@pellux/goodvibes-sdk 0.18.3 → 0.18.11

package/dist/platform/media/provider-registry.js

@@ -0,0 +1,57 @@
+export class MediaProviderRegistry {
+    providers = new Map();
+    register(provider, options = {}) {
+        const id = provider.id.trim();
+        if (!id)
+            throw new Error('Media provider id is required');
+        if (this.providers.has(id) && !options.replace) {
+            throw new Error(`Media provider already registered: ${id}`);
+        }
+        const registered = { ...provider, id };
+        this.providers.set(id, registered);
+        return () => {
+            if (this.providers.get(id) === registered)
+                this.unregister(id);
+        };
+    }
+    unregister(id) {
+        return this.providers.delete(id);
+    }
+    get(id) {
+        return this.providers.get(id) ?? null;
+    }
+    list() {
+        return [...this.providers.values()]
+            .map((provider) => ({
+            id: provider.id,
+            label: provider.label,
+            capabilities: [...provider.capabilities],
+        }))
+            .sort((a, b) => a.label.localeCompare(b.label) || a.id.localeCompare(b.id));
+    }
+    findProvider(capability, providerId) {
+        if (providerId) {
+            const provider = this.get(providerId);
+            return provider?.capabilities.includes(capability) ? provider : null;
+        }
+        return [...this.providers.values()].find((provider) => provider.capabilities.includes(capability)) ?? null;
+    }
+    async status() {
+        const statuses = [];
+        for (const provider of this.providers.values()) {
+            if (provider.status) {
+                statuses.push(await provider.status());
+                continue;
+            }
+            statuses.push({
+                id: provider.id,
+                label: provider.label,
+                state: 'healthy',
+                capabilities: [...provider.capabilities],
+                configured: true,
+                metadata: {},
+            });
+        }
+        return statuses.sort((a, b) => a.label.localeCompare(b.label) || a.id.localeCompare(b.id));
+    }
+}

package/dist/platform/multimodal/types.d.ts

@@ -0,0 +1,71 @@
+import type { ArtifactDescriptor } from '../artifacts/types.js';
+export type MultimodalKind = 'image' | 'audio' | 'video' | 'document';
+export type MultimodalDetail = 'compact' | 'standard' | 'detailed';
+export interface MultimodalArtifactInput {
+    readonly artifactId?: string;
+    readonly mimeType?: string;
+    readonly dataBase64?: string;
+    readonly uri?: string;
+    readonly allowPrivateHosts?: boolean;
+    readonly filename?: string;
+    readonly metadata?: Record<string, unknown>;
+}
+export interface MultimodalProviderDescriptor {
+    readonly id: string;
+    readonly label: string;
+    readonly transport: 'media' | 'voice' | 'extractor' | 'hybrid';
+    readonly capabilities: readonly string[];
+    readonly configured: boolean;
+    readonly metadata: Record<string, unknown>;
+}
+export interface MultimodalSegment {
+    readonly kind: 'transcript' | 'section' | 'scene' | 'ocr' | 'summary';
+    readonly title?: string;
+    readonly text?: string;
+    readonly startMs?: number;
+    readonly endMs?: number;
+    readonly confidence?: number;
+    readonly metadata: Record<string, unknown>;
+}
+export interface MultimodalAnalysisRequest {
+    readonly artifactId?: string;
+    readonly artifact?: MultimodalArtifactInput;
+    readonly prompt?: string;
+    readonly imageProviderId?: string;
+    readonly audioProviderId?: string;
+    readonly modelId?: string;
+    readonly language?: string;
+    readonly detail?: MultimodalDetail;
+    readonly metadata?: Record<string, unknown>;
+}
+export interface MultimodalAnalysisResult {
+    readonly id: string;
+    readonly kind: MultimodalKind;
+    readonly artifact: ArtifactDescriptor;
+    readonly providerIds: readonly string[];
+    readonly summary?: string;
+    readonly text?: string;
+    readonly labels: readonly string[];
+    readonly entities: readonly string[];
+    readonly segments: readonly MultimodalSegment[];
+    readonly metadata: Record<string, unknown>;
+}
+export interface MultimodalPacket {
+    readonly detail: MultimodalDetail;
+    readonly budgetLimit: number;
+    readonly estimatedTokens: number;
+    readonly rendered: string;
+    readonly highlights: readonly string[];
+}
+export interface MultimodalWritebackResult {
+    readonly analysisArtifact: ArtifactDescriptor;
+    readonly knowledgeSourceId?: string;
+    readonly metadata: Record<string, unknown>;
+}
+export interface MultimodalServiceStatus {
+    readonly enabled: boolean;
+    readonly providerCount: number;
+    readonly providers: readonly MultimodalProviderDescriptor[];
+    readonly note: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/platform/multimodal/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/platform/multimodal/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,CAAC;AACtE,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;AAEnE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,GAAG,WAAW,GAAG,QAAQ,CAAC;IAC/D,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,SAAS,GAAG,OAAO,GAAG,KAAK,GAAG,SAAS,CAAC;IACtE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,uBAAuB,CAAC;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;IAC9C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,SAAS,4BAA4B,EAAE,CAAC;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB"}

