@pugi/cli 0.1.0-beta.99 → 1.0.0-alpha.1

package/dist/core/permissions/state.js

@@ -1,241 +0,0 @@
-/**
- * Per-workspace permission-mode session state — .
- *
- * State lives in `.pugi/session.json` under the workspace root. The
- * file is read on first `getCurrentMode()` call (cached for the
- * process lifetime) and written atomically via tmp+rename on
- * `setCurrentMode()` so a kill mid-write does not corrupt the JSON.
- *
- * Resolution order for the effective mode on a fresh process:
- *  1. CLI flag (`pugi --mode plan`) — passed via `resolveMode` arg;
- *     not read from disk here.
- *  2. Workspace session state — `<root>/.pugi/session.json` field
- *     `permissionMode`.
- *  3. Global config — `~/.pugi/config.json` field
- *     `defaultPermissionMode`.
- *  4. Hard default `ask`.
- *
- * This module owns layers 2 + 3. The CLI arg parser owns layer 1; both
- * funnel into `resolveMode()` which performs the merge.
- */
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
-import { dirname, resolve } from 'node:path';
-import { homedir } from 'node:os';
-import { z } from 'zod';
-import { DEFAULT_PERMISSION_MODE, parsePermissionMode, } from './mode.js';
-/**
- * : zod enum for the canonical 6-mode taxonomy. Includes
- * aliases (`ask`, `allow`, `bypass`) as accepted input — Zod parses
- * them, the helpers below remap к canonical names before returning к
- * the caller. Persistence always writes the canonical name so the file
- * migrates forward on next save.
- */
-const permissionModeEnum = z.enum([
-    // Canonical names.
-    'default',
-    'acceptEdits',
-    'plan',
-    'auto',
-    'dontAsk',
-    'bypassPermissions',
-    // backwards-compat aliases — resolved via parsePermissionMode.
-    'ask',
-    'allow',
-    'bypass',
-]);
-const sessionStateSchema = z
-    .object({
-    permissionMode: permissionModeEnum.optional(),
-    /**
-     * snapshot of the mode that was active immediately BEFORE
-     * the operator typed `/plan` (or `/plan <prompt>`). `/plan --back`
-     * pops this snapshot and restores it. Cleared after a successful
-     * pop so a second `/plan --back` does not double-revert.
-     */
-    previousPermissionMode: permissionModeEnum.optional(),
-})
-    .partial()
-    .passthrough();
-const globalConfigSchema = z
-    .object({
-    defaultPermissionMode: permissionModeEnum.optional(),
-})
-    .partial()
-    .passthrough();
-const SESSION_FILE = '.pugi/session.json';
-/**
- * Return the path to the workspace session-state file.
- */
-export function sessionStatePath(workspaceRoot) {
-    return resolve(workspaceRoot, SESSION_FILE);
-}
-/**
- * Return the path to the user-global config file. Uses HOME env when
- * present (test fixtures, CI) so we never accidentally hit the real
- * user-global file in spec runs.
- */
-export function globalConfigPath(homeDir = homedir()) {
-    return resolve(homeDir, '.pugi/config.json');
-}
-/**
- * Read the workspace's saved permission mode. Returns null when the
- * file is absent OR the field is unset; the caller layers in CLI + env
- * + global config defaults to produce the effective mode.
- *
- * Never throws on JSON parse / schema errors — a malformed session
- * file should not break the gate. The defensive `try/catch` returns
- * null and lets the caller fall through to the next layer.
- */
-export function getCurrentMode(workspaceRoot) {
-    const path = sessionStatePath(workspaceRoot);
-    if (!existsSync(path))
-        return null;
-    try {
-        const raw = readFileSync(path, 'utf8');
-        const parsed = sessionStateSchema.parse(JSON.parse(raw));
-        if (typeof parsed.permissionMode !== 'string')
-            return null;
-        // : parsePermissionMode resolves aliases (`ask`, `allow`,
-        // `bypass`) to their canonical names. A session file written
-        // by .x is silently upgraded on read.
