@stfade/pi-read-delegator 1.0.12 → 1.0.13

package/dist/bash-filter.js

@@ -0,0 +1,420 @@
+/**
+ * bash-filter.ts — Bash command classification and Reader forwarding
+ *
+ * Classifies shell commands as read-only (delegate to Reader subagent),
+ * write (execute directly), or ambiguous (prompt user).
+ */
+// ---------------------------------------------------------------------------
+// Command lists
+// ---------------------------------------------------------------------------
+/**
+ * Commands that ONLY read and should be forwarded to the Reader subagent.
+ *
+ * Covers three shells:
+ *   - bash/sh (Linux/macOS/WSL/Git Bash)
+ *   - PowerShell (Windows)
+ *   - cmd.exe (Windows)
+ *
+ * All comparisons are case-insensitive (isReadSegment lowercases the argv).
+ *
+ * Context-dependent:
+ *   - sed without -i is read-only (stream editor → stdout)
+ *   - awk is read-only (pattern scanning / processing language)
+ */
+const READ_COMMANDS = new Set([
+    // ── bash / sh (Linux, macOS, WSL, Git Bash) ──
+    "cat",
+    "grep",
+    "find",
+    "ls",
+    "head",
+    "tail",
+    "less",
+    "wc",
+    "nl",
+    "more",
+    "bat",
+    "rg",
+    "fd",
+    "awk",
+    "du",
+    "df",
+    "stat",
+    "file",
+    "which",
+    "where",
+    "type",
+    "dir",
+    "sort",
+    "uniq",
+    "cut",
+    "tr",
+    "diff",
+    "cmp",
+    "comm",
+    "od",
+    "hexdump",
+    "xxd",
+    // ── PowerShell (Windows) ──
+    "get-content",
+    "select-string",
+    "get-childitem",
+    "get-itemproperty",
+    "get-item",
+    "test-path",
+    "get-alias",
+    "get-command",
+    "measure-object",
+    "compare-object",
+    "where-object",
+    "select-object",
+    "format-list",
+    "format-table",
+    "get-service",
+    "get-process",
+    "get-eventlog",
+    "get-history",
+    "get-variable",
+    "get-psdrive",
+    "get-psprovider",
+    // ── cmd.exe (Windows) ──
+    "findstr",
+    "comp",
+    "fc",
+    "tree",
+]);
+/**
+ * Commands that write to the filesystem and should execute directly.
+ * sed and tee are context-dependent — handled specially in isWriteCommand.
+ *
+ * Covers bash/sh, PowerShell, and cmd.exe writable commands.
+ */
+const WRITE_COMMANDS = new Set([
+    // ── bash / sh ──
+    "mkdir",
+    "touch",
+    "echo",
+    "rm",
+    "mv",
+    "cp",
+    "chmod",
+    "chown",
+    "ln",
+    "rmdir",
+    // ── cross-platform build tools ──
+    "npm",
+    "pnpm",
+    "yarn",
+    "pip",
+    "cargo",
+    "go",
+    "npx",
+    "node",
+    "python",
+    "python3",
+    "git",
+    "docker",
+    "kubectl",
+    "tsc",
+    "make",
+    "cmake",
+    "dotnet",
+    "rustc",
+    "gcc",
+    "g++",
+    // ── PowerShell write commands ──
+    "set-content",
+    "add-content",
+    "new-item",
+    "remove-item",
+    "copy-item",
+    "move-item",
+    "rename-item",
+    "out-file",
+    "export-csv",
+    "export-clixml",
+    "start-process",
+    "invoke-expression",
+    "invoke-webrequest",
+    // ── cmd.exe write commands ──
+    "del",
+    "erase",
+    "rename",
+    "copy",
+    "xcopy",
+    "robocopy",
+    "move",
+    "md",
+    "rd",
+    "attrib",
+    "icacls",
+    "cacls",
+    "setx",
+    "reg",
+]);
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Shell operators that separate distinct commands in a pipeline or chain.
+ * We check each segment independently — if ANY segment starts with a read
+ * command, the whole command is treated as containing a read.
+ */
+const SHELL_SEPARATORS = /(?:&&|\|\||[;|&])(?=(?:[^"']*["'][^"']*["'])*[^"']*$)/;
+/**
+ * Output redirect operators. These turn a read command into a write —
+ * e.g. `grep pattern file > out.txt` writes output to a file. We still
+ * block these because the actual operation (grep/find/cat) is a read.