package/dist/platform/multimodal/types.js

@@ -0,0 +1 @@
+export {};

package/dist/platform/permissions/analysis.d.ts

@@ -0,0 +1,3 @@
+import type { PermissionCategory, PermissionRequestAnalysis } from './types.js';
+export declare function analyzePermissionRequest(toolName: string, args: Record<string, unknown>, category: PermissionCategory): PermissionRequestAnalysis;
+//# sourceMappingURL=analysis.d.ts.map

package/dist/platform/permissions/analysis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis.d.ts","sourceRoot":"","sources":["../../../src/platform/permissions/analysis.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,kBAAkB,EAClB,yBAAyB,EAE1B,MAAM,YAAY,CAAC;AA2OpB,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,QAAQ,EAAE,kBAAkB,GAC3B,yBAAyB,CAe3B"}

package/dist/platform/permissions/analysis.js

@@ -0,0 +1,220 @@
+import { normalizeCommandWithVerdicts } from '../runtime/permissions/normalization/index.js';
+import { classifyHostTrustTier, extractHostname } from '../tools/fetch/trust-tiers.js';
+function truncatePreview(value, limit = 120) {
+    return value.length <= limit ? value : `${value.slice(0, limit - 3)}...`;
+}
+function cleanReasons(values) {
+    const deduped = new Set();
+    for (const value of values) {
+        const trimmed = value.trim();
+        if (trimmed.length > 0)
+            deduped.add(trimmed);
+        if (deduped.size >= 3)
+            break;
+    }
+    return Array.from(deduped);
+}
+function riskFromClassification(classification) {
+    switch (classification) {
+        case 'read':
+            return 'low';
+        case 'write':
+        case 'network':
+            return 'medium';
+        case 'escalation':
+            return 'high';
+        case 'destructive':
+            return 'critical';
+        default:
+            return 'high';
+    }
+}
+const SECRET_NAME_PATTERN = /\b(api[_-]?key|token|secret|password|passwd|private[_-]?key|authorization)\b/i;
+const INLINE_SECRET_PATTERN = /\b(Bearer\s+[A-Za-z0-9._-]{12,}|ghp_[A-Za-z0-9]{20,}|sk-[A-Za-z0-9]{12,}|AIza[0-9A-Za-z_-]{16,}|xox[baprs]-[A-Za-z0-9-]{10,})\b/;
+function detectSecretExposure(command) {
+    const warnings = [];
+    if (SECRET_NAME_PATTERN.test(command)) {
+        warnings.push('Command references secret or credential material.');
+    }
+    if (INLINE_SECRET_PATTERN.test(command)) {
+        warnings.push('Command appears to contain an inline credential or token value.');
+    }
+    if (/curl\s+.*authorization[:=]/i.test(command) || /-H\s+["']?Authorization:/i.test(command)) {
+        warnings.push('Command includes an explicit Authorization header.');
+    }
+    if (/echo\s+.*(api[_-]?key|token|secret|password)/i.test(command)) {
+        warnings.push('Command may print secret material into logs or terminal output.');
+    }
+    return warnings;
+}
+function pathLooksSensitive(path) {
+    return /(^|\/)(\.env(\..+)?)$|(^|\/)(id_rsa|id_ed25519|known_hosts|authorized_keys)$|\.pem$|\.p12$|credentials|secrets?/i.test(path);
+}
+function analyzeExec(args) {
+    const command = typeof args['command'] === 'string'
+        ? args['command']
+        : typeof args['cmd'] === 'string'
+            ? args['cmd']
+            : '';
+    if (command.length === 0) {
+        return {
+            classification: 'write',
+            riskLevel: 'high',
+            summary: 'Execute shell command',
+            reasons: ['Shell execution can mutate files, spawn processes, or access the network.'],
+            target: '',
+            targetKind: 'command',
+            surface: 'shell',
+            blastRadius: 'project',
+            sideEffects: ['process execution', 'filesystem mutation', 'possible network access'],
+        };
+    }
+    const verdict = normalizeCommandWithVerdicts(command);
+    const classification = verdict.highestClassification;
+    const reasons = cleanReasons([
+        verdict.denialExplanation ?? '',
+        ...verdict.segments.filter((segment) => !segment.allowed || segment.hasObfuscation).map((segment) => segment.reason),
+        ...verdict.segments.flatMap((segment) => segment.obfuscationPatterns),
+        ...detectSecretExposure(command),
+    ]);
+    const secretWarnings = detectSecretExposure(command);
+    const riskLevel = secretWarnings.length > 0
+        ? 'critical'
+        : verdict.allowed && !verdict.hasObfuscation
+            ? riskFromClassification(classification)
+            : classification === 'destructive'
+                ? 'critical'
+                : 'high';
+    return {
+        classification,
+        riskLevel,
+        summary: classification === 'destructive'
+            ? 'Execute destructive shell command'
+            : classification === 'escalation'
+                ? 'Execute privileged or delegated shell command'
+                : classification === 'network'
+                    ? 'Execute networked shell command'
+                    : classification === 'write'
+                        ? 'Execute shell command with write-capable effects'
