@te-river/opencode-team-mode 1.7.2 → 1.7.3

package/dist/approval-gate.js

@@ -1,627 +0,0 @@
-/**
- * Unified approval gate — Layer 2 (timeout auto-reject) + Layer 3 (SDK
- * fallback) of the R6 + R2 approval flow.
- *
- * The host only shows its official confirmation dialog for command patterns
- * declared `ask` in an agent's permission config (Layer 1, envprotect.ts).
- * When a dialog opens it SUSPENDS the tool call and waits for a human; on the
- * OpenCode DESKTOP that human is present, but a request can also be left
- * unanswered.  This module owns ONE timer that watches the host permission
- * events and closes abandoned requests on the safe side.
- *
- * REAL host contract (1.18.29, probed live via SSE + the plugin event hook —
- * see gate-test report-p5):
- *   permission.asked   → properties = { id, sessionID, permission: "bash",
- *                        patterns: [<concrete command segment>, …], metadata:
- *                        { command }, always: [<host's "always" generalization
- *                        proposal>], tool: { messageID, callID } } — the props
- *                        carry NO `type` field, and the tool name sits in
- *                        `permission`.  A props matching one of OUR injected
- *                        bash ask sets means the dialog is ours: audit "ask",
- *                        arm the timeout, and — for the R6 env face — mark
- *                        the session deferrable (canDefer, see below).
- *   permission.replied → properties = { sessionID, requestID, reply } on the
- *                        wire, but the plugin-side observer has also seen it
- *                        with ONLY { sessionID }.  The gate therefore cancels
- *                        EVERY pending timer of that session on a reply: an
- *                        already-approved command left on a live timer would
- *                        get a second reject after the timeout, the SDK call
- *                        would hit a dead id (4xx) and flip the gate
- *                        permanently degraded.
- *
- * Older/typed spellings (`permission.updated`, `pattern`, `permissionID`,
- * `response`) keep being accepted — the shipped SDK d.ts still names the
- * events that way, and some builds omit the reply id entirely (a short
- * ghost-suppression window per session then absorbs late/duplicate `asked`
- * replays instead of re-arming a ghost timer).
- *
- * Hard rules (HUMAN-approved):
- *   - the plugin NEVER self-allows: `reply` is fixed to "reject".  The only
- *     way a gated command runs is a human approving the dialog;
- *   - on `TM_ENV_PROTECT=off` the gate is not armed (the caller decides);
- *   - deferral is SESSION-SCOPED (canDefer): only sessions registered as
- *     carrying our injected ask set may have env reads passed through —
- *     registration comes from an exec-role user prompt (the live-proven
- *     `message.updated` UserMessage{role,agent,sessionID} signal, plus the
- *     documented `chat.message` hook) or from an R6-env-classified asked
- *     event.  Stock build/plan sessions never register, so the global R6
- *     hook keeps hard-throwing there — closing the R6 bypass the global
- *     `isArmed()` deferral allowed;
- *   - if the SDK reply FAILS (network/host — including the SDK's
- *     `throwOnError:false` envelope resolving with `{ error }`), we cannot
- *     close the dialog, so the gate flips itself permanently "degraded" —
- *     the R6 hook stops deferring env reads and hard-throws them again
- *     (fail-closed), and the event is audited "degraded".
- *
- * SDK surface (probed live): the host client may carry NO `permission`
- * namespace and NO list/create endpoint; the reply path is the top-level
- * `postSessionIdPermissionsPermissionId({ path: { id: sessionID,
- * permissionID }, body: { response } })`.  `client.permission.reply` /
- * `client.permission.list` are still tried first so a richer host build is
- * supported, but when they are absent the poll fallback is a no-op (events
- * are the sole pending signal).
- */
-import { ENV_PROTECT_SERVICE, categorizePermission } from "./envprotect.js";
-import { resolveTmConfig } from "./tm/config.js";
-/** Default timeout, in minutes, before an unanswered dialog is auto-rejected.
- *  1 min (user directive) — an unanswered dialog no longer hangs for 10.
- *  A short timer is safe because a reject that lands on an already-closed
- *  request is benign; see `MIN_ASK_TIMEOUT_MIN` for the full rationale. */
-export const DEFAULT_ASK_TIMEOUT_MIN = 1;
-/**
- * Hard floor (minutes) for the auto-reject timeout.  The HISTORIC 3-min
- * floor existed to dodge the measured ~120s `permission.replied` bus lag:
- * a shorter timer would fire before the cancel arrives and auto-reject a
- * just-approved request.  That lag, though, is the HOST DELIVERING the
- * replied event to the plugin over the bus — NOT the host resolving the
- * user's click: an approval takes effect instantly host-side, so the
- * plugin's late reject simply targets an already-closed request id → 404.
- * T2's `classifyReplyFailure` maps that outcome to the benign
- * `already-closed` verdict (it never flips the gate to `degraded`, and the
- * approved command runs either way); `onReplied` records a reply landing
- * after the auto-reject as `late-<verdict>` for observability.  With that
- * classification in place a short timeout no longer disables the gate, so
- * the floor drops to 1 minute (user directive).  Trade-off: an UNANSWERED
- * dialog auto-rejects after 1 min — a user who stepped away re-triggers
- * the command.  In-range values below the floor still clamp UP to it.
- *
- * This is the FALLBACK default of the floor.  The live floor comes from the
- * P0 config knob `TM_ASK_TIMEOUT_FLOOR_MIN`
- * (`resolveTmConfig().askTimeoutFloorMin`, itself defaulted to 1).
