@within-7/minto 0.1.7 → 0.2.0

package/dist/core/permissions/rules/autoEscalationRule.js

@@ -0,0 +1,291 @@
+import { isSensitivePath, getSensitivePathInfo } from "./sensitivePathsRule.js";
+import {
+  isOutsideProject,
+  calculateExternalOperationRisk
+} from "./projectBoundaryRule.js";
+import { logSecurityEvent } from "../auditLog.js";
+const ESCALATION_PATTERNS = [
+  // Privilege escalation
+  {
+    pattern: /\bsudo\s+/,
+    reason: "privilege_escalation",
+    description: "sudo command"
+  },
+  {
+    pattern: /\bsu\s+(-|\w)/,
+    reason: "privilege_escalation",
+    description: "su command"
+  },
+  {
+    pattern: /\bchmod\s+[0-7]*[4-7][0-7]*\s/,
+    reason: "privilege_escalation",
+    description: "chmod with execute permissions"
+  },
+  {
+    pattern: /\bchown\s+/,
+    reason: "privilege_escalation",
+    description: "chown command"
+  },
+  // Dangerous file operations
+  {
+    pattern: /\brm\s+(-r|-rf|-fr)\s+/,
+    reason: "dangerous_command",
+    description: "recursive delete"
+  },
+  {
+    pattern: /\bdd\s+.*if=/,
+    reason: "dangerous_command",
+    description: "dd command"
+  },
+  {
+    pattern: /\bmkfs\b/,
+    reason: "dangerous_command",
+    description: "filesystem creation"
+  },
+  {
+    pattern: />\s*\/dev\/(sd|hd|nvme)/,
+    reason: "dangerous_command",
+    description: "write to disk device"
+  },
+  // Network access (potential data exfiltration)
+  {
+    pattern: /\bcurl\s+.*(-d|--data|-F|--form)/,
+    reason: "network_access",
+    description: "curl with data upload"
+  },
+  {
+    pattern: /\bwget\s+--post/,
+    reason: "network_access",
+    description: "wget with POST"
+  },
+  {
+    pattern: /\bnc\s+/,
+    reason: "network_access",
+    description: "netcat"
+  },
+  {
+    pattern: /\bssh\s+/,
+    reason: "network_access",
+    description: "SSH connection"
+  },
+  {
+    pattern: /\bscp\s+/,
+    reason: "network_access",
+    description: "SCP file transfer"
+  },
+  {
+    pattern: /\brsync\s+.*:/,
+    reason: "network_access",
+    description: "rsync to remote"
+  },
+  // Bulk operations
+  {
+    pattern: /\bfind\s+.*-exec.*\brm\b/,
+    reason: "bulk_operation",
+    description: "find with delete"
+  },
+  {
+    pattern: /\bxargs\s+.*\brm\b/,
+    reason: "bulk_operation",
+    description: "xargs with delete"
+  },
+  // Shell/script execution (potential for hidden actions)
+  {
+    pattern: /\beval\s+/,
+    reason: "dangerous_command",
+    description: "eval command"
+  },
+  {
+    pattern: /\bsource\s+/,
+    reason: "dangerous_command",
+    description: "source command"
+  },
+  {
+    pattern: /\.\s+\//,
+    reason: "dangerous_command",
+    description: "dot source"
+  }
+];
+function matchesEscalationPattern(command) {
+  for (const { pattern, reason, description } of ESCALATION_PATTERNS) {
+    if (pattern.test(command)) {
+      return { reason, description };
+    }
+  }
+  return null;
+}
+function getOperationType(toolName, input) {
+  switch (toolName) {
+    case "Read":
+    case "FileRead":
+    case "Glob":
+    case "Grep":
+      return "read";
+    case "Write":
+    case "FileWrite":
+    case "Edit":
+    case "FileEdit":
+    case "MultiEdit":
+    case "NotebookEdit":
+      return "write";
+    case "Bash": {
+      const command = input.command || "";
+      if (/\b(rm|del|rmdir|unlink)\b/.test(command)) {
+        return "delete";
+      }
+      return "execute";
+    }
+    default:
+      return null;
+  }
+}
+function extractFilePath(input) {
+  if (input.file_path) return input.file_path;
+  if (input.filePath) return input.filePath;
+  if (input.path) return input.path;
+  return null;
+}
+const ESCALATION_MESSAGES = {
+  sensitive_path: "\u{1F510} This operation accesses sensitive files",
+  critical_external: "\u{1F6A8} This operation affects files far outside your project",
+  dangerous_command: "\u26A0\uFE0F This command is potentially destructive",
+  bulk_operation: "\u{1F4E6} This operation affects multiple files",
+  privilege_escalation: "\u{1F511} This command may escalate system privileges",
+  network_access: "\u{1F310} This command accesses the network"
+};
+const autoEscalationRule = {
+  name: "auto-escalation",
+  description: "Requires confirmation for high-risk operations",
+  priority: 85,
+  // Below sensitive-paths and project-boundary, but above safe-mode
+  check(context) {
+    const toolName = context.tool.name;
+    const input = context.input;
+    if (toolName === "Bash") {
+      const command = input.command || "";
+      const match = matchesEscalationPattern(command);
+      if (match) {
+        logSecurityEvent({
+          eventType: "security_warning",
+          toolName,
+          operation: "execute",
+          target: command,
+          outcome: "denied",
+          // Will be 'allowed' if user approves
+          riskLevel: "high",
+          context: {
+            escalationReason: match.reason,
+            escalationDescription: match.description
+          },
+          triggeredRule: "auto-escalation"
+        });
+        return {
+          allowed: false,
+          promptUser: true,
+          reason: `High-risk operation: ${match.description}`,
+          message: `${ESCALATION_MESSAGES[match.reason]}
+
+Command: ${command.length > 100 ? command.substring(0, 100) + "..." : command}
+
+Reason: ${match.description}`,
+          permissionKey: `AutoEscalate(${match.reason}:${command.substring(0, 50)})`
+        };
+      }
+    }
+    const operation = getOperationType(toolName, input);
+    if (operation && operation !== "read") {
+      const filePath = extractFilePath(input);
+      if (filePath) {
+        if (isSensitivePath(filePath, operation)) {
+          const info = getSensitivePathInfo(filePath);
+          logSecurityEvent({
+            eventType: "sensitive_path_access",
+            toolName,
+            operation,
+            target: filePath,
+            outcome: "denied",
+            riskLevel: "high",
+            context: {
+              category: info?.category,
