@within-7/minto 0.1.7 → 0.3.0

package/dist/core/permissions/rules/safeModeRule.js

@@ -0,0 +1,65 @@
+const RESTRICTED_TOOLS = /* @__PURE__ */ new Set([
+  "Bash",
+  // Can execute arbitrary commands
+  "KillShell"
+  // Can kill processes
+]);
+const DANGEROUS_COMMAND_PATTERNS = [
+  /rm\s+-rf?\s+\//,
+  // rm -rf /
+  /sudo\s+/,
+  // sudo commands
+  /mkfs/,
+  // formatting
+  /dd\s+if=/,
+  // disk operations
+  /:\s*\(\)\s*\{\s*:\|:\s*&\s*\}/,
+  // fork bomb
+  /shutdown|reboot|poweroff/i,
+  // system control
+  /chmod\s+777/,
+  // overly permissive chmod
+  /curl.*\|\s*(bash|sh)/,
+  // piped scripts
+  /wget.*\|\s*(bash|sh)/
+  // piped scripts
+];
+const safeModeRule = {
+  name: "safe-mode",
+  description: "Restricts dangerous operations in safe mode",
+  priority: 90,
+  // High priority, but below plan mode
+  check(context) {
+    if (!context.safeMode) {
+      return { allowed: true };
+    }
+    const toolName = context.tool.name;
+    if (toolName === "Bash") {
+      const command = context.input.command;
+      if (command) {
+        for (const pattern of DANGEROUS_COMMAND_PATTERNS) {
+          if (pattern.test(command)) {
+            return {
+              allowed: false,
+              reason: `Command matches dangerous pattern in safe mode`,
+              message: `This command is blocked in safe mode for security reasons.`
+            };
+          }
+        }
+      }
+    }
+    if (RESTRICTED_TOOLS.has(toolName)) {
+      return {
+        allowed: true,
+        // Allow but mark for prompting
+        promptUser: true,
+        message: `Tool ${toolName} requires approval in safe mode`
+      };
+    }
+    return { allowed: true };
+  }
+};
+export {
+  safeModeRule
+};
+//# sourceMappingURL=safeModeRule.js.map

package/dist/core/permissions/rules/safeModeRule.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/core/permissions/rules/safeModeRule.ts"],
+  "sourcesContent": ["/**\n * Safe Mode Permission Rule\n *\n * Restricts dangerous operations when in safe mode.\n */\n\nimport type {\n  PermissionRule,\n  PermissionContext,\n  PermissionResult,\n} from '../engine/types'\n\n/**\n * Tools that are restricted in safe mode\n */\nconst RESTRICTED_TOOLS = new Set([\n  'Bash', // Can execute arbitrary commands\n  'KillShell', // Can kill processes\n])\n\n/**\n * Dangerous bash command patterns\n */\nconst DANGEROUS_COMMAND_PATTERNS = [\n  /rm\\s+-rf?\\s+\\//, // rm -rf /\n  /sudo\\s+/, // sudo commands\n  /mkfs/, // formatting\n  /dd\\s+if=/, // disk operations\n  /:\\s*\\(\\)\\s*\\{\\s*:\\|:\\s*&\\s*\\}/, // fork bomb\n  /shutdown|reboot|poweroff/i, // system control\n  /chmod\\s+777/, // overly permissive chmod\n  /curl.*\\|\\s*(bash|sh)/, // piped scripts\n  /wget.*\\|\\s*(bash|sh)/, // piped scripts\n]\n\n/**\n * Safe Mode Rule\n *\n * Restricts potentially dangerous operations.\n */\nexport const safeModeRule: PermissionRule = {\n  name: 'safe-mode',\n  description: 'Restricts dangerous operations in safe mode',\n  priority: 90, // High priority, but below plan mode\n\n  check(context: PermissionContext): PermissionResult {\n    // Skip if not in safe mode\n    if (!context.safeMode) {\n      return { allowed: true }\n    }\n\n    const toolName = context.tool.name\n\n    // Check bash commands specifically\n    if (toolName === 'Bash') {\n      const command = context.input.command as string | undefined\n      if (command) {\n        for (const pattern of DANGEROUS_COMMAND_PATTERNS) {\n          if (pattern.test(command)) {\n            return {\n              allowed: false,\n              reason: `Command matches dangerous pattern in safe mode`,\n              message: `This command is blocked in safe mode for security reasons.`,\n            }\n          }\n        }\n      }\n    }\n\n    // Restricted tools require explicit approval in safe mode\n    if (RESTRICTED_TOOLS.has(toolName)) {\n      return {\n        allowed: true, // Allow but mark for prompting\n        promptUser: true,\n        message: `Tool ${toolName} requires approval in safe mode`,\n      }\n    }\n\n    return { allowed: true }\n  },\n}\n"],
+  "mappings": "AAeA,MAAM,mBAAmB,oBAAI,IAAI;AAAA,EAC/B;AAAA;AAAA,EACA;AAAA;AACF,CAAC;AAKD,MAAM,6BAA6B;AAAA,EACjC;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACF;AAOO,MAAM,eAA+B;AAAA,EAC1C,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU;AAAA;AAAA,EAEV,MAAM,SAA8C;AAElD,QAAI,CAAC,QAAQ,UAAU;AACrB,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAEA,UAAM,WAAW,QAAQ,KAAK;AAG9B,QAAI,aAAa,QAAQ;AACvB,YAAM,UAAU,QAAQ,MAAM;AAC9B,UAAI,SAAS;AACX,mBAAW,WAAW,4BAA4B;AAChD,cAAI,QAAQ,KAAK,OAAO,GAAG;AACzB,mBAAO;AAAA,cACL,SAAS;AAAA,cACT,QAAQ;AAAA,cACR,SAAS;AAAA,YACX;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,QAAI,iBAAiB,IAAI,QAAQ,GAAG;AAClC,aAAO;AAAA,QACL,SAAS;AAAA;AAAA,QACT,YAAY;AAAA,QACZ,SAAS,QAAQ,QAAQ;AAAA,MAC3B;AAAA,IACF;AAEA,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACF;",
+  "names": []
+}

package/dist/core/permissions/rules/sensitivePathsRule.js

@@ -0,0 +1,345 @@
+import { resolve, normalize } from "path";
+import { homedir } from "os";
+const SENSITIVE_PATHS = [
+  // SSH
+  {
+    pattern: "~/.ssh/*",
+    category: "ssh",
+    description: "SSH keys and configuration",
+    operations: ["read", "write", "delete"]
+  },
+  {
+    pattern: "~/.ssh",
+    category: "ssh",
+    description: "SSH directory",
+    operations: ["write", "delete"]
+  },
+  // Credentials
+  {
+    pattern: "~/.aws/*",
+    category: "cloud",
+    description: "AWS credentials and configuration",