- */
-export const MIN_ASK_TIMEOUT_MIN = 1;
-/** Poll cadence (ms) that re-scans pending permissions in case an event was
- *  missed — only meaningful when the client exposes a list capability. */
-const POLL_INTERVAL_MS = 60 * 1000;
-/** Suppression window (ms) for late/duplicate `permission.asked` replays
- *  after a `permission.replied` that carried NO permission id.  Ghost timers
- *  are the degraded-flip poison (dead id → 4xx → permanent degraded); the
- *  window only sacrifices the timeout for brand-new asks of the same session
- *  for this short period, never a self-allow. */
-const GHOST_ASK_WINDOW_MS = 60 * 1000;
-/** Cap on the closed-permission-id tombstone LRU (ids are unique, so it is
- *  purely an anti-ghost cache + late-verdict provenance store — pruning the
- *  oldest is sufficient). */
-const MAX_TOMBSTONES = 500;
-/**
- * Resolve `TM_ASK_TIMEOUT_MIN`.  Unset / blank / non-numeric / <1 / >1440
- * (24h) fall back to the 1-minute default — a mistyped value can never
- * disable the timeout or make it absurdly long.  Valid values below the
- * floor clamp UP to it — the floor is the P0 config knob
- * `TM_ASK_TIMEOUT_FLOOR_MIN` (`resolveTmConfig().askTimeoutFloorMin`,
- * default 1).  The historic ~120s bus-lag reason for a 3-min floor is
- * obsolete: a late reject on an already-closed id is benign
- * `already-closed`, not a degraded flip (see `MIN_ASK_TIMEOUT_MIN`).
- */
-export function resolveAskTimeoutMs(env = process.env) {
-    const raw = env.TM_ASK_TIMEOUT_MIN;
-    if (typeof raw !== "string" || raw.trim() === "")
-        return DEFAULT_ASK_TIMEOUT_MIN * 60 * 1000;
-    const n = Number(raw.trim());
-    if (!Number.isFinite(n))
-        return DEFAULT_ASK_TIMEOUT_MIN * 60 * 1000;
-    const min = Math.trunc(n);
-    if (min < 1 || min > 1440)
-        return DEFAULT_ASK_TIMEOUT_MIN * 60 * 1000;
-    // Floor read from the config knob (bounded to [1,1440] by envInt) so a
-    // stricter posture can raise it WITHOUT a source change; default is 1.
-    const floorMin = resolveTmConfig(env).askTimeoutFloorMin;
-    return Math.max(min, floorMin) * 60 * 1000;
-}
-/** Best-effort structured audit; a failing log endpoint never breaks the gate. */
-function auditAsk(client, tool, category, verdict) {
-    try {
-        // `app.log({...})` is a METHOD call on `app` — casting the fetched
-        // function and invoking it plain (`(app.log as Fn)({...})`) drops the
-        // SDK `this` exactly like the historic R6 audit bug did, silently
-        // killing every gate audit line (pinned by the this-bound §7 mocks).
-        const app = client?.app;
-        if (!app || typeof app.log !== "function")
-            return;
-        void app.log({
-            body: {
-                level: "warn",
-                service: ENV_PROTECT_SERVICE,
-                message: `${ENV_PROTECT_SERVICE} :: ${tool} :: ${category} :: ${verdict}`,
-            },
-        });
-    }
-    catch {
-        /* audit is best-effort */
-    }
-}
-/**
- * The SDK default is `throwOnError:false` (types/sdk.gen contract): an HTTP
- * failure — e.g. a 4xx on an already-closed permission id — RESOLVES with an
- * `{ error }` envelope instead of rejecting.  Unwrapping it into a throw is
- * what makes the Layer-3 degraded flip actually fire on the real host.
- */
-function unwrapSdkEnvelope(res) {
-    if (res && typeof res === "object" && "error" in res) {
-        const err = res.error;
-        if (err) {
-            // Carry the HTTP status ONTO the thrown error.  On the real host the
-            // status sits at `res.response.status` (NOT on the error body), and
-            // `classifyReplyFailure` needs it to tell a benign 404 (dialog already
-            // closed — the D4 late-reply race) from a shape-bug 400 / a transport
-            // failure.  Falls back to an error-body status, then undefined.
-            const status = res.response?.status ??
-                err.status;
-            throw Object.assign(err, { status });
-        }
-    }
-    return res;
-}
-/**
- * Non-privacy diagnostic appended to a `degraded` audit verdict: the error
- * CLASS name and host status code only — never message text, request params
- * or paths (privacy red line).  Handles both thrown Errors and `{error}`
- * envelope bodies (`{ error: { name, status | status_code } }`); the name passes an
- * identifier whitelist so hostile/echoed text can never ride into the log.
- */
-function errorDiagnostic(err) {
-    const e = err;
-    const name = typeof e?.name === "string" && /^[A-Za-z][A-Za-z0-9_.-]{0,63}$/.test(e.name)
-        ? e.name
-        : "Error";
-    const rawStatus = [e?.status, e?.statusCode, e?.status_code].find((v) => typeof v === "number" && Number.isFinite(v));
-    return ` err=${name}${rawStatus !== undefined ? ` status=${rawStatus}` : ""}`;
-}
-/**
- * Classify a reply-call failure so the gate no longer flips permanently
- * `degraded` on a harmless close.  `unwrapSdkEnvelope` has already hoisted the
- * HTTP status onto the thrown envelope error; a genuine `Promise.reject`
- * arrives as a plain Error with no status.
- *   - `benign-closed`: 404, or a NotFound/PermissionNotFound name/_tag — the
- *     dialog was ALREADY closed on the host (the D4 late-reply race): our
- *     reject was a no-op, so the popup path stays trustworthy.
