@swifty.js/swifty 0.0.26 → 0.0.28

package/dist/chunk-WX3B64R4.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { createRequire as __swiftyCreateRequire } from "node:module";
+const require = __swiftyCreateRequire(import.meta.url);
+import{D as n,I as S,b as g,c as _,d as b}from"./chunk-OTVZGPHD.js";import{existsSync as D,readFileSync as $}from"fs";import{homedir as L}from"os";import{join as h}from"path";function m(e){return!!e._zod}function l(e,o){return m(e)?g(e,o):e.safeParse(o)}async function pe(e,o){return m(e)?await _(e,o):await e.safeParseAsync(o)}function ue(e){if(!e)return;let o;if(m(e)?o=e._zod?.def?.shape:o=e.shape,!!o){if(typeof o=="function")try{return o()}catch{return}return o}}function de(e){if(m(e)){let i=e._zod?.def;if(i){if(i.value!==void 0)return i.value;if(Array.isArray(i.values)&&i.values.length>0)return i.values[0]}}let t=e._def;if(t){if(t.value!==void 0)return t.value;if(Array.isArray(t.values)&&t.values.length>0)return t.values[0]}let r=e.value;if(r!==void 0)return r}var w=S({module:"config"}),j={anthropic:"ANTHROPIC_API_KEY",openai:"OPENAI_API_KEY","openai-compat":"OPENAI_API_KEY"};function V(e){return y.has(e)}var y=new Set(Object.keys(j)),p=class extends Error{constructor(o){super(o),this.name="ConfigError"}},T=n.object({name:n.string(),protocol:n.enum(["anthropic","openai","openai-compat"]),base_url:n.string(),model:n.string(),api_key:n.string().optional(),thinking:n.boolean().optional(),context_window:n.coerce.number().optional(),max_output_tokens:n.coerce.number().optional()}),K=!0,k=1e6,P=128e3;function A(e){return{...e,thinking:e.thinking??K,context_window:Y(e),max_output_tokens:F(e)}}function Y(e){return Number.isSafeInteger(e.context_window)&&(e.context_window??0)>0?e.context_window??k:k}function F(e){return Number.isSafeInteger(e.max_output_tokens)&&(e.max_output_tokens??0)>0?e.max_output_tokens??P:P}function Se(e){if(e.api_key)return e.api_key;let o=V(e.protocol)?j[e.protocol]:"";return o?process.env[o]??"":""}var O=n.object({name:n.string(),command:n.string().optional(),args:n.array(n.string()).optional(),url:n.string().optional(),transport:n.string().optional(),headers:n.record(n.string(),n.string()).optional(),env:n.record(n.string(),n.string()).optional()}),M=n.object({id:n.string().optional(),event:n.string(),condition:n.string().optional(),action:n.object({type:n.string(),command:n.string().optional(),url:n.string().optional(),method:n.string().optional(),prompt:n.string().optional()}),reject:n.boolean().optional(),once:n.boolean().optional(),async:n.boolean().optional(),on_error:n.string().optional()}),z=n.object({enabled:n.boolean().optional(),auto_allow:n.boolean().optional(),network_enabled:n.boolean().optional()}),H=n.looseObject({providers:n.array(T),permission_mode:n.string().optional(),mcp_servers:n.array(O).default([]),hooks:n.array(M).default([]),sandbox:z.optional(),enable_coordinator_mode:n.boolean().optional(),enable_fork:n.boolean().optional()});function we(e){return e.enable_fork!==!1}function B(e){return typeof e=="object"&&e!