@phuetz/code-buddy 0.1.0

package/dist/security/tool-permissions.js

@@ -0,0 +1,330 @@
+/**
+ * Tool Permissions System
+ *
+ * Inspired by mistral-vibe's tool permission system that allows:
+ * - ALWAYS: Auto-execute without prompting
+ * - ASK: Request user confirmation before running
+ * - NEVER: Block execution entirely
+ *
+ * Supports:
+ * - Exact tool name matching
+ * - Glob patterns (e.g., "read_*", "git*")
+ * - Regex patterns with "re:" prefix (e.g., "re:^file_.*")
+ */
+import fs from 'fs-extra';
+import path from 'path';
+import os from 'os';
+import { logger } from '../utils/logger.js';
+// ============================================================================
+// Types
+// ============================================================================
+export var ToolPermission;
+(function (ToolPermission) {
+    ToolPermission["ALWAYS"] = "always";
+    ToolPermission["ASK"] = "ask";
+    ToolPermission["NEVER"] = "never";
+})(ToolPermission || (ToolPermission = {}));
+// ============================================================================
+// Default Configuration (like mistral-vibe)
+// ============================================================================
+const DEFAULT_CONFIG = {
+    default: ToolPermission.ASK,
+    rules: [
+        // Read-only operations are always allowed
+        { pattern: 'read_file', permission: ToolPermission.ALWAYS },
+        { pattern: 'view_file', permission: ToolPermission.ALWAYS },
+        { pattern: 'list_files', permission: ToolPermission.ALWAYS },
+        { pattern: 'search_files', permission: ToolPermission.ALWAYS },
+        { pattern: 'grep', permission: ToolPermission.ALWAYS },
+        { pattern: 'rg', permission: ToolPermission.ALWAYS },
+        { pattern: 'find_files', permission: ToolPermission.ALWAYS },
+        { pattern: 'glob', permission: ToolPermission.ALWAYS },
+        { pattern: 'git_status', permission: ToolPermission.ALWAYS },
+        { pattern: 'git_log', permission: ToolPermission.ALWAYS },
+        { pattern: 'git_diff', permission: ToolPermission.ALWAYS },
+        // Todo operations are always allowed
+        { pattern: 'todo_*', permission: ToolPermission.ALWAYS },
+        // Write operations require confirmation
+        { pattern: 'write_file', permission: ToolPermission.ASK },
+        { pattern: 'edit_file', permission: ToolPermission.ASK },
+        { pattern: 'create_file', permission: ToolPermission.ASK },
+        { pattern: 'delete_file', permission: ToolPermission.ASK },
+        { pattern: 'str_replace', permission: ToolPermission.ASK },
+        // Shell commands require confirmation
+        { pattern: 'bash', permission: ToolPermission.ASK },
+        { pattern: 'shell', permission: ToolPermission.ASK },
+        { pattern: 'execute', permission: ToolPermission.ASK },
+        // Git write operations require confirmation
+        { pattern: 'git_commit', permission: ToolPermission.ASK },
+        { pattern: 'git_push', permission: ToolPermission.ASK },
+        { pattern: 'git_checkout', permission: ToolPermission.ASK },
+    ],
+    allowlist: [
+        // Safe bash commands (like mistral-vibe)
+        'echo *',
+        'ls *',
+        'cat *',
+        'head *',
+        'tail *',
+        'find *',
+        'git log *',
+        'git status *',
+        'git diff *',
+        'npm run test*',
+        'npm run build*',
+        'npm run lint*',
+    ],
+    denylist: [
+        // Interactive commands that can't work in non-TTY
+        'vim *',
+        'nano *',
+        'emacs *',
+        'less *',
+        'more *',
+        'bash -i*',
+        'python',
+        'node',
+        // Dangerous commands
+        'rm -rf /*',
+        'rm -rf ~*',
+        'sudo *',
+    ],
+};
+// ============================================================================
+// Pattern Matching
+// ============================================================================
+/**
+ * Check if a string matches a pattern (glob or regex)
+ */
+function matchesPattern(input, pattern) {
+    // Regex pattern (with "re:" prefix)
+    if (pattern.startsWith('re:')) {
+        try {
+            const regex = new RegExp(pattern.slice(3));
+            return regex.test(input);
+        }
+        catch {
+            return false;
+        }
+    }
+    // Glob pattern (convert to regex)
+    const regexPattern = pattern
+        .replace(/[.+^${}()|[\]\\]/g, '\\$&') // Escape special chars
+        .replace(/\*/g, '.*') // * -> .*
+        .replace(/\?/g, '.'); // ? -> .