+ */
+const REDIRECT_WRITE = /\b>>?\b/;
+/**
+ * Split a command string by shell separators (&&, ||, ;, |, &) and return
+ * the list of segment strings. Respects quoting so separators inside quotes
+ * are not treated as actual shell separators.
+ */
+export function splitShellSegments(command) {
+    const segments = [];
+    let current = "";
+    let inSingle = false;
+    let inDouble = false;
+    for (let i = 0; i < command.length; i++) {
+        const ch = command[i];
+        if (inSingle) {
+            current += ch;
+            if (ch === "'")
+                inSingle = false;
+        }
+        else if (inDouble) {
+            current += ch;
+            if (ch === '"')
+                inDouble = false;
+            else if (ch === "\\" && i + 1 < command.length) {
+                current += command[++i];
+            }
+        }
+        else if (ch === "'") {
+            current += ch;
+            inSingle = true;
+        }
+        else if (ch === '"') {
+            current += ch;
+            inDouble = true;
+        }
+        else if (ch === "|") {
+            // Peek ahead for ||
+            if (i + 1 < command.length && command[i + 1] === "|") {
+                // || separator
+                segments.push(current.trim());
+                current = "";
+                i++; // skip second |
+            }
+            else {
+                // Single | pipe
+                segments.push(current.trim());
+                current = "";
+            }
+        }
+        else if (ch === "&") {
+            if (i + 1 < command.length && command[i + 1] === "&") {
+                // && separator
+                segments.push(current.trim());
+                current = "";
+                i++; // skip second &
+            }
+            else {
+                // Single & background
+                segments.push(current.trim());
+                current = "";
+            }
+        }
+        else if (ch === ";") {
+            segments.push(current.trim());
+            current = "";
+        }
+        else {
+            current += ch;
+        }
+    }
+    // Flush remaining
+    const remainder = current.trim();
+    if (remainder.length > 0) {
+        segments.push(remainder);
+    }
+    return segments;
+}
+/**
+ * Check if a single segment (no pipes/chains) is a read command.
+ */
+function isReadSegment(segment) {
+    const argv = parseArgv(segment);
+    if (argv.length === 0)
+        return false;
+    const cmd = argv[0].toLowerCase();
+    // sed without -i is read-only
+    if (cmd === "sed" || cmd === "sed.exe") {
+        return !hasInlineFlag(argv);
+    }
+    return READ_COMMANDS.has(cmd);
+}
+/**
+ * Determine if a bash command is read-only and should be forwarded to Reader.
+ *
+ * Splits on shell separators (&&, ||, ;, |, &) and checks EACH segment.
+ * If ANY segment starts with a read command, the full command is blocked.
+ *
+ * Examples:
+ *   isReadCommand("cat file")               → true
+ *   isReadCommand("echo hello && cat file")  → true (cat in chain)
+ *   isReadCommand("npm test")               → false
+ *   isReadCommand("grep x | head -5")       → true (pipeline)
+ */
+export function isReadCommand(command) {
+    const segments = splitShellSegments(command);
+    for (const seg of segments) {
+        if (isReadSegment(seg))
+            return true;
+    }
+    return false;
+}
+/**
+ * Determine if a bash command modifies the filesystem and should run directly.
+ *
+ * Rules:
+ * - If any segment's first word is in WRITE_COMMANDS → true
+ * - sed with -i flag → true (in-place edit)
+ * - Command contains > or >> redirect → true (writes to file)
+ * - Command contains tee → true (writes to file)
+ */
+export function isWriteCommand(command) {
+    const segments = splitShellSegments(command);
+    for (const seg of segments) {
+        const argv = parseArgv(seg);
+        if (argv.length === 0)
+            continue;
+        const cmd = argv[0].toLowerCase();
+        if (cmd === "sed" || cmd === "sed.exe") {
+            if (hasInlineFlag(argv))
+                return true;
+            continue;
+        }
+        if (WRITE_COMMANDS.has(cmd))
+            return true;
+        // tee always writes
+        if (cmd === "tee" || cmd === "tee.exe")
+            return true;
+    }
+    // Output redirects anywhere in the full command = write
+    if (REDIRECT_WRITE.test(command))
+        return true;
+    return false;
+}
+/**
+ * Wrap a shell command into a Reader subagent task.
