
+}).strict()
+
+export const McpServerSchema = z.preprocess(
+  (value) => {
+    if (value && typeof value === 'object' && !('transport' in (value as Record<string, unknown>))) {
+      return { ...(value as Record<string, unknown>), transport: 'http' }
+    }
+    return value
+  },
+  z.discriminatedUnion('transport', [McpServerHttpSchema, McpServerSseSchema, McpServerStdioSchema])
+)
+
+// ── Hooks ────────────────────────────────────────────────────────
+
+export const HookEntrySchema = z.object({
+  type: z.enum(['command', 'prompt']).default('command'),
+  command: z.string().optional(),
+  prompt: z.string().optional(),
+  model: z.string().optional(),
+  timeout: z.number().optional(),
+  matcher: z.union([z.string(), z.record(z.unknown())]).optional(),
+  failClosed: z.boolean().optional(),
+  loop_limit: z.number().nullable().optional(),
+}).superRefine((entry, ctx) => {
+  if (entry.type === 'command' && !entry.command) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ['command'],
+      message: 'Command hooks require a command.',
+    })
+  }
+
+  if (entry.type === 'prompt' && !entry.prompt) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ['prompt'],
+      message: 'Prompt hooks require a prompt.',
+    })
+  }
+})
+
+export const HooksSchema = z.object({
+  sessionStart: z.array(HookEntrySchema).optional(),
+  sessionEnd: z.array(HookEntrySchema).optional(),
+  preToolUse: z.array(HookEntrySchema).optional(),
+  postToolUse: z.array(HookEntrySchema).optional(),
+  postToolUseFailure: z.array(HookEntrySchema).optional(),
+  subagentStart: z.array(HookEntrySchema).optional(),
+  subagentStop: z.array(HookEntrySchema).optional(),
+  beforeShellExecution: z.array(HookEntrySchema).optional(),
+  afterShellExecution: z.array(HookEntrySchema).optional(),
+  beforeMCPExecution: z.array(HookEntrySchema).optional(),
+  afterMCPExecution: z.array(HookEntrySchema).optional(),
+  afterFileEdit: z.array(HookEntrySchema).optional(),
+  beforeReadFile: z.array(HookEntrySchema).optional(),
+  beforeSubmitPrompt: z.array(HookEntrySchema).optional(),
+  preCompact: z.array(HookEntrySchema).optional(),
+  stop: z.array(HookEntrySchema).optional(),
+  afterAgentResponse: z.array(HookEntrySchema).optional(),
+  afterAgentThought: z.array(HookEntrySchema).optional(),
+  beforeTabFileRead: z.array(HookEntrySchema).optional(),
+  afterTabFileEdit: z.array(HookEntrySchema).optional(),
+}).catchall(z.array(HookEntrySchema))
+
+// ── Brand / Interface ────────────────────────────────────────────
+
+export const BrandSchema = z.object({
+  displayName: z.string(),
+  shortDescription: z.string().optional(),
+  longDescription: z.string().optional(),
+  category: z.string().default('Productivity'),
+  color: z.string().optional(),
+  icon: z.string().optional(),
+  logo: z.string().optional(),
+  screenshots: z.array(z.string()).optional(),
+  defaultPrompts: z.array(z.string()).optional(),
+  websiteURL: z.string().url().optional(),
+  privacyPolicyURL: z.string().url().optional(),
+  termsOfServiceURL: z.string().url().optional(),
+})
+
+// ── Targets / User Config ───────────────────────────────────────
+
+export const TargetPlatform = z.enum([
+  'claude-code',
+  'cursor',
+  'codex',
+  'opencode',
+  'github-copilot',
+  'openhands',
+  'warp',
+  'gemini-cli',
+  'roo-code',
+  'cline',
+  'amp',
+])
+export type TargetPlatform = z.infer<typeof TargetPlatform>
+
+const UserConfigValueSchema = z.union([z.string(), z.number(), z.boolean()])
+
+export const UserConfigEntrySchema = z.object({
+  key: z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, 'Use lowercase kebab-case for user config keys'),
+  title: z.string(),
+  description: z.string(),
+  type: z.enum(['secret', 'string', 'number', 'boolean']).default('string'),
+  required: z.boolean().default(true),
+  envVar: z.string().optional(),
+  defaultValue: UserConfigValueSchema.optional(),
+  placeholder: z.string().optional(),
+  targets: z.array(TargetPlatform).optional(),
+}).superRefine((entry, ctx) => {
+  if (entry.type === 'secret' && entry.defaultValue !== undefined) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ['defaultValue'],
+      message: 'Secret userConfig entries should not define a defaultValue.',
+    })
+  }
+
