@te-river/opencode-team-mode 1.5.0 → 1.5.2

package/dist/agents.js

@@ -23,6 +23,75 @@
  *  - All agents run at temperature 0.2 for format discipline.
  */
 /* ------------------------------------------------------------------ */
+/*  Tool whitelist builder (Phase 2 / T2.1, G2 ruling "方案甲")        */
+/* ------------------------------------------------------------------ */
+/**
+ * Builds the permission block that IS the agent's tool whitelist.
+ *
+ * Verified live (T0.4③): a "deny" permission removes the built-in tool
+ * from the model's tool surface entirely — zero bypass, zero hallucinated
+ * calls.  So a whitelist = deny every excluded built-in + allow the kept
+ * set, exactly the shape the D6 probe validated
+ * (%TEMP%/opencode/tm-probe/workspace/opencode.json).
+ *
+ * G2 rulings baked in:
+ *  - glob/list never enter the whitelist — file enumeration goes through
+ *    tm_bash (ls / dir / Get-ChildItem);
+ *  - webfetch/websearch excluded network-wide (P5 network zero);
+ *  - "tm_*" covers exactly the four governed tools (tm_read / tm_grep /
+ *    tm_bash / tm_fetch); the R6 env-protection hook aliases onto them
+ *    unchanged, so narrowing the surface does not weaken the anti-backdoor
+ *    chain.
+ *
+ * T2.1 review revision (Critical fix): the built-in bash RETURNS for the
+ * execution roles (team / implementer / reviewer / tester).  G2 only ruled
+ * that glob/list enumeration goes through tm_bash — it never ruled away
+ * command execution, and tm_bash is a read-only allowlist that cannot run
+ * npm test / tsc / --help probes.  R6 keeps governing bash's env surface
+ * through the envprotect hook, independently of this matrix.
+ */
+const NEVER_ALLOWED = [
+    "read",
+    "grep",
+    "glob",
+    "list",
+    "apply_patch",
+    "webfetch",
+    "websearch",
+    "todowrite",
+    "lsp",
+    "skill",
+    "question",
+];
+/** Built-ins granted per agent; every one NOT granted is denied. */
+const PER_AGENT_TOOLS = ["edit", "write", "task", "bash"];
+/** The governed tools, named explicitly next to the "tm_*" wildcard
+ *  (belt-and-braces: the explicit allows survive even if a host ever
+ *  stops expanding the wildcard). */
+const TM_TOOLS = ["tm_read", "tm_grep", "tm_bash", "tm_fetch"];
+/** M3: tm_ptc_run — explicit per-agent grant (five specialists = allow,
+ *  team = deny to override the tm_* wildcard).  Design §3: PTC is a
+ *  governed, read-only bridge; the team lead orchestrates, it does not
+ *  run batch programs itself. */
+const PTC_TOOL = "tm_ptc_run";
+const whitelist = (...granted) => {
+    const permission = {};
+    for (const tool of NEVER_ALLOWED)
+        permission[tool] = "deny";
+    for (const tool of PER_AGENT_TOOLS) {
+        permission[tool] = granted.includes(tool) ? "allow" : "deny";
+    }
+    for (const tool of TM_TOOLS)
+        permission[tool] = "allow";
+    permission["tm_*"] = "allow";
+    return permission;
+};
+/** Apply the M3 tm_ptc_run grant to an agent's permission block.  The five
+ *  specialists get `allow`; the team lead gets `deny` (overrides the wildcard). */
+function applyPtcPermission(permission, isTeamLead) {
+    permission[PTC_TOOL] = isTeamLead ? "deny" : "allow";
+}
+/* ------------------------------------------------------------------ */
 /*  Reply contract + hybrid blackboard (appended to every specialist)  */
 /* ------------------------------------------------------------------ */
 const REPLY_CONTRACT = `
@@ -74,8 +143,9 @@ process management every run.
 ## Triage — classify before acting (Step 0, always)
 - Question ≠ work order.  When the user asks, analyzes, or consults
   ("why does X fail?", "how would we do Y?"), ANSWER it — read code if
-  useful, change nothing.  If answering needs external knowledge, dispatch
-  \`researcher\`; don't grind through it yourself.
