@project-ava-supernova/core 0.2.71

package/dist/tools/desktop-plan-approve.js

@@ -0,0 +1,135 @@
+import { classifyPlanStep } from '../desktop/safety.js';
+const PLAN_TTL_MS = 5 * 60 * 1000; // 5 minutes
+/**
+ * Desktop trajectory approval tool.
+ *
+ * Ava calls this as her first tool for any task involving 2+ mutative
+ * actions. The user sees one approval card listing every step of the
+ * plan, clicks Allow once, and the subsequent reversible actions
+ * (launch_app, focus_window, type, normal click, navigate) all
+ * auto-approve — no repeated prompts for each step.
+ *
+ * Irreversible actions (Send, Pay, Delete, destructive combos) still
+ * prompt fresh every time even inside an approved plan, and any such
+ * hit invalidates the plan so subsequent reversible steps re-approve
+ * too. This matches the spec: the batched approval is a *ceiling* on
+ * what was consented to, never a blanket trust.
+ *
+ * Single-action tasks should skip the plan and go straight to the
+ * per-action approval — one prompt either way, no ceremony.
+ */
+export class DesktopPlanApproveTool {
+    name = 'desktop_plan_approve';
+    description = 'Present a desktop automation plan for one-shot approval. Call as the first action for any task with 2+ mutative steps. The user sees one card with the whole plan and approves once; reversible follow-up steps then auto-run.';
+    riskLevel = 'write';
+    requiresConfirmation = false;
+    usesDynamicConfirmation = true;
+    schema = {
+        name: 'desktop_plan_approve',
+        description: 'Present a trajectory plan to the user for one-shot approval. Call this FIRST for any multi-step task (open an app + type, navigate + click, etc.). ' +
+            'The user sees one card listing every step; clicking Allow approves the whole sequence at once. Reversible follow-up actions auto-run. ' +
+            'Irreversible actions (Send, Submit, Pay, Delete, destructive key combos) still prompt individually — the plan never blankets those. ' +
+            'For single-action tasks, skip this and go straight to the action.',
+        parameters: {
+            type: 'object',
+            properties: {
+                summary: {
+                    type: 'string',
+                    description: 'One-sentence description of what the whole plan accomplishes (e.g. "Open Notepad and type the sentence").',
+                },
+                steps: {
+                    type: 'array',
+                    description: 'Ordered list of the atomic actions you intend to take. Each step should map to one tool call.',
+                    items: {
+                        type: 'object',
+                        properties: {
+                            description: {
+                                type: 'string',
+                                description: 'What this step will do (plain English, user-facing — e.g. "Launch Notepad", "Type the sentence", "Focus the window").',
+                            },
+                        },
+                        required: ['description'],
+                    },
+                },
+            },
+            required: ['summary', 'steps'],
+        },
+    };
+    async execute(args, context) {
+        const summary = args.summary?.trim();
+        const rawSteps = args.steps;
+        if (!summary)
+            return { success: false, output: 'summary is required.' };
+        if (!rawSteps || rawSteps.length === 0)
+            return { success: false, output: 'steps is required and must be non-empty.' };
+        // Drop empty descriptions, then classify each surviving step. The
+        // classifier reads the description text the model just wrote, so a
+        // step the model labelled as harmless but described as "Send the email"
+        // is flagged as irreversible regardless — Ava can't lie her way past it.
+        const steps = rawSteps
+            .map(s => String(s?.description ?? '').trim())
+            .filter(description => description.length > 0)
+            .map(description => {
+            const classification = classifyPlanStep(description);
+            const step = { description, riskClass: classification.riskClass };
+            if (classification.reasons.length > 0)
+                step.reasons = classification.reasons;
+            return step;
+        });
+        if (steps.length === 0)
+            return { success: false, output: 'steps must contain at least one non-empty description.' };
+        // Single-step plans are fine. They cost the user the same one click,
+        // and the plan card is arguably more informative than a raw action
+        // confirmation anyway. Consistency beats cleverness here.
+        const state = (context.sharedState || {});
+        const handler = state.desktopApprovalHandler;
+        if (!handler) {
+            return {
+                success: false,
+                output: 'Plan approval requires the Ava IDE host. No desktopApprovalHandler on sharedState — cannot prompt the user.',
+            };
+        }
+        // Synthetic classification so the host renders this as a plan card.
+        // The classification payload carries the reasons list, which we use to
+        // hint that this is a plan-level approval rather than a per-action one.
+        const classification = {
+            riskClass: 'mutative-reversible',
+            reasons: [
+                'Plan covers multiple reversible actions',
+                ...steps.map((s, i) => `Step ${i + 1}: ${s.description}`),
+            ],
+            requiresSecretHandle: false,
+        };
+        let approved;
+        try {
+            approved = await handler(this.name, { summary, steps }, classification);
+        }
+        catch (err) {
+            return { success: false, output: `Plan approval handler failed: ${err instanceof Error ? err.message : String(err)}` };
+        }
+        if (!approved) {
+            return {
+                success: false,
+                output: `User declined the plan: "${summary}". Do not proceed with any of the steps.`,
+            };
+        }
+        const plan = {
+            id: typeof crypto !== 'undefined' && 'randomUUID' in crypto ? crypto.randomUUID() : `plan-${Date.now()}`,
+            summary,
+            steps,
+            approvedAt: Date.now(),
+            ttlMs: PLAN_TTL_MS,
+        };
+        // Write back onto sharedState so the gate can read it on subsequent actions.
+        state.desktopActivePlan = plan;
+        return {
+            success: true,
+            output: `Plan approved — reversible follow-up actions will run without extra prompts. ` +
+                `Steps:\n${steps.map((s, i) => `  ${i + 1}. ${s.description}`).join('\n')}\n\n` +
+                `Irreversible actions (Send / Pay / Delete / destructive combos) will still ask for fresh approval. ` +
+                `Plan expires in ${Math.round(PLAN_TTL_MS / 60000)} minutes.`,
+            metadata: { planId: plan.id, stepCount: steps.length },
+        };
+    }
+}
+//# sourceMappingURL=desktop-plan-approve.js.map