+  if (entry.type === 'number' && entry.defaultValue !== undefined && typeof entry.defaultValue !== 'number') {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ['defaultValue'],
+      message: 'Number userConfig entries require a numeric defaultValue.',
+    })
+  }
+
+  if (entry.type === 'boolean' && entry.defaultValue !== undefined && typeof entry.defaultValue !== 'boolean') {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ['defaultValue'],
+      message: 'Boolean userConfig entries require a boolean defaultValue.',
+    })
+  }
+})
+
+export const UserConfigSchema = z.array(UserConfigEntrySchema)
+
+// ── Permissions ─────────────────────────────────────────────────
+
+export const PermissionRuleSchema = z.string().superRefine((value, ctx) => {
+  if (!parsePermissionRule(value)) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: `Permission rules must use the canonical DSL: ${PERMISSION_SELECTOR_KINDS.map(kind => `${kind}(...)`).join(', ')}`,
+    })
+  }
+})
+
+export const PermissionsSchema = z.object({
+  allow: z.array(PermissionRuleSchema).optional(),
+  ask: z.array(PermissionRuleSchema).optional(),
+  deny: z.array(PermissionRuleSchema).optional(),
+}).refine(
+  permissions => (permissions.allow?.length ?? 0) + (permissions.ask?.length ?? 0) + (permissions.deny?.length ?? 0) > 0,
+  {
+    message: 'Permissions must declare at least one allow/ask/deny rule.',
+  },
+)
+
+// ── Platform Overrides ───────────────────────────────────────────
+
+export const ClaudeCodeOverridesSchema = z.object({
+  skillDefaults: z.record(z.unknown()).optional(),
+  mcpAuth: z.enum(['inline', 'platform']).optional(),
+}).catchall(z.unknown())
+
+export const CursorOverridesSchema = z.object({
+  mcpAuth: z.enum(['inline', 'platform']).optional(),
+  rules: z.array(z.object({
+    description: z.string(),
+    globs: z.union([z.string(), z.array(z.string())]).optional(),
+    alwaysApply: z.boolean().optional(),
+    content: z.string().optional(),
+  })).optional(),
+}).catchall(z.unknown())
+
+export const CodexOverridesSchema = z.object({
+  interface: z.record(z.unknown()).optional(),
+}).catchall(z.unknown())
+
+export const OpenCodeOverridesSchema = z.object({
+  npmPackage: z.string().optional(),
+}).catchall(z.unknown())
+
+export const PlatformOverridesSchema = z.object({
+  'claude-code': ClaudeCodeOverridesSchema.optional(),
+  cursor: CursorOverridesSchema.optional(),
+  codex: CodexOverridesSchema.optional(),
+  opencode: OpenCodeOverridesSchema.optional(),
+})
+
+// ── Main Plugin Config ───────────────────────────────────────────
+
+export const PluginConfigSchema = z.object({
+  // Identity
+  name: z.string().regex(/^[a-z0-9-]+$/, 'Must be lowercase with hyphens only'),
+  version: z.string().default('0.1.0'),
+  description: z.string(),
+  author: z.object({
+    name: z.string(),
+    url: z.string().url().optional(),
+    email: z.string().email().optional(),
+  }),
+  repository: z.string().optional(),
+  license: z.string().default('MIT'),
+  keywords: z.array(z.string()).optional(),
+
+  // Brand
+  brand: BrandSchema.optional(),
+  userConfig: UserConfigSchema.optional(),
+  permissions: PermissionsSchema.optional(),
+
+  // Plugin components (paths relative to config file)
+  skills: z.string().default('./skills/'),
+  commands: z.string().optional(),
+  agents: z.string().optional(),
+  instructions: z.string().optional(),
+
+  // MCP servers
+  mcp: z.record(McpServerSchema).optional(),
+
+  // Hooks
+  hooks: HooksSchema.optional(),
+
+  // Scripts (copied to all targets)
+  scripts: z.string().optional(),
+
+  // Assets (copied to all targets)
+  assets: z.string().optional(),
+
+  // Platform-specific overrides
+  platforms: PlatformOverridesSchema.optional(),
+
+  // Which platforms to generate
+  targets: z.array(TargetPlatform).default(['claude-code', 'cursor', 'codex', 'opencode']),
+
+  // Output directory
+  outDir: z.string().default('./dist'),
+})
+
+export type PluginConfig = z.infer<typeof PluginConfigSchema>
+export type McpServer = z.infer<typeof McpServerSchema>
+export type McpAuth = z.infer<typeof McpAuthSchema>
+export type HookEntry = z.infer<typeof HookEntrySchema>
+export type Brand = z.infer<typeof BrandSchema>
+export type UserConfigEntry = z.infer<typeof UserConfigEntrySchema>
+export type PermissionRule = z.infer<typeof PermissionRuleSchema>
+export type Permissions = z.infer<typeof PermissionsSchema>