@tienne/gestalt 0.88.0 → 0.89.0

package/dist/src/utils/claude-projects.js

@@ -0,0 +1,157 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync, readdirSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+const defaultExecGit = (cwd, args) => execFileSync('git', args, {
+    cwd,
+    encoding: 'utf-8',
+    stdio: ['ignore', 'pipe', 'ignore'],
+    maxBuffer: 16 * 1024 * 1024,
+});
+export function encodeClaudeProjectDir(absPath) {
+    return absPath.replace(/[^A-Za-z0-9-]/g, '-');
+}
+export function normalizeRemoteUrl(url) {
+    let rest = url.trim();
+    rest = rest.replace(/^[a-z][a-z0-9+.-]*:\/\//i, '');
+    rest = rest.replace(/^[^@/]*@/, '');
+    // scp 꼴(host:org/repo)은 첫 콜론이 구분자이고 URL 꼴의 host:port는 포트를 버린다.
+    rest = rest.replace(/^([^/:]+):(\d+)\//, '$1/').replace(/^([^/:]+):/, '$1/');
+    rest = rest
+        .replace(/\/+$/, '')
+        .replace(/\.git$/, '')
+        .replace(/\/+$/, '');
+    const slash = rest.indexOf('/');
+    if (slash < 0)
+        return rest.toLowerCase();
+    return rest.slice(0, slash).toLowerCase() + rest.slice(slash);
+}
+export function listWorktreePaths(repoRoot, execGit = defaultExecGit) {
+    try {
+        const out = execGit(repoRoot, ['worktree', 'list', '--porcelain']);
+        return out
+            .split('\n')
+            .filter((l) => l.startsWith('worktree '))
+            .map((l) => l.slice('worktree '.length).trim())
+            .filter(Boolean);
+    }
+    catch {
+        return [];
+    }
+}
+function remoteKeyOf(dir, execGit) {
+    try {
+        const url = execGit(dir, ['remote', 'get-url', 'origin']).trim();
+        return url ? normalizeRemoteUrl(url) : null;
+    }
+    catch {
+        return null;
+    }
+}
+function isDir(p) {
+    try {
+        return statSync(p).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * 인코딩은 손실이 있어(`/`, `.`, `-`가 모두 `-`) 디렉토리 이름만으론 원래 경로를 못 얻는다.
+ * 조각 사이 구분자를 실제 파일시스템에 대어 보며 존재하는 경로로 복원한다.
+ */
+function restorePath(encoded) {
+    if (!encoded.startsWith('-'))
+        return null;
+    const pieces = encoded.slice(1).split('-');
+    const listCache = new Map();
+    const list = (dir) => {
+        let v = listCache.get(dir);
+        if (!v) {
+            try {
+                v = readdirSync(dir);
+            }
+            catch {
+                v = [];
+            }
+            listCache.set(dir, v);
+        }
+        return v;
+    };
+    const join2 = (dir, seg) => (dir === '/' ? `/${seg}` : `${dir}/${seg}`);
+    const walk = (i, dir, seg) => {
+        // 지금까지의 조각이 dir 아래 어떤 항목의 접두어도 아니면 더 이어 봐야 헛걸음이다.
+        if (!list(dir).some((n) => n.startsWith(seg)))
+            return null;
+        if (i === pieces.length) {
+            const full = join2(dir, seg);
+            return seg && existsSync(full) ? full : null;
+        }
+        const next = pieces[i];
+        if (seg && isDir(join2(dir, seg))) {
+            const r = walk(i + 1, join2(dir, seg), next);
+            if (r)
+                return r;
+        }
+        for (const sep of ['-', '.']) {
+            const r = walk(i + 1, dir, seg + sep + next);
+            if (r)
+                return r;
+        }
+        return null;
+    };
+    return walk(1, '/', pieces[0]);
+}
+export function findClaudeProjectMemoryDirs(opts) {
+    const execGit = opts.execGit ?? defaultExecGit;
+    const projectsRoot = opts.projectsRoot ?? join(homedir(), '.claude', 'projects');
+    const remoteKey = remoteKeyOf(opts.repoRoot, execGit);
+    const memoryDirs = new Set();
+    const matchedPaths = new Set();
+    const seenEncoded = new Set();
+    const tryPath = (absPath) => {
+        const encoded = encodeClaudeProjectDir(absPath);
+        seenEncoded.add(encoded);
+        const mem = join(projectsRoot, encoded, 'memory');
+        if (isDir(mem)) {
+            memoryDirs.add(mem);
+            matchedPaths.add(absPath);
+        }
+    };
+    const firstPass = new Set([
+        opts.repoRoot,
+        ...listWorktreePaths(opts.repoRoot, execGit),
+        ...(opts.extraRoots ?? []),
+    ]);
+    for (const p of firstPass)
+        tryPath(p);
+    if (remoteKey && isDir(projectsRoot)) {
+        let entries;
+        try {
+            entries = readdirSync(projectsRoot);
+        }
+        catch {
+            entries = [];
+        }
+        for (const entry of entries) {
+            if (seenEncoded.has(entry))
+                continue;
+            const mem = join(projectsRoot, entry, 'memory');
+            if (!isDir(mem))
+                continue;
+            const restored = restorePath(entry);
+            if (!restored || !isDir(restored))
+                continue;
+            if (remoteKeyOf(restored, execGit) === remoteKey) {
+                memoryDirs.add(mem);
+                matchedPaths.add(restored);
+            }
+        }
+    }
+    return {
+        remoteKey,
+        matchedPaths: [...matchedPaths].sort(),
+        memoryDirs: [...memoryDirs].sort(),
+    };
+}
+//# sourceMappingURL=claude-projects.js.map