+    operations: ["read", "write", "delete"]
+  },
+  {
+    pattern: "~/.config/gcloud/*",
+    category: "cloud",
+    description: "Google Cloud credentials",
+    operations: ["read", "write", "delete"]
+  },
+  {
+    pattern: "~/.azure/*",
+    category: "cloud",
+    description: "Azure credentials",
+    operations: ["read", "write", "delete"]
+  },
+  {
+    pattern: "~/.config/gh/*",
+    category: "credentials",
+    description: "GitHub CLI credentials",
+    operations: ["read", "write", "delete"]
+  },
+  {
+    pattern: "~/.docker/config.json",
+    category: "credentials",
+    description: "Docker registry credentials",
+    operations: ["read", "write", "delete"]
+  },
+  {
+    pattern: "~/.npmrc",
+    category: "credentials",
+    description: "NPM credentials",
+    operations: ["read", "write", "delete"]
+  },
+  {
+    pattern: "~/.netrc",
+    category: "credentials",
+    description: "Network credentials",
+    operations: ["read", "write", "delete"]
+  },
+  {
+    pattern: "~/.gnupg/*",
+    category: "credentials",
+    description: "GPG keys and configuration",
+    operations: ["read", "write", "delete"]
+  },
+  // Development secrets
+  {
+    pattern: "**/.env",
+    category: "development",
+    description: "Environment variables file",
+    operations: ["read", "write", "delete"]
+  },
+  {
+    pattern: "**/.env.*",
+    category: "development",
+    description: "Environment variables file",
+    operations: ["read", "write", "delete"]
+  },
+  {
+    pattern: "**/credentials.json",
+    category: "development",
+    description: "Credentials file",
+    operations: ["read", "write", "delete"]
+  },
+  {
+    pattern: "**/secrets.json",
+    category: "development",
+    description: "Secrets file",
+    operations: ["read", "write", "delete"]
+  },
+  {
+    pattern: "**/secrets.yaml",
+    category: "development",
+    description: "Secrets file",
+    operations: ["read", "write", "delete"]
+  },
+  {
+    pattern: "**/secrets.yml",
+    category: "development",
+    description: "Secrets file",
+    operations: ["read", "write", "delete"]
+  },
+  {
+    pattern: "**/*.pem",
+    category: "credentials",
+    description: "Private key file",
+    operations: ["read", "write", "delete"]
+  },
+  {
+    pattern: "**/*.key",
+    category: "credentials",
+    description: "Private key file",
+    operations: ["read", "write", "delete"]
+  },
+  {
+    pattern: "**/id_rsa",
+    category: "ssh",
+    description: "SSH private key",
+    operations: ["read", "write", "delete"]
+  },
+  {
+    pattern: "**/id_ed25519",
+    category: "ssh",
+    description: "SSH private key",
+    operations: ["read", "write", "delete"]
+  },
+  // Browser data
+  {
+    pattern: "~/Library/Application Support/Google/Chrome/*",
+    category: "browser",
+    description: "Chrome browser data",
+    operations: ["read", "write", "delete"]
+  },
+  {
+    pattern: "~/Library/Application Support/Firefox/*",
+    category: "browser",
+    description: "Firefox browser data",
+    operations: ["read", "write", "delete"]
+  },
+  {
+    pattern: "~/.config/google-chrome/*",
+    category: "browser",
+    description: "Chrome browser data (Linux)",
+    operations: ["read", "write", "delete"]
+  },
+  {
+    pattern: "~/.mozilla/firefox/*",
+    category: "browser",
+    description: "Firefox browser data (Linux)",
+    operations: ["read", "write", "delete"]
+  },
+  // System configuration
+  {
+    pattern: "/etc/passwd",
+    category: "system",
+    description: "System user database",
+    operations: ["read", "write", "delete"]
+  },
+  {
+    pattern: "/etc/shadow",
+    category: "system",
+    description: "System password hashes",
+    alwaysBlock: true,
+    operations: ["read", "write", "delete"]
+  },
+  {
+    pattern: "/etc/sudoers",
+    category: "system",
+    description: "Sudo configuration",
+    operations: ["read", "write", "delete"]
+  },
+  {
+    pattern: "/etc/hosts",
+    category: "system",
+    description: "Host file",
+    operations: ["write", "delete"]
+  },
+  // Cryptocurrency wallets
+  {
+    pattern: "~/.bitcoin/*",
+    category: "wallet",
+    description: "Bitcoin wallet",
+    operations: ["read", "write", "delete"]
+  },
+  {
+    pattern: "~/.ethereum/*",
+    category: "wallet",
+    description: "Ethereum wallet",
+    operations: ["read", "write", "delete"]
+  },
+  {
+    pattern: "**/*wallet*.json",
+    category: "wallet",
+    description: "Wallet file",
+    operations: ["read", "write", "delete"]
+  },
+  {
+    pattern: "**/*keystore*",
+    category: "wallet",
+    description: "Keystore file",
+    operations: ["read", "write", "delete"]
+  },
+  // Minto/Claude configuration (protect our own config)
+  {
+    pattern: "~/.minto.json",
+    category: "credentials",
+    description: "Minto global configuration (may contain API keys)",
+    operations: ["delete"]
+    // Only protect delete, read/write allowed for config
+  }
+];
+function expandPath(pattern) {
+  const home = homedir();
+  let expanded = pattern.replace(/^~/, home);
+  return normalize(expanded);
+}
+function patternToRegex(pattern) {
+  const expanded = expandPath(pattern);
+  let regex = expanded.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "<<<DOUBLESTAR>>>").replace(/\*/g, "[^/]*").replace(/<<<DOUBLESTAR>>>/g, ".*");
+  return new RegExp(`^${regex}$`, "i");
+}
+function matchesSensitivePath(filePath, sensitivePath) {
+  const normalizedPath = normalize(resolve(filePath));
