@swifty.js/swifty 0.0.21 → 0.0.23

package/dist/lib/chunk-GHF2PSEW.js

@@ -0,0 +1,8 @@
+// src/tools/tool-names.ts
+var TOOL_SEARCH_TOOL_NAME = "ToolSearch";
+var MCP_CALL_TOOL_NAME = "McpCall";
+
+export {
+  TOOL_SEARCH_TOOL_NAME,
+  MCP_CALL_TOOL_NAME
+};

package/dist/lib/chunk-GNI7YX6F.js

@@ -0,0 +1,426 @@
+import {
+  mcpCallPermissionContent
+} from "./chunk-PZ42NAFA.js";
+import {
+  createChildLogger,
+  strArg
+} from "./chunk-EY7HE52Q.js";
+import {
+  MCP_CALL_TOOL_NAME
+} from "./chunk-GHF2PSEW.js";
+
+// src/permissions/checker.ts
+import { readFileSync, writeFileSync, mkdirSync, statSync } from "fs";
+import { homedir, tmpdir } from "os";
+import { join, resolve, dirname } from "path";
+import yaml from "js-yaml";
+import z, { parse } from "zod";
+var log = createChildLogger({ module: "permissions" });
+var DANGEROUS_PATTERNS = [];
+var SAFE_PREFIXES = [
+  "ls",
+  "pwd",
+  "echo",
+  "cat",
+  "head",
+  "tail",
+  "wc",
+  "date",
+  "whoami",
+  "uname",
+  "hostname",
+  "which",
+  "type",
+  "file",
+  "git status",
+  "git log",
+  "git diff",
+  "git branch",
+  "git show",
+  "git rev-parse",
+  "git remote",
+  "bun test",
+  "bun run",
+  "npm test",
+  "npm run",
+  "go test",
+  "go build",
+  "go vet",
+  "python -c",
+  "node -e"
+];
+var CONTENT_FIELDS = {
+  Bash: "command",
+  PowerShell: "command",
+  ReadFile: "file_path",
+  WriteFile: "file_path",
+  EditFile: "file_path",
+  Glob: "pattern",
+  Grep: "pattern"
+};
+var DEFAULT_DENY_WRITE = [
+  ".swifty/config.yaml",
+  ".swifty/permissions.local.yaml",
+  ".swifty/skills/"
+];
+function extractContent(toolName, args) {
+  if (toolName === MCP_CALL_TOOL_NAME) {
+    return mcpCallPermissionContent(strArg(args, "server", ""), strArg(args, "tool", ""));
+  }
+  const field = CONTENT_FIELDS[toolName];
+  if (!field) {
+    return "";
+  }
+  const v = args[field];
+  return typeof v === "string" ? v : "";
+}
+var PathSandbox = class {
+  allowedRoots;
+  denyWritePaths;
+  projectDir;
+  constructor(projectDir) {
+    this.projectDir = resolve(projectDir);
+    this.allowedRoots = [this.projectDir, tmpdir()];
+    this.denyWritePaths = DEFAULT_DENY_WRITE.map((p) => join(this.projectDir, p));
+  }
+  addRoot(root) {
+    this.allowedRoots.push(resolve(root));
+  }
+  // Add custom deny-write paths
+  addDenyWrite(path) {
+    this.denyWritePaths.push(resolve(path));
+  }
+  /**
+   * Check whether a path is in the deny-write list.
+   * denyWrite has the highest priority — even if the path is within an allowed root, writes are still denied.
