@within-7/minto 0.2.0 → 0.3.0

package/dist/core/permissions/rules/autoEscalationRule.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/core/permissions/rules/autoEscalationRule.ts"],
-  "sourcesContent": ["/**\n * Auto-Escalation Rule\n *\n * Automatically escalates permission requirements when detecting\n * high-risk operations, even if safe mode is not explicitly enabled.\n * This provides defense-in-depth by requiring confirmation for\n * particularly dangerous actions regardless of mode.\n */\n\nimport type {\n  PermissionRule,\n  PermissionContext,\n  PermissionResult,\n} from '../engine/types'\nimport { isSensitivePath, getSensitivePathInfo } from './sensitivePathsRule'\nimport {\n  isOutsideProject,\n  calculateExternalOperationRisk,\n} from './projectBoundaryRule'\nimport { logSecurityEvent } from '../auditLog'\n\n/**\n * Escalation trigger reasons\n */\nexport type EscalationReason =\n  | 'sensitive_path' // Accessing sensitive paths\n  | 'critical_external' // Critical external operation\n  | 'dangerous_command' // Known dangerous command pattern\n  | 'bulk_operation' // Bulk file operations\n  | 'privilege_escalation' // Commands that might escalate privileges\n  | 'network_access' // Network-related commands\n\n/**\n * Patterns that should always trigger escalation\n */\nconst ESCALATION_PATTERNS: Array<{\n  pattern: RegExp\n  reason: EscalationReason\n  description: string\n}> = [\n  // Privilege escalation\n  {\n    pattern: /\\bsudo\\s+/,\n    reason: 'privilege_escalation',\n    description: 'sudo command',\n  },\n  {\n    pattern: /\\bsu\\s+(-|\\w)/,\n    reason: 'privilege_escalation',\n    description: 'su command',\n  },\n  {\n    pattern: /\\bchmod\\s+[0-7]*[4-7][0-7]*\\s/,\n    reason: 'privilege_escalation',\n    description: 'chmod with execute permissions',\n  },\n  {\n    pattern: /\\bchown\\s+/,\n    reason: 'privilege_escalation',\n    description: 'chown command',\n  },\n\n  // Dangerous file operations\n  {\n    pattern: /\\brm\\s+(-r|-rf|-fr)\\s+/,\n    reason: 'dangerous_command',\n    description: 'recursive delete',\n  },\n  {\n    pattern: /\\bdd\\s+.*if=/,\n    reason: 'dangerous_command',\n    description: 'dd command',\n  },\n  {\n    pattern: /\\bmkfs\\b/,\n    reason: 'dangerous_command',\n    description: 'filesystem creation',\n  },\n  {\n    pattern: />\\s*\\/dev\\/(sd|hd|nvme)/,\n    reason: 'dangerous_command',\n    description: 'write to disk device',\n  },\n\n  // Network access (potential data exfiltration)\n  {\n    pattern: /\\bcurl\\s+.*(-d|--data|-F|--form)/,\n    reason: 'network_access',\n    description: 'curl with data upload',\n  },\n  {\n    pattern: /\\bwget\\s+--post/,\n    reason: 'network_access',\n    description: 'wget with POST',\n  },\n  {\n    pattern: /\\bnc\\s+/,\n    reason: 'network_access',\n    description: 'netcat',\n  },\n  {\n    pattern: /\\bssh\\s+/,\n    reason: 'network_access',\n    description: 'SSH connection',\n  },\n  {\n    pattern: /\\bscp\\s+/,\n    reason: 'network_access',\n    description: 'SCP file transfer',\n  },\n  {\n    pattern: /\\brsync\\s+.*:/,\n    reason: 'network_access',\n    description: 'rsync to remote',\n  },\n\n  // Bulk operations\n  {\n    pattern: /\\bfind\\s+.*-exec.*\\brm\\b/,\n    reason: 'bulk_operation',\n    description: 'find with delete',\n  },\n  {\n    pattern: /\\bxargs\\s+.*\\brm\\b/,\n    reason: 'bulk_operation',\n    description: 'xargs with delete',\n  },\n\n  // Shell/script execution (potential for hidden actions)\n  {\n    pattern: /\\beval\\s+/,\n    reason: 'dangerous_command',\n    description: 'eval command',\n  },\n  {\n    pattern: /\\bsource\\s+/,\n    reason: 'dangerous_command',\n    description: 'source command',\n  },\n  {\n    pattern: /\\.\\s+\\//,\n    reason: 'dangerous_command',\n    description: 'dot source',\n  },\n]\n\n/**\n * Check if a command matches any escalation pattern\n */\nfunction matchesEscalationPattern(\n  command: string,\n): { reason: EscalationReason; description: string } | null {\n  for (const { pattern, reason, description } of ESCALATION_PATTERNS) {\n    if (pattern.test(command)) {\n      return { reason, description }\n    }\n  }\n  return null\n}\n\n/**\n * Get operation type from tool\n */\nfunction getOperationType(\n  toolName: string,\n  input: Record<string, unknown>,\n): 'read' | 'write' | 'delete' | 'execute' | null {\n  switch (toolName) {\n    case 'Read':\n    case 'FileRead':\n    case 'Glob':\n    case 'Grep':\n      return 'read'\n    case 'Write':\n    case 'FileWrite':\n    case 'Edit':\n    case 'FileEdit':\n    case 'MultiEdit':\n    case 'NotebookEdit':\n      return 'write'\n    case 'Bash': {\n      const command = (input.command as string) || ''\n      if (/\\b(rm|del|rmdir|unlink)\\b/.test(command)) {\n        return 'delete'\n      }\n      return 'execute'\n    }\n    default:\n      return null\n  }\n}\n\n/**\n * Extract file path from input\n */\nfunction extractFilePath(input: Record<string, unknown>): string | null {\n  if (input.file_path) return input.file_path as string\n  if (input.filePath) return input.filePath as string\n  if (input.path) return input.path as string\n  return null\n}\n\n/**\n * Escalation messages by reason\n */\nconst ESCALATION_MESSAGES: Record<EscalationReason, string> = {\n  sensitive_path: '\uD83D\uDD10 This operation accesses sensitive files',\n  critical_external: '\uD83D\uDEA8 This operation affects files far outside your project',\n  dangerous_command: '\u26A0\uFE0F This command is potentially destructive',\n  bulk_operation: '\uD83D\uDCE6 This operation affects multiple files',\n  privilege_escalation: '\uD83D\uDD11 This command may escalate system privileges',\n  network_access: '\uD83C\uDF10 This command accesses the network',\n}\n\n/**\n * Auto-Escalation Rule\n *\n * Requires confirmation for high-risk operations even without safe mode.