@pennyfarthing/core 10.4.0 → 11.0.0

package/packages/core/dist/server/settings-store.d.ts

@@ -0,0 +1,195 @@
+/**
+ * Settings Store for Cyclist
+ *
+ * Provides runtime state management for application settings including
+ * the Bash approval gate feature (Story 22-3), verbose mode (Story 22-5),
+ * and permission grants (Story 33-4).
+ *
+ * AC2 (35-14): This module handles ONLY runtime state - no file I/O.
+ * File persistence is delegated to settings.ts via callbacks.
+ */
+/**
+ * Get the current state of the Bash approval gate
+ * @returns true if approval gate is enabled, false otherwise
+ */
+export declare function getBashApprovalGate(): boolean;
+/**
+ * Set the state of the Bash approval gate
+ * @param enabled - true to enable approval gate, false to disable
+ */
+export declare function setBashApprovalGate(enabled: boolean): void;
+/**
+ * Get all patterns in the allowlist
+ * @returns Array of glob patterns
+ */
+export declare function getAllowlist(): string[];
+/**
+ * Add a pattern to the allowlist
+ * Patterns use simple glob format: 'git *' matches 'git status', 'git commit', etc.
+ * @param pattern - Glob pattern to add (e.g., 'git *', 'npm *')
+ */
+export declare function addToAllowlist(pattern: string): void;
+/**
+ * Check if a command matches any pattern in the allowlist
+ * @param command - The full command to check
+ * @returns true if command matches an allowlisted pattern
+ */
+export declare function isAllowlisted(command: string): boolean;
+/**
+ * Clear all patterns from the allowlist
+ */
+export declare function clearAllowlist(): void;
+/**
+ * Extract a glob pattern from a command
+ * Takes the first word (command name) and appends ' *'
+ * @param command - Full command string
+ * @returns Glob pattern (e.g., 'git commit -m "msg"' -> 'git *')
+ */
+export declare function extractPattern(command: string): string;
+/**
+ * Get the current state of verbose mode
+ * When enabled, tool blocks are expanded by default
+ * @returns true if verbose mode is enabled, false otherwise
+ */
+export declare function getVerboseMode(): boolean;
+/**
+ * Set the state of verbose mode
+ * @param enabled - true to enable verbose mode, false to disable
+ */
+export declare function setVerboseMode(enabled: boolean): void;
+/**
+ * Get the current state of the dangerous path gate
+ * When enabled, modifications to sensitive paths require approval
+ * @returns true if dangerous path gate is enabled, false otherwise
+ */
+export declare function getDangerousPathGate(): boolean;
+/**
+ * Set the state of the dangerous path gate
+ * @param enabled - true to enable dangerous path detection, false to disable
+ */
+export declare function setDangerousPathGate(enabled: boolean): void;
+/**
+ * Get all paths in the path allowlist
+ * @returns Array of path patterns
+ */
+export declare function getPathAllowlist(): string[];
+/**
+ * Add a path to the allowlist
+ * @param path - Path or glob pattern to allow
+ */
+export declare function addToPathAllowlist(path: string): void;
+/**
+ * Check if a path matches any pattern in the path allowlist
+ * @param path - The path to check
+ * @returns true if path matches an allowlisted pattern
+ */
+export declare function isPathAllowlisted(path: string): boolean;
+/**
+ * Clear all paths from the path allowlist
+ */
+export declare function clearPathAllowlist(): void;
+/**
+ * Sync in-memory settings store with file-based settings
+ * Called when file-based settings are loaded/changed to update runtime state
+ * @param fileSettings - Settings loaded from file
+ */
+export declare function syncWithFileSettings(fileSettings: {
+    workflow?: {
+        auto_handoff?: boolean;
+        handoff_confirm?: boolean;
+    };
+    display?: {
+        show_flow?: boolean;
+        sidebar_width?: number;
+    };
+    notifications?: {
+        phase_change?: boolean;
+        sound?: boolean;
+    };
+}): void;
+/**
+ * Grant type enum for permission scopes
+ */
+export declare const GrantType: {
+    readonly ONCE: "once";
+    readonly SESSION: "session";
+    readonly ALWAYS: "always";
+};
+export type GrantTypeValue = (typeof GrantType)[keyof typeof GrantType];
+/**
+ * Permission grant structure
+ */
+export interface PermissionGrant {
+    tool: string;
+    scope: string;
+    grant_type: GrantTypeValue;
+    granted_at: string;
+    agent?: string;
+}
+/**
+ * Set the callback for persisting grants to file
+ * AC2: Delegates persistence to settings.ts
+ * @param callback - Function that persists grants and returns success boolean
+ */