+   */
+  checkDenyWrite(filePath) {
+    const absolute = resolve(filePath);
+    for (const denied of this.denyWritePaths) {
+      if (absolute.startsWith(denied)) {
+        return {
+          effect: "deny",
+          reason: `Path ${filePath} is in deny-write list`
+        };
+      }
+    }
+    return null;
+  }
+  check(filePath) {
+    const absolute = resolve(filePath);
+    for (const root of this.allowedRoots) {
+      if (absolute.startsWith(root)) {
+        return null;
+      }
+    }
+    return {
+      effect: "deny",
+      reason: `Path ${filePath} is outside allowed directories`
+    };
+  }
+};
+function globMatch(pattern, content) {
+  const re = "^" + pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".") + "$";
+  try {
+    return new RegExp(re).test(content);
+  } catch (err) {
+    log.error({ err }, "permissions operation failed");
+    return false;
+  }
+}
+var RULE_RE = /^(\w+)\((.+)\)$/;
+function loadRulesFile(path) {
+  let data;
+  try {
+    data = readFileSync(path, "utf-8");
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      log.error({ err }, "permissions operation failed");
+    }
+    return [];
+  }
+  const YamlEntrySchema = z.object({
+    rule: z.string().optional(),
+    effect: z.string().optional()
+  });
+  let yamlData;
+  try {
+    const parsed = yaml.load(data);
+    yamlData = parse(z.array(YamlEntrySchema), parsed);
+  } catch (err) {
+    log.error({ err }, "permissions operation failed");
+    return [];
+  }
+  const rules = [];
+  for (const entry of yamlData) {
+    if (entry.effect !== "allow" && entry.effect !== "deny" && entry.effect !== "ask") {
+      continue;
+    }
+    const m = RULE_RE.exec((entry.rule ?? "").trim());
+    if (!m) {
+      continue;
+    }
+    rules.push({ tool: m[1], pattern: m[2], effect: entry.effect });
+  }
+  return rules;
+}
+function evaluateRules(rules, toolName, content) {
+  let hit = null;
+  for (const r of rules) {
+    if (r.tool !== toolName && r.tool !== "*") {
+      continue;
+    }
+    if (!globMatch(r.pattern, content)) {
+      continue;
+    }
+    if (r.effect === "deny") {
+      return "deny";
+    }
+    if (r.effect === "ask") {
+      hit = "ask";
+    } else {
+      hit ??= "allow";
+    }
+  }
+  return hit;
+}
+var RuleEngine = class {
+  userPath;
+  projectPath;
+  localPath;
+  cache = /* @__PURE__ */ new Map();
+  constructor(workDir) {
+    this.userPath = join(homedir(), ".swifty", "permissions.yaml");
+    this.projectPath = join(workDir, ".swifty", "permissions.yaml");
+    this.localPath = join(workDir, ".swifty", "permissions.local.yaml");
+  }
+  // Read a single rules file; skips disk I/O and parsing on cache hit.
+  rulesFor(path) {
+    let st;
+    try {
+      st = statSync(path, { bigint: true });
+    } catch {
+      this.cache.delete(path);
+      return [];
+    }
+    const cached = this.cache.get(path);
+    if (cached?.mtimeNs === st.mtimeNs && cached.size === st.size) {
+      return cached.rules;
+    }
+    const rules = loadRulesFile(path);
+    this.cache.set(path, { mtimeNs: st.mtimeNs, size: st.size, rules });
+    return rules;
+  }
+  // Return the merged snapshot of all three rules files. Reuses the previous
+  // parse result when files are unchanged; re-reads only on change, so edits
+  // take effect on the next evaluation without redundant parsing. One snapshot
+  // is taken per tool call and shared across sub-command checks.
+  snapshot() {
+    return [this.userPath, this.projectPath, this.localPath].flatMap((p) => this.rulesFor(p));
+  }
+  // Take a snapshot then adjudicate: reuses the previous parse result when
+  // files are unchanged; a freshly written "allow always" rule takes effect
+  // immediately. Priority is deny > ask > allow regardless of which layer or
+  // line a rule resides on, so a deny cannot be overridden by an allow from
+  // another layer. Returns null when no rule matches.
+  evaluate(toolName, content) {
+    return evaluateRules(this.snapshot(), toolName, content);
+  }
+  // Persists a rule to the project-local YAML file in the `Tool(pattern)`
+  // format so "allow always" survives a restart.
