@scalequality/cli 0.4.6 → 0.4.7

package/dist/connect.build.json

@@ -1,5 +1,5 @@
 {
   "sdkVersion": "0.3.281",
-  "sha256": "7c22c97149f00383b45b4f18cc9e08de81b99dbdddc067c76e9b888b359cd456",
-  "sourceCommit": "441fed6eb19d2a0e0c86f5926bbcb516900114fa"
+  "sha256": "03afc2ab7b4193895bb197e5d3594b5733ff18868f79e0b26ea9d3f08ae3dec7",
+  "sourceCommit": "3975ff27d27caf9615cc9ff288a2cbeab1bced2b"
 }

package/dist/connect.cjs

@@ -1960,9 +1960,11 @@ var SQ_READ_ONLY = /* @__PURE__ */ new Set([
   "measure_change"
 ]);
 var BASH_MAX_TIMEOUT_MS = 10 * 60 * 1e3;
-var BASH_DENY = [
+var CLOUD_BASH_DENY = [
   { re: /\bgit\b[^\n;&|]*\s(push|send-pack|send-email|request-pull)\b/, why: "Publishing from the workspace is not allowed. Use the open_pull_request tool; it asks the user for approval." },
-  { re: /\bgit\b[^\n;&|]*\sremote\b/, why: "Git remotes are managed by ScaleQuality and cannot be read or changed from the workspace." },
+  { re: /\bgit\b[^\n;&|]*\sremote\b/, why: "Git remotes are managed by ScaleQuality and cannot be read or changed from the workspace." }
+];
+var BASH_DENY = [
   { re: /\bgit\b[^\n;&|]*\scredential\b/, why: "Git credentials are not available in the workspace." },
   { re: /\bgit\b[^\n;&|]*\sconfig\b[^\n;&|]*(credential|insteadof|pushinsteadof|extraheader|\bremote\.|\burl\.)/, why: "Git credential and remote settings cannot be changed from the workspace." },
   { re: /credential[._-]?helper/, why: "Git credential helpers cannot be configured in the workspace." },
@@ -1984,6 +1986,9 @@ function normalizeCommand(command) {
 function bashDenial(command, opts = {}) {
   const n = normalizeCommand(command);
   for (const { re, why } of BASH_DENY) if (re.test(n) || re.test(command)) return why;
+  if (!opts.local) {
+    for (const { re, why } of CLOUD_BASH_DENY) if (re.test(n) || re.test(command)) return why;
+  }
   if (opts.local) {
     for (const { re, why } of LOCAL_BASH_DENY) if (re.test(n) || re.test(command)) return why;
   }
@@ -2363,7 +2368,7 @@ function httpCommandApprovalApi(o) {
       const r = await post("", body);
       const approvalId = typeof r?.approvalId === "string" ? r.approvalId : "";
       if (!approvalId) throw new CommandApprovalError(502, "INVALID_RESPONSE");
-      return { approvalId };
+      return { approvalId, ...r?.approved === true ? { approved: true } : {} };
     },
     async cancel(approvalId, reason) {
       await post(`/${encodeURIComponent(approvalId)}/cancel`, { reason });
@@ -2389,17 +2394,24 @@ var BrowserCommandGate = class {
     this.chain = next.catch(() => void 0);
     return next;
   }
+  checkEdit(path, opts = {}) {
+    const next = this.chain.then(() => this.ask(`edit ${path}`, { signal: opts.signal, edit: { path, ...opts.preview ? { preview: opts.preview } : {} } }));
+    this.chain = next.catch(() => void 0);
+    return next;
+  }
   async ask(command, opts) {
-    if (matchingRule(command, this.allRules())) return { allow: true };
+    if (!opts.edit && matchingRule(command, this.allRules())) return { allow: true };
     if (opts.signal?.aborted) return { allow: false, message: STOPPED };
     let approvalId;
+    let approved = false;
     try {
-      ({ approvalId } = await this.o.api.request({
+      ({ approvalId, approved = false } = await this.o.api.request({
         command,
         cwd: this.o.root,
         ...opts.description ? { description: opts.description.slice(0, 1e3) } : {},
-        reasons: approvalReasons(command),
-        suggestedRule: suggestRule(command)
+        reasons: opts.edit ? [] : approvalReasons(command),
+        suggestedRule: opts.edit ? null : suggestRule(command),
+        ...opts.edit ? { edit: { path: opts.edit.path, ...opts.edit.preview ? { preview: opts.edit.preview.slice(0, 4e3) } : {} } } : {}
       }));
     } catch (e) {
       this.o.log?.(`command approval could not be requested: ${e.message}`);
@@ -2409,6 +2421,7 @@ var BrowserCommandGate = class {
         message: code === "COMMAND_NOT_ALLOWED" ? "This command is not allowed in the ScaleQuality workspace. It did not run; do not try to run it another way." : "The command could not be sent to the user for approval, so it did not run. Tell the user; do not try to run it another way."
       };
     }
+    if (approved) return { allow: true };
     this.o.onWaiting?.(command);
     const timeoutMs = this.o.timeoutMs ?? COMMAND_APPROVAL_TIMEOUT_MS;
     const timer = new AbortController();