+export declare function setGrantsPersistCallback(callback: (grants: PermissionGrant[]) => boolean): void;
+/**
+ * Initialize grants from pre-loaded data
+ * AC2: Accepts grants array from settings.ts instead of reading files directly
+ * @param grants - Array of grants to initialize with
+ */
+export declare function initializeGrants(grants: PermissionGrant[]): void;
+/**
+ * Add a permission grant
+ * @param grant - The grant to add
+ */
+export declare function addGrant(grant: PermissionGrant): void;
+/**
+ * Check if a grant exists for the given tool and command
+ * Auto-revokes 'once' grants after checking
+ * @param tool - The tool name (e.g., 'Bash', 'WebFetch')
+ * @param command - The command/URL/path to check
+ * @param agent - Optional agent name for agent-scoped grant matching
+ * @returns true if grant exists
+ */
+export declare function checkGrant(tool: string, command: string, agent?: string): boolean;
+/**
+ * Get all grants (session + persisted)
+ * @returns Array of all grants
+ */
+export declare function getGrants(): PermissionGrant[];
+/**
+ * Get only session grants (memory-only, non-persisted)
+ * @returns Array of session grants
+ */
+export declare function getSessionGrants(): PermissionGrant[];
+/**
+ * Get only persisted grants (always grants)
+ * @returns Array of persisted grants
+ */
+export declare function getPersistedGrants(): PermissionGrant[];
+/**
+ * Remove a specific grant
+ * @param grant - The grant to remove
+ */
+export declare function removeGrant(grant: PermissionGrant): void;
+/**
+ * Clear all grants (both session and persisted)
+ */
+export declare function clearAllGrants(): void;
+/**
+ * Clear session grants only (once + session, not always)
+ * Called on application exit
+ */
+export declare function clearSessionGrants(): void;
+/**
+ * Persist an always grant to settings file
+ * @param grant - The grant to persist
+ */
+export declare function persistAlwaysGrant(grant: PermissionGrant): void;
+/**
+ * Load persisted grants from settings file
+ * DEPRECATED: Use initializeGrants() with grants from settings.loadGrants() instead
+ * Kept for backward compatibility - calls initializeGrants with empty array
+ */
+export declare function loadPersistedGrants(): void;
+//# sourceMappingURL=settings-store.d.ts.map

package/packages/core/dist/server/settings-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings-store.d.ts","sourceRoot":"","sources":["../../src/server/settings-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAaH;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAE1D;AAED;;;GAGG;AACH,wBAAgB,YAAY,IAAI,MAAM,EAAE,CAEvC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAIpD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED;;GAEG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGtD;AAsBD;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAExC;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAErD;AAUD;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAE3D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,EAAE,CAE3C;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAIrD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAsBD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE;IACjD,QAAQ,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACjE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,aAAa,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC7D,GAAG,IAAI,CAOP;AAMD;;GAEG;AACH,eAAO,MAAM,SAAS;;;;CAIZ,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAExE;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,cAAc,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAWD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,OAAO,GAAG,IAAI,CAE/F;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,CAUhE;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAgBrD;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CA0CjF;AA4BD;;;GAGG;AACH,wBAAgB,SAAS,IAAI,eAAe,EAAE,CAE7C;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,eAAe,EAAE,CAEpD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,eAAe,EAAE,CAEtD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAaxD;AAED;;GAEG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAQrC;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAU/D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAK1C"}

package/packages/core/dist/server/settings-store.js

@@ -0,0 +1,398 @@
+/**
+ * Settings Store for Cyclist
+ *
+ * Provides runtime state management for application settings including
+ * the Bash approval gate feature (Story 22-3), verbose mode (Story 22-5),
+ * and permission grants (Story 33-4).
