@shipit-ai/cli 1.166.1 → 1.167.0

package/dist/src/presentation/web/components/common/feature-node/feature-node.js

@@ -4,7 +4,7 @@ import { useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import { useRouter } from 'next/navigation';
 import { Handle, Position } from '@xyflow/react';
-import { Plus, Trash2, Zap, ClipboardList, LoaderCircle, Globe, RotateCcw, Play, Square, Eye, Archive, ArchiveRestore, MessageSquare, } from 'lucide-react';
+import { Plus, Trash2, Zap, ClipboardList, LoaderCircle, Globe, RotateCcw, Play, Square, Eye, Archive, ArchiveRestore, MessageSquare, Shield, } from 'lucide-react';
 import { cn } from '../../../lib/utils.js';
 import { ActionButton } from '../../common/action-button/action-button.js';
 import { Button } from '../../ui/button.js';
@@ -111,7 +111,7 @@ export function FeatureNode({ data, selected, }) {
                     selected &&
                     'border-e-rose-400 border-t-rose-400 border-b-rose-400 dark:border-e-amber-500 dark:border-t-amber-500 dark:border-b-amber-500', selected &&
                     data.state !== 'action-required' &&
-                    'border-blue-400 dark:border-amber-500/60', data.state === 'deleting' && 'opacity-60', data.state === 'archived' && 'opacity-50'), children: [data.state !== 'creating' ? (_jsx("div", { className: "absolute end-4 top-3", children: _jsx(TooltipProvider, { children: _jsxs(Tooltip, { children: [_jsx(TooltipTrigger, { asChild: true, children: _jsxs("span", { "data-testid": "feature-node-phase-badge", className: "flex items-center gap-1.5", children: [_jsx("span", { className: "text-muted-foreground text-[10px]", children: lifecyclePhaseBadge[data.lifecycle].tooltip }), _jsx("span", { className: cn('h-1.5 w-1.5 -translate-y-px rounded-full', lifecyclePhaseBadge[data.lifecycle].dot) })] }) }), _jsxs(TooltipContent, { side: "right", className: "max-w-56", children: [_jsx("p", { className: "font-semibold", children: lifecyclePhaseBadge[data.lifecycle].tooltip }), _jsx("p", { className: "mt-1 text-xs leading-relaxed text-neutral-500", children: lifecyclePhaseBadge[data.lifecycle].description })] })] }) }) })) : null, _jsxs("div", { className: "flex items-center gap-1.5 pe-24", children: [data.agentType ? (_jsx(AgentIcon, { agentType: data.agentType, className: "h-4 w-4 shrink-0" })) : null, _jsx(TooltipProvider, { children: _jsxs(Tooltip, { children: [_jsx(TooltipTrigger, { asChild: true, children: _jsx("span", { "data-testid": "feature-node-fast-mode-badge", className: "shrink-0", children: data.fastMode ? (_jsx(Zap, { className: "h-3.5 w-3.5 text-amber-500" })) : (_jsx(ClipboardList, { className: "h-3.5 w-3.5 text-indigo-500" })) }) }), _jsx(TooltipContent, { side: "top", children: data.fastMode ? t('featureNode.fastMode') : t('featureNode.specDriven') })] }) }), _jsx("h3", { className: "min-w-0 truncate text-sm font-bold", children: data.name })] }), data.description ? (_jsx("p", { "data-testid": "feature-node-description", className: "text-muted-foreground mt-1 line-clamp-2 text-xs", children: data.description })) : null, _jsxs("div", { className: "mt-auto pt-2", children: [config.showProgressBar ? (_jsxs(_Fragment, { children: [_jsx("div", { className: "text-muted-foreground flex items-center justify-end text-[10px]", children: _jsxs("span", { children: [data.progress, "%"] }) }), _jsx("div", { "data-testid": "feature-node-progress-bar", className: "bg-muted mt-1.5 h-1 w-full overflow-hidden rounded-full", children: _jsx("div", { className: cn('h-full rounded-full transition-all', config.progressClass), style: { width: `${data.progress}%` } }) })] })) : null, !config.showProgressBar &&
+                    'border-blue-400 dark:border-amber-500/60', data.state === 'deleting' && 'opacity-60', data.state === 'archived' && 'opacity-50'), children: [data.state !== 'creating' ? (_jsx("div", { className: "absolute end-4 top-3", children: _jsx(TooltipProvider, { children: _jsxs(Tooltip, { children: [_jsx(TooltipTrigger, { asChild: true, children: _jsxs("span", { "data-testid": "feature-node-phase-badge", className: "flex items-center gap-1.5", children: [_jsx("span", { className: "text-muted-foreground text-[10px]", children: lifecyclePhaseBadge[data.lifecycle].tooltip }), _jsx("span", { className: cn('h-1.5 w-1.5 -translate-y-px rounded-full', lifecyclePhaseBadge[data.lifecycle].dot) })] }) }), _jsxs(TooltipContent, { side: "right", className: "max-w-56", children: [_jsx("p", { className: "font-semibold", children: lifecyclePhaseBadge[data.lifecycle].tooltip }), _jsx("p", { className: "mt-1 text-xs leading-relaxed text-neutral-500", children: lifecyclePhaseBadge[data.lifecycle].description })] })] }) }) })) : null, _jsxs("div", { className: "flex items-center gap-1.5 pe-24", children: [data.agentType ? (_jsx(AgentIcon, { agentType: data.agentType, className: "h-4 w-4 shrink-0" })) : null, _jsx(TooltipProvider, { children: _jsxs(Tooltip, { children: [_jsx(TooltipTrigger, { asChild: true, children: _jsx("span", { "data-testid": "feature-node-fast-mode-badge", className: "shrink-0", children: data.fastMode ? (_jsx(Zap, { className: "h-3.5 w-3.5 text-amber-500" })) : (_jsx(ClipboardList, { className: "h-3.5 w-3.5 text-indigo-500" })) }) }), _jsx(TooltipContent, { side: "top", children: data.fastMode ? t('featureNode.fastMode') : t('featureNode.specDriven') })] }) }), _jsx("h3", { className: "min-w-0 truncate text-sm font-bold", children: data.name }), data.permissionMode ? (_jsx(TooltipProvider, { children: _jsxs(Tooltip, { children: [_jsx(TooltipTrigger, { asChild: true, children: _jsxs("span", { "data-testid": "feature-node-permission-badge", className: "flex shrink-0 items-center gap-0.5 rounded-full border px-1.5 py-0.5 text-[9px] font-medium text-violet-600 dark:text-violet-400", children: [_jsx(Shield, { className: "h-2.5 w-2.5" }), data.permissionMode] }) }), _jsx(TooltipContent, { side: "top", children: t('feature.card.permissionOverride', { mode: data.permissionMode }) })] }) })) : null] }), data.description ? (_jsx("p", { "data-testid": "feature-node-description", className: "text-muted-foreground mt-1 line-clamp-2 text-xs", children: data.description })) : null, _jsxs("div", { className: "mt-auto pt-2", children: [config.showProgressBar ? (_jsxs(_Fragment, { children: [_jsx("div", { className: "text-muted-foreground flex items-center justify-end text-[10px]", children: _jsxs("span", { children: [data.progress, "%"] }) }), _jsx("div", { "data-testid": "feature-node-progress-bar", className: "bg-muted mt-1.5 h-1 w-full overflow-hidden rounded-full", children: _jsx("div", { className: cn('h-full rounded-full transition-all', config.progressClass), style: { width: `${data.progress}%` } }) })] })) : null, !config.showProgressBar &&
                                 ![
                                     'deleting',
                                     'creating',

