@trops/dash-core 0.1.638 → 0.1.639

package/dist/electron/index.js

@@ -983,6 +983,8 @@ const BOTS_PAUSE_BOT$1 = "bots-pause-bot";
 const BOTS_RESUME_BOT$1 = "bots-resume-bot";
 const BOTS_GET_PAUSE_STATE$1 = "bots-get-pause-state";
 const BOTS_LIST_TOOL_SOURCES$1 = "bots-list-tool-sources";
+const BOTS_GET_GRANTS$1 = "bots-get-grants";
+const BOTS_REVOKE_GRANT$1 = "bots-revoke-grant";
 
 // --- Main → Renderer (send) ---
 const BOT_STREAM$2 = "bot-stream"; // { botId, event: BotEvent }
@@ -1010,6 +1012,8 @@ var botEvents$1 = {
   BOTS_RESUME_BOT: BOTS_RESUME_BOT$1,
   BOTS_GET_PAUSE_STATE: BOTS_GET_PAUSE_STATE$1,
   BOTS_LIST_TOOL_SOURCES: BOTS_LIST_TOOL_SOURCES$1,
+  BOTS_GET_GRANTS: BOTS_GET_GRANTS$1,
+  BOTS_REVOKE_GRANT: BOTS_REVOKE_GRANT$1,
   BOT_STREAM: BOT_STREAM$2,
   BOT_APPROVAL_PENDING: BOT_APPROVAL_PENDING$2,
   BOT_BUDGET_ALERT: BOT_BUDGET_ALERT$2,
@@ -19492,7 +19496,7 @@ util$E.isObject = isObject;
 util$E.isPlainObject = isPlainObject;
 util$E.numKeys = numKeys;
 util$E.escapeRegex = escapeRegex;
-util$E.clone = clone;
+util$E.clone = clone$1;
 util$E.normalizeParams = normalizeParams;
 util$E.createTransparentProxy = createTransparentProxy;
 util$E.stringifyPrimitive = stringifyPrimitive;
@@ -19715,7 +19719,7 @@ function escapeRegex(str) {
     return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 // zod-specific utils
-function clone(inst, def, params) {
+function clone$1(inst, def, params) {
     const cl = new inst._zod.constr(def ?? inst._zod.def);
     if (!def || params?.parent)
         cl._zod.parent = inst;
@@ -19805,7 +19809,7 @@ function pick$1(schema, mask) {
         // pick key
         newShape[key] = currDef.shape[key];
     }
-    return clone(schema, {
+    return clone$1(schema, {
         ...schema._zod.def,
         shape: newShape,
         checks: [],
@@ -19822,7 +19826,7 @@ function omit(schema, mask) {
             continue;
         delete newShape[key];
     }
-    return clone(schema, {
+    return clone$1(schema, {
         ...schema._zod.def,
         shape: newShape,
         checks: [],
@@ -19841,10 +19845,10 @@ function extend(schema, shape) {
         },
         checks: [], // delete existing checks
     };
-    return clone(schema, def);
+    return clone$1(schema, def);
 }
 function merge(a, b) {
-    return clone(a, {
+    return clone$1(a, {
         ...a._zod.def,
         get shape() {
             const _shape = { ...a._zod.def.shape, ...b._zod.def.shape };
@@ -19885,7 +19889,7 @@ function partial(Class, schema, mask) {
                 : oldShape[key];
         }
     }
-    return clone(schema, {
+    return clone$1(schema, {
         ...schema._zod.def,
         shape,
         checks: [],
@@ -19917,7 +19921,7 @@ function required$3(Class, schema, mask) {
             });
         }
     }
-    return clone(schema, {
+    return clone$1(schema, {
         ...schema._zod.def,
         shape,
         // optional: [],
@@ -36674,7 +36678,7 @@ function _resolveIdentity({ token, widgetId }) {
 // Argument keys that look like paths. Different MCP servers use
 // different conventions; this list covers the common filesystem-style
 // servers. Extensible — add as new patterns surface.
-const PATH_ARG_KEYS = ["path", "uri", "filepath", "file", "directory"];
+const PATH_ARG_KEYS$1 = ["path", "uri", "filepath", "file", "directory"];
 