+  const regex = patternToRegex(sensitivePath.pattern);
+  return regex.test(normalizedPath);
+}
+function getOperationType(toolName, input) {
+  switch (toolName) {
+    case "View":
+    // Actual API name for FileReadTool
+    case "Read":
+    case "FileRead":
+    case "Glob":
+    case "Grep":
+      return "read";
+    case "Replace":
+    // Actual API name for FileWriteTool
+    case "Write":
+    case "FileWrite":
+    case "Edit":
+    case "FileEdit":
+    case "MultiEdit":
+    case "NotebookEdit":
+    case "NotebookEditCell":
+      return "write";
+    case "Bash": {
+      const command = input.command || "";
+      if (/\b(rm|del|rmdir|unlink)\b/.test(command)) {
+        return "delete";
+      }
+      if (/\b(mv|cp|touch|mkdir|echo\s+.*>|cat\s+.*>|tee)\b/.test(command)) {
+        return "write";
+      }
+      if (/\b(cat|head|tail|less|more|grep|find|ls)\b/.test(command)) {
+        return "read";
+      }
+      return "execute";
+    }
+    default:
+      return null;
+  }
+}
+function extractFilePath(toolName, input) {
+  if (input.file_path) return input.file_path;
+  if (input.filePath) return input.filePath;
+  if (input.path) return input.path;
+  if (toolName === "Bash") {
+    const command = input.command || "";
+    const pathMatch = command.match(
+      /(?:cat|rm|mv|cp|head|tail|less|more|touch|mkdir)\s+["']?([^\s"'|&;>]+)/
+    );
+    if (pathMatch) {
+      return pathMatch[1] || null;
+    }
+  }
+  return null;
+}
+function findMatchingSensitivePaths(filePath, operation) {
+  return SENSITIVE_PATHS.filter((sp) => {
+    if (sp.operations && !sp.operations.includes(operation)) {
+      return false;
+    }
+    return matchesSensitivePath(filePath, sp);
+  });
+}
+const sensitivePathsRule = {
+  name: "sensitive-paths",
+  description: "Protects sensitive paths from unauthorized access",
+  priority: 100,
+  // Highest priority - checked before all other rules
+  check(context) {
+    const toolName = context.tool.name;
+    const input = context.input;
+    const operation = getOperationType(toolName, input);
+    if (!operation) {
+      return { allowed: true };
+    }
+    const filePath = extractFilePath(toolName, input);
+    if (!filePath) {
+      return { allowed: true };
+    }
+    const matches = findMatchingSensitivePaths(filePath, operation);
+    if (matches.length === 0) {
+      return { allowed: true };
+    }
+    const blocked = matches.find((m) => m.alwaysBlock);
+    if (blocked) {
+      return {
+        allowed: false,
+        reason: `Access to ${blocked.description} is blocked for security`,
+        message: `\u{1F512} Access denied: ${blocked.description} (${blocked.category})`
+      };
+    }
+    const categories = [...new Set(matches.map((m) => m.category))];
+    const descriptions = matches.map((m) => m.description).join(", ");
+    return {
+      allowed: false,
+      promptUser: true,
+      reason: `Sensitive path access requires confirmation`,
+      message: `\u26A0\uFE0F Sensitive ${operation} operation on: ${descriptions}
+Categories: ${categories.join(", ")}`,
+      permissionKey: `SensitivePath(${operation}:${filePath})`
+    };
+  }
+};
+function isSensitivePath(filePath, operation = "read") {
+  return findMatchingSensitivePaths(filePath, operation).length > 0;
+}
+function getSensitivePathInfo(filePath) {
+  for (const sp of SENSITIVE_PATHS) {
+    if (matchesSensitivePath(filePath, sp)) {
+      return sp;
+    }
+  }
+  return null;
+}
+export {
+  SENSITIVE_PATHS,
+  findMatchingSensitivePaths,
+  getSensitivePathInfo,
+  isSensitivePath,
+  matchesSensitivePath,
+  sensitivePathsRule
+};
+//# sourceMappingURL=sensitivePathsRule.js.map

package/dist/core/permissions/rules/sensitivePathsRule.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/core/permissions/rules/sensitivePathsRule.ts"],
+  "sourcesContent": ["/**\n * Sensitive Paths Protection Rule\n *\n * Always requires explicit authorization for operations on sensitive paths,\n * regardless of other permissions. These paths contain sensitive data that\n * should never be accessed without user awareness.\n */\n\nimport type {\n  PermissionRule,\n  PermissionContext,\n  PermissionResult,\n} from '../engine/types'\nimport { resolve, normalize } from 'path'\nimport { homedir } from 'os'\n\n/**\n * Categories of sensitive paths with different protection levels\n */\nexport type SensitivePathCategory =\n  | 'credentials' // API keys, passwords, tokens\n  | 'ssh' // SSH keys and config\n  | 'system' // System configuration files\n  | 'browser' // Browser data (cookies, history, passwords)\n  | 'cloud' // Cloud provider credentials\n  | 'development' // Development secrets (env files, etc.)