package/dist/tools/desktop-plan-approve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"desktop-plan-approve.js","sourceRoot":"","sources":["../../src/tools/desktop-plan-approve.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAE/C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,sBAAsB;IACxB,IAAI,GAAG,sBAAsB,CAAC;IAC9B,WAAW,GAAG,gOAAgO,CAAC;IAC/O,SAAS,GAAkB,OAAO,CAAC;IACnC,oBAAoB,GAAG,KAAK,CAAC;IAC7B,uBAAuB,GAAG,IAAI,CAAC;IAE/B,MAAM,GAAmB;QAChC,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EACT,qJAAqJ;YACrJ,wIAAwI;YACxI,sIAAsI;YACtI,mEAAmE;QACrE,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,2GAA2G;iBACzH;gBACD,KAAK,EAAE;oBACL,IAAI,EAAE,OAAO;oBACb,WAAW,EAAE,+FAA+F;oBAC5G,KAAK,EAAE;wBACL,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE;4BACV,WAAW,EAAE;gCACX,IAAI,EAAE,QAAQ;gCACd,WAAW,EAAE,uHAAuH;6BACrI;yBACF;wBACD,QAAQ,EAAE,CAAC,aAAa,CAAC;qBAC1B;iBACF;aACF;YACD,QAAQ,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;SAC/B;KACF,CAAC;IAEF,KAAK,CAAC,OAAO,CAAC,IAA6B,EAAE,OAA6B;QACxE,MAAM,OAAO,GAAI,IAAI,CAAC,OAAkB,EAAE,IAAI,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAoD,CAAC;QAC3E,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QACxE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;QAEtH,kEAAkE;QAClE,mEAAmE;QACnE,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,KAAK,GAAqB,QAAQ;aACrC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;aAC7C,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;aAC7C,GAAG,CAAC,WAAW,CAAC,EAAE;YACjB,MAAM,cAAc,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACrD,MAAM,IAAI,GAAmB,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,CAAC,SAAS,EAAE,CAAC;YAClF,IAAI,cAAc,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,IAAI,CAAC,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC;YAC7E,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACL,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;QACpH,qEAAqE;QACrE,mEAAmE;QACnE,0DAA0D;QAE1D,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAA4B,CAAC;QACrE,MAAM,OAAO,GAAG,KAAK,CAAC,sBAA4D,CAAC;QACnF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EACJ,6GAA6G;aAChH,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,cAAc,GAAyB;YAC3C,SAAS,EAAE,qBAAqB;YAChC,OAAO,EAAE;gBACP,yCAAyC;gBACzC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;aAC1D;YACD,oBAAoB,EAAE,KAAK;SAC5B,CAAC;QAEF,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,cAAc,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACzH,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,4BAA4B,OAAO,0CAA0C;aACtF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAe;YACvB,EAAE,EAAE,OAAO,MAAM,KAAK,WAAW,IAAI,YAAY,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,EAAE;YACxG,OAAO;YACP,KAAK;YACL,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;YACtB,KAAK,EAAE,WAAW;SACnB,CAAC;QACF,6EAA6E;QAC5E,KAAmD,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAE9E,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EACJ,+EAA+E;gBAC/E,WAAW,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;gBAC/E,qGAAqG;gBACrG,mBAAmB,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW;YAC/D,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE;SACvD,CAAC;IACJ,CAAC;CACF"}

