@vitos-pizza/vitos-pizza 0.1.0 → 0.2.0

package/node_modules/@vitos-pizza/permission-system/src/forwarding/subagent-registry.ts

@@ -1,61 +1,61 @@
-const SUBAGENT_SESSION_REGISTRY_KEY = Symbol.for(
-	"@vitos-pizza/permission-system:subagent-registry",
-);
-
-export interface SubagentSessionInfo {
-	parentSessionId?: string;
-}
-
-export class SubagentSessionRegistry {
-	private readonly sessions = new Map<string, SubagentSessionInfo>();
-
-	register(sessionId: string, info: SubagentSessionInfo): void {
-		this.sessions.set(sessionId, info);
-	}
-
-	unregister(sessionId: string): void {
-		this.sessions.delete(sessionId);
-	}
-
-	get(sessionId: string): SubagentSessionInfo | undefined {
-		return this.sessions.get(sessionId);
-	}
-}
-
-export function getSubagentSessionRegistry(): SubagentSessionRegistry {
-	const store = globalThis as Record<symbol, unknown>;
-	const existing = store[SUBAGENT_SESSION_REGISTRY_KEY] as
-		| SubagentSessionRegistry
-		| undefined;
-	if (existing) return existing;
-	const registry = new SubagentSessionRegistry();
-	store[SUBAGENT_SESSION_REGISTRY_KEY] = registry;
-	return registry;
-}
-
-export const SUBAGENT_CHILD_SESSION_CREATED = "subagents:child:session-created";
-export const SUBAGENT_CHILD_DISPOSED = "subagents:child:disposed";
-
-interface LifecycleEventBus {
-	on(channel: string, handler: (data: unknown) => void): () => void;
-}
-
-export function subscribeSubagentLifecycle(
-	events: LifecycleEventBus,
-	registry: SubagentSessionRegistry,
-): () => void {
-	const unsubCreated = events.on(SUBAGENT_CHILD_SESSION_CREATED, (data) => {
-		const event = data as { sessionId: string; parentSessionId?: string };
-		registry.register(event.sessionId, {
-			parentSessionId: event.parentSessionId,
-		});
-	});
-	const unsubDisposed = events.on(SUBAGENT_CHILD_DISPOSED, (data) => {
-		const event = data as { sessionId: string };
-		registry.unregister(event.sessionId);
-	});
-	return () => {
-		unsubCreated();
-		unsubDisposed();
-	};
-}
+const SUBAGENT_SESSION_REGISTRY_KEY = Symbol.for(
+	"@vitos-pizza/permission-system:subagent-registry",
+);
+
+export interface SubagentSessionInfo {
+	parentSessionId?: string;
+}
+
+export class SubagentSessionRegistry {
+	private readonly sessions = new Map<string, SubagentSessionInfo>();
+
+	register(sessionId: string, info: SubagentSessionInfo): void {
+		this.sessions.set(sessionId, info);
+	}
+
+	unregister(sessionId: string): void {
+		this.sessions.delete(sessionId);
+	}
+
+	get(sessionId: string): SubagentSessionInfo | undefined {
+		return this.sessions.get(sessionId);
+	}
+}
+
+export function getSubagentSessionRegistry(): SubagentSessionRegistry {
+	const store = globalThis as Record<symbol, unknown>;
+	const existing = store[SUBAGENT_SESSION_REGISTRY_KEY] as
+		| SubagentSessionRegistry
+		| undefined;
+	if (existing) return existing;
+	const registry = new SubagentSessionRegistry();
+	store[SUBAGENT_SESSION_REGISTRY_KEY] = registry;
+	return registry;
+}
+
+export const SUBAGENT_CHILD_SESSION_CREATED = "subagents:child:session-created";
+export const SUBAGENT_CHILD_DISPOSED = "subagents:child:disposed";
+
+interface LifecycleEventBus {
+	on(channel: string, handler: (data: unknown) => void): () => void;
+}
+
+export function subscribeSubagentLifecycle(
+	events: LifecycleEventBus,
+	registry: SubagentSessionRegistry,
+): () => void {
+	const unsubCreated = events.on(SUBAGENT_CHILD_SESSION_CREATED, (data) => {
+		const event = data as { sessionId: string; parentSessionId?: string };
+		registry.register(event.sessionId, {
+			parentSessionId: event.parentSessionId,
+		});
+	});
+	const unsubDisposed = events.on(SUBAGENT_CHILD_DISPOSED, (data) => {
+		const event = data as { sessionId: string };
+		registry.unregister(event.sessionId);
+	});
+	return () => {