\n  | 'wallet' // Cryptocurrency wallets\n\n/**\n * Sensitive path definition\n */\nexport interface SensitivePath {\n  /** Pattern to match (supports * wildcards) */\n  pattern: string\n  /** Category of sensitive data */\n  category: SensitivePathCategory\n  /** Human-readable description */\n  description: string\n  /** Whether this path is always blocked (vs requiring confirmation) */\n  alwaysBlock?: boolean\n  /** Applicable operations (read, write, delete, execute) */\n  operations?: ('read' | 'write' | 'delete' | 'execute')[]\n}\n\n/**\n * Default sensitive paths list\n */\nexport const SENSITIVE_PATHS: SensitivePath[] = [\n  // SSH\n  {\n    pattern: '~/.ssh/*',\n    category: 'ssh',\n    description: 'SSH keys and configuration',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.ssh',\n    category: 'ssh',\n    description: 'SSH directory',\n    operations: ['write', 'delete'],\n  },\n\n  // Credentials\n  {\n    pattern: '~/.aws/*',\n    category: 'cloud',\n    description: 'AWS credentials and configuration',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.config/gcloud/*',\n    category: 'cloud',\n    description: 'Google Cloud credentials',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.azure/*',\n    category: 'cloud',\n    description: 'Azure credentials',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.config/gh/*',\n    category: 'credentials',\n    description: 'GitHub CLI credentials',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.docker/config.json',\n    category: 'credentials',\n    description: 'Docker registry credentials',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.npmrc',\n    category: 'credentials',\n    description: 'NPM credentials',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.netrc',\n    category: 'credentials',\n    description: 'Network credentials',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.gnupg/*',\n    category: 'credentials',\n    description: 'GPG keys and configuration',\n    operations: ['read', 'write', 'delete'],\n  },\n\n  // Development secrets\n  {\n    pattern: '**/.env',\n    category: 'development',\n    description: 'Environment variables file',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/.env.*',\n    category: 'development',\n    description: 'Environment variables file',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/credentials.json',\n    category: 'development',\n    description: 'Credentials file',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/secrets.json',\n    category: 'development',\n    description: 'Secrets file',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/secrets.yaml',\n    category: 'development',\n    description: 'Secrets file',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/secrets.yml',\n    category: 'development',\n    description: 'Secrets file',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/*.pem',\n    category: 'credentials',\n    description: 'Private key file',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/*.key',\n    category: 'credentials',\n    description: 'Private key file',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/id_rsa',\n    category: 'ssh',\n    description: 'SSH private key',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/id_ed25519',\n    category: 'ssh',\n    description: 'SSH private key',\n    operations: ['read', 'write', 'delete'],\n  },\n\n  // Browser data\n  {\n    pattern: '~/Library/Application Support/Google/Chrome/*',\n    category: 'browser',\n    description: 'Chrome browser data',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/Library/Application Support/Firefox/*',\n    category: 'browser',\n    description: 'Firefox browser data',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.config/google-chrome/*',\n    category: 'browser',\n    description: 'Chrome browser data (Linux)',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.mozilla/firefox/*',\n    category: 'browser',\n    description: 'Firefox browser data (Linux)',\n    operations: ['read', 'write', 'delete'],\n  },\n\n  // System configuration\n  {\n    pattern: '/etc/passwd',\n    category: 'system',\n    description: 'System user database',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '/etc/shadow',\n    category: 'system',\n    description: 'System password hashes',\n    alwaysBlock: true,\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '/etc/sudoers',\n    category: 'system',\n    description: 'Sudo configuration',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '/etc/hosts',\n    category: 'system',\n    description: 'Host file',\n    operations: ['write', 'delete'],\n  },\n\n  // Cryptocurrency wallets\n  {\n    pattern: '~/.bitcoin/*',\n    category: 'wallet',\n    description: 'Bitcoin wallet',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.ethereum/*',\n    category: 'wallet',\n    description: 'Ethereum wallet',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/*wallet*.json',\n    category: 'wallet',\n    description: 'Wallet file',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/*keystore*',\n    category: 'wallet',\n    description: 'Keystore file',\n    operations: ['read', 'write', 'delete'],\n  },\n\n  // Minto/Claude configuration (protect our own config)\n  {\n    pattern: '~/.minto.json',\n    category: 'credentials',\n    description: 'Minto global configuration (may contain API keys)',\n    operations: ['delete'], // Only protect delete, read/write allowed for config\n  },\n]\n\n/**\n * Expand ~ to home directory and normalize path\n */\nfunction expandPath(pattern: string): string {\n  const home = homedir()\n  let expanded = pattern.replace(/^~/, home)\n  return normalize(expanded)\n}\n\n/**\n * Convert glob pattern to regex\n */\nfunction patternToRegex(pattern: string): RegExp {\n  const expanded = expandPath(pattern)\n  // Escape special regex characters except * and **\n  let regex = expanded\n    .replace(/[.+?^${}()|[\\]\\\\]/g, '\\\\$&')\n    .replace(/\\*\\*/g, '<<<DOUBLESTAR>>>')\n    .replace(/\\*/g, '[^/]*')\n    .replace(/<<<DOUBLESTAR>>>/g, '.