@rse/ase 0.9.42 → 0.9.44

package/dst/ase-artifact.js

@@ -28,8 +28,9 @@ export class Artifact {
     }
     /*  translate a single ".gitignore" line into a picomatch-backed rule,
         honoring the anchored-vs-floating, directory-only, and negation
-        semantics of ".gitignore" patterns  */
-    static compileIgnoreRule(line) {
+        semantics of ".gitignore" patterns; anchored patterns resolve
+        relative to the "base" directory holding the ".gitignore"  */
+    static compileIgnoreRule(line, base) {
         let pattern = line.trim();
         if (pattern === "" || pattern.startsWith("#"))
             return null;
@@ -46,18 +47,19 @@ export class Artifact {
         const anchored = pattern.includes("/");
         if (pattern.startsWith("/"))
             pattern = pattern.slice(1);
-        const glob = anchored ? pattern : `**/${pattern}`;
+        const glob = anchored ? (base === "" ? pattern : `${base}/${pattern}`) : `**/${pattern}`;
         const isMatch = picomatch(glob, { dot: true });
         return { matcher: (p) => isMatch(p), negated, dirOnly };
     }
-    /*  load the ".gitignore" rules located directly in a directory  */
-    static loadIgnoreRules(dir) {
+    /*  load the ".gitignore" rules located directly in a directory,
+        given as absolute "dir" and project-relative "relDir"  */
+    static loadIgnoreRules(dir, relDir) {
         const file = path.join(dir, ".gitignore");
         if (!fs.existsSync(file))
             return [];
         const rules = [];
         for (const line of fs.readFileSync(file, "utf8").split(/\r?\n/)) {
-            const rule = Artifact.compileIgnoreRule(line);
+            const rule = Artifact.compileIgnoreRule(line, relDir);
             if (rule !== null)
                 rules.push(rule);
         }
@@ -83,7 +85,7 @@ export class Artifact {
         const root = Task.projectRoot();
         const files = new Set();
         const walk = (dir, relDir, inherited) => {
-            const rules = [...inherited, ...Artifact.loadIgnoreRules(dir)];
+            const rules = [...inherited, ...Artifact.loadIgnoreRules(dir, relDir)];
             for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
                 if (entry.name === ".git")
                     continue;
@@ -135,9 +137,7 @@ export class Artifact {
     /*  read the configured "basedir" anchor and "files" miniglob spec
         for a single kind; "basedir" is project-root-relative (POSIX,
         "" ≡ project root) and "files" resolves relative to "basedir"  */
-    static spec(log, kind) {
-        const cfg = new Config("config", configSchema, log);
-        cfg.read();
+    static spec(cfg, kind) {
         const basedir = Artifact.configString(cfg, `project.artifact.${kind}.basedir`)
             .replace(/\\/g, "/").replace(/^\/+|\/+$/g, "")
             .replace(/^\.$/, "");
@@ -163,10 +163,12 @@ export class Artifact {
     /*  resolve the requested kinds to project-relative file lists  */
     static list(log, kinds) {
         const all = Artifact.universe();
+        const cfg = new Config("config", configSchema, log);
+        cfg.read();
         /*  raw-resolve all five configured kinds  */
         const raw = new Map();
         for (const kind of configuredKinds) {
-            const { basedir, files } = Artifact.spec(log, kind);
+            const { basedir, files } = Artifact.spec(cfg, kind);
             raw.set(kind, Artifact.resolveKind(basedir, files, all));
         }
         /*  partition the universe by descending precedence  */
@@ -174,8 +176,9 @@ export class Artifact {
         const part = new Map();
         for (const kind of configuredKinds) {
             const own = [];
-            for (const file of raw.get(kind).size > 0 ? all : []) {
-                if (raw.get(kind).has(file) && !claimed.has(file)) {
+            const resolved = raw.get(kind);
+            for (const file of all) {
+                if (resolved.has(file) && !claimed.has(file)) {
                     own.push(file);
                     claimed.add(file);
                 }
@@ -198,7 +201,11 @@ export class Artifact {
         const file = filename.replace(/\\/g, "/").replace(/^\/+/, "");
         if (file === "")
             throw new Error("artifact: filename must not be empty");
-        const { basedir } = Artifact.spec(log, kind);
+        if (file.split("/").includes(".."))
+            throw new Error("artifact: filename must not contain \"..\" segments");
+        const cfg = new Config("config", configSchema, log);
+        cfg.read();
+        const { basedir } = Artifact.spec(cfg, kind);
         return basedir === "" ? file : `${basedir}/${file}`;
     }
 }
@@ -248,6 +255,11 @@ export default class ArtifactCommand {
         });
     }
 }
+/*  render a caught error as an MCP tool error result  */
+const mcpToolError = (err) => ({
+    isError: true,
+    content: [{ type: "text", text: `ERROR: ${err instanceof Error ? err.message : String(err)}` }]
+});
 /*  MCP registration entry point for artifact tools  */
 export class ArtifactMCP {
     log;
@@ -285,11 +297,7 @@ export class ArtifactMCP {
                 };
             }
             catch (err) {
-                const message = err instanceof Error ? err.message : String(err);
-                return {
-                    isError: true,
-                    content: [{ type: "text", text: `ERROR: ${message}` }]
-                };
+                return mcpToolError(err);
             }
         });
         mcp.registerTool("ase_artifact_name", {
@@ -319,11 +327,7 @@ export class ArtifactMCP {
                 };
             }
             catch (err) {
-                const message = err instanceof Error ? err.message : String(err);
-                return {
-                    isError: true,
-                    content: [{ type: "text", text: `ERROR: ${message}` }]
-                };
+                return mcpToolError(err);
             }
         });
     }