+                        : 'Execute read-only shell command',
+        reasons: reasons.length > 0
+            ? reasons
+            : [`Highest detected shell risk: ${classification}.`],
+        target: truncatePreview(command),
+        targetKind: 'command',
+        surface: 'shell',
+        blastRadius: secretWarnings.length > 0 || classification === 'destructive'
+            ? 'platform'
+            : classification === 'network'
+                ? 'external'
+                : 'project',
+        sideEffects: cleanReasons([
+            classification === 'network' ? 'outbound network access' : '',
+            classification === 'write' || classification === 'destructive' ? 'filesystem mutation' : '',
+            classification === 'escalation' || classification === 'destructive' ? 'privileged or chained execution' : '',
+            'process execution',
+        ]),
+    };
+}
+function analyzeFetch(args) {
+    const rawUrl = typeof args['url'] === 'string'
+        ? args['url']
+        : typeof args['endpoint'] === 'string'
+            ? args['endpoint']
+            : '';
+    const host = rawUrl.length > 0 ? extractHostname(rawUrl) : null;
+    const trust = host ? classifyHostTrustTier(host) : null;
+    const reasons = cleanReasons([
+        host ? `Target host: ${host}` : '',
+        trust ? `Host trust tier: ${trust.tier} (${trust.reason})` : '',
+    ]);
+    return {
+        classification: 'network',
+        riskLevel: trust?.tier === 'blocked'
+            ? 'critical'
+            : trust?.tier === 'unknown'
+                ? 'medium'
+                : 'low',
+        summary: host ? `Fetch remote resource from ${host}` : 'Fetch remote resource',
+        reasons: reasons.length > 0
+            ? reasons
+            : ['Outbound network access can disclose local context and pull remote content into the session.'],
+        target: truncatePreview(rawUrl),
+        targetKind: 'url',
+        surface: 'network',
+        blastRadius: 'external',
+        sideEffects: cleanReasons([
+            'outbound network access',
+            'remote content ingestion',
+            trust?.tier === 'unknown' || trust?.tier === 'blocked' ? 'untrusted host interaction' : '',
+        ]),
+        host: host ?? undefined,
+    };
+}
+function analyzePathTool(toolName, args, category) {
+    const path = typeof args['path'] === 'string'
+        ? args['path']
+        : typeof args['file'] === 'string'
+            ? args['file']
+            : '';
+    return {
+        classification: category === 'write' ? 'write' : 'read',
+        riskLevel: category === 'write' ? (pathLooksSensitive(path) ? 'high' : 'medium') : 'low',
+        summary: category === 'write'
+            ? `Modify local file or project state via ${toolName}`
+            : `Read local project state via ${toolName}`,
+        reasons: cleanReasons([
+            category === 'write'
+                ? 'This action can modify files or other local project state.'
+                : 'This action is read-oriented and does not directly mutate project state.',
+            pathLooksSensitive(path) ? 'Target path looks like a secret or credential file.' : '',
+        ]),
+        target: path,
+        targetKind: 'path',
+        surface: 'filesystem',
+        blastRadius: pathLooksSensitive(path) ? 'platform' : 'project',
+        sideEffects: cleanReasons([
+            category === 'write' ? 'filesystem mutation' : 'filesystem read',
+            pathLooksSensitive(path) ? 'possible secret exposure' : '',
+        ]),
+    };
+}
+function analyzeDelegate(toolName, args) {
+    const task = typeof args['task'] === 'string'
+        ? args['task']
+        : typeof args['name'] === 'string'
+            ? args['name']
+            : typeof args['prompt'] === 'string'
+                ? args['prompt']
+                : '';
+    return {
+        classification: 'escalation',
+        riskLevel: 'high',
+        summary: `Delegate work through ${toolName}`,
+        reasons: ['Delegated execution can fan out work, tools, and side effects beyond the current step.'],
+        target: truncatePreview(task),
+        targetKind: 'task',
+        surface: 'orchestration',
+        blastRadius: 'delegated',
+        sideEffects: ['delegated execution', 'task fan-out', 'tool-capability inheritance'],
+    };
+}
+export function analyzePermissionRequest(toolName, args, category) {
+    if (toolName === 'exec')
+        return analyzeExec(args);
+    if (toolName === 'fetch')
+        return analyzeFetch(args);
+    if (category === 'write' || category === 'read')
+        return analyzePathTool(toolName, args, category);
+    if (category === 'delegate')
+        return analyzeDelegate(toolName, args);
+    return {
+        classification: category,
+        riskLevel: 'high',
+        summary: `Request permission for ${toolName}`,
+        reasons: ['Review the target and intent before approving this action.'],
+        targetKind: 'generic',
+        surface: 'shell',
+        blastRadius: 'project',
+    };
+}