*')\n\n  return new RegExp(`^${regex}$`, 'i')\n}\n\n/**\n * Check if a path matches a sensitive path pattern\n */\nexport function matchesSensitivePath(\n  filePath: string,\n  sensitivePath: SensitivePath,\n): boolean {\n  const normalizedPath = normalize(resolve(filePath))\n  const regex = patternToRegex(sensitivePath.pattern)\n  return regex.test(normalizedPath)\n}\n\n/**\n * Get operation type from tool name and input\n */\nfunction getOperationType(\n  toolName: string,\n  input: Record<string, unknown>,\n): 'read' | 'write' | 'delete' | 'execute' | null {\n  switch (toolName) {\n    case 'View': // Actual API name for FileReadTool\n    case 'Read':\n    case 'FileRead':\n    case 'Glob':\n    case 'Grep':\n      return 'read'\n    case 'Replace': // Actual API name for FileWriteTool\n    case 'Write':\n    case 'FileWrite':\n    case 'Edit':\n    case 'FileEdit':\n    case 'MultiEdit':\n    case 'NotebookEdit':\n    case 'NotebookEditCell': // Actual API name for NotebookEditTool\n      return 'write'\n    case 'Bash': {\n      const command = (input.command as string) || ''\n      // Check for delete commands\n      if (/\\b(rm|del|rmdir|unlink)\\b/.test(command)) {\n        return 'delete'\n      }\n      // Check for write commands\n      if (/\\b(mv|cp|touch|mkdir|echo\\s+.*>|cat\\s+.*>|tee)\\b/.test(command)) {\n        return 'write'\n      }\n      // Check for read commands\n      if (/\\b(cat|head|tail|less|more|grep|find|ls)\\b/.test(command)) {\n        return 'read'\n      }\n      return 'execute'\n    }\n    default:\n      return null\n  }\n}\n\n/**\n * Extract file path from tool input\n */\nfunction extractFilePath(\n  toolName: string,\n  input: Record<string, unknown>,\n): string | null {\n  // Direct file path tools\n  if (input.file_path) return input.file_path as string\n  if (input.filePath) return input.filePath as string\n  if (input.path) return input.path as string\n\n  // For Bash commands, try to extract file paths\n  if (toolName === 'Bash') {\n    const command = (input.command as string) || ''\n    // Simple extraction - look for paths after common commands\n    const pathMatch = command.match(\n      /(?:cat|rm|mv|cp|head|tail|less|more|touch|mkdir)\\s+[\"']?([^\\s\"'|&;>]+)/,\n    )\n    if (pathMatch) {\n      return pathMatch[1] || null\n    }\n  }\n\n  return null\n}\n\n/**\n * Find matching sensitive paths for a given file path and operation\n */\nexport function findMatchingSensitivePaths(\n  filePath: string,\n  operation: 'read' | 'write' | 'delete' | 'execute',\n): SensitivePath[] {\n  return SENSITIVE_PATHS.filter(sp => {\n    // Check if operation is applicable\n    if (sp.operations && !sp.operations.includes(operation)) {\n      return false\n    }\n    return matchesSensitivePath(filePath, sp)\n  })\n}\n\n/**\n * Sensitive Paths Rule\n *\n * Always prompts for sensitive paths, even if other permissions are granted.\n */\nexport const sensitivePathsRule: PermissionRule = {\n  name: 'sensitive-paths',\n  description: 'Protects sensitive paths from unauthorized access',\n  priority: 100, // Highest priority - checked before all other rules\n\n  check(context: PermissionContext): PermissionResult {\n    const toolName = context.tool.name\n    const input = context.input\n\n    // Get operation type\n    const operation = getOperationType(toolName, input)\n    if (!operation) {\n      return { allowed: true }\n    }\n\n    // Extract file path\n    const filePath = extractFilePath(toolName, input)\n    if (!filePath) {\n      return { allowed: true }\n    }\n\n    // Find matching sensitive paths\n    const matches = findMatchingSensitivePaths(filePath, operation)\n    if (matches.length === 0) {\n      return { allowed: true }\n    }\n\n    // Check if any match is always blocked\n    const blocked = matches.find(m => m.alwaysBlock)\n    if (blocked) {\n      return {\n        allowed: false,\n        reason: `Access to ${blocked.description} is blocked for security`,\n        message: `\uD83D\uDD12 Access denied: ${blocked.description} (${blocked.category})`,\n      }\n    }\n\n    // Require explicit user confirmation for sensitive paths\n    const categories = [...new Set(matches.map(m => m.category))]\n    const descriptions = matches.map(m => m.description).join(', ')\n\n    return {\n      allowed: false,\n      promptUser: true,\n      reason: `Sensitive path access requires confirmation`,\n      message: `\u26A0\uFE0F Sensitive ${operation} operation on: ${descriptions}\\nCategories: ${categories.join(', ')}`,\n      permissionKey: `SensitivePath(${operation}:${filePath})`,\n    }\n  },\n}\n\n/**\n * Check if a path is sensitive (utility function for external use)\n */\nexport function isSensitivePath(\n  filePath: string,\n  operation: 'read' | 'write' | 'delete' | 'execute' = 'read',\n): boolean {\n  return findMatchingSensitivePaths(filePath, operation).length > 0\n}\n\n/**\n * Get sensitive path info for a file\n */\nexport function getSensitivePathInfo(filePath: string): SensitivePath | null {\n  for (const sp of SENSITIVE_PATHS) {\n    if (matchesSensitivePath(filePath, sp)) {\n      return sp\n    }\n  }\n  return null\n}\n"],