package/dist/src/presentation/web/components/common/feature-node/feature-node.stories.js

@@ -172,7 +172,7 @@ const allStatesData = [
         state: 'error',
         progress: 30,
         errorMessage: 'Build failed: Cannot find module @sendgrid/mail',
-        agentType: 'aider',
+        agentType: 'copilot-cli',
         modelId: 'claude-sonnet-4-6',
         repositoryPath: '/home/user/my-repo',
         repositoryName: 'my-repo',
@@ -288,28 +288,28 @@ const allAgentTypesData = [
         branch: 'feat/gemini-cli',
     },
     {
-        name: 'Aider Agent',
-        description: 'Running with Aider executor',
+        name: 'Copilot CLI Agent',
+        description: 'Running with GitHub Copilot CLI executor',
         featureId: '#a4',
         lifecycle: 'implementation',
         state: 'running',
         progress: 50,
-        agentType: 'aider',
+        agentType: 'copilot-cli',
         modelId: 'claude-sonnet-4-6',
         repositoryPath: '/home/user/my-repo',
-        branch: 'feat/aider',
+        branch: 'feat/copilot-cli',
     },
     {
-        name: 'Continue Agent',
-        description: 'Running with Continue executor',
+        name: 'Rovo Dev Agent',
+        description: 'Running with Rovo Dev CLI executor',
         featureId: '#a5',
         lifecycle: 'implementation',
         state: 'running',
         progress: 50,
-        agentType: 'continue',
-        modelId: 'claude-sonnet-4-6',
+        agentType: 'rovo-dev',
+        modelId: 'auto',
         repositoryPath: '/home/user/my-repo',
-        branch: 'feat/continue',
+        branch: 'feat/rovo-dev',
     },
     {
         name: 'Default (No Agent)',

package/dist/src/presentation/web/components/features/control-center/control-center.stories.js

@@ -306,7 +306,7 @@ const fullSpectrumFeatures = [
             progress: 71,
             repositoryPath: '/home/user/acme/infra',
             branch: 'feat/terraform-modules',
-            agentType: 'aider',
+            agentType: 'copilot-cli',
             startedAt: Date.now() - 22 * 60_000,
             showHandles: true,
             onDelete: noop,

package/dist/src/presentation/web/components/features/features-canvas/features-canvas.stories.js

@@ -147,7 +147,7 @@ const multipleNodes = [
             repositoryName: 'my-repo',
             branch: 'feat/email-service',
             worktreePath: '/home/user/.shipit-ai/repos/abc123/wt/feat-email-service',
-            agentType: 'aider',
+            agentType: 'copilot-cli',
             modelId: 'claude-sonnet-4-6',
             hasAgentRun: true,
             hasPlan: true,
@@ -955,7 +955,7 @@ const fullSpectrumNodes = [
             state: 'error',
             progress: 55,
             errorMessage: 'ENOMEM — out of memory during test execution',
-            agentType: 'aider',
+            agentType: 'copilot-cli',
             modelId: 'claude-sonnet-4-6',
             repositoryPath: '/home/dev/platform',
             repositoryName: 'platform',

package/dist/src/presentation/web/components/features/settings/AgentModelPicker/AgentModelPicker.stories.d.ts