package/dist/tools/desktop-providers.d.ts

@@ -0,0 +1,144 @@
+/**
+ * Host-side provider interfaces that back the desktop-automation tools.
+ *
+ * These are populated by the Tauri IDE (or any other host) via
+ * `ToolExecutionContext.sharedState` and consumed by the desktop_* and
+ * browser_* tools. Core does not depend on Tauri — hosts fulfil the
+ * contract and tools fail cleanly when a provider is absent.
+ *
+ * Keep this file interface-only. No runtime logic, no imports.
+ */
+export interface UIAElement {
+    name: string;
+    control_type: string;
+    cx: number;
+    cy: number;
+    x: number;
+    y: number;
+    width: number;
+    height: number;
+    /** UIA IsEnabled — false = greyed out (a disabled "Empty Recycle Bin" means
+     *  the bin is already empty). Absent on older hosts ⇒ treat as enabled. */
+    enabled?: boolean;
+    /** Another window physically covers this element's centre — a click would
+     *  hit THAT window instead (desktop icons behind an app window). Absent on
+     *  older hosts ⇒ treat as not occluded. */
+    occluded?: boolean;
+    /** Which surface the element came from: an open context menu/dropdown, the
+     *  shell's desktop icon list, or a normal app window. Lets the Planner and
+     *  Verifier reason about WHAT they're looking at (a menu is transient; the
+     *  icon list survives occlusion). Absent on older hosts ⇒ 'app'. */
+    surface?: 'menu' | 'desktop-icon' | 'app';
+}
+export interface UIAProvider {
+    listElements(): Promise<UIAElement[]>;
+    findElement(name: string): Promise<{
+        name: string;
+        control_type: string;
+        cx: number;
+        cy: number;
+    } | null>;
+    clickElement(name: string): Promise<{
+        name: string;
+        cx: number;
+        cy: number;
+    } | null>;
+    focusWindow(name: string): Promise<string | null>;
+}
+export interface InputProvider {
+    click(x: number, y: number): Promise<void>;
+    doubleClick(x: number, y: number): Promise<void>;
+    rightClick(x: number, y: number): Promise<void>;
+    typeText(text: string): Promise<void>;
+    keyPress(key: string): Promise<void>;
+    scroll(direction: 'up' | 'down' | 'left' | 'right', amount?: number): Promise<void>;
+    moveMouse(x: number, y: number): Promise<void>;
+    drag(x: number, y: number, endX: number, endY: number): Promise<void>;
+    /**
+     * Flash a click-through highlight box on (x, y, w, h) for ~ms — the visual
+     * "here's where I'm about to act" preview shown before Drive-mode actions.
+     * Optional: hosts without an overlay omit it and Drive still confirms
+     * irreversible actions, so the preview is UX, never a safety guard.
+     */
+    highlight?(x: number, y: number, w: number, h: number, ms?: number): Promise<void>;
+    /**
+     * Minimize every window to reveal the desktop — so desktop icons become
+     * visible in the accessibility tree and clickable. The fix for "the target
+     * icon is behind an open window". Optional; hosts without it simply can't
+     * clear occlusion.
+     */
+    minimizeAll?(): Promise<void>;
+}
+export interface BrowserSnapshotElement {
+    tag: 'link' | 'button' | 'input' | 'textarea' | 'select' | string;
+    selector: string;
+    text?: string;
+    placeholder?: string;
+    href?: string;
+    value?: string;
+}
+export interface BrowserSnapshot {
+    url: string;
+    title: string;
+    elements: BrowserSnapshotElement[];
+}
+export interface BrowserProvider {
+    navigate(url: string): Promise<{
+        url: string;
+        title: string;
+    }>;
+    snapshot(): Promise<BrowserSnapshot>;
+    click(selector: string): Promise<void>;
+    /** Type into the focused element, or into `selector` when given (page.fill). */
+    type(text: string, selector?: string): Promise<void>;
+    key(key: string): Promise<void>;
+    /** Wheel-scroll the page. Optional — native scroll is a Phase D primitive. */
+    scroll?(direction: 'up' | 'down' | 'left' | 'right', amount?: number): Promise<void>;
+    close(): Promise<void>;
+    /**
+     * Whether a browser is ALREADY running. Perception must only snapshot a
+     * live browser — snapshot()/navigate() may launch one as a side effect,
+     * which observation must never do. Hosts that can't tell should omit this;
+     * absent means "not live" for perception purposes.
+     */
+    isLive?(): boolean;
+}
+export interface VisionProvider {
+    /**
+     * Visually locate an element on the CURRENT screen from a plain-English
+     * description ("the blue Save button"). The host captures the screenshot,
+     * runs the grounding model (local or cloud per the user's perception
+     * setting), and returns SCREEN-PIXEL coordinates — or null if the element
+     * can't be found. Hosts must never capture or transmit a screenshot unless
+     * the user's vision setting allows it.
+     */
+    localize(targetDescription: string): Promise<{
+        x: number;
+        y: number;
+    } | null>;
+    /** Whether a vision lane is currently usable (setting + key/model present). */
+    isAvailable(): boolean;
+    /** Structured capability — lane + whether it's a verified path — so Scout
+     *  can advertise vision honestly (e.g. "local vision, unverified"). Optional
+     *  for back-compat; hosts should implement it. Shape mirrors
+     *  `VisionCapability` from `@ava/core/desktop`. */
+    capability?(): {
+        available: boolean;
+        lane: 'off' | 'local' | 'cloud-byok' | 'cloud-platform';
+        verified: boolean;
+        reason: string;
+    };
+}
+export interface AppLauncherProvider {
+    /**
+     * Launch a named executable or full path. The host MUST reject shell
+     * interpreters and admin / registry tools by basename — this is the
+     * trust boundary, not a convenience. No shell interpolation, no args
+     * string, no env injection.
+     */
+    launch(app: string): Promise<{
+        pid?: number;
+        launched: string;
+    }>;
+}
+//# sourceMappingURL=desktop-providers.d.ts.map