+    const regex = new RegExp(`^${regexPattern}$`, 'i');
+    return regex.test(input);
+}
+// ============================================================================
+// Tool Permission Manager
+// ============================================================================
+export class ToolPermissionManager {
+    config;
+    configPath;
+    constructor(configPath) {
+        this.configPath = configPath || path.join(os.homedir(), '.codebuddy', 'tool-permissions.json');
+        this.config = this.loadConfig();
+    }
+    /**
+     * Load configuration from file or use defaults
+     */
+    loadConfig() {
+        try {
+            if (fs.existsSync(this.configPath)) {
+                const data = fs.readFileSync(this.configPath, 'utf-8');
+                const loaded = JSON.parse(data);
+                // Merge with defaults
+                return {
+                    default: loaded.default || DEFAULT_CONFIG.default,
+                    rules: [...DEFAULT_CONFIG.rules, ...(loaded.rules || [])],
+                    allowlist: [...DEFAULT_CONFIG.allowlist, ...(loaded.allowlist || [])],
+                    denylist: [...DEFAULT_CONFIG.denylist, ...(loaded.denylist || [])],
+                };
+            }
+        }
+        catch (error) {
+            logger.warn(`Failed to load tool permissions config: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        return { ...DEFAULT_CONFIG };
+    }
+    /**
+     * Save configuration to file
+     */
+    saveConfig() {
+        try {
+            const dir = path.dirname(this.configPath);
+            fs.ensureDirSync(dir);
+            fs.writeFileSync(this.configPath, JSON.stringify(this.config, null, 2));
+        }
+        catch (error) {
+            logger.warn(`Failed to save tool permissions config: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /**
+     * Get permission for a tool
+     *
+     * @param toolName - Name of the tool
+     * @param commandArgs - Optional command arguments (for bash/shell tools)
+     * @returns Permission level and optional reason
+     */
+    getPermission(toolName, commandArgs) {
+        const fullCommand = commandArgs ? `${toolName} ${commandArgs}` : toolName;
+        // Check denylist first (highest priority)
+        for (const pattern of this.config.denylist) {
+            if (matchesPattern(fullCommand, pattern) || matchesPattern(toolName, pattern)) {
+                return {
+                    permission: ToolPermission.NEVER,
+                    reason: `Blocked by denylist pattern: ${pattern}`,
+                };
+            }
+        }
+        // Check allowlist (for bash commands with arguments)
+        if (commandArgs) {
+            for (const pattern of this.config.allowlist) {
+                if (matchesPattern(fullCommand, pattern)) {
+                    return {
+                        permission: ToolPermission.ALWAYS,
+                        reason: `Allowed by allowlist pattern: ${pattern}`,
+                    };
+                }
+            }
+        }
+        // Check specific rules
+        for (const rule of this.config.rules) {
+            if (matchesPattern(toolName, rule.pattern)) {
+                return {
+                    permission: rule.permission,
+                    reason: rule.reason || `Matched rule: ${rule.pattern}`,
+                };
+            }
+        }
+        // Return default
+        return {
+            permission: this.config.default,
+            reason: 'Using default permission',
+        };
+    }
+    /**
+     * Check if a tool should be auto-approved
+     */
+    shouldAutoApprove(toolName, commandArgs) {
+        const { permission } = this.getPermission(toolName, commandArgs);
+        return permission === ToolPermission.ALWAYS;
+    }
+    /**
+     * Check if a tool should be blocked
+     */
+    shouldBlock(toolName, commandArgs) {
+        const { permission } = this.getPermission(toolName, commandArgs);
+        return permission === ToolPermission.NEVER;
+    }
+    /**
+     * Add a rule
+     */
+    addRule(rule) {
+        this.config.rules.push(rule);
+        this.saveConfig();
+    }
+    /**
+     * Remove a rule by pattern
+     */
+    removeRule(pattern) {
+        const initialLength = this.config.rules.length;
+        this.config.rules = this.config.rules.filter(r => r.pattern !== pattern);
+        if (this.config.rules.length !== initialLength) {
+            this.saveConfig();
+            return true;
+        }
+        return false;
+    }
+    /**
+     * Add to allowlist
+     */
+    addToAllowlist(pattern) {
+        if (!this.config.allowlist.includes(pattern)) {
+            this.config.allowlist.push(pattern);
+            this.saveConfig();
+        }
+    }
+    /**