+ *
+ * AC2 (35-14): This module handles ONLY runtime state - no file I/O.
+ * File persistence is delegated to settings.ts via callbacks.
+ */
+// AC2: NO fs import - file I/O is handled by settings.ts
+// =============================================================================
+// In-Memory State
+// =============================================================================
+// In-memory settings state
+let bashApprovalGateEnabled = false;
+let allowlist = [];
+let verboseModeEnabled = false;
+/**
+ * Get the current state of the Bash approval gate
+ * @returns true if approval gate is enabled, false otherwise
+ */
+export function getBashApprovalGate() {
+    return bashApprovalGateEnabled;
+}
+/**
+ * Set the state of the Bash approval gate
+ * @param enabled - true to enable approval gate, false to disable
+ */
+export function setBashApprovalGate(enabled) {
+    bashApprovalGateEnabled = enabled;
+}
+/**
+ * Get all patterns in the allowlist
+ * @returns Array of glob patterns
+ */
+export function getAllowlist() {
+    return [...allowlist]; // Return copy to prevent mutation
+}
+/**
+ * Add a pattern to the allowlist
+ * Patterns use simple glob format: 'git *' matches 'git status', 'git commit', etc.
+ * @param pattern - Glob pattern to add (e.g., 'git *', 'npm *')
+ */
+export function addToAllowlist(pattern) {
+    if (!allowlist.includes(pattern)) {
+        allowlist.push(pattern);
+    }
+}
+/**
+ * Check if a command matches any pattern in the allowlist
+ * @param command - The full command to check
+ * @returns true if command matches an allowlisted pattern
+ */
+export function isAllowlisted(command) {
+    return allowlist.some((pattern) => matchGlobPattern(pattern, command));
+}
+/**
+ * Clear all patterns from the allowlist
+ */
+export function clearAllowlist() {
+    allowlist = [];
+}
+/**
+ * Extract a glob pattern from a command
+ * Takes the first word (command name) and appends ' *'
+ * @param command - Full command string
+ * @returns Glob pattern (e.g., 'git commit -m "msg"' -> 'git *')
+ */
+export function extractPattern(command) {
+    const firstWord = command.trim().split(/\s+/)[0];
+    return `${firstWord} *`;
+}
+/**
+ * Simple glob pattern matching
+ * Supports '*' as wildcard for any characters
+ * @param pattern - Glob pattern (e.g., 'git *')
+ * @param str - String to match against
+ * @returns true if str matches pattern
+ */
+function matchGlobPattern(pattern, str) {
+    // Escape regex special chars except *
+    const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+    // Convert * to regex .*
+    const regexStr = escaped.replace(/\*/g, '.*');
+    const regex = new RegExp(`^${regexStr}$`);
+    return regex.test(str);
+}
+// =============================================================================
+// Verbose Mode (Story 22-5)
+// =============================================================================
+/**
+ * Get the current state of verbose mode
+ * When enabled, tool blocks are expanded by default
+ * @returns true if verbose mode is enabled, false otherwise
+ */
+export function getVerboseMode() {
+    return verboseModeEnabled;
+}
+/**
+ * Set the state of verbose mode
+ * @param enabled - true to enable verbose mode, false to disable
+ */
+export function setVerboseMode(enabled) {
+    verboseModeEnabled = enabled;
+}
+// =============================================================================
+// Dangerous Path Detection (Story 22-4)
+// =============================================================================
+// In-memory state for dangerous path detection
+let dangerousPathGateEnabled = true; // Enabled by default for safety
+let pathAllowlist = [];
+/**