+  useful, change nothing.  If answering needs a deeper dig through the
+  codebase than your context affords, dispatch \`researcher\`; don't
+  grind through it yourself.
 - Spotted an obvious defect while answering?  Propose the fix and WAIT for
   the go-ahead — never fix-on-the-sly.
 - Explicit action request ("fix X", "add Y", "refactor Z") → route via the
@@ -96,7 +166,7 @@ files — NOT docs, comments, formatting, NOT *.test.* files).
 | Docs / comments / formatting only | implementer (or direct edit, see below) |
 | Product behavior change (bug fix, small feature) | implementer → tester → reviewer |
 | Multi-module / cross-interface feature | architect → implementer → tester → reviewer(s) |
-| Unknown external tech / dependency in play | researcher first, then the fitting row above |
+| Unfamiliar tech / dependency in play | researcher first (local-repo evidence: call sites, installed/vendored packages, shipped docs), then the fitting row above |
 
 - FIXED MINIMUM PIPELINES: the reviewer may be skipped ONLY for
   non-product artifacts, with a one-line reason.  A product change routed
@@ -123,8 +193,9 @@ Count the dispatches your routing row prescribes:
     ONLY when it is genuinely absent.  These docs define the conventions
     the whole team must follow; distill the binding ones for your
     dispatches.  Then read the relevant source yourself; dispatch
-    \`researcher\` ONLY for genuinely unknown external tech.  Done means
-    you can state which files change, in what order, and the risks.
+    \`researcher\` ONLY for genuinely unfamiliar tech — its findings come
+    from the local repo (code, docs, installed packages), never the web.
+    Done means you can state which files change, in what order, and the risks.
   - Plan (≤30 lines): Goal / Root cause or scope (file:line evidence) /
     Change list (file → what) / Pipeline (routing row + agents) /
     Assumptions & risks / Open questions.
@@ -244,8 +315,8 @@ Findings that drive architecture or API usage must be verified before
 adoption:
 - The researcher tags each finding High / Medium / Low confidence.
 - Low/medium-confidence claims that affect the design get a second check
-  (re-ask the researcher for another source, or sanity-check against the
-  actual codebase).
+  (re-ask the researcher for a second local source, or sanity-check against
+  the actual codebase).
 - Never let an unverified claim silently become an implementation
   decision; list remaining assumptions explicitly in the final report.
 
@@ -272,12 +343,10 @@ If a target file does not exist, offer to create it; skip both when the
 user opted out.
 `,
     color: "#E879F9", // purple
-    permission: {
-        edit: "allow",
-        bash: "allow",
-        webfetch: "allow",
-        task: "allow",
-    },
+    // Whitelist (7 tools): tm_* x4 + task dispatch + edit (<=10-line
+    // non-product edits, see "When you may edit directly") + write (board
+    // files) + bash (discovery-gate probes: --help, installed versions).
+    permission: whitelist("task", "edit", "write", "bash"),
     temperature: 0.2,
 };
 /* ------------------------------------------------------------------ */
@@ -320,9 +389,12 @@ When the team lead sends back a design flaw found in review or testing:
   of guessing about the codebase.
 `,
     color: "#38BDF8", // sky blue
-    // Read-only on PROJECT sources; a dispatched board artifact is explicitly
-    // writable (see Blackboard rules).
-    permission: { edit: "allow", bash: "deny", webfetch: "allow" },
+    // Whitelist (5 tools): tm_* x4 + task dispatch.  Fully read-only by
+    // design (T2.1): output lives in the reply; if a board artifact is ever
+    // dispatched, the BLACKBOARD WRITE FAILED fallback hands the content to
+    // the lead inline (see Blackboard rules).  No bash — unchanged from the
+    // pre-T2.1 architect bash:deny posture.
+    permission: whitelist("task"),
     temperature: 0.2,
 };
 /* ------------------------------------------------------------------ */
@@ -359,7 +431,9 @@ to you by the team lead.
   check, the previously failing test).
