@swifty.js/swifty 0.0.18 → 0.0.19

package/dist/chunk-T74SUDUF.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { createRequire as __swiftyCreateRequire } from "node:module";
+const require = __swiftyCreateRequire(import.meta.url);
+import{c as F}from"./chunk-P276SKAC.js";import{a as y}from"./chunk-7MHXMDYC.js";import{D as d,I as D,S as c,e as x}from"./chunk-ZM2V2A7B.js";import{b as k}from"./chunk-E55KH72M.js";import{readFileSync as _,writeFileSync as j,mkdirSync as M,statSync as $}from"fs";import{homedir as C,tmpdir as L}from"os";import{join as p,resolve as f,dirname as A}from"path";var E=D({module:"permissions"}),T=[],z=["ls","pwd","echo","cat","head","tail","wc","date","whoami","uname","hostname","which","type","file","git status","git log","git diff","git branch","git show","git rev-parse","git remote","bun test","bun run","npm test","npm run","go test","go build","go vet","python -c","node -e"],O={Bash:"command",PowerShell:"command",ReadFile:"file_path",WriteFile:"file_path",EditFile:"file_path",Glob:"pattern",Grep:"pattern"},Y=[".swifty/config.yaml",".swifty/permissions.local.yaml",".swifty/skills/"];function w(r,e){if(r===k)return F(c(e,"server",""),c(e,"tool",""));let t=O[r];if(!t)return"";let s=e[t];return typeof s=="string"?s:""}var R=class{allowedRoots;denyWritePaths;projectDir;constructor(e){this.projectDir=f(e),this.allowedRoots=[this.projectDir,L()],this.denyWritePaths=Y.map(t=>p(this.projectDir,t))}addRoot(e){this.allowedRoots.push(f(e))}addDenyWrite(e){this.denyWritePaths.push(f(e))}checkDenyWrite(e){let t=f(e);for(let s of this.denyWritePaths)if(t.startsWith(s))return{effect:"deny",reason:`Path ${e} is in deny-write list`};return null}check(e){let t=f(e);for(let s of this.allowedRoots)if(t.startsWith(s))return null;return{effect:"deny",reason:`Path ${e} is outside allowed directories`}}};function B(r,e){let t="^"+r.replace(/[.+^${}()|[\]\\]/g,"\\$&").replace(/\*/g,".*").replace(/\?/g,".")+"$";try{return new RegExp(t).test(e)}catch(s){return E.error({err:s},"permissions operation failed"),!1}}var G=/^(\w+)\((.+)\)$/;function S(r){let e;try{e=_(r,"utf-8")}catch(n){return n.code!=="ENOENT"&&E.error({err:n},"permissions operation failed"),[]}let t=d.object({rule:d.string().optional(),effect:d.string().optional()}),s;try{let n=y.load(e);s=x(d.array(t),n)}catch(n){return E.error({err:n},"permissions operation failed"),[]}let i=[];for(let n of s){if(n.effect!=="allow"&&n.effect!=="deny"&&n.effect!=="ask")continue;let o=G.exec((n.rule??"").trim());o&&i.push({tool:o[1],pattern:o[2],effect:n.effect})}return i}function b(r,e,t){let s=null;for(let i of r)if(!(i.tool!==e&&i.tool!=="*")&&B(i.pattern,t)){if(i.effect==="deny")return"deny";i.effect==="ask"?s="ask":s??