==null}function C(e){let o=$(e,"utf-8"),t=b.load(o);if(!B(t))return w.error({path:e},"invalid yaml"),{providers:[],mcp_servers:[],hooks:[]};let r=l(H,t);if(r.success){let f=r.data;return{...f,providers:f.providers.map(A)}}w.error({error:r.error},"config error");let a=[],i,c=[],s=[],d,v=!1,x=!0;if("providers"in t){let f=l(n.array(T),t.providers);f.success&&(a=f.data.map(A))}if("permission_mode"in t&&typeof t.permission_mode=="string"&&(i=t.permission_mode),"mcp_servers"in t){let f=l(n.array(O),t.mcp_servers);f.success&&(c=f.data)}if("hooks"in t){let f=l(n.array(M),t.hooks);f.success&&(s=f.data)}if("sandbox"in t){let f=l(z,t.sandbox);f.success&&(d=f.data)}return"enable_coordinator_mode"in t&&(v=!!t.enable_coordinator_mode),"enable_fork"in t&&(x=!!t.enable_fork),{providers:a,permission_mode:i,mcp_servers:c,hooks:s,sandbox:d,enable_coordinator_mode:v,enable_fork:x}}function W(e,o){if(o.providers.length>0&&(e.providers=o.providers),o.permission_mode&&(e.permission_mode=o.permission_mode),o.mcp_servers.length>0){let t=new Map;for(let r=0;r<e.mcp_servers.length;r++){let a=e.mcp_servers[r];t.set(a.name,r)}for(let r of o.mcp_servers){let a=t.get(r.name);a!==void 0?e.mcp_servers[a]=r:(e.mcp_servers.push(r),t.set(r.name,e.mcp_servers.length-1))}}return e.hooks=[...e.hooks,...o.hooks],o.sandbox&&(e.sandbox={...e.sandbox,...o.sandbox}),o.enable_coordinator_mode&&(e.enable_coordinator_mode=!0),o.enable_fork!==void 0&&(e.enable_fork=o.enable_fork),e}function E(e){if(e.providers.length===0)throw new p("At least one provider MUST be configured.");let o=["name","protocol","base_url","model"];for(let t=0;t<e.providers.length;t++){let r=e.providers[t],a={name:r.name,protocol:r.protocol,base_url:r.base_url,model:r.model},i=o.filter(c=>!a[c].trim());if(i.length>0)throw new p(`Provider #${String(t+1)}: missing fields: ${i.join(", ")}`);if(!y.has(r.protocol))throw new p(`Provider #${String(t+1)}: invalid protocol '${r.protocol}', MUST be one of: ${Array.from(y).join(", ")}`)}}function ke(e,o={}){if(e){let c=C(e);return(!o.allowEmptyProviders||c.providers.length>0)&&E(c),c}let t=process.cwd(),r=L(),a=[h(r,".swifty","config.yaml"),h(t,".swifty","config.yaml"),h(t,".swifty","config.local.yaml")],i=null;for(let c of a){if(!D(c))continue;let s=C(c);i?i=W(i,s):i=s}if(!i){if(o.allowEmptyProviders)return{providers:[],mcp_servers:[],hooks:[]};throw new p("No config file found, expected .swifty/config.y(a)ml under project or $HOME/.swifty/config.y(a)ml.")}return(!o.allowEmptyProviders||i.providers.length>0)&&E(i),i}var u=class extends Error{constructor(o){super(o),this.name="LLMError"}},I=class extends u{constructor(o){super(o),this.name="AuthenticationError"}},R=class extends u{retryAfter;constructor(o,t){super(o),this.name="RateLimitError",this.retryAfter=t}},N=class extends u{constructor(o){super(o),this.name="NetworkError"}},U=class extends u{constructor(o){super(o),this.name="ContextTooLongError"}};var Z="Tool execution was interrupted. The tool may or may not have completed; verify before relying on its effects.",Ce="The user rejected this tool use. Nothing was changed (for file edits, the new content was NOT written).";function Ee(e){let o=[];for(let t=0;t<e.length;t++){let r=e[t];if(r.role==="assistant"&&r.toolUses?.length){o.push(r);let a=new Set(r.toolUses.map(s=>s.toolUseId)),i=[],c=[];for(;t+1<e.length;){let s=e[t+1];if(s.role!=="user"||!s.toolResults?.length||s.toolUses?.length)break;t++,c.push(s);for(let d of s.toolResults)a.delete(d.toolUseId)&&i.push(d)}for(let s of a)i.push({toolUseId:s,content:Z,isError:!0});o.push({...c[0]??{role:"user",content:""},toolResults:i});for(let s of c.slice(1))(s.content.length>0||s.thinkingBlocks?.length)&&o.push({...s,toolResults:[]});continue}if((r.toolResults?.length??0)>0){if(r.content.length===0&&!r.toolUses?.length&&!r.thinkingBlocks?.length)continue;o.push({...r,toolResults:[]})}else o.push(r)}return o}export{l as a,pe as b,ue as c,de as d,T as e,K as f,k as g,P as h,Y as i,F as j,Se as k,we as l,ke as m,u as n,I as o,R as p,N as q,U as r,Ce as s,Ee as t};