+ * Get the current state of the dangerous path gate
+ * When enabled, modifications to sensitive paths require approval
+ * @returns true if dangerous path gate is enabled, false otherwise
+ */
+export function getDangerousPathGate() {
+    return dangerousPathGateEnabled;
+}
+/**
+ * Set the state of the dangerous path gate
+ * @param enabled - true to enable dangerous path detection, false to disable
+ */
+export function setDangerousPathGate(enabled) {
+    dangerousPathGateEnabled = enabled;
+}
+/**
+ * Get all paths in the path allowlist
+ * @returns Array of path patterns
+ */
+export function getPathAllowlist() {
+    return [...pathAllowlist];
+}
+/**
+ * Add a path to the allowlist
+ * @param path - Path or glob pattern to allow
+ */
+export function addToPathAllowlist(path) {
+    if (!pathAllowlist.includes(path)) {
+        pathAllowlist.push(path);
+    }
+}
+/**
+ * Check if a path matches any pattern in the path allowlist
+ * @param path - The path to check
+ * @returns true if path matches an allowlisted pattern
+ */
+export function isPathAllowlisted(path) {
+    return pathAllowlist.some((pattern) => matchPathPattern(pattern, path));
+}
+/**
+ * Clear all paths from the path allowlist
+ */
+export function clearPathAllowlist() {
+    pathAllowlist = [];
+}
+/**
+ * Simple path pattern matching
+ * Supports '*' as wildcard for any characters
+ * @param pattern - Glob pattern
+ * @param path - Path to match against
+ * @returns true if path matches pattern
+ */
+function matchPathPattern(pattern, path) {
+    // Escape regex special chars except *
+    const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+    // Convert * to regex .*
+    const regexStr = escaped.replace(/\*/g, '.*');
+    const regex = new RegExp(`^${regexStr}$`);
+    return regex.test(path);
+}
+// =============================================================================
+// File-based Settings Integration (Story 24-1)
+// =============================================================================
+/**
+ * Sync in-memory settings store with file-based settings
+ * Called when file-based settings are loaded/changed to update runtime state
+ * @param fileSettings - Settings loaded from file
+ */
+export function syncWithFileSettings(fileSettings) {
+    // Future: could sync verbose mode or other settings from file
+    // For now, just validate the settings structure
+    if (fileSettings && typeof fileSettings === 'object') {
+        // Settings are valid - integration point for future enhancements
+        // E.g., could set verbose mode: setVerboseMode(fileSettings.display?.verbose ?? false);
+    }
+}
+// =============================================================================
+// Permission Grant System (Story 33-4)
+// =============================================================================
+/**
+ * Grant type enum for permission scopes
+ */
+export const GrantType = {
+    ONCE: 'once',
+    SESSION: 'session',
+    ALWAYS: 'always',
+};
+// In-memory grant storage (session + once grants)
+let sessionGrants = [];
+// Persisted grants (always grants, stored in memory but synced to file via callback)
+let persistedGrants = [];
+// AC2: Callback for persisting grants to file (delegated to settings.ts)
+let grantsPersistCallback = null;
+/**
+ * Set the callback for persisting grants to file
+ * AC2: Delegates persistence to settings.ts
+ * @param callback - Function that persists grants and returns success boolean
+ */
+export function setGrantsPersistCallback(callback) {
+    grantsPersistCallback = callback;
+}
+/**
+ * Initialize grants from pre-loaded data
+ * AC2: Accepts grants array from settings.ts instead of reading files directly
+ * @param grants - Array of grants to initialize with