package/dist/tools/desktop-providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"desktop-providers.d.ts","sourceRoot":"","sources":["../../src/tools/desktop-providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf;+EAC2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;+CAE2C;IAC3C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;wEAGoE;IACpE,OAAO,CAAC,EAAE,MAAM,GAAG,cAAc,GAAG,KAAK,CAAC;CAC3C;AAED,MAAM,WAAW,WAAW;IAC1B,YAAY,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACtC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC1G,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACrF,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,UAAU,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,CAAC,SAAS,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE;;;;;OAKG;IACH,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnF;;;;;OAKG;IACH,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,GAAG,QAAQ,GAAG,MAAM,CAAC;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,sBAAsB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IACrC,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,gFAAgF;IAChF,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,8EAA8E;IAC9E,MAAM,CAAC,CAAC,SAAS,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB;;;;;OAKG;IACH,MAAM,CAAC,IAAI,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC9E,+EAA+E;IAC/E,WAAW,IAAI,OAAO,CAAC;IACvB;;;uDAGmD;IACnD,UAAU,CAAC,IAAI;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,KAAK,GAAG,OAAO,GAAG,YAAY,GAAG,gBAAgB,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACnI;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClE"}

package/dist/tools/desktop-providers.js

@@ -0,0 +1,12 @@
+/**
+ * Host-side provider interfaces that back the desktop-automation tools.
+ *
+ * These are populated by the Tauri IDE (or any other host) via
+ * `ToolExecutionContext.sharedState` and consumed by the desktop_* and
+ * browser_* tools. Core does not depend on Tauri — hosts fulfil the
+ * contract and tools fail cleanly when a provider is absent.
+ *
+ * Keep this file interface-only. No runtime logic, no imports.
+ */
+export {};
+//# sourceMappingURL=desktop-providers.js.map

package/dist/tools/desktop-providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"desktop-providers.js","sourceRoot":"","sources":["../../src/tools/desktop-providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/tools/desktop-safety-gate.d.ts