package/dist/chunk-Y6SQB5FG.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { createRequire as __swiftyCreateRequire } from "node:module";
+const require = __swiftyCreateRequire(import.meta.url);
+import{a as T,b as f}from"./chunk-E55KH72M.js";var c=class{tools=new Map;discovered=new Set;mcpLoadingMode="eager";exposeToolSearch=!1;exposeMcpCall=!1;register(e){this.tools.set(e.name,e)}get(e){return this.tools.get(e)}listTools(){return[...this.tools.values()]}getAllSchemas(e="anthropic"){let o=e==="openai"||e==="openai-compat",t=this.mcpLoadingMode==="native"&&!o,n=[];for(let s of this.tools.values()){if(s.name===T&&!this.exposeToolSearch||s.name===f&&!this.exposeMcpCall)continue;let a=!!s.deferred&&!this.discovered.has(s.name);if(a&&!t)continue;let r=s.schema();o?n.push({strict:!1,type:"function",name:r.name,description:r.description,parameters:r.input_schema,function:{name:r.name,description:r.description,parameters:r.input_schema}}):n.push(a?{...r,type:"custom",defer_loading:!0}:{...r,type:"custom"})}return n}getDeferredToolNames(){let e=[];for(let o of this.tools.values())o.deferred&&!this.discovered.has(o.name)&&e.push(o.name);return e.sort()}getDeferredTools(){return[...this.tools.values()].filter(e=>e.deferred&&!this.discovered.has(e.name))}searchDeferred(e,o=5){let t=e.toLowerCase(),n=[];for(let s of this.tools.values())if(!(!s.deferred||this.discovered.has(s.name))&&(s.name.toLowerCase().includes(t)||s.description.toLowerCase().includes(t))&&(n.push(s),n.length>=o))break;return n}findDeferredByNames(e){let o=new Map;for(let[t,n]of this.tools)o.set(t.toLowerCase(),n);return e.map(t=>o.get(t.toLowerCase())).filter(t=>t?.deferred??!1)}markDiscovered(e){this.discovered.add(e)}isDiscovered(e){return this.discovered.has(e)}};var h=new Set(["ExitPlanMode","Agent","AskUserQuestion","TaskStop"]),M=new Set(["TeamCreate","TeamDelete"]),m=new Set(["ExitPlanMode","Agent","AskUserQuestion","TaskStop"]),u=new Set(["ReadFile","Grep","Glob","Bash","PowerShell","EditFile","WriteFile","LoadSkill","SyntheticOutput","ToolSearch","EnterWorktree","ExitWorktree","McpCall"]);function g(i){return i.startsWith("mcp__")}function w(i,e,o,t,n=!1){let s=new Set(o??[]),a=new Set(e??[]),r=a.size>0&&!(a.size===1&&a.has("*")),p=new c;p.mcpLoadingMode=i.mcpLoadingMode;for(let d of i.listTools()){let l=d.name;if(g(l)){!s.has(l)&&(!r||a.has(l))&&p.register(d);continue}h.has(l)||n&&m.has(l)||t&&!u.has(l)||s.has(l)||r&&!a.has(l)||p.register(d)}return p}var A="agent:builtin:fork";function k(i){let e=new c;e.mcpLoadingMode=i.mcpLoadingMode;for(let o of i.listTools())if(o.name==="Agent"&&"querySource"in o){let t=Object.create(Object.getPrototypeOf(o),Object.getOwnPropertyDescriptors(o));t.querySource=A,e.register(t)}else e.register(o);return e}export{c as a,h as b,M as c,m as d,u as e,w as f,A as g,k as h};

