@poolzin/pool-bot 2026.2.24 → 2026.2.25

package/dist/cli/exec-approvals-cli.js

@@ -1,26 +1,14 @@
 import fs from "node:fs/promises";
 import JSON5 from "json5";
 import { readExecApprovalsSnapshot, saveExecApprovals, } from "../infra/exec-approvals.js";
+import { formatTimeAgo } from "../infra/format-time/format-relative.js";
 import { defaultRuntime } from "../runtime.js";
 import { formatDocsLink } from "../terminal/links.js";
-import { isRich, theme } from "../terminal/theme.js";
 import { renderTable } from "../terminal/table.js";
-import { callGatewayFromCli } from "./gateway-rpc.js";
+import { isRich, theme } from "../terminal/theme.js";
 import { describeUnknownError } from "./gateway-cli/shared.js";
+import { callGatewayFromCli } from "./gateway-rpc.js";
 import { nodesCallOpts, resolveNodeId } from "./nodes-cli/rpc.js";
-function formatAge(msAgo) {
-    const s = Math.max(0, Math.floor(msAgo / 1000));
-    if (s < 60)
-        return `${s}s`;
-    const m = Math.floor(s / 60);
-    if (m < 60)
-        return `${m}m`;
-    const h = Math.floor(m / 60);
-    if (h < 24)
-        return `${h}h`;
-    const d = Math.floor(h / 24);
-    return `${d}d`;
-}
 async function readStdin() {
     const chunks = [];
     for await (const chunk of process.stdin) {
@@ -29,11 +17,13 @@ async function readStdin() {
     return Buffer.concat(chunks).toString("utf8");
 }
 async function resolveTargetNodeId(opts) {
-    if (opts.gateway)
+    if (opts.gateway) {
         return null;
+    }
     const raw = opts.node?.trim() ?? "";
-    if (!raw)
+    if (!raw) {
         return null;
+    }
     return await resolveNodeId(opts, raw);
 }
 async function loadSnapshot(opts, nodeId) {
@@ -63,6 +53,41 @@ async function loadSnapshotTarget(opts) {
     const snapshot = await loadSnapshot(opts, nodeId);
     return { snapshot, nodeId, source: nodeId ? "node" : "gateway" };
 }
+function exitWithError(message) {
+    defaultRuntime.error(message);
+    defaultRuntime.exit(1);
+    throw new Error(message);
+}
+function requireTrimmedNonEmpty(value, message) {
+    const trimmed = value.trim();
+    if (!trimmed) {
+        exitWithError(message);
+    }
+    return trimmed;
+}
+async function loadWritableSnapshotTarget(opts) {
+    const { snapshot, nodeId, source } = await loadSnapshotTarget(opts);
+    if (source === "local") {
+        defaultRuntime.log(theme.muted("Writing local approvals."));
+    }
+    const targetLabel = source === "local" ? "local" : nodeId ? `node:${nodeId}` : "gateway";
+    const baseHash = snapshot.hash;
+    if (!baseHash) {
+        exitWithError("Exec approvals hash missing; reload and retry.");
+    }
+    return { snapshot, nodeId, source, targetLabel, baseHash };
+}
+async function saveSnapshotTargeted(params) {
+    const next = params.source === "local"
+        ? saveSnapshotLocal(params.file)
+        : await saveSnapshot(params.opts, params.nodeId, params.file, params.baseHash);
+    if (params.opts.json) {
+        defaultRuntime.log(JSON.stringify(next));
+        return;
+    }
+    defaultRuntime.log(theme.muted(`Target: ${params.targetLabel}`));
+    renderApprovalsSnapshot(next, params.targetLabel);
+}
 function formatCliError(err) {
     const msg = describeUnknownError(err);
     return msg.includes("\n") ? msg.split("\n")[0] : msg;
@@ -89,14 +114,15 @@ function renderApprovalsSnapshot(snapshot, targetLabel) {
         const allowlist = Array.isArray(agent.allowlist) ? agent.allowlist : [];
         for (const entry of allowlist) {
             const pattern = entry?.pattern?.trim() ?? "";
-            if (!pattern)
+            if (!pattern) {
                 continue;
+            }
             const lastUsedAt = typeof entry.lastUsedAt === "number" ? entry.lastUsedAt : null;
             allowlistRows.push({
                 Target: targetLabel,
                 Agent: agentId,
                 Pattern: pattern,
-                LastUsed: lastUsedAt ? `${formatAge(Math.max(0, now - lastUsedAt))} ago` : muted("unknown"),
+                LastUsed: lastUsedAt ? formatTimeAgo(Math.max(0, now - lastUsedAt)) : muted("unknown"),
             });
         }
     }
@@ -166,6 +192,37 @@ function isEmptyAgent(agent) {
         agent.autoAllowSkills === undefined &&
         allowlist.length === 0);
 }
+async function loadWritableAllowlistAgent(opts) {
+    const { snapshot, nodeId, source, targetLabel, baseHash } = await loadWritableSnapshotTarget(opts);
+    const file = snapshot.file ?? { version: 1 };
+    file.version = 1;