\n */\nexport const autoEscalationRule: PermissionRule = {\n  name: 'auto-escalation',\n  description: 'Requires confirmation for high-risk operations',\n  priority: 85, // Below sensitive-paths and project-boundary, but above safe-mode\n\n  check(context: PermissionContext): PermissionResult {\n    const toolName = context.tool.name\n    const input = context.input\n\n    // For Bash commands, check escalation patterns\n    if (toolName === 'Bash') {\n      const command = (input.command as string) || ''\n      const match = matchesEscalationPattern(command)\n\n      if (match) {\n        // Log the escalation trigger\n        logSecurityEvent({\n          eventType: 'security_warning',\n          toolName,\n          operation: 'execute',\n          target: command,\n          outcome: 'denied', // Will be 'allowed' if user approves\n          riskLevel: 'high',\n          context: {\n            escalationReason: match.reason,\n            escalationDescription: match.description,\n          },\n          triggeredRule: 'auto-escalation',\n        })\n\n        return {\n          allowed: false,\n          promptUser: true,\n          reason: `High-risk operation: ${match.description}`,\n          message: `${ESCALATION_MESSAGES[match.reason]}\\n\\nCommand: ${command.length > 100 ? command.substring(0, 100) + '...' : command}\\n\\nReason: ${match.description}`,\n          permissionKey: `AutoEscalate(${match.reason}:${command.substring(0, 50)})`,\n        }\n      }\n    }\n\n    // Check file operations for sensitive paths\n    const operation = getOperationType(toolName, input)\n    if (operation && operation !== 'read') {\n      const filePath = extractFilePath(input)\n\n      if (filePath) {\n        // Check if it's a sensitive path\n        if (isSensitivePath(filePath, operation)) {\n          const info = getSensitivePathInfo(filePath)\n\n          logSecurityEvent({\n            eventType: 'sensitive_path_access',\n            toolName,\n            operation,\n            target: filePath,\n            outcome: 'denied',\n            riskLevel: 'high',\n            context: {\n              category: info?.category,\n              description: info?.description,\n            },\n            triggeredRule: 'auto-escalation',\n          })\n\n          return {\n            allowed: false,\n            promptUser: true,\n            reason: `Sensitive path: ${info?.description || 'unknown'}`,\n            message: `${ESCALATION_MESSAGES.sensitive_path}\\n\\nPath: ${filePath}\\nCategory: ${info?.category || 'unknown'}`,\n            permissionKey: `AutoEscalate(sensitive:${filePath})`,\n          }\n        }\n\n        // Check if it's a critical external operation\n        if (isOutsideProject(filePath)) {\n          const risk = calculateExternalOperationRisk(operation, filePath)\n\n          if (risk === 'critical' || risk === 'high') {\n            logSecurityEvent({\n              eventType: 'external_operation',\n              toolName,\n              operation,\n              target: filePath,\n              outcome: 'denied',\n              riskLevel: risk,\n              triggeredRule: 'auto-escalation',\n            })\n\n            return {\n              allowed: false,\n              promptUser: true,\n              reason: `${risk} risk external operation`,\n              message: `${ESCALATION_MESSAGES.critical_external}\\n\\nPath: ${filePath}\\nRisk Level: ${risk.toUpperCase()}`,\n              permissionKey: `AutoEscalate(external:${filePath})`,\n            }\n          }\n        }\n      }\n    }\n\n    return { allowed: true }\n  },\n}\n\n/**\n * Check if an operation should trigger auto-escalation\n */\nexport function shouldAutoEscalate(\n  toolName: string,\n  input: Record<string, unknown>,\n): {\n  shouldEscalate: boolean\n  reason?: EscalationReason\n  description?: string\n} {\n  // Check command patterns\n  if (toolName === 'Bash') {\n    const command = (input.command as string) || ''\n    const match = matchesEscalationPattern(command)\n    if (match) {\n      return { shouldEscalate: true, ...match }\n    }\n  }\n\n  // Check file paths\n  const filePath = extractFilePath(input)\n  if (filePath) {\n    const operation = getOperationType(toolName, input)\n\n    if (operation && operation !== 'read') {\n      if (isSensitivePath(filePath, operation)) {\n        return {\n          shouldEscalate: true,\n          reason: 'sensitive_path',\n          description: 'Sensitive file access',\n        }\n      }\n\n      if (isOutsideProject(filePath)) {\n        const risk = calculateExternalOperationRisk(operation, filePath)\n        if (risk === 'critical' || risk === 'high') {\n          return {\n            shouldEscalate: true,\n            reason: 'critical_external',\n            description: `${risk} risk external operation`,\n          }\n        }\n      }\n    }\n  }\n\n  return { shouldEscalate: false }\n}\n"],
-  "mappings": "AAcA,SAAS,iBAAiB,4BAA4B;AACtD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,wBAAwB;AAgBjC,MAAM,sBAID;AAAA;AAAA,EAEH;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AACF;AAKA,SAAS,yBACP,SAC0D;AAC1D,aAAW,EAAE,SAAS,QAAQ,YAAY,KAAK,qBAAqB;AAClE,QAAI,QAAQ,KAAK,OAAO,GAAG;AACzB,aAAO,EAAE,QAAQ,YAAY;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;AAKA,SAAS,iBACP,UACA,OACgD;AAChD,UAAQ,UAAU;AAAA,IAChB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK,QAAQ;AACX,YAAM,UAAW,MAAM,WAAsB;AAC7C,UAAI,4BAA4B,KAAK,OAAO,GAAG;AAC7C,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT;AAAA,IACA;AACE,aAAO;AAAA,EACX;AACF;AAKA,SAAS,gBAAgB,OAA+C;AACtE,MAAI,MAAM,UAAW,QAAO,MAAM;AAClC,MAAI,MAAM,SAAU,QAAO,MAAM;AACjC,MAAI,MAAM,KAAM,QAAO,MAAM;AAC7B,SAAO;AACT;AAKA,MAAM,sBAAwD;AAAA,EAC5D,gBAAgB;AAAA,EAChB,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,gBAAgB;AAClB;AAOO,MAAM,qBAAqC;AAAA,EAChD,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU;AAAA;AAAA,EAEV,MAAM,SAA8C;AAClD,UAAM,WAAW,QAAQ,KAAK;AAC9B,UAAM,QAAQ,QAAQ;AAGtB,QAAI,aAAa,QAAQ;AACvB,YAAM,UAAW,MAAM,WAAsB;AAC7C,YAAM,QAAQ,yBAAyB,OAAO;AAE9C,UAAI,OAAO;AAET,yBAAiB;AAAA,UACf,WAAW;AAAA,UACX;AAAA,UACA,WAAW;AAAA,UACX,QAAQ;AAAA,UACR,SAAS;AAAA;AAAA,UACT,WAAW;AAAA,UACX,SAAS;AAAA,YACP,kBAAkB,MAAM;AAAA,YACxB,uBAAuB,MAAM;AAAA,UAC/B;AAAA,UACA,eAAe;AAAA