package/dist/{devtools-3OAJUZGE.js → devtools-OJ75EP3T.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire as __swiftyCreateRequire } from "node:module";
 const require = __swiftyCreateRequire(import.meta.url);
-import{c as t}from"./chunk-XBHVVB5A.js";import"./chunk-X3UA5OZL.js";var n=globalThis;n.WebSocket||=t;n.window||=globalThis;n.self||=globalThis;n.window.__REACT_DEVTOOLS_COMPONENT_FILTERS__=[{type:1,value:7,isEnabled:!0},{type:2,value:"InternalApp",isEnabled:!0,isValid:!0},{type:2,value:"InternalAppContext",isEnabled:!0,isValid:!0},{type:2,value:"InternalStdoutContext",isEnabled:!0,isValid:!0},{type:2,value:"InternalStderrContext",isEnabled:!0,isValid:!0},{type:2,value:"InternalStdinContext",isEnabled:!0,isValid:!0},{type:2,value:"InternalFocusContext",isEnabled:!0,isValid:!0}];import a from"react-devtools-core";var l=async()=>new Promise(o=>{let e=new t("ws://localhost:8097"),i=setTimeout(()=>{e.terminate(),o(!1)},2e3);i.unref(),e.on("open",()=>{clearTimeout(i),e.terminate(),o(!0)}),e.on("error",()=>{clearTimeout(i),e.terminate(),o(!1)})});await l()?(a.initialize(),a.connectToDevTools()):console.warn(`DEV is set to true, but the React DevTools server is not running. Start it with:
+import{c as t}from"./chunk-FPQ2LBL4.js";import"./chunk-X3UA5OZL.js";var n=globalThis;n.WebSocket||=t;n.window||=globalThis;n.self||=globalThis;n.window.__REACT_DEVTOOLS_COMPONENT_FILTERS__=[{type:1,value:7,isEnabled:!0},{type:2,value:"InternalApp",isEnabled:!0,isValid:!0},{type:2,value:"InternalAppContext",isEnabled:!0,isValid:!0},{type:2,value:"InternalStdoutContext",isEnabled:!0,isValid:!0},{type:2,value:"InternalStderrContext",isEnabled:!0,isValid:!0},{type:2,value:"InternalStdinContext",isEnabled:!0,isValid:!0},{type:2,value:"InternalFocusContext",isEnabled:!0,isValid:!0}];import a from"react-devtools-core";var l=async()=>new Promise(o=>{let e=new t("ws://localhost:8097"),i=setTimeout(()=>{e.terminate(),o(!1)},2e3);i.unref(),e.on("open",()=>{clearTimeout(i),e.terminate(),o(!0)}),e.on("error",()=>{clearTimeout(i),e.terminate(),o(!1)})});await l()?(a.initialize(),a.connectToDevTools()):console.warn(`DEV is set to true, but the React DevTools server is not running. Start it with:
 
 $ npx react-devtools
 `);

package/dist/lib/agent-XYO2MXXK.js

@@ -0,0 +1,11 @@
+import {
+  Agent
+} from "./chunk-DV6RV5WU.js";
+import "./chunk-IB5IQK2S.js";
+import "./chunk-FBSPZQGC.js";
+import "./chunk-KG4MJGKQ.js";
+import "./chunk-EY7HE52Q.js";
+import "./chunk-GHF2PSEW.js";
+export {
+  Agent
+};

package/dist/lib/{anthropic-RYPJDHQM.js → anthropic-TGJGAP5R.js}

@@ -5,11 +5,10 @@ import {
   markLastUserTailForCache,
   markToolsForCache,
   needsToolSearchBeta
-} from "./chunk-2AUSNVIB.js";
-import "./chunk-2QILP24G.js";
-import "./chunk-3LU4APFB.js";
-import "./chunk-OO2CLOEE.js";
-import "./chunk-PZ42NAFA.js";
+} from "./chunk-ALJAVRRX.js";
+import "./chunk-IB5IQK2S.js";
+import "./chunk-FBSPZQGC.js";
+import "./chunk-KG4MJGKQ.js";
 import "./chunk-EY7HE52Q.js";
 import "./chunk-GHF2PSEW.js";
 export {