package/dst/ase-config.js

@@ -97,17 +97,21 @@ const parseScopeTerm = (value) => {
     throw new Error(`invalid --scope term "${value}" ` +
         "(expected: \"user\", \"project\", \"task:<id>\", or \"session:<id>\")");
 };
-/*  detect whether a project context exists, i.e. either we are inside
-    a Git working tree or a ".ase" directory is present at or above cwd  */
-const hasProjectContext = () => {
+/*  determine the Git top-level directory, if inside a Git repository  */
+const gitToplevel = () => {
     try {
         const result = execaSync("git", ["rev-parse", "--show-toplevel"], { stderr: "ignore" });
-        if (result.stdout.trim() !== "")
-            return true;
+        return result.stdout.trim() || null;
     }
     catch {
-        /*  not inside a Git working tree  */
+        return null;
     }
+};
+/*  detect whether a project context exists, i.e. either we are inside
+    a Git working tree or a ".ase" directory is present at or above cwd  */
+const hasProjectContext = () => {
+    if (gitToplevel() !== null)
+        return true;
     let dir = fs.realpathSync(process.cwd());
     for (;;) {
         if (fs.existsSync(path.join(dir, ".ase")))
@@ -226,14 +230,14 @@ export class Config {
         else if (term.kind === "project") {
             const rel = path.join(".ase", `${name}.yaml`);
             const cwd = process.cwd();
-            const top = this.gitToplevel();
+            const top = gitToplevel();
             const found = top !== null ?
                 this.findUpward(cwd, top, rel) :
                 (fs.existsSync(path.join(cwd, rel)) ? path.join(cwd, rel) : null);
             return found ?? path.join(top ?? cwd, rel);
         }
         else if (term.kind === "task") {
-            const top = this.gitToplevel() ?? process.cwd();
+            const top = gitToplevel() ?? process.cwd();
             return path.join(top, ".ase", "task", term.id, `${name}.yaml`);
         }
         else
@@ -258,18 +262,6 @@ export class Config {
         }
         return null;
     }
-    /*  determine the Git top-level directory, if inside a Git repository  */
-    gitToplevel() {
-        try {
-            const result = execaSync("git", ["rev-parse", "--show-toplevel"], {
-                stderr: "ignore"
-            });
-            return result.stdout.trim() || null;
-        }
-        catch {
-            return null;
-        }
-    }
     /*  read the full scope chain into memory; the requested mode applies
         to the target scope only, inherited scopes are always lenient  */
     read(mode = "lenient") {
@@ -538,8 +530,8 @@ export default class ConfigCommand {
             "\"user\" is always implicitly included and \"project\" is implicitly " +
             "included whenever a project context (Git repo or upward \".ase\" directory) exists")
             .description("manage ASE configuration")
-            .action((_opts, cmd) => {
-            cmd.outputHelp();
+            .action(() => {
+            configCmd.outputHelp();
             process.exit(1);
         });
         /*  register CLI sub-command "ase config init"  */
@@ -662,6 +654,11 @@ export default class ConfigCommand {
         });
     }
 }
+/*  render a caught error as an MCP tool error result  */
+const mcpToolError = (err) => ({
+    isError: true,
+    content: [{ type: "text", text: `ERROR: ${err instanceof Error ? err.message : String(err)}` }]
+});
 /*  MCP registration entry point for layered YAML configuration access  */
 export class ConfigMCP {
     log;
@@ -687,17 +684,13 @@ export class ConfigMCP {
             try {
                 const scope = parseScope(args.scope);
                 const cfg = new Config("config", configSchema, this.log, scope);
-                let text = "";
-                cfg.lock(() => {
-                    cfg.read();
-                    const val = cfg.get(args.key);
-                    text = val === undefined ? "" : JSON.stringify(val);
-                });
+                cfg.read();
+                const val = cfg.get(args.key);
+                const text = val === undefined ? "" : JSON.stringify(val);
                 return { content: [{ type: "text", text }] };
             }
             catch (err) {
-                const message = err instanceof Error ? err.message : String(err);
-                return { isError: true, content: [{ type: "text", text: `config_get: ERROR: ${message}` }] };
+                return mcpToolError(err);
             }
         });
         /*  config set  */
@@ -723,11 +716,10 @@ export class ConfigMCP {
                     cfg.set(args.key, args.val);
                     cfg.write();
                 });
-                return { content: [{ type: "text", text: `config_set: OK: stored "${args.key}" on scope "${args.scope}"` }] };
+                return { content: [{ type: "text", text: `OK: stored "${args.key}" on scope "${args.scope}"` }] };
             }
             catch (err) {
-                const message = err instanceof Error ? err.message : String(err);
-                return { isError: true, content: [{ type: "text", text: `config_set: ERROR: ${message}` }] };
+                return mcpToolError(err);
             }
         });
         /*  config delete  */
@@ -750,11 +742,10 @@ export class ConfigMCP {
                     cfg.delete(args.key);
                     cfg.write();
                 });
-                return { content: [{ type: "text", text: `config_delete: OK: removed "${args.key}" on scope "${args.scope}"` }] };
+                return { content: [{ type: "text", text: `OK: removed "${args.key}" on scope "${args.scope}"` }] };
             }
             catch (err) {
-                const message = err instanceof Error ? err.message : String(err);
-                return { isError: true, content: [{ type: "text", text: `config_delete: ERROR: ${message}` }] };
+                return mcpToolError(err);
             }
         });
     }