+              description: info?.description
+            },
+            triggeredRule: "auto-escalation"
+          });
+          return {
+            allowed: false,
+            promptUser: true,
+            reason: `Sensitive path: ${info?.description || "unknown"}`,
+            message: `${ESCALATION_MESSAGES.sensitive_path}
+
+Path: ${filePath}
+Category: ${info?.category || "unknown"}`,
+            permissionKey: `AutoEscalate(sensitive:${filePath})`
+          };
+        }
+        if (isOutsideProject(filePath)) {
+          const risk = calculateExternalOperationRisk(operation, filePath);
+          if (risk === "critical" || risk === "high") {
+            logSecurityEvent({
+              eventType: "external_operation",
+              toolName,
+              operation,
+              target: filePath,
+              outcome: "denied",
+              riskLevel: risk,
+              triggeredRule: "auto-escalation"
+            });
+            return {
+              allowed: false,
+              promptUser: true,
+              reason: `${risk} risk external operation`,
+              message: `${ESCALATION_MESSAGES.critical_external}
+
+Path: ${filePath}
+Risk Level: ${risk.toUpperCase()}`,
+              permissionKey: `AutoEscalate(external:${filePath})`
+            };
+          }
+        }
+      }
+    }
+    return { allowed: true };
+  }
+};
+function shouldAutoEscalate(toolName, input) {
+  if (toolName === "Bash") {
+    const command = input.command || "";
+    const match = matchesEscalationPattern(command);
+    if (match) {
+      return { shouldEscalate: true, ...match };
+    }
+  }
+  const filePath = extractFilePath(input);
+  if (filePath) {
+    const operation = getOperationType(toolName, input);
+    if (operation && operation !== "read") {
+      if (isSensitivePath(filePath, operation)) {
+        return {
+          shouldEscalate: true,
+          reason: "sensitive_path",
+          description: "Sensitive file access"
+        };
+      }
+      if (isOutsideProject(filePath)) {
+        const risk = calculateExternalOperationRisk(operation, filePath);
+        if (risk === "critical" || risk === "high") {
+          return {
+            shouldEscalate: true,
+            reason: "critical_external",
+            description: `${risk} risk external operation`
+          };
+        }
+      }
+    }
+  }
+  return { shouldEscalate: false };
+}
+export {
+  autoEscalationRule,
+  shouldAutoEscalate
+};
+//# sourceMappingURL=autoEscalationRule.js.map

package/dist/core/permissions/rules/autoEscalationRule.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/core/permissions/rules/autoEscalationRule.ts"],
+  "sourcesContent": ["/**\n * Auto-Escalation Rule\n *\n * Automatically escalates permission requirements when detecting\n * high-risk operations, even if safe mode is not explicitly enabled.\n * This provides defense-in-depth by requiring confirmation for\n * particularly dangerous actions regardless of mode.\n */\n\nimport type {\n  PermissionRule,\n  PermissionContext,\n  PermissionResult,\n} from '../engine/types'\nimport { isSensitivePath, getSensitivePathInfo } from './sensitivePathsRule'\nimport {\n  isOutsideProject,\n  calculateExternalOperationRisk,\n} from './projectBoundaryRule'\nimport { logSecurityEvent } from '../auditLog'\n\n/**\n * Escalation trigger reasons\n */\nexport type EscalationReason =\n  | 'sensitive_path' // Accessing sensitive paths\n  | 'critical_external' // Critical external operation\n  | 'dangerous_command' // Known dangerous command pattern\n  | 'bulk_operation' // Bulk file operations\n  | 'privilege_escalation' // Commands that might escalate privileges\n  | 'network_access' // Network-related commands\n\n/**\n * Patterns that should always trigger escalation\n */\nconst ESCALATION_PATTERNS: Array<{\n  pattern: RegExp\n  reason: EscalationReason\n  description: string\n}> = [\n  // Privilege escalation\n  {\n    pattern: /\\bsudo\\s+/,\n    reason: 'privilege_escalation',\n    description: 'sudo command',\n  },\n  {\n    pattern: /\\bsu\\s+(-|\\w)/,\n    reason: 'privilege_escalation',\n    description: 'su command',\n  },\n  {\n    pattern: /\\bchmod\\s+[0-7]*[4-7][0-7]*\\s/,\n    reason: 'privilege_escalation',\n    description: 'chmod with execute permissions',\n  },\n  {\n    pattern: /\\bchown\\s+/,\n    reason: 'privilege_escalation',\n    description: 'chown command',\n  },\n\n  // Dangerous file operations\n  {\n    pattern: /\\brm\\s+(-r|-rf|-fr)\\s+/,\n    reason: 'dangerous_command',\n    description: 'recursive delete',\n  },\n  {\n    pattern: /\\bdd\\s+.*if=/,\n    reason: 'dangerous_command',\n    description: 'dd command',\n  },\n  {\n    pattern: /\\bmkfs\\b/,\n    reason: 'dangerous_command',\n    description: 'filesystem creation',\n  },\n  {\n    pattern: />\\s*\\/dev\\/(sd|hd|nvme)/,\n    reason: 'dangerous_command',\n    description: 'write to disk device',\n  },\n\n  // Network access (potential data exfiltration)\n  {\n    pattern: /\\bcurl\\s+.*(-d|--data|-F|--form)/,\n    reason: 'network_access',\n    description: 'curl with data upload',\n  },\n  {\n    pattern: /\\bwget\\s+--post/,\n    reason: 'network_access',\n    description: 'wget with POST',\n  },\n  {\n    pattern: /\\bnc\\s+/,\n    reason: 'network_access',\n    description: 'netcat',\n  },\n  {\n    pattern: /\\bssh\\s+/,\n    reason: 'network_access',\n    description: 'SSH connection',\n  },\n  {\n    pattern: /\\bscp\\s+/,\n    reason: 'network_access',\n    description: 'SCP file transfer',\n  },\n  {\n    pattern: /\\brsync\\s+.*:/,\n    reason: 'network_access',\n    description: 'rsync to remote',\n  },\n\n  // Bulk operations\n  {\n    pattern: /\\bfind\\s+.*-exec.*\\brm\\b/,\n    reason: 'bulk_operation',\n    description: 'find with delete',\n  },\n  {\n    pattern: /\\bxargs\\s+.