 `,
     color: "#4ADE80", // green
-    permission: { edit: "allow", bash: "allow", webfetch: "allow" },
+    // Whitelist (7 tools): tm_* x4 + edit/write (code implementation) + bash
+    // (narrowest verification for the fix: build / typecheck / failing test).
+    permission: whitelist("edit", "write", "bash"),
     temperature: 0.2,
 };
 /* ------------------------------------------------------------------ */
@@ -417,9 +491,12 @@ the previously flagged scope plus regressions introduced by the fixes;
 confirm each prior finding item by item (fixed / not fixed / partial).
 `,
     color: "#FB923C", // orange
-    // May edit ONLY a dispatched board artifact; never the reviewed code
-    // (see Blackboard rules + role rules).
-    permission: { edit: "allow", bash: "allow", webfetch: "allow" },
+    // Whitelist (6 tools): tm_* x4 + task dispatch + bash.  No edit/write
+    // (T2.1): findings travel in the reply skeleton; a dispatched board
+    // artifact rides the BLACKBOARD WRITE FAILED inline fallback (see
+    // Blackboard rules).  bash backs the evidence standard — the reviewer
+    // must be able to run npm test / tsc itself.
+    permission: whitelist("task", "bash"),
     temperature: 0.2,
 };
 /* ------------------------------------------------------------------ */
@@ -483,7 +560,9 @@ worse than admitting the gap.
   refactor instead of contorting the test.
 `,
     color: "#F472B6", // pink
-    permission: { edit: "allow", bash: "allow", webfetch: "allow" },
+    // Whitelist (7 tools): tm_* x4 + edit/write (test files) + bash (the
+    // whole verification stack: build / typecheck / lint / test runs).
+    permission: whitelist("edit", "write", "bash"),
     temperature: 0.2,
 };
 /* ------------------------------------------------------------------ */
@@ -491,10 +570,11 @@ worse than admitting the gap.
 /* ------------------------------------------------------------------ */
 const researcher = {
     mode: "subagent",
-    description: "Researcher — investigates libraries, APIs, best practices, and " +
-        "documentation; every finding carries a source and confidence tag so " +
-        "the team can decide what needs verification.  Use for information that " +
-        "must inform a technical decision.",
+    description: "Researcher — investigates the local repository: code, configs, " +
+        "installed/vendored packages, and shipped documentation; every finding " +
+        "carries a source (file:line) and confidence tag so the team can decide " +
+        "what needs verification.  Use for information that must inform a " +
+        "technical decision.  Web research is out of scope (no network tools).",
     prompt: `You are the **Researcher** on a multi-agent coding team.
 
 ## Role
@@ -534,7 +614,13 @@ by the team — flag prominently if that is the case.
   of re-deriving.
 `,
     color: "#A78BFA", // violet
-    permission: { edit: "allow", bash: "allow", webfetch: "allow", websearch: "allow" },
+    // Whitelist (4 tools): tm_* x4 ONLY — intentionally below the 5-7 band
+    // (T2.1): pure local research.  webfetch/websearch are excluded
+    // network-wide (P5), which also removes the dangling websearch:allow
+    // found in T0.3; file enumeration goes through tm_bash (G2 方案甲).
+    // No bash / no execution rights is intentional trimming — local
+    // research reads, it does not run.
+    permission: whitelist(),
     temperature: 0.2,
 };
 /* Shared rules appended to every specialist prompt (after the contract). */
@@ -545,6 +631,14 @@ Every "done / fixed / passed" claim in your reply must carry its
 evidence: command output, log lines, or a diff.  No narrative-only
 completions.
 
+## Tool surface (do not retry removed tools)
+All file reads / searches / enumeration go through tm_read / tm_grep / tm_bash.
+The built-in read/grep/glob/list tools are removed from the tool surface —
+retrying them only wastes a turn.  Built-in bash exists only where granted
+(team / implementer / reviewer / tester run commands: build / test / git);
+architect and researcher have no bash at all — one-off read-only commands
+go through tm_bash or are reported as a gap.
