@theokit/sdk 2.4.0 → 2.5.0

package/dist/index.cjs

@@ -18715,25 +18715,47 @@ async function migrateSqliteToLance2(options) {
 
 // src/permission-engine.ts
 var PermissionEngine = class {
-  constructor(rules) {
+  constructor(rules, options = {}) {
     this.rules = rules;
+    this.defaultAction = options.defaultAction ?? "allow";
   }
   rules;
+  defaultAction;
   /**
-   * Evaluate a tool name against the rules. First match wins; default "allow".
+   * Evaluate a tool name against the rules. First match wins; falls back to the
+   * configured `defaultAction` (default `"allow"`) when no rule matches.
    */
   evaluate(toolName) {
     for (const rule of this.rules) {
-      if (typeof rule.tool === "string") {
-        if (rule.tool === toolName) return rule.action;
-      } else {
-        if (rule.tool.test(toolName)) return rule.action;
-      }
+      const matches = typeof rule.tool === "string" ? rule.tool === toolName : rule.tool.test(toolName);
+      if (matches) return rule.action;
     }
-    return "allow";
+    return this.defaultAction;
   }
 };
 
+// src/permission-plugin.ts
+function createPermissionPlugin(engine, opts = {}) {
+  return definePlugin({
+    name: opts.name ?? "permission-engine",
+    version: "1.0.0",
+    kind: "general",
+    register(ctx) {
+      ctx.on("pre_tool_call", (rawCtx) => {
+        const { name } = rawCtx;
+        const action = engine.evaluate(name);
+        if (action === "deny") {
+          return { block: true, message: `denied by permission engine: ${name}` };
+        }
+        if (action === "ask") {
+          return opts.onAsk ? opts.onAsk(name) : { block: true, message: `requires approval: ${name}` };
+        }
+        return void 0;
+      });
+    }
+  });
+}
+
 // src/security.ts
 init_security();
 var Security = class {
@@ -19523,6 +19545,7 @@ exports.computeCost = computeCost;
 exports.createAgentFactory = createAgentFactory;
 exports.createCounterBudgetTracker = createCounterBudgetTracker;
 exports.createNoopMemoryProvider = createNoopMemoryProvider;
+exports.createPermissionPlugin = createPermissionPlugin;
 exports.createSquad = createSquad;
 exports.definePlugin = definePlugin;
 exports.defineProvider = defineProvider;