*\\brm\\b/,\n    reason: 'bulk_operation',\n    description: 'xargs with delete',\n  },\n\n  // Shell/script execution (potential for hidden actions)\n  {\n    pattern: /\\beval\\s+/,\n    reason: 'dangerous_command',\n    description: 'eval command',\n  },\n  {\n    pattern: /\\bsource\\s+/,\n    reason: 'dangerous_command',\n    description: 'source command',\n  },\n  {\n    pattern: /\\.\\s+\\//,\n    reason: 'dangerous_command',\n    description: 'dot source',\n  },\n]\n\n/**\n * Check if a command matches any escalation pattern\n */\nfunction matchesEscalationPattern(\n  command: string,\n): { reason: EscalationReason; description: string } | null {\n  for (const { pattern, reason, description } of ESCALATION_PATTERNS) {\n    if (pattern.test(command)) {\n      return { reason, description }\n    }\n  }\n  return null\n}\n\n/**\n * Get operation type from tool\n */\nfunction getOperationType(\n  toolName: string,\n  input: Record<string, unknown>,\n): 'read' | 'write' | 'delete' | 'execute' | null {\n  switch (toolName) {\n    case 'Read':\n    case 'FileRead':\n    case 'Glob':\n    case 'Grep':\n      return 'read'\n    case 'Write':\n    case 'FileWrite':\n    case 'Edit':\n    case 'FileEdit':\n    case 'MultiEdit':\n    case 'NotebookEdit':\n      return 'write'\n    case 'Bash': {\n      const command = (input.command as string) || ''\n      if (/\\b(rm|del|rmdir|unlink)\\b/.test(command)) {\n        return 'delete'\n      }\n      return 'execute'\n    }\n    default:\n      return null\n  }\n}\n\n/**\n * Extract file path from input\n */\nfunction extractFilePath(input: Record<string, unknown>): string | null {\n  if (input.file_path) return input.file_path as string\n  if (input.filePath) return input.filePath as string\n  if (input.path) return input.path as string\n  return null\n}\n\n/**\n * Escalation messages by reason\n */\nconst ESCALATION_MESSAGES: Record<EscalationReason, string> = {\n  sensitive_path: '\uD83D\uDD10 This operation accesses sensitive files',\n  critical_external: '\uD83D\uDEA8 This operation affects files far outside your project',\n  dangerous_command: '\u26A0\uFE0F This command is potentially destructive',\n  bulk_operation: '\uD83D\uDCE6 This operation affects multiple files',\n  privilege_escalation: '\uD83D\uDD11 This command may escalate system privileges',\n  network_access: '\uD83C\uDF10 This command accesses the network',\n}\n\n/**\n * Auto-Escalation Rule\n *\n * Requires confirmation for high-risk operations even without safe mode.\n */\nexport const autoEscalationRule: PermissionRule = {\n  name: 'auto-escalation',\n  description: 'Requires confirmation for high-risk operations',\n  priority: 85, // Below sensitive-paths and project-boundary, but above safe-mode\n\n  check(context: PermissionContext): PermissionResult {\n    const toolName = context.tool.name\n    const input = context.input\n\n    // For Bash commands, check escalation patterns\n    if (toolName === 'Bash') {\n      const command = (input.command as string) || ''\n      const match = matchesEscalationPattern(command)\n\n      if (match) {\n        // Log the escalation trigger\n        logSecurityEvent({\n          eventType: 'security_warning',\n          toolName,\n          operation: 'execute',\n          target: command,\n          outcome: 'denied', // Will be 'allowed' if user approves\n          riskLevel: 'high',\n          context: {\n            escalationReason: match.reason,\n            escalationDescription: match.description,\n          },\n          triggeredRule: 'auto-escalation',\n        })\n\n        return {\n          allowed: false,\n          promptUser: true,\n          reason: `High-risk operation: ${match.description}`,\n          message: `${ESCALATION_MESSAGES[match.reason]}\\n\\nCommand: ${command.length > 100 ? command.substring(0, 100) + '...' : command}\\n\\nReason: ${match.description}`,\n          permissionKey: `AutoEscalate(${match.reason}:${command.substring(0, 50)})`,\n        }\n      }\n    }\n\n    // Check file operations for sensitive paths\n    const operation = getOperationType(toolName, input)\n    if (operation && operation !== 'read') {\n      const filePath = extractFilePath(input)\n\n      if (filePath) {\n        // Check if it's a sensitive path\n        if (isSensitivePath(filePath, operation)) {\n          const info = getSensitivePathInfo(filePath)\n\n          logSecurityEvent({\n            eventType: 'sensitive_path_access',\n            toolName,\n            operation,\n            target: filePath,\n            outcome: 'denied',\n            riskLevel: 'high',\n            context: {\n              category: info?.category,\n              description: info?.description,\n            },\n            triggeredRule: 'auto-escalation',\n          })\n\n          return {\n            allowed: false,\n            promptUser: true,\n            reason: `Sensitive path: ${info?.description || 'unknown'}`,\n            message: `${ESCALATION_MESSAGES.sensitive_path}\\n\\nPath: ${filePath}\\nCategory: ${info?.category || 'unknown'}`,\n            permissionKey: `AutoEscalate(sensitive:${filePath})`,\n          }\n        }\n\n        // Check if it's a critical external operation\n        if (isOutsideProject(filePath)) {\n          const risk = calculateExternalOperationRisk(operation, filePath)\n\n          if (risk === 'critical' || risk === 'high') {\n            logSecurityEvent({\n              eventType: 'external_operation',\n              toolName,\n              operation,\n              target: filePath,\n              outcome: 'denied',\n              riskLevel: risk,\n              triggeredRule: 'auto-escalation',\n            })\n\n            return {\n              allowed: false,\n              promptUser: true,\n              reason: `${risk} risk external operation`,\n              message: `${ESCALATION_MESSAGES.critical_external}\\n\\nPath: ${filePath}\\nRisk Level: ${risk.toUpperCase()}`,\n              permissionKey: `AutoEscalate(external:${filePath})`,\n            }\n          }\n        }\n      }\n    }\n\n    return { allowed: true }\n  },\n}\n\n/**\n * Check if an operation should trigger auto-escalation\n */\nexport function shouldAutoEscalate(\n  toolName: string,\n  input: Record<string, unknown>,\n): {\n  shouldEscalate: boolean\n  reason?: EscalationReason\n  description?: string\n} {\n  // Check command patterns\n  if (toolName === 'Bash') {\n    const command = (input.command as string) || ''\n    const match = matchesEscalationPattern(command)\n    if (match) {\n      return { shouldEscalate: true, ...match }\n    }\n  }\n\n  // Check file paths\n  const filePath = extractFilePath(input)\n  if (filePath) {\n    const operation = getOperationType(toolName, input)\n\n    if (operation && operation !