+
 ## Project conventions
 If the project README (or AGENTS.md) is quoted in your dispatch, treat
 its conventions as binding — they outrank your defaults.  Do not re-open
@@ -555,6 +649,14 @@ belongs to the work.`;
 for (const a of [architect, implementer, reviewer, tester, researcher]) {
     a.prompt = (a.prompt ?? "") + REPLY_CONTRACT + SHARED_RULES;
 }
+/* M3: tm_ptc_run permission — five specialists get allow, team gets deny
+ * (overrides the tm_* wildcard).  Applied once at module init. */
+if (teamLead.permission)
+    applyPtcPermission(teamLead.permission, true);
+for (const a of [architect, implementer, reviewer, tester, researcher]) {
+    if (a.permission)
+        applyPtcPermission(a.permission, false);
+}
 /* ------------------------------------------------------------------ */
 /*  Export all agents keyed by name                                   */
 /* ------------------------------------------------------------------ */

package/dist/agents.js.map

@@ -1 +1 @@
-{"version":3,"file":"agents.js","sourceRoot":"","sources":["../src/agents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;+DA0BwC,CAAA;AAE/D,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,MAAM,QAAQ,GAAgB;IAC5B,IAAI,EAAE,SAAS;IACf,WAAW,EACT,4DAA4D;QAC5D,qEAAqE;QACrE,qEAAqE;QACrE,oEAAoE;QACpE,6DAA6D;QAC7D,4BAA4B;IAC9B,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+MT;IACC,KAAK,EAAE,SAAS,EAAE,SAAS;IAC3B,UAAU,EAAE;QACV,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,OAAO;KACd;IACD,WAAW,EAAE,GAAG;CACjB,CAAA;AAED,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,MAAM,SAAS,GAAgB;IAC7B,IAAI,EAAE,UAAU;IAChB,WAAW,EACT,2EAA2E;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,yCAAyC;IAC3C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BT;IACC,KAAK,EAAE,SAAS,EAAE,WAAW;IAC7B,0EAA0E;IAC1E,mCAAmC;IACnC,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE;IAC9D,WAAW,EAAE,GAAG;CACjB,CAAA;AAED,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,MAAM,WAAW,GAAgB;IAC/B,IAAI,EAAE,UAAU;IAChB,WAAW,EACT,uEAAuE;QACvE,0EAA0E;QAC1E,gEAAgE;IAClE,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;CAwBT;IACC,KAAK,EAAE,SAAS,EAAE,QAAQ;IAC1B,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE;IAC/D,WAAW,EAAE,GAAG;CACjB,CAAA;AAED,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,MAAM,QAAQ,GAAgB;IAC5B,IAAI,EAAE,UAAU;IAChB,WAAW,EACT,qEAAqE;QACrE,uEAAuE;QACvE,mEAAmE;QACnE,sEAAsE;QACtE,yBAAyB;IAC3B,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CT;IACC,KAAK,EAAE,SAAS,EAAE,SAAS;IAC3B,qEAAqE;IACrE,uCAAuC;IACvC,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE;IAC/D,WAAW,EAAE,GAAG;CACjB,CAAA;AAED,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,MAAM,MAAM,GAAgB;IAC1B,IAAI,EAAE,UAAU;IAChB,WAAW,EACT,qEAAqE;QACrE,yEAAyE;QACzE,sEAAsE;QACtE,0DAA0D;IAC5D,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkDT;IACC,KAAK,EAAE,SAAS,EAAE,OAAO;IACzB,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE;IAC/D,WAAW,EAAE,GAAG;CACjB,CAAA;AAED,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,MAAM,UAAU,GAAgB;IAC9B,IAAI,EAAE,UAAU;IAChB,WAAW,EACT,iEAAiE;QACjE,sEAAsE;QACtE,yEAAyE;QACzE,mCAAmC;IACrC,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqCT;IACC,KAAK,EAAE,SAAS,EAAE,SAAS;IAC3B,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE;IACnF,WAAW,EAAE,GAAG;CACjB,CAAA;AAED,4EAA4E;AAC5E,MAAM,YAAY,GAAG;;;;;;;;;;;;qBAYA,CAAA;AAErB,4EAA4E;AAC5E,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;IACvE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,cAAc,GAAG,YAAY,CAAA;AAC7D,CAAC;AAED,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AAExE,MAAM,CAAC,MAAM,MAAM,GAAgC;IACjD,MAAM,EAAE,QAAQ;IAChB,SAAS;IACT,WAAW;IACX,QAAQ;IACR,MAAM;IACN,UAAU;CACX,CAAA"}