+  "mappings": "AAaA,SAAS,SAAS,iBAAiB;AACnC,SAAS,eAAe;AAiCjB,MAAM,kBAAmC;AAAA;AAAA,EAE9C;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,SAAS,QAAQ;AAAA,EAChC;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,SAAS,QAAQ;AAAA,EAChC;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ;AAAA;AAAA,EACvB;AACF;AAKA,SAAS,WAAW,SAAyB;AAC3C,QAAM,OAAO,QAAQ;AACrB,MAAI,WAAW,QAAQ,QAAQ,MAAM,IAAI;AACzC,SAAO,UAAU,QAAQ;AAC3B;AAKA,SAAS,eAAe,SAAyB;AAC/C,QAAM,WAAW,WAAW,OAAO;AAEnC,MAAI,QAAQ,SACT,QAAQ,sBAAsB,MAAM,EACpC,QAAQ,SAAS,kBAAkB,EACnC,QAAQ,OAAO,OAAO,EACtB,QAAQ,qBAAqB,IAAI;AAEpC,SAAO,IAAI,OAAO,IAAI,KAAK,KAAK,GAAG;AACrC;AAKO,SAAS,qBACd,UACA,eACS;AACT,QAAM,iBAAiB,UAAU,QAAQ,QAAQ,CAAC;AAClD,QAAM,QAAQ,eAAe,cAAc,OAAO;AAClD,SAAO,MAAM,KAAK,cAAc;AAClC;AAKA,SAAS,iBACP,UACA,OACgD;AAChD,UAAQ,UAAU;AAAA,IAChB,KAAK;AAAA;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK,QAAQ;AACX,YAAM,UAAW,MAAM,WAAsB;AAE7C,UAAI,4BAA4B,KAAK,OAAO,GAAG;AAC7C,eAAO;AAAA,MACT;AAEA,UAAI,mDAAmD,KAAK,OAAO,GAAG;AACpE,eAAO;AAAA,MACT;AAEA,UAAI,6CAA6C,KAAK,OAAO,GAAG;AAC9D,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT;AAAA,IACA;AACE,aAAO;AAAA,EACX;AACF;AAKA,SAAS,gBACP,UACA,OACe;AAEf,MAAI,MAAM,UAAW,QAAO,MAAM;AAClC,MAAI,MAAM,SAAU,QAAO,MAAM;AACjC,MAAI,MAAM,KAAM,QAAO,MAAM;AAG7B,MAAI,aAAa,QAAQ;AACvB,UAAM,UAAW,MAAM,WAAsB;AAE7C,UAAM,YAAY,QAAQ;AAAA,MACxB;AAAA,IACF;AACA,QAAI,WAAW;AACb,aAAO,UAAU,CAAC,KAAK;AAAA,IACzB;AAAA,EACF;AAEA,SAAO;AACT;AAKO,SAAS,2BACd,UACA,WACiB;AACjB,SAAO,gBAAgB,OAAO,QAAM;AAElC,QAAI,GAAG,cAAc,CAAC,GAAG,WAAW,SAAS,SAAS,GAAG;AACvD,aAAO;AAAA,IACT;AACA,WAAO,qBAAqB,UAAU,EAAE;AAAA,EAC1C,CAAC;AACH;AAOO,MAAM,qBAAqC;AAAA,EAChD,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU;AAAA;AAAA,EAEV,MAAM,SAA8C;AAClD,UAAM,WAAW,QAAQ,KAAK;AAC9B,UAAM,QAAQ,QAAQ;AAGtB,UAAM,YAAY,iBAAiB,UAAU,KAAK;AAClD,QAAI,CAAC,WAAW;AACd,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,UAAM,WAAW,gBAAgB,UAAU,KAAK;AAChD,QAAI,CAAC,UAAU;AACb,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,UAAM,UAAU,2BAA2B,UAAU,SAAS;AAC9D,QAAI,QAAQ,WAAW,GAAG;AACxB,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,UAAM,UAAU,QAAQ,KAAK,OAAK,EAAE,WAAW;AAC/C,QAAI,SAAS;AACX,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ,aAAa,QAAQ,WAAW;AAAA,QACxC,SAAS,4BAAqB,QAAQ,WAAW,KAAK,QAAQ,QAAQ;AAAA,MACxE;AAAA,IACF;AAGA,UAAM,aAAa,CAAC,GAAG,IAAI,IAAI,QAAQ,IAAI,OAAK,EAAE,QAAQ,CAAC,CAAC;AAC5D,UAAM,eAAe,QAAQ,IAAI,OAAK,EAAE,WAAW,EAAE,KAAK,IAAI;AAE9D,WAAO;AAAA,MACL,SAAS;AAAA,MACT,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,SAAS,0BAAgB,SAAS,kBAAkB,YAAY;AAAA,cAAiB,WAAW,KAAK,IAAI,CAAC;AAAA,MACtG,eAAe,iBAAiB,SAAS,IAAI,QAAQ;AAAA,IACvD;AAAA,EACF;AACF;AAKO,SAAS,gBACd,UACA,YAAqD,QAC5C;AACT,SAAO,2BAA2B,UAAU,SAAS,EAAE,SAAS;AAClE;AAKO,SAAS,qBAAqB,UAAwC;AAC3E,aAAW,MAAM,iBAAiB;AAChC,QAAI,qBAAqB,UAAU,EAAE,GAAG;AACtC,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/core/permissions/types.js

@@ -0,0 +1,127 @@
+const DEFAULT_PERMISSION_RULES = [
+  // Deny dangerous operations
+  {
+    id: "deny-rm-rf",
+    pattern: "Bash(rm -rf*)",
+    decision: "deny",
+    scope: "global",
+    priority: 1,
+    description: "Block recursive force delete"
+  },
+  {
+    id: "deny-rm-force",
+    pattern: "Bash(rm -f*)",
+    decision: "deny",
+    scope: "global",
+    priority: 1,
+    description: "Block force delete"
+  },
+  {
+    id: "deny-env-files",
+    pattern: "Read(.env*)",
+    decision: "deny",
+    scope: "global",
+    priority: 1,
+    description: "Block reading .env files"
+  },
+  {
+    id: "deny-ssh-keys",
+    pattern: "Read(*.ssh*)",
+    decision: "deny",
+    scope: "global",
+    priority: 1,
+    description: "Block reading SSH keys"
+  },
+  {
+    id: "deny-credentials",
+    pattern: "Read(*credentials*)",
+    decision: "deny",
+    scope: "global",
+    priority: 1,
+    description: "Block reading credential files"
+  },
+  // Allow safe operations
+  {
+    id: "allow-git-status",
+    pattern: "Bash(git status*)",
+    decision: "allow",
+    scope: "global",
+    priority: 10,
+    description: "Allow git status"
+  },
+  {
+    id: "allow-git-diff",
+    pattern: "Bash(git diff*)",
+    decision: "allow",
+    scope: "global",
+    priority: 10,
+    description: "Allow git diff"
+  },
+  {
+    id: "allow-git-log",
+    pattern: "Bash(git log*)",
+    decision: "allow",
+    scope: "global",
+    priority: 10,
+    description: "Allow git log"
+  },
+  {
+    id: "allow-git-branch",
+    pattern: "Bash(git branch*)",
+    decision: "allow",
+    scope: "global",
+    priority: 10,
+    description: "Allow git branch"
+  },
+  {
+    id: "allow-ls",
+    pattern: "Bash(ls *)",
+    decision: "allow",
+    scope: "global",
+    priority: 10,
+    description: "Allow ls command"
+  },
+  {
+    id: "allow-npm-install",
+    pattern: "Bash(npm install*)",
+    decision: "allow",
+    scope: "global",
+    priority: 10,
+    description: "Allow npm install"
+  },
+  {
+    id: "allow-bun-install",
+    pattern: "Bash(bun install*)",
+    decision: "allow",
+    scope: "global",
+    priority: 10,
+    description: "Allow bun install"
+  },
+  // Ask for potentially dangerous operations
+  {
+    id: "ask-git-push",
+    pattern: "Bash(git push*)",
+    decision: "ask",
+    scope: "global",
+    priority: 20,
+    description: "Ask before git push"
+  },
+  {
+    id: "ask-git-commit",
+    pattern: "Bash(git commit*)",
+    decision: "ask",
+    scope: "global",
+    priority: 20,
+    description: "Ask before git commit"
+  }
+];
+const DEFAULT_PERMISSION_CONFIG = {
+  rules: DEFAULT_PERMISSION_RULES,
+  defaultDecision: "ask",
+  debug: false
+};
+export {
+  DEFAULT_PERMISSION_CONFIG,
+  DEFAULT_PERMISSION_RULES
+};
+//# sourceMappingURL=types.js.map

package/dist/core/permissions/types.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/core/permissions/types.ts"],