+ *
+ * Returns a formatted string instructing the Reader to execute and report
+ * minimal results.
+ */
+export function wrapForReader(command) {
+    return [
+        "Execute this shell command and return ONLY the essential result.",
+        "Max 5 lines or a single number. Never dump full file contents.",
+        `Command: ${command}`,
+    ].join("\n");
+}
+/**
+ * Wrap a generic task (non-bash) into a Reader subagent task.
+ */
+export function wrapTaskForReader(task) {
+    return [
+        "Execute this task and return ONLY the essential result.",
+        "Max 5 lines or a single number. Never dump full file contents.",
+        `Task: ${task}`,
+    ].join("\n");
+}
+// ---------------------------------------------------------------------------
+// Internals
+// ---------------------------------------------------------------------------
+/**
+ * Parse a command string into argv tokens, respecting single/double quotes.
+ *
+ * This is a simplified parser — edge cases like escaped quotes inside
+ * opposite-quoted strings are handled on a best-effort basis.
+ */
+function parseArgv(command) {
+    const tokens = [];
+    let current = "";
+    let inSingle = false;
+    let inDouble = false;
+    for (let i = 0; i < command.length; i++) {
+        const ch = command[i];
+        if (inSingle) {
+            if (ch === "'") {
+                inSingle = false;
+            }
+            else {
+                current += ch;
+            }
+        }
+        else if (inDouble) {
+            if (ch === '"') {
+                inDouble = false;
+            }
+            else if (ch === "\\" && i + 1 < command.length) {
+                // Simple escape handling inside double quotes
+                const next = command[i + 1];
+                if (next === '"' || next === "\\" || next === "$" || next === "`") {
+                    current += next;
+                    i++;
+                }
+                else {
+                    current += ch;
+                }
+            }
+            else {
+                current += ch;
+            }
+        }
+        else {
+            if (ch === "'") {
+                inSingle = true;
+            }
+            else if (ch === '"') {
+                inDouble = true;
+            }
+            else if (ch === " " || ch === "\t") {
+                if (current.length > 0) {
+                    tokens.push(current);
+                    current = "";
+                }
+            }
+            else {
+                current += ch;
+            }
+        }
+    }
+    // Flush remaining token
+    if (current.length > 0) {
+        tokens.push(current);
+    }
+    return tokens;
+}
+/**
+ * Check whether `sed` has the -i (in-place) flag.
+ */
+function hasInlineFlag(argv) {
+    for (let i = 1; i < argv.length; i++) {
+        const arg = argv[i];
+        // -i, -i.bak, --in-place, --in-place=.bak
+        if (arg === "-i" || arg.startsWith("-i.") || arg === "--in-place") {
+            return true;
+        }
+        if (arg.startsWith("--in-place=")) {
+            return true;
+        }
+        // Stop at the expression (s/.../.../ or -e '...') — flags after that
+        // might apply to the expression, not sed itself. In practice, -i always
+        // comes before the expression.
+    }
+    return false;
+}
+//# sourceMappingURL=bash-filter.js.map

package/{config.d.ts → dist/config.d.ts}

@@ -9,7 +9,6 @@ export interface ReadDelegatorConfig {
     enabled: boolean;
     reader_subagent_name: string;
     blocked_tools: string[];
-    allowed_bash_write_commands: string[];
     orchestrator_prompt: string;
     reader_model: string;
     language: string;

package/{config.js → dist/config.js}

@@ -1,4 +1,3 @@
-"use strict";
 /**
  * config.ts — Configuration loader for pi-read-delegator
  *
@@ -6,46 +5,10 @@
  * If the config file doesn't exist, it creates one with defaults.
  * If the config file is corrupted, it overwrites with defaults and logs a warning.