+ */
+export function initializeGrants(grants) {
+    // Clear existing grants
+    persistedGrants = [];
+    // Only load 'always' grants (session/once grants are not persisted)
+    for (const grant of grants) {
+        if (grant.grant_type === 'always') {
+            persistedGrants.push(grant);
+        }
+    }
+}
+/**
+ * Add a permission grant
+ * @param grant - The grant to add
+ */
+export function addGrant(grant) {
+    if (grant.grant_type === 'always') {
+        // Always grants go to persisted storage
+        if (!persistedGrants.some((g) => g.tool === grant.tool && g.scope === grant.scope && g.agent === grant.agent)) {
+            persistedGrants.push(grant);
+            // AC2: Persist via callback instead of direct file I/O
+            if (grantsPersistCallback) {
+                grantsPersistCallback(persistedGrants);
+            }
+        }
+    }
+    else {
+        // Once and session grants go to session storage
+        if (!sessionGrants.some((g) => g.tool === grant.tool && g.scope === grant.scope && g.agent === grant.agent)) {
+            sessionGrants.push(grant);
+        }
+    }
+}
+/**
+ * Check if a grant exists for the given tool and command
+ * Auto-revokes 'once' grants after checking
+ * @param tool - The tool name (e.g., 'Bash', 'WebFetch')
+ * @param command - The command/URL/path to check
+ * @param agent - Optional agent name for agent-scoped grant matching
+ * @returns true if grant exists
+ */
+export function checkGrant(tool, command, agent) {
+    // Use appropriate matching based on tool type
+    const matchScope = (scope, value) => {
+        // For WebFetch, use domain matching for URLs
+        if (tool === 'WebFetch' && (value.startsWith('http://') || value.startsWith('https://'))) {
+            return matchDomainPattern(scope, value);
+        }
+        // For file tools, use path matching
+        if ((tool === 'Edit' || tool === 'Write' || tool === 'Read') && value.startsWith('/')) {
+            return matchPathPattern(scope, value);
+        }
+        // Default: glob pattern matching
+        return matchGlobPattern(scope, value);
+    };
+    // Match agent: global grants (no agent) match any request,
+    // agent-scoped grants only match when the requesting agent matches
+    const matchAgent = (grant) => {
+        if (!grant.agent)
+            return true; // Global grant matches any agent
+        return grant.agent === agent; // Agent-scoped grant requires match
+    };
+    // Check session grants first
+    const sessionIndex = sessionGrants.findIndex((g) => g.tool === tool && matchScope(g.scope, command) && matchAgent(g));
+    if (sessionIndex !== -1) {
+        const grant = sessionGrants[sessionIndex];
+        if (grant.grant_type === 'once') {
+            // Auto-revoke once grants
+            sessionGrants.splice(sessionIndex, 1);
+        }
+        return true;
+    }
+    // Check persisted grants
+    const persistedMatch = persistedGrants.find((g) => g.tool === tool && matchScope(g.scope, command) && matchAgent(g));
+    return !!persistedMatch;
+}
+/**
+ * Match a domain pattern against a URL (Story 33-3)
+ * Supports patterns like '*.github.com' to match 'github.com', 'api.github.com', etc.
+ * @param pattern - Domain pattern (e.g., '*.github.com')
+ * @param url - URL to match against
+ * @returns true if URL matches pattern
+ */
+function matchDomainPattern(pattern, url) {
+    try {
+        const urlObj = new URL(url);
+        const hostname = urlObj.hostname;
+        // If pattern starts with '*.' it matches the domain and all subdomains
+        if (pattern.startsWith('*.')) {
+            const baseDomain = pattern.slice(2); // Remove '*.'