 // Heuristic: tool names matching this regex are treated as writes for
 // purposes of choosing readPaths vs writePaths. The match is intentionally
@@ -36683,7 +36687,7 @@ const PATH_ARG_KEYS = ["path", "uri", "filepath", "file", "directory"];
 const WRITE_TOOL_PATTERN =
   /(^|_)(write|create|edit|delete|remove|append|move|rename|chmod|chown|mkdir)/i;
 
-function isWriteTool(toolName) {
+function isWriteTool$1(toolName) {
   if (typeof toolName !== "string") return false;
   return WRITE_TOOL_PATTERN.test(toolName);
 }
@@ -36757,7 +36761,7 @@ function _evaluateGrant({
 
   // Path-argument containment. Only checked when the tool's args
   // include a path-shaped key.
-  const isWrite = isWriteTool(toolName);
+  const isWrite = isWriteTool$1(toolName);
   // Write tools must use writePaths; read tools may use either
   // readPaths or writePaths (write access implies read access).
   const allowedPaths = isWrite
@@ -36765,7 +36769,7 @@ function _evaluateGrant({
     : [...serverPerms.readPaths, ...serverPerms.writePaths];
 
   if (args && typeof args === "object") {
-    for (const key of PATH_ARG_KEYS) {
+    for (const key of PATH_ARG_KEYS$1) {
       const v = args[key];
       if (typeof v !== "string" || !v) continue;
       if (allowedPaths.length === 0) {
@@ -37134,8 +37138,8 @@ var permissionGate = {
   gateToolCall: gateToolCall$1,
   gateBotToolCall,
   gateToolCallWithJit: gateToolCallWithJit$1,
-  isWriteTool,
-  PATH_ARG_KEYS,
+  isWriteTool: isWriteTool$1,
+  PATH_ARG_KEYS: PATH_ARG_KEYS$1,
 };
 
 /**
@@ -75184,6 +75188,9 @@ var agentToolBridge = {
 const { createEventStream } = eventStream;
 const { BOT_MCP_SERVER, buildBotMcpServer } = agentToolBridge;
 
+// The SDK names bridged tools "mcp__<server>__<tool>".
+const BRIDGED_PREFIX = `mcp__${BOT_MCP_SERVER}__`;
+
 // Test seam: injected fake `query` implementation (see __setQueryForTest).
 let _queryImpl = null;
 
@@ -75243,7 +75250,27 @@ function _makeCanUseTool(ctx) {
     if (ctx.approvalPolicy === "allow") {
       return { behavior: "allow", updatedInput: input };
     }
-    // Otherwise gate through the approval queue (shown in the Activity panel).
+    // Bridged Dash provider tools go through the SAME Dash permission gate as
+    // the tool-loop engine — grants, remembered approvals ("Always allow"),
+    // and the approval queue all apply, keyed by the real provider.
+    if (
+      typeof toolName === "string" &&
+      toolName.startsWith(BRIDGED_PREFIX) &&
+      typeof ctx.requestPermission === "function"
+    ) {
+      const decision = await ctx.requestPermission(
+        toolName.slice(BRIDGED_PREFIX.length),
+        input,
+      );
+      return decision && decision.allow
+        ? { behavior: "allow", updatedInput: input }
+        : {
+            behavior: "deny",
+            message: (decision && decision.reason) || "not permitted",
+          };
+    }
+    // Built-in tools (Bash, Write, …) ask every time via the approval queue
+    // (shown in the Activity panel) — they're never remembered.
     if (typeof ctx.createApproval !== "function") {
       return { behavior: "deny", message: "no approval channel available" };
     }
@@ -76538,6 +76565,111 @@ function normalizeMcpResult$1(mcpResult) {
 
 var mcpResult = { normalizeMcpResult: normalizeMcpResult$1 };
 