@@ -7,7 +7,7 @@ export declare const ClaudeCodeDefault: Story;
 export declare const CursorSelected: Story;
 export declare const GeminiCli: Story;
 export declare const CodexCliSelected: Story;
-export declare const DemoAgent: Story;
+export declare const CopilotCli: Story;
 export declare const OverrideMode: Story;
 export declare const Disabled: Story;
 //# sourceMappingURL=AgentModelPicker.stories.d.ts.map

package/dist/src/presentation/web/components/features/settings/AgentModelPicker/AgentModelPicker.stories.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AgentModelPicker.stories.d.ts","sourceRoot":"","sources":["../../../../../../../../src/presentation/web/components/features/settings/AgentModelPicker/AgentModelPicker.stories.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAE3C,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,OAAO,gBAAgB,CAevC,CAAC;AAEF,eAAe,IAAI,CAAC;AACpB,KAAK,KAAK,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;AAEnC,eAAO,MAAM,iBAAiB,EAAE,KAM/B,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,KAM5B,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,KAMvB,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,KAM9B,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,KAMvB,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,KAM1B,CAAC;AAEF,eAAO,MAAM,QAAQ,EAAE,KAOtB,CAAC"}
+{"version":3,"file":"AgentModelPicker.stories.d.ts","sourceRoot":"","sources":["../../../../../../../../src/presentation/web/components/features/settings/AgentModelPicker/AgentModelPicker.stories.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAE3C,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,OAAO,gBAAgB,CAevC,CAAC;AAEF,eAAe,IAAI,CAAC;AACpB,KAAK,KAAK,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;AAEnC,eAAO,MAAM,iBAAiB,EAAE,KAM/B,CAAC;AAEF,eAAO,MAAM,cAAc,EAAE,KAM5B,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,KAMvB,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,KAM9B,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,KAMxB,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,KAM1B,CAAC;AAEF,eAAO,MAAM,QAAQ,EAAE,KAOtB,CAAC"}

package/dist/src/presentation/web/components/features/settings/AgentModelPicker/AgentModelPicker.stories.js

@@ -42,10 +42,10 @@ export const CodexCliSelected = {
         mode: 'settings',
     },
 };
-export const DemoAgent = {
+export const CopilotCli = {
     args: {
-        initialAgentType: 'dev',
-        initialModel: '',
+        initialAgentType: 'copilot-cli',
+        initialModel: 'claude-sonnet-4-5',
         mode: 'settings',
     },
 };

package/dist/src/presentation/web/components/features/settings/agent-permission-picker.d.ts

@@ -0,0 +1,8 @@
+export interface AgentPermissionPickerProps {
+    agentType: string;
+    currentMode: string | undefined;
+    onChange: (mode: string) => void;
+    disabled?: boolean;
+}
+export declare function AgentPermissionPicker({ agentType, currentMode, onChange, disabled, }: AgentPermissionPickerProps): import("react/jsx-runtime").JSX.Element | null;
+//# sourceMappingURL=agent-permission-picker.d.ts.map

package/dist/src/presentation/web/components/features/settings/agent-permission-picker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-permission-picker.d.ts","sourceRoot":"","sources":["../../../../../../../src/presentation/web/components/features/settings/agent-permission-picker.tsx"],"names":[],"mappings":"AAUA,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,wBAAgB,qBAAqB,CAAC,EACpC,SAAS,EACT,WAAW,EACX,QAAQ,EACR,QAAgB,GACjB,EAAE,0BAA0B,kDA6E5B"}

package/dist/src/presentation/web/components/features/settings/agent-permission-picker.js

@@ -0,0 +1,33 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useEffect, useState } from 'react';
+import { useTranslation } from 'react-i18next';
+import { Shield } from 'lucide-react';
+import { cn } from '../../../lib/utils.js';
+import { Label } from '../../ui/label.js';
+import { Badge } from '../../ui/badge.js';
+import { getAgentPermissionOptions } from '../../../app/actions/agent-permissions.js';
+export function AgentPermissionPicker({ agentType, currentMode, onChange, disabled = false, }) {
+    const { t } = useTranslation('web');
+    const [options, setOptions] = useState([]);
+    useEffect(() => {
+        let cancelled = false;
+        getAgentPermissionOptions(agentType).then((opts) => {
+            if (!cancelled)
+                setOptions(opts);
+        });
+        return () => {
+            cancelled = true;
+        };
+    }, [agentType]);
+    if (options.length === 0)
+        return null;
+    // If no currentMode, default to first option
+    const selectedMode = currentMode ?? options[0]?.value;
+    return (_jsxs("div", { className: "space-y-2", children: [_jsxs("div", { className: "flex items-center gap-1.5", children: [_jsx(Shield, { className: "text-muted-foreground h-3.5 w-3.5" }), _jsx(Label, { className: "text-sm", children: t('settings.agent.permissions.title') })] }), _jsx("div", { className: "space-y-1.5", children: options.map((option) => {
+                    const isSelected = option.value === selectedMode;
+                    return (_jsxs("button", { type: "button", disabled: disabled, onClick: () => onChange(option.value), "data-testid": `permission-option-${option.value}`, className: cn('flex w-full cursor-pointer items-start gap-3 rounded-md border px-3 py-2.5 text-start transition-colors', isSelected
+                            ? 'border-primary bg-primary/5'
+                            : 'border-input hover:border-primary/50 hover:bg-accent/50', disabled && 'cursor-not-allowed opacity-60'), children: [_jsx("span", { className: cn('mt-0.5 flex h-4 w-4 shrink-0 items-center justify-center rounded-full border-2 transition-colors', isSelected ? 'border-primary' : 'border-muted-foreground/40'), children: isSelected ? _jsx("span", { className: "bg-primary h-2 w-2 rounded-full" }) : null }), _jsxs("div", { className: "min-w-0 flex-1", children: [_jsxs("div", { className: "flex items-center gap-2", children: [_jsx("span", { className: cn('text-sm font-medium', isSelected && 'text-primary'), children: option.label }), option.batchSafe ? (_jsx(Badge, { variant: "secondary", className: "px-1.5 py-0 text-[10px]", children: t('settings.agent.permissions.batchSafe') })) : (_jsx(Badge, { variant: "outline", className: "px-1.5 py-0 text-[10px]", children: t('settings.agent.permissions.interactiveOnly') }))] }), _jsx("p", { className: "text-muted-foreground mt-0.5 text-xs", children: option.description })] })] }, option.value));
+                }) })] }));
+}