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../src/agents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,wEAAwE;AACxE,sEAAsE;AACtE,wEAAwE;AACxE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,aAAa,GAAG;IACpB,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,aAAa;IACb,UAAU;IACV,WAAW;IACX,WAAW;IACX,KAAK;IACL,OAAO;IACP,UAAU;CACF,CAAA;AAEV,oEAAoE;AACpE,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAU,CAAA;AAElE;;qCAEqC;AACrC,MAAM,QAAQ,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,CAAU,CAAA;AAEvE;;;iCAGiC;AACjC,MAAM,QAAQ,GAAG,YAAqB,CAAA;AAEtC,MAAM,SAAS,GAAG,CAChB,GAAG,OAAgD,EAClC,EAAE;IACnB,MAAM,UAAU,GAAoB,EAAE,CAAA;IACtC,KAAK,MAAM,IAAI,IAAI,aAAa;QAAE,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAA;IAC3D,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAA;IAC9D,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,QAAQ;QAAE,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,CAAA;IACvD,UAAU,CAAC,MAAM,CAAC,GAAG,OAAO,CAAA;IAC5B,OAAO,UAAU,CAAA;AACnB,CAAC,CAAA;AAED;mFACmF;AACnF,SAAS,kBAAkB,CAAC,UAA2B,EAAE,UAAmB;IAC1E,UAAU,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;AACtD,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;+DA0BwC,CAAA;AAE/D,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,MAAM,QAAQ,GAAgB;IAC5B,IAAI,EAAE,SAAS;IACf,WAAW,EACT,4DAA4D;QAC5D,qEAAqE;QACrE,qEAAqE;QACrE,oEAAoE;QACpE,6DAA6D;QAC7D,4BAA4B;IAC9B,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiNT;IACC,KAAK,EAAE,SAAS,EAAE,SAAS;IAC3B,iEAAiE;IACjE,sEAAsE;IACtE,qEAAqE;IACrE,UAAU,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC;IACtD,WAAW,EAAE,GAAG;CACjB,CAAA;AAED,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,MAAM,SAAS,GAAgB;IAC7B,IAAI,EAAE,UAAU;IAChB,WAAW,EACT,2EAA2E;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,yCAAyC;IAC3C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BT;IACC,KAAK,EAAE,SAAS,EAAE,WAAW;IAC7B,oEAAoE;IACpE,wEAAwE;IACxE,wEAAwE;IACxE,wEAAwE;IACxE,wCAAwC;IACxC,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC;IAC7B,WAAW,EAAE,GAAG;CACjB,CAAA;AAED,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,MAAM,WAAW,GAAgB;IAC/B,IAAI,EAAE,UAAU;IAChB,WAAW,EACT,uEAAuE;QACvE,0EAA0E;QAC1E,gEAAgE;IAClE,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;CAwBT;IACC,KAAK,EAAE,SAAS,EAAE,QAAQ;IAC1B,yEAAyE;IACzE,0EAA0E;IAC1E,UAAU,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC;IAC9C,WAAW,EAAE,GAAG;CACjB,CAAA;AAED,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,MAAM,QAAQ,GAAgB;IAC5B,IAAI,EAAE,UAAU;IAChB,WAAW,EACT,qEAAqE;QACrE,uEAAuE;QACvE,mEAAmE;QACnE,sEAAsE;QACtE,yBAAyB;IAC3B,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CT;IACC,KAAK,EAAE,SAAS,EAAE,SAAS;IAC3B,sEAAsE;IACtE,oEAAoE;IACpE,kEAAkE;IAClE,sEAAsE;IACtE,6CAA6C;IAC7C,UAAU,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;IACrC,WAAW,EAAE,GAAG;CACjB,CAAA;AAED,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,MAAM,MAAM,GAAgB;IAC1B,IAAI,EAAE,UAAU;IAChB,WAAW,EACT,qEAAqE;QACrE,yEAAyE;QACzE,sEAAsE;QACtE,0DAA0D;IAC5D,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkDT;IACC,KAAK,EAAE,SAAS,EAAE,OAAO;IACzB,qEAAqE;IACrE,mEAAmE;IACnE,UAAU,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC;IAC9C,WAAW,EAAE,GAAG;CACjB,CAAA;AAED,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,MAAM,UAAU,GAAgB;IAC9B,IAAI,EAAE,UAAU;IAChB,WAAW,EACT,iEAAiE;QACjE,wEAAwE;QACxE,yEAAyE;QACzE,mEAAmE;QACnE,uEAAuE;IACzE,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqCT;IACC,KAAK,EAAE,SAAS,EAAE,SAAS;IAC3B,uEAAuE;IACvE,gEAAgE;IAChE,qEAAqE;IACrE,iEAAiE;IACjE,gEAAgE;IAChE,mCAAmC;IACnC,UAAU,EAAE,SAAS,EAAE;IACvB,WAAW,EAAE,GAAG;CACjB,CAAA;AAED,4EAA4E;AAC5E,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;qBAoBA,CAAA;AAErB,4EAA4E;AAC5E,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;IACvE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,cAAc,GAAG,YAAY,CAAA;AAC7D,CAAC;AAED;kEACkE;AAClE,IAAI,QAAQ,CAAC,UAAU;IAAE,kBAAkB,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;AACtE,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;IACvE,IAAI,CAAC,CAAC,UAAU;QAAE,kBAAkB,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;AAC3D,CAAC;AAED,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AAExE,MAAM,CAAC,MAAM,MAAM,GAAgC;IACjD,MAAM,EAAE,QAAQ;IAChB,SAAS;IACT,WAAW;IACX,QAAQ;IACR,MAAM;IACN,UAAU;CACX,CAAA"}

package/dist/approval-gate.d.ts

@@ -0,0 +1,147 @@
+/**
+ * Unified approval gate — Layer 2 (timeout auto-reject) + Layer 3 (SDK
+ * fallback) of the R6 + R2 approval flow.
+ *
+ * The host only shows its official confirmation dialog for command patterns
+ * declared `ask` in an agent's permission config (Layer 1, envprotect.ts).
+ * When a dialog opens it SUSPENDS the tool call and waits for a human; on the
+ * OpenCode DESKTOP that human is present, but a request can also be left
+ * unanswered.  This module owns ONE timer that watches the host permission
+ * events and closes abandoned requests on the safe side.
+ *
+ * REAL host contract (1.18.29, probed live via SSE + the plugin event hook —
+ * see gate-test report-p5):
+ *   permission.asked   → properties = { id, sessionID, permission: "bash",
+ *                        patterns: [<concrete command segment>, …], metadata:
+ *                        { command }, always: [<host's "always" generalization
+ *                        proposal>], tool: { messageID, callID } } — the props
+ *                        carry NO `type` field, and the tool name sits in
+ *                        `permission`.  A props matching one of OUR injected
+ *                        bash ask sets means the dialog is ours: audit "ask",
+ *                        arm the timeout, and — for the R6 env face — mark
+ *                        the session deferrable (canDefer, see below).
+ *   permission.replied → properties = { sessionID, requestID, reply } on the
+ *                        wire, but the plugin-side observer has also seen it
+ *                        with ONLY { sessionID }.  The gate therefore cancels
+ *                        EVERY pending timer of that session on a reply: an
+ *                        already-approved command left on a live timer would
+ *                        get a second reject after the timeout, the SDK call
+ *                        would hit a dead id (4xx) and flip the gate
+ *                        permanently degraded.