,QACjB,CAAC;AAED,eAAO;AAAA,UACL,SAAS;AAAA,UACT,YAAY;AAAA,UACZ,QAAQ,wBAAwB,MAAM,WAAW;AAAA,UACjD,SAAS,GAAG,oBAAoB,MAAM,MAAM,CAAC;AAAA;AAAA,WAAgB,QAAQ,SAAS,MAAM,QAAQ,UAAU,GAAG,GAAG,IAAI,QAAQ,OAAO;AAAA;AAAA,UAAe,MAAM,WAAW;AAAA,UAC/J,eAAe,gBAAgB,MAAM,MAAM,IAAI,QAAQ,UAAU,GAAG,EAAE,CAAC;AAAA,QACzE;AAAA,MACF;AAAA,IACF;AAGA,UAAM,YAAY,iBAAiB,UAAU,KAAK;AAClD,QAAI,aAAa,cAAc,QAAQ;AACrC,YAAM,WAAW,gBAAgB,KAAK;AAEtC,UAAI,UAAU;AAEZ,YAAI,gBAAgB,UAAU,SAAS,GAAG;AACxC,gBAAM,OAAO,qBAAqB,QAAQ;AAE1C,2BAAiB;AAAA,YACf,WAAW;AAAA,YACX;AAAA,YACA;AAAA,YACA,QAAQ;AAAA,YACR,SAAS;AAAA,YACT,WAAW;AAAA,YACX,SAAS;AAAA,cACP,UAAU,MAAM;AAAA,cAChB,aAAa,MAAM;AAAA,YACrB;AAAA,YACA,eAAe;AAAA,UACjB,CAAC;AAED,iBAAO;AAAA,YACL,SAAS;AAAA,YACT,YAAY;AAAA,YACZ,QAAQ,mBAAmB,MAAM,eAAe,SAAS;AAAA,YACzD,SAAS,GAAG,oBAAoB,cAAc;AAAA;AAAA,QAAa,QAAQ;AAAA,YAAe,MAAM,YAAY,SAAS;AAAA,YAC7G,eAAe,0BAA0B,QAAQ;AAAA,UACnD;AAAA,QACF;AAGA,YAAI,iBAAiB,QAAQ,GAAG;AAC9B,gBAAM,OAAO,+BAA+B,WAAW,QAAQ;AAE/D,cAAI,SAAS,cAAc,SAAS,QAAQ;AAC1C,6BAAiB;AAAA,cACf,WAAW;AAAA,cACX;AAAA,cACA;AAAA,cACA,QAAQ;AAAA,cACR,SAAS;AAAA,cACT,WAAW;AAAA,cACX,eAAe;AAAA,YACjB,CAAC;AAED,mBAAO;AAAA,cACL,SAAS;AAAA,cACT,YAAY;AAAA,cACZ,QAAQ,GAAG,IAAI;AAAA,cACf,SAAS,GAAG,oBAAoB,iBAAiB;AAAA;AAAA,QAAa,QAAQ;AAAA,cAAiB,KAAK,YAAY,CAAC;AAAA,cACzG,eAAe,yBAAyB,QAAQ;AAAA,YAClD;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACF;AAKO,SAAS,mBACd,UACA,OAKA;AAEA,MAAI,aAAa,QAAQ;AACvB,UAAM,UAAW,MAAM,WAAsB;AAC7C,UAAM,QAAQ,yBAAyB,OAAO;AAC9C,QAAI,OAAO;AACT,aAAO,EAAE,gBAAgB,MAAM,GAAG,MAAM;AAAA,IAC1C;AAAA,EACF;AAGA,QAAM,WAAW,gBAAgB,KAAK;AACtC,MAAI,UAAU;AACZ,UAAM,YAAY,iBAAiB,UAAU,KAAK;AAElD,QAAI,aAAa,cAAc,QAAQ;AACrC,UAAI,gBAAgB,UAAU,SAAS,GAAG;AACxC,eAAO;AAAA,UACL,gBAAgB;AAAA,UAChB,QAAQ;AAAA,UACR,aAAa;AAAA,QACf;AAAA,MACF;AAEA,UAAI,iBAAiB,QAAQ,GAAG;AAC9B,cAAM,OAAO,+BAA+B,WAAW,QAAQ;AAC/D,YAAI,SAAS,cAAc,SAAS,QAAQ;AAC1C,iBAAO;AAAA,YACL,gBAAgB;AAAA,YAChB,QAAQ;AAAA,YACR,aAAa,GAAG,IAAI;AAAA,UACtB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,gBAAgB,MAAM;AACjC;",
+  "sourcesContent": ["/**\n * Auto-Escalation Rule\n *\n * Automatically escalates permission requirements when detecting\n * high-risk operations, even if safe mode is not explicitly enabled.\n * This provides defense-in-depth by requiring confirmation for\n * particularly dangerous actions regardless of mode.\n */\n\nimport type {\n  PermissionRule,\n  PermissionContext,\n  PermissionResult,\n} from '../engine/types'\nimport { isSensitivePath, getSensitivePathInfo } from './sensitivePathsRule'\nimport {\n  isOutsideProject,\n  calculateExternalOperationRisk,\n} from './projectBoundaryRule'\nimport { logSecurityEvent } from '../auditLog'\n\n/**\n * Escalation trigger reasons\n */\nexport type EscalationReason =\n  | 'sensitive_path' // Accessing sensitive paths\n  | 'critical_external' // Critical external operation\n  | 'dangerous_command' // Known dangerous command pattern\n  | 'bulk_operation' // Bulk file operations\n  | 'privilege_escalation' // Commands that might escalate privileges\n  | 'network_access' // Network-related commands\n\n/**\n * Patterns that should always trigger escalation\n */\nconst ESCALATION_PATTERNS: Array<{\n  pattern: RegExp\n  reason: EscalationReason\n  description: string\n}> = [\n  // Privilege escalation\n  {\n    pattern: /\\bsudo\\s+/,\n    reason: 'privilege_escalation',\n    description: 'sudo command',\n  },\n  {\n    pattern: /\\bsu\\s+(-|\\w)/,\n    reason: 'privilege_escalation',\n    description: 'su command',\n  },\n  {\n    pattern: /\\bchmod\\s+[0-7]*[4-7][0-7]*\\s/,\n    reason: 'privilege_escalation',\n    description: 'chmod with execute permissions',\n  },\n  {\n    pattern: /\\bchown\\s+/,\n    reason: 'privilege_escalation',\n    description: 'chown command',\n  },\n\n  // Dangerous file operations\n  {\n    pattern: /\\brm\\s+(-r|-rf|-fr)\\s+/,\n    reason: 'dangerous_command',\n    description: 'recursive delete',\n  },\n  {\n    pattern: /\\bdd\\s+.*if=/,\n    reason: 'dangerous_command',\n    description: 'dd command',\n  },\n  {\n    pattern: /\\bmkfs\\b/,\n    reason: 'dangerous_command',\n    description: 'filesystem creation',\n  },\n  {\n    pattern: />\\s*\\/dev\\/(sd|hd|nvme)/,\n    reason: 'dangerous_command',\n    description: 'write to disk device',\n  },\n\n  // Network access (potential data exfiltration)\n  {\n    pattern: /\\bcurl\\s+.*(-d|--data|-F|--form)/,\n    reason: 'network_access',\n    description: 'curl with data upload',\n  },\n  {\n    pattern: /\\bwget\\s+--post/,\n    reason: 'network_access',\n    description: 'wget with POST',\n  },\n  {\n    pattern: /\\bnc\\s+/,\n    reason: 'network_access',\n    description: 'netcat',\n  },\n  {\n    pattern: /\\bssh\\s+/,\n    reason: 'network_access',\n    description: 'SSH connection',\n  },\n  {\n    pattern: /\\bscp\\s+/,\n    reason: 'network_access',\n    description: 'SCP file transfer',\n  },\n  {\n    pattern: /\\brsync\\s+.*:/,\n    reason: 'network_access',\n    description: 'rsync to remote',\n  },\n\n  // Bulk operations\n  {\n    pattern: /\\bfind\\s+.*-exec.*\\brm\\b/,\n    reason: 'bulk_operation',\n    description: 'find with delete',\n  },\n  {\n    pattern: /\\bxargs\\s+.*\\brm\\b/,\n    reason: 'bulk_operation',\n    description: 'xargs with delete',\n  },\n\n  // Shell/script execution (potential for hidden actions)\n  {\n    pattern: /\\beval\\s+/,\n    reason: 'dangerous_command',\n    description: 'eval command',\n  },\n  {\n    pattern: /\\bsource\\s+/,\n    reason: 'dangerous_command',\n    description: 'source command',\n  },\n  {\n    pattern: /\\.