package/dist/src/presentation/web/components/features/settings/agent-permission-picker.stories.d.ts

@@ -0,0 +1,15 @@
+import type { Meta, StoryObj } from '@storybook/react-vite';
+import { AgentPermissionPicker } from './agent-permission-picker.js';
+declare const meta: Meta<typeof AgentPermissionPicker>;
+export default meta;
+type Story = StoryObj<typeof AgentPermissionPicker>;
+export declare const ClaudeCode: Story;
+export declare const Cursor: Story;
+export declare const GeminiCli: Story;
+export declare const CodexCli: Story;
+export declare const CopilotCli: Story;
+export declare const RovoDev: Story;
+export declare const NoSelection: Story;
+export declare const Disabled: Story;
+export declare const Interactive: Story;
+//# sourceMappingURL=agent-permission-picker.stories.d.ts.map

package/dist/src/presentation/web/components/features/settings/agent-permission-picker.stories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-permission-picker.stories.d.ts","sourceRoot":"","sources":["../../../../../../../src/presentation/web/components/features/settings/agent-permission-picker.stories.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAOlE,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,OAAO,qBAAqB,CAiB5C,CAAC;AAEF,eAAe,IAAI,CAAC;AACpB,KAAK,KAAK,GAAG,QAAQ,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpD,eAAO,MAAM,UAAU,EAAE,KAKxB,CAAC;AAEF,eAAO,MAAM,MAAM,EAAE,KAKpB,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,KAKvB,CAAC;AAEF,eAAO,MAAM,QAAQ,EAAE,KAKtB,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,KAKxB,CAAC;AAEF,eAAO,MAAM,OAAO,EAAE,KAKrB,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,KAKzB,CAAC;AAEF,eAAO,MAAM,QAAQ,EAAE,KAMtB,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,KAEzB,CAAC"}

package/dist/src/presentation/web/components/features/settings/agent-permission-picker.stories.js

@@ -0,0 +1,75 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { useState } from 'react';
+import { fn } from 'storybook/test';
+import { AgentPermissionPicker } from './agent-permission-picker.js';
+function StatefulPicker({ agentType, initialMode }) {
+    const [mode, setMode] = useState(initialMode);
+    return _jsx(AgentPermissionPicker, { agentType: agentType, currentMode: mode, onChange: setMode });
+}
+const meta = {
+    title: 'Features/Settings/AgentPermissionPicker',
+    component: AgentPermissionPicker,
+    tags: ['autodocs'],
+    parameters: {
+        layout: 'padded',
+    },
+    args: {
+        onChange: fn(),
+    },
+    decorators: [
+        (Story) => (_jsx("div", { className: "w-[400px]", children: _jsx(Story, {}) })),
+    ],
+};
+export default meta;
+export const ClaudeCode = {
+    args: {
+        agentType: 'claude-code',
+        currentMode: 'bypassPermissions',
+    },
+};
+export const Cursor = {
+    args: {
+        agentType: 'cursor',
+        currentMode: 'yolo',
+    },
+};
+export const GeminiCli = {
+    args: {
+        agentType: 'gemini-cli',
+        currentMode: 'yolo',
+    },
+};
+export const CodexCli = {
+    args: {
+        agentType: 'codex-cli',
+        currentMode: 'danger-full-access',
+    },
+};
+export const CopilotCli = {
+    args: {
+        agentType: 'copilot-cli',
+        currentMode: 'yolo',
+    },
+};
+export const RovoDev = {
+    args: {
+        agentType: 'rovo-dev',
+        currentMode: 'yolo',
+    },
+};
+export const NoSelection = {
+    args: {
+        agentType: 'claude-code',
+        currentMode: undefined,
+    },
+};
+export const Disabled = {
+    args: {
+        agentType: 'claude-code',
+        currentMode: 'bypassPermissions',
+        disabled: true,
+    },
+};
+export const Interactive = {
+    render: () => _jsx(StatefulPicker, { agentType: "claude-code", initialMode: "bypassPermissions" }),
+};