+ *
+ * Older/typed spellings (`permission.updated`, `pattern`, `permissionID`,
+ * `response`) keep being accepted — the shipped SDK d.ts still names the
+ * events that way, and some builds omit the reply id entirely (a short
+ * ghost-suppression window per session then absorbs late/duplicate `asked`
+ * replays instead of re-arming a ghost timer).
+ *
+ * Hard rules (HUMAN-approved):
+ *   - the plugin NEVER self-allows: `reply` is fixed to "reject".  The only
+ *     way a gated command runs is a human approving the dialog;
+ *   - on `TM_ENV_PROTECT=off` the gate is not armed (index.ts decides);
+ *   - deferral is SESSION-SCOPED (canDefer): only sessions registered as
+ *     carrying our injected ask set may have env reads passed through —
+ *     registration comes from an exec-role user prompt (the live-proven
+ *     `message.updated` UserMessage{role,agent,sessionID} signal, plus the
+ *     documented `chat.message` hook) or from an R6-env-classified asked
+ *     event.  Stock build/plan sessions never register, so the global R6
+ *     hook keeps hard-throwing there — closing the R6 bypass the global
+ *     `isArmed()` deferral allowed;
+ *   - if the SDK reply FAILS (network/host — including the v1
+ *     `throwOnError:false` envelope resolving with `{ error }`), we cannot
+ *     close the dialog, so the gate flips itself permanently "degraded" —
+ *     the R6 hook stops deferring env reads and hard-throws them again
+ *     (fail-closed), and the event is audited "degraded".
+ *
+ * SDK surface (probed live on 1.18.x): the plugin's `input.client` is the v1
+ * `OpencodeClient`, which has NO `permission` namespace and NO list/create
+ * endpoint; the reply path is the top-level
+ * `postSessionIdPermissionsPermissionId({ path: { id: sessionID,
+ * permissionID }, body: { response } })`.  `client.permission.reply` /
+ * `client.permission.list` are still tried first so a richer host build is
+ * supported, but on v1 they are simply absent and the poll fallback is a
+ * no-op (events are the sole pending signal there).
+ */
+import type { PermissionEvent } from "./types.js";
+/** Default timeout, in minutes, before an unanswered dialog is auto-rejected. */
+export declare const DEFAULT_ASK_TIMEOUT_MIN = 10;
+/**
+ * Hard floor (minutes) for the auto-reject timeout.  Measured live on the
+ * OpenCode Desktop: a `permission.replied` (human answered "once") reaches
+ * the plugin through the host event bus ~120s LATE — a 1-minute timer
+ * therefore fires BEFORE the cancel arrives and auto-rejects the just-
+ * approved request on a dead id (4xx → permanent degraded, the D4
+ * double-reject race).  3 min = observed ~120s lag + margin; in-range
+ * values below the floor clamp UP to it (a longer timeout is always the
+ * safe direction — the dialog just stays open a bit longer).
+ */
+export declare const MIN_ASK_TIMEOUT_MIN = 3;
+/** The verdict vocabulary recorded in the audit trail (privacy: no command
+ *  text, path, variable name or value is ever logged). */
+export type ApprovalVerdict = "ask" | "allowed-once" | "allowed-always" | "rejected" | "timeout-rejected" | "degraded";
+/**
+ * Resolve `TM_ASK_TIMEOUT_MIN`.  Unset / blank / non-numeric / <1 / >1440
+ * (24h) fall back to the 10-minute default — a mistyped value can never
+ * disable the timeout or make it absurdly long.  Valid values below the
+ * 3-minute bus-lag floor clamp UP to it (1→3, 2→3; see
+ * `MIN_ASK_TIMEOUT_MIN` for the measured ~120s replied-event lag).