package/dst/ase-diagram.js

@@ -7,6 +7,7 @@ import fs from "node:fs";
 import { InvalidArgumentError } from "commander";
 import { renderMermaidASCII, renderMermaidSVG } from "beautiful-mermaid";
 import { z } from "zod";
+import getStdin from "get-stdin";
 /*  custom argument parser for Commander: non-negative integer  */
 const parseInteger = (name) => (value) => {
     const n = Number.parseInt(value, 10);
@@ -211,13 +212,6 @@ export class Diagram {
         return out;
     }
 }
-/*  read stdin into a single string  */
-const readStdin = async () => {
-    const chunks = [];
-    for await (const chunk of process.stdin)
-        chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
-    return Buffer.concat(chunks).toString("utf8");
-};
 /*  command-line handling  */
 export default class DiagramCommand {
     log;
@@ -241,12 +235,20 @@ export default class DiagramCommand {
             .option("--terminal-width <n>", "width of terminal of <n> characters (for diagram clipping)", parseInteger("--terminal-width"), Diagram.detectTermWidth())
             .option("--terminal-height <n>", "height of terminal of <n> lines (for diagram clipping)", parseInteger("--terminal-height"), Diagram.detectTermHeight())
             .action(async (opts) => {
-            /*  fetch Mermaid diagram specification from stdin  */
+            /*  fetch Mermaid diagram specification from file or stdin  */
             let src;
-            if (opts.input !== undefined)
-                src = fs.readFileSync(opts.input, "utf8");
+            if (opts.input !== undefined) {
+                try {
+                    src = fs.readFileSync(opts.input, "utf8");
+                }
+                catch (err) {
+                    const message = err instanceof Error ? err.message : String(err);
+                    this.log.write("error", `diagram: failed to read input file: ${message}`);
+                    process.exit(1);
+                }
+            }
             else
-                src = await readStdin();
+                src = await getStdin();
             if (src.trim() === "") {
                 this.log.write("error", "diagram: empty Mermaid diagram specification");
                 process.exit(1);
@@ -254,18 +256,7 @@ export default class DiagramCommand {
             /*  create diagram rendering  */
             let out;
             try {
-                out = Diagram.render(src, {
-                    format: opts.format,
-                    ascii: opts.ascii ?? false,
-                    colorMode: opts.colorMode,
-                    nodeMarginX: opts.nodeMarginX,
-                    nodeMarginY: opts.nodeMarginY,
-                    nodePadding: opts.nodePadding,
-                    diagramClipX: opts.diagramClipX,
-                    diagramClipY: opts.diagramClipY,
-                    terminalWidth: opts.terminalWidth,
-                    terminalHeight: opts.terminalHeight
-                });
+                out = Diagram.render(src, opts);
             }
             catch (err) {
                 const message = err instanceof Error ? err.message : String(err);
@@ -321,18 +312,7 @@ export class DiagramMCP {
             }
         }, async (args) => {
             try {
-                const out = Diagram.render(args.diagram, {
-                    format: args.format,
-                    ascii: args.ascii,
-                    colorMode: args.colorMode,
-                    nodeMarginX: args.nodeMarginX,
-                    nodeMarginY: args.nodeMarginY,
-                    nodePadding: args.nodePadding,
-                    diagramClipX: args.diagramClipX,
-                    diagramClipY: args.diagramClipY,
-                    terminalWidth: args.terminalWidth,
-                    terminalHeight: args.terminalHeight
-                });
+                const out = Diagram.render(args.diagram, args);
                 return {
                     content: [{ type: "text", text: out }]
                 };