package/dist/src/presentation/web/components/features/settings/agent-settings-section.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-settings-section.d.ts","sourceRoot":"","sources":["../../../../../../../src/presentation/web/components/features/settings/agent-settings-section.tsx"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AAiB3E,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,WAAW,CAAC;CACpB;AAED,wBAAgB,oBAAoB,CAAC,EAAE,KAAK,EAAE,EAAE,yBAAyB,2CA+IxE"}
+{"version":3,"file":"agent-settings-section.d.ts","sourceRoot":"","sources":["../../../../../../../src/presentation/web/components/features/settings/agent-settings-section.tsx"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AAgB3E,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,WAAW,CAAC;CACpB;AAkBD,wBAAgB,oBAAoB,CAAC,EAAE,KAAK,EAAE,EAAE,yBAAyB,2CAoKxE"}

package/dist/src/presentation/web/components/features/settings/agent-settings-section.js

@@ -9,26 +9,44 @@ import { Input } from '../../ui/input.js';
 import { Button } from '../../ui/button.js';
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue, } from '../../ui/select.js';
 import { updateSettingsAction } from '../../../app/actions/update-settings.js';
+import { setAgentPermissionMode } from '../../../app/actions/agent-permissions.js';
 import { AgentType, AgentAuthMethod } from '../../../../../../packages/core/src/domain/generated/output.js';
 import { getAgentTypeIcon } from '../../common/feature-node/agent-type-icons.js';
+import { AgentPermissionPicker } from './agent-permission-picker.js';
 const AGENT_TYPE_OPTIONS = [
     { value: AgentType.ClaudeCode, label: 'Claude Code' },
     { value: AgentType.CodexCli, label: 'Codex CLI' },
+    { value: AgentType.CopilotCli, label: 'GitHub Copilot CLI' },
     { value: AgentType.Cursor, label: 'Cursor' },
     { value: AgentType.GeminiCli, label: 'Gemini CLI' },
-    { value: AgentType.Aider, label: 'Aider' },
-    { value: AgentType.Continue, label: 'Continue' },
-    { value: AgentType.Dev, label: 'Dev' },
+    { value: AgentType.RovoDev, label: 'Rovo Dev CLI' },
 ];
 const AUTH_METHOD_OPTIONS = [
     { value: AgentAuthMethod.Session, label: 'Session' },
     { value: AgentAuthMethod.Token, label: 'Token' },
 ];
+/** Resolve the current permission mode for the active agent from settings. */
+function resolvePermissionMode(agent) {
+    const perms = agent.permissions;
+    if (!perms)
+        return undefined;
+    const keyMap = {
+        [AgentType.ClaudeCode]: 'claudeCode',
+        [AgentType.Cursor]: 'cursor',
+        [AgentType.GeminiCli]: 'geminiCli',
+        [AgentType.CodexCli]: 'codexCli',
+        [AgentType.CopilotCli]: 'copilotCli',
+        [AgentType.RovoDev]: 'rovoDev',
+    };
+    const key = keyMap[agent.type];
+    return key ? perms[key] : undefined;
+}
 export function AgentSettingsSection({ agent }) {
     const [agentType, setAgentType] = useState(agent.type);
     const [authMethod, setAuthMethod] = useState(agent.authMethod);
     const [token, setToken] = useState(agent.token ?? '');
     const [showToken, setShowToken] = useState(false);
+    const [permissionMode, setPermissionMode] = useState(resolvePermissionMode(agent));
     const [isPending, startTransition] = useTransition();
     const [showSaved, setShowSaved] = useState(false);
     const prevPendingRef = useRef(false);
@@ -58,8 +76,18 @@ export function AgentSettingsSection({ agent }) {
     }
     function handleAgentTypeChange(value) {
         setAgentType(value);
+        setPermissionMode(undefined); // Reset permission mode when agent changes
         save(buildPayload({ type: value }));
     }
+    function handlePermissionModeChange(mode) {
+        setPermissionMode(mode);
+        startTransition(async () => {
+            const result = await setAgentPermissionMode(agentType, mode);
+            if (!result.success) {
+                toast.error(result.error ?? 'Failed to save permission mode');
+            }
+        });
+    }
     function handleAuthMethodChange(value) {
         setAuthMethod(value);
         save(buildPayload({ authMethod: value }));
@@ -72,5 +100,5 @@ export function AgentSettingsSection({ agent }) {
     return (_jsxs(Card, { id: "agent", className: "scroll-mt-6", "data-testid": "agent-settings-section", children: [_jsxs(CardHeader, { children: [_jsxs("div", { className: "flex items-center justify-between", children: [_jsxs("div", { className: "flex items-center gap-2", children: [_jsx(Bot, { className: "text-muted-foreground h-4 w-4" }), _jsx(CardTitle, { children: "Preferred Agent" })] }), isPending ? _jsx("span", { className: "text-muted-foreground text-xs", children: "Saving..." }) : null, showSaved && !isPending ? (_jsxs("span", { className: "flex items-center gap-1 text-xs text-green-600", children: [_jsx(Check, { className: "h-3 w-3" }), "Saved"] })) : null] }), _jsx(CardDescription, { children: "Choose your AI coding agent and authentication method" })] }), _jsxs(CardContent, { className: "space-y-4", children: [_jsxs("div", { className: "space-y-2", children: [_jsx(Label, { htmlFor: "agent-type", children: "Agent Type" }), _jsxs(Select, { value: agentType, onValueChange: handleAgentTypeChange, children: [_jsx(SelectTrigger, { id: "agent-type", "data-testid": "agent-type-select", children: _jsx(SelectValue, {}) }), _jsx(SelectContent, { children: AGENT_TYPE_OPTIONS.map((opt) => {
                                             const Icon = getAgentTypeIcon(opt.value);
                                             return (_jsx(SelectItem, { value: opt.value, children: _jsxs("span", { className: "flex items-center gap-2", children: [_jsx(Icon, { className: "h-4 w-4 shrink-0" }), opt.label] }) }, opt.value));
-                                        }) })] })] }), _jsxs("div", { className: "space-y-2", children: [_jsx(Label, { htmlFor: "auth-method", children: "Authentication Method" }), _jsxs(Select, { value: authMethod, onValueChange: handleAuthMethodChange, children: [_jsx(SelectTrigger, { id: "auth-method", "data-testid": "auth-method-select", children: _jsx(SelectValue, {}) }), _jsx(SelectContent, { children: AUTH_METHOD_OPTIONS.map((opt) => (_jsx(SelectItem, { value: opt.value, children: opt.label }, opt.value))) })] })] }), authMethod === AgentAuthMethod.Token && (_jsxs("div", { className: "space-y-2", children: [_jsx(Label, { htmlFor: "agent-token", children: "API Token" }), _jsxs("div", { className: "relative", children: [_jsx(Input, { id: "agent-token", "data-testid": "agent-token-input", type: showToken ? 'text' : 'password', value: token, onChange: (e) => setToken(e.target.value), onBlur: handleTokenBlur, placeholder: "Enter your API token", className: "pe-10" }), _jsx(Button, { type: "button", variant: "ghost", size: "sm", className: "absolute top-0 right-0 h-full px-3 hover:bg-transparent", onClick: () => setShowToken(!showToken), "data-testid": "toggle-token-visibility", "aria-label": showToken ? 'Hide token' : 'Show token', children: showToken ? _jsx(EyeOff, { className: "h-4 w-4" }) : _jsx(Eye, { className: "h-4 w-4" }) })] }), _jsx("p", { className: "text-muted-foreground text-xs", children: "Saves automatically when you leave the field" })] }))] })] }));
+                                        }) })] })] }), _jsxs("div", { className: "space-y-2", children: [_jsx(Label, { htmlFor: "auth-method", children: "Authentication Method" }), _jsxs(Select, { value: authMethod, onValueChange: handleAuthMethodChange, children: [_jsx(SelectTrigger, { id: "auth-method", "data-testid": "auth-method-select", children: _jsx(SelectValue, {}) }), _jsx(SelectContent, { children: AUTH_METHOD_OPTIONS.map((opt) => (_jsx(SelectItem, { value: opt.value, children: opt.label }, opt.value))) })] })] }), _jsx(AgentPermissionPicker, { agentType: agentType, currentMode: permissionMode, onChange: handlePermissionModeChange, disabled: isPending }), authMethod === AgentAuthMethod.Token && (_jsxs("div", { className: "space-y-2", children: [_jsx(Label, { htmlFor: "agent-token", children: "API Token" }), _jsxs("div", { className: "relative", children: [_jsx(Input, { id: "agent-token", "data-testid": "agent-token-input", type: showToken ? 'text' : 'password', value: token, onChange: (e) => setToken(e.target.value), onBlur: handleTokenBlur, placeholder: "Enter your API token", className: "pe-10" }), _jsx(Button, { type: "button", variant: "ghost", size: "sm", className: "absolute top-0 right-0 h-full px-3 hover:bg-transparent", onClick: () => setShowToken(!showToken), "data-testid": "toggle-token-visibility", "aria-label": showToken ? 'Hide token' : 'Show token', children: showToken ? _jsx(EyeOff, { className: "h-4 w-4" }) : _jsx(Eye, { className: "h-4 w-4" }) })] }), _jsx("p", { className: "text-muted-foreground text-xs", children: "Saves automatically when you leave the field" })] }))] })] }));
 }