@@ -0,0 +1,84 @@
+import type { ToolExecutionContext, ToolResult } from './types.js';
+import { type ActionClassificationInput, type ClassificationResult, type PermissionLevel } from '../desktop/safety.js';
+import type { BudgetTracker } from '../desktop/budget.js';
+/**
+ * Host-side approval handler for desktop automation. Populated on
+ * sharedState.desktopApprovalHandler by the IDE. Receives the classification
+ * so the UI can show the risk class + reasons alongside the raw tool call.
+ *
+ * Must NEVER cache approvals for irreversible or privileged actions — the
+ * spec requires fresh confirmation every call for those classes.
+ */
+export type DesktopApprovalHandler = (toolName: string, args: Record<string, unknown>, classification: ClassificationResult) => Promise<boolean>;
+export interface ActivePlanStep {
+    description: string;
+    /**
+     * Per-step risk classification, computed by classifyPlanStep() at plan
+     * submission. Lets the IDE plan card render a per-step badge so the
+     * operator can spot a destructive verb buried in step 4 without having
+     * to read every line. Optional for back-compat with older sidecars
+     * that may have written plans before this field existed.
+     */
+    riskClass?: import('../desktop/safety.js').RiskClass;
+    /** Reasons the classifier produced this riskClass — same shape as ClassificationResult.reasons. */
+    reasons?: string[];
+}
+export interface ActivePlan {
+    id: string;
+    summary: string;
+    steps: ActivePlanStep[];
+    /** Epoch ms. Used by the gate to enforce a TTL so a forgotten plan can't
+     *  blanket-approve actions indefinitely. */
+    approvedAt: number;
+    /** ms — typically 5 minutes. Gate rejects a plan older than this. */
+    ttlMs: number;
+}
+export interface DesktopSafetyState {
+    /** 'watch' | 'drive'. Default 'watch' if absent. (A legacy persisted 'ask'
+     *  is coerced to 'watch' — the two were behaviourally identical.) */
+    desktopPermissionLevel?: PermissionLevel;
+    /** User has explicitly opted in to allowing privileged/elevated actions this session. */
+    desktopPrivilegedOptIn?: boolean;
+    /** Host-provided approval prompt. When absent, any action requiring approval is denied. */
+    desktopApprovalHandler?: DesktopApprovalHandler;
+    /** Budget tracker for the current desktop session. When absent, ticking is skipped. */
+    desktopBudget?: BudgetTracker;
+    /** Currently-approved trajectory plan. While set and un-expired, the gate
+     *  auto-approves mutative-reversible actions — the user already approved
+     *  the whole sequence up front. Irreversible actions still prompt fresh,
+     *  per spec. Set by desktop_plan_approve, cleared on new user turn,
+     *  irreversible hit, or TTL expiry. */
+    desktopActivePlan?: ActivePlan | null;
+    /** Number of mutative actions that have already been approved in the
+     *  current turn. The gate uses this to enforce the plan-first rule: if
+     *  Ava ignored the system prompt and is about to take action #2 with no
+     *  active plan, we return an educational error so she corrects on the
+     *  next loop. Reset to 0 on every new user message in the sidecar. */
+    desktopMutativeActionsThisTurn?: number;
+}
+export interface GateOutcome {
+    allowed: boolean;
+    classification: ClassificationResult;
+    /** Present when blocked — use as the tool's error output. */
+    blockedOutput?: string;
+}
+/**
+ * Gate a proposed desktop/browser action against the safety ontology and
+ * optional per-session budget. Call this as the first step of `execute()`
+ * in any mutative tool. Observational tools (list_elements, snapshot,
+ * focus_window, close) do not need to gate.
+ *
+ * Returns `{ allowed: false, blockedOutput }` when the action should
+ * short-circuit. The tool returns that verbatim as its ToolResult output.
+ */
+export declare function gateDesktopAction(input: ActionClassificationInput, toolName: string, args: Record<string, unknown>, context: ToolExecutionContext): Promise<GateOutcome>;
+/**
+ * Record a successful action step against the session budget.
+ * Rough token accounting — we don't have per-persona splits in the tool
+ * path, so we bucket everything under `actor`. Call this AFTER a
+ * successful execute(), not before.
+ */
+export declare function tickBudget(context: ToolExecutionContext, approxTokens?: number): void;
+/** Convenience: turn a blocked GateOutcome into a ToolResult. */
+export declare function blockedResult(outcome: GateOutcome): ToolResult;
+//# sourceMappingURL=desktop-safety-gate.d.ts.map

package/dist/tools/desktop-safety-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"desktop-safety-gate.d.ts","sourceRoot":"","sources":["../../src/tools/desktop-safety-gate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EAGL,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;;;;GAOG;AACH,MAAM,MAAM,sBAAsB,GAAG,CACnC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,cAAc,EAAE,oBAAoB,KACjC,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,OAAO,sBAAsB,EAAE,SAAS,CAAC;IACrD,mGAAmG;IACnG,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB;gDAC4C;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC;yEACqE;IACrE,sBAAsB,CAAC,EAAE,eAAe,CAAC;IACzC,yFAAyF;IACzF,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,2FAA2F;IAC3F,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IAChD,uFAAuF;IACvF,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B;;;;2CAIuC;IACvC,iBAAiB,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IACtC;;;;0EAIsE;IACtE,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACzC;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,oBAAoB,CAAC;IACrC,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,yBAAyB,EAChC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,WAAW,CAAC,CAmJtB;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,oBAAoB,EAAE,YAAY,GAAE,MAAa,GAAG,IAAI,CAW3F;AAED,iEAAiE;AACjE,wBAAgB,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CAM9D"}