-        return parsePermissionMode(parsed.permissionMode);
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Persist the workspace's permission mode. Creates the `.pugi/` dir
- * when missing; preserves any unrelated keys in the file (passthrough
- * schema). Atomic tmp+rename so a kill mid-write does not corrupt the
- * JSON.
- */
-export function setCurrentMode(workspaceRoot, mode) {
-    const path = sessionStatePath(workspaceRoot);
-    mkdirSync(dirname(path), { recursive: true });
-    const existing = existsSync(path)
-        ? safeParseObject(readFileSync(path, 'utf8'))
-        : {};
-    const next = { ...existing, permissionMode: mode };
-    const tmpPath = `${path}.tmp`;
-    writeFileSync(tmpPath, `${JSON.stringify(next, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
-    renameSync(tmpPath, path);
-}
-/**
- * — read the snapshot of the mode that was active before the
- * most-recent `/plan` (or `pugi plan`) entry. Returns null when the
- * file is absent OR the field is unset. Same defensive behaviour as
- * `getCurrentMode`: a malformed session file never breaks the slash
- * command — the worst case is `/plan --back` reports "no previous
- * mode to restore" and the operator picks the target mode explicitly.
- */
-export function getPreviousMode(workspaceRoot) {
-    const path = sessionStatePath(workspaceRoot);
-    if (!existsSync(path))
-        return null;
-    try {
-        const raw = readFileSync(path, 'utf8');
-        const parsed = sessionStateSchema.parse(JSON.parse(raw));
-        if (typeof parsed.previousPermissionMode !== 'string')
-            return null;
-        return parsePermissionMode(parsed.previousPermissionMode);
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * — record the mode that was active immediately before the
- * operator switched to plan. The runtime calls this AT `/plan` entry
- * with the current mode (whatever `resolveMode` returned). Atomic
- * tmp+rename keeps the snapshot consistent if the process is killed
- * mid-write. Pass `null` to clear the snapshot (used after a
- * successful `/plan --back` so a second `--back` does not loop).
- */
-export function setPreviousMode(workspaceRoot, mode) {
-    const path = sessionStatePath(workspaceRoot);
-    mkdirSync(dirname(path), { recursive: true });
-    const existing = existsSync(path)
-        ? safeParseObject(readFileSync(path, 'utf8'))
-        : {};
-    const next = { ...existing };
-    if (mode === null) {
-        delete next.previousPermissionMode;
-    }
-    else {
-        next.previousPermissionMode = mode;
-    }
-    const tmpPath = `${path}.tmp`;
-    writeFileSync(tmpPath, `${JSON.stringify(next, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
-    renameSync(tmpPath, path);
-}
-/**
- * Read `~/.pugi/config.json::defaultPermissionMode`. Returns null when
- * the file is absent / the field is unset; same defensive behaviour
- * as `getCurrentMode` — a malformed global config never breaks the gate.
- */
-export function getGlobalDefaultMode(homeDir = homedir()) {
-    const path = globalConfigPath(homeDir);
-    if (!existsSync(path))
-        return null;
-    try {
-        const raw = readFileSync(path, 'utf8');
-        const parsed = globalConfigSchema.parse(JSON.parse(raw));
-        if (typeof parsed.defaultPermissionMode !== 'string')
-            return null;
-        return parsePermissionMode(parsed.defaultPermissionMode);
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Persist `~/.pugi/config.json::defaultPermissionMode`. Used by the
- * `/permissions <mode> --persist` flow so a future fresh session
- * defaults to the same mode without an explicit `--mode` flag.