== 'read') {\n      if (isSensitivePath(filePath, operation)) {\n        return {\n          shouldEscalate: true,\n          reason: 'sensitive_path',\n          description: 'Sensitive file access',\n        }\n      }\n\n      if (isOutsideProject(filePath)) {\n        const risk = calculateExternalOperationRisk(operation, filePath)\n        if (risk === 'critical' || risk === 'high') {\n          return {\n            shouldEscalate: true,\n            reason: 'critical_external',\n            description: `${risk} risk external operation`,\n          }\n        }\n      }\n    }\n  }\n\n  return { shouldEscalate: false }\n}\n"],
+  "mappings": "AAcA,SAAS,iBAAiB,4BAA4B;AACtD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,wBAAwB;AAgBjC,MAAM,sBAID;AAAA;AAAA,EAEH;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AACF;AAKA,SAAS,yBACP,SAC0D;AAC1D,aAAW,EAAE,SAAS,QAAQ,YAAY,KAAK,qBAAqB;AAClE,QAAI,QAAQ,KAAK,OAAO,GAAG;AACzB,aAAO,EAAE,QAAQ,YAAY;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;AAKA,SAAS,iBACP,UACA,OACgD;AAChD,UAAQ,UAAU;AAAA,IAChB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK,QAAQ;AACX,YAAM,UAAW,MAAM,WAAsB;AAC7C,UAAI,4BAA4B,KAAK,OAAO,GAAG;AAC7C,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT;AAAA,IACA;AACE,aAAO;AAAA,EACX;AACF;AAKA,SAAS,gBAAgB,OAA+C;AACtE,MAAI,MAAM,UAAW,QAAO,MAAM;AAClC,MAAI,MAAM,SAAU,QAAO,MAAM;AACjC,MAAI,MAAM,KAAM,QAAO,MAAM;AAC7B,SAAO;AACT;AAKA,MAAM,sBAAwD;AAAA,EAC5D,gBAAgB;AAAA,EAChB,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,gBAAgB;AAClB;AAOO,MAAM,qBAAqC;AAAA,EAChD,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU;AAAA;AAAA,EAEV,MAAM,SAA8C;AAClD,UAAM,WAAW,QAAQ,KAAK;AAC9B,UAAM,QAAQ,QAAQ;AAGtB,QAAI,aAAa,QAAQ;AACvB,YAAM,UAAW,MAAM,WAAsB;AAC7C,YAAM,QAAQ,yBAAyB,OAAO;AAE9C,UAAI,OAAO;AAET,yBAAiB;AAAA,UACf,WAAW;AAAA,UACX;AAAA,UACA,WAAW;AAAA,UACX,QAAQ;AAAA,UACR,SAAS;AAAA;AAAA,UACT,WAAW;AAAA,UACX,SAAS;AAAA,YACP,kBAAkB,MAAM;AAAA,YACxB,uBAAuB,MAAM;AAAA,UAC/B;AAAA,UACA,eAAe;AAAA,QACjB,CAAC;AAED,eAAO;AAAA,UACL,SAAS;AAAA,UACT,YAAY;AAAA,UACZ,QAAQ,wBAAwB,MAAM,WAAW;AAAA,UACjD,SAAS,GAAG,oBAAoB,MAAM,MAAM,CAAC;AAAA;AAAA,WAAgB,QAAQ,SAAS,MAAM,QAAQ,UAAU,GAAG,GAAG,IAAI,QAAQ,OAAO;AAAA;AAAA,UAAe,MAAM,WAAW;AAAA,UAC/J,eAAe,gBAAgB,MAAM,MAAM,IAAI,QAAQ,UAAU,GAAG,EAAE,CAAC;AAAA,QACzE;AAAA,MACF;AAAA,IACF;AAGA,UAAM,YAAY,iBAAiB,UAAU,KAAK;AAClD,QAAI,aAAa,cAAc,QAAQ;AACrC,YAAM,WAAW,gBAAgB,KAAK;AAEtC,UAAI,UAAU;AAEZ,YAAI,gBAAgB,UAAU,SAAS,GAAG;AACxC,gBAAM,OAAO,qBAAqB,QAAQ;AAE1C,2BAAiB;AAAA,YACf,WAAW;AAAA,YACX;AAAA,YACA;AAAA,YACA,QAAQ;AAAA,YACR,SAAS;AAAA,YACT,WAAW;AAAA,YACX,SAAS;AAAA,cACP,UAAU,MAAM;AAAA,cAChB,aAAa,MAAM;AAAA,YACrB;AAAA,YACA,eAAe;AAAA,UACjB,CAAC;AAED,iBAAO;AAAA,YACL,SAAS;AAAA,YACT,YAAY;AAAA,YACZ,QAAQ,mBAAmB,MAAM,eAAe,SAAS;AAAA,YACzD,SAAS,GAAG,oBAAoB,cAAc;AAAA;AAAA,QAAa,QAAQ;AAAA,YAAe,MAAM,YAAY,SAAS;AAAA,YAC7G,eAAe,0BAA0B,QAAQ;AAAA,UACnD;AAAA,QACF;AAGA,YAAI,iBAAiB,QAAQ,GAAG;AAC9B,gBAAM,OAAO,+BAA+B,WAAW,QAAQ;AAE/D,cAAI,SAAS,cAAc,SAAS,QAAQ;AAC1C,6BAAiB;AAAA,cACf,WAAW;AAAA,cACX;AAAA,cACA;AAAA,cACA,QAAQ;AAAA,cACR,SAAS;AAAA,cACT,WAAW;AAAA,cACX,eAAe;AAAA,YACjB,CAAC;AAED,mBAAO;AAAA,cACL,SAAS;AAAA,cACT,YAAY;AAAA,cACZ,QAAQ,GAAG,IAAI;AAAA,cACf,SAAS,GAAG,oBAAoB,iBAAiB;AAAA;AAAA,QAAa,QAAQ;AAAA,cAAiB,KAAK,YAAY,CAAC;AAAA,cACzG,eAAe,yBAAyB,QAAQ;AAAA,YAClD;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACF;AAKO,SAAS,mBACd,UACA,OAKA;AAEA,MAAI,aAAa,QAAQ;AACvB,UAAM,UAAW,MAAM,WAAsB;AAC7C,UAAM,QAAQ,yBAAyB,OAAO;AAC9C,QAAI,OAAO;AACT,aAAO,EAAE,gBAAgB,MAAM,GAAG,MAAM;AAAA,IAC1C;AAAA,EACF;AAGA,QAAM,WAAW,gBAAgB,KAAK;AACtC,MAAI,UAAU;AACZ,UAAM,YAAY,iBAAiB,UAAU,KAAK;AAElD,QAAI,aAAa,cAAc,QAAQ;AACrC,UAAI,gBAAgB,UAAU,SAAS,GAAG;AACxC,eAAO;AAAA,UACL,gBAAgB;AAAA,UAChB,QAAQ;AAAA,UACR,aAAa;AAAA,QACf;AAAA,MACF;AAEA,UAAI,iBAAiB,QAAQ,GAAG;AAC9B,cAAM,OAAO,+BAA+B,WAAW,QAAQ;AAC/D,YAAI,SAAS,cAAc,SAAS,QAAQ;AAC1C,iBAAO;AAAA,YACL,gBAAgB;AAAA,YAChB,QAAQ;AAAA,YACR,aAAa,GAAG,IAAI;AAAA,UACtB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,gBAAgB,MAAM;AACjC;",
+  "names": []
+}

package/dist/core/permissions/rules/index.js

@@ -0,0 +1,46 @@
+export * from "./planModeRule.js";
+export * from "./safeModeRule.js";
+export * from "./allowedToolsRule.js";
+export * from "./sensitivePathsRule.js";
+export * from "./projectBoundaryRule.js";
+export * from "./autoEscalationRule.js";
+import { planModeRule } from "./planModeRule.js";
+import { safeModeRule } from "./safeModeRule.js";
+import { allowedToolsRule } from "./allowedToolsRule.js";
+import { sensitivePathsRule } from "./sensitivePathsRule.js";
+import { projectBoundaryRule } from "./projectBoundaryRule.js";
+import { autoEscalationRule } from "./autoEscalationRule.js";
+const builtInRules = [
+  sensitivePathsRule,
+  // Priority 100 - Sensitive paths always checked first
+  projectBoundaryRule,
+  // Priority 95 - External operations
+  planModeRule,
+  // Priority 95 - Plan mode restrictions
+  safeModeRule,
+  // Priority 90 - Safe mode restrictions
+  autoEscalationRule,
+  // Priority 85 - Auto-escalation for high-risk ops
+  allowedToolsRule
+  // Priority 50 - Standard tool permissions
+];
+const securityRules = [
+  sensitivePathsRule,
+  projectBoundaryRule,
+  autoEscalationRule
+];
+const modeRules = [planModeRule, safeModeRule];
+function registerBuiltInRules(engine) {
+  engine.registerRules(builtInRules);
+}
+function registerSecurityRules(engine) {
+  engine.registerRules(securityRules);
+}
+export {
+  builtInRules,
+  modeRules,
+  registerBuiltInRules,
+  registerSecurityRules,
+  securityRules
+};
+//# sourceMappingURL=index.js.map