+/**
+ * rememberGrant.js — turn an "Always allow" bot approval into a durable grant,
+ * and revoke it.
+ *
+ * Bot grants live in the shared grant store (electron/mcp/grantedPermissions)
+ * keyed by botId, shape `{ servers: { [provider]: { tools, readPaths,
+ * writePaths } } }`, and are enforced by the bot permission gate
+ * (gateBotToolCall). A remembered approval is scoped to this bot + this
+ * provider + this tool, plus — when the tool call carries a path argument —
+ * the folder of that path (write folder for write tools, read folder
+ * otherwise). Nothing broader.
+ *
+ * Pure (NFR-006): the gate's path rules (isWriteTool, path arg keys) and
+ * `dirname` are injected so this matches the real gate exactly.
+ */
+
+const LISTING_TOOL = /(list|director|tree|search)/i;
+
+/**
+ * The folder to remember for a path argument: a `directory` arg, or a
+ * directory-listing tool, names the folder itself; any other path is a file,
+ * so its parent folder is remembered.
+ */
+function folderForPathArg(key, value, toolName, dirname) {
+  if (key === "directory" || LISTING_TOOL.test(String(toolName || ""))) {
+    return value;
+  }
+  return dirname(value);
+}
+
+const clone = (perms) =>
+  perms && typeof perms === "object" ? JSON.parse(JSON.stringify(perms)) : {};
+
+const addUnique = (list, value) =>
+  list.includes(value) ? list : [...list, value];
+
+/**
+ * @param {object|null} perms  the bot's current grant (or null)
+ * @param {{ serverName: string, toolName: string, args?: object }} call
+ * @param {{ isWriteTool: Function, pathArgKeys: string[], dirname: Function }} helpers
+ * @returns {object} the new grant (input is not mutated)
+ */
+function rememberToolGrant$1(perms, call, helpers) {
+  const { serverName, toolName, args } = call;
+  const next = clone(perms);
+  next.grantOrigin = next.grantOrigin || "manual";
+  next.servers = next.servers || {};
+  const server = next.servers[serverName] || {
+    tools: [],
+    readPaths: [],
+    writePaths: [],
+  };
+  server.tools = addUnique(server.tools || [], toolName);
+  server.readPaths = server.readPaths || [];
+  server.writePaths = server.writePaths || [];
+
+  if (args && typeof args === "object") {
+    const isWrite = helpers.isWriteTool(toolName);
+    for (const key of helpers.pathArgKeys) {
+      const v = args[key];
+      if (typeof v !== "string" || !v) continue;
+      const folder = folderForPathArg(key, v, toolName, helpers.dirname);
+      if (isWrite) server.writePaths = addUnique(server.writePaths, folder);
+      else server.readPaths = addUnique(server.readPaths, folder);
+    }
+  }
+
+  next.servers[serverName] = server;
+  return next;
+}
+
+/**
+ * Revoke one remembered tool. When it was the provider's last remembered
+ * tool, the provider entry (and its folders) is removed entirely.
+ */
+function forgetToolGrant$1(perms, serverName, toolName) {
+  const server = perms && perms.servers && perms.servers[serverName];
+  if (!server || !(server.tools || []).includes(toolName)) return perms;
+  const next = clone(perms);
+  const tools = next.servers[serverName].tools.filter((t) => t !== toolName);
+  if (tools.length) next.servers[serverName].tools = tools;
+  else delete next.servers[serverName];
+  return next;
+}
+
+/** Remembered tools + folders per provider, for display in the bot form. */
+function summarizeGrants$1(perms) {
+  const out = {};
+  const servers = (perms && perms.servers) || {};
+  for (const [name, s] of Object.entries(servers)) {
+    out[name] = {
+      tools: [...(s.tools || [])],
+      folders: [...(s.readPaths || []), ...(s.writePaths || [])],
+    };
+  }
+  return out;
+}
+
+var rememberGrant = {
+  rememberToolGrant: rememberToolGrant$1,
+  forgetToolGrant: forgetToolGrant$1,
+  summarizeGrants: summarizeGrants$1,
+  folderForPathArg,
+};
+
 /**
  * botController.js
  *
@@ -76575,6 +76707,13 @@ const {
   resolveBotTools,
   checkToolCall,
 } = toolSources;
+const {
+  rememberToolGrant,
+  forgetToolGrant,
+  summarizeGrants,
+} = rememberGrant;
+const grantStore = grantedPermissions;
+const { isWriteTool, PATH_ARG_KEYS } = permissionGate;
 const {
   getProvider: getProvider$1,
   getDefaultModel,
@@ -76802,6 +76941,8 @@ const botController$1 = {
 