\\s+\\//,\n    reason: 'dangerous_command',\n    description: 'dot source',\n  },\n]\n\n/**\n * Check if a command matches any escalation pattern\n */\nfunction matchesEscalationPattern(\n  command: string,\n): { reason: EscalationReason; description: string } | null {\n  for (const { pattern, reason, description } of ESCALATION_PATTERNS) {\n    if (pattern.test(command)) {\n      return { reason, description }\n    }\n  }\n  return null\n}\n\n/**\n * Get operation type from tool\n */\nfunction getOperationType(\n  toolName: string,\n  input: Record<string, unknown>,\n): 'read' | 'write' | 'delete' | 'execute' | null {\n  switch (toolName) {\n    case 'View': // Actual API name for FileReadTool\n    case 'Read':\n    case 'FileRead':\n    case 'Glob':\n    case 'Grep':\n      return 'read'\n    case 'Replace': // Actual API name for FileWriteTool\n    case 'Write':\n    case 'FileWrite':\n    case 'Edit':\n    case 'FileEdit':\n    case 'MultiEdit':\n    case 'NotebookEdit':\n    case 'NotebookEditCell': // Actual API name for NotebookEditTool\n      return 'write'\n    case 'Bash': {\n      const command = (input.command as string) || ''\n      if (/\\b(rm|del|rmdir|unlink)\\b/.test(command)) {\n        return 'delete'\n      }\n      return 'execute'\n    }\n    default:\n      return null\n  }\n}\n\n/**\n * Extract file path from input\n */\nfunction extractFilePath(input: Record<string, unknown>): string | null {\n  if (input.file_path) return input.file_path as string\n  if (input.filePath) return input.filePath as string\n  if (input.path) return input.path as string\n  return null\n}\n\n/**\n * Escalation messages by reason\n */\nconst ESCALATION_MESSAGES: Record<EscalationReason, string> = {\n  sensitive_path: '\uD83D\uDD10 This operation accesses sensitive files',\n  critical_external: '\uD83D\uDEA8 This operation affects files far outside your project',\n  dangerous_command: '\u26A0\uFE0F This command is potentially destructive',\n  bulk_operation: '\uD83D\uDCE6 This operation affects multiple files',\n  privilege_escalation: '\uD83D\uDD11 This command may escalate system privileges',\n  network_access: '\uD83C\uDF10 This command accesses the network',\n}\n\n/**\n * Auto-Escalation Rule\n *\n * Requires confirmation for high-risk operations even without safe mode.\n */\nexport const autoEscalationRule: PermissionRule = {\n  name: 'auto-escalation',\n  description: 'Requires confirmation for high-risk operations',\n  priority: 85, // Below sensitive-paths and project-boundary, but above safe-mode\n\n  check(context: PermissionContext): PermissionResult {\n    const toolName = context.tool.name\n    const input = context.input\n\n    // For Bash commands, check escalation patterns\n    if (toolName === 'Bash') {\n      const command = (input.command as string) || ''\n      const match = matchesEscalationPattern(command)\n\n      if (match) {\n        // Log the escalation trigger\n        logSecurityEvent({\n          eventType: 'security_warning',\n          toolName,\n          operation: 'execute',\n          target: command,\n          outcome: 'denied', // Will be 'allowed' if user approves\n          riskLevel: 'high',\n          context: {\n            escalationReason: match.reason,\n            escalationDescription: match.description,\n          },\n          triggeredRule: 'auto-escalation',\n        })\n\n        return {\n          allowed: false,\n          promptUser: true,\n          reason: `High-risk operation: ${match.description}`,\n          message: `${ESCALATION_MESSAGES[match.reason]}\\n\\nCommand: ${command.length > 100 ? command.substring(0, 100) + '...' : command}\\n\\nReason: ${match.description}`,\n          permissionKey: `AutoEscalate(${match.reason}:${command.substring(0, 50)})`,\n        }\n      }\n    }\n\n    // Check file operations for sensitive paths\n    const operation = getOperationType(toolName, input)\n    if (operation && operation !== 'read') {\n      const filePath = extractFilePath(input)\n\n      if (filePath) {\n        // Check if it's a sensitive path\n        if (isSensitivePath(filePath, operation)) {\n          const info = getSensitivePathInfo(filePath)\n\n          logSecurityEvent({\n            eventType: 'sensitive_path_access',\n            toolName,\n            operation,\n            target: filePath,\n            outcome: 'denied',\n            riskLevel: 'high',\n            context: {\n              category: info?.category,\n              description: info?.description,\n            },\n            triggeredRule: 'auto-escalation',\n          })\n\n          return {\n            allowed: false,\n            promptUser: true,\n            reason: `Sensitive path: ${info?.description || 'unknown'}`,\n            message: `${ESCALATION_MESSAGES.sensitive_path}\\n\\nPath: ${filePath}\\nCategory: ${info?.category || 'unknown'}`,\n            permissionKey: `AutoEscalate(sensitive:${filePath})`,\n          }\n        }\n\n        // Check if it's a critical external operation\n        if (isOutsideProject(filePath)) {\n          const risk = calculateExternalOperationRisk(operation, filePath)\n\n          if (risk === 'critical' || risk === 'high') {\n            logSecurityEvent({\n              eventType: 'external_operation',\n              toolName,\n              operation,\n              target: filePath,\n              outcome: 'denied',\n              riskLevel: risk,\n              triggeredRule: 'auto-escalation',\n            })\n\n            return {\n              allowed: false,\n              promptUser: true,\n              reason: `${risk} risk external operation`,\n              message: `${ESCALATION_MESSAGES.critical_external}\\n\\nPath: ${filePath}\\nRisk Level: ${risk.toUpperCase()}`,\n              permissionKey: `AutoEscalate(external:${filePath})`,\n            }\n          }\n        }\n      }\n    }\n\n    return { allowed: true }\n  },\n}\n\n/**\n * Check if an operation should trigger auto-escalation\n */\nexport function shouldAutoEscalate(\n  toolName: string,\n  input: Record<string, unknown>,\n): {\n  shouldEscalate: boolean\n  reason?: EscalationReason\n  description?: string\n} {\n  // Check command patterns\n  if (toolName === 'Bash') {\n    const command = (input.command as string) || ''\n    const match = matchesEscalationPattern(command)\n    if (match) {\n      return { shouldEscalate: true, ...match }\n    }\n  }\n\n  // Check file paths\n  const filePath = extractFilePath(input)\n  if (filePath) {\n    const operation = getOperationType(toolName, input)\n\n    if (operation && operation !== 'read') {\n      if (isSensitivePath(filePath, operation)) {\n        return {\n          shouldEscalate: true,\n          reason: 'sensitive_path',\n          description: 'Sensitive file access',\n        }\n      }\n\n      if (isOutsideProject(filePath)) {\n        const risk = calculateExternalOperationRisk(operation, filePath)\n        if (risk === 'critical' || risk === 'high') {\n          return {\n            shouldEscalate: true,\n            reason: 'critical_external',\n            description: `${risk} risk external operation`,\n          }\n        }\n      }\n    }\n  }\n\n  return { shouldEscalate: false }\n}\n"],