package/dist/src/utils/claude-projects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-projects.js","sourceRoot":"","sources":["../../../src/utils/claude-projects.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAmBjC,MAAM,cAAc,GAAY,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAC5C,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;IACxB,GAAG;IACH,QAAQ,EAAE,OAAO;IACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;IACnC,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;CAC5B,CAAC,CAAC;AAEL,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,OAAO,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;IACpD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACpC,+DAA+D;IAC/D,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC7E,IAAI,GAAG,IAAI;SACR,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;SACnB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IACzC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,UAAmB,cAAc;IACnF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;QACnE,OAAO,GAAG;aACP,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;aACxC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;aAC9C,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,OAAgB;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjE,OAAO,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,CAAS;IACtB,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,MAAM,IAAI,GAAG,CAAC,GAAW,EAAY,EAAE;QACrC,IAAI,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,CAAC;gBACH,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,CAAC,GAAG,EAAE,CAAC;YACT,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,GAAW,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC;IAExF,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,GAAW,EAAE,GAAW,EAAiB,EAAE;QAClE,kDAAkD;QAClD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3D,IAAI,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC7B,OAAO,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/C,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QACxB,IAAI,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;YAC7C,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC;QAClB,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC;YAC7C,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,OAAO,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,IAAwC;IAExC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;IAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAEtD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAEtC,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,EAAE;QAClC,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAChD,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACf,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpB,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;QACxB,IAAI,CAAC,QAAQ;QACb,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;KAC3B,CAAC,CAAC;IACH,KAAK,MAAM,CAAC,IAAI,SAAS;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAEtC,IAAI,SAAS,IAAI,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACrC,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,SAAS;YACrC,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YAChD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC1B,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAC5C,IAAI,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;gBACjD,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACpB,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS;QACT,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE;QACtC,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE;KACnC,CAAC;AACJ,CAAC"}