+  "sourcesContent": ["/**\n * Permission Rule Engine Types\n *\n * Defines the types for the enhanced permission rules system with\n * pattern matching and rule priorities.\n */\n\n/**\n * Decision type for permission rules\n */\nexport type PermissionDecision = 'allow' | 'deny' | 'ask'\n\n/**\n * Scope for permission rules\n */\nexport type PermissionScope = 'global' | 'project'\n\n/**\n * Permission rule definition\n */\nexport interface PermissionRule {\n  /** Unique identifier for the rule */\n  id: string\n  /** Pattern to match tool use, supports wildcards */\n  pattern: string\n  /** Decision when pattern matches */\n  decision: PermissionDecision\n  /** Scope of the rule */\n  scope: PermissionScope\n  /** Priority (lower number = higher priority) */\n  priority: number\n  /** Optional description */\n  description?: string\n  /** When the rule was created */\n  createdAt?: number\n  /** Optional expiration timestamp */\n  expiresAt?: number\n}\n\n/**\n * Result of evaluating a permission rule\n */\nexport interface PermissionEvaluationResult {\n  /** The final decision */\n  decision: PermissionDecision\n  /** The rule that matched (null if default) */\n  matchedRule: PermissionRule | null\n  /** Debug info about the evaluation */\n  evaluationPath?: string[]\n}\n\n/**\n * Configuration for the permission rule engine\n */\nexport interface PermissionRulesConfig {\n  /** List of permission rules */\n  rules: PermissionRule[]\n  /** Default decision when no rule matches */\n  defaultDecision: PermissionDecision\n  /** Whether to enable rule evaluation debugging */\n  debug?: boolean\n}\n\n/**\n * Default permission rules configuration\n *\n * Pattern format:\n * - \"ToolName\" - matches any use of the tool\n * - \"ToolName(*)\" - matches any params (explicit)\n * - \"ToolName(exact)\" - matches exact param\n * - \"ToolName(prefix*)\" - matches prefix with any suffix\n *\n * For Bash, the param is the first two words of the command.\n * For Read/Edit, the param is the file path.\n */\nexport const DEFAULT_PERMISSION_RULES: PermissionRule[] = [\n  // Deny dangerous operations\n  {\n    id: 'deny-rm-rf',\n    pattern: 'Bash(rm -rf*)',\n    decision: 'deny',\n    scope: 'global',\n    priority: 1,\n    description: 'Block recursive force delete',\n  },\n  {\n    id: 'deny-rm-force',\n    pattern: 'Bash(rm -f*)',\n    decision: 'deny',\n    scope: 'global',\n    priority: 1,\n    description: 'Block force delete',\n  },\n  {\n    id: 'deny-env-files',\n    pattern: 'Read(.env*)',\n    decision: 'deny',\n    scope: 'global',\n    priority: 1,\n    description: 'Block reading .env files',\n  },\n  {\n    id: 'deny-ssh-keys',\n    pattern: 'Read(*.ssh*)',\n    decision: 'deny',\n    scope: 'global',\n    priority: 1,\n    description: 'Block reading SSH keys',\n  },\n  {\n    id: 'deny-credentials',\n    pattern: 'Read(*credentials*)',\n    decision: 'deny',\n    scope: 'global',\n    priority: 1,\n    description: 'Block reading credential files',\n  },\n  // Allow safe operations\n  {\n    id: 'allow-git-status',\n    pattern: 'Bash(git status*)',\n    decision: 'allow',\n    scope: 'global',\n    priority: 10,\n    description: 'Allow git status',\n  },\n  {\n    id: 'allow-git-diff',\n    pattern: 'Bash(git diff*)',\n    decision: 'allow',\n    scope: 'global',\n    priority: 10,\n    description: 'Allow git diff',\n  },\n  {\n    id: 'allow-git-log',\n    pattern: 'Bash(git log*)',\n    decision: 'allow',\n    scope: 'global',\n    priority: 10,\n    description: 'Allow git log',\n  },\n  {\n    id: 'allow-git-branch',\n    pattern: 'Bash(git branch*)',\n    decision: 'allow',\n    scope: 'global',\n    priority: 10,\n    description: 'Allow git branch',\n  },\n  {\n    id: 'allow-ls',\n    pattern: 'Bash(ls *)',\n    decision: 'allow',\n    scope: 'global',\n    priority: 10,\n    description: 'Allow ls command',\n  },\n  {\n    id: 'allow-npm-install',\n    pattern: 'Bash(npm install*)',\n    decision: 'allow',\n    scope: 'global',\n    priority: 10,\n    description: 'Allow npm install',\n  },\n  {\n    id: 'allow-bun-install',\n    pattern: 'Bash(bun install*)',\n    decision: 'allow',\n    scope: 'global',\n    priority: 10,\n    description: 'Allow bun install',\n  },\n  // Ask for potentially dangerous operations\n  {\n    id: 'ask-git-push',\n    pattern: 'Bash(git push*)',\n    decision: 'ask',\n    scope: 'global',\n    priority: 20,\n    description: 'Ask before git push',\n  },\n  {\n    id: 'ask-git-commit',\n    pattern: 'Bash(git commit*)',\n    decision: 'ask',\n    scope: 'global',\n    priority: 20,\n    description: 'Ask before git commit',\n  },\n]\n\n/**\n * Default permission configuration\n */\nexport const DEFAULT_PERMISSION_CONFIG: PermissionRulesConfig = {\n  rules: DEFAULT_PERMISSION_RULES,\n  defaultDecision: 'ask',\n  debug: false,\n}\n"],
+  "mappings": "AA2EO,MAAM,2BAA6C;AAAA;AAAA,EAExD;AAAA,IACE,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,UAAU;AAAA,IACV,OAAO;AAAA,IACP,UAAU;AAAA,IACV,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,UAAU;AAAA,IACV,OAAO;AAAA,IACP,UAAU;AAAA,IACV,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,UAAU;AAAA,IACV,OAAO;AAAA,IACP,UAAU;AAAA,IACV,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,UAAU;AAAA,IACV,OAAO;AAAA,IACP,UAAU;AAAA,IACV,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,UAAU;AAAA,IACV,OAAO;AAAA,IACP,UAAU;AAAA,IACV,aAAa;AAAA,EACf;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,UAAU;AAAA,IACV,OAAO;AAAA,IACP,UAAU;AAAA,IACV,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,UAAU;AAAA,IACV,OAAO;AAAA,IACP,UAAU;AAAA,IACV,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,UAAU;AAAA,IACV,OAAO;AAAA,IACP,UAAU;AAAA,IACV,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,UAAU;AAAA,IACV,OAAO;AAAA,IACP,UAAU;AAAA,IACV,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,UAAU;AAAA,IACV,OAAO;AAAA,IACP,UAAU;AAAA,IACV,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,UAAU;AAAA,IACV,OAAO;AAAA,IACP,UAAU;AAAA,IACV,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,UAAU;AAAA,IACV,OAAO;AAAA,IACP,UAAU;AAAA,IACV,aAAa;AAAA,EACf;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,UAAU;AAAA,IACV,OAAO;AAAA,IACP,UAAU;AAAA,IACV,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,UAAU;AAAA,IACV,OAAO;AAAA,IACP,UAAU;AAAA,IACV,aAAa;AAAA,EACf;AACF;AAKO,MAAM,4BAAmD;AAAA,EAC9D,OAAO;AAAA,EACP,iBAAiB;AAAA,EACjB,OAAO;AACT;",