package/dist/platform/permissions/briefs/render-hints.d.ts

@@ -0,0 +1,3 @@
+import type { PermissionApprovalBrief } from './types.js';
+export declare function formatPermissionBriefHint(brief: PermissionApprovalBrief): string;
+//# sourceMappingURL=render-hints.d.ts.map

package/dist/platform/permissions/briefs/render-hints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render-hints.d.ts","sourceRoot":"","sources":["../../../../src/platform/permissions/briefs/render-hints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,CAEhF"}

package/dist/platform/permissions/briefs/render-hints.js

@@ -0,0 +1,3 @@
+export function formatPermissionBriefHint(brief) {
+    return `${brief.risk.headline} · ${brief.subjectLabel.toLowerCase()} review`;
+}

package/dist/platform/permissions/briefs/types.d.ts

@@ -0,0 +1,10 @@
+import type { PermissionRiskDescriptor } from '../../runtime/permissions/risk-model.js';
+export interface PermissionApprovalBrief {
+    readonly title: string;
+    readonly subjectLabel: string;
+    readonly subjectValue: string;
+    readonly decisionModeLabel: string;
+    readonly checklist: string;
+    readonly risk: PermissionRiskDescriptor;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/platform/permissions/briefs/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/platform/permissions/briefs/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AAExF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;CACzC"}

package/dist/platform/permissions/briefs/types.js

@@ -0,0 +1 @@
+export {};