+  "mappings": "AAcA,SAAS,iBAAiB,4BAA4B;AACtD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,wBAAwB;AAgBjC,MAAM,sBAID;AAAA;AAAA,EAEH;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AACF;AAKA,SAAS,yBACP,SAC0D;AAC1D,aAAW,EAAE,SAAS,QAAQ,YAAY,KAAK,qBAAqB;AAClE,QAAI,QAAQ,KAAK,OAAO,GAAG;AACzB,aAAO,EAAE,QAAQ,YAAY;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;AAKA,SAAS,iBACP,UACA,OACgD;AAChD,UAAQ,UAAU;AAAA,IAChB,KAAK;AAAA;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK,QAAQ;AACX,YAAM,UAAW,MAAM,WAAsB;AAC7C,UAAI,4BAA4B,KAAK,OAAO,GAAG;AAC7C,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT;AAAA,IACA;AACE,aAAO;AAAA,EACX;AACF;AAKA,SAAS,gBAAgB,OAA+C;AACtE,MAAI,MAAM,UAAW,QAAO,MAAM;AAClC,MAAI,MAAM,SAAU,QAAO,MAAM;AACjC,MAAI,MAAM,KAAM,QAAO,MAAM;AAC7B,SAAO;AACT;AAKA,MAAM,sBAAwD;AAAA,EAC5D,gBAAgB;AAAA,EAChB,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,gBAAgB;AAClB;AAOO,MAAM,qBAAqC;AAAA,EAChD,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU;AAAA;AAAA,EAEV,MAAM,SAA8C;AAClD,UAAM,WAAW,QAAQ,KAAK;AAC9B,UAAM,QAAQ,QAAQ;AAGtB,QAAI,aAAa,QAAQ;AACvB,YAAM,UAAW,MAAM,WAAsB;AAC7C,YAAM,QAAQ,yBAAyB,OAAO;AAE9C,UAAI,OAAO;AAET,yBAAiB;AAAA,UACf,WAAW;AAAA,UACX;AAAA,UACA,WAAW;AAAA,UACX,QAAQ;AAAA,UACR,SAAS;AAAA;AAAA,UACT,WAAW;AAAA,UACX,SAAS;AAAA,YACP,kBAAkB,MAAM;AAAA,YACxB,uBAAuB,MAAM;AAAA,UAC/B;AAAA,UACA,eAAe;AAAA,QACjB,CAAC;AAED,eAAO;AAAA,UACL,SAAS;AAAA,UACT,YAAY;AAAA,UACZ,QAAQ,wBAAwB,MAAM,WAAW;AAAA,UACjD,SAAS,GAAG,oBAAoB,MAAM,MAAM,CAAC;AAAA;AAAA,WAAgB,QAAQ,SAAS,MAAM,QAAQ,UAAU,GAAG,GAAG,IAAI,QAAQ,OAAO;AAAA;AAAA,UAAe,MAAM,WAAW;AAAA,UAC/J,eAAe,gBAAgB,MAAM,MAAM,IAAI,QAAQ,UAAU,GAAG,EAAE,CAAC;AAAA,QACzE;AAAA,MACF;AAAA,IACF;AAGA,UAAM,YAAY,iBAAiB,UAAU,KAAK;AAClD,QAAI,aAAa,cAAc,QAAQ;AACrC,YAAM,WAAW,gBAAgB,KAAK;AAEtC,UAAI,UAAU;AAEZ,YAAI,gBAAgB,UAAU,SAAS,GAAG;AACxC,gBAAM,OAAO,qBAAqB,QAAQ;AAE1C,2BAAiB;AAAA,YACf,WAAW;AAAA,YACX;AAAA,YACA;AAAA,YACA,QAAQ;AAAA,YACR,SAAS;AAAA,YACT,WAAW;AAAA,YACX,SAAS;AAAA,cACP,UAAU,MAAM;AAAA,cAChB,aAAa,MAAM;AAAA,YACrB;AAAA,YACA,eAAe;AAAA,UACjB,CAAC;AAED,iBAAO;AAAA,YACL,SAAS;AAAA,YACT,YAAY;AAAA,YACZ,QAAQ,mBAAmB,MAAM,eAAe,SAAS;AAAA,YACzD,SAAS,GAAG,oBAAoB,cAAc;AAAA;AAAA,QAAa,QAAQ;AAAA,YAAe,MAAM,YAAY,SAAS;AAAA,YAC7G,eAAe,0BAA0B,QAAQ;AAAA,UACnD;AAAA,QACF;AAGA,YAAI,iBAAiB,QAAQ,GAAG;AAC9B,gBAAM,OAAO,+BAA+B,WAAW,QAAQ;AAE/D,cAAI,SAAS,cAAc,SAAS,QAAQ;AAC1C,6BAAiB;AAAA,cACf,WAAW;AAAA,cACX;AAAA,cACA;AAAA,cACA,QAAQ;AAAA,cACR,SAAS;AAAA,cACT,WAAW;AAAA,cACX,eAAe;AAAA,YACjB,CAAC;AAED,mBAAO;AAAA,cACL,SAAS;AAAA,cACT,YAAY;AAAA,cACZ,QAAQ,GAAG,IAAI;AAAA,cACf,SAAS,GAAG,oBAAoB,iBAAiB;AAAA;AAAA,QAAa,QAAQ;AAAA,cAAiB,KAAK,YAAY,CAAC;AAAA,cACzG,eAAe,yBAAyB,QAAQ;AAAA,YAClD;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACF;AAKO,SAAS,mBACd,UACA,OAKA;AAEA,MAAI,aAAa,QAAQ;AACvB,UAAM,UAAW,MAAM,WAAsB;AAC7C,UAAM,QAAQ,yBAAyB,OAAO;AAC9C,QAAI,OAAO;AACT,aAAO,EAAE,gBAAgB,MAAM,GAAG,MAAM;AAAA,IAC1C;AAAA,EACF;AAGA,QAAM,WAAW,gBAAgB,KAAK;AACtC,MAAI,UAAU;AACZ,UAAM,YAAY,iBAAiB,UAAU,KAAK;AAElD,QAAI,aAAa,cAAc,QAAQ;AACrC,UAAI,gBAAgB,UAAU,SAAS,GAAG;AACxC,eAAO;AAAA,UACL,gBAAgB;AAAA,UAChB,QAAQ;AAAA,UACR,aAAa;AAAA,QACf;AAAA,MACF;AAEA,UAAI,iBAAiB,QAAQ,GAAG;AAC9B,cAAM,OAAO,+BAA+B,WAAW,QAAQ;AAC/D,YAAI,SAAS,cAAc,SAAS,QAAQ;AAC1C,iBAAO;AAAA,YACL,gBAAgB;AAAA,YAChB,QAAQ;AAAA,YACR,aAAa,GAAG,IAAI;AAAA,UACtB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,gBAAgB,MAAM;AACjC;",
   "names": []
 }

package/dist/core/permissions/rules/projectBoundaryRule.js

@@ -27,17 +27,22 @@ function calculateExternalOperationRisk(operation, filePath) {
 }
 function getOperationType(toolName, input) {
   switch (toolName) {
+    case "View":
+    // Actual API name for FileReadTool
     case "Read":
     case "FileRead":
     case "Glob":
     case "Grep":
       return "read";
+    case "Replace":
+    // Actual API name for FileWriteTool
     case "Write":
     case "FileWrite":
     case "Edit":
     case "FileEdit":
     case "MultiEdit":
     case "NotebookEdit":
+    case "NotebookEditCell":
       return "write";
     case "Bash": {
       const command = input.command || "";

package/dist/core/permissions/rules/projectBoundaryRule.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/core/permissions/rules/projectBoundaryRule.ts"],
-  "sourcesContent": ["/**\n * Project Boundary Rule\n *\n * Enforces secondary confirmation for write/delete operations\n * outside the project directory. This prevents accidental modifications\n * to files outside the current working context.\n */\n\nimport type {\n  PermissionRule,\n  PermissionContext,\n  PermissionResult,\n} from '../engine/types'\nimport { resolve, relative, isAbsolute } from 'path'\nimport { getOriginalCwd } from '@utils/state'\n\n/**\n * Operation risk levels for operations outside project directory\n */\nexport type ExternalOperationRisk = 'low' | 'medium' | 'high' | 'critical'\n\n/**\n * Determine if a path is outside the project directory\n */\nexport function isOutsideProject(filePath: string): boolean {\n  const projectDir = getOriginalCwd()\n  const absolutePath = isAbsolute(filePath)\n    ? resolve(filePath)\n    : resolve(projectDir, filePath)\n\n  const relativePath = relative(projectDir, absolutePath)\n\n  // If the relative path starts with '..' or is absolute, it's outside\n  return relativePath.startsWith('..') || isAbsolute(relativePath)\n}\n\n/**\n * Get the relative path from project directory (for display)\n */\nexport function getRelativeFromProject(filePath: string): string {\n  const projectDir = getOriginalCwd()\n  const absolutePath = isAbsolute(filePath)\n    ? resolve(filePath)\n    : resolve(projectDir, filePath)\n\n  return relative(projectDir, absolutePath)\n}\n\n/**\n * Calculate risk level for an external operation\n */\nexport function calculateExternalOperationRisk(\n  operation: 'read' | 'write' | 'delete' | 'execute',\n  filePath: string,\n): ExternalOperationRisk {\n  const relativePath = getRelativeFromProject(filePath)\n\n  // Count how many levels up we're going\n  const levelsUp = (relativePath.match(/\\.