package/dist/core/permissions/rules/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/core/permissions/rules/index.ts"],
+  "sourcesContent": ["/**\n * Permission Rules Index\n *\n * Export all built-in permission rules.\n * Rules are sorted by priority (highest first):\n * - sensitivePathsRule: 100 (highest - always checked first)\n * - projectBoundaryRule: 95\n * - planModeRule: 95 (same level as project boundary)\n * - safeModeRule: 90\n * - autoEscalationRule: 85\n * - allowedToolsRule: 50 (lowest - checked last)\n */\n\nexport * from './planModeRule'\nexport * from './safeModeRule'\nexport * from './allowedToolsRule'\nexport * from './sensitivePathsRule'\nexport * from './projectBoundaryRule'\nexport * from './autoEscalationRule'\n\nimport { planModeRule } from './planModeRule'\nimport { safeModeRule } from './safeModeRule'\nimport { allowedToolsRule } from './allowedToolsRule'\nimport { sensitivePathsRule } from './sensitivePathsRule'\nimport { projectBoundaryRule } from './projectBoundaryRule'\nimport { autoEscalationRule } from './autoEscalationRule'\nimport type { PermissionRule } from '../engine/types'\n\n/**\n * All built-in permission rules in priority order (highest first)\n */\nexport const builtInRules: PermissionRule[] = [\n  sensitivePathsRule, // Priority 100 - Sensitive paths always checked first\n  projectBoundaryRule, // Priority 95 - External operations\n  planModeRule, // Priority 95 - Plan mode restrictions\n  safeModeRule, // Priority 90 - Safe mode restrictions\n  autoEscalationRule, // Priority 85 - Auto-escalation for high-risk ops\n  allowedToolsRule, // Priority 50 - Standard tool permissions\n]\n\n/**\n * Security-focused rules (high priority)\n */\nexport const securityRules: PermissionRule[] = [\n  sensitivePathsRule,\n  projectBoundaryRule,\n  autoEscalationRule,\n]\n\n/**\n * Mode-based rules\n */\nexport const modeRules: PermissionRule[] = [planModeRule, safeModeRule]\n\n/**\n * Register all built-in rules with an engine\n */\nexport function registerBuiltInRules(engine: {\n  registerRules: (rules: PermissionRule[]) => void\n}): void {\n  engine.registerRules(builtInRules)\n}\n\n/**\n * Register only security rules with an engine\n */\nexport function registerSecurityRules(engine: {\n  registerRules: (rules: PermissionRule[]) => void\n}): void {\n  engine.registerRules(securityRules)\n}\n"],
+  "mappings": "AAaA,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAEd,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB;AACjC,SAAS,0BAA0B;AACnC,SAAS,2BAA2B;AACpC,SAAS,0BAA0B;AAM5B,MAAM,eAAiC;AAAA,EAC5C;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACF;AAKO,MAAM,gBAAkC;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AACF;AAKO,MAAM,YAA8B,CAAC,cAAc,YAAY;AAK/D,SAAS,qBAAqB,QAE5B;AACP,SAAO,cAAc,YAAY;AACnC;AAKO,SAAS,sBAAsB,QAE7B;AACP,SAAO,cAAc,aAAa;AACpC;",
+  "names": []
+}

package/dist/core/permissions/rules/planModeRule.js

@@ -0,0 +1,55 @@
+const WRITE_TOOLS = /* @__PURE__ */ new Set([
+  "Edit",
+  "Write",
+  "MultiEdit",
+  "NotebookEdit",
+  "Bash"
+  // May write files
+]);
+const READ_ONLY_TOOLS = /* @__PURE__ */ new Set([
+  "Read",
+  "Glob",
+  "Grep",
+  "LS",
+  "LSP",
+  "WebSearch",
+  "WebFetch",
+  "Task",
+  // Can spawn read-only agents
+  "TodoWrite",
+  // Planning notes
+  "AskUserQuestion",
+  "EnterPlanMode",
+  "ExitPlanMode"
+]);
+const planModeRule = {
+  name: "plan-mode",
+  description: "Restricts write operations in plan mode",
+  priority: 100,
+  // High priority
+  check(context) {
+    if (!context.planMode) {
+      return { allowed: true };
+    }
+    const toolName = context.tool.name;
+    if (READ_ONLY_TOOLS.has(toolName)) {
+      return { allowed: true };
+    }
+    if (WRITE_TOOLS.has(toolName)) {
+      return {
+        allowed: false,
+        reason: `Tool ${toolName} is not allowed in plan mode. Only read-only operations are permitted.`,
+        message: "Cannot modify files while in plan mode. Use ExitPlanMode to implement changes."
+      };
+    }
+    if (context.tool.isReadOnly && context.tool.isReadOnly()) {
+      return { allowed: true };
+    }
+    console.warn(`Unknown tool ${toolName} used in plan mode`);
+    return { allowed: true };
+  }
+};
+export {
+  planModeRule
+};
+//# sourceMappingURL=planModeRule.js.map

package/dist/core/permissions/rules/planModeRule.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/core/permissions/rules/planModeRule.ts"],
+  "sourcesContent": ["/**\n * Plan Mode Permission Rule\n *\n * Restricts write operations when in plan mode.\n */\n\nimport type {\n  PermissionRule,\n  PermissionContext,\n  PermissionResult,\n} from '../engine/types'\n\n/**\n * Tools that modify state (not allowed in plan mode)\n */\nconst WRITE_TOOLS = new Set([\n  'Edit',\n  'Write',\n  'MultiEdit',\n  'NotebookEdit',\n  'Bash', // May write files\n])\n\n/**\n * Read-only tools (always allowed in plan mode)\n */\nconst READ_ONLY_TOOLS = new Set([\n  'Read',\n  'Glob',\n  'Grep',\n  'LS',\n  'LSP',\n  'WebSearch',\n  'WebFetch',\n  'Task', // Can spawn read-only agents\n  'TodoWrite', // Planning notes\n  'AskUserQuestion',\n  'EnterPlanMode',\n  'ExitPlanMode',\n])\n\n/**\n * Plan Mode Rule\n *\n * When in plan mode, only allow read-only operations.\n */\nexport const planModeRule: PermissionRule = {\n  name: 'plan-mode',\n  description: 'Restricts write operations in plan mode',\n  priority: 100, // High priority\n\n  check(context: PermissionContext): PermissionResult {\n    // Skip if not in plan mode\n    if (!context.planMode) {\n      return { allowed: true }\n    }\n\n    const toolName = context.tool.name\n\n    // Always allow read-only tools\n    if (READ_ONLY_TOOLS.has(toolName)) {\n      return { allowed: true }\n    }\n\n    // Block write tools in plan mode\n    if (WRITE_TOOLS.has(toolName)) {\n      return {\n        allowed: false,\n        reason: `Tool ${toolName} is not allowed in plan mode. Only read-only operations are permitted.`,\n        message:\n          'Cannot modify files while in plan mode. Use ExitPlanMode to implement changes.',\n      }\n    }\n\n    // Check if tool explicitly declares read-only\n    if (context.tool.isReadOnly && context.tool.isReadOnly()) {\n      return { allowed: true }\n    }\n\n    // Default: allow unknown tools but log warning\n    console.warn(`Unknown tool ${toolName} used in plan mode`)\n    return { allowed: true }\n  },\n}\n"],