- *   - `param-shape`: 400, or a BadRequest/InvalidRequest name/_tag — our
- *     reply body/params are wrong for this host: a real integration bug.
- *   - `transport`: everything else — a genuine Error, a 5xx, or an empty /
- *     status-less body — we could not reach or close the dialog.
- * Reads only the error CLASS + status number (privacy: never message text).
- */
-export function classifyReplyFailure(err) {
-    const e = err;
-    const rawStatus = [e?.status, e?.statusCode, e?.status_code].find((v) => typeof v === "number" && Number.isFinite(v));
-    const tag = `${typeof e?.name === "string" ? e.name : ""} ${typeof e?._tag === "string" ? e._tag : ""}`.trim();
-    if (rawStatus === 404 || /NotFound|PermissionNotFound/.test(tag))
-        return "benign-closed";
-    if (rawStatus === 400 || /BadRequest|InvalidRequest/.test(tag))
-        return "param-shape";
-    return "transport";
-}
-/** A recognized human reply word -> its audit verdict; null for anything the
- *  out-of-vocabulary path keeps silent about (used by the LATE-verdict audit
- *  so an unknown late word can never fabricate a verdict or a `late-degraded`). */
-function lateVerdictWord(lower) {
-    if (lower === "reject")
-        return "rejected";
-    if (lower === "always")
-        return "allowed-always";
-    if (lower === "once")
-        return "allowed-once";
-    return null;
-}
-/**
- * Build the reject closure.  CRITICAL: every SDK endpoint is invoked as a
- * METHOD (`perm.reply({...})` / `c.post...({...})` — property-access call
- * sites keep the receiver binding).  Fetching the function first
- * (`const post = c.post...` then `await post({...})`) drops the SDK `this`,
- * so EVERY outbound reply died synchronously on the real host — the timer
- * fired at ask+timeout yet the dialog stayed open and the gate flipped
- * `degraded` (same regression class as the historic app.log audit bug; the
- * §7 test mocks now require the binding so it can never come back).
- */
-function replyCapableFn(client) {
-    const c = client;
-    if (!c)
-        return null;
-    const perm = c.permission;
-    if (perm && typeof perm.reply === "function") {
-        return async (sid, pid) => {
-            // richest host first (permission.reply), reject-only, both param shapes
-            return unwrapSdkEnvelope(
-            // `!` + property-access call site: binding survives, compiler stays happy
-            await perm.reply({ path: { sessionID: sid, id: pid }, body: { response: "reject" } }));
-        };
-    }
-    if (typeof c.postSessionIdPermissionsPermissionId === "function") {
-        return async (sid, pid) => unwrapSdkEnvelope(await c.postSessionIdPermissionsPermissionId({
-            path: { id: sid, permissionID: pid },
-            body: { response: "reject" },
-        }));
-    }
-    return null;
-}
-function listCapableFn(client) {
-    const c = client;
-    const perm = c?.permission;
-    if (perm && typeof perm.list === "function") {
-        // method call on `perm` — `this` must survive (see replyCapableFn note)
-        return async () => await perm.list({});
-    }
-    return null;
-}
-/** True when the client exposes a permission-reply path at all.  index.ts
- *  arms the gate ONLY for such a client — fail-closed otherwise (no armed
- *  auto-reject ⇒ the R6 hook keeps hard-throwing every env read). */
-export function hasPermissionReplyCapability(client) {
-    return replyCapableFn(client) !== null;
-}
-/** First string-ish value among the host's several id/response spellings. */
-function str(...values) {
-    for (const v of values) {
-        if (typeof v === "string" && v.trim() !== "")
-            return v.trim();
-    }
-    return undefined;
-}
-/**
- * Create the approval gate.  It is intentionally pure about timing +
- * replying + session registration; the caller (index.ts) decides whether to
- * arm it (mode != off AND the client is reply-capable), feeds events in, and
- * wires `canDefer(sessionID)` into the R6 hook.
- */
-export function createApprovalGate(deps) {
-    const { client, timeoutMs } = deps;
-    const timers = deps.timers ?? {
-        // unref() so a pending timeout never, on its own, keeps the host process
-        // alive (same philosophy as the blackboard sweeper's unref'd interval)
-        setTimeoutFn: (cb, ms) => {
-            const t = setTimeout(cb, ms);
-            if (typeof t?.unref === "function")
-                t.unref();
-            return t;
-        },
-        clearTimeoutFn: (h) => clearTimeout(h),
-    };
-    const nowMs = deps.now ?? (() => Date.now());
-    const notify = deps.notify;
-    const reply = replyCapableFn(client);
-    const list = listCapableFn(client);
-    const pending = new Map();
-    /** Sessions known to carry our injected ask set (deferral whitelist). */
-    const liveAsk = new Set();
-    /** Permission ids already closed (replied / timed out): a late or
-     *  duplicated `asked` replay for one must never re-arm a ghost timer.
-     *  Upgraded from a bare Set to a small LRU map — R1#8 — so a LATE
-     *  `permission.replied` (the human's decision reaching the plugin AFTER the
-     *  timer already auto-rejected) can be audited with its real category.
-     *  Bounded at MAX_TOMBSTONES with the oldest evicted. */
-    const closed = new Map();
-    /** Sessions whose reply carried NO permission id → suppress fresh asks of
-     *  that session briefly (map sid → expiry ms). */
-    const repliedNoId = new Map();
-    /** Sessions blanket-approved for env reads ("always" on an env ask). */
-    const envApprovedSessions = new Set();
-    let armed = true;
-    let degraded = false;
-    let pollHandle = null;
-    function remove(id) {
-        const rec = pending.get(id);
-        if (rec) {
-            timers.clearTimeoutFn(rec.timer);
-            pending.delete(id);
-        }
-        return rec;
-    }
-    function tombstone(id, sid, cat) {
-        // LRU touch: delete+set moves the id to the newest end.  Re-inserting a
-        // known id preserves its recorded cat/sid when THIS call omits them, so a
-        // late/duplicate reply never overwrites the real category a prior close
-        // (fireReject / first reply) recorded.
-        const prev = closed.get(id);
-        closed.delete(id);
-        closed.set(id, {
-            sid: sid ?? prev?.sid ?? "",
-            cat: cat ?? prev?.cat ?? "danger",
-            at: nowMs(),
-        });
-        while (closed.size > MAX_TOMBSTONES) {
-            const oldest = closed.keys().next().value;
-            if (oldest === undefined)
-                break;
-            closed.delete(oldest);
-        }
-    }
-    /** True while sid is inside the no-id-reply ghost window. */
-    function ghostSuppressed(sid) {
-        const expiry = repliedNoId.get(sid);
-        if (expiry === undefined)
-            return false;
-        if (expiry <= nowMs()) {
-            repliedNoId.delete(sid);
-            return false;
-        }
-        return true;
-    }
-    async function fireReject(id, cat) {
-        const rec = pending.get(id);
-        if (!rec)
-            return;
-        pending.delete(id);
-        tombstone(id, rec.sid, rec.cat);
-        let ok = false;
-        let errDiag = "";
-        let failClass = null;
-        try {
-            if (reply) {
-                // unwrapSdkEnvelope inside `reply` turns the SDK `{error}` envelope into a
-                // throw (carrying the hoisted HTTP status); a rejecting transport
-                // lands in the same catch.
-                await reply(rec.sid, id);
-                ok = true;
-            }
-        }
-        catch (err) {
-            ok = false;
-            failClass = classifyReplyFailure(err);
-            errDiag = errorDiagnostic(err);
-        }
-        // Classify a failed reply instead of a blanket degraded flip:
-        //   benign-closed (404 / NotFound) — the dialog was ALREADY closed on the
-        //     host (the D4 late-reply race): our reject was a harmless no-op, NOT
-        //     an integration fault, so the popup path stays trustworthy.  Do NOT
-        //     flip degraded — one dead-id reject must never poison the whole gate.
-        //   param-shape (400 / BadRequest) — our reply shape is wrong for this
-        //     host: a real bug, fail closed.
-        //   transport (a real Error / 5xx / status-less body) — we could not reach
-        //     or close the dialog: fail closed (the historic behaviour).
-        if (!ok && failClass !== "benign-closed") {
-            // Layer 3 fallback: stop trusting the popup path; the hook reverts to
-            // hard-throwing env reads.
-            degraded = true;
-        }
-        const verdict = ok
-            ? "timeout-rejected"
-            : failClass === "benign-closed"
-                ? "already-closed"
-                : failClass === "param-shape"
-                    ? "rejected-shape-bug"
-                    : "degraded";
-        // every failure verdict carries the non-privacy error class/status tail
-        // (see errorDiagnostic) so a live-host failure is diagnosable from the log
-        auditAsk(client, "bash", cat, verdict + errDiag);
-    }
-    function arm(id, sid, cat) {
-        if (pending.has(id))
-            return;
-        const timer = timers.setTimeoutFn(() => void fireReject(id, cat), timeoutMs);
-        pending.set(id, { sid, cat, timer });
-    }
-    /** Single registration funnel for both event and poll discovery. */
-    function registerAsk(id, sid, cat) {
-        if (!id || !sid)
-            return;
-        if (closed.has(id))
-            return; // ghost replay of a closed request
-        if (ghostSuppressed(sid))
-            return; // replied-without-id; assume a replay
-        if (pending.has(id))
-            return;
-        // The R6 ENV face is the deferral proof: only sessions whose dialogs
-        // actually carry our injected env-ask patterns (or an exec-role
-        // chat.message, see registerExecSession) may defer env reads.  Danger
-        // faces never register — stock hosts that ask on `rm` by default must
-        // not gain env deferral.
-        if (cat === "env")
-            liveAsk.add(sid);
-        auditAsk(client, "bash", cat, "ask");
-        arm(id, sid, cat);
-    }
-    async function pollOnce() {
-        if (!list || !armed)
-            return;
-        try {
-            const res = await list();
-            const data = Array.isArray(res) ? res : res?.data;
-            if (Array.isArray(data)) {
-                for (const item of data) {
-                    const props = item?.properties ?? item;
-                    const cat = categorizePermission(props);
-                    if (!cat)
-                        continue;
-                    const p = props;
-                    registerAsk(str(p.id, p.permissionID, p.requestID), str(p.sessionID), cat);
-                }
-            }
-        }
-        catch {
-            /* poll is best-effort */
-        }
-    }
-    function schedulePoll() {
-        pollHandle = timers.setTimeoutFn(() => {
-            void pollOnce().finally(() => {
-                // dispose() during an in-flight poll must not re-arm a zombie chain
-                if (armed)
-                    schedulePoll();
-            });
-        }, POLL_INTERVAL_MS);
-    }
-    /** Toasted request ids (cap-bounded) — duplicate `asked` replays for one
-     *  dialog must not spam notifications. */
-    const notified = new Set();
-    function onAsked(props) {
-        // attention hook FIRST, for EVERY dialog (not just our categorized asks):
-        // the user asked to be notified wherever a confirmation window pops
-        const id = str(props.id, props.permissionID, props.requestID);
-        if (notify) {
-            if (!id || !notified.has(id)) {
-                if (id) {
-                    notified.add(id);
-                    if (notified.size > 256) {
-                        // keep the set bounded; ids are tombstoned on reply anyway
-                        const first = notified.values().next().value;
-                        if (first !== undefined)
-                            notified.delete(first);
-                    }
-                }
-                try {
-                    const perm = String(props.permission ?? props.permissionID ?? "permission");
-                    const patterns = Array.isArray(props.patterns) ? props.patterns.map(String) : [];
-                    const detail = patterns.length > 0 ? patterns[0] : perm;
-                    notify(`等待你的批准：${detail}（${Math.round(timeoutMs / 60000)} 分钟无应答将自动拒绝）`);
-                }
-                catch {
-                    /* notification is best-effort — never break the gate */
-                }
-            }
-        }
-        if (degraded)
-            return; // auto-reject is broken — do not open new timers
-        const cat = categorizePermission(props);
-        if (!cat)
-            return; // not one of our injected bash asks → leave it to the human
-        registerAsk(str(props.id, props.permissionID, props.requestID), str(props.sessionID), cat);
-    }
-    function onReplied(props) {
-        const sid = str(props.sessionID);
-        const id = str(props.requestID, props.permissionID, props.id);
-        const resp = str(props.reply, props.response);
-        // Capture prior-closed state BEFORE this reply tombstones the id: the
-        // late-verdict audit must fire only for a reply that arrives AFTER the id
-        // was already closed (a timeout auto-reject / an earlier reply), not for
-        // the first-ever reply we happen to be tombstoning right now.