\\./g) || []).length\n\n  // Critical: More than 3 levels up or accessing system directories\n  if (\n    levelsUp > 3 ||\n    filePath.startsWith('/etc') ||\n    filePath.startsWith('/usr')\n  ) {\n    return 'critical'\n  }\n\n  // High: Delete operations or 2-3 levels up\n  if (operation === 'delete' || levelsUp >= 2) {\n    return 'high'\n  }\n\n  // Medium: Write operations 1 level up\n  if (operation === 'write' && levelsUp >= 1) {\n    return 'medium'\n  }\n\n  // Low: Other cases\n  return 'low'\n}\n\n/**\n * Get operation type from tool name\n */\nfunction getOperationType(\n  toolName: string,\n  input: Record<string, unknown>,\n): 'read' | 'write' | 'delete' | 'execute' | null {\n  switch (toolName) {\n    case 'Read':\n    case 'FileRead':\n    case 'Glob':\n    case 'Grep':\n      return 'read'\n    case 'Write':\n    case 'FileWrite':\n    case 'Edit':\n    case 'FileEdit':\n    case 'MultiEdit':\n    case 'NotebookEdit':\n      return 'write'\n    case 'Bash': {\n      const command = (input.command as string) || ''\n      if (/\\b(rm|del|rmdir|unlink)\\b/.test(command)) {\n        return 'delete'\n      }\n      if (/\\b(mv|cp|touch|mkdir|echo\\s+.*>|cat\\s+.*>|tee)\\b/.test(command)) {\n        return 'write'\n      }\n      if (/\\b(cat|head|tail|less|more|grep|find|ls)\\b/.test(command)) {\n        return 'read'\n      }\n      return 'execute'\n    }\n    default:\n      return null\n  }\n}\n\n/**\n * Extract file paths from tool input (may return multiple for Bash)\n */\nfunction extractFilePaths(\n  toolName: string,\n  input: Record<string, unknown>,\n): string[] {\n  const paths: string[] = []\n\n  // Direct file path tools\n  if (input.file_path) paths.push(input.file_path as string)\n  if (input.filePath) paths.push(input.filePath as string)\n  if (input.path) paths.push(input.path as string)\n\n  // For Bash commands, extract all paths\n  if (toolName === 'Bash') {\n    const command = (input.command as string) || ''\n\n    // Match paths after file operation commands\n    const pathMatches = command.matchAll(\n      /(?:cat|rm|mv|cp|head|tail|less|more|touch|mkdir|rmdir|>\\s*)\\s*[\"']?([^\\s\"'|&;><]+)/g,\n    )\n    for (const match of pathMatches) {\n      if (match[1] && !match[1].startsWith('-')) {\n        paths.push(match[1])\n      }\n    }\n  }\n\n  return paths\n}\n\n/**\n * Risk level descriptions\n */\nconst RISK_MESSAGES: Record<ExternalOperationRisk, string> = {\n  low: '\uD83D\uDCC1 This file is outside your project directory.',\n  medium: '\u26A0\uFE0F This operation modifies a file outside your project.',\n  high: '\uD83D\uDD36 High-risk operation: This file is significantly outside your project boundary.',\n  critical:\n    '\uD83D\uDEA8 Critical: This operation affects system or deeply external files!',\n}\n\n/**\n * Project Boundary Rule\n *\n * Requires confirmation for write/delete operations outside project.\n */\nexport const projectBoundaryRule: PermissionRule = {\n  name: 'project-boundary',\n  description:\n    'Requires confirmation for write/delete operations outside project directory',\n  priority: 95, // High priority, but below sensitive paths\n\n  check(context: PermissionContext): PermissionResult {\n    const toolName = context.tool.name\n    const input = context.input\n\n    // Get operation type\n    const operation = getOperationType(toolName, input)\n    if (!operation) {\n      return { allowed: true }\n    }\n\n    // Only check write/delete operations (read is generally safe)\n    if (operation === 'read') {\n      return { allowed: true }\n    }\n\n    // Extract file paths\n    const filePaths = extractFilePaths(toolName, input)\n    if (filePaths.length === 0) {\n      return { allowed: true }\n    }\n\n    // Check each path\n    const externalPaths: Array<{\n      path: string\n      relativePath: string\n      risk: ExternalOperationRisk\n    }> = []\n\n    for (const filePath of filePaths) {\n      if (isOutsideProject(filePath)) {\n        const relativePath = getRelativeFromProject(filePath)\n        const risk = calculateExternalOperationRisk(operation, filePath)\n        externalPaths.push({ path: filePath, relativePath, risk })\n      }\n    }\n\n    // If no external paths, allow\n    if (externalPaths.length === 0) {\n      return { allowed: true }\n    }\n\n    // Get the highest risk level\n    const riskOrder: ExternalOperationRisk[] = [\n      'low',\n      'medium',\n      'high',\n      'critical',\n    ]\n    const highestRisk = externalPaths.reduce((max, curr) => {\n      return riskOrder.indexOf(curr.risk) > riskOrder.indexOf(max)\n        ? curr.risk\n        : max\n    }, 'low' as ExternalOperationRisk)\n\n    // Critical operations are blocked\n    if (highestRisk === 'critical') {\n      return {\n        allowed: false,\n        reason: 'Critical external operation blocked',\n        message: `${RISK_MESSAGES.critical}\\n\\nPaths:\\n${externalPaths.map(p => `  \u2022 ${p.relativePath}`).join('\\n')}\\n\\nThis operation is too risky to allow. Please reconsider.`,\n      }\n    }\n\n    // All other external operations require explicit confirmation\n    const projectDir = getOriginalCwd()\n    const pathList = externalPaths\n      .map(p => `  \u2022 ${p.relativePath} (${p.risk} risk)`)\n      .join('\\n')\n\n    return {\n      allowed: false,\n      promptUser: true,\n      reason: 'External operation requires confirmation',\n      message: `${RISK_MESSAGES[highestRisk]}\\n\\nProject: ${projectDir}\\n\\nExternal paths:\\n${pathList}\\n\\nOperation: ${operation}`,\n      permissionKey: `ExternalOp(${operation}:${externalPaths.map(p => p.path).join(',')})`,\n    }\n  },\n}\n\n/**\n * Check if an operation is outside project (utility function)\n */\nexport function isExternalOperation(\n  filePath: string,\n  operation: 'read' | 'write' | 'delete' | 'execute',\n): { isExternal: boolean; risk: ExternalOperationRisk | null } {\n  if (!isOutsideProject(filePath)) {\n    return { isExternal: false, risk: null }\n  }\n\n  return {\n    isExternal: true,\n    risk: calculateExternalOperationRisk(operation, filePath),\n  }\n}\n"],