- */
-export function setGlobalDefaultMode(mode, homeDir = homedir()) {
-    const path = globalConfigPath(homeDir);
-    mkdirSync(dirname(path), { recursive: true });
-    const existing = existsSync(path)
-        ? safeParseObject(readFileSync(path, 'utf8'))
-        : {};
-    const next = { ...existing, defaultPermissionMode: mode };
-    const tmpPath = `${path}.tmp`;
-    writeFileSync(tmpPath, `${JSON.stringify(next, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
-    renameSync(tmpPath, path);
-}
-export function resolveMode(options) {
-    if (options.cliFlag) {
-        const flag = parsePermissionMode(options.cliFlag);
-        if (flag)
-            return flag;
-    }
-    const workspace = getCurrentMode(options.workspaceRoot);
-    if (workspace)
-        return workspace;
-    const global = getGlobalDefaultMode(options.homeDir);
-    if (global)
-        return global;
-    return DEFAULT_PERMISSION_MODE;
-}
-/**
- * Defensive helper — parse JSON to an object; non-object payload (top-
- * level array, primitive) collapses to an empty object so the merge
- * doesn't surface a TypeError. The `setCurrentMode` / `setGlobalDefaultMode`
- * helpers only write objects, so a non-object existing file is corrupted
- * and we explicitly reset it rather than appending into a non-object.
- */
-function safeParseObject(raw) {
-    try {
-        const parsed = JSON.parse(raw);
-        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
-            return parsed;
-        }
-        return {};
-    }
-    catch {
-        return {};
-    }
-}
-//# sourceMappingURL=state.js.map

package/dist/core/permissions/tool-class.js

@@ -1,107 +0,0 @@
-/**
- * Tool side-effect classification — .
- *
- * Three classes drive the canonical 4-mode permission gate:
- *
- *  - `read`    — observe-only. Plan mode allows; ask still prompts;
- *                 allow + bypass execute silently. Examples: read,
- *                 grep, glob, web_fetch, web_search, skills_list.
- *  - `write`   — mutates workspace, journal, or operator screen with
- *                 visible side effects. Plan mode refuses; ask prompts;
- *                 allow + bypass execute. Examples: write, edit, bash,
- *                 multi_edit, task_*. `ask_user_question` is also
- *                 classed as `write` because it interrupts the
- *                 dispatcher's flow control and demands operator
- *                 attention — plan mode should not prompt operators.
- *  - `dispatch` — spawns a child subagent or off-tree task. Plan mode
- *                 refuses (a write-capable child violates plan-mode's
- *                 read-only contract); ask prompts; allow + bypass
- *                 execute. Example: `agent`.
- *
- * Unknown tool names default to `write` — deny-first safety. A stale
- * schema entry that the gate has not been told about should not silently
- * pass in plan mode just because the gate doesn't recognise it.
- */
-/**
- * Closed map of every built-in tool name -> side-effect class. The
- * source of truth for the four standard modes; mirrored against the
- * `WIRED_TOOLS` set in `core/engine/tool-bridge.ts` so an unrecognised
- * tool surfaces as the safe deny-first `write` default.
- *
- * MCP tools follow the `mcp__<server>__<tool>` namespace and are
- * uniformly classed via `getToolClass` because per-tool annotations are
- * not yet a part of the MCP spec — treating them as `write` is the
- * conservative default until server-side metadata is trustworthy.
- */
-const BUILT_IN_TOOL_CLASSES = Object.freeze({
-    // Read-only observations.
-    read: 'read',
-    grep: 'read',
-    glob: 'read',
-    ls: 'read',
-    search: 'read',
-    web_fetch: 'read',
-    web_search: 'read',
-    file_cache_check: 'read',
-    skills_list: 'read',
-    skill: 'read',
-    task_get: 'read',
-    task_list: 'read',
-    // Phase 1 runtime evidence pack (PUGI-291..295): server_health and
-    // server_logs are read-only probes (HTTP GET + tail of a log file
-    // already on disk). Classifying them as `read` keeps the ask-mode
-    // prompts honest; the dispatcher still applies the network-perm gate
-    // for server_health and the workspace-read gate for server_logs.