package/dst/ase-getopt.js

@@ -55,8 +55,10 @@ export class GetoptMCP {
                 /*  tokenize spec and add one option per token  */
                 const tokens = args.spec.split(/\s+/).filter((e) => e.length > 0);
                 const re = /^--([A-Za-z][A-Za-z0-9-]*)(?:\|-([A-Za-z]))?(?:=(\((.*)\)(\.\.\.)?|.*))?$/;
+                const camelKey = (long) => long.replace(/-(.)/g, (_, c) => c.toUpperCase());
                 const internals = new Set();
                 const flagTakesValue = new Map();
+                const listOpts = [];
                 for (const tok of tokens) {
                     const m = re.exec(tok);
                     if (m === null)
@@ -83,32 +85,25 @@ export class GetoptMCP {
                     }
                     else
                         opt.default(false);
-                    if (long !== undefined && long.startsWith("int-")) {
+                    if (choices !== null && isList)
+                        listOpts.push({ long, choices });
+                    if (long.startsWith("int-")) {
                         /*  internal option: hide from usage help and remember
                             its camel-cased key for the info rendering below  */
                         opt.hideHelp();
-                        internals.add(long.replace(/-(.)/g, (_, c) => c.toUpperCase()));
+                        internals.add(camelKey(long));
                     }
                     cmd.addOption(opt);
                 }
                 /*  parse args  */
                 cmd.parse(argsVec, { from: "user" });
-                /*  validate comma-separated list-of-choices options  */
-                const listOpts = [];
-                for (const tok of tokens) {
-                    const m = re.exec(tok);
-                    if (m === null)
-                        continue;
-                    const long = m[1];
-                    const choicePart = m[4] ?? null;
-                    const listMarker = m[5] ?? null;
-                    if (choicePart !== null && listMarker !== null)
-                        listOpts.push({ long, choices: choicePart.split("|") });
-                }
+                /*  validate comma-separated list-of-choices options (only
+                    the first supplied token is checked here -- skills
+                    validate the remaining tokens as they consume them)  */
                 if (listOpts.length > 0) {
                     const opts = cmd.opts();
                     for (const { long, choices } of listOpts) {
-                        const key = long.replace(/-(.)/g, (_, c) => c.toUpperCase());
+                        const key = camelKey(long);
                         const v = opts[key];
                         if (typeof v !== "string")
                             continue;