package/dist/platform/permissions/types.d.ts

@@ -0,0 +1,27 @@
+export type PermissionCategory = 'read' | 'write' | 'execute' | 'delegate';
+export type PermissionRiskLevel = 'low' | 'medium' | 'high' | 'critical';
+export type PermissionDecisionSource = 'config_policy' | 'managed_policy' | 'safety_check' | 'runtime_mode' | 'session_override' | 'user_prompt';
+export type PermissionDecisionReasonCode = 'config_allow' | 'config_deny' | 'managed_policy_allow' | 'managed_policy_deny' | 'safety_guardrail' | 'mode_allow_all' | 'mode_denied' | 'session_cached_allow' | 'session_cached_deny' | 'user_approved' | 'user_denied';
+export type PermissionAnalysisTargetKind = 'command' | 'path' | 'url' | 'task' | 'generic';
+export type PermissionAnalysisSurface = 'filesystem' | 'shell' | 'network' | 'orchestration' | 'platform' | 'generic';
+export type PermissionBlastRadius = 'local' | 'project' | 'external' | 'delegated' | 'platform';
+export interface PermissionRequestAnalysis {
+    readonly classification: string;
+    readonly riskLevel: PermissionRiskLevel;
+    readonly summary: string;
+    readonly reasons: readonly string[];
+    readonly target?: string;
+    readonly targetKind?: PermissionAnalysisTargetKind;
+    readonly surface?: PermissionAnalysisSurface;
+    readonly blastRadius?: PermissionBlastRadius;
+    readonly sideEffects?: readonly string[];
+    readonly host?: string;
+}
+export interface PermissionCheckResult {
+    readonly approved: boolean;
+    readonly persisted: boolean;
+    readonly sourceLayer: PermissionDecisionSource;
+    readonly reasonCode: PermissionDecisionReasonCode;
+    readonly analysis: PermissionRequestAnalysis;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/platform/permissions/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/platform/permissions/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,CAAC;AAE3E,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAEzE,MAAM,MAAM,wBAAwB,GAChC,eAAe,GACf,gBAAgB,GAChB,cAAc,GACd,cAAc,GACd,kBAAkB,GAClB,aAAa,CAAC;AAElB,MAAM,MAAM,4BAA4B,GACpC,cAAc,GACd,aAAa,GACb,sBAAsB,GACtB,qBAAqB,GACrB,kBAAkB,GAClB,gBAAgB,GAChB,aAAa,GACb,sBAAsB,GACtB,qBAAqB,GACrB,eAAe,GACf,aAAa,CAAC;AAElB,MAAM,MAAM,4BAA4B,GAAG,SAAS,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;AAC3F,MAAM,MAAM,yBAAyB,GAAG,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,eAAe,GAAG,UAAU,GAAG,SAAS,CAAC;AACtH,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,GAAG,UAAU,CAAC;AAEhG,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,4BAA4B,CAAC;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;IAC7C,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;IAC7C,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,wBAAwB,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,4BAA4B,CAAC;IAClD,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAC;CAC9C"}

package/dist/platform/permissions/types.js

@@ -0,0 +1 @@
+export {};

package/dist/platform/profiles/manager.d.ts

@@ -0,0 +1,57 @@
+import type { GoodVibesConfig } from '../config/schema.js';
+/**
+ * ProfileData - TUI-specific settings stored in a profile.
+ * Excludes permissions and API keys — only display/behavior/provider settings.
+ */
+export interface ProfileData {
+    display?: Partial<GoodVibesConfig['display']>;
+    provider?: Pick<GoodVibesConfig['provider'], 'model' | 'reasoningEffort'>;
+    behavior?: Partial<GoodVibesConfig['behavior']>;
+}
+/**
+ * ProfileInfo - Summary of a saved profile.
+ */
+export interface ProfileInfo {
+    name: string;
+    timestamp: number;
+    filePath: string;
+}
+/**
+ * ProfileManager - Save and load named TUI config profiles.
+ *
+ * Profiles are stored as JSON files in ~/.goodvibes/sdk/profiles/<name>.json.
+ * Only TUI-specific settings (display, provider, behavior categories) are saved;
+ * permissions and API keys are never included.
+ */
+export declare class ProfileManager {
+    private readonly profilesDir;
+    private lastTimestamp;
+    constructor(baseDir: string);
+    get storagePath(): string;
+    /**
+     * save - Persist a profile under the given name.
+     * Overwrites an existing profile with the same name.
+     */
+    save(name: string, data: ProfileData): string;
+    /**
+     * load - Load a profile by name. Returns the profile data or throws if not found.
+     */
+    load(name: string): {
+        data: ProfileData;
+        timestamp: number;
+    };
+    /**
+     * list - Return all saved profiles sorted by most recent first.
+     */
+    list(): ProfileInfo[];
+    private nextTimestamp;
+    /**
+     * delete - Remove a profile by name. Returns true if deleted, false if not found.
+     */
+    delete(name: string): boolean;
+    /**
+     * sanitizeName - Safe filename from profile name.
+     */
+    sanitizeName(name: string): string;
+}
+//# sourceMappingURL=manager.d.ts.map

package/dist/platform/profiles/manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../../src/platform/profiles/manager.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAG3D;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9C,QAAQ,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,OAAO,GAAG,iBAAiB,CAAC,CAAC;IAC1E,QAAQ,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC;CACjD;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,aAAa,CAAK;gBAEd,OAAO,EAAE,MAAM;IAI3B,IAAW,WAAW,IAAI,MAAM,CAE/B;IAED;;;OAGG;IACI,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,MAAM;IAiBpD;;OAEG;IACI,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAuBnE;;OAEG;IACI,IAAI,IAAI,WAAW,EAAE;IA8B5B,OAAO,CAAC,aAAa;IAMrB;;OAEG;IACI,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAapC;;OAEG;IACI,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;CAS1C"}