-        const wasClosed = id ? closed.has(id) : false;
-        const prec = id ? pending.get(id) : undefined;
-        if (id)
-            tombstone(id, sid ?? prec?.sid, prec?.cat);
-        // Real 1.18.29 replied props identify the request via `requestID` — and
-        // the plugin-side observer has seen builds carrying ONLY { sessionID }.
-        // Cancel EVERY pending timer of the session either way: an approved
-        // command left timed would fire a reject on a dead id (4xx) and flip the
-        // gate permanently degraded.
-        const affected = [];
-        let removed;
-        if (id) {
-            removed = remove(id);
-            if (removed)
-                affected.push(removed);
-        }
-        for (const [pid, rec] of [...pending]) {
-            if (sid && rec.sid === sid) {
-                pending.delete(pid);
-                timers.clearTimeoutFn(rec.timer);
-                tombstone(pid, rec.sid, rec.cat);
-                affected.push(rec);
-            }
-        }
-        if (!id && sid)
-            repliedNoId.set(sid, nowMs() + GHOST_ASK_WINDOW_MS);
-        // R1#8 — LATE VERDICT OBSERVABILITY: the id was ALREADY closed (remove()
-        // found nothing, and it was closed before this reply — `wasClosed`), yet a
-        // real reply word rode in afterwards: the human's decision reached the
-        // plugin past the auto-reject (the D4 race the timeout floor guards).  The
-        // reject already landed, so this is OBSERVABILITY ONLY — it never re-arms a
-        // timer, never revives the command, and sends NO SDK reply, so it cannot
-        // breach "the plugin only ever rejects".  The category comes from the
-        // original close, so the audit line stays well-formed with no command text.
-        if (id && !removed && wasClosed && resp) {
-            const entry = closed.get(id);
-            const late = entry ? lateVerdictWord(resp.toLowerCase()) : null;
-            if (entry && late)
-                auditAsk(client, "bash", entry.cat, `late-${late}`);
-        }
-        for (const rec of affected) {
-            if (!resp)
-                continue; // outcome unknown: cancel silently, never invent a verdict
-            const lower = resp.toLowerCase();
-            const verdict = lower === "reject" ? "rejected"
-                : lower === "always" ? "allowed-always"
-                    : lower === "once" ? "allowed-once"
-                        : "degraded"; // out-of-vocabulary word: record it honestly, not as "rejected"
-            auditAsk(client, "bash", rec.cat, verdict);
-            // "always" on an env-related ask → blanket-approve all env reads for
-            // this session (the host's pattern generalization is too broad, so we
-            // interpret "always" as a session-scoped env approval).  The hook
-            // still hard-throws env-FILE reads (CATEGORY_ENV_FILE_PATH) in an
-            // env-approved session: files on disk never open a dialog of their
-            // own, so no "always" verdict can have consented to them.
-            if (verdict === "allowed-always" && sid && /^(bash-)?env/.test(rec.cat)) {
-                envApprovedSessions.add(sid);
-            }
-        }
-    }
-    /** Global gate health: armed, not degraded, and the client can reply. */
-    function healthy() {
-        return armed && !degraded && reply !== null;
-    }
-    return {
-        handleEvent(event) {
-            if (!armed)
-                return; // disposed
-            const type = String(event?.type ?? "");
-            const props = event?.properties;
-            if (!props)
-                return;
-            // live host 1.18.29 emits `permission.asked`; the shipped d.ts spells
-            // the same signal `permission.updated` — accept both open spellings
-            if (type === "permission.asked" || type === "permission.updated")
-                onAsked(props);
-            else if (type === "permission.replied")
-                onReplied(props);
-        },
-        start() {
-            // When the host has no list endpoint (`list` is null), events are the
-            // only pending signal, so start() is a deliberate no-op.