="allow"}return s}var P=class{userPath;projectPath;localPath;cache=new Map;constructor(e){this.userPath=p(C(),".swifty","permissions.yaml"),this.projectPath=p(e,".swifty","permissions.yaml"),this.localPath=p(e,".swifty","permissions.local.yaml")}rulesFor(e){let t;try{t=$(e,{bigint:!0})}catch{return this.cache.delete(e),[]}let s=this.cache.get(e);if(s?.mtimeNs===t.mtimeNs&&s.size===t.size)return s.rules;let i=S(e);return this.cache.set(e,{mtimeNs:t.mtimeNs,size:t.size,rules:i}),i}snapshot(){return[this.userPath,this.projectPath,this.localPath].flatMap(e=>this.rulesFor(e))}evaluate(e,t){return b(this.snapshot(),e,t)}appendLocalRule(e){M(A(this.localPath),{recursive:!0});let t=S(this.localPath);if(t.some(n=>n.tool===e.tool&&n.pattern===e.pattern&&n.effect===e.effect))return;t.push(e);let i=t.map(n=>({rule:`${n.tool}(${n.pattern})`,effect:n.effect}));j(this.localPath,y.dump(i),"utf-8")}};function I(r){for(let e of T)if(e.re.test(r))return e.reason;return""}function N(r){let e=r.trim();return e.includes(">")||e.includes("|")||e.includes(";")||e.includes("&&")||e.includes("$(")||e.includes("`")?!1:z.some(t=>e===t||e.startsWith(t+" ")||e.startsWith(t+"	"))}function U(r,e){switch(r){case"bypassPermissions":return"allow";case"plan":return e==="read"?"allow":"ask";case"acceptEdits":return e==="command"?"ask":"allow";default:return e==="read"?"allow":"ask"}}var W=class{mode;planFilePath="";sandboxEnabled=!1;sandboxAutoAllow=!1;sandbox;ruleEngine;constructor(e,t="default"){this.mode=t,this.sandbox=new R(e),this.ruleEngine=new P(e)}check(e,t,s){let i=w(e,s),n=null,o=()=>n??=this.ruleEngine.snapshot();if(this.mode==="plan"&&(e==="WriteFile"||e==="EditFile")&&c(s,"file_path","").includes(".swifty/plans/"))return{effect:"allow",reason:"Plan file write allowed in plan mode"};if(t==="command"&&N(i))return{effect:"allow",reason:"Safe read-only command"};let a=t==="command"?I(i):"";if(a)return{effect:"deny",reason:`Dangerous command blocked: ${a}`};if(this.sandboxEnabled&&this.sandboxAutoAllow&&e==="Bash"){let u=c(s,"command").split(/\s*(?:&&|\|\||[;|])\s*/).map(g=>g.trim()).filter(Boolean),l=!1;for(let g of u){let v=b(o(),e,g);if(v==="deny")return{effect:"deny",reason:"Permission rule: deny"};v==="ask"&&(l=!0)}return l?{effect:"ask",reason:"Permission rule: ask (sandbox does not override)"}:{effect:"allow",reason:"Sandbox auto-allow: OS sandbox active"}}let h=c(s,"file_path",c(s,"path",""));if((t==="read"||t==="write")&&h){if(t==="write"){let l=this.sandbox.checkDenyWrite(h);if(l)return l}let u=this.sandbox.check(h);if(u&&this.mode!=="bypassPermissions"){let l=this.ruleEngine.evaluate(e,i);return l?{effect:l,reason:`Permission rule: ${l}`}:{effect:"ask",reason:u.reason}}}let m=b(o(),e,i);return m?{effect:m,reason:`Permission rule: ${m}`}:{effect:U(this.mode,t),reason:`Mode: ${this.mode}`}}allowExtraRoot(e){this.sandbox.addRoot(e)}allowAlways(e,t){let s=w(e,t),i=e==="ReadFile"||e==="WriteFile"||e==="EditFile",n;if(i&&s){let o=f(s),a=!1;try{a=$(o).isDirectory()}catch{}n=p(a?o:A(o),"*")}else n=s.trim().split(/\s+/).slice(0,2).join(" ")+"*";this.ruleEngine.appendLocalRule({tool:e,pattern:n,effect:"allow"})}describeToolAction(e,t){let s=w(e,t);if(s)return s;let i=[];for(let[n,o]of Object.entries(t)){let a=String(o);a.length>80&&(a=a.slice(0,80)+"..."),i.push(`${n}: ${a}`)}return i.join(", ")}};export{w as a,R as b,b as c,P as d,W as e};