+    const agentKey = resolveAgentKey(opts.agent);
+    const agent = ensureAgent(file, agentKey);
+    const allowlistEntries = Array.isArray(agent.allowlist) ? agent.allowlist : [];
+    return { nodeId, source, targetLabel, baseHash, file, agentKey, agent, allowlistEntries };
+}
+async function runAllowlistMutation(pattern, opts, mutate) {
+    try {
+        const trimmedPattern = requireTrimmedNonEmpty(pattern, "Pattern required.");
+        const context = await loadWritableAllowlistAgent(opts);
+        const shouldSave = await mutate({ ...context, trimmedPattern });
+        if (!shouldSave) {
+            return;
+        }
+        await saveSnapshotTargeted({
+            opts,
+            source: context.source,
+            nodeId: context.nodeId,
+            file: context.file,
+            baseHash: context.baseHash,
+            targetLabel: context.targetLabel,
+        });
+    }
+    catch (err) {
+        defaultRuntime.error(formatCliError(err));
+        defaultRuntime.exit(1);
+    }
+}
 export function registerExecApprovalsCli(program) {
     const formatExample = (cmd, desc) => `  ${theme.command(cmd)}\n    ${theme.muted(desc)}`;
     const approvals = program
@@ -209,45 +266,22 @@ export function registerExecApprovalsCli(program) {
         .action(async (opts) => {
         try {
             if (!opts.file && !opts.stdin) {
-                defaultRuntime.error("Provide --file or --stdin.");
-                defaultRuntime.exit(1);
-                return;
+                exitWithError("Provide --file or --stdin.");
             }
             if (opts.file && opts.stdin) {
-                defaultRuntime.error("Use either --file or --stdin (not both).");
-                defaultRuntime.exit(1);
-                return;
-            }
-            const { snapshot, nodeId, source } = await loadSnapshotTarget(opts);
-            if (source === "local") {
-                defaultRuntime.log(theme.muted("Writing local approvals."));
-            }
-            const targetLabel = source === "local" ? "local" : nodeId ? `node:${nodeId}` : "gateway";
-            if (!snapshot.hash) {
-                defaultRuntime.error("Exec approvals hash missing; reload and retry.");
-                defaultRuntime.exit(1);
-                return;
+                exitWithError("Use either --file or --stdin (not both).");
             }
+            const { source, nodeId, targetLabel, baseHash } = await loadWritableSnapshotTarget(opts);
             const raw = opts.stdin ? await readStdin() : await fs.readFile(String(opts.file), "utf8");
             let file;
             try {
                 file = JSON5.parse(raw);
             }
             catch (err) {
-                defaultRuntime.error(`Failed to parse approvals JSON: ${String(err)}`);
-                defaultRuntime.exit(1);
-                return;
+                exitWithError(`Failed to parse approvals JSON: ${String(err)}`);
             }
             file.version = 1;
-            const next = source === "local"
-                ? saveSnapshotLocal(file)
-                : await saveSnapshot(opts, nodeId, file, snapshot.hash);
-            if (opts.json) {
-                defaultRuntime.log(JSON.stringify(next));
-                return;
-            }
-            defaultRuntime.log(theme.muted(`Target: ${targetLabel}`));
-            renderApprovalsSnapshot(next, targetLabel);
+            await saveSnapshotTargeted({ opts, source, nodeId, file, baseHash, targetLabel });
         }
         catch (err) {
             defaultRuntime.error(formatCliError(err));
@@ -266,49 +300,16 @@ export function registerExecApprovalsCli(program) {
         .option("--gateway", "Force gateway approvals", false)
         .option("--agent <id>", 'Agent id (defaults to "*")')
         .action(async (pattern, opts) => {
-        try {
-            const trimmed = pattern.trim();
-            if (!trimmed) {
-                defaultRuntime.error("Pattern required.");
-                defaultRuntime.exit(1);
-                return;
-            }
-            const { snapshot, nodeId, source } = await loadSnapshotTarget(opts);
-            if (source === "local") {
-                defaultRuntime.log(theme.muted("Writing local approvals."));
-            }
-            const targetLabel = source === "local" ? "local" : nodeId ? `node:${nodeId}` : "gateway";
-            if (!snapshot.hash) {
-                defaultRuntime.error("Exec approvals hash missing; reload and retry.");