+  "mappings": "AAeA,MAAM,cAAc,oBAAI,IAAI;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AACF,CAAC;AAKD,MAAM,kBAAkB,oBAAI,IAAI;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOM,MAAM,eAA+B;AAAA,EAC1C,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU;AAAA;AAAA,EAEV,MAAM,SAA8C;AAElD,QAAI,CAAC,QAAQ,UAAU;AACrB,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAEA,UAAM,WAAW,QAAQ,KAAK;AAG9B,QAAI,gBAAgB,IAAI,QAAQ,GAAG;AACjC,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,QAAI,YAAY,IAAI,QAAQ,GAAG;AAC7B,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ,QAAQ,QAAQ;AAAA,QACxB,SACE;AAAA,MACJ;AAAA,IACF;AAGA,QAAI,QAAQ,KAAK,cAAc,QAAQ,KAAK,WAAW,GAAG;AACxD,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,YAAQ,KAAK,gBAAgB,QAAQ,oBAAoB;AACzD,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACF;",
+  "names": []
+}

package/dist/core/permissions/rules/projectBoundaryRule.js

@@ -0,0 +1,168 @@
+import { resolve, relative, isAbsolute } from "path";
+import { getOriginalCwd } from "../../../utils/state.js";
+function isOutsideProject(filePath) {
+  const projectDir = getOriginalCwd();
+  const absolutePath = isAbsolute(filePath) ? resolve(filePath) : resolve(projectDir, filePath);
+  const relativePath = relative(projectDir, absolutePath);
+  return relativePath.startsWith("..") || isAbsolute(relativePath);
+}
+function getRelativeFromProject(filePath) {
+  const projectDir = getOriginalCwd();
+  const absolutePath = isAbsolute(filePath) ? resolve(filePath) : resolve(projectDir, filePath);
+  return relative(projectDir, absolutePath);
+}
+function calculateExternalOperationRisk(operation, filePath) {
+  const relativePath = getRelativeFromProject(filePath);
+  const levelsUp = (relativePath.match(/\.\./g) || []).length;
+  if (levelsUp > 3 || filePath.startsWith("/etc") || filePath.startsWith("/usr")) {
+    return "critical";
+  }
+  if (operation === "delete" || levelsUp >= 2) {
+    return "high";
+  }
+  if (operation === "write" && levelsUp >= 1) {
+    return "medium";
+  }
+  return "low";
+}
+function getOperationType(toolName, input) {
+  switch (toolName) {
+    case "Read":
+    case "FileRead":
+    case "Glob":
+    case "Grep":
+      return "read";
+    case "Write":
+    case "FileWrite":
+    case "Edit":
+    case "FileEdit":
+    case "MultiEdit":
+    case "NotebookEdit":
+      return "write";
+    case "Bash": {
+      const command = input.command || "";
+      if (/\b(rm|del|rmdir|unlink)\b/.test(command)) {
+        return "delete";
+      }
+      if (/\b(mv|cp|touch|mkdir|echo\s+.*>|cat\s+.*>|tee)\b/.test(command)) {
+        return "write";
+      }
+      if (/\b(cat|head|tail|less|more|grep|find|ls)\b/.test(command)) {
+        return "read";
+      }
+      return "execute";
+    }
+    default:
+      return null;
+  }
+}
+function extractFilePaths(toolName, input) {
+  const paths = [];
+  if (input.file_path) paths.push(input.file_path);
+  if (input.filePath) paths.push(input.filePath);
+  if (input.path) paths.push(input.path);
+  if (toolName === "Bash") {
+    const command = input.command || "";
+    const pathMatches = command.matchAll(
+      /(?:cat|rm|mv|cp|head|tail|less|more|touch|mkdir|rmdir|>\s*)\s*["']?([^\s"'|&;><]+)/g
+    );
+    for (const match of pathMatches) {
+      if (match[1] && !match[1].startsWith("-")) {
+        paths.push(match[1]);
+      }
+    }
+  }
+  return paths;
+}
+const RISK_MESSAGES = {
+  low: "\u{1F4C1} This file is outside your project directory.",
+  medium: "\u26A0\uFE0F This operation modifies a file outside your project.",
+  high: "\u{1F536} High-risk operation: This file is significantly outside your project boundary.",
+  critical: "\u{1F6A8} Critical: This operation affects system or deeply external files!"
+};
+const projectBoundaryRule = {
+  name: "project-boundary",
+  description: "Requires confirmation for write/delete operations outside project directory",
+  priority: 95,
+  // High priority, but below sensitive paths
+  check(context) {
+    const toolName = context.tool.name;
+    const input = context.input;
+    const operation = getOperationType(toolName, input);
+    if (!operation) {
+      return { allowed: true };
+    }
+    if (operation === "read") {
+      return { allowed: true };
+    }
+    const filePaths = extractFilePaths(toolName, input);
+    if (filePaths.length === 0) {
+      return { allowed: true };
+    }
+    const externalPaths = [];
+    for (const filePath of filePaths) {
+      if (isOutsideProject(filePath)) {
+        const relativePath = getRelativeFromProject(filePath);
+        const risk = calculateExternalOperationRisk(operation, filePath);
+        externalPaths.push({ path: filePath, relativePath, risk });
+      }
+    }
+    if (externalPaths.length === 0) {
+      return { allowed: true };
+    }
+    const riskOrder = [
+      "low",
+      "medium",
+      "high",
+      "critical"
+    ];
+    const highestRisk = externalPaths.reduce((max, curr) => {
+      return riskOrder.indexOf(curr.risk) > riskOrder.indexOf(max) ? curr.risk : max;
+    }, "low");
+    if (highestRisk === "critical") {
+      return {
+        allowed: false,
+        reason: "Critical external operation blocked",
+        message: `${RISK_MESSAGES.critical}
+
+Paths:
+${externalPaths.map((p) => `  \u2022 ${p.relativePath}`).join("\n")}
+
+This operation is too risky to allow. Please reconsider.`
+      };
+    }
+    const projectDir = getOriginalCwd();
+    const pathList = externalPaths.map((p) => `  \u2022 ${p.relativePath} (${p.risk} risk)`).join("\n");
+    return {
+      allowed: false,
+      promptUser: true,
+      reason: "External operation requires confirmation",