package/dist/lib/{checker-6BW4222R.js → checker-AXHPKVBY.js}

@@ -5,8 +5,8 @@ import {
   evaluateRules,
   extractContent,
   isSafeCommand
-} from "./chunk-GNI7YX6F.js";
-import "./chunk-PZ42NAFA.js";
+} from "./chunk-DJ6AILPN.js";
+import "./chunk-KG4MJGKQ.js";
 import "./chunk-EY7HE52Q.js";
 import "./chunk-GHF2PSEW.js";
 export {

package/dist/lib/{chunk-HK2Z6WP4.js → chunk-2IVEVG5N.js}

@@ -167,10 +167,13 @@ function filterToolsForAgent(registry, allowedTools, disallowedTools, isAsync, i
   const allowed = new Set(allowedTools ?? []);
   const hasWhitelist = allowed.size > 0 && !(allowed.size === 1 && allowed.has("*"));
   const filtered = new ToolRegistry();
+  filtered.mcpLoadingMode = registry.mcpLoadingMode;
   for (const tool of registry.listTools()) {
     const name = tool.name;
     if (isMCPTool(name)) {
-      filtered.register(tool);
+      if (!disallowed.has(name) && (!hasWhitelist || allowed.has(name))) {
+        filtered.register(tool);
+      }
       continue;
     }
     if (SUBAGENT_DISALLOWED_TOOLS.has(name)) {
@@ -195,6 +198,7 @@ function filterToolsForAgent(registry, allowedTools, disallowedTools, isAsync, i
 var FORK_QUERY_SOURCE = "agent:builtin:fork";
 function cloneRegistryForFork(registry) {
   const forked = new ToolRegistry();
+  forked.mcpLoadingMode = registry.mcpLoadingMode;
   for (const tool of registry.listTools()) {
     if (tool.name === "Agent" && "querySource" in tool) {
       const clone = Object.create(

package/dist/lib/{chunk-2AUSNVIB.js → chunk-ALJAVRRX.js}

@@ -1,30 +1,29 @@
 import {
-  computeCompactThreshold
-} from "./chunk-2QILP24G.js";
-import {
-  getContextWindow,
-  getMaxOutputTokens,
-  resolveAPIKey
-} from "./chunk-3LU4APFB.js";
+  normalizeToolResultContentBlock
+} from "./chunk-IB5IQK2S.js";
 import {
   AuthenticationError,
   ContextTooLongError,
+  DEFAULT_PROVIDER_THINKING,
   LLMError,
   NetworkError,
   RateLimitError,
-  ensureToolPairing
-} from "./chunk-OO2CLOEE.js";
+  ensureToolPairing,
+  getMaxOutputTokens,
+  resolveAPIKey
+} from "./chunk-FBSPZQGC.js";
 import {
   MCP_TOOL_PREFIX,
   isMcpToolLike
-} from "./chunk-PZ42NAFA.js";
+} from "./chunk-KG4MJGKQ.js";
 import {
   asErrorString,
   asRecord,
   asString,
   contentToText,
   createChildLogger,
-  isRecord
+  isRecord,
+  strArg
 } from "./chunk-EY7HE52Q.js";
 