+  appendLocalRule(rule) {
+    mkdirSync(dirname(this.localPath), { recursive: true });
+    const rules = loadRulesFile(this.localPath);
+    const exists = rules.some(
+      (r) => r.tool === rule.tool && r.pattern === rule.pattern && r.effect === rule.effect
+    );
+    if (exists) {
+      return;
+    }
+    rules.push(rule);
+    const entries = rules.map((r) => ({
+      rule: `${r.tool}(${r.pattern})`,
+      effect: r.effect
+    }));
+    writeFileSync(this.localPath, yaml.dump(entries), "utf-8");
+  }
+};
+function detectDangerous(command) {
+  for (const p of DANGEROUS_PATTERNS) {
+    if (p.re.test(command)) {
+      return p.reason;
+    }
+  }
+  return "";
+}
+function isSafeCommand(command) {
+  const trimmed = command.trim();
+  if (trimmed.includes(">") || trimmed.includes("|") || trimmed.includes(";") || trimmed.includes("&&") || trimmed.includes("$(") || trimmed.includes("`")) {
+    return false;
+  }
+  return SAFE_PREFIXES.some(
+    (prefix) => trimmed === prefix || trimmed.startsWith(prefix + " ") || trimmed.startsWith(prefix + "	")
+  );
+}
+function modeDecide(mode, category) {
+  switch (mode) {
+    case "bypassPermissions":
+      return "allow";
+    case "plan":
+      return category === "read" ? "allow" : "ask";
+    case "acceptEdits":
+      return category === "command" ? "ask" : "allow";
+    case "default":
+    default:
+      return category === "read" ? "allow" : "ask";
+  }
+}
+var PermissionChecker = class {
+  mode;
+  planFilePath = "";
+  // Sandbox mode: when enabled, command-category tools run through OS sandbox isolation, with optional auto-allow
+  sandboxEnabled = false;
+  sandboxAutoAllow = false;
+  sandbox;
+  ruleEngine;
+  constructor(workDir, mode = "default") {
+    this.mode = mode;
+    this.sandbox = new PathSandbox(workDir);
+    this.ruleEngine = new RuleEngine(workDir);
+  }
+  check(toolName, category, args) {
+    const content = extractContent(toolName, args);
+    let snapshot = null;
+    const rules = () => snapshot ??= this.ruleEngine.snapshot();
+    if (this.mode === "plan" && (toolName === "WriteFile" || toolName === "EditFile")) {
+      const path = strArg(args, "file_path", "");
+      if (path.includes(".swifty/plans/")) {
+        return {
+          effect: "allow",
+          reason: "Plan file write allowed in plan mode"
+        };
+      }
+    }
+    if (category === "command" && isSafeCommand(content)) {
+      return { effect: "allow", reason: "Safe read-only command" };
+    }
+    const dangerReason = category === "command" ? detectDangerous(content) : "";
+    if (dangerReason) {
+      return {
+        effect: "deny",
+        reason: `Dangerous command blocked: ${dangerReason}`
+      };
+    }
+    if (this.sandboxEnabled && this.sandboxAutoAllow && toolName === "Bash") {
+      const subcommands = strArg(args, "command").split(/\s*(?:&&|\|\||[;|])\s*/).map((s) => s.trim()).filter(Boolean);
+      let hasAsk = false;
+      for (const sub of subcommands) {
+        const ruleResult = evaluateRules(rules(), toolName, sub);
+        if (ruleResult === "deny") {
+          return { effect: "deny", reason: "Permission rule: deny" };
+        }
+        if (ruleResult === "ask") {
+          hasAsk = true;
+        }
+      }
+      if (hasAsk) {
+        return {
+          effect: "ask",
+          reason: "Permission rule: ask (sandbox does not override)"
+        };
+      }
+      return {
+        effect: "allow",
+        reason: "Sandbox auto-allow: OS sandbox active"
+      };
+    }
+    const filePath = strArg(args, "file_path", strArg(args, "path", ""));
+    if ((category === "read" || category === "write") && filePath) {
+      if (category === "write") {
+        const denyDecision = this.sandbox.checkDenyWrite(filePath);
+        if (denyDecision) {
+          return denyDecision;
+        }
+      }
+      const sandboxDecision = this.sandbox.check(filePath);
+      if (sandboxDecision && this.mode !== "bypassPermissions") {
+        const ruleEffect2 = this.ruleEngine.evaluate(toolName, content);
+        if (ruleEffect2) {
+          return {
+            effect: ruleEffect2,
+            reason: `Permission rule: ${ruleEffect2}`
+          };
+        }
+        return { effect: "ask", reason: sandboxDecision.reason };
+      }
+    }
+    const ruleEffect = evaluateRules(rules(), toolName, content);
+    if (ruleEffect) {
+      return { effect: ruleEffect, reason: `Permission rule: ${ruleEffect}` };
+    }
+    return {
+      effect: modeDecide(this.mode, category),
+      reason: `Mode: ${this.mode}`
+    };
+  }
+  // Allow an extra directory outside the project root. When a background agent
+  // needs read/write access to user-level data (e.g., user-level memory dir),
+  // the caller declares it explicitly; the sandbox baseline stays at the project root.
+  allowExtraRoot(path) {
+    this.sandbox.addRoot(path);
+  }
+  // Persist a scoped "allow always" rule.
+  // - File path: parent directory + `/*` (a directory path uses itself + `/*`).
+  // - Command: first 1-2 words + `*` so it allows that command family.
+  allowAlways(toolName, args) {
+    const content = extractContent(toolName, args);
+    const isFilePath = toolName === "ReadFile" || toolName === "WriteFile" || toolName === "EditFile";
+    let pattern;
+    if (isFilePath && content) {
+      const abs = resolve(content);
+      let isDir = false;
+      try {
+        isDir = statSync(abs).isDirectory();
+      } catch {
+      }
+      pattern = join(isDir ? abs : dirname(abs), "*");
+    } else {
+      const words = content.trim().split(/\s+/).slice(0, 2);
+      pattern = words.join(" ") + "*";
+    }
+    this.ruleEngine.appendLocalRule({
+      tool: toolName,
+      pattern,
+      effect: "allow"
+    });
+  }
+  /**
+   * Generate a human-readable description of the tool action for display in HITL confirmation dialogs.
+   * Prioritizes extracting fields defined in contentFields (e.g., command, file_path);
+   * falls back to a key:value summary of parameters if no match is found.
+   */
+  describeToolAction(toolName, args) {
+    const content = extractContent(toolName, args);
+    if (content) {
+      return content;
+    }
+    const parts = [];
+    for (const [k, v] of Object.entries(args)) {
+      let s = String(v);
+      if (s.length > 80) {
+        s = s.slice(0, 80) + "...";
+      }
+      parts.push(`${k}: ${s}`);
+    }
+    return parts.join(", ");
+  }
+};
+
+export {
+  extractContent,
+  PathSandbox,
+  evaluateRules,
+  RuleEngine,
+  isSafeCommand,
+  PermissionChecker
+};

package/dist/lib/chunk-HK2Z6WP4.js

@@ -0,0 +1,223 @@
+import {
+  MCP_CALL_TOOL_NAME,
+  TOOL_SEARCH_TOOL_NAME
+} from "./chunk-GHF2PSEW.js";
+
+// src/tools/registry.ts
+var ToolRegistry = class {
+  tools = /* @__PURE__ */ new Map();
+  discovered = /* @__PURE__ */ new Set();
+  /**
+   * How MCP tools are loaded, written by mcp/strategy after connecting to the
+   * server. ToolSearch relies on it to decide what to return, and the client
+   * relies on it to decide whether to send defer_loading. It stays eager when
+   * there is no MCP, which behaves the same as no deferral.
+   */
+  mcpLoadingMode = "eager";
+  /**
+   * Whether to expose the search and dispatch tools to the model is computed once
+   * by applyMode in mcp/strategy at session start. It is not recomputed each turn
+   * based on "are there still deferred tools": tools may be disabled at runtime,
+   * and recomputing would drop one from tools[] mid-session — that's an array
+   * change, which breaks the cache prefix just the same.
+   */
+  exposeToolSearch = false;
+  exposeMcpCall = false;
+  register(tool) {
+    this.tools.set(tool.name, tool);
+  }
+  get(name) {
+    return this.tools.get(name);
+  }
+  listTools() {
+    return [...this.tools.values()];
+  }
+  getAllSchemas(protocol = "anthropic") {
+    const isOpenAI = protocol === "openai" || protocol === "openai-compat";
+    const native = this.mcpLoadingMode === "native" && !isOpenAI;
+    const schemas = [];
+    for (const tool of this.tools.values()) {
+      if (tool.name === TOOL_SEARCH_TOOL_NAME && !this.exposeToolSearch || tool.name === MCP_CALL_TOOL_NAME && !this.exposeMcpCall) {
+        continue;
+      }
+      const deferred = Boolean(tool.deferred) && !this.discovered.has(tool.name);
+      if (deferred && !native) {
+        continue;
+      }
+      const s = tool.schema();
+      if (isOpenAI) {
+        schemas.push({
+          strict: false,
+          // Whether to enforce strict parameter validation. Default true.
+          type: "function",
+          name: s.name,
+          description: s.description,
+          parameters: s.input_schema,
+          // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+          // @ts-ignore
+          function: {
+            name: s.name,
+            description: s.description,
+            parameters: s.input_schema
+          }
+        });
+      } else {
+        schemas.push(
+          deferred ? {
+            ...s,
+            type: "custom",
+            defer_loading: true
+          } : {
+            ...s,
+            type: "custom"
+          }
+        );
+      }
+    }
+    return schemas;
+  }
+  /**
+   * Names of deferred tools not yet discovered, in lexicographic order.
+   *
+   * Sorting is not cosmetic: callers compare this list to detect pool changes;
+   * unstable ordering would produce different text for the same set of tools
+   * and break the comparison.
+   */
+  getDeferredToolNames() {
+    const names = [];
+    for (const tool of this.tools.values()) {
+      if (tool.deferred && !this.discovered.has(tool.name)) {
+        names.push(tool.name);
+      }
+    }
+    return names.sort();
+  }
+  getDeferredTools() {
+    return [...this.tools.values()].filter((t) => t.deferred && !this.discovered.has(t.name));
+  }
+  searchDeferred(query, maxResults = 5) {
+    const lower = query.toLowerCase();
+    const matches = [];
+    for (const tool of this.tools.values()) {
+      if (!tool.deferred || this.discovered.has(tool.name)) {
+        continue;
+      }
+      if (tool.name.toLowerCase().includes(lower) || tool.description.toLowerCase().includes(lower)) {
+        matches.push(tool);
+        if (matches.length >= maxResults) {
+          break;
+        }
+      }
+    }
+    return matches;
+  }
+  findDeferredByNames(names) {
+    const lowerMap = /* @__PURE__ */ new Map();
+    for (const [name, tool] of this.tools) {
+      lowerMap.set(name.toLowerCase(), tool);
+    }
+    return names.map((n) => lowerMap.get(n.toLowerCase())).filter((t) => t?.deferred ?? false);
+  }
+  markDiscovered(name) {
+    this.discovered.add(name);
+  }
+  isDiscovered(name) {
+    return this.discovered.has(name);
+  }
+};
+
+// src/subagent/tool-filter.ts
+var SUBAGENT_DISALLOWED_TOOLS = /* @__PURE__ */ new Set([
+  "ExitPlanMode",
+  "Agent",
+  // Prevents recursive spawning of subagents
+  "AskUserQuestion",
+  "TaskStop"
+]);
+var TEAMMATE_DISALLOWED_TOOLS = /* @__PURE__ */ new Set(["TeamCreate", "TeamDelete"]);
+var CUSTOM_AGENT_DISALLOWED_TOOLS = /* @__PURE__ */ new Set([
+  "ExitPlanMode",
+  "Agent",
+  "AskUserQuestion",
+  "TaskStop"
+]);
+var ASYNC_AGENT_ALLOWED_TOOLS = /* @__PURE__ */ new Set([
+  "ReadFile",
+  // "WebSearch",
+  "Grep",
+  "Glob",
+  "Bash",
+  "PowerShell",
+  "EditFile",
+  "WriteFile",
+  "LoadSkill",
+  "SyntheticOutput",
+  "ToolSearch",
+  "EnterWorktree",
+  "ExitWorktree",
+  // ToolSearch only reads out schemas; actual invocation relies on McpCall.
+  // The two must be allowed together, or the subagent sees tools but cannot call them
+  "McpCall"
+]);
+function isMCPTool(name) {
+  return name.startsWith("mcp__");
+}
+function filterToolsForAgent(registry, allowedTools, disallowedTools, isAsync, isCustom = false) {
+  const disallowed = new Set(disallowedTools ?? []);
+  const allowed = new Set(allowedTools ?? []);
+  const hasWhitelist = allowed.size > 0 && !(allowed.size === 1 && allowed.has("*"));
+  const filtered = new ToolRegistry();
+  for (const tool of registry.listTools()) {
+    const name = tool.name;
+    if (isMCPTool(name)) {
+      filtered.register(tool);
+      continue;
+    }
+    if (SUBAGENT_DISALLOWED_TOOLS.has(name)) {
+      continue;
+    }
+    if (isCustom && CUSTOM_AGENT_DISALLOWED_TOOLS.has(name)) {
+      continue;
+    }
+    if (isAsync && !ASYNC_AGENT_ALLOWED_TOOLS.has(name)) {
+      continue;
+    }
+    if (disallowed.has(name)) {
+      continue;
+    }
+    if (hasWhitelist && !allowed.has(name)) {
+      continue;
+    }
+    filtered.register(tool);
+  }
+  return filtered;
+}
+var FORK_QUERY_SOURCE = "agent:builtin:fork";
+function cloneRegistryForFork(registry) {
+  const forked = new ToolRegistry();
+  for (const tool of registry.listTools()) {
+    if (tool.name === "Agent" && "querySource" in tool) {
+      const clone = Object.create(
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
+        Object.getPrototypeOf(tool),
+        Object.getOwnPropertyDescriptors(tool)
+      );
+      clone.querySource = FORK_QUERY_SOURCE;
+      forked.register(clone);
+    } else {
+      forked.register(tool);
+    }
+  }
+  return forked;
+}
+
+export {
+  ToolRegistry,
+  SUBAGENT_DISALLOWED_TOOLS,
+  TEAMMATE_DISALLOWED_TOOLS,
+  CUSTOM_AGENT_DISALLOWED_TOOLS,
+  ASYNC_AGENT_ALLOWED_TOOLS,
+  filterToolsForAgent,
+  FORK_QUERY_SOURCE,
+  cloneRegistryForFork
+};