package/dst/ase-hook.js

@@ -217,16 +217,13 @@ export default class HookCommand {
         const cfg = new Config("config", configSchema, this.log, hasSession ? parseScope(`session:${sessionId}`) : parseScope(undefined));
         /*  determine task id (only persist when scoped to a real session)  */
         const taskId = process.env.ASE_TASK_ID ?? "default";
-        if (hasSession)
-            cfg.lock(() => {
-                cfg.read();
+        cfg.lock(() => {
+            cfg.read();
+            if (hasSession) {
                 cfg.set("agent.task", taskId);
                 cfg.write();
-            });
-        else
-            cfg.lock(() => {
-                cfg.read();
-            });
+            }
+        });
         /*  initialize agent activity status  */
         this.writeAgentStatus("ready");
         /*  determine project id  */
@@ -333,19 +330,19 @@ export default class HookCommand {
                 "@ase_agent_status", icon], { stdio: "ignore", reject: false });
         }
     }
-    /*  handler for "ase hook user-prompt-submit" (both tools)  */
+    /*  handler for "ase hook user-prompt-submit" (all tools)  */
     async doUserPromptSubmit(_tool) {
         await this.drainStdin();
         this.writeAgentStatus("busy");
         return 0;
     }
-    /*  handler for "ase hook stop" (both tools)  */
+    /*  handler for "ase hook stop" (all tools)  */
     async doStop(_tool) {
         await this.drainStdin();
         this.writeAgentStatus("ready");
         return 0;
     }
-    /*  handler for "ase hook session-end" (both tools)  */
+    /*  handler for "ase hook session-end" (all tools)  */
     async doSessionEnd(_tool) {
         /*  determine session id  */
         const sessionId = await this.readSessionIdFromStdin();
@@ -432,7 +429,9 @@ export default class HookCommand {
             }));
         else if (!spec.toolInputIsString && typeof rawInput === "object" && rawInput !== null)
             toolInput = rawInput;
-        if (toolName === spec.bashToolName && /^ase(\s|$)/.test(toolInput.command ?? ""))
+        const command = toolInput.command ?? "";
+        if (toolName === spec.bashToolName && /^ase(\s|$)/.test(command)
+            && !/[;&|<>`\n]|\$\(/.test(command))
             return { approve: true, reason: "ASE CLI invocation auto-approved" };
         else if (toolName === "Skill" && /^(?:ase:)?ase-.+/.test(toolInput.skill ?? ""))
             return { approve: true, reason: "ASE skill invocation auto-approved" };
@@ -450,6 +449,17 @@ export default class HookCommand {
         }
         return { approve: false, reason: "" };
     }
+    /*  read the hook event payload from stdin and parse it into the
+        loosely-typed input object shared by the tool-approval handlers  */
+    async readHookInput(tool) {
+        const spec = toolSpecs[tool];
+        const stdin = await this.readStdin();
+        const input = this.parseJSON(stdin, v.looseObject({
+            session_id: v.optional(v.string()),
+            sessionId: v.optional(v.string())
+        }));
+        return { spec, input };
+    }
     /*  handler for "ase hook pre-tool-use" (all tools).
         For Anthropic Claude Code CLI and GitHub Copilot CLI this is where ASE tool
         invocations are auto-approved (via "permissionDecision: allow").
@@ -459,13 +469,8 @@ export default class HookCommand {
         still drain stdin, as Codex treats a non-draining hook as a hard
         error.  */
     async doPreToolUse(tool) {
-        const spec = toolSpecs[tool];
         /*  read tool invocation information  */
-        const stdin = await this.readStdin();
-        const input = this.parseJSON(stdin, v.looseObject({
-            session_id: v.optional(v.string()),
-            sessionId: v.optional(v.string())
-        }));
+        const { spec, input } = await this.readHookInput(tool);
         /*  Codex auto-approves through "PermissionRequest", not here  */
         if (spec.approvalEvent !== "PreToolUse")
             return 0;
@@ -496,13 +501,8 @@ export default class HookCommand {
         Staying silent (or returning a non-approval) defers to Codex's
         normal approval flow.  */
     async doPermissionRequest(tool) {
-        const spec = toolSpecs[tool];
         /*  read tool invocation information  */
-        const stdin = await this.readStdin();
-        const input = this.parseJSON(stdin, v.looseObject({
-            session_id: v.optional(v.string()),
-            sessionId: v.optional(v.string())
-        }));
+        const { spec, input } = await this.readHookInput(tool);
         /*  determine whether to auto-approve the tool invocation  */
         const { approve } = this.decideApproval(tool, spec, input);
         /*  emit the Codex "PermissionRequest" approval decision  */
@@ -525,13 +525,15 @@ export default class HookCommand {
     }
     /*  register commands  */
     register(program) {
-        /*  default for --tool derived from ASE_TOOL environment variable  */
+        /*  default for --tool derived from ASE_TOOL environment variable
+            (validated lazily by "parseTool" in each action, so an invalid
+            value cannot break unrelated "ase" commands at startup)  */
         const envTool = process.env.ASE_TOOL ?? "";
-        const toolDflt = envTool !== "" ? this.parseTool(envTool) : "claude";
+        const toolDflt = envTool !== "" ? envTool : "claude";
         /*  register CLI top-level command "ase hook"  */
         const hookCmd = program
             .command("hook")
-            .description("Anthropic Claude Code CLI and GitHub Copilot CLI hook entry points")
+            .description("Anthropic Claude Code CLI, GitHub Copilot CLI, and OpenAI Codex CLI hook entry points")
             .action(() => {
             hookCmd.outputHelp();
             process.exit(1);