+            return hostname === baseDomain || hostname.endsWith('.' + baseDomain);
+        }
+        // Exact domain match
+        return hostname === pattern;
+    }
+    catch {
+        // Invalid URL, fall back to glob matching
+        return matchGlobPattern(pattern, url);
+    }
+}
+/**
+ * Get all grants (session + persisted)
+ * @returns Array of all grants
+ */
+export function getGrants() {
+    return [...sessionGrants, ...persistedGrants];
+}
+/**
+ * Get only session grants (memory-only, non-persisted)
+ * @returns Array of session grants
+ */
+export function getSessionGrants() {
+    return [...sessionGrants];
+}
+/**
+ * Get only persisted grants (always grants)
+ * @returns Array of persisted grants
+ */
+export function getPersistedGrants() {
+    return [...persistedGrants];
+}
+/**
+ * Remove a specific grant
+ * @param grant - The grant to remove
+ */
+export function removeGrant(grant) {
+    const matchGrant = (g) => g.tool === grant.tool && g.scope === grant.scope && g.grant_type === grant.grant_type && g.agent === grant.agent;
+    const hadPersistedGrant = persistedGrants.some(matchGrant);
+    sessionGrants = sessionGrants.filter((g) => !matchGrant(g));
+    persistedGrants = persistedGrants.filter((g) => !matchGrant(g));
+    // AC2: If we removed an always grant, persist via callback
+    if (hadPersistedGrant && grant.grant_type === 'always' && grantsPersistCallback) {
+        grantsPersistCallback(persistedGrants);
+    }
+}
+/**
+ * Clear all grants (both session and persisted)
+ */
+export function clearAllGrants() {
+    const hadPersistedGrants = persistedGrants.length > 0;
+    sessionGrants = [];
+    persistedGrants = [];
+    // AC2: Persist via callback if we cleared any always grants
+    if (hadPersistedGrants && grantsPersistCallback) {
+        grantsPersistCallback(persistedGrants);
+    }
+}
+/**
+ * Clear session grants only (once + session, not always)
+ * Called on application exit
+ */
+export function clearSessionGrants() {
+    sessionGrants = [];
+}
+/**
+ * Persist an always grant to settings file
+ * @param grant - The grant to persist
+ */
+export function persistAlwaysGrant(grant) {
+    if (grant.grant_type === 'always') {
+        if (!persistedGrants.some((g) => g.tool === grant.tool && g.scope === grant.scope && g.agent === grant.agent)) {
+            persistedGrants.push(grant);
+        }
+        // AC2: Persist via callback
+        if (grantsPersistCallback) {
+            grantsPersistCallback(persistedGrants);
+        }
+    }
+}
+/**
+ * Load persisted grants from settings file
+ * DEPRECATED: Use initializeGrants() with grants from settings.loadGrants() instead
+ * Kept for backward compatibility - calls initializeGrants with empty array
+ */
+export function loadPersistedGrants() {
+    // AC2: This function no longer does file I/O
+    // For backward compatibility, initialize with empty grants
+    // Callers should use: settingsStore.initializeGrants(settings.loadGrants())
+    initializeGrants([]);
+}
+//# sourceMappingURL=settings-store.js.map

package/packages/core/dist/server/settings-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings-store.js","sourceRoot":"","sources":["../../src/server/settings-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,yDAAyD;AAEzD,gFAAgF;AAChF,kBAAkB;AAClB,gFAAgF;AAEhF,2BAA2B;AAC3B,IAAI,uBAAuB,GAAG,KAAK,CAAC;AACpC,IAAI,SAAS,GAAa,EAAE,CAAC;AAC7B,IAAI,kBAAkB,GAAG,KAAK,CAAC;AAE/B;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,uBAAuB,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,uBAAuB,GAAG,OAAO,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,kCAAkC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,SAAS,GAAG,EAAE,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,OAAO,GAAG,SAAS,IAAI,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,OAAe,EAAE,GAAW;IACpD,sCAAsC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IAC7D,wBAAwB;IACxB,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,kBAAkB,GAAG,OAAO,CAAC;AAC/B,CAAC;AAED,gFAAgF;AAChF,wCAAwC;AACxC,gFAAgF;AAEhF,+CAA+C;AAC/C,IAAI,wBAAwB,GAAG,IAAI,CAAC,CAAC,gCAAgC;AACrE,IAAI,aAAa,GAAa,EAAE,CAAC;AAEjC;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,wBAAwB,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,wBAAwB,GAAG,OAAO,