-  "mappings": "AAaA,SAAS,SAAS,UAAU,kBAAkB;AAC9C,SAAS,sBAAsB;AAUxB,SAAS,iBAAiB,UAA2B;AAC1D,QAAM,aAAa,eAAe;AAClC,QAAM,eAAe,WAAW,QAAQ,IACpC,QAAQ,QAAQ,IAChB,QAAQ,YAAY,QAAQ;AAEhC,QAAM,eAAe,SAAS,YAAY,YAAY;AAGtD,SAAO,aAAa,WAAW,IAAI,KAAK,WAAW,YAAY;AACjE;AAKO,SAAS,uBAAuB,UAA0B;AAC/D,QAAM,aAAa,eAAe;AAClC,QAAM,eAAe,WAAW,QAAQ,IACpC,QAAQ,QAAQ,IAChB,QAAQ,YAAY,QAAQ;AAEhC,SAAO,SAAS,YAAY,YAAY;AAC1C;AAKO,SAAS,+BACd,WACA,UACuB;AACvB,QAAM,eAAe,uBAAuB,QAAQ;AAGpD,QAAM,YAAY,aAAa,MAAM,OAAO,KAAK,CAAC,GAAG;AAGrD,MACE,WAAW,KACX,SAAS,WAAW,MAAM,KAC1B,SAAS,WAAW,MAAM,GAC1B;AACA,WAAO;AAAA,EACT;AAGA,MAAI,cAAc,YAAY,YAAY,GAAG;AAC3C,WAAO;AAAA,EACT;AAGA,MAAI,cAAc,WAAW,YAAY,GAAG;AAC1C,WAAO;AAAA,EACT;AAGA,SAAO;AACT;AAKA,SAAS,iBACP,UACA,OACgD;AAChD,UAAQ,UAAU;AAAA,IAChB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK,QAAQ;AACX,YAAM,UAAW,MAAM,WAAsB;AAC7C,UAAI,4BAA4B,KAAK,OAAO,GAAG;AAC7C,eAAO;AAAA,MACT;AACA,UAAI,mDAAmD,KAAK,OAAO,GAAG;AACpE,eAAO;AAAA,MACT;AACA,UAAI,6CAA6C,KAAK,OAAO,GAAG;AAC9D,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT;AAAA,IACA;AACE,aAAO;AAAA,EACX;AACF;AAKA,SAAS,iBACP,UACA,OACU;AACV,QAAM,QAAkB,CAAC;AAGzB,MAAI,MAAM,UAAW,OAAM,KAAK,MAAM,SAAmB;AACzD,MAAI,MAAM,SAAU,OAAM,KAAK,MAAM,QAAkB;AACvD,MAAI,MAAM,KAAM,OAAM,KAAK,MAAM,IAAc;AAG/C,MAAI,aAAa,QAAQ;AACvB,UAAM,UAAW,MAAM,WAAsB;AAG7C,UAAM,cAAc,QAAQ;AAAA,MAC1B;AAAA,IACF;AACA,eAAW,SAAS,aAAa;AAC/B,UAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,GAAG;AACzC,cAAM,KAAK,MAAM,CAAC,CAAC;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAKA,MAAM,gBAAuD;AAAA,EAC3D,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UACE;AACJ;AAOO,MAAM,sBAAsC;AAAA,EACjD,MAAM;AAAA,EACN,aACE;AAAA,EACF,UAAU;AAAA;AAAA,EAEV,MAAM,SAA8C;AAClD,UAAM,WAAW,QAAQ,KAAK;AAC9B,UAAM,QAAQ,QAAQ;AAGtB,UAAM,YAAY,iBAAiB,UAAU,KAAK;AAClD,QAAI,CAAC,WAAW;AACd,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,QAAI,cAAc,QAAQ;AACxB,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,UAAM,YAAY,iBAAiB,UAAU,KAAK;AAClD,QAAI,UAAU,WAAW,GAAG;AAC1B,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,UAAM,gBAID,CAAC;AAEN,eAAW,YAAY,WAAW;AAChC,UAAI,iBAAiB,QAAQ,GAAG;AAC9B,cAAM,eAAe,uBAAuB,QAAQ;AACpD,cAAM,OAAO,+BAA+B,WAAW,QAAQ;AAC/D,sBAAc,KAAK,EAAE,MAAM,UAAU,cAAc,KAAK,CAAC;AAAA,MAC3D;AAAA,IACF;AAGA,QAAI,cAAc,WAAW,GAAG;AAC9B,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,UAAM,YAAqC;AAAA,MACzC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,UAAM,cAAc,cAAc,OAAO,CAAC,KAAK,SAAS;AACtD,aAAO,UAAU,QAAQ,KAAK,IAAI,IAAI,UAAU,QAAQ,GAAG,IACvD,KAAK,OACL;AAAA,IACN,GAAG,KAA8B;AAGjC,QAAI,gBAAgB,YAAY;AAC9B,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS,GAAG,cAAc,QAAQ;AAAA;AAAA;AAAA,EAAe,cAAc,IAAI,OAAK,YAAO,EAAE,YAAY,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA,MAC7G;AAAA,IACF;AAGA,UAAM,aAAa,eAAe;AAClC,UAAM,WAAW,cACd,IAAI,OAAK,YAAO,EAAE,YAAY,KAAK,EAAE,IAAI,QAAQ,EACjD,KAAK,IAAI;AAEZ,WAAO;AAAA,MACL,SAAS;AAAA,MACT,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,SAAS,GAAG,cAAc,WAAW,CAAC;AAAA;AAAA,WAAgB,UAAU;AAAA;AAAA;AAAA,EAAwB,QAAQ;AAAA;AAAA,aAAkB,SAAS;AAAA,MAC3H,eAAe,cAAc,SAAS,IAAI,cAAc,IAAI,OAAK,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC;AAAA,IACpF;AAAA,EACF;AACF;AAKO,SAAS,oBACd,UACA,WAC6D;AAC7D,MAAI,CAAC,iBAAiB,QAAQ,GAAG;AAC/B,WAAO,EAAE,YAAY,OAAO,MAAM,KAAK;AAAA,EACzC;AAEA,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM,+BAA+B,WAAW,QAAQ;AAAA,EAC1D;AACF;",
+  "sourcesContent": ["/**\n * Project Boundary Rule\n *\n * Enforces secondary confirmation for write/delete operations\n * outside the project directory. This prevents accidental modifications\n * to files outside the current working context.\n */\n\nimport type {\n  PermissionRule,\n  PermissionContext,\n  PermissionResult,\n} from '../engine/types'\nimport { resolve, relative, isAbsolute } from 'path'\nimport { getOriginalCwd } from '@utils/state'\n\n/**\n * Operation risk levels for operations outside project directory\n */\nexport type ExternalOperationRisk = 'low' | 'medium' | 'high' | 'critical'\n\n/**\n * Determine if a path is outside the project directory\n */\nexport function isOutsideProject(filePath: string): boolean {\n  const projectDir = getOriginalCwd()\n  const absolutePath = isAbsolute(filePath)\n    ? resolve(filePath)\n    : resolve(projectDir, filePath)\n\n  const relativePath = relative(projectDir, absolutePath)\n\n  // If the relative path starts with '..' or is absolute, it's outside\n  return relativePath.startsWith('..') || isAbsolute(relativePath)\n}\n\n/**\n * Get the relative path from project directory (for display)\n */\nexport function getRelativeFromProject(filePath: string): string {\n  const projectDir = getOriginalCwd()\n  const absolutePath = isAbsolute(filePath)\n    ? resolve(filePath)\n    : resolve(projectDir, filePath)\n\n  return relative(projectDir, absolutePath)\n}\n\n/**\n * Calculate risk level for an external operation\n */\nexport function calculateExternalOperationRisk(\n  operation: 'read' | 'write' | 'delete' | 'execute',\n  filePath: string,\n): ExternalOperationRisk {\n  const relativePath = getRelativeFromProject(filePath)\n\n  // Count how many levels up we're going\n  const levelsUp = (relativePath.match(/\\.