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.loadConfig = loadConfig;
-exports.saveConfig = saveConfig;
-const fs = __importStar(require("fs"));
-const os = __importStar(require("os"));
-const path = __importStar(require("path"));
-const ui_1 = require("./ui");
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { rawLog, rawWarn, rawError } from "./ui";
 // ---------------------------------------------------------------------------
 // Defaults
 // ---------------------------------------------------------------------------
@@ -53,16 +16,31 @@ const DEFAULT_CONFIG = {
     enabled: true,
     reader_subagent_name: "reader",
     blocked_tools: ["read", "grep", "find", "ls"],
-    allowed_bash_write_commands: [
-        "mkdir",
-        "echo",
-        "touch",
-        "sed",
-        "rm",
-        "mv",
-        "cp",
-    ],
-    orchestrator_prompt: "You are an orchestrator. For any file reading, searching, or listing operation, you MUST use the subagent tool with subagent='reader'. Do not use read/grep/find/ls yourself. If you need to run a shell command that only reads (like cat, grep, find, ls), also delegate it to the reader subagent.",
+    orchestrator_prompt: [
+        "## Reader Subagent Protocol",
+        "",
+        "Your `read`,`grep`,`find`,`ls` tools are BLOCKED. Shell read commands (cat, grep, type, Get-Content, etc.) are also blocked.",
+        "",
+        "### How to delegate",
+        'Use: `subagent(agent="reader", task="<format>")`',
+        "Format: Action: {read|grep|find|ls}  Target: {file|dir}  Detail: {what,be specific}",
+        "",
+        "### Graduated reading (use this order)",
+        "1. **Find first**: `find src/ *.ts` → locate the relevant file.",
+        "2. **Grep next**: `grep functionName in src/file.ts` → locate the exact spot.",
+        "3. **Read last**: `read src/file.ts lines 42-80` → get only the needed section.",
+        "Never read an entire file unless you truly need all of it.",
+        "",
+        "### Cache awareness",
+        "You have previously-read file content in your context window. Before delegating, check if you already have what you need.",
+        "Re-reading the same file wastes tokens — reuse cached content.",
+        "",
+        "### Reader output format (no headers, no fluff)",
+        "grep: file:line  content  |  read: N: line  |  find/ls: bare list",
+        "Large grep/find results: reader returns count-line first, then top matches.",
+        "The reader auto-skips imports, node_modules, binaries — you get clean data.",
+        'If you get "(no matches)" or an error, adjust and retry.',
+    ].join("\n"),
     reader_model: "lmstudio/nvidia/nemotron-3-nano-4b",
     language: "auto",
 };
@@ -89,7 +67,7 @@ function configFilePath() {
  * - If the file is corrupted, overwrite with defaults, log a warning, return defaults.
  * - Otherwise parse and return the typed config.
  */
-function loadConfig() {
+export function loadConfig() {
     const filePath = configFilePath();
     try {
         if (!fs.existsSync(filePath)) {
@@ -106,7 +84,7 @@ function loadConfig() {
     }
     catch (err) {
         // File is missing, unreadable, or invalid JSON → overwrite with defaults
-        (0, ui_1.rawWarn)(`Corrupted config file at ${filePath}. Overwriting with defaults. Error: ${err}`);
+        rawWarn(`Corrupted config file at ${filePath}. Overwriting with defaults. Error: ${err}`);
         try {
             ensureDir(path.dirname(filePath));
             fs.writeFileSync(filePath, JSON.stringify(DEFAULT_CONFIG, null, 2), "utf-8");
@@ -122,17 +100,17 @@ function loadConfig() {
  * @param config  The config object to persist
  * @param options.silent  If true, suppress console output
  */
-function saveConfig(config, options) {
+export function saveConfig(config, options) {
     const filePath = configFilePath();
     ensureDir(path.dirname(filePath));
     try {
         fs.writeFileSync(filePath, JSON.stringify(config, null, 2), "utf-8");
         if (!options?.silent) {
-            (0, ui_1.rawLog)(`Config saved to ${filePath}`);
+            rawLog(`Config saved to ${filePath}`);
         }
     }
     catch (err) {
-        (0, ui_1.rawError)(`Failed to save config: ${err}`);
+        rawError(`Failed to save config: ${err}`);
         throw err;
     }
 }
@@ -153,9 +131,6 @@ function mergeDefaults(partial, defaults) {
         blocked_tools: Array.isArray(p.blocked_tools)
             ? p.blocked_tools
             : defaults.blocked_tools,
-        allowed_bash_write_commands: Array.isArray(p.allowed_bash_write_commands)
-            ? p.allowed_bash_write_commands
-            : defaults.allowed_bash_write_commands,
         orchestrator_prompt: typeof p.orchestrator_prompt === "string"
             ? p.orchestrator_prompt
             : defaults.orchestrator_prompt,