   delete(botId) {
     this._scheduler.unregister(botId);
+    // A deleted bot's remembered approvals go with it.
+    grantStore.revokeGrant(botId);
     return this._store.delete(botId);
   },
 
@@ -76813,10 +76954,50 @@ const botController$1 = {
     return { stopped: this._runner.abort(botId) };
   },
 
+  /**
+   * Resolve a pending approval. `decision.remember` ("Always allow") also
+   * saves a durable grant for this bot + provider + tool (+ the folder of a
+   * path argument), so later runs use that tool without asking. Only provider
+   * tool approvals can be remembered — built-in agent tools have no provider
+   * and always ask.
+   */
   approve(approvalId, decision = {}) {
-    return decision.allow
-      ? { ok: this._approvals.resolve(approvalId, decision) }
-      : { ok: this._approvals.deny(approvalId, decision.reason) };
+    if (!decision.allow) {
+      return { ok: this._approvals.deny(approvalId, decision.reason) };
+    }
+    let remembered = false;
+    if (decision.remember) {
+      const pending = this._approvals.get(approvalId);
+      const req = pending && pending.request;
+      if (req && req.botId && req.serverName && req.toolName) {
+        const next = rememberToolGrant(
+          grantStore.getGrant(req.botId),
+          {
+            serverName: req.serverName,
+            toolName: req.toolName,
+            args: req.input,
+          },
+          { isWriteTool, pathArgKeys: PATH_ARG_KEYS, dirname: path$2.dirname },
+        );
+        remembered = grantStore.setGrant(req.botId, next) === true;
+      }
+    }
+    return { ok: this._approvals.resolve(approvalId, decision), remembered };
+  },
+
+  /** Remembered approvals for a bot: { [provider]: { tools, folders } }. */
+  getGrants(botId) {
+    return summarizeGrants(grantStore.getGrant(botId));
+  },
+
+  /** Revoke one remembered tool approval; returns the updated summary. */
+  revokeGrant(botId, serverName, toolName) {
+    const current = grantStore.getGrant(botId);
+    if (current) {
+      const next = forgetToolGrant(current, serverName, toolName);
+      if (next !== current) grantStore.setGrant(botId, next);
+    }
+    return this.getGrants(botId);
   },
 
   listApprovals() {
@@ -80985,6 +81166,8 @@ const {
   BOTS_RESUME_BOT,
   BOTS_GET_PAUSE_STATE,
   BOTS_LIST_TOOL_SOURCES,
+  BOTS_GET_GRANTS,
+  BOTS_REVOKE_GRANT,
   BOT_STREAM,
   BOT_APPROVAL_PENDING,
   BOT_BUDGET_ALERT,
@@ -81037,6 +81220,12 @@ const botApi$1 = {
   listToolSources: (workspaceId = null) =>
     ipcRenderer$3.invoke(BOTS_LIST_TOOL_SOURCES, { workspaceId }),
 
+  /** Remembered approvals ("Always allow"): { [provider]: { tools, folders } }. */
+  getGrants: (botId) => ipcRenderer$3.invoke(BOTS_GET_GRANTS, { botId }),
+  /** Revoke one remembered tool approval; resolves to the updated summary. */
+  revokeGrant: (botId, serverName, toolName) =>
+    ipcRenderer$3.invoke(BOTS_REVOKE_GRANT, { botId, serverName, toolName }),
+
   /** Subscribe to streamed run events: { botId, event }. */
   onStream: (callback) => _addListener(BOT_STREAM, callback),
   /** Subscribe to new pending approvals: { id, request }. */