-            if (!list || !armed)
-                return;
-            schedulePoll();
-        },
-        dispose() {
-            armed = false;
-            if (pollHandle != null)
-                timers.clearTimeoutFn(pollHandle);
-            pollHandle = null;
-            for (const id of [...pending.keys()])
-                remove(id);
-        },
-        isArmed() {
-            return healthy();
-        },
-        canDefer(sessionID) {
-            // bound-method-safe (no `this`): destructure-able by the R6 hook
-            return healthy() && !!sessionID && liveAsk.has(sessionID);
-        },
-        hasLiveAsk(sessionID) {
-            return sessionID ? liveAsk.has(sessionID) : false;
-        },
-        registerExecSession(sessionID) {
-            if (sessionID)
-                liveAsk.add(sessionID);
-        },
-        revokeExecSession(sessionID) {
-            if (sessionID)
-                liveAsk.delete(sessionID);
-        },
-        isEnvApproved(sessionID) {
-            return !!sessionID && envApprovedSessions.has(sessionID);
-        },
-        pendingSize() {
-            return pending.size;
-        },
-    };
-}
-//# sourceMappingURL=approval-gate.js.map

package/dist/approval-gate.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"approval-gate.js","sourceRoot":"","sources":["../src/approval-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAGH,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAEhD;;;2EAG2E;AAC3E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAA;AAExC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAA;AAEpC;0EAC0E;AAC1E,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAA;AAElC;;;;iDAIiD;AACjD,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,CAAA;AAErC;;6BAE6B;AAC7B,MAAM,cAAc,GAAG,GAAG,CAAA;AAkB1B;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA0C,OAAO,CAAC,GAAG;IACvF,MAAM,GAAG,GAAG,GAAG,CAAC,kBAAkB,CAAA;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAA;IAC5F,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAA;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACzB,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI;QAAE,OAAO,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAA;IACrE,uEAAuE;IACvE,uEAAuE;IACvE,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,kBAAkB,CAAA;IACxD,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAC5C,CAAC;AAwED,kFAAkF;AAClF,SAAS,QAAQ,CAAC,MAAe,EAAE,IAAY,EAAE,QAAgB,EAAE,OAAe;IAChF,IAAI,CAAC;QACH,mEAAmE;QACnE,sEAAsE;QACtE,kEAAkE;QAClE,qEAAqE;QACrE,MAAM,GAAG,GAAI,MAA2E,EAAE,GAAG,CAAA;QAC7F,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,UAAU;YAAE,OAAM;QACjD,KAAK,GAAG,CAAC,GAAG,CAAC;YACX,IAAI,EAAE;gBACJ,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,mBAAmB;gBAC5B,OAAO,EAAE,GAAG,mBAAmB,OAAO,IAAI,OAAO,QAAQ,OAAO,OAAO,EAAE;aAC1E;SACF,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAY;IACrC,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;QACrD,MAAM,GAAG,GAAI,GAA2B,CAAC,KAAK,CAAA;QAC9C,IAAI,GAAG,EAAE,CAAC;YACR,qEAAqE;YACrE,oEAAoE;YACpE,uEAAuE;YACvE,sEAAsE;YACtE,gEAAgE;YAChE,MAAM,MAAM,GACT,GAA2C,CAAC,QAAQ,EAAE,MAAM;gBAC5D,GAA4B,CAAC,MAAM,CAAA;YACtC,MAAM,MAAM,CAAC,MAAM,CAAC,GAAa,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;QAChD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,CAAC,GAAG,GAKU,CAAA;IACpB,MAAM,IAAI,GACR,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,IAAI,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1E,CAAC,CAAC,CAAC,CAAC,IAAI;QACR,CAAC,CAAC,OAAO,CAAA;IACb,MAAM,SAAS,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,CAC/D,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CACnD,CAAA;IACD,OAAO,QAAQ,IAAI,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;AAC/E,CAAC;AAKD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,MAAM,CAAC,GAAG,GAMU,CAAA;IACpB,MAAM,SAAS,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,CAC/D,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CACnD,CAAA;IACD,MAAM,GAAG,GACP,GAAG,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,CAAA;IACpG,IAAI,SAAS,KAAK,GAAG,IAAI,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,eAAe,CAAA;IACxF,IAAI,SAAS,KAAK,GAAG,IAAI,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAA;IACpF,OAAO,WAAW,CAAA;AACpB,CAAC;AAED;;mFAEmF;AACnF,SAAS,eAAe,CACtB,KAAa;IAEb,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAA;IACzC,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAA;IAC/C,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,cAAc,CAAA;IAC3C,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc,CAAC,MAAe;IACrC,MAAM,CAAC,GAAG,MAGU,CAAA;IACpB,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACnB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAA;IACzB,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QAC7C,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACxB,wEAAwE;YACxE,OAAO,iBAAiB;YACtB,0EAA0E;YAC1E,MAAM,IAAI,CAAC,KAAM,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CACvF,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,oCAAoC,KAAK,UAAU,EAAE,CAAC;QACjE,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CACxB,iBAAiB,CACf,MAAM,CAAC,CAAC,oCAAqC,CAAC;YAC5C,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE;YACpC,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;SAC7B,CAAC,CACH,CAAA;IACL,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,aAAa,CAAC,MAAe;IACpC,MAAM,CAAC,GAAG,MAAoF,CAAA;IAC9F,MAAM,IAAI,GAAG,CAAC,EAAE,UAAU,CAAA;IAC1B,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC5C,wEAAwE;QACxE,OAAO,KAAK,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAK,CAAC,EAAE,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;qEAEqE;AACrE,MAAM,UAAU,4BAA4B,CAAC,MAAe;IAC1D,OAAO,cAAc,CAAC,MAAM,CAAC,KAAK,IAAI,CAAA;AACxC,CAAC;AAiBD,6EAA6E;AAC7E,SAAS,GAAG,CAAC,GAAG,MAAiB;IAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IAC/D,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAsB;IACvD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAA;IAClC,MAAM,MAAM,GAAe,IAAI,CAAC,MAAM,IAAI;QACxC,yEAAyE;QACzE,uEAAuE;QACvE,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE;YACvB,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;YAC5B,IAAI,OAAO,CAAC,EAAE,KAAK,KAAK,UAAU;gBAAE,CAAC,CAAC,KAAK,EAAE,CAAA;YAC7C,OAAO,CAAC,CAAA;QACV,CAAC;QACD,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAmB,CAAC;KACzD,CAAA;IACD,MAAM,KAAK,GAAiB,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAC1B,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAA;IAC/C,yEAAyE;IACzE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC;;;;;6DAKyD;IACzD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAA;IAC7C;sDACkD;IAClD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC7C,wEAAwE;IACxE,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7C,IAAI,KAAK,GAAG,IAAI,CAAA;IAChB,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,UAAU,GAAgB,IAAI,CAAA;IAElC,SAAS,MAAM,CAAC,EAAU;QACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC3B,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YAChC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACpB,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,SAAS,SAAS,CAAC,EAAU,EAAE,GAAY,EAAE,GAAsB;QACjE,wEAAwE;QACxE,0EAA0E;QAC1E,wEAAwE;QACxE,uCAAuC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC3B,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACjB,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;YACb,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE,GAAG,IAAI,EAAE;YAC3B,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE,GAAG,IAAI,QAAQ;YACjC,EAAE,EAAE,KAAK,EAAE;SACZ,CAAC,CAAA;QACF,OAAO,MAAM,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAA2B,CAAA;YAC/D,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAK;YAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACvB,CAAC;IACH,CAAC;IAED,6DAA6D;IAC7D,SAAS,eAAe,CAAC,GAAW;QAClC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QACtC,IAAI,MAAM,IAAI,KAAK,EAAE,EAAE,CAAC;YACtB,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACvB,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,EAAU,EAAE,GAAqB;QACzD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC3B,IAAI,CAAC,GAAG;YAAE,OAAM;QAChB,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAClB,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,EAAE,GAAG,KAAK,CAAA;QACd,IAAI,OAAO,GAAG,EAAE,CAAA;QAChB,IAAI,SAAS,GAA6B,IAAI,CAAA;QAC9C,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,CAAC;gBACV,2EAA2E;gBAC3E,kEAAkE;gBAClE,2BAA2B;gBAC3B,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;gBACxB,EAAE,GAAG,IAAI,CAAA;YACX,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,EAAE,GAAG,KAAK,CAAA;YACV,SAAS,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAA;YACrC,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;QAChC,CAAC;QACD,8DAA8D;QAC9D,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,uEAAuE;QACvE,qCAAqC;QACrC,2EAA2E;QAC3E,iEAAiE;QACjE,IAAI,CAAC,EAAE,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YACzC,sEAAsE;YACtE,2BAA2B;YAC3B,QAAQ,GAAG,IAAI,CAAA;QACjB,CAAC;QACD,MAAM,OAAO,GAAG,EAAE;YAChB,CAAC,CAAC,kBAAkB;YACpB,CAAC,CAAC,SAAS,KAAK,eAAe;gBAC7B,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,SAAS,KAAK,aAAa;oBAC3B,CAAC,CAAC,oBAAoB;oBACtB,CAAC,CAAC,UAAU,CAAA;QAClB,wEAAwE;QACxE,2EAA2E;QAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,CAAA;IAClD,CAAC;IAED,SAAS,GAAG,CAAC,EAAU,EAAE,GAAW,EAAE,GAAqB;QACzD,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAM;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,KAAK,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,SAAS,CAAC,CAAA;QAC5E,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;IACtC,CAAC;IAED,oEAAoE;IACpE,SAAS,WAAW,CAClB,EAAsB,EACtB,GAAuB,EACvB,GAAqB;QAErB,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG;YAAE,OAAM;QACvB,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAM,CAAC,mCAAmC;QAC9D,IAAI,eAAe,CAAC,GAAG,CAAC;YAAE,OAAM,CAAC,sCAAsC;QACvE,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAM;QAC3B,qEAAqE;QACrE,gEAAgE;QAChE,sEAAsE;QACtE,sEAAsE;QACtE,yBAAyB;QACzB,IAAI,GAAG,KAAK,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;QACpC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IACnB,CAAC;IAED,KAAK,UAAU,QAAQ;QACrB,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,OAAM;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAA;YACxB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,GAA0B,EAAE,IAAI,CAAA;YACzE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;oBACxB,MAAM,KAAK,GAAI,IAAiC,EAAE,UAAU,IAAI,IAAI,CAAA;oBACpE,MAAM,GAAG,GAAG,oBAAoB,CAAC,KAAmD,CAAC,CAAA;oBACrF,IAAI,CAAC,GAAG;wBAAE,SAAQ;oBAClB,MAAM,CAAC,GAAG,KAAuF,CAAA;oBACjG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAA;gBAC5E,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;IACH,CAAC;IAED,SAAS,YAAY;QACnB,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE;YACpC,KAAK,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC3B,oEAAoE;gBACpE,IAAI,KAAK;oBAAE,YAAY,EAAE,CAAA;YAC3B,CAAC,CAAC,CAAA;QACJ,CAAC,EAAE,gBAAgB,CAAC,CAAA;IACtB,CAAC;IAED;8CAC0C;IAC1C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAElC,SAAS,OAAO,CAAC,KAAiD;QAChE,