package/dist/src/utils/read-only-tools.d.ts

@@ -0,0 +1,19 @@
+export declare const READ_ONLY_ALLOW_WORDS: readonly ["search", "get", "read", "list", "query", "fetch"];
+export declare const READ_ONLY_DENY_WORDS: readonly ["send", "create", "update", "delete", "post", "put", "patch", "dml", "ddl"];
+type Classification = 'allow' | 'deny' | 'ambiguous';
+export declare function classifyToolName(name: string): Classification;
+export interface FilteredTools {
+    allowed: string[];
+    denied: string[];
+    ambiguous: string[];
+}
+export declare function filterReadOnlyTools(names: string[]): FilteredTools;
+/** CLI 하위 명령이 이 동사로 시작해야 읽기 전용으로 본다. 도구 이름 규칙과 같은 원리다 */
+export declare const READ_ONLY_CLI_VERBS: readonly ["list", "get", "describe"];
+/**
+ * 셸 명령 한 줄이 읽기 전용 클라우드 조회인지 본다. 지금은 aws CLI와 aws-vault list만 판정하고 나머지는 ambiguous다.
+ * 하위 명령이 list, get, describe로 시작해야 allow이고 비밀값이나 자격증명을 내주는 동작은 이름이 get이어도 deny다.
+ */
+export declare function classifyCliCommand(command: string): Classification;
+export {};
+//# sourceMappingURL=read-only-tools.d.ts.map

package/dist/src/utils/read-only-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-only-tools.d.ts","sourceRoot":"","sources":["../../../src/utils/read-only-tools.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,qBAAqB,8DAA+D,CAAC;AAElG,eAAO,MAAM,oBAAoB,uFAUvB,CAAC;AAEX,KAAK,cAAc,GAAG,OAAO,GAAG,MAAM,GAAG,WAAW,CAAC;AAcrD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAuB7D;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,aAAa,CAiBlE;AAED,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,sCAAuC,CAAC;AA2CxE;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAalE"}