 // src/llm/anthropic.ts
@@ -152,14 +151,17 @@ async function fetchModelContextWindow(config) {
     clearTimeout(timer);
   }
 }
-function supportsAdaptiveThinking() {
-  return true;
-}
 function userBlocksFor(content) {
   if (typeof content === "string") {
     return [{ type: "text", text: content }];
   }
-  return content;
+  return content.map((raw) => {
+    const block = normalizeToolResultContentBlock(raw);
+    if (!block || block.type === "tool_reference") {
+      throw new Error(`Unsupported user content block: ${strArg(raw, "type", "unknown")}`);
+    }
+    return block;
+  });
 }
 function buildAnthropicMessages(messages) {
   const result = [];
@@ -208,6 +210,9 @@ function buildAnthropicMessages(messages) {
           content: tr.contentBlocks?.length ? tr.contentBlocks : tr.content
         });
       }
+      if (m.content.length > 0) {
+        blocks.push(...userBlocksFor(m.content));
+      }
       result.push({ role: "user", content: blocks });
     } else {
       if (result.length === 0) {
@@ -254,7 +259,6 @@ var AnthropicClient = class {
   systemPrompt;
   maxOutputTokens;
   /** Currently not used */
-  contextWindow;
   constructor(config, systemPrompt) {
     const apiKey = resolveAPIKey(config);
     if (!apiKey) {
@@ -267,10 +271,9 @@ var AnthropicClient = class {
       baseURL: config.base_url
     });
     this.model = config.model;
-    this.thinking = config.thinking ?? true;
+    this.thinking = config.thinking ?? DEFAULT_PROVIDER_THINKING;
     this.systemPrompt = systemPrompt;
     this.maxOutputTokens = getMaxOutputTokens(config);
-    this.contextWindow = getContextWindow(config);
   }
   setSystemPrompt(prompt) {
     this.systemPrompt = prompt;
@@ -316,19 +319,7 @@ var AnthropicClient = class {
       messages,
       ...antToolSchemas.length > 0 ? { tools: antToolSchemas } : {}
     };
-    if (this.thinking) {
-      if (supportsAdaptiveThinking()) {
-        params.thinking = {
-          type: "enabled",
-          budget_tokens: computeCompactThreshold(this.contextWindow, this.maxOutputTokens)
-        };
-      }
-    } else {
-      params.thinking = {
-        type: "enabled",
-        budget_tokens: computeCompactThreshold(this.contextWindow, this.maxOutputTokens)
-      };
-    }
+    params.thinking = this.thinking && this.maxOutputTokens > 1024 ? { type: "enabled", budget_tokens: Math.min(16384, this.maxOutputTokens - 1) } : { type: "disabled" };
     let inputTokens = 0;
     let outputTokens = 0;
     let cacheReadInputTokens = 0;
@@ -377,7 +368,7 @@ var AnthropicClient = class {
                 text: delta.thinking
               };
             } else if (delta.type === "signature_delta") {
-              thinkingSignature = delta.signature;
+              thinkingSignature += delta.signature;
             } else if (delta.type === "text_delta") {
               yield {
                 type: "text_delta",
@@ -497,6 +488,7 @@ function markLastUserTailForCache(messages) {
     Reflect.set(last, "cache_control", {
       type: "ephemeral"
     });
+    return;
   }
 }
 function classifyAnthropicError(err) {
@@ -508,14 +500,16 @@ function classifyAnthropicError(err) {
       return new AuthenticationError(`Invalid API key: ${err.message}`);
     }
     if (err.status === 429 /* RateLimitError */) {
-      const retryAfter = asRecord(err.headers)["retry-after"];
+      const headers = err.headers;
+      const retryAfter = headers instanceof Headers ? headers.get("retry-after") : void 0;
       let message = "Rate Limited";
       if (retryAfter) {
         const s = Number.parseInt(asString(retryAfter));
         if (Number.isNaN(s)) {
           message += ", please wait.";
+        } else {
+          message += `, retry after ${asString(s)}s.`;
         }
-        message += `, retry after ${asString(s)}s.`;
       } else {
         message += ", please wait.";
       }