package/dist/tools/desktop-safety-gate.js

@@ -0,0 +1,171 @@
+import { classifyAction, decideApproval, } from '../desktop/safety.js';
+/**
+ * Gate a proposed desktop/browser action against the safety ontology and
+ * optional per-session budget. Call this as the first step of `execute()`
+ * in any mutative tool. Observational tools (list_elements, snapshot,
+ * focus_window, close) do not need to gate.
+ *
+ * Returns `{ allowed: false, blockedOutput }` when the action should
+ * short-circuit. The tool returns that verbatim as its ToolResult output.
+ */
+export async function gateDesktopAction(input, toolName, args, context) {
+    const state = (context.sharedState || {});
+    const classification = classifyAction(input);
+    // Runtime coercion: configs written before the two-level collapse may still
+    // hold 'ask' — treat anything that isn't 'drive' as 'watch'.
+    const permissionLevel = state.desktopPermissionLevel === 'drive' ? 'drive' : 'watch';
+    const privilegedOptIn = state.desktopPrivilegedOptIn ?? false;
+    const decision = decideApproval(classification.riskClass, permissionLevel, privilegedOptIn);
+    // Budget check comes before approval — no point asking for confirmation
+    // if we're already over budget.
+    if (state.desktopBudget) {
+        const snap = state.desktopBudget.snapshot();
+        if (snap.breached) {
+            return {
+                allowed: false,
+                classification,
+                blockedOutput: `Session budget breached (${snap.breachReason}) — ` +
+                    `${snap.step} steps · ${Math.round(snap.tokensUsed / 1000)}K tokens · ` +
+                    `${Math.round(snap.elapsedMs / 1000)}s. Ask the user to extend the budget or start a fresh session.`,
+            };
+        }
+    }
+    if (decision.forbidden) {
+        return {
+            allowed: false,
+            classification,
+            blockedOutput: `Action forbidden (${classification.riskClass}): ${decision.reason}. ` +
+                (classification.reasons.length
+                    ? `Signals: ${classification.reasons.join('; ')}.`
+                    : '') +
+                ' Privileged actions require explicit opt-in — ask the user before retrying.',
+        };
+    }
+    // Secret-handle guard — runs BEFORE approval logic because no amount
+    // of user approval should let raw credentials flow through a text arg.
+    // When the classifier flags a sensitive field (password, secret, token,
+    // API key, 2FA code — either by `isMaskedField` or by field-name
+    // pattern match), the `text` value must be a `{{secret:<id>}}` handle
+    // returned by `secret_request`. The host substitutes the real value at
+    // execution time, so the actual credential never enters the model's
+    // tool args or reasoning history.
+    //
+    // If Ava tries to pass raw text into a sensitive field, block with an
+    // educational error. She'll see it in her next loop and call
+    // secret_request for a handle, then retry the tool.
+    if (classification.requiresSecretHandle) {
+        const text = typeof args.text === 'string' ? args.text : '';
+        const hasSecretHandle = /\{\{secret:[^}\s]+\}\}/.test(text);
+        if (!hasSecretHandle) {
+            return {
+                allowed: false,
+                classification,
+                blockedOutput: `This field is sensitive (${classification.reasons.join('; ') || 'password / secret / token'}). ` +
+                    `Do NOT type raw credentials into it. Choose ONE of:\n\n` +
+                    `(A) Vault flow — preferred when available:\n` +
+                    `  1. Call secret_request({ label: "<what this is>", reason: "<why you need it>" }).\n` +
+                    `  2. The user picks a vault entry; you receive an opaque handle like {{secret:abc123}}.\n` +
+                    `  3. Call this tool again with text: "{{secret:abc123}}" (just the handle — nothing else).\n` +
+                    `  4. The host substitutes the real value at execution time. The credential never appears in your tool args, thinking, or chat history.\n\n` +
+                    `(B) User-types-it themselves — use this if secret_request returns "vault not available":\n` +
+                    `  1. Stop trying to type into the field.\n` +
+                    `  2. Tell the user plainly: "I'll let you type that one — it's a sensitive field and I shouldn't handle raw credentials."\n` +
+                    `  3. Wait for them to continue the task or give you the next step.\n` +
+                    `  DO NOT ask the user to paste the credential into chat — that puts it in conversation history, same problem.`,
+            };
+        }
+    }
+    if (decision.requiresApproval) {
+        // Trajectory-plan short-circuit: if the user already approved a plan
+        // that covers reversible actions, auto-approve here. Irreversible
+        // actions NEVER short-circuit on a plan — spec rule, they always
+        // prompt fresh. An irreversible hit ALSO invalidates the plan so
+        // subsequent reversible steps have to re-approve too (prevents a
+        // dangerous action mid-plan from silently continuing).
+        if (classification.riskClass === 'mutative-reversible' &&
+            state.desktopActivePlan &&
+            Date.now() - state.desktopActivePlan.approvedAt < state.desktopActivePlan.ttlMs) {
+            return { allowed: true, classification };
+        }
+        if (classification.riskClass === 'mutative-irreversible' && state.desktopActivePlan) {
+            // Invalidate the plan — an irreversible action ends the batch
+            state.desktopActivePlan = null;
+        }
+        // Plan-first enforcement: EVERY mutative-reversible action requires
+        // an active plan. No exceptions for the first action, no "ceremony"
+        // exemption for single-step plans. This gives the user exactly one
+        // approval per task (the plan card) and all the reversible follow-ups
+        // run silently under it. Irreversible actions are exempt from the
+        // plan requirement — they always prompt individually per spec, and
+        // forcing a plan for an irreversible-only task would just add an
+        // extra prompt without helping.
+        if (classification.riskClass === 'mutative-reversible' && !state.desktopActivePlan) {
+            return {
+                allowed: false,
+                classification,
+                blockedOutput: `This is a mutative action and there's no approved plan yet. ` +
+                    `Call desktop_plan_approve({ summary, steps }) FIRST with every action you intend to take (including this one). ` +
+                    `The user will see one approval card for the whole task; after they approve, reversible actions run silently. ` +
+                    `Irreversible actions still prompt individually.`,
+            };
+        }
+        const handler = state.desktopApprovalHandler;
+        if (!handler) {
+            // Fail closed — if the host can't prompt, we don't assume consent.
+            return {
+                allowed: false,
+                classification,
+                blockedOutput: `Approval required (${classification.riskClass}) but no desktop approval handler is available in this host. ` +
+                    'Desktop mode requires the Ava IDE for irreversible / sensitive actions.',
+            };
+        }
+        let approved;
+        try {
+            approved = await handler(toolName, args, classification);
+        }
+        catch (err) {
+            return {
+                allowed: false,
+                classification,
+                blockedOutput: `Approval handler failed: ${err instanceof Error ? err.message : String(err)}`,
+            };
+        }
+        if (!approved) {
+            return {
+                allowed: false,
+                classification,
+                blockedOutput: `User declined (${classification.riskClass}): ${decision.reason}. ` +
+                    (classification.reasons.length ? `Signals: ${classification.reasons.join('; ')}.` : ''),
+            };
+        }
+    }
+    return { allowed: true, classification };
+}
+/**
+ * Record a successful action step against the session budget.
+ * Rough token accounting — we don't have per-persona splits in the tool
+ * path, so we bucket everything under `actor`. Call this AFTER a
+ * successful execute(), not before.
+ */
+export function tickBudget(context, approxTokens = 1000) {
+    const state = (context.sharedState || {});
+    if (!state.desktopBudget)
+        return;
+    state.desktopBudget.recordStep({
+        scout: 0,
+        planner: 0,
+        actor: approxTokens,
+        verifier: 0,
+        narrator: 0,
+        omniParser: 0,
+    });
+}
+/** Convenience: turn a blocked GateOutcome into a ToolResult. */
+export function blockedResult(outcome) {
+    return {
+        success: false,
+        output: outcome.blockedOutput || 'Action blocked by safety gate.',
+        metadata: { blocked: true, classification: outcome.classification },
+    };
+}
+//# sourceMappingURL=desktop-safety-gate.js.map