package/dist/src/utils/read-only-tools.js

@@ -0,0 +1,132 @@
+export const READ_ONLY_ALLOW_WORDS = ['search', 'get', 'read', 'list', 'query', 'fetch'];
+export const READ_ONLY_DENY_WORDS = [
+    'send',
+    'create',
+    'update',
+    'delete',
+    'post',
+    'put',
+    'patch',
+    'dml',
+    'ddl',
+];
+function tokenize(name) {
+    if (!name)
+        return [];
+    // camelCase 경계 분리: 대문자 앞에 공백 삽입
+    const withSpaces = name.replace(/([a-z])([A-Z])/g, '$1 $2');
+    // _ - . : / 로 분리
+    const tokens = withSpaces.split(/[\s_\-.:/]+/);
+    return tokens.filter((t) => t.length > 0).map((t) => t.toLowerCase());
+}
+export function classifyToolName(name) {
+    const tokens = tokenize(name);
+    if (tokens.length === 0)
+        return 'ambiguous';
+    const allowWords = new Set(READ_ONLY_ALLOW_WORDS);
+    const denyWords = new Set(READ_ONLY_DENY_WORDS);
+    let hasAllow = false;
+    let hasDeny = false;
+    for (const token of tokens) {
+        if (denyWords.has(token)) {
+            hasDeny = true;
+        }
+        if (allowWords.has(token)) {
+            hasAllow = true;
+        }
+    }
+    if (hasDeny)
+        return 'deny';
+    if (hasAllow)
+        return 'allow';
+    return 'ambiguous';
+}
+export function filterReadOnlyTools(names) {
+    const allowed = [];
+    const denied = [];
+    const ambiguous = [];
+    for (const name of names) {
+        const classification = classifyToolName(name);
+        if (classification === 'allow') {
+            allowed.push(name);
+        }
+        else if (classification === 'deny') {
+            denied.push(name);
+        }
+        else {
+            ambiguous.push(name);
+        }
+    }
+    return { allowed, denied, ambiguous };
+}
+/** CLI 하위 명령이 이 동사로 시작해야 읽기 전용으로 본다. 도구 이름 규칙과 같은 원리다 */
+export const READ_ONLY_CLI_VERBS = ['list', 'get', 'describe'];
+// 이름은 읽기지만 비밀값이나 임시 자격증명을 내주거나 로컬에 파일을 쓰는 동작이다
+const CLI_SENSITIVE_WORDS = ['secret', 'password', 'token', 'credential', 'credentials'];
+const CLI_DENY_OPERATIONS = new Set(['get-object', 'get-object-torrent']);
+const CLI_DENY_FLAGS = new Set(['--with-decryption']);
+// 셸 연결이나 치환, 리다이렉션이 섞이면 뒤에 무엇이 붙었는지 이 함수로는 알 수 없다
+const SHELL_META_RE = /[;&|`<>\n\r]|\$\(/;
+// aws 전역 옵션 중 값을 받지 않는 것. 나머지 --옵션은 다음 토큰을 값으로 먹는다
+const AWS_FLAG_ONLY_OPTIONS = new Set([
+    '--debug',
+    '--no-verify-ssl',
+    '--no-paginate',
+    '--no-sign-request',
+    '--no-cli-pager',
+    '--cli-auto-prompt',
+    '--no-cli-auto-prompt',
+]);
+function awsPositionals(args) {
+    const out = [];
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a.startsWith('--')) {
+            if (!a.includes('=') && !AWS_FLAG_ONLY_OPTIONS.has(a))
+                i += 1;
+            continue;
+        }
+        out.push(a);
+        if (out.length === 2)
+            break;
+    }
+    return out;
+}
+function classifyAwsOperation(service, operation) {
+    if (service === 'configure')
+        return operation === 'list-profiles' ? 'allow' : 'deny';
+    if (CLI_DENY_OPERATIONS.has(operation))
+        return 'deny';
+    const words = operation.split('-');
+    if (words.some((w) => CLI_SENSITIVE_WORDS.includes(w)))
+        return 'deny';
+    const verb = words[0];
+    if (READ_ONLY_CLI_VERBS.includes(verb))
+        return 'allow';
+    return 'deny';
+}
+/**
+ * 셸 명령 한 줄이 읽기 전용 클라우드 조회인지 본다. 지금은 aws CLI와 aws-vault list만 판정하고 나머지는 ambiguous다.
+ * 하위 명령이 list, get, describe로 시작해야 allow이고 비밀값이나 자격증명을 내주는 동작은 이름이 get이어도 deny다.
+ */
+export function classifyCliCommand(command) {
+    const trimmed = command.trim();
+    if (trimmed === '')
+        return 'ambiguous';
+    if (SHELL_META_RE.test(trimmed))
+        return 'deny';
+    const tokens = trimmed.split(/\s+/);
+    const program = tokens[0];
+    const args = tokens.slice(1);
+    if (args.some((a) => CLI_DENY_FLAGS.has(a.split('=')[0])))
+        return 'deny';
+    if (program === 'aws-vault')
+        return args[0] === 'list' ? 'allow' : 'deny';
+    if (program !== 'aws')
+        return 'ambiguous';
+    const [service, operation] = awsPositionals(args);
+    if (service === undefined || operation === undefined)
+        return 'ambiguous';
+    return classifyAwsOperation(service, operation);
+}
+//# sourceMappingURL=read-only-tools.js.map