-                defaultRuntime.exit(1);
-                return;
-            }
-            const file = snapshot.file ?? { version: 1 };
-            file.version = 1;
-            const agentKey = resolveAgentKey(opts.agent);
-            const agent = ensureAgent(file, agentKey);
-            const allowlistEntries = Array.isArray(agent.allowlist) ? agent.allowlist : [];
-            if (allowlistEntries.some((entry) => normalizeAllowlistEntry(entry) === trimmed)) {
+        await runAllowlistMutation(pattern, opts, ({ trimmedPattern, file, agent, agentKey, allowlistEntries }) => {
+            if (allowlistEntries.some((entry) => normalizeAllowlistEntry(entry) === trimmedPattern)) {
                 defaultRuntime.log("Already allowlisted.");
-                return;
+                return false;
             }
-            allowlistEntries.push({ pattern: trimmed, lastUsedAt: Date.now() });
+            allowlistEntries.push({ pattern: trimmedPattern, lastUsedAt: Date.now() });
             agent.allowlist = allowlistEntries;
             file.agents = { ...file.agents, [agentKey]: agent };
-            const next = source === "local"
-                ? saveSnapshotLocal(file)
-                : await saveSnapshot(opts, nodeId, file, snapshot.hash);
-            if (opts.json) {
-                defaultRuntime.log(JSON.stringify(next));
-                return;
-            }
-            defaultRuntime.log(theme.muted(`Target: ${targetLabel}`));
-            renderApprovalsSnapshot(next, targetLabel);
-        }
-        catch (err) {
-            defaultRuntime.error(formatCliError(err));
-            defaultRuntime.exit(1);
-        }
+            return true;
+        });
     });
     nodesCallOpts(allowlistAdd);
     const allowlistRemove = allowlist
@@ -318,32 +319,11 @@ export function registerExecApprovalsCli(program) {
         .option("--gateway", "Force gateway approvals", false)
         .option("--agent <id>", 'Agent id (defaults to "*")')
         .action(async (pattern, opts) => {
-        try {
-            const trimmed = pattern.trim();
-            if (!trimmed) {
-                defaultRuntime.error("Pattern required.");
-                defaultRuntime.exit(1);
-                return;
-            }
-            const { snapshot, nodeId, source } = await loadSnapshotTarget(opts);
-            if (source === "local") {
-                defaultRuntime.log(theme.muted("Writing local approvals."));
-            }
-            const targetLabel = source === "local" ? "local" : nodeId ? `node:${nodeId}` : "gateway";
-            if (!snapshot.hash) {
-                defaultRuntime.error("Exec approvals hash missing; reload and retry.");
-                defaultRuntime.exit(1);
-                return;
-            }
-            const file = snapshot.file ?? { version: 1 };
-            file.version = 1;
-            const agentKey = resolveAgentKey(opts.agent);
-            const agent = ensureAgent(file, agentKey);
-            const allowlistEntries = Array.isArray(agent.allowlist) ? agent.allowlist : [];
-            const nextEntries = allowlistEntries.filter((entry) => normalizeAllowlistEntry(entry) !== trimmed);
+        await runAllowlistMutation(pattern, opts, ({ trimmedPattern, file, agent, agentKey, allowlistEntries }) => {
+            const nextEntries = allowlistEntries.filter((entry) => normalizeAllowlistEntry(entry) !== trimmedPattern);
             if (nextEntries.length === allowlistEntries.length) {
                 defaultRuntime.log("Pattern not found.");
-                return;
+                return false;
             }
             if (nextEntries.length === 0) {
                 delete agent.allowlist;
@@ -359,20 +339,8 @@ export function registerExecApprovalsCli(program) {
             else {
                 file.agents = { ...file.agents, [agentKey]: agent };
             }
-            const next = source === "local"
-                ? saveSnapshotLocal(file)
-                : await saveSnapshot(opts, nodeId, file, snapshot.hash);
-            if (opts.json) {
-                defaultRuntime.log(JSON.stringify(next));
-                return;
-            }
-            defaultRuntime.log(theme.muted(`Target: ${targetLabel}`));
-            renderApprovalsSnapshot(next, targetLabel);
-        }
-        catch (err) {
-            defaultRuntime.error(formatCliError(err));
-            defaultRuntime.exit(1);
-        }
+            return true;
+        });
     });
     nodesCallOpts(allowlistRemove);
 }