+     * Add to denylist
+     */
+    addToDenylist(pattern) {
+        if (!this.config.denylist.includes(pattern)) {
+            this.config.denylist.push(pattern);
+            this.saveConfig();
+        }
+    }
+    /**
+     * Get all rules
+     */
+    getRules() {
+        return [...this.config.rules];
+    }
+    /**
+     * Get configuration
+     */
+    getConfig() {
+        return { ...this.config };
+    }
+    /**
+     * Reset to defaults
+     */
+    resetToDefaults() {
+        this.config = { ...DEFAULT_CONFIG };
+        this.saveConfig();
+    }
+    /**
+     * Format rules for display
+     */
+    formatRules() {
+        const lines = [
+            'Tool Permissions Configuration',
+            '═'.repeat(50),
+            '',
+            `Default: ${this.config.default.toUpperCase()}`,
+            '',
+            '📋 Rules:',
+        ];
+        const permissionIcons = {
+            [ToolPermission.ALWAYS]: '✅',
+            [ToolPermission.ASK]: '❓',
+            [ToolPermission.NEVER]: '🚫',
+        };
+        for (const rule of this.config.rules) {
+            const icon = permissionIcons[rule.permission];
+            lines.push(`  ${icon} ${rule.pattern} → ${rule.permission}`);
+        }
+        lines.push('');
+        lines.push('✅ Allowlist:');
+        for (const pattern of this.config.allowlist.slice(0, 10)) {
+            lines.push(`  • ${pattern}`);
+        }
+        if (this.config.allowlist.length > 10) {
+            lines.push(`  ... and ${this.config.allowlist.length - 10} more`);
+        }
+        lines.push('');
+        lines.push('🚫 Denylist:');
+        for (const pattern of this.config.denylist.slice(0, 10)) {
+            lines.push(`  • ${pattern}`);
+        }
+        if (this.config.denylist.length > 10) {
+            lines.push(`  ... and ${this.config.denylist.length - 10} more`);
+        }
+        return lines.join('\n');
+    }
+}
+// ============================================================================
+// Singleton Instance
+// ============================================================================
+let instance = null;
+export function getToolPermissionManager() {
+    if (!instance) {
+        instance = new ToolPermissionManager();
+    }
+    return instance;
+}
+export function resetToolPermissionManager() {
+    instance = null;
+}
+//# sourceMappingURL=tool-permissions.js.map

package/dist/security/tool-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-permissions.js","sourceRoot":"","sources":["../../src/security/tool-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,UAAU,CAAC;AAC1B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,+EAA+E;AAC/E,QAAQ;AACR,+EAA+E;AAE/E,MAAM,CAAN,IAAY,cAIX;AAJD,WAAY,cAAc;IACxB,mCAAiB,CAAA;IACjB,6BAAW,CAAA;IACX,iCAAe,CAAA;AACjB,CAAC,EAJW,cAAc,KAAd,cAAc,QAIzB;AAsBD,+EAA+E;AAC/E,4CAA4C;AAC5C,+EAA+E;AAE/E,MAAM,cAAc,GAAyB;IAC3C,OAAO,EAAE,cAAc,CAAC,GAAG;IAC3B,KAAK,EAAE;QACL,0CAA0C;QAC1C,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,CAAC,MAAM,EAAE;QAC3D,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,CAAC,MAAM,EAAE;QAC3D,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,CAAC,MAAM,EAAE;QAC5D,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,cAAc,CAAC,MAAM,EAAE;QAC9D,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,CAAC,MAAM,EAAE;QACtD,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,cAAc,CAAC,MAAM,EAAE;QACpD,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,CAAC,MAAM,EAAE;QAC5D,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,CAAC,MAAM,EAAE;QACtD,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,CAAC,MAAM,EAAE;QAC5D,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,CAAC,MAAM,EAAE;QACzD,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC,MAAM,EAAE;QAE1D,qCAAqC;QACrC,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,CAAC,MAAM,EAAE;QAExD,wCAAwC;QACxC,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,CAAC,GAAG,EAAE;QACzD,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,CAAC,GAAG,EAAE;QACxD,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,CAAC,GAAG,EAAE;QAC1D,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,CAAC,GAAG,EAAE;QAC1D,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,CAAC,GAAG,EAAE;QAE1D,sCAAsC;QACtC,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,CAAC,GAAG,EAAE;QACnD,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,CAAC,GAAG,EAAE;QACpD,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,CAAC,GAAG,EAAE;QAEtD,4CAA4C;QAC5C,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,CAAC,GAAG,EAAE;QACzD,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC,GAAG,EAAE;QACvD,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,cAAc,CAAC,GAAG,EAAE;KAC5D;IACD,SAAS,EAAE;QACT,yCAAyC;QACzC,QAAQ;QACR,MAAM;QACN,OAAO;QACP,QAAQ;QACR,QAAQ;QACR,QAAQ;QACR,WAAW;QACX,cAAc;QACd,YAAY;QACZ,eAAe;QACf,gBAAgB;QAChB,eAAe;KAChB;IACD,QAAQ,EAAE;QACR,kDAAkD;QAClD,OAAO;QACP,QAAQ;QACR,SAAS;QACT,QAAQ;QACR,QAAQ;QACR,UAAU;QACV,QAAQ;QACR,MAAM;QACN,qBAAqB;QACrB,WAAW;QACX,WAAW;QACX,QAAQ;KACT;CACF,CAAC;AAEF,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E;;GAEG;AACH,SAAS,cAAc,CAAC,KAAa,EAAE,OAAe;IACpD,oCAAoC;IACpC,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,MAAM,YAAY,GAAG,OAAO;SACzB,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,uBAAuB;SAC5D,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAkB,UAAU;SAChD,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAkB,SAAS;IAElD,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,YAAY,GAAG,EAAE,GAAG,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E,MAAM,OAAO,qBAAqB;IACxB,MAAM,CAAuB;IAC7B,UAAU,CAAS;IAE3B,YAAY,UAAmB;QAC7B,IAAI,CAAC,UAAU,GAAG,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,uBAAuB,CAAC,CAAC;QAC/F,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;IAClC,CAAC;IAED;;OAEG;IACK,UAAU;QAChB,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkC,CAAC;gBAEjE,sBAAsB;gBACtB,OAAO;oBACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,cAAc,CAAC,OAAO;oBACjD,KAAK,EAAE,CAAC,GAAG,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;oBACzD,SAAS,EAAE,CAAC,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;oBACrE,QAAQ,EAAE,CAAC,GAAG,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;iBACnE,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,2CAA2C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnH,CAAC;QAED,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1C,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YACtB,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,2CAA2C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,aAAa,CAAC,QAAgB,EAAE,WAAoB;QAIlD,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;QAE1E,0CAA0C;QAC1C,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC3C,IAAI,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC9E,OAAO;oBACL,UAAU,EAAE,cAAc,CAAC,KAAK;oBAChC,MAAM,EAAE,gCAAgC,OAAO,EAAE;iBAClD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,IAAI,WAAW,EAAE,CAAC;YAChB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC5C,IAAI,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC;oBACzC,OAAO;wBACL,UAAU,EAAE,cAAc,CAAC,MAAM;wBACjC,MAAM,EAAE,iCAAiC,OAAO,EAAE;qBACnD,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,uBAAuB;QACvB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACrC,IAAI,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3C,OAAO;oBACL,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,iBAAiB,IAAI,CAAC,OAAO,EAAE;iBACvD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,iBAAiB;QACjB,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC/B,MAAM,EAAE,0BAA0B;SACnC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,QAAgB,EAAE,WAAoB;QACtD,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACjE,OAAO,UAAU,KAAK,cAAc,CAAC,MAAM,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,QAAgB,EAAE,WAAoB;QAChD,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACjE,OAAO,UAAU,KAAK,cAAc,CAAC,KAAK,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,IAAwB;QAC9B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAAe;QACxB,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QAEzE,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YAC/C,IAAI,CAAC,UAAU,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,OAAe;QAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAAe;QAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,eAAe;QACb,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC;QACpC,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,WAAW;QACT,MAAM,KAAK,GAAa;YACtB,gCAAgC;YAChC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACd,EAAE;YACF,YAAY,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE;YAC/C,EAAE;YACF,WAAW;SACZ,CAAC;QAEF,MAAM,eAAe,GAAmC;YACtD,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,GAAG;YAC5B,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,GAAG;YACzB,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,IAAI;SAC7B,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC;QACpE,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YACxD,KAAK,CAAC,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;CACF;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E,IAAI,QAAQ,GAAiC,IAAI,CAAC;AAElD,MAAM,UAAU,wBAAwB;IACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,IAAI,qBAAqB,EAAE,CAAC;IACzC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,QAAQ,GAAG,IAAI,CAAC;AAClB,CAAC"}

package/dist/security/tool-policy/groups.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Tool Groups
+ *
+ * Inspired by OpenClaw's tool-policy.ts
+ * Defines logical groups of tools for policy management.
+ */
+/**
+ * Tool group identifiers
+ * Hierarchical structure: group:category:subcategory
+ */
+export type ToolGroup = 'group:all' | 'group:fs' | 'group:fs:read' | 'group:fs:write' | 'group:fs:delete' | 'group:runtime' | 'group:runtime:bash' | 'group:runtime:node' | 'group:web' | 'group:web:fetch' | 'group:web:browser' | 'group:git' | 'group:git:read' | 'group:git:write' | 'group:docker' | 'group:messaging' | 'group:memory' | 'group:agent' | 'group:system' | 'group:dangerous';
+/**
+ * Mapping of tool groups to individual tools
+ */
+export declare const TOOL_GROUPS: Record<ToolGroup, string[]>;
+/**
+ * Tool name aliases for normalization
+ */
+export declare const TOOL_ALIASES: Record<string, string>;
+/**
+ * Normalize a tool name to canonical form
+ */
+export declare function normalizeToolName(name: string): string;
+/**
+ * Normalize a list of tool names
+ */
+export declare function normalizeToolList(tools: string[]): string[];
+/**
+ * Check if a string is a tool group
+ */
+export declare function isToolGroup(value: string): value is ToolGroup;
+/**
+ * Expand tool groups into individual tools
+ */
+export declare function expandToolGroups(tools: string[], groups?: Record<string, string[]>): string[];
+/**
+ * Get all tools in a group (including subgroups)
+ */
+export declare function getToolsInGroup(group: ToolGroup): string[];
+/**
+ * Check if a tool belongs to a group
+ */
+export declare function isToolInGroup(tool: string, group: ToolGroup): boolean;
+/**
+ * Get all groups a tool belongs to
+ */
+export declare function getToolGroups(tool: string): ToolGroup[];

package/dist/security/tool-policy/groups.js

@@ -0,0 +1,235 @@
+/**
+ * Tool Groups
+ *
+ * Inspired by OpenClaw's tool-policy.ts
+ * Defines logical groups of tools for policy management.
+ */
+// ============================================================================
+// Tool Group Definitions
+// ============================================================================
+/**
+ * Mapping of tool groups to individual tools
+ */
+export const TOOL_GROUPS = {
+    'group:all': ['*'],
+    'group:fs': [
+        'read_file', 'read', 'Read',
+        'write_file', 'write', 'Write',
+        'edit_file', 'edit', 'Edit',
+        'list_directory', 'ls', 'Glob',
+        'search_files', 'grep', 'Grep',
+        'create_directory', 'mkdir',
+        'delete_file', 'rm', 'delete',
+        'move_file', 'mv', 'move',
+        'copy_file', 'cp', 'copy',
+    ],
+    'group:fs:read': [
+        'read_file', 'read', 'Read',
+        'list_directory', 'ls', 'Glob',
+        'search_files', 'grep', 'Grep',
+    ],
+    'group:fs:write': [
+        'write_file', 'write', 'Write',
+        'edit_file', 'edit', 'Edit',
+        'create_directory', 'mkdir',
+        'move_file', 'mv', 'move',
+        'copy_file', 'cp', 'copy',
+    ],
+    'group:fs:delete': [
+        'delete_file', 'rm', 'delete',
+    ],
+    'group:runtime': [
+        'bash', 'Bash', 'exec', 'execute',
+        'run_command', 'shell',
+        'node', 'python', 'run_script',
+    ],
+    'group:runtime:bash': [
+        'bash', 'Bash', 'exec', 'execute',
+        'run_command', 'shell',
+    ],
+    'group:runtime:node': [
+        'node', 'run_script',
+    ],
+    'group:web': [
+        'web_fetch', 'WebFetch', 'fetch', 'http',
+        'web_search', 'WebSearch', 'search',
+        'browser_navigate', 'browser_click', 'browser_type',
+        'browser_screenshot', 'browser_scroll',
+    ],
+    'group:web:fetch': [
+        'web_fetch', 'WebFetch', 'fetch', 'http',
+    ],
+    'group:web:browser': [
+        'browser_navigate', 'browser_click', 'browser_type',
+        'browser_screenshot', 'browser_scroll',
+        'browser_evaluate', 'browser_wait',
+    ],
+    'group:git': [
+        'git_status', 'git_log', 'git_diff',
+        'git_commit', 'git_push', 'git_pull',
+        'git_branch', 'git_checkout', 'git_merge',
+        'git_stash', 'git_reset',
+    ],
+    'group:git:read': [
+        'git_status', 'git_log', 'git_diff',
+        'git_branch',
+    ],
+    'group:git:write': [
+        'git_commit', 'git_push', 'git_pull',
+        'git_checkout', 'git_merge',
+        'git_stash', 'git_reset',
+    ],
+    'group:docker': [
+        'docker_build', 'docker_run', 'docker_stop',
+        'docker_ps', 'docker_logs', 'docker_exec',
+    ],
+    'group:messaging': [
+        'send_message', 'reply',
+        'slack_send', 'discord_send', 'telegram_send',
+        'email_send',
+    ],
+    'group:memory': [
+        'memory_store', 'memory_recall', 'memory_search',
+        'memory_delete', 'memory_clear',
+    ],
+    'group:agent': [
+        'spawn_agent', 'Task',
+        'agent_status', 'agent_stop',
+        'subagent_spawn', 'subagent_list',
+    ],
+    'group:system': [
+        'system_info', 'process_list',
+        'screenshot', 'clipboard',
+        'notification',
+    ],
+    'group:dangerous': [
+        'delete_file', 'rm', 'delete',
+        'git_reset', 'git_push',
+        'docker_stop', 'docker_rm',
+        'bash', 'Bash', 'exec',
+        'memory_clear', 'memory_delete',
+    ],
+};
+// ============================================================================
+// Tool Name Normalization
+// ============================================================================
+/**
+ * Tool name aliases for normalization
+ */
+export const TOOL_ALIASES = {
+    // Filesystem
+    'read': 'read_file',
+    'Read': 'read_file',
+    'write': 'write_file',
+    'Write': 'write_file',
+    'edit': 'edit_file',
+    'Edit': 'edit_file',
+    'ls': 'list_directory',
+    'Glob': 'list_directory',
+    'grep': 'search_files',
+    'Grep': 'search_files',
+    'rm': 'delete_file',
+    'mv': 'move_file',
+    'cp': 'copy_file',
+    // Runtime
+    'Bash': 'bash',
+    'exec': 'bash',
+    'execute': 'bash',
+    'shell': 'bash',
+    'run_command': 'bash',
+    // Web
+    'WebFetch': 'web_fetch',
+    'fetch': 'web_fetch',
+    'http': 'web_fetch',
+    'WebSearch': 'web_search',
+    'search': 'web_search',
+    // Agent
+    'Task': 'spawn_agent',
+};
+/**
+ * Normalize a tool name to canonical form
+ */
+export function normalizeToolName(name) {
+    return TOOL_ALIASES[name] || name.toLowerCase();
+}
+/**
+ * Normalize a list of tool names
+ */
+export function normalizeToolList(tools) {
+    return [...new Set(tools.map(normalizeToolName))];
+}
+// ============================================================================
+// Group Expansion
+// ============================================================================
+/**
+ * Check if a string is a tool group
+ */
+export function isToolGroup(value) {
+    return value.startsWith('group:') && value in TOOL_GROUPS;
+}
+/**
+ * Expand tool groups into individual tools
+ */
+export function expandToolGroups(tools, groups = TOOL_GROUPS) {
+    const expanded = new Set();
+    for (const tool of tools) {
+        if (isToolGroup(tool)) {
+            const groupTools = groups[tool] || [];
+            for (const t of groupTools) {
+                if (t === '*') {
+                    // Wildcard - add all non-group tools
+                    for (const [_, groupToolList] of Object.entries(groups)) {
+                        for (const gt of groupToolList) {
+                            if (gt !== '*') {
+                                expanded.add(normalizeToolName(gt));
+                            }
+                        }
+                    }
+                }