+		unsubCreated();
+		unsubDisposed();
+	};
+}

package/node_modules/@vitos-pizza/permission-system/src/gates/path-utils.ts

@@ -1,66 +1,66 @@
-import { existsSync } from "node:fs";
-import { dirname, isAbsolute, relative, resolve } from "node:path";
-import { expandHomePath } from "../expand-home.ts";
-
-export function normalizePathValue(pathValue: string, cwd: string): string {
-	const expanded = expandHomePath(pathValue.trim());
-	if (!expanded) return expanded;
-	return isAbsolute(expanded) ? resolve(expanded) : resolve(cwd, expanded);
-}
-
-export function findProjectRoot(cwd: string): string {
-	let dir = resolve(cwd);
-	while (true) {
-		if (existsSync(resolve(dir, ".git"))) {
-			return dir;
-		}
-		const parent = dirname(dir);
-		if (parent === dir) break;
-		dir = parent;
-	}
-	return resolve(cwd);
-}
-
-export function isPathWithinRoot(normalizedPath: string, root: string): boolean {
-	const resolvedRoot = resolve(root);
-	const resolvedPath = resolve(normalizedPath);
-	if (resolvedPath === resolvedRoot) return true;
-	const rel = relative(resolvedRoot, resolvedPath);
-	return !rel.startsWith("..") && !isAbsolute(rel);
-}
-
-export function isExternalPath(pathValue: string, cwd: string): boolean {
-	const normalized = normalizePathValue(pathValue, cwd);
-	const projectRoot = findProjectRoot(cwd);
-	return !isPathWithinRoot(normalized, projectRoot);
-}
-export function extractPathFromToolInput(
-	toolName: string,
-	input: Record<string, unknown>,
-): string | null {
-	if (typeof input.path === "string") return input.path;
-	if (toolName === "bash" && typeof input.command === "string") {
-		return input.command;
-	}
-	if (toolName === "mcp") {
-		const args = input.arguments;
-		if (
-			typeof args === "object" &&
-			args !== null &&
-			typeof (args as { path?: string }).path === "string"
-		) {
-			return (args as { path: string }).path;
-		}
-	}
-	return null;
-}
-
-export function extractMcpTarget(
-	input: Record<string, unknown>,
-): string | null {
-	if (typeof input.server === "string" && typeof input.tool === "string") {
-		return `${input.server}/${input.tool}`;
-	}
-	if (typeof input.tool === "string") return input.tool;
-	return null;
-}
+import { existsSync } from "node:fs";
+import { dirname, isAbsolute, relative, resolve } from "node:path";
+import { expandHomePath } from "../expand-home.ts";
+
+export function normalizePathValue(pathValue: string, cwd: string): string {
+	const expanded = expandHomePath(pathValue.trim());
+	if (!expanded) return expanded;
+	return isAbsolute(expanded) ? resolve(expanded) : resolve(cwd, expanded);
+}
+
+export function findProjectRoot(cwd: string): string {
+	let dir = resolve(cwd);
+	while (true) {
+		if (existsSync(resolve(dir, ".git"))) {
+			return dir;
+		}
+		const parent = dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	return resolve(cwd);
+}
+
+export function isPathWithinRoot(normalizedPath: string, root: string): boolean {
+	const resolvedRoot = resolve(root);
+	const resolvedPath = resolve(normalizedPath);
+	if (resolvedPath === resolvedRoot) return true;
+	const rel = relative(resolvedRoot, resolvedPath);
+	return !rel.startsWith("..") && !isAbsolute(rel);
+}
+
+export function isExternalPath(pathValue: string, cwd: string): boolean {
+	const normalized = normalizePathValue(pathValue, cwd);
+	const projectRoot = findProjectRoot(cwd);
+	return !isPathWithinRoot(normalized, projectRoot);
+}
+export function extractPathFromToolInput(
+	toolName: string,
+	input: Record<string, unknown>,
+): string | null {
+	if (typeof input.path === "string") return input.path;
+	if (toolName === "bash" && typeof input.command === "string") {
+		return input.command;
+	}
+	if (toolName === "mcp") {
+		const args = input.arguments;
+		if (
+			typeof args === "object" &&