\\./g) || []).length\n\n  // Critical: More than 3 levels up or accessing system directories\n  if (\n    levelsUp > 3 ||\n    filePath.startsWith('/etc') ||\n    filePath.startsWith('/usr')\n  ) {\n    return 'critical'\n  }\n\n  // High: Delete operations or 2-3 levels up\n  if (operation === 'delete' || levelsUp >= 2) {\n    return 'high'\n  }\n\n  // Medium: Write operations 1 level up\n  if (operation === 'write' && levelsUp >= 1) {\n    return 'medium'\n  }\n\n  // Low: Other cases\n  return 'low'\n}\n\n/**\n * Get operation type from tool name\n */\nfunction getOperationType(\n  toolName: string,\n  input: Record<string, unknown>,\n): 'read' | 'write' | 'delete' | 'execute' | null {\n  switch (toolName) {\n    case 'View': // Actual API name for FileReadTool\n    case 'Read':\n    case 'FileRead':\n    case 'Glob':\n    case 'Grep':\n      return 'read'\n    case 'Replace': // Actual API name for FileWriteTool\n    case 'Write':\n    case 'FileWrite':\n    case 'Edit':\n    case 'FileEdit':\n    case 'MultiEdit':\n    case 'NotebookEdit':\n    case 'NotebookEditCell': // Actual API name for NotebookEditTool\n      return 'write'\n    case 'Bash': {\n      const command = (input.command as string) || ''\n      if (/\\b(rm|del|rmdir|unlink)\\b/.test(command)) {\n        return 'delete'\n      }\n      if (/\\b(mv|cp|touch|mkdir|echo\\s+.*>|cat\\s+.*>|tee)\\b/.test(command)) {\n        return 'write'\n      }\n      if (/\\b(cat|head|tail|less|more|grep|find|ls)\\b/.test(command)) {\n        return 'read'\n      }\n      return 'execute'\n    }\n    default:\n      return null\n  }\n}\n\n/**\n * Extract file paths from tool input (may return multiple for Bash)\n */\nfunction extractFilePaths(\n  toolName: string,\n  input: Record<string, unknown>,\n): string[] {\n  const paths: string[] = []\n\n  // Direct file path tools\n  if (input.file_path) paths.push(input.file_path as string)\n  if (input.filePath) paths.push(input.filePath as string)\n  if (input.path) paths.push(input.path as string)\n\n  // For Bash commands, extract all paths\n  if (toolName === 'Bash') {\n    const command = (input.command as string) || ''\n\n    // Match paths after file operation commands\n    const pathMatches = command.matchAll(\n      /(?:cat|rm|mv|cp|head|tail|less|more|touch|mkdir|rmdir|>\\s*)\\s*[\"']?([^\\s\"'|&;><]+)/g,\n    )\n    for (const match of pathMatches) {\n      if (match[1] && !match[1].startsWith('-')) {\n        paths.push(match[1])\n      }\n    }\n  }\n\n  return paths\n}\n\n/**\n * Risk level descriptions\n */\nconst RISK_MESSAGES: Record<ExternalOperationRisk, string> = {\n  low: '\uD83D\uDCC1 This file is outside your project directory.',\n  medium: '\u26A0\uFE0F This operation modifies a file outside your project.',\n  high: '\uD83D\uDD36 High-risk operation: This file is significantly outside your project boundary.',\n  critical:\n    '\uD83D\uDEA8 Critical: This operation affects system or deeply external files!',\n}\n\n/**\n * Project Boundary Rule\n *\n * Requires confirmation for write/delete operations outside project.\n */\nexport const projectBoundaryRule: PermissionRule = {\n  name: 'project-boundary',\n  description:\n    'Requires confirmation for write/delete operations outside project directory',\n  priority: 95, // High priority, but below sensitive paths\n\n  check(context: PermissionContext): PermissionResult {\n    const toolName = context.tool.name\n    const input = context.input\n\n    // Get operation type\n    const operation = getOperationType(toolName, input)\n    if (!operation) {\n      return { allowed: true }\n    }\n\n    // Only check write/delete operations (read is generally safe)\n    if (operation === 'read') {\n      return { allowed: true }\n    }\n\n    // Extract file paths\n    const filePaths = extractFilePaths(toolName, input)\n    if (filePaths.length === 0) {\n      return { allowed: true }\n    }\n\n    // Check each path\n    const externalPaths: Array<{\n      path: string\n      relativePath: string\n      risk: ExternalOperationRisk\n    }> = []\n\n    for (const filePath of filePaths) {\n      if (isOutsideProject(filePath)) {\n        const relativePath = getRelativeFromProject(filePath)\n        const risk = calculateExternalOperationRisk(operation, filePath)\n        externalPaths.push({ path: filePath, relativePath, risk })\n      }\n    }\n\n    // If no external paths, allow\n    if (externalPaths.length === 0) {\n      return { allowed: true }\n    }\n\n    // Get the highest risk level\n    const riskOrder: ExternalOperationRisk[] = [\n      'low',\n      'medium',\n      'high',\n      'critical',\n    ]\n    const highestRisk = externalPaths.reduce((max, curr) => {\n      return riskOrder.indexOf(curr.risk) > riskOrder.indexOf(max)\n        ? curr.risk\n        : max\n    }, 'low' as ExternalOperationRisk)\n\n    // Critical operations are blocked\n    if (highestRisk === 'critical') {\n      return {\n        allowed: false,\n        reason: 'Critical external operation blocked',\n        message: `${RISK_MESSAGES.critical}\\n\\nPaths:\\n${externalPaths.map(p => `  \u2022 ${p.relativePath}`).join('\\n')}\\n\\nThis operation is too risky to allow. Please reconsider.`,\n      }\n    }\n\n    // All other external operations require explicit confirmation\n    const projectDir = getOriginalCwd()\n    const pathList = externalPaths\n      .map(p => `  \u2022 ${p.relativePath} (${p.risk} risk)`)\n      .join('\\n')\n\n    return {\n      allowed: false,\n      promptUser: true,\n      reason: 'External operation requires confirmation',\n      message: `${RISK_MESSAGES[highestRisk]}\\n\\nProject: ${projectDir}\\n\\nExternal paths:\\n${pathList}\\n\\nOperation: ${operation}`,\n      permissionKey: `ExternalOp(${operation}:${externalPaths.map(p => p.path).join(',')})`,\n    }\n  },\n}\n\n/**\n * Check if an operation is outside project (utility function)\n */\nexport function isExternalOperation(\n  filePath: string,\n  operation: 'read' | 'write' | 'delete' | 'execute',\n): { isExternal: boolean; risk: ExternalOperationRisk | null } {\n  if (!isOutsideProject(filePath)) {\n    return { isExternal: false, risk: null }\n  }\n\n  return {\n    isExternal: true,\n    risk: calculateExternalOperationRisk(operation, filePath),\n  }\n}\n"],
+  "mappings": "AAaA,SAAS,SAAS,UAAU,kBAAkB;AAC9C,SAAS,sBAAsB;AAUxB,SAAS,iBAAiB,UAA2B;AAC1D,QAAM,aAAa,eAAe;AAClC,QAAM,eAAe,WAAW,QAAQ,IACpC,QAAQ,QAAQ,IAChB,QAAQ,YAAY,QