@sema-agent/client-core 0.99.0 → 0.101.0

package/dist/generated/settingsSchemaMcpRequestEntry.js

@@ -0,0 +1,156 @@
+export const SETTINGS_MCP_REQUEST_ENTRY_CLOSURE = (MCP_CONTENT_ORIGINS, startsWithHttpScheme, echoCallerText) => {
+    function describeValueShape(v) {
+        if (v === undefined)
+            return "nothing (the key is absent)";
+        if (v === null)
+            return "null";
+        if (Array.isArray(v))
+            return "an array";
+        if (typeof v === "string")
+            return v.length === 0 ? "an empty string" : `a string of ${v.length} characters`;
+        if (typeof v === "object")
+            return "an object";
+        return `a ${typeof v}`;
+    }
+    function describeNotStringArray(v) {
+        return Array.isArray(v) ? "an array with a non-string element" : describeValueShape(v);
+    }
+    function isStringArray(v) {
+        return Array.isArray(v) && v.every((a) => typeof a === "string");
+    }
+    function quotedCallerText(text) {
+        return `"${echoCallerText(text)}"`;
+    }
+    const TOOL_WIRE_NAME_MAX_CHARS = 128;
+    const hasEdgeWhitespace = (v) => v.trim() !== v;
+    function isUsableWireName(v) {
+        return typeof v === "string" && v.length > 0 && v.length <= TOOL_WIRE_NAME_MAX_CHARS && !hasEdgeWhitespace(v);
+    }
+    function describeBadWireName(v) {
+        if (typeof v !== "string")
+            return v === null ? "null" : Array.isArray(v) ? "array" : typeof v;
+        if (v.length === 0)
+            return "empty";
+        const head = quotedCallerText(v);
+        const tooLong = `${v.length} chars > ${TOOL_WIRE_NAME_MAX_CHARS}`;
+        if (!hasEdgeWhitespace(v))
+            return `${head} (${tooLong})`;
+        return `${head} (${v.length > TOOL_WIRE_NAME_MAX_CHARS ? `${tooLong}, ` : ""}leading or trailing whitespace)`;
+    }
+    const CONTENT_ORIGIN_WORDS = new Set(MCP_CONTENT_ORIGINS);
+    function isContentOriginWord(v) {
+        return typeof v === "string" && CONTENT_ORIGIN_WORDS.has(v);
+    }
+    function describeBadContentOrigin(v) {
+        return typeof v === "string" ? quotedCallerText(v) : v === null ? "null" : Array.isArray(v) ? "array" : typeof v;
+    }
+    function readMcpIdentityHeaders(transport) {
+        return {
+            ...(typeof transport.principalHeader === "string" ? { principalHeader: transport.principalHeader } : {}),
+            ...(transport.principalHeader === undefined && typeof transport.assertionHeader === "string" ? { assertionHeader: transport.assertionHeader } : {}),
+        };
+    }
+    const transportBad = (path, reason) => ({ ok: false, issue: { path, reason } });
+    function readRequestMcpTransport(t) {
+        if (!t || typeof t !== "object")
+            return transportBad("transport", `must be an object with a "kind" of "stdio" or "http" — got ${describeValueShape(t)}`);
+        const tr = t;
+        const lost = [];
+        if (tr.kind === "stdio") {
+            if (typeof tr.command !== "string" || tr.command.length === 0)
+                return transportBad("transport.command", `must be a non-empty string (the command to run) — got ${describeValueShape(tr.command)}`);
+            if (tr.args !== undefined && !isStringArray(tr.args))
+                lost.push({ path: "transport.args", reason: `must be an array of strings — got ${describeNotStringArray(tr.args)}` });
+            const env = readTransportRecord("transport.env", tr.env, lost);
+            return {
+                ok: true,
+                transport: {
+                    kind: "stdio",
+                    command: tr.command,
+                    ...(isStringArray(tr.args) ? { args: tr.args } : {}),
+                    ...(env !== undefined ? { env } : {}),
+                },
+                lost,
+            };
+        }
+        if (tr.kind === "http") {
+            if (typeof tr.url !== "string" || !startsWithHttpScheme(tr.url))
+                return transportBad("transport.url", "must be an absolute http(s) URL (put credentials in transport.headers, never in the URL)");
+            const ids = readMcpIdentityHeaders(tr);
+            const headers = readTransportRecord("transport.headers", tr.headers, lost);
+            if (tr.principalHeader !== undefined && ids.principalHeader === undefined) {
+                lost.push({ path: "transport.principalHeader", reason: `must be a string (the HTTP header NAME the end-user principal is injected into) — got ${describeValueShape(tr.principalHeader)}` });
+            }
+            return {
+                ok: true,
+                transport: {
+                    kind: "http",
+                    url: tr.url,
+                    ...(headers !== undefined ? { headers } : {}),
+                    ...ids,
+                },
+                lost,
+            };
+        }
+        return transportBad("transport.kind", `must be "stdio" or "http" — got ${describeValueShape(tr.kind)}`);
+    }
+    const RESERVED_MEMBER_NAME = "__proto__";
+    const RESERVED_MEMBER_FAULT = `no member of a declaration may be named "${RESERVED_MEMBER_NAME}"`;
+    function readPlainStringRecord(v) {
+        if (v === null || typeof v !== "object" || Array.isArray(v))
+            return { ok: false, fault: "not_plain_record", detail: v === null ? "got null" : Array.isArray(v) ? "got an array" : `got a ${typeof v}` };
+        let proto;
+        let names;
+        try {
+            proto = Object.getPrototypeOf(v);
+            names = Object.getOwnPropertyNames(v);
+        }
+        catch {
+            return { ok: false, fault: "not_plain_record", detail: "got an object that could not be inspected (a proxy trap threw)" };
+        }
+        if (proto !== Object.prototype && proto !== null) {
+            return { ok: false, fault: "not_plain_record", detail: "got an object that is not plain data (a class instance, a Map, process.env, or a record built on a prototype; copy it into a plain object)" };
+        }
+        const record = {};
+        let reservedMember = false;
+        for (const name of names) {
+            let value;
+            let unreadable = false;
+            try {
+                const d = Object.getOwnPropertyDescriptor(v, name);
+                value = d === undefined ? undefined : Object.hasOwn(d, "value") ? d.value : d.get === undefined ? undefined : Reflect.apply(d.get, v, []);
+            }
+            catch {
+                unreadable = true;
+            }
+            if (unreadable || typeof value !== "string") {
+                const valueFault = unreadable ? "could not be read (its getter threw)" : `must be a string — got ${describeValueShape(value)}`;
+                const reserved = name === RESERVED_MEMBER_NAME;
+                return {
+                    ok: false,
+                    fault: reserved ? "member_name_reserved" : "member_not_string",
+                    member: echoCallerText(name),
+                    detail: `its member "${echoCallerText(name)}" ${reserved ? `is not allowed (${RESERVED_MEMBER_FAULT}) and its value ${valueFault}` : valueFault}`,
+                };
+            }
+            if (name === RESERVED_MEMBER_NAME)
+                reservedMember = true;
+            else
+                record[name] = value;
+        }
+        return { ok: true, record, reservedMember };
+    }
+    function readTransportRecord(path, raw, lost) {
+        if (raw === undefined)
+            return undefined;
+        const read = readPlainStringRecord(raw);
+        if (!read.ok) {
+            lost.push({ path, reason: `must be a plain object of string values — ${read.detail}`, ...(read.member !== undefined ? { member: read.member } : {}), fault: read.fault });
+            return undefined;
+        }
+        if (read.reservedMember)
+            lost.push({ path: `${path}.${RESERVED_MEMBER_NAME}`, reason: RESERVED_MEMBER_FAULT, member: RESERVED_MEMBER_NAME, fault: "member_name_reserved" });
+        return read.record;
+    }
+    return { readRequestMcpTransport, readMcpIdentityHeaders, isUsableWireName, describeBadWireName, isContentOriginWord, describeBadContentOrigin, TOOL_WIRE_NAME_MAX_CHARS };
+};

package/dist/generated/settingsSchemaSafetyMergeSpec.d.ts

@@ -0,0 +1 @@
+export declare const SETTINGS_SAFETY_MERGE_CLOSURE: (MIN_TRUST_WORDS: readonly ["local", "session", "project", "global", "managed", "task"]) => any;

package/dist/generated/settingsSchemaSafetyMergeSpec.js

@@ -0,0 +1,95 @@
+export const SETTINGS_SAFETY_MERGE_CLOSURE = (MIN_TRUST_WORDS) => {
+    function trustRank(layer) {
+        switch (layer) {
+            case "managed": return 6;
+            case "global": return 5;
+            case "project": return 4;
+            case "local": return 3;
+            case "session": return 2;
+            case "task": return 1;
+            default: {
+                const unknown = layer;
+                throw new RangeError(`MinTrust: unknown trust word '${String(unknown)}' (words: ${MIN_TRUST_WORDS.join(", ")})`);
+            }
+        }
+    }
+    function isAtLeast(layer, minTrust) {
+        return trustRank(layer) >= trustRank(minTrust);
+    }
+    const SAFETY_MERGE_SPEC = {
+        permissions: {
+            mergeShape: "denyFirst", minTrust: "global", tighten: { rule: "policyDenyWins" }, enforcement: "gate", fail: "closed",
+            seam: "toolPolicy + deny-narrowing (SessionPolicyStore)", coreAxis: "permissionDecision",
+            members: {
+                allow: { direction: "loosen", minTrust: "global" },
+                deny: { direction: "tighten", minTrust: "local" },
+                ask: { direction: "tighten", minTrust: "local" },
+            },
+        },
+        permissionMode: { mergeShape: "replace", minTrust: "global", tighten: { rule: "enumRank", order: ["bypassPermissions", "auto", "acceptEdits", "default", "dontAsk", "plan"] }, enforcement: "gate", fail: "closed", seam: "derive → toolPolicy / onAsk / handsReadOnly (§6.4); bypass = launch-flag only; the kill-switches are the killSwitches row" },
+        handsReadOnly: { mergeShape: "replace", minTrust: "global", tighten: { rule: "boolStricter", strict: true }, enforcement: "gate", fail: "closed", seam: "handsReadOnly" },
+        shellGate: { mergeShape: "replace", minTrust: "global", tighten: { rule: "enumRank", order: ["always"] }, enforcement: "gate", fail: "closed", seam: "shellGate", coreAxis: "shellGate" },
+        approver: { mergeShape: "replace", minTrust: "global", tighten: { rule: "none" }, enforcement: "gate", fail: "closed", seam: "onAsk (conflict → reject)" },
+        sandboxNetwork: {
+            mergeShape: "denyFirst", minTrust: "global", tighten: { rule: "setNarrower" }, enforcement: "gate", fail: "closed",
+            seam: "ExecutionEnv (fs+net) + sensitive-path", coreAxis: "egress",
+            members: {
+                enabled: { direction: "tighten", minTrust: "global", boolPole: { strict: true, minTrust: "local" } },
+                allowUnsandboxedCommands: { direction: "tighten", minTrust: "global", boolPole: { strict: false, minTrust: "local" } },
+                autoAllowBashIfSandboxed: { direction: "tighten", minTrust: "global", boolPole: { strict: false, minTrust: "local" } },
+                enableWeakerNestedSandbox: { direction: "tighten", minTrust: "global", boolPole: { strict: false, minTrust: "local" } },
+                enableWeakerNetworkIsolation: { direction: "tighten", minTrust: "global", boolPole: { strict: false, minTrust: "local" } },
+                "network.allowManagedDomainsOnly": { direction: "tighten", minTrust: "global", boolPole: { strict: true, minTrust: "local" } },
+                "network.allowAllUnixSockets": { direction: "tighten", minTrust: "global", boolPole: { strict: false, minTrust: "local" } },
+                "network.allowLocalBinding": { direction: "tighten", minTrust: "global", boolPole: { strict: false, minTrust: "local" } },
+                "filesystem.allowManagedReadPathsOnly": { direction: "tighten", minTrust: "global", boolPole: { strict: true, minTrust: "local" } },
+                "filesystem.denyWrite": { direction: "tighten", minTrust: "local" },
+                "filesystem.denyRead": { direction: "tighten", minTrust: "local" },
+            },
+        },
+        hooks: { mergeShape: "runAll", minTrust: "project", tighten: { rule: "none" }, enforcement: "gate", fail: "closed", seam: "hooks (single source or adapter-composed)" },
+        mcpServers: { mergeShape: "overrideByName", minTrust: "project", tighten: { rule: "none" }, enforcement: "resolver", fail: "open", seam: "spec.mcp + allowTools" },
+        rulesInstructions: { mergeShape: "concat", minTrust: "project", tighten: { rule: "none" }, enforcement: "resolver", fail: "open", seam: "appendSystemPrompt / memory (GLOBAL→PROJECT→SESSION)" },
+        model: { mergeShape: "replace", minTrust: "session", tighten: { rule: "none" }, enforcement: "client", fail: "open", seam: "RoleSpec / TaskSpec.{model,thinking}" },
+        env: { mergeShape: "concat", minTrust: "project", tighten: { rule: "none" }, enforcement: "resolver", fail: "open", seam: "NodeExecutionEnv.shellEnv (later layer overrides same name)" },
+        envSecret: { mergeShape: "replace", minTrust: "global", tighten: { rule: "none" }, enforcement: "resolver", fail: "closed", seam: "§7 secret-ref resolution" },
+        memoryScopes: { mergeShape: "concat", minTrust: "global", tighten: { rule: "none" }, enforcement: "client", fail: "open", seam: "MemoryStore" },
+        autoCompaction: { mergeShape: "replace", minTrust: "session", tighten: { rule: "none" }, enforcement: "client", fail: "open", seam: "compaction config" },
+        ui: { mergeShape: "replace", minTrust: "local", tighten: { rule: "none" }, enforcement: "client", fail: "open", seam: "shell-only (theme/keybindings/statusLine) — never touches the engine" },
+        org: { mergeShape: "replace", minTrust: "managed", tighten: { rule: "none" }, enforcement: "server", fail: "closed", seam: "web-admin → governanceBaseline (SSO/SCIM/audit/budget, TOB-only)" },
+        httpHookAllowlists: { mergeShape: "denyFirst", minTrust: "global", tighten: { rule: "setNarrower" }, enforcement: "resolver", fail: "closed", seam: "http hook URL / header-env allowlists (httpHookUrlVerdict / httpHookEnvVarsAllowed)" },
+        killSwitches: {
+            mergeShape: "replace", minTrust: "global", tighten: { rule: "boolStricter", strict: true }, enforcement: "gate", fail: "closed",
+            seam: "permission-mode kill-switches (a switch ON removes bypassPermissions / auto from every layer's mode choice)",
+            members: {
+                disableBypassPermissionsMode: { direction: "tighten", minTrust: "global", boolPole: { strict: true, minTrust: "local" } },
+                disableAutoMode: { direction: "tighten", minTrust: "global", boolPole: { strict: true, minTrust: "local" } },
+            },
+        },
+    };
+    function categorySpec(category) {
+        if (!Object.hasOwn(SAFETY_MERGE_SPEC, category)) {
+            throw new RangeError(`SAFETY_MERGE_SPEC: unknown category '${category}' (categories: ${Object.keys(SAFETY_MERGE_SPEC).join(", ")})`);
+        }
+        return SAFETY_MERGE_SPEC[category];
+    }
+    function resolveMemberAdmission(spec, member, categoryLabel = "(unnamed category)", value) {
+        if (spec.members === undefined) {
+            throw new RangeError(`SAFETY_MERGE_SPEC: category '${categoryLabel}' has no member-level admission — its minTrust applies to the whole key`);
+        }
+        if (!Object.hasOwn(spec.members, member)) {
+            throw new RangeError(`SAFETY_MERGE_SPEC: unknown member '${member}' of category '${categoryLabel}' (members: ${Object.keys(spec.members).join(", ")})`);
+        }
+        const row = spec.members[member];
+        const rowFloor = row.minTrust ?? spec.minTrust;
+        if (row.boolPole !== undefined) {
+            const floor = value === row.boolPole.strict ? row.boolPole.minTrust : rowFloor;
+            return { direction: row.direction, minTrust: floor, boolPole: row.boolPole };
+        }
+        return { direction: row.direction, minTrust: rowFloor };
+    }
+    function memberAdmission(category, member, value) {
+        return resolveMemberAdmission(categorySpec(category), member, category, value);
+    }
+    return { isAtLeast, memberAdmission, SAFETY_MERGE_SPEC };
+};

package/dist/generated/settingsSchemaSettingsSources.d.ts

@@ -0,0 +1 @@
+export declare const SETTINGS_LAYER_SOURCES_CLOSURE: (SAFETY_MERGE_SPEC: object, isAtLeast: (layer: string, minTrust: string) => boolean, memberAdmission: (category: string, member: string) => object) => any;

package/dist/generated/settingsSchemaSettingsSources.js

@@ -0,0 +1,58 @@
+export const SETTINGS_LAYER_SOURCES_CLOSURE = (SAFETY_MERGE_SPEC, isAtLeast, memberAdmission) => {
+    const SETTINGS_SOURCES = ["userSettings", "projectSettings", "localSettings", "flagSettings", "policySettings", "foreignProjectSettings"];
+    const SETTINGS_SOURCE_CONTRACT = {
+        userSettings: { trust: "global", repoControllable: false },
+        projectSettings: { trust: "project", repoControllable: true },
+        localSettings: { trust: "project", repoControllable: true },
+        flagSettings: { trust: "global", repoControllable: false },
+        policySettings: { trust: "managed", repoControllable: false },
+        foreignProjectSettings: { trust: "project", repoControllable: true, tightenOnly: true },
+    };
+    function settingsSourceContract(source) {
+        if (!Object.hasOwn(SETTINGS_SOURCE_CONTRACT, source)) {
+            throw new RangeError(`SETTINGS_SOURCE_CONTRACT: unknown settings source '${String(source)}' (sources: ${SETTINGS_SOURCES.join(", ")})`);
+        }
+        return SETTINGS_SOURCE_CONTRACT[source];
+    }
+    const WORKSPACE_TRUST_STATES = ["accepted", "declined", "no_trust_step"];
+    function layerAdmission(source, workspace, category, member, value) {
+        const layer = settingsSourceContract(source);
+        const tightenOnlyLayer = readsTightenOnly(layer, workspace);
+        let floor;
+        let direction;
+        if (member === undefined) {
+            if (!Object.hasOwn(SAFETY_MERGE_SPEC, category)) {
+                throw new RangeError(`SAFETY_MERGE_SPEC: unknown category '${String(category)}' (categories: ${Object.keys(SAFETY_MERGE_SPEC).join(", ")})`);
+            }
+            floor = SAFETY_MERGE_SPEC[category].minTrust;
+        }
+        else {
+            const resolved = memberAdmission(category, member, value);
+            floor = resolved.minTrust;
+            direction = resolved.direction;
+        }
+        if (!isAtLeast(layer.trust, floor))
+            return "below_trust_floor";
+        if (direction === "tighten" || !tightenOnlyLayer)
+            return "admitted";
+        return layer.tightenOnly === true ? "tighten_only" : "trust_withheld";
+    }
+    function readsTightenOnly(layer, workspace) {
+        const accepted = workspaceAccepted(workspace);
+        return layer.tightenOnly === true || (layer.repoControllable && !accepted);
+    }
+    function workspaceAccepted(workspace) {
+        switch (workspace) {
+            case "accepted":
+                return true;
+            case "declined":
+            case "no_trust_step":
+                return false;
+            default: {
+                const unknown = workspace;
+                throw new RangeError(`WORKSPACE_TRUST_STATES: unknown workspace trust reading '${String(unknown)}' (readings: ${WORKSPACE_TRUST_STATES.join(", ")})`);
+            }
+        }
+    }
+    return { layerAdmission };
+};

package/dist/generated/settingsSchemaTables.d.ts

@@ -10,3 +10,6 @@ export declare const SETTINGS_BUDGET_PER_MODEL_NUMBER_KEYS: readonly ["maxBudget
 export declare const SETTINGS_MODEL_API_WORDS: readonly ["openai-completions", "anthropic-messages"];
 export declare const SETTINGS_TOOL_NAME_MATCHER_EVENTS: readonly ["PreToolUse", "PostToolUse", "PostToolUseFailure"];
 export declare const SETTINGS_UI_LANGUAGE_VALUES: readonly ["en", "zh"];
+export declare const SETTINGS_MCP_CONTENT_ORIGINS: readonly ["local", "execution", "external"];
+export declare const SETTINGS_MIN_TRUST_WORDS: readonly ["local", "session", "project", "global", "managed", "task"];
+export declare const SETTINGS_WORKSPACE_TRUST_STATES: readonly ["accepted", "declined", "no_trust_step"];

package/dist/generated/settingsSchemaTables.js

@@ -45,3 +45,21 @@ export const SETTINGS_UI_LANGUAGE_VALUES = Object.freeze([
     "en",
     "zh",
 ]);
+export const SETTINGS_MCP_CONTENT_ORIGINS = Object.freeze([
+    "local",
+    "execution",
+    "external",
+]);
+export const SETTINGS_MIN_TRUST_WORDS = Object.freeze([
+    "local",
+    "session",
+    "project",
+    "global",
+    "managed",
+    "task",
+]);
+export const SETTINGS_WORKSPACE_TRUST_STATES = Object.freeze([
+    "accepted",
+    "declined",
+    "no_trust_step",
+]);

package/dist/generated/settingsSchemaTypes.d.ts

@@ -102,4 +102,32 @@ export type HooksClassification = {
     readonly dropped: readonly [];
     readonly rejections: readonly HooksRejection[];
 };
+export type RequestMcpTransport = {
+    kind: "stdio";
+    command: string;
+    args?: string[];
+    env?: Record<string, string>;
+} | {
+    kind: "http";
+    url: string;
+    headers?: Record<string, string>;
+    principalHeader?: string;
+    assertionHeader?: string;
+};
+export interface McpEntryKeyIssue {
+    readonly path: string;
+    readonly reason: string;
+    readonly member?: string;
+    readonly fault?: "not_plain_record" | "member_not_string" | "member_name_reserved";
+}
+export type RequestMcpTransportRead = {
+    ok: true;
+    transport: RequestMcpTransport;
+    lost: readonly McpEntryKeyIssue[];
+} | {
+    ok: false;
+    issue: McpEntryKeyIssue;
+};
+declare const MCP_CONTENT_ORIGINS: readonly ["local", "execution", "external"];
+export type McpContentOrigin = (typeof MCP_CONTENT_ORIGINS)[number];
 export {};

package/dist/generated/settingsSchemaUrlPattern.d.ts

@@ -0,0 +1 @@
+export declare const SETTINGS_URL_ALLOW_PATTERN_MATCHES_CLOSURE: () => (url: string, pattern: string) => boolean;

package/dist/generated/settingsSchemaUrlPattern.js

@@ -0,0 +1,183 @@
+export const SETTINGS_URL_ALLOW_PATTERN_MATCHES_CLOSURE = () => {
+    const SPECIAL_SCHEMES = new Set(["http:", "https:", "ws:", "wss:", "ftp:", "file:"]);
+    const HOST_ROUTED_SCHEMES = new Set(["http:", "https:", "ws:", "wss:"]);
+    const OTHER_DEFAULT_PORT_SCHEME = { "http:": "https", "https:": "http", "ws:": "wss", "wss:": "ws", "ftp:": "http" };
+    const SOCKET_PATH_SCHEME = "ws+unix:";
+    function parseUrl(s) {
+        try {
+            return new URL(s);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    function occurrences(haystack, needle) {
+        return haystack.split(needle).length - 1;
+    }
+    function parserReadings(s) {
+        const fold = (x) => x.replace(/\p{Default_Ignorable_Code_Point}/gu, "").normalize("NFKC").toLowerCase().normalize("NFKC");
+        const seen = asParserSees(s);
+        const decoded = seen.replace(/(?:%[0-9a-f]{2})+/gi, (run) => {
+            try {
+                return decodeURIComponent(run);
+            }
+            catch {
+                return run;
+            }
+        });
+        return [fold(seen), fold(decoded)];
+    }
+    function freeToken(stem, avoid, build) {
+        const taken = new Set();
+        const shape = new RegExp(`zz${stem}(\\d+)qq`, "g");
+        for (const reading of parserReadings(avoid))
+            for (const m of reading.matchAll(shape))
+                taken.add(m[1]);
+        for (let i = 0;; i++) {
+            if (taken.has(String(i)))
+                continue;
+            const token = `zz${stem}${i}qq`;
+            const { built, inserted } = build(token);
+            if (parserReadings(built).every((r) => occurrences(r, token) === inserted))
+                return { token, built };
+            taken.add(String(i));
+        }
+    }
+    function asParserSees(s) {
+        let start = 0;
+        let end = s.length;
+        while (start < end && s.charCodeAt(start) <= 0x20)
+            start++;
+        while (end > start && s.charCodeAt(end - 1) <= 0x20)
+            end--;
+        return s.slice(start, end).replace(/[\t\n\r]/g, "");
+    }
+    function defaultPortWritten(marked, pat) {
+        if (pat.port !== "")
+            return false;
+        const other = OTHER_DEFAULT_PORT_SCHEME[pat.protocol];
+        if (other === undefined)
+            return false;
+        const seen = asParserSees(marked);
+        const colon = seen.indexOf(":");
+        if (colon === -1)
+            return false;
+        const alt = parseUrl(other + seen.slice(colon));
+        return alt !== undefined && alt.port !== "";
+    }
+    function namesScheme(pattern, protocol) {
+        return asParserSees(pattern).toLowerCase().startsWith(protocol);
+    }
+    function socketPart(path) {
+        const i = path.indexOf(":");
+        return i === -1 ? path : path.slice(0, i);
+    }
+    function globMatches(pattern, value) {
+        const parts = pattern.split("*");
+        const head = parts[0] ?? "";
+        if (parts.length === 1)
+            return head === value;
+        const tail = parts[parts.length - 1] ?? "";
+        const end = value.length - tail.length;
+        if (end < head.length || !value.startsWith(head) || !value.endsWith(tail))
+            return false;
+        let at = head.length;
+        for (const mid of parts.slice(1, -1)) {
+            if (mid === "")
+                continue;
+            const found = value.indexOf(mid, at);
+            if (found === -1 || found + mid.length > end)
+                return false;
+            at = found + mid.length;
+        }
+        return true;
+    }
+    function nextSeparator(s, separators, from) {
+        let i = from;
+        while (i < s.length && !separators.includes(s.charAt(i)))
+            i++;
+        return i;
+    }
+    function segmentedGlobMatches(pattern, value, separators) {
+        let p = 0;
+        let v = 0;
+        for (;;) {
+            const pe = nextSeparator(pattern, separators, p);
+            const ve = nextSeparator(value, separators, v);
+            if (pattern.charAt(pe) !== value.charAt(ve) || !globMatches(pattern.slice(p, pe), value.slice(v, ve)))
+                return false;
+            if (pe === pattern.length)
+                return true;
+            p = pe + 1;
+            v = ve + 1;
+        }
+    }
+    function componentMatches(url, pattern, reading) {
+        if (pattern === "*")
+            return true;
+        const target = parseUrl(url);
+        if (target === undefined)
+            return false;
+        const strict = reading === "allow";
+        if (strict && !HOST_ROUTED_SCHEMES.has(target.protocol) && !namesScheme(pattern, target.protocol))
+            return false;
+        const socketTarget = strict && target.protocol === SOCKET_PATH_SCHEME;
+        if (socketTarget) {
+            const socket = socketPart(target.pathname + target.search);
+            if (socket === "" || socket.split("/").includes(".."))
+                return false;
+        }
+        const { token: WILDCARD, built: starred } = freeToken("wildcard", `${pattern}\n${url}`, (t) => ({ built: pattern.replaceAll("*", t), inserted: occurrences(pattern, "*") }));
+        const { token: SHIELD, built: marked } = freeToken("punycode", `${starred}\n${url}`, (t) => {
+            let inserted = 0;
+            const built = starred.replace(/[a-z0-9-]+/gi, (run) => {
+                if (!/^xn--/i.test(run) || !run.includes(WILDCARD))
+                    return run;
+                inserted++;
+                return t + run;
+            });
+            return { built, inserted };
+        });
+        const unshield = (s) => s.replaceAll(SHIELD, "");
+        let portAny = false;
+        let pat = parseUrl(marked);
+        if (pat === undefined) {
+            const zeroPort = marked.replace(new RegExp(`:${WILDCARD}(?=[/?#]|$)`), ":0");
+            if (zeroPort !== marked) {
+                pat = parseUrl(zeroPort);
+                portAny = pat !== undefined;
+            }
+        }
+        if (pat !== undefined && (occurrences(pat.href, WILDCARD) > occurrences(pattern, "*") || occurrences(pat.href, SHIELD) > occurrences(marked, SHIELD)))
+            pat = undefined;
+        if (pat === undefined || (SPECIAL_SCHEMES.has(pat.protocol) && pat.hostname.split(".").some((l) => l.startsWith("xn--") && l.includes(WILDCARD)))) {
+            return !strict && segmentedGlobMatches(pattern, `${target.protocol}//${target.host}${target.pathname}${target.search}`, "/");
+        }
+        if (pat.protocol !== `${WILDCARD}:` && pat.protocol !== target.protocol)
+            return false;
+        if (strict && unshield(pat.hostname).includes("*"))
+            return false;
+        const host = target.hostname.replace(/\.$/, "").toLowerCase();
+        const hostPattern = unshield(pat.hostname).replace(/\.$/, "").toLowerCase().replaceAll(WILDCARD, "*");
+        if (!globMatches(hostPattern, host))
+            return false;
+        if (pat.port === "" && pat.hostname.includes(WILDCARD) && !(strict && defaultPortWritten(marked, pat)))
+            portAny = true;
+        if (!portAny && pat.port !== target.port)
+            return false;
+        if ((pat.pathname === "/" || pat.pathname === "") && pat.search === "" && !marked.endsWith("/"))
+            return !socketTarget;
+        const pathPattern = unshield(pat.pathname + pat.search).replaceAll(WILDCARD, "*");
+        const targetPath = target.pathname + target.search;
+        if (!globMatches(pathPattern, targetPath))
+            return false;
+        if (!socketTarget)
+            return true;
+        const socketPattern = socketPart(pathPattern);
+        return !socketPattern.includes("*") && socketPattern === socketPart(targetPath);
+    }
+    function urlAllowPatternMatches(url, pattern) {
+        return componentMatches(url, pattern, "allow");
+    }
+    return urlAllowPatternMatches;
+};