@@ -2422,7 +2435,7 @@ var BrowserCommandGate = class {
       return reason === "STOPPED" ? { allow: false, message: STOPPED } : { allow: false, message: `The user did not answer the approval for this command within ${Math.round(timeoutMs / 6e4)} minutes, so it did not run. Ask the user before trying it again.` };
     }
     if (decision.decision === "REJECT") {
-      return { allow: false, message: "The user denied this command in the browser. It did not run. Do not run the same command again unless the user asks; continue another way or ask the user." };
+      return opts.edit ? { allow: false, message: `The user declined this change to ${opts.edit.path} in the browser. The file was not changed. Ask the user what to do differently.` } : { allow: false, message: "The user denied this command in the browser. It did not run. Do not run the same command again unless the user asks; continue another way or ask the user." };
     }
     if (decision.remember) {
       if (this.o.onRemember) this.o.onRemember(decision.remember);
@@ -9677,6 +9690,16 @@ function findRunId(value) {
   };
   return walk(value, 0);
 }
+function editPreview(tool, input) {
+  const lines2 = (text3, mark) => typeof text3 === "string" ? text3.split("\n").slice(0, 40).map((line) => `${mark}${line}`) : [];
+  const out2 = [];
+  if (tool === "Write") out2.push(...lines2(input.content, "+"));
+  else if (tool === "Edit") out2.push(...lines2(input.old_string, "-"), ...lines2(input.new_string, "+"));
+  else if (tool === "MultiEdit" && Array.isArray(input.edits)) {
+    for (const e of input.edits.slice(0, 5)) out2.push(...lines2(e?.old_string, "-"), ...lines2(e?.new_string, "+"), "");
+  } else if (tool === "NotebookEdit") out2.push(...lines2(input.new_source, "+"));
+  return out2.join("\n").slice(0, 4e3);
+}
 function turnOffering(raw, loaded) {
   const o = raw && typeof raw === "object" ? raw : {};
   const names = (v) => new Set((Array.isArray(v) ? v : []).filter((x) => typeof x === "string").map((x) => x.toLowerCase()));
@@ -11636,9 +11659,10 @@ function buildQueryOptions(o) {
       return { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: "Only ScaleQuality tools are available in this workspace." } };
     }
     const d = await decideToolUse(name, input.tool_input ?? {}, o.policy);
-    if (d.behavior === "allow") await beforeWrite(name, d.updatedInput);
-    if (d.behavior === "allow" && gate && name === "Bash") {
-      return { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "ask", permissionDecisionReason: "Commands on this machine are confirmed by the user." } };
+    const gated = d.behavior === "allow" && !!gate && (name === "Bash" || !!gate.checkEdit && !o.plan && name in WRITE_TOOL_PATHS);
+    if (d.behavior === "allow" && !gated) await beforeWrite(name, d.updatedInput);
+    if (gated) {
+      return { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "ask", permissionDecisionReason: "Commands and changes on this machine follow the person's permission mode." } };
     }
     return d.behavior === "allow" ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow", updatedInput: d.updatedInput } } : { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: d.message } };
   };
@@ -11655,6 +11679,12 @@ function buildQueryOptions(o) {
     }
     const d = await decideToolUse(toolName, input, o.policy);
     if (d.behavior !== "allow") return { behavior: "deny", message: d.message };
+    if (gate?.checkEdit && !o.plan && toolName in WRITE_TOOL_PATHS) {
+      const field = WRITE_TOOL_PATHS[toolName];
+      const path = typeof d.updatedInput[field] === "string" ? (0, import_path15.relative)(o.root, d.updatedInput[field]) || String(d.updatedInput[field]) : "";
+      const r = await gate.checkEdit(path, { preview: editPreview(toolName, d.updatedInput), signal: opts?.signal ?? o.abortController.signal });
+      if (!r.allow) return { behavior: "deny", message: r.message };
+    }
     await beforeWrite(toolName, d.updatedInput);
     if (gate && toolName === "Bash") {
       const r = await gate.check(String(d.updatedInput.command ?? ""), {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scalequality/cli",
-  "version": "0.4.6",
+  "version": "0.4.7",
   "description": "ScaleQuality CLI. Connect your computer to the ScaleQuality AI Workspace (`scalequality login`), run its coding engine in any folder of your computer, and import your Claude Code and Codex conversations.",
   "type": "module",
   "bin": {