-    server_health: 'read',
-    server_logs: 'read',
-    // Mutating actions.
-    write: 'write',
-    edit: 'write',
-    multi_edit: 'write',
-    bash: 'write',
-    // Phase 1 runtime evidence pack: server_start spawns a process,
-    // server_stop terminates one, http_request can POST/PUT/DELETE
-    // arbitrary data against a localhost service. All three are write
-    // class so plan mode refuses and ask mode prompts.
-    server_start: 'write',
-    server_stop: 'write',
-    http_request: 'write',
-    task_create: 'write',
-    task_update: 'write',
-    todo_write: 'write',
-    // `ask_user_question` halts the loop and demands operator attention.
-    // Plan mode should not interrupt — class as write so the gate refuses
-    // it in plan mode but ask + allow + bypass execute normally.
-    ask_user_question: 'write',
-    // Dispatch — spawn a child agent. Refused in plan mode regardless of
-    // the child's role tier (the engine adapter applies role-based
-    // capability filtering, but the gate refuses dispatch up front so a
-    // plan-mode session cannot leak a writeable child).
-    agent: 'dispatch',
-    pugi_delegate: 'dispatch',
-    sub_agent_spawn: 'dispatch',
-});
-const MCP_TOOL_PREFIX = 'mcp__';
-/**
- * Resolve the class for a tool name. Unknown names default to `write`
- * (deny-first). MCP tools (any name prefixed with `mcp__`) default to
- * `write` for the same conservative reason — the MCP spec lacks
- * per-tool annotations today.
- */
-export function getToolClass(toolName) {
-    const builtIn = BUILT_IN_TOOL_CLASSES[toolName];
-    if (builtIn)
-        return builtIn;
-    if (toolName.startsWith(MCP_TOOL_PREFIX))
-        return 'write';
-    return 'write';
-}
-/**
- * Expose the built-in class map for diagnostic surfaces (`pugi doctor`,
- * test fixtures). Caller MUST NOT mutate — the object is already frozen
- * so any attempt throws in strict mode.
- */
-export function listBuiltInToolClasses() {
-    return BUILT_IN_TOOL_CLASSES;
-}
-//# sourceMappingURL=tool-class.js.map

package/dist/core/plan-mode/ui-state.js

@@ -1,51 +0,0 @@
-const REDUCER_TIMESTAMP = 0;
-export function reducePlanModeState(state, event) {
-    if (event.kind === 'reset') {
-        return { kind: 'inactive' };
-    }
-    switch (state.kind) {
-        case 'inactive':
-            if (event.kind === 'start') {
-                return { kind: 'building', planText: '', startedAt: REDUCER_TIMESTAMP };
-            }
-            return state;
-        case 'building':
-            if (event.kind === 'append') {
-                return { ...state, planText: state.planText + event.text };
-            }
-            if (event.kind === 'finalize') {
-                return {
-                    kind: 'awaiting-approval',
-                    planText: state.planText,
-                    planId: event.planId,
-                };
-            }
-            return state;
-        case 'awaiting-approval':
-            if (event.kind === 'approve' && event.planId === state.planId) {
-                return {
-                    kind: 'approved',
-                    planId: event.planId,
-                    approvedAt: REDUCER_TIMESTAMP,
-                };
-            }
-            if (event.kind === 'reject' && event.planId === state.planId) {
-                return event.reason === undefined
-                    ? { kind: 'rejected', planId: event.planId }
-                    : { kind: 'rejected', planId: event.planId, reason: event.reason };
-            }
-            if (event.kind === 'amend' && event.previousPlanId === state.planId) {
-                return {
-                    kind: 'amended',
-                    planId: event.planId,
-                    previousPlanId: event.previousPlanId,
-                };
-            }
-            return state;
-        case 'approved':
-        case 'rejected':
-        case 'amended':
-            return state;
-    }
-}
-//# sourceMappingURL=ui-state.js.map