+			args !== null &&
+			typeof (args as { path?: string }).path === "string"
+		) {
+			return (args as { path: string }).path;
+		}
+	}
+	return null;
+}
+
+export function extractMcpTarget(
+	input: Record<string, unknown>,
+): string | null {
+	if (typeof input.server === "string" && typeof input.tool === "string") {
+		return `${input.server}/${input.tool}`;
+	}
+	if (typeof input.tool === "string") return input.tool;
+	return null;
+}

package/node_modules/@vitos-pizza/permission-system/src/gates/pipeline.ts

@@ -1,155 +1,151 @@
-import { evaluateBashCommand } from "../bash/matcher.ts";
-import type { PermissionEvaluator } from "../permission-evaluator.ts";
-import { inferSkillNameFromPath } from "../sanitizers/skill-prompt.ts";
-import type {
-	FlatPermissionConfig,
-	GateContext,
-	PermissionCheckResult,
-	PermissionState,
-} from "../types.ts";
-import {
-	extractMcpTarget,
-	extractPathFromToolInput,
-	isExternalPath,
-	normalizePathValue,
-} from "./path-utils.ts";
-
-export interface GatePipelineOptions {
-	yoloMode?: boolean;
-	platform?: NodeJS.Platform;
-	skillDirs?: readonly string[];
-	registeredTools?: ReadonlySet<string>;
-}
-
-export function runGatePipeline(
-	permission: FlatPermissionConfig,
-	evaluator: PermissionEvaluator,
-	ctx: GateContext,
-	options: GatePipelineOptions = {},
-): PermissionCheckResult {
-	const { toolName, input, cwd } = ctx;
-	const evalOptions = {
-		yoloMode: options.yoloMode,
-		platform: options.platform,
-	};
-
-	if (options.registeredTools && !options.registeredTools.has(toolName)) {
-		return {
-			state: "deny",
-			reason: `Tool "${toolName}" is not registered`,
-			matchedPattern: "<unregistered-tool>",
-			surface: toolName,
-			value: toolName,
-			origin: "builtin",
-		};
-	}
-
-	const checks: PermissionCheckResult[] = [];
-	const pathValue = extractPathFromToolInput(toolName, input);
-	if (pathValue) {
-		const normalizedPath = normalizePathValue(pathValue, cwd);
-		checks.push(
-			evaluator.evaluateSurface(
-				permission,
-				"path",
-				normalizedPath,
-				"project",
-				evalOptions,
-			),
-		);
-		if (isExternalPath(pathValue, cwd)) {
-			const externalRules = permission.external_directory;
-			if (
-				typeof externalRules === "object" &&
-				externalRules !== null &&
-				!Array.isArray(externalRules)
-			) {
-				checks.push(
-					evaluator.evaluateSurface(
-						permission,
-						"external_directory",
-						normalizedPath,
-						"project",
-						evalOptions,
-					),
-				);
-			} else if (typeof externalRules === "string") {
-				checks.push({
-					state: externalRules as PermissionState,
-					matchedPattern: "external_directory",
-					surface: "external_directory",
-					value: normalizedPath,
-					origin: "project",
-				});
-			}
-		}
-	}
-
-	const toolPermission = permission[toolName];
-	if (typeof toolPermission === "string") {
-		checks.push({
-			state: toolPermission as PermissionState,
-			matchedPattern: toolName,
-			surface: toolName,
-			value: toolName,
-			origin: "project",
-		});
-	} else {
-		checks.push(
-			evaluator.evaluateSurface(
-				permission,
-				"*",
-				toolName,
-				"project",
-				evalOptions,
-			),
-		);
-	}
-
-	if (toolName === "bash" && typeof input.command === "string") {
-		checks.push(
-			evaluateBashCommand(input.command, permission, evaluator, evalOptions),
-		);
-	}
-
-	if (toolName === "mcp") {
-		const target = extractMcpTarget(input);
-		if (target) {
-			checks.push(
-				evaluator.evaluateSurface(
-					permission,
-					"mcp",
-					target,
-					"project",
-					evalOptions,
-				),
-			);
-		}
-	}
-
-	if (toolName === "read" && pathValue && options.skillDirs?.length) {
-		const skillName = inferSkillNameFromPath(pathValue, options.skillDirs);
-		if (skillName) {
-			checks.push(