+  "names": []
+}

package/dist/core/tokenStats.js

@@ -0,0 +1,9 @@
+const DEFAULT_ESTIMATION_CONFIG = {
+  charsPerToken: 4,
+  defaultInputCostPerMillion: 3,
+  defaultOutputCostPerMillion: 15
+};
+export {
+  DEFAULT_ESTIMATION_CONFIG
+};
+//# sourceMappingURL=tokenStats.js.map

package/dist/core/tokenStats.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/core/tokenStats.ts"],
+  "sourcesContent": ["/**\n * Token Statistics Types\n *\n * Unified type definitions for token tracking across the application.\n * These types are used by TokenStatsManager to provide consistent\n * token statistics at global, agent, and request levels.\n */\n\n/**\n * Token usage statistics from a single API call\n */\nexport interface TokenUsageRecord {\n  /** Input tokens (prompt) */\n  inputTokens: number\n  /** Output tokens (completion) */\n  outputTokens: number\n  /** Cache creation tokens (Anthropic-specific) */\n  cacheCreationTokens: number\n  /** Cache read tokens (Anthropic-specific) */\n  cacheReadTokens: number\n  /** Total tokens (computed: input + output) */\n  totalTokens: number\n  /** Estimated cost in USD */\n  estimatedCostUSD: number\n  /** Data source: 'api' for actual values, 'estimated' for calculated */\n  source: 'api' | 'estimated'\n  /** Timestamp when this record was created */\n  timestamp: number\n  /** Model used for this request */\n  model: string\n}\n\n/**\n * Aggregated token statistics for a scope (global or per-agent)\n */\nexport interface AggregatedTokenStats {\n  /** Total input tokens across all requests */\n  totalInputTokens: number\n  /** Total output tokens across all requests */\n  totalOutputTokens: number\n  /** Total cache creation tokens */\n  totalCacheCreationTokens: number\n  /** Total cache read tokens */\n  totalCacheReadTokens: number\n  /** Grand total tokens (input + output) */\n  grandTotalTokens: number\n  /** Total estimated cost in USD */\n  totalCostUSD: number\n  /** Number of API requests */\n  requestCount: number\n  /** First request timestamp */\n  firstRequestTime?: number\n  /** Last request timestamp */\n  lastRequestTime?: number\n  /** Breakdown by model */\n  byModel: Map<string, ModelTokenStats>\n}\n\n/**\n * Per-model token statistics\n */\nexport interface ModelTokenStats {\n  /** Model name */\n  model: string\n  /** Input tokens for this model */\n  inputTokens: number\n  /** Output tokens for this model */\n  outputTokens: number\n  /** Total tokens for this model */\n  totalTokens: number\n  /** Estimated cost for this model */\n  estimatedCostUSD: number\n  /** Number of requests to this model */\n  requestCount: number\n}\n\n/**\n * Scope identifier for hierarchical statistics\n */\nexport type TokenStatsScope =\n  | { type: 'global' }\n  | { type: 'agent'; agentId: string }\n  | { type: 'request'; requestId: string }\n\n/**\n * Event emitted when token stats change\n */\nexport interface TokenStatsEvent {\n  /** Type of change */\n  eventType: 'usage_recorded' | 'scope_created' | 'scope_completed'\n  /** Scope that changed */\n  scope: TokenStatsScope\n  /** The usage record (for usage_recorded events) */\n  usage?: TokenUsageRecord\n  /** Current aggregated stats for the scope */\n  aggregated: AggregatedTokenStats\n  /** Global aggregated stats (always included for convenience) */\n  globalStats: AggregatedTokenStats\n}\n\n/**\n * Context for token tracking (passed through the API call chain)\n *\n * This is used to associate token usage with specific agents or tool uses,\n * enabling per-agent token tracking.\n */\nexport interface TokenTrackingContext {\n  /** Agent ID if this request is within an agent context */\n  agentId?: string\n  /** Tool use ID if this request is triggered by a tool */\n  toolUseId?: string\n  /** Model being used for this request */\n  model: string\n}\n\n/**\n * Raw token usage from API response (before processing)\n */\nexport interface RawTokenUsage {\n  /** Input tokens from API */\n  inputTokens: number\n  /** Output tokens from API */\n  outputTokens: number\n  /** Cache creation tokens (optional, Anthropic-specific) */\n  cacheCreationTokens?: number\n  /** Cache read tokens (optional, Anthropic/OpenAI) */\n  cacheReadTokens?: number\n}\n\n/**\n * Configuration for token estimation when API doesn't return usage\n */\nexport interface TokenEstimationConfig {\n  /** Average characters per token (default: 4 for mixed English/Chinese) */\n  charsPerToken: number\n  /** Default input cost per million tokens in USD */\n  defaultInputCostPerMillion: number\n  /** Default output cost per million tokens in USD */\n  defaultOutputCostPerMillion: number\n}\n\n/**\n * Default estimation configuration\n */\nexport const DEFAULT_ESTIMATION_CONFIG: TokenEstimationConfig = {\n  charsPerToken: 4,\n  defaultInputCostPerMillion: 3.0,\n  defaultOutputCostPerMillion: 15.0,\n}\n"],
+  "mappings": "AAgJO,MAAM,4BAAmD;AAAA,EAC9D,eAAe;AAAA,EACf,4BAA4B;AAAA,EAC5B,6BAA6B;AAC/B;",
+  "names": []
+}