+ */
+export declare function resolveAskTimeoutMs(env?: Record<string, string | undefined>): number;
+type TimerHandle = unknown;
+export interface GateTimers {
+    setTimeoutFn: (cb: () => void, ms: number) => TimerHandle;
+    clearTimeoutFn: (handle: TimerHandle) => void;
+}
+export interface ApprovalGateDeps {
+    client: unknown;
+    timeoutMs: number;
+    /** Injectable timers (default: real global timers) for deterministic tests. */
+    timers?: GateTimers;
+    /** Injectable clock (default: Date.now) for deterministic window tests. */
+    now?: () => number;
+}
+export interface ApprovalGate {
+    /** Handle one host event (permission.asked/updated / permission.replied). */
+    handleEvent(event: PermissionEvent): void;
+    /** Start the poll fallback (no-op on v1 where no list endpoint exists). */
+    start(): void;
+    /** Stop the poll + every pending timer. */
+    dispose(): void;
+    /** Global gate health: armed, not degraded, and the client can reply. */
+    isArmed(): boolean;
+    /**
+     * The R6 hook's deferral query: TRUE only when this exact session is
+     * registered as carrying our injected ask set AND the gate is healthy.
+     * Replaces the old global `isArmed()` deferral (which let stock build/plan
+     * sessions pass env reads silently with no dialog in front of them).
+     */
+    canDefer(sessionID?: string): boolean;
+    /** True once a session registered (exec-role prompt seen on
+     *  message.updated / chat.message by index.ts, or an R6-env-classified
+     *  asked event).  Introspection for tests/diagnostics. */
+    hasLiveAsk(sessionID?: string): boolean;
+    /** Mark a session as carrying the injected ask set (index.ts calls this
+     *  when a user prompt routes to an agent we injected the escalated bash
+     *  ask object into — proven live: `message.updated` UserMessage carries
+     *  { sessionID, role:"user", agent } and fires BEFORE the session's first
+     *  tool call, while permission.asked fires AFTER tool.execute.before). */
+    registerExecSession(sessionID?: string): void;
+    /** True after the user picked "always" on an env-related ask in this session
+     *  — subsequent env reads pass silently (the approval event itself is audited). */
+    isEnvApproved(sessionID?: string): boolean;
+    /** Number of pending requests currently being timed (tests / introspection). */
+    pendingSize(): number;
+}
+/** True when the client exposes a permission-reply path at all.  index.ts
+ *  arms the gate ONLY for such a client — fail-closed otherwise (no armed
+ *  auto-reject ⇒ the R6 hook keeps hard-throwing every env read). */
+export declare function hasPermissionReplyCapability(client: unknown): boolean;
+/**
+ * Create the approval gate.  It is intentionally pure about timing +
+ * replying + session registration; the caller (index.ts) decides whether to
+ * arm it (mode != off AND the client is reply-capable), feeds events in, and
+ * wires `canDefer(sessionID)` into the R6 hook.
+ */
+export declare function createApprovalGate(deps: ApprovalGateDeps): ApprovalGate;
+export {};
+//# sourceMappingURL=approval-gate.d.ts.map

package/dist/approval-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-gate.d.ts","sourceRoot":"","sources":["../src/approval-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAGjD,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,KAAK,CAAA;AAEzC;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAA;AAiBpC;0DAC0D;AAC1D,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,cAAc,GACd,gBAAgB,GAChB,UAAU,GACV,kBAAkB,GAClB,UAAU,CAAA;AAEd;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,MAAM,CAQjG;AAED,KAAK,WAAW,GAAG,OAAO,CAAA;AAE1B,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK,WAAW,CAAA;IACzD,cAAc,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,IAAI,CAAA;CAC9C;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,OAAO,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAAA;IACzC,2EAA2E;IAC3E,KAAK,IAAI,IAAI,CAAA;IACb,2CAA2C;IAC3C,OAAO,IAAI,IAAI,CAAA;IACf,yEAAyE;IACzE,OAAO,IAAI,OAAO,CAAA;IAClB;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACrC;;8DAE0D;IAC1D,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACvC;;;;8EAI0E;IAC1E,mBAAmB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7C;uFACmF;IACnF,aAAa,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAC1C,gFAAgF;IAChF,WAAW,IAAI,MAAM,CAAA;CACtB;AA6GD;;qEAEqE;AACrE,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAErE;AAgBD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,GAAG,YAAY,CA6OvE"}