+      message: `${RISK_MESSAGES[highestRisk]}
+
+Project: ${projectDir}
+
+External paths:
+${pathList}
+
+Operation: ${operation}`,
+      permissionKey: `ExternalOp(${operation}:${externalPaths.map((p) => p.path).join(",")})`
+    };
+  }
+};
+function isExternalOperation(filePath, operation) {
+  if (!isOutsideProject(filePath)) {
+    return { isExternal: false, risk: null };
+  }
+  return {
+    isExternal: true,
+    risk: calculateExternalOperationRisk(operation, filePath)
+  };
+}
+export {
+  calculateExternalOperationRisk,
+  getRelativeFromProject,
+  isExternalOperation,
+  isOutsideProject,
+  projectBoundaryRule
+};
+//# sourceMappingURL=projectBoundaryRule.js.map

package/dist/core/permissions/rules/projectBoundaryRule.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/core/permissions/rules/projectBoundaryRule.ts"],
+  "sourcesContent": ["/**\n * Project Boundary Rule\n *\n * Enforces secondary confirmation for write/delete operations\n * outside the project directory. This prevents accidental modifications\n * to files outside the current working context.\n */\n\nimport type {\n  PermissionRule,\n  PermissionContext,\n  PermissionResult,\n} from '../engine/types'\nimport { resolve, relative, isAbsolute } from 'path'\nimport { getOriginalCwd } from '@utils/state'\n\n/**\n * Operation risk levels for operations outside project directory\n */\nexport type ExternalOperationRisk = 'low' | 'medium' | 'high' | 'critical'\n\n/**\n * Determine if a path is outside the project directory\n */\nexport function isOutsideProject(filePath: string): boolean {\n  const projectDir = getOriginalCwd()\n  const absolutePath = isAbsolute(filePath)\n    ? resolve(filePath)\n    : resolve(projectDir, filePath)\n\n  const relativePath = relative(projectDir, absolutePath)\n\n  // If the relative path starts with '..' or is absolute, it's outside\n  return relativePath.startsWith('..') || isAbsolute(relativePath)\n}\n\n/**\n * Get the relative path from project directory (for display)\n */\nexport function getRelativeFromProject(filePath: string): string {\n  const projectDir = getOriginalCwd()\n  const absolutePath = isAbsolute(filePath)\n    ? resolve(filePath)\n    : resolve(projectDir, filePath)\n\n  return relative(projectDir, absolutePath)\n}\n\n/**\n * Calculate risk level for an external operation\n */\nexport function calculateExternalOperationRisk(\n  operation: 'read' | 'write' | 'delete' | 'execute',\n  filePath: string,\n): ExternalOperationRisk {\n  const relativePath = getRelativeFromProject(filePath)\n\n  // Count how many levels up we're going\n  const levelsUp = (relativePath.match(/\\.\\./g) || []).length\n\n  // Critical: More than 3 levels up or accessing system directories\n  if (\n    levelsUp > 3 ||\n    filePath.startsWith('/etc') ||\n    filePath.startsWith('/usr')\n  ) {\n    return 'critical'\n  }\n\n  // High: Delete operations or 2-3 levels up\n  if (operation === 'delete' || levelsUp >= 2) {\n    return 'high'\n  }\n\n  // Medium: Write operations 1 level up\n  if (operation === 'write' && levelsUp >= 1) {\n    return 'medium'\n  }\n\n  // Low: Other cases\n  return 'low'\n}\n\n/**\n * Get operation type from tool name\n */\nfunction getOperationType(\n  toolName: string,\n  input: Record<string, unknown>,\n): 'read' | 'write' | 'delete' | 'execute' | null {\n  switch (toolName) {\n    case 'Read':\n    case 'FileRead':\n    case 'Glob':\n    case 'Grep':\n      return 'read'\n    case 'Write':\n    case 'FileWrite':\n    case 'Edit':\n    case 'FileEdit':\n    case 'MultiEdit':\n    case 'NotebookEdit':\n      return 'write'\n    case 'Bash': {\n      const command = (input.command as string) || ''\n      if (/\\b(rm|del|rmdir|unlink)\\b/.test(command)) {\n        return 'delete'\n      }\n      if (/\\b(mv|cp|touch|mkdir|echo\\s+.*>|cat\\s+.*>|tee)\\b/.test(command)) {\n        return 'write'\n      }\n      if (/\\b(cat|head|tail|less|more|grep|find|ls)\\b/.test(command)) {\n        return 'read'\n      }\n      return 'execute'\n    }\n    default:\n      return null\n  }\n}\n\n/**\n * Extract file paths from tool input (may return multiple for Bash)\n */\nfunction extractFilePaths(\n  toolName: string,\n  input: Record<string, unknown>,\n): string[] {\n  const paths: string[] = []\n\n  // Direct file path tools\n  if (input.file_path) paths.push(input.file_path as string)\n  if (input.filePath) paths.push(input.filePath as string)\n  if (input.path) paths.push(input.path as string)\n\n  // For Bash commands, extract all paths\n  if (toolName === 'Bash') {\n    const command = (input.command as string) || ''\n\n    // Match paths after file operation commands\n    const pathMatches = command.matchAll(\n      /(?:cat|rm|mv|cp|head|tail|less|more|touch|mkdir|rmdir|>\\s*)\\s*[\"']?([^\\s\"'|&;><]+)/g,\n    )\n    for (const match of pathMatches) {\n      if (match[1] && !match[1].startsWith('-')) {\n        paths.push(match[1])\n      }\n    }\n  }\n\n  return paths\n}\n\n/**\n * Risk level descriptions\n */\nconst RISK_MESSAGES: Record<ExternalOperationRisk, string> = {\n  low: '\uD83D\uDCC1 This file is outside your project directory.',\n  medium: '\u26A0\uFE0F This operation modifies a file outside your project.',\n  high: '\uD83D\uDD36 High-risk operation: This file is significantly outside your project boundary.',\n  critical:\n    '\uD83D\uDEA8 Critical: This operation affects system or deeply external files!',\n}\n\n/**\n * Project Boundary Rule\n *\n * Requires confirmation for write/delete operations outside project.