package/dist/platform/profiles/manager.js

@@ -0,0 +1,140 @@
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync, unlinkSync } from 'fs';
+import { join } from 'path';
+import { logger } from '../utils/logger.js';
+import { summarizeError } from '../utils/error-display.js';
+/**
+ * ProfileManager - Save and load named TUI config profiles.
+ *
+ * Profiles are stored as JSON files in ~/.goodvibes/sdk/profiles/<name>.json.
+ * Only TUI-specific settings (display, provider, behavior categories) are saved;
+ * permissions and API keys are never included.
+ */
+export class ProfileManager {
+    profilesDir;
+    lastTimestamp = 0;
+    constructor(baseDir) {
+        this.profilesDir = baseDir;
+    }
+    get storagePath() {
+        return this.profilesDir;
+    }
+    /**
+     * save - Persist a profile under the given name.
+     * Overwrites an existing profile with the same name.
+     */
+    save(name, data) {
+        if (!name || !name.trim())
+            throw new Error('Profile name cannot be empty');
+        mkdirSync(this.profilesDir, { recursive: true });
+        const sanitizedName = this.sanitizeName(name);
+        const filePath = join(this.profilesDir, `${sanitizedName}.json`);
+        const record = {
+            name: sanitizedName,
+            timestamp: this.nextTimestamp(),
+            display: data.display ?? {},
+            provider: data.provider ?? {},
+            behavior: data.behavior ?? {},
+        };
+        writeFileSync(filePath, JSON.stringify(record, null, 2), 'utf-8');
+        logger.debug('ProfileManager: saved profile', { name: sanitizedName, filePath });
+        return filePath;
+    }
+    /**
+     * load - Load a profile by name. Returns the profile data or throws if not found.
+     */
+    load(name) {
+        if (!name || !name.trim())
+            throw new Error('Profile name cannot be empty');
+        const sanitizedName = this.sanitizeName(name);
+        const filePath = join(this.profilesDir, `${sanitizedName}.json`);
+        if (!existsSync(filePath)) {
+            throw new Error(`Profile not found: ${name}`);
+        }
+        try {
+            const raw = readFileSync(filePath, 'utf-8');
+            const record = JSON.parse(raw);
+            return {
+                timestamp: Number(record.timestamp ?? 0),
+                data: {
+                    display: record.display ?? {},
+                    provider: record.provider,
+                    behavior: record.behavior ?? {},
+                },
+            };
+        }
+        catch (e) {
+            throw new Error(`Failed to parse profile "${name}": ${summarizeError(e)}`);
+        }
+    }
+    /**
+     * list - Return all saved profiles sorted by most recent first.
+     */
+    list() {
+        if (!existsSync(this.profilesDir))
+            return [];
+        let files;
+        try {
+            files = readdirSync(this.profilesDir).filter(f => f.endsWith('.json'));
+        }
+        catch {
+            return [];
+        }
+        const profiles = [];
+        for (const file of files) {
+            const name = file.replace(/\.json$/, '');
+            const filePath = join(this.profilesDir, file);
+            let timestamp = 0;
+            try {
+                const raw = readFileSync(filePath, 'utf-8');
+                const record = JSON.parse(raw);
+                timestamp = Number(record.timestamp ?? 0);
+            }
+            catch {
+                // Skip unreadable files
+                continue;
+            }
+            profiles.push({ name, timestamp, filePath });
+        }
+        profiles.sort((a, b) => {
+            if (b.timestamp !== a.timestamp)
+                return b.timestamp - a.timestamp;
+            return b.name.localeCompare(a.name);
+        });
+        return profiles;
+    }
+    nextTimestamp() {
+        const now = Date.now();
+        this.lastTimestamp = now > this.lastTimestamp ? now : this.lastTimestamp + 1;
+        return this.lastTimestamp;
+    }
+    /**
+     * delete - Remove a profile by name. Returns true if deleted, false if not found.
+     */
+    delete(name) {
+        if (!name || !name.trim())
+            return false;
+        const sanitizedName = this.sanitizeName(name);
+        const filePath = join(this.profilesDir, `${sanitizedName}.json`);
+        if (!existsSync(filePath))
+            return false;
+        try {
+            unlinkSync(filePath);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * sanitizeName - Safe filename from profile name.
+     */
+    sanitizeName(name) {
+        return name
+            .toLowerCase()
+            .replace(/\s+/g, '-')
+            .replace(/[^a-z0-9_-]/g, '')
+            .replace(/-+/g, '-')
+            .replace(/^-+|-+$/g, '')
+            || 'profile';
+    }
+}