package/dist/src/presentation/web/components/features/settings/agent-settings-section.stories.d.ts

@@ -13,5 +13,5 @@ type Story = StoryObj<typeof meta>;
 export declare const Default: Story;
 export declare const TokenAuth: Story;
 export declare const CodexCli: Story;
-export declare const AiderSession: Story;
+export declare const CopilotCli: Story;
 //# sourceMappingURL=agent-settings-section.stories.d.ts.map

package/dist/src/presentation/web/components/features/settings/agent-settings-section.stories.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-settings-section.stories.d.ts","sourceRoot":"","sources":["../../../../../../../src/presentation/web/components/features/settings/agent-settings-section.stories.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAQ,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAGhE,QAAA,MAAM,IAAI;;;;;;;CAOmC,CAAC;AAE9C,eAAe,IAAI,CAAC;AACpB,KAAK,KAAK,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;AAEnC,eAAO,MAAM,OAAO,EAAE,KAOrB,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,KAQvB,CAAC;AAEF,eAAO,MAAM,QAAQ,EAAE,KAOtB,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,KAO1B,CAAC"}
+{"version":3,"file":"agent-settings-section.stories.d.ts","sourceRoot":"","sources":["../../../../../../../src/presentation/web/components/features/settings/agent-settings-section.stories.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAQ,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAGhE,QAAA,MAAM,IAAI;;;;;;;CAOmC,CAAC;AAE9C,eAAe,IAAI,CAAC;AACpB,KAAK,KAAK,GAAG,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;AAEnC,eAAO,MAAM,OAAO,EAAE,KAOrB,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,KAQvB,CAAC;AAEF,eAAO,MAAM,QAAQ,EAAE,KAOtB,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,KAOxB,CAAC"}

package/dist/src/presentation/web/components/features/settings/agent-settings-section.stories.js