+                else if (!isToolGroup(t)) {
+                    expanded.add(normalizeToolName(t));
+                }
+                else {
+                    // Recursive group expansion
+                    const subExpanded = expandToolGroups([t], groups);
+                    for (const st of subExpanded) {
+                        expanded.add(st);
+                    }
+                }
+            }
+        }
+        else {
+            expanded.add(normalizeToolName(tool));
+        }
+    }
+    return Array.from(expanded);
+}
+/**
+ * Get all tools in a group (including subgroups)
+ */
+export function getToolsInGroup(group) {
+    return expandToolGroups([group]);
+}
+/**
+ * Check if a tool belongs to a group
+ */
+export function isToolInGroup(tool, group) {
+    const groupTools = getToolsInGroup(group);
+    const normalizedTool = normalizeToolName(tool);
+    return groupTools.includes(normalizedTool);
+}
+/**
+ * Get all groups a tool belongs to
+ */
+export function getToolGroups(tool) {
+    const normalizedTool = normalizeToolName(tool);
+    const groups = [];
+    for (const [group, tools] of Object.entries(TOOL_GROUPS)) {
+        const expanded = expandToolGroups(tools);
+        if (expanded.includes(normalizedTool)) {
+            groups.push(group);
+        }
+    }
+    return groups;
+}
+//# sourceMappingURL=groups.js.map

package/dist/security/tool-policy/groups.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groups.js","sourceRoot":"","sources":["../../../src/security/tool-policy/groups.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAgCH,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,WAAW,GAAgC;IACtD,WAAW,EAAE,CAAC,GAAG,CAAC;IAElB,UAAU,EAAE;QACV,WAAW,EAAE,MAAM,EAAE,MAAM;QAC3B,YAAY,EAAE,OAAO,EAAE,OAAO;QAC9B,WAAW,EAAE,MAAM,EAAE,MAAM;QAC3B,gBAAgB,EAAE,IAAI,EAAE,MAAM;QAC9B,cAAc,EAAE,MAAM,EAAE,MAAM;QAC9B,kBAAkB,EAAE,OAAO;QAC3B,aAAa,EAAE,IAAI,EAAE,QAAQ;QAC7B,WAAW,EAAE,IAAI,EAAE,MAAM;QACzB,WAAW,EAAE,IAAI,EAAE,MAAM;KAC1B;IAED,eAAe,EAAE;QACf,WAAW,EAAE,MAAM,EAAE,MAAM;QAC3B,gBAAgB,EAAE,IAAI,EAAE,MAAM;QAC9B,cAAc,EAAE,MAAM,EAAE,MAAM;KAC/B;IAED,gBAAgB,EAAE;QAChB,YAAY,EAAE,OAAO,EAAE,OAAO;QAC9B,WAAW,EAAE,MAAM,EAAE,MAAM;QAC3B,kBAAkB,EAAE,OAAO;QAC3B,WAAW,EAAE,IAAI,EAAE,MAAM;QACzB,WAAW,EAAE,IAAI,EAAE,MAAM;KAC1B;IAED,iBAAiB,EAAE;QACjB,aAAa,EAAE,IAAI,EAAE,QAAQ;KAC9B;IAED,eAAe,EAAE;QACf,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS;QACjC,aAAa,EAAE,OAAO;QACtB,MAAM,EAAE,QAAQ,EAAE,YAAY;KAC/B;IAED,oBAAoB,EAAE;QACpB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS;QACjC,aAAa,EAAE,OAAO;KACvB;IAED,oBAAoB,EAAE;QACpB,MAAM,EAAE,YAAY;KACrB;IAED,WAAW,EAAE;QACX,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM;QACxC,YAAY,EAAE,WAAW,EAAE,QAAQ;QACnC,kBAAkB,EAAE,eAAe,EAAE,cAAc;QACnD,oBAAoB,EAAE,gBAAgB;KACvC;IAED,iBAAiB,EAAE;QACjB,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM;KACzC;IAED,mBAAmB,EAAE;QACnB,kBAAkB,EAAE,eAAe,EAAE,cAAc;QACnD,oBAAoB,EAAE,gBAAgB;QACtC,kBAAkB,EAAE,cAAc;KACnC;IAED,WAAW,EAAE;QACX,YAAY,EAAE,SAAS,EAAE,UAAU;QACnC,YAAY,EAAE,UAAU,EAAE,UAAU;QACpC,YAAY,EAAE,cAAc,EAAE,WAAW;QACzC,WAAW,EAAE,WAAW;KACzB;IAED,gBAAgB,EAAE;QAChB,YAAY,EAAE,SAAS,EAAE,UAAU;QACnC,YAAY;KACb;IAED,iBAAiB,EAAE;QACjB,YAAY,EAAE,UAAU,EAAE,UAAU;QACpC,cAAc,EAAE,WAAW;QAC3B,WAAW,EAAE,WAAW;KACzB;IAED,cAAc,EAAE;QACd,cAAc,EAAE,YAAY,EAAE,aAAa;QAC3C,WAAW,EAAE,aAAa,EAAE,aAAa;KAC1C;IAED,iBAAiB,EAAE;QACjB,cAAc,EAAE,OAAO;QACvB,YAAY,EAAE,cAAc,EAAE,eAAe;QAC7C,YAAY;KACb;IAED,cAAc,EAAE;QACd,cAAc,EAAE,eAAe,EAAE,eAAe;QAChD,eAAe,EAAE,cAAc;KAChC;IAED,aAAa,EAAE;QACb,aAAa,EAAE,MAAM;QACrB,cAAc,EAAE,YAAY;QAC5B,gBAAgB,EAAE,eAAe;KAClC;IAED,cAAc,EAAE;QACd,aAAa,EAAE,cAAc;QAC7B,YAAY,EAAE,WAAW;QACzB,cAAc;KACf;IAED,iBAAiB,EAAE;QACjB,aAAa,EAAE,IAAI,EAAE,QAAQ;QAC7B,WAAW,EAAE,UAAU;QACvB,aAAa,EAAE,WAAW;QAC1B,MAAM,EAAE,MAAM,EAAE,MAAM;QACtB,cAAc,EAAE,eAAe;KAChC;CACF,CAAC;AAEF,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAA2B;IAClD,aAAa;IACb,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,WAAW;IACnB,IAAI,EAAE,gBAAgB;IACtB,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,cAAc;IACtB,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,WAAW;IAEjB,UAAU;IACV,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;IACd,SAAS,EAAE,MAAM;IACjB,OAAO,EAAE,MAAM;IACf,aAAa,EAAE,MAAM;IAErB,MAAM;IACN,UAAU,EAAE,WAAW;IACvB,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,WAAW;IACnB,WAAW,EAAE,YAAY;IACzB,QAAQ,EAAE,YAAY;IAEtB,QAAQ;IACR,MAAM,EAAE,aAAa;CACtB,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAe;IAC/C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,WAAW,CAAC;AAC5D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAe,EACf,SAAmC,WAAW;IAE9C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAEnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACtC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;gBAC3B,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;oBACd,qCAAqC;oBACrC,KAAK,MAAM,CAAC,CAAC,EAAE,aAAa,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;wBACxD,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;4BAC/B,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gCACf,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC;4BACtC,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3B,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrC,CAAC;qBAAM,CAAC;oBACN,4BAA4B;oBAC5B,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;oBAClD,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;wBAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACnB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,KAAgB;IAC9C,OAAO,gBAAgB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,KAAgB;IAC1D,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC/C,OAAO,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAgB,EAAE,CAAC;IAE/B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACzD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAiB,CAAC,CAAC;QACrD,IAAI,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,KAAkB,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/security/tool-policy/index.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Tool Policy System
+ *
+ * Hierarchical tool grouping and policy management for fine-grained
+ * access control in Code Buddy.
+ *
+ * @example
+ * ```typescript
+ * import { getPolicyManager, isToolAllowed } from './security/tool-policy';
+ *
+ * // Quick check
+ * if (isToolAllowed('bash', { command: 'npm install' })) {
+ *   // Execute
+ * }
+ *
+ * // Full API
+ * const manager = getPolicyManager();
+ * manager.setProfile('coding');
+ * const decision = manager.checkTool('bash', { command: 'rm -rf /' });
+ * if (decision.action === 'deny') {
+ *   console.log(decision.reason);
+ * }
+ * ```
+ */
+export type { ToolGroup, PolicyProfile, PolicyAction, PolicyRule, PolicyCondition, ProfileDefinition, PolicyDecision, PolicyContext, PolicySource, PolicyConfig, PolicyEvents, } from './types.js';
+export { ALL_TOOL_GROUPS, DEFAULT_POLICY_CONFIG, getParentGroup, isChildGroup, } from './types.js';
+export { TOOL_GROUPS, getToolGroups, getToolsInGroup, isToolInGroup, registerToolGroups, unregisterToolGroups, getAllRegisteredTools, getGroupStats, } from './tool-groups.js';
+export { PROFILES, getProfile, getProfileNames, getProfileRules, formatProfile, getProfileComparison, } from './profiles.js';
+export { PolicyResolver, resolveMultiple, filterByPolicy, getAllowedTools, } from './policy-resolver.js';
+export { PolicyManager, getPolicyManager, resetPolicyManager, isToolAllowed, toolRequiresConfirmation, isToolDenied, } from './policy-manager.js';