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,CAAA;QAC7D,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC7B,IAAI,EAAE,EAAE,CAAC;oBACP,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;oBAChB,IAAI,QAAQ,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC;wBACxB,2DAA2D;wBAC3D,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;wBAC5C,IAAI,KAAK,KAAK,SAAS;4BAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;oBACjD,CAAC;gBACH,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,YAAY,IAAI,YAAY,CAAC,CAAA;oBAC3E,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;oBAChF,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;oBACvD,MAAM,CAAC,UAAU,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,cAAc,CAAC,CAAA;gBACzE,CAAC;gBAAC,MAAM,CAAC;oBACP,wDAAwD;gBAC1D,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,QAAQ;YAAE,OAAM,CAAC,iDAAiD;QACtE,MAAM,GAAG,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;QACvC,IAAI,CAAC,GAAG;YAAE,OAAM,CAAC,4DAA4D;QAC7E,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAA;IAC5F,CAAC;IAED,SAAS,SAAS,CAAC,KAAiD;QAClE,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAChC,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;QAC7D,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC7C,sEAAsE;QACtE,0EAA0E;QAC1E,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QAC7C,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC7C,IAAI,EAAE;YAAE,SAAS,CAAC,EAAE,EAAE,GAAG,IAAI,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;QAClD,wEAAwE;QACxE,wEAAwE;QACxE,oEAAoE;QACpE,yEAAyE;QACzE,6BAA6B;QAC7B,MAAM,QAAQ,GAAwB,EAAE,CAAA;QACxC,IAAI,OAAiC,CAAA;QACrC,IAAI,EAAE,EAAE,CAAC;YACP,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAA;YACpB,IAAI,OAAO;gBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACrC,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC;YACtC,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;gBAC3B,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBACnB,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;gBAChC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAA;gBAChC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACpB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,EAAE,IAAI,GAAG;YAAE,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC,CAAA;QACnE,yEAAyE;QACzE,2EAA2E;QAC3E,uEAAuE;QACvE,2EAA2E;QAC3E,4EAA4E;QAC5E,yEAAyE;QACzE,sEAAsE;QACtE,4EAA4E;QAC5E,IAAI,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAC/D,IAAI,KAAK,IAAI,IAAI;gBAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAA;QACxE,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,CAAC,IAAI;gBAAE,SAAQ,CAAC,2DAA2D;YAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;YAChC,MAAM,OAAO,GACX,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU;gBAC/B,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB;oBACvC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,cAAc;wBACnC,CAAC,CAAC,UAAU,CAAA,CAAC,gEAAgE;YAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;YAC1C,qEAAqE;YACrE,sEAAsE;YACtE,kEAAkE;YAClE,kEAAkE;YAClE,mEAAmE;YACnE,0DAA0D;YAC1D,IAAI,OAAO,KAAK,gBAAgB,IAAI,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxE,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,SAAS,OAAO;QACd,OAAO,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAA;IAC7C,CAAC;IAED,OAAO;QACL,WAAW,CAAC,KAAsB;YAChC,IAAI,CAAC,KAAK;gBAAE,OAAM,CAAC,WAAW;YAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;YACtC,MAAM,KAAK,GAAG,KAAK,EAAE,UAAU,CAAA;YAC/B,IAAI,CAAC,KAAK;gBAAE,OAAM;YAClB,sEAAsE;YACtE,oEAAoE;YACpE,IAAI,IAAI,KAAK,kBAAkB,IAAI,IAAI,KAAK,oBAAoB;gBAAE,OAAO,CAAC,KAAK,CAAC,CAAA;iBAC3E,IAAI,IAAI,KAAK,oBAAoB;gBAAE,SAAS,CAAC,KAAK,CAAC,CAAA;QAC1D,CAAC;QACD,KAAK;YACH,sEAAsE;YACtE,yDAAyD;YACzD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;gBAAE,OAAM;YAC3B,YAAY,EAAE,CAAA;QAChB,CAAC;QACD,OAAO;YACL,KAAK,GAAG,KAAK,CAAA;YACb,IAAI,UAAU,IAAI,IAAI;gBAAE,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;YACzD,UAAU,GAAG,IAAI,CAAA;YACjB,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;gBAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QAClD,CAAC;QACD,OAAO;YACL,OAAO,OAAO,EAAE,CAAA;QAClB,CAAC;QACD,QAAQ,CAAC,SAAkB;YACzB,iEAAiE;YACjE,OAAO,OAAO,EAAE,IAAI,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC3D,CAAC;QACD,UAAU,CAAC,SAAkB;YAC3B,OAAO,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACnD,CAAC;QACD,mBAAmB,CAAC,SAAkB;YACpC,IAAI,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACvC,CAAC;QACD,iBAAiB,CAAC,SAAkB;YAClC,IAAI,SAAS;gBAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC1C,CAAC;QACD,aAAa,CAAC,SAAkB;YAC9B,OAAO,CAAC,CAAC,SAAS,IAAI,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC1D,CAAC;QACD,WAAW;YACT,OAAO,OAAO,CAAC,IAAI,CAAA;QACrB,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/host/v1.d.ts

@@ -1,14 +0,0 @@
-/**
- * The v1 personality: everything this plugin does through the OpenCode 1.18.x
- * `server(input, options)` hook object.  Moved out of `src/index.ts` verbatim
- * for the v2 port (see docs plan) — no behaviour change is allowed here; a v1
- * host must observe byte-identical hooks, and the ~1700 assertions in
- * test-*.mjs are the oracle that keeps that promise.
- *
- * v1-only by construction: the single composed `tool.execute.before` slot, the
- * permission-event approval gate, the `{"*": "ask"}` bash escalation object,
- * and `tui.showToast` notification.
- */
-import type { PluginInput, Hooks } from "../types.js";
-export declare function createV1Personality(input: PluginInput, options?: Record<string, unknown>): Promise<Hooks>;
-//# sourceMappingURL=v1.d.ts.map