@@ -34,10 +34,10 @@ export const CodexCli = {
         },
     },
 };
-export const AiderSession = {
+export const CopilotCli = {
     args: {
         agent: {
-            type: AgentType.Aider,
+            type: AgentType.CopilotCli,
             authMethod: AgentAuthMethod.Session,
         },
     },

package/dist/src/presentation/web/components/layouts/app-sidebar/app-sidebar.stories.js

@@ -82,8 +82,8 @@ const mockFeatures = [
         name: 'User Profile',
         status: 'done',
         duration: '1h',
-        agentType: 'dev',
-        modelId: 'gpt-8',
+        agentType: 'gemini-cli',
+        modelId: 'gemini-2.5-pro',
         repositoryPath: '/home/user/projects/my-app',
         repositoryName: 'my-app',
     },

package/dist/src/presentation/web/lib/path-sanitizers.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Resolve a path through `realpath` and return the resolved absolute path,
+ * or `null` if the path is missing, unreadable, or cannot be canonicalized
+ * for any other reason. Never throws.
+ *
+ * CodeQL recognizes `realpathSync` output as a sanitizer for
+ * `js/path-injection`, so the returned value is safe to flow into `stat`,
+ * `readFile`, `readdir`, `spawn`, and other filesystem sinks.
+ */
+export declare function realpathOrNull(p: string): string | null;
+/**
+ * Pure string containment check: does `resolvedCandidate` live at or
+ * beneath `resolvedRoot`? BOTH arguments are expected to already be
+ * realpath-resolved absolute paths — this helper does NOT resolve them.
+ * Separate the resolve step from the containment check so the caller can
+ * resolve once and validate many times without redundant syscalls or
+ * TOCTOU windows.
+ *
+ * Uses forward-slash normalization on both sides before comparing, which
+ * is lossless on POSIX (separator is already `/`) and lossless on Windows
+ * (where `/` cannot appear inside a path component). This makes the
+ * helper safe to use across all three platforms.
+ */
+export declare function isWithinRoot(resolvedCandidate: string, resolvedRoot: string): boolean;
+/**
+ * Resolve `candidate` through realpath and assert the result lives under
+ * at least one of the provided `allowedRoots`. Returns the resolved
+ * candidate path on success, or `null` if the candidate cannot be resolved
+ * or does not fall under any allowed root.
+ *
+ * The roots are resolved once, up-front, with graceful fallback to the
+ * unresolved form on failure (so a root that does not yet exist on disk
+ * is still honored as a literal prefix — this matches the existing
+ * behavior of the upload and directory-list routes). If the caller wants
+ * strict resolution of the roots too, pre-resolve them with
+ * `realpathOrNull` and filter out `null`s before calling this helper.
+ */
+export declare function realpathWithinAllowedRoots(candidate: string, allowedRoots: readonly string[]): string | null;
+/**
+ * Async variant of `realpathOrNull`. See the sync version for semantics.
+ */
+export declare function realpathOrNullAsync(p: string): Promise<string | null>;
+/**
+ * Async variant of `realpathWithinAllowedRoots`. See the sync version for
+ * semantics. Resolves the candidate and each root concurrently via
+ * `Promise.all` so the worst-case wall-clock time is a single realpath,
+ * not N of them serialized.
+ */
+export declare function realpathWithinAllowedRootsAsync(candidate: string, allowedRoots: readonly string[]): Promise<string | null>;
+//# sourceMappingURL=path-sanitizers.d.ts.map

package/dist/src/presentation/web/lib/path-sanitizers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-sanitizers.d.ts","sourceRoot":"","sources":["../../../../../src/presentation/web/lib/path-sanitizers.ts"],"names":[],"mappings":"AAsCA;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMvD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,iBAAiB,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAIrF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,MAAM,GAAG,IAAI,CAWf;AAUD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAO3E;AAED;;;;;GAKG;AACH,wBAAsB,+BAA+B,CACnD,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAcxB"}