package/dist/tools/desktop-safety-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"desktop-safety-gate.js","sourceRoot":"","sources":["../../src/tools/desktop-safety-gate.ts"],"names":[],"mappings":"AACA,OAAO,EACL,cAAc,EACd,cAAc,GAIf,MAAM,sBAAsB,CAAC;AAyE9B;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAgC,EAChC,QAAgB,EAChB,IAA6B,EAC7B,OAA6B;IAE7B,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAiD,CAAC;IAC1F,MAAM,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAC7C,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM,eAAe,GAClB,KAAK,CAAC,sBAAiC,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAC3E,MAAM,eAAe,GAAG,KAAK,CAAC,sBAAsB,IAAI,KAAK,CAAC;IAC9D,MAAM,QAAQ,GAAG,cAAc,CAAC,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;IAE5F,wEAAwE;IACxE,gCAAgC;IAChC,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,cAAc;gBACd,aAAa,EACX,4BAA4B,IAAI,CAAC,YAAY,MAAM;oBACnD,GAAG,IAAI,CAAC,IAAI,YAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,aAAa;oBACvE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,gEAAgE;aACvG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,cAAc;YACd,aAAa,EACX,qBAAqB,cAAc,CAAC,SAAS,MAAM,QAAQ,CAAC,MAAM,IAAI;gBACtE,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM;oBAC5B,CAAC,CAAC,YAAY,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBAClD,CAAC,CAAC,EAAE,CAAC;gBACP,6EAA6E;SAChF,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,uEAAuE;IACvE,wEAAwE;IACxE,iEAAiE;IACjE,sEAAsE;IACtE,uEAAuE;IACvE,oEAAoE;IACpE,kCAAkC;IAClC,EAAE;IACF,sEAAsE;IACtE,6DAA6D;IAC7D,oDAAoD;IACpD,IAAI,cAAc,CAAC,oBAAoB,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,eAAe,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,cAAc;gBACd,aAAa,EACX,4BAA4B,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,2BAA2B,KAAK;oBACjG,yDAAyD;oBACzD,8CAA8C;oBAC9C,uFAAuF;oBACvF,2FAA2F;oBAC3F,8FAA8F;oBAC9F,4IAA4I;oBAC5I,4FAA4F;oBAC5F,4CAA4C;oBAC5C,6HAA6H;oBAC7H,sEAAsE;oBACtE,+GAA+G;aAClH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAC9B,qEAAqE;QACrE,kEAAkE;QAClE,iEAAiE;QACjE,iEAAiE;QACjE,iEAAiE;QACjE,uDAAuD;QACvD,IACE,cAAc,CAAC,SAAS,KAAK,qBAAqB;YAClD,KAAK,CAAC,iBAAiB;YACvB,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,iBAAiB,CAAC,UAAU,GAAG,KAAK,CAAC,iBAAiB,CAAC,KAAK,EAC/E,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAC3C,CAAC;QACD,IAAI,cAAc,CAAC,SAAS,KAAK,uBAAuB,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACpF,8DAA8D;YAC9D,KAAK,CAAC,iBAAiB,GAAG,IAAI,CAAC;QACjC,CAAC;QAED,oEAAoE;QACpE,oEAAoE;QACpE,mEAAmE;QACnE,sEAAsE;QACtE,kEAAkE;QAClE,mEAAmE;QACnE,iEAAiE;QACjE,gCAAgC;QAChC,IAAI,cAAc,CAAC,SAAS,KAAK,qBAAqB,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;YACnF,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,cAAc;gBACd,aAAa,EACX,8DAA8D;oBAC9D,iHAAiH;oBACjH,+GAA+G;oBAC/G,iDAAiD;aACpD,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,sBAAsB,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,mEAAmE;YACnE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,cAAc;gBACd,aAAa,EACX,sBAAsB,cAAc,CAAC,SAAS,+DAA+D;oBAC7G,yEAAyE;aAC5E,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,cAAc;gBACd,aAAa,EAAE,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aAC9F,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,cAAc;gBACd,aAAa,EACX,kBAAkB,cAAc,CAAC,SAAS,MAAM,QAAQ,CAAC,MAAM,IAAI;oBACnE,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,OAA6B,EAAE,eAAuB,IAAI;IACnF,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAiD,CAAC;IAC1F,IAAI,CAAC,KAAK,CAAC,aAAa;QAAE,OAAO;IACjC,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC;QAC7B,KAAK,EAAE,CAAC;QACR,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,YAAY;QACnB,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,CAAC;QACX,UAAU,EAAE,CAAC;KACd,CAAC,CAAC;AACL,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,aAAa,CAAC,OAAoB;IAChD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,OAAO,CAAC,aAAa,IAAI,gCAAgC;QACjE,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE;KACpE,CAAC;AACJ,CAAC"}