package/dist/lib/{chunk-GNI7YX6F.js → chunk-DJ6AILPN.js}

@@ -1,6 +1,6 @@
 import {
   mcpCallPermissionContent
-} from "./chunk-PZ42NAFA.js";
+} from "./chunk-KG4MJGKQ.js";
 import {
   createChildLogger,
   strArg
@@ -12,9 +12,38 @@ import {
 // src/permissions/checker.ts
 import { readFileSync, writeFileSync, mkdirSync, statSync } from "fs";
 import { homedir, tmpdir } from "os";
-import { join, resolve, dirname } from "path";
+import { join as join2, resolve as resolve2, dirname as dirname2 } from "path";
 import yaml from "js-yaml";
 import z, { parse } from "zod";
+
+// src/utils/paths.ts
+import { realpathSync } from "fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "path";
+function canonicalPath(path) {
+  let current = resolve(path);
+  const missing = [];
+  for (; ; ) {
+    try {
+      return join(realpathSync(current), ...missing);
+    } catch (error) {
+      if (!(error instanceof Error) || !("code" in error) || error.code !== "ENOENT" && error.code !== "ENOTDIR") {
+        throw error;
+      }
+      const parent = dirname(current);
+      if (parent === current) {
+        return resolve(path);
+      }
+      missing.unshift(basename(current));
+      current = parent;
+    }
+  }
+}
+function isPathWithin(root, path) {
+  const child = relative(root, path);
+  return child === "" || child !== ".." && !child.startsWith(`..${sep}`) && !isAbsolute(child);
+}
+
+// src/permissions/checker.ts
 var log = createChildLogger({ module: "permissions" });
 var DANGEROUS_PATTERNS = [];
 var SAFE_PREFIXES = [
@@ -56,7 +85,8 @@ var CONTENT_FIELDS = {
   WriteFile: "file_path",
   EditFile: "file_path",
   Glob: "pattern",
-  Grep: "pattern"
+  Grep: "pattern",
+  InstallSkill: "source"
 };
 var DEFAULT_DENY_WRITE = [
   ".swifty/config.yaml",
@@ -79,25 +109,26 @@ var PathSandbox = class {
   denyWritePaths;
   projectDir;
   constructor(projectDir) {
-    this.projectDir = resolve(projectDir);
+    this.projectDir = resolve2(projectDir);
     this.allowedRoots = [this.projectDir, tmpdir()];
-    this.denyWritePaths = DEFAULT_DENY_WRITE.map((p) => join(this.projectDir, p));
+    this.denyWritePaths = DEFAULT_DENY_WRITE.map((p) => join2(this.projectDir, p));
   }
   addRoot(root) {
-    this.allowedRoots.push(resolve(root));
+    this.allowedRoots.push(resolve2(root));
   }
   // Add custom deny-write paths
   addDenyWrite(path) {
-    this.denyWritePaths.push(resolve(path));
+    this.denyWritePaths.push(resolve2(path));
   }
   /**
    * Check whether a path is in the deny-write list.
    * denyWrite has the highest priority — even if the path is within an allowed root, writes are still denied.
    */
   checkDenyWrite(filePath) {
-    const absolute = resolve(filePath);
+    const absolute = resolve2(this.projectDir, filePath);
+    const canonical = canonicalPath(absolute);
     for (const denied of this.denyWritePaths) {
-      if (absolute.startsWith(denied)) {
+      if (isPathWithin(denied, absolute) || isPathWithin(canonicalPath(denied), canonical)) {
         return {
           effect: "deny",
           reason: `Path ${filePath} is in deny-write list`
@@ -107,9 +138,9 @@ var PathSandbox = class {
     return null;
   }
   check(filePath) {
-    const absolute = resolve(filePath);
+    const absolute = canonicalPath(resolve2(this.projectDir, filePath));
     for (const root of this.allowedRoots) {
-      if (absolute.startsWith(root)) {
+      if (isPathWithin(canonicalPath(root), absolute)) {
         return null;
       }
     }
@@ -190,9 +221,9 @@ var RuleEngine = class {
   localPath;
   cache = /* @__PURE__ */ new Map();
   constructor(workDir) {
-    this.userPath = join(homedir(), ".swifty", "permissions.yaml");
-    this.projectPath = join(workDir, ".swifty", "permissions.yaml");
-    this.localPath = join(workDir, ".swifty", "permissions.local.yaml");
+    this.userPath = join2(homedir(), ".swifty", "permissions.yaml");
+    this.projectPath = join2(workDir, ".swifty", "permissions.yaml");