package/dist/src/presentation/web/lib/path-sanitizers.js

@@ -0,0 +1,137 @@
+/**
+ * Path sanitization helpers for the web presentation layer.
+ *
+ * Provides the small set of primitives used by every route and server
+ * action that touches a user-influenced filesystem path. Each helper
+ * does one thing, is recognized by CodeQL's js/path-injection taint
+ * analysis as a sanitizer, and is portable across macOS/Linux/Windows.
+ *
+ * Design principles:
+ *
+ *   - `realpathOrNull(p)` resolves a path through `realpath` and returns
+ *     `null` on any error (missing file, permission denied, broken symlink).
+ *     Callers never have to care about the thrown error variants.
+ *
+ *   - `isWithinRoot(candidate, root)` is a pure string containment check
+ *     that expects both arguments to already be realpath-resolved. It
+ *     normalizes backslash separators to forward slashes before comparing,
+ *     so Windows realpath output matches the forward-slash roots that
+ *     shipit uses throughout the codebase for persistence and comparison.
+ *
+ *   - `realpathWithinAllowedRoots(candidate, roots)` combines the two:
+ *     resolves the candidate once, resolves each root once (with graceful
+ *     fallback to the unresolved form for the roots), then checks
+ *     containment. Returns the resolved candidate on success, `null` on
+ *     failure. Use this when a value must live under one of several
+ *     permitted directories (e.g. cwd OR home-dir for the uploads API).
+ *
+ * These helpers intentionally do NOT compose realpath with the
+ * containment check into a single `realpathWithinRoot(candidate, root)`
+ * function, because that composition re-resolves an already-resolved
+ * root on every nested call and opens a TOCTOU window where filesystem
+ * state can change between the resolve and the containment check. Keep
+ * realpath and containment separate so the caller can resolve once and
+ * validate many.
+ */
+import { realpathSync } from 'node:fs';
+import { realpath } from 'node:fs/promises';
+/**
+ * Resolve a path through `realpath` and return the resolved absolute path,
+ * or `null` if the path is missing, unreadable, or cannot be canonicalized
+ * for any other reason. Never throws.
+ *
+ * CodeQL recognizes `realpathSync` output as a sanitizer for
+ * `js/path-injection`, so the returned value is safe to flow into `stat`,
+ * `readFile`, `readdir`, `spawn`, and other filesystem sinks.
+ */
+export function realpathOrNull(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Pure string containment check: does `resolvedCandidate` live at or
+ * beneath `resolvedRoot`? BOTH arguments are expected to already be
+ * realpath-resolved absolute paths — this helper does NOT resolve them.
+ * Separate the resolve step from the containment check so the caller can
+ * resolve once and validate many times without redundant syscalls or
+ * TOCTOU windows.
+ *
+ * Uses forward-slash normalization on both sides before comparing, which
+ * is lossless on POSIX (separator is already `/`) and lossless on Windows
+ * (where `/` cannot appear inside a path component). This makes the
+ * helper safe to use across all three platforms.
+ */
+export function isWithinRoot(resolvedCandidate, resolvedRoot) {
+    const normRoot = resolvedRoot.replace(/\\/g, '/');
+    const normCandidate = resolvedCandidate.replace(/\\/g, '/');
+    return normCandidate === normRoot || normCandidate.startsWith(`${normRoot}/`);
+}
+/**
+ * Resolve `candidate` through realpath and assert the result lives under
+ * at least one of the provided `allowedRoots`. Returns the resolved
+ * candidate path on success, or `null` if the candidate cannot be resolved
+ * or does not fall under any allowed root.
+ *
+ * The roots are resolved once, up-front, with graceful fallback to the
+ * unresolved form on failure (so a root that does not yet exist on disk
+ * is still honored as a literal prefix — this matches the existing
+ * behavior of the upload and directory-list routes). If the caller wants
+ * strict resolution of the roots too, pre-resolve them with
+ * `realpathOrNull` and filter out `null`s before calling this helper.
+ */
+export function realpathWithinAllowedRoots(candidate, allowedRoots) {
+    const resolvedCandidate = realpathOrNull(candidate);
+    if (!resolvedCandidate)
+        return null;
+    for (const root of allowedRoots) {
+        const resolvedRoot = realpathOrNull(root) ?? root;
+        if (isWithinRoot(resolvedCandidate, resolvedRoot)) {
+            return resolvedCandidate;
+        }
+    }
+    return null;
+}
+// ─── Async variants ─────────────────────────────────────────────────────
+//
+// Route handlers that already use async fs APIs should use these rather
+// than the sync variants so they don't block the event loop under
+// concurrent load. The async helpers mirror the sync ones exactly in
+// semantics — same null-on-error contract, same normalization, same
+// containment rules.
+/**
+ * Async variant of `realpathOrNull`. See the sync version for semantics.
+ */
+export async function realpathOrNullAsync(p) {
+    try {
+        // codeql[js/path-injection] -- this function IS the sanitizer: callers gate access via isWithinRoot containment checks on the resolved result
+        return await realpath(p);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Async variant of `realpathWithinAllowedRoots`. See the sync version for
+ * semantics. Resolves the candidate and each root concurrently via
+ * `Promise.all` so the worst-case wall-clock time is a single realpath,
+ * not N of them serialized.
+ */
+export async function realpathWithinAllowedRootsAsync(candidate, allowedRoots) {
+    const [resolvedCandidate, ...resolvedRoots] = await Promise.all([
+        realpathOrNullAsync(candidate),
+        ...allowedRoots.map((r) => realpathOrNullAsync(r)),
+    ]);
+    if (!resolvedCandidate)
+        return null;
+    for (let i = 0; i < resolvedRoots.length; i++) {
+        const resolvedRoot = resolvedRoots[i] ?? allowedRoots[i];
+        if (isWithinRoot(resolvedCandidate, resolvedRoot)) {
+            return resolvedCandidate;
+        }
+    }
+    return null;
+}