package/dist/tools/desktop-tools.d.ts

@@ -0,0 +1,22 @@
+import type { Tool } from './types.js';
+import type { ToolRegistry } from './tool-registry.js';
+/**
+ * Build the desktop-automation + browser-control tools.
+ *
+ * Names must stay in sync with DESKTOP_TOOL_NAMES in agent/agent.ts, which is
+ * what the mode gate and the extension's exclude list both key off. The
+ * desktop-tools.test.ts contract test asserts the two agree, so a tool added
+ * here without a name there fails CI rather than shipping to the marketplace.
+ */
+export declare function createDesktopTools(): Tool[];
+/**
+ * Register the desktop-automation + browser-control tools onto a registry.
+ *
+ * Call this ONLY from a host that is allowed to ship desktop automation: the
+ * Tauri IDE and the CLI, both distributed outside the VS Code Marketplace.
+ * The VS Code extension must never call it, and must never import this module.
+ *
+ * Call it AFTER registerBuiltins() — these are additions to the base set.
+ */
+export declare function registerDesktopTools(registry: ToolRegistry): void;
+//# sourceMappingURL=desktop-tools.d.ts.map

package/dist/tools/desktop-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"desktop-tools.d.ts","sourceRoot":"","sources":["../../src/tools/desktop-tools.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAcvD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,EAAE,CAe3C;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,CAEjE"}