-				evaluator.evaluateSurface(
-					permission,
-					"skill",
-					skillName,
-					"project",
-					evalOptions,
-				),
-			);
-		}
-	}
-
-	const mostRestrictive = evaluator.pickMostRestrictive(checks);
-	return (
-		mostRestrictive ?? {
-			state: "ask",
-			matchedPattern: "*",
-			surface: toolName,
-			value: toolName,
-			origin: "builtin",
-		}
-	);
-}
+import { evaluateBashCommand } from "../bash/matcher.ts";
+import type {
+	EvaluateOptions,
+	PermissionEvaluator,
+	SessionApprovals,
+} from "../permission-evaluator.ts";
+import { inferSkillNameFromPath } from "../sanitizers/skill-prompt.ts";
+import type {
+	FlatPermissionConfig,
+	GateContext,
+	PermissionCheckResult,
+} from "../types.ts";
+import {
+	extractMcpTarget,
+	extractPathFromToolInput,
+	isExternalPath,
+	normalizePathValue,
+} from "./path-utils.ts";
+
+export interface GatePipelineOptions {
+	yoloMode?: boolean;
+	platform?: NodeJS.Platform;
+	skillDirs?: readonly string[];
+	registeredTools?: ReadonlySet<string>;
+	sessionApprovals?: SessionApprovals;
+}
+
+export function runGatePipeline(
+	permission: FlatPermissionConfig,
+	evaluator: PermissionEvaluator,
+	ctx: GateContext,
+	options: GatePipelineOptions = {},
+): PermissionCheckResult {
+	const { toolName, input, cwd } = ctx;
+	const evalOptions: EvaluateOptions = {
+		yoloMode: options.yoloMode,
+		platform: options.platform,
+		sessionApprovals: options.sessionApprovals,
+	};
+
+	if (options.registeredTools && !options.registeredTools.has(toolName)) {
+		return {
+			state: "deny",
+			reason: `Tool "${toolName}" is not registered`,
+			matchedPattern: "<unregistered-tool>",
+			surface: toolName,
+			value: toolName,
+			origin: "builtin",
+		};
+	}
+
+	const checks: PermissionCheckResult[] = [];
+	const pathValue = extractPathFromToolInput(toolName, input);
+	if (pathValue) {
+		const normalizedPath = normalizePathValue(pathValue, cwd);
+		checks.push(
+			evaluator.evaluateSurface(
+				permission,
+				"path",
+				normalizedPath,
+				"project",
+				evalOptions,
+			),
+		);
+		if (isExternalPath(pathValue, cwd)) {
+			const externalRules = permission.external_directory;
+			if (externalRules !== undefined) {
+				checks.push(
+					evaluator.evaluateSurface(
+						permission,
+						"external_directory",
+						normalizedPath,
+						"project",
+						evalOptions,
+					),
+				);
+			}
+		}
+	}
+
+	const toolPermission = permission[toolName];
+	if (typeof toolPermission === "string") {
+		// Evaluate via the tool surface so session approvals / yolo apply.
+		checks.push(
+			evaluator.evaluateSurface(
+				permission,
+				toolName,
+				toolName,
+				"project",
+				evalOptions,
+			),
+		);
+	} else {
+		checks.push(
+			evaluator.evaluateSurface(
+				permission,
+				"*",
+				toolName,
+				"project",
+				evalOptions,
+			),
+		);
+	}
+
+	if (toolName === "bash" && typeof input.command === "string") {
+		checks.push(
+			evaluateBashCommand(input.command, permission, evaluator, evalOptions),
+		);
+	}
+
+	if (toolName === "mcp") {
+		const target = extractMcpTarget(input);
+		if (target) {
+			checks.push(
+				evaluator.evaluateSurface(
+					permission,
+					"mcp",
+					target,
+					"project",
+					evalOptions,
+				),
+			);
+		}
+	}
+
+	if (toolName === "read" && pathValue && options.skillDirs?.length) {
+		const skillName = inferSkillNameFromPath(pathValue, options.skillDirs);
+		if (skillName) {
+			checks.push(
+				evaluator.evaluateSurface(
+					permission,
+					"skill",
+					skillName,
+					"project",
+					evalOptions,
+				),
+			);
+		}
+	}
+
+	const mostRestrictive = evaluator.pickMostRestrictive(checks);
+	return (
+		mostRestrictive ?? {
+			state: "ask",
+			matchedPattern: "*",
+			surface: toolName,
+			value: toolName,
+			origin: "builtin",
+		}
+	);
+}