package/dist/src/utils/read-only-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-only-tools.js","sourceRoot":"","sources":["../../../src/utils/read-only-tools.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC;AAElG,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,KAAK;IACL,OAAO;IACP,KAAK;IACL,KAAK;CACG,CAAC;AAIX,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAErB,gCAAgC;IAChC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;IAE5D,iBAAiB;IACjB,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAE/C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE9B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAE5C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,qBAAqB,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAS,oBAAoB,CAAC,CAAC;IAExD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,OAAO;QAAE,OAAO,MAAM,CAAC;IAC3B,IAAI,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC7B,OAAO,WAAW,CAAC;AACrB,CAAC;AAQD,MAAM,UAAU,mBAAmB,CAAC,KAAe;IACjD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,cAAc,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;aAAM,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACxC,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAU,CAAC;AAExE,+CAA+C;AAC/C,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;AACzF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAC1E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;AACtD,kDAAkD;AAClD,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAC1C,mDAAmD;AACnD,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,SAAS;IACT,iBAAiB;IACjB,eAAe;IACf,mBAAmB;IACnB,gBAAgB;IAChB,mBAAmB;IACnB,sBAAsB;CACvB,CAAC,CAAC;AAEH,SAAS,cAAc,CAAC,IAAc;IACpC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;YAC9D,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe,EAAE,SAAiB;IAC9D,IAAI,OAAO,KAAK,WAAW;QAAE,OAAO,SAAS,KAAK,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IACrF,IAAI,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC;IACtD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACtE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACvB,IAAK,mBAAyC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC;IAC9E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,WAAW,CAAC;IACvC,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAC1E,IAAI,OAAO,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1E,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,WAAW,CAAC;IAC1C,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IACzE,OAAO,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAClD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tienne/gestalt",
-  "version": "0.88.0",
+  "version": "0.89.0",
   "description": "TypeScript AI Development Harness - Gestalt psychology-driven requirement clarification",
   "repository": {
     "type": "git",
@@ -58,6 +58,7 @@
     "chokidar": "^4.0.3",
     "commander": "^13.1.0",
     "dotenv": "^17.3.1",
+    "elkjs": "^0.12.0",
     "gray-matter": "^4.0.3",
     "node-notifier": "^10.0.1",
     "node-pty": "^1.1.0",

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gestalt",
-  "version": "0.88.0",
+  "version": "0.89.0",
   "description": "Gestalt psychology-driven AI development harness. Transforms scattered requirements into structured, validated specifications through interactive interviews.",
   "author": {
     "name": "tienne"

package/plugin/.mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "gestalt": {
       "command": "npx",
-      "args": ["-y", "@tienne/gestalt@0.88.0", "serve"],
+      "args": ["-y", "@tienne/gestalt@0.89.0", "serve"],
       "startup_timeout_sec": 180,
       "tool_timeout_sec": 900
     }

package/plugin/mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "gestalt": {
       "command": "npx",
-      "args": ["-y", "@tienne/gestalt@0.88.0", "serve"],
+      "args": ["-y", "@tienne/gestalt@0.89.0", "serve"],
       "startup_timeout_sec": 180,
       "tool_timeout_sec": 900
     }

package/plugin/skills/_shared/proactive-routing.md

@@ -49,6 +49,7 @@
 | 슬라이드 Reveal.js 구조·템플릿·비주얼 디자인 자문 | `presentation-designer` |
 | 발표자료·슬라이드·프레젠테이션 제작 요청 ("발표자료 만들어줘", "슬라이드 만들어줘", "피치덱") | `presentation` 스킬 사용 (presentation-writer 콘텐츠 → 승인 단계 → presentation-designer 디자인 → Reveal.js HTML) |
 | 시스템 설계, 아키텍처 리뷰, 설계 패턴 | `architect` |
+| 근거 달린 아키텍처 그림 요청 ("아키텍처 그려줘", "화면에서 DB까지 그려줘", "배포 경로 그려줘") | `architecture` 스킬 사용 (맥락 소스 찾기 → 읽기 전용 걸러내기 → 탐색 → IR validate → 미해결 질문 → render). 설계 리뷰나 자문이면 `architect` |
 | 보안 취약점, 인증/인가, 시크릿 노출 검토 | `security-reviewer` |
 | 성능 병목, N+1, 메모리 누수 분석 | `performance-reviewer` |
 | 코드 가독성, SOLID, 에러 처리 리뷰 | `quality-reviewer` |