package/dist/headlessPermissionModeWire.d.ts

@@ -4,11 +4,27 @@ import { type EnvLike } from './hostEnv.js';
 export declare const HEADLESS_PERMISSION_MODE_ENV = "SEMA_HEADLESS_PERMISSION_MODE";
 export declare const HEADLESS_PERMISSION_WIRE_MODES: readonly PermissionMode[];
 export declare function normalizeShellPermissionModeForWire(mode: string | undefined): string | undefined;
+export interface HeadlessPermissionFlags {
+    readonly flag?: string;
+    readonly missing?: true;
+    readonly dangerouslySkipPermissions?: boolean;
+}
 export type HeadlessPermissionResolution = {
     fields: PermissionModeField;
     source: 'flag' | 'env' | 'default';
     warning?: string;
 };
-export declare function permissionModeFromArgv(argv: readonly string[]): string | undefined;
-export declare function resolveHeadlessPermissionMode(argv: readonly string[], env?: EnvLike, permissionModes?: PermissionModesReading): HeadlessPermissionResolution;
+export declare function resolveHeadlessPermissionMode(flags: HeadlessPermissionFlags | undefined, env?: EnvLike, permissionModes?: PermissionModesReading): HeadlessPermissionResolution;
+export type HeadlessPermissionModeKnob = {
+    readonly kind: 'absent';
+} | {
+    readonly kind: 'word';
+    readonly word: PermissionMode;
+} | {
+    readonly kind: 'invalid';
+    readonly raw: string;
+    readonly warning: string;
+};
+export declare function readHeadlessPermissionModeKnob(env?: EnvLike): HeadlessPermissionModeKnob;
+export declare function headlessDontAskDowngradeWarning(permissionModes?: PermissionModesReading): string;
 export declare function _resetHeadlessPermissionModeWireForTest(): void;