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,aAAa,GAAG,EAAE,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,OAAe,EAAE,IAAY;IACrD,sCAAsC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IAC7D,wBAAwB;IACxB,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,gFAAgF;AAChF,+CAA+C;AAC/C,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,YAIpC;IACC,8DAA8D;IAC9D,gDAAgD;IAChD,IAAI,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACrD,iEAAiE;QACjE,wFAAwF;IAC1F,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,uCAAuC;AACvC,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;CACR,CAAC;AAeX,kDAAkD;AAClD,IAAI,aAAa,GAAsB,EAAE,CAAC;AAE1C,qFAAqF;AACrF,IAAI,eAAe,GAAsB,EAAE,CAAC;AAE5C,yEAAyE;AACzE,IAAI,qBAAqB,GAAoD,IAAI,CAAC;AAElF;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAgD;IACvF,qBAAqB,GAAG,QAAQ,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAyB;IACxD,wBAAwB;IACxB,eAAe,GAAG,EAAE,CAAC;IAErB,oEAAoE;IACpE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAClC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAsB;IAC7C,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClC,wCAAwC;QACxC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9G,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5B,uDAAuD;YACvD,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,qBAAqB,CAAC,eAAe,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,gDAAgD;QAChD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5G,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,OAAe,EAAE,KAAc;IACtE,8CAA8C;IAC9C,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,KAAa,EAAE,EAAE;QAClD,6CAA6C;QAC7C,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACzF,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,oCAAoC;QACpC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtF,OAAO,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC;QACD,iCAAiC;QACjC,OAAO,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC;IAEF,2DAA2D;IAC3D,mEAAmE;IACnE,MAAM,UAAU,GAAG,CAAC,KAAsB,EAAE,EAAE;QAC5C,IAAI,CAAC,KAAK,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,CAAC,iCAAiC;QAChE,OAAO,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,oCAAoC;IACpE,CAAC,CAAC;IAEF,6BAA6B;IAC7B,MAAM,YAAY,GAAG,aAAa,CAAC,SAAS,CAC1C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CACxE,CAAC;IAEF,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;YAChC,0BAA0B;YAC1B,aAAa,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yBAAyB;IACzB,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CACxE,CAAC;IAEF,OAAO,CAAC,CAAC,cAAc,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,OAAe,EAAE,GAAW;IACtD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAEjC,uEAAuE;QACvE,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc;YACnD,OAAO,QAAQ,KAAK,UAAU,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC;QACxE,CAAC;QAED,qBAAqB;QACrB,OAAO,QAAQ,KAAK,OAAO,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,0CAA0C;QAC1C,OAAO,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO,CAAC,GAAG,aAAa,EAAE,GAAG,eAAe,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,CAAC,GAAG,aAAa,CAAC,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,CAAC,GAAG,eAAe,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAsB;IAChD,MAAM,UAAU,GAAG,CAAC,CAAkB,EAAE,EAAE,CACxC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC;IAEnH,MAAM,iBAAiB,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAE3D,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,eAAe,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhE,2DAA2D;IAC3D,IAAI,iBAAiB,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,qBAAqB,EAAE,CAAC;QAChF,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,kBAAkB,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IACtD,aAAa,GAAG,EAAE,CAAC;IACnB,eAAe,GAAG,EAAE,CAAC;IACrB,4DAA4D;IAC5D,IAAI,kBAAkB,IAAI,qBAAqB,EAAE,CAAC;QAChD,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,aAAa,GAAG,EAAE,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAsB;IACvD,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9G,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD,4BAA4B;QAC5B,IAAI,qBAAqB,EAAE,CAAC;YAC1B,qBAAqB,CAAC,eAAe,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,6CAA6C;IAC7C,2DAA2D;IAC3D,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,CAAC,CAAC;AACvB,CAAC"}