+    this.localPath = join2(workDir, ".swifty", "permissions.local.yaml");
   }
   // Read a single rules file; skips disk I/O and parsing on cache hit.
   rulesFor(path) {
@@ -229,7 +260,7 @@ var RuleEngine = class {
   // Persists a rule to the project-local YAML file in the `Tool(pattern)`
   // format so "allow always" survives a restart.
   appendLocalRule(rule) {
-    mkdirSync(dirname(this.localPath), { recursive: true });
+    mkdirSync(dirname2(this.localPath), { recursive: true });
     const rules = loadRulesFile(this.localPath);
     const exists = rules.some(
       (r) => r.tool === rule.tool && r.pattern === rule.pattern && r.effect === rule.effect
@@ -255,7 +286,7 @@ function detectDangerous(command) {
 }
 function isSafeCommand(command) {
   const trimmed = command.trim();
-  if (trimmed.includes(">") || trimmed.includes("|") || trimmed.includes(";") || trimmed.includes("&&") || trimmed.includes("$(") || trimmed.includes("`")) {
+  if (trimmed.includes(">") || trimmed.includes("<") || /[\r\n&]/.test(trimmed) || trimmed.includes("|") || trimmed.includes(";") || trimmed.includes("&&") || trimmed.includes("$(") || trimmed.includes("`")) {
     return false;
   }
   return SAFE_PREFIXES.some(
@@ -275,7 +306,14 @@ function modeDecide(mode, category) {
       return category === "read" ? "allow" : "ask";
   }
 }
-var PermissionChecker = class {
+var PermissionChecker = class _PermissionChecker {
+  constructor(workDir, mode = "default") {
+    this.workDir = workDir;
+    this.mode = mode;
+    this.sandbox = new PathSandbox(workDir);
+    this.ruleEngine = new RuleEngine(workDir);
+  }
+  workDir;
   mode;
   planFilePath = "";
   // Sandbox mode: when enabled, command-category tools run through OS sandbox isolation, with optional auto-allow
@@ -283,18 +321,24 @@ var PermissionChecker = class {
   sandboxAutoAllow = false;
   sandbox;
   ruleEngine;
-  constructor(workDir, mode = "default") {
-    this.mode = mode;
-    this.sandbox = new PathSandbox(workDir);
-    this.ruleEngine = new RuleEngine(workDir);
+  forWorkDir(workDir) {
+    const checker = new _PermissionChecker(workDir, this.mode);
+    checker.ruleEngine = this.ruleEngine;
+    checker.sandboxEnabled = this.sandboxEnabled;
+    checker.sandboxAutoAllow = this.sandboxAutoAllow;
+    return checker;
   }
   check(toolName, category, args) {
     const content = extractContent(toolName, args);
     let snapshot = null;
     const rules = () => snapshot ??= this.ruleEngine.snapshot();
+    const explicitEffect = evaluateRules(rules(), toolName, content);
+    if (explicitEffect === "deny" || explicitEffect === "ask") {
+      return { effect: explicitEffect, reason: `Permission rule: ${explicitEffect}` };
+    }
     if (this.mode === "plan" && (toolName === "WriteFile" || toolName === "EditFile")) {
       const path = strArg(args, "file_path", "");
-      if (path.includes(".swifty/plans/")) {
+      if (this.planFilePath && canonicalPath(resolve2(this.workDir, path)) === canonicalPath(resolve2(this.workDir, this.planFilePath)) && !this.sandbox.checkDenyWrite(path)) {
         return {
           effect: "allow",
           reason: "Plan file write allowed in plan mode"
@@ -377,13 +421,13 @@ var PermissionChecker = class {
     const isFilePath = toolName === "ReadFile" || toolName === "WriteFile" || toolName === "EditFile";
     let pattern;
     if (isFilePath && content) {
-      const abs = resolve(content);
+      const abs = resolve2(this.workDir, content);
       let isDir = false;
       try {
         isDir = statSync(abs).isDirectory();
       } catch {
       }
-      pattern = join(isDir ? abs : dirname(abs), "*");
+      pattern = join2(isDir ? abs : dirname2(abs), "*");
     } else {
       const words = content.trim().split(/\s+/).slice(0, 2);
       pattern = words.join(" ") + "*";
@@ -417,6 +461,8 @@ var PermissionChecker = class {
 };
 
 export {
+  canonicalPath,
+  isPathWithin,
   extractContent,
   PathSandbox,
   evaluateRules,