\n */\nexport const projectBoundaryRule: PermissionRule = {\n  name: 'project-boundary',\n  description:\n    'Requires confirmation for write/delete operations outside project directory',\n  priority: 95, // High priority, but below sensitive paths\n\n  check(context: PermissionContext): PermissionResult {\n    const toolName = context.tool.name\n    const input = context.input\n\n    // Get operation type\n    const operation = getOperationType(toolName, input)\n    if (!operation) {\n      return { allowed: true }\n    }\n\n    // Only check write/delete operations (read is generally safe)\n    if (operation === 'read') {\n      return { allowed: true }\n    }\n\n    // Extract file paths\n    const filePaths = extractFilePaths(toolName, input)\n    if (filePaths.length === 0) {\n      return { allowed: true }\n    }\n\n    // Check each path\n    const externalPaths: Array<{\n      path: string\n      relativePath: string\n      risk: ExternalOperationRisk\n    }> = []\n\n    for (const filePath of filePaths) {\n      if (isOutsideProject(filePath)) {\n        const relativePath = getRelativeFromProject(filePath)\n        const risk = calculateExternalOperationRisk(operation, filePath)\n        externalPaths.push({ path: filePath, relativePath, risk })\n      }\n    }\n\n    // If no external paths, allow\n    if (externalPaths.length === 0) {\n      return { allowed: true }\n    }\n\n    // Get the highest risk level\n    const riskOrder: ExternalOperationRisk[] = [\n      'low',\n      'medium',\n      'high',\n      'critical',\n    ]\n    const highestRisk = externalPaths.reduce((max, curr) => {\n      return riskOrder.indexOf(curr.risk) > riskOrder.indexOf(max)\n        ? curr.risk\n        : max\n    }, 'low' as ExternalOperationRisk)\n\n    // Critical operations are blocked\n    if (highestRisk === 'critical') {\n      return {\n        allowed: false,\n        reason: 'Critical external operation blocked',\n        message: `${RISK_MESSAGES.critical}\\n\\nPaths:\\n${externalPaths.map(p => `  \u2022 ${p.relativePath}`).join('\\n')}\\n\\nThis operation is too risky to allow. Please reconsider.`,\n      }\n    }\n\n    // All other external operations require explicit confirmation\n    const projectDir = getOriginalCwd()\n    const pathList = externalPaths\n      .map(p => `  \u2022 ${p.relativePath} (${p.risk} risk)`)\n      .join('\\n')\n\n    return {\n      allowed: false,\n      promptUser: true,\n      reason: 'External operation requires confirmation',\n      message: `${RISK_MESSAGES[highestRisk]}\\n\\nProject: ${projectDir}\\n\\nExternal paths:\\n${pathList}\\n\\nOperation: ${operation}`,\n      permissionKey: `ExternalOp(${operation}:${externalPaths.map(p => p.path).join(',')})`,\n    }\n  },\n}\n\n/**\n * Check if an operation is outside project (utility function)\n */\nexport function isExternalOperation(\n  filePath: string,\n  operation: 'read' | 'write' | 'delete' | 'execute',\n): { isExternal: boolean; risk: ExternalOperationRisk | null } {\n  if (!isOutsideProject(filePath)) {\n    return { isExternal: false, risk: null }\n  }\n\n  return {\n    isExternal: true,\n    risk: calculateExternalOperationRisk(operation, filePath),\n  }\n}\n"],
+  "mappings": "AAaA,SAAS,SAAS,UAAU,kBAAkB;AAC9C,SAAS,sBAAsB;AAUxB,SAAS,iBAAiB,UAA2B;AAC1D,QAAM,aAAa,eAAe;AAClC,QAAM,eAAe,WAAW,QAAQ,IACpC,QAAQ,QAAQ,IAChB,QAAQ,YAAY,QAAQ;AAEhC,QAAM,eAAe,SAAS,YAAY,YAAY;AAGtD,SAAO,aAAa,WAAW,IAAI,KAAK,WAAW,YAAY;AACjE;AAKO,SAAS,uBAAuB,UAA0B;AAC/D,QAAM,aAAa,eAAe;AAClC,QAAM,eAAe,WAAW,QAAQ,IACpC,QAAQ,QAAQ,IAChB,QAAQ,YAAY,QAAQ;AAEhC,SAAO,SAAS,YAAY,YAAY;AAC1C;AAKO,SAAS,+BACd,WACA,UACuB;AACvB,QAAM,eAAe,uBAAuB,QAAQ;AAGpD,QAAM,YAAY,aAAa,MAAM,OAAO,KAAK,CAAC,GAAG;AAGrD,MACE,WAAW,KACX,SAAS,WAAW,MAAM,KAC1B,SAAS,WAAW,MAAM,GAC1B;AACA,WAAO;AAAA,EACT;AAGA,MAAI,cAAc,YAAY,YAAY,GAAG;AAC3C,WAAO;AAAA,EACT;AAGA,MAAI,cAAc,WAAW,YAAY,GAAG;AAC1C,WAAO;AAAA,EACT;AAGA,SAAO;AACT;AAKA,SAAS,iBACP,UACA,OACgD;AAChD,UAAQ,UAAU;AAAA,IAChB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK,QAAQ;AACX,YAAM,UAAW,MAAM,WAAsB;AAC7C,UAAI,4BAA4B,KAAK,OAAO,GAAG;AAC7C,eAAO;AAAA,MACT;AACA,UAAI,mDAAmD,KAAK,OAAO,GAAG;AACpE,eAAO;AAAA,MACT;AACA,UAAI,6CAA6C,KAAK,OAAO,GAAG;AAC9D,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT;AAAA,IACA;AACE,aAAO;AAAA,EACX;AACF;AAKA,SAAS,iBACP,UACA,OACU;AACV,QAAM,QAAkB,CAAC;AAGzB,MAAI,MAAM,UAAW,OAAM,KAAK,MAAM,SAAmB;AACzD,MAAI,MAAM,SAAU,OAAM,KAAK,MAAM,QAAkB;AACvD,MAAI,MAAM,KAAM,OAAM,KAAK,MAAM,IAAc;AAG/C,MAAI,aAAa,QAAQ;AACvB,UAAM,UAAW,MAAM,WAAsB;AAG7C,UAAM,cAAc,QAAQ;AAAA,MAC1B;AAAA,IACF;AACA,eAAW,SAAS,aAAa;AAC/B,UAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,GAAG;AACzC,cAAM,KAAK,MAAM,CAAC,CAAC;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAKA,MAAM,gBAAuD;AAAA,EAC3D,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UACE;AACJ;AAOO,MAAM,sBAAsC;AAAA,EACjD,MAAM;AAAA,EACN,aACE;AAAA,EACF,UAAU;AAAA;AAAA,EAEV,MAAM,SAA8C;AAClD,UAAM,WAAW,QAAQ,KAAK;AAC9B,UAAM,QAAQ,QAAQ;AAGtB,UAAM,YAAY,iBAAiB,UAAU,KAAK;AAClD,QAAI,CAAC,WAAW;AACd,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,QAAI,cAAc,QAAQ;AACxB,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,UAAM,YAAY,iBAAiB,UAAU,KAAK;AAClD,QAAI,UAAU,WAAW,GAAG;AAC1B,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,UAAM,gBAID,CAAC;AAEN,eAAW,YAAY,WAAW;AAChC,UAAI,iBAAiB,QAAQ,GAAG;AAC9B,cAAM,eAAe,uBAAuB,QAAQ;AACpD,cAAM,OAAO,+BAA+B,WAAW,QAAQ;AAC/D,sBAAc,KAAK,EAAE,MAAM,UAAU,cAAc,KAAK,CAAC;AAAA,MAC3D;AAAA,IACF;AAGA,QAAI,cAAc,WAAW,GAAG;AAC9B,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,UAAM,YAAqC;AAAA,MACzC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,UAAM,cAAc,cAAc,OAAO,CAAC,KAAK,SAAS;AACtD,aAAO,UAAU,QAAQ,KAAK,IAAI,IAAI,UAAU,QAAQ,GAAG,IACvD,KAAK,OACL;AAAA,IACN,GAAG,KAA8B;AAGjC,QAAI,gBAAgB,YAAY;AAC9B,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS,GAAG,cAAc,QAAQ;AAAA;AAAA;AAAA,EAAe,cAAc,IAAI,OAAK,YAAO,EAAE,YAAY,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA,MAC7G;AAAA,IACF;AAGA,UAAM,aAAa,eAAe;AAClC,UAAM,WAAW,cACd,IAAI,OAAK,YAAO,EAAE,YAAY,KAAK,EAAE,IAAI,QAAQ,EACjD,KAAK,IAAI;AAEZ,WAAO;AAAA,MACL,SAAS;AAAA,MACT,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,SAAS,GAAG,cAAc,WAAW,CAAC;AAAA;AAAA,WAAgB,UAAU;AAAA;AAAA;AAAA,EAAwB,QAAQ;AAAA;AAAA,aAAkB,SAAS;AAAA,MAC3H,eAAe,cAAc,SAAS,IAAI,cAAc,IAAI,OAAK,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC;AAAA,IACpF;AAAA,EACF;AACF;AAKO,SAAS,oBACd,UACA,WAC6D;AAC7D,MAAI,CAAC,iBAAiB,QAAQ,GAAG;AAC/B,WAAO,EAAE,YAAY,OAAO,MAAM,KAAK;AAAA,EACzC;AAEA,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM,+BAA+B,WAAW,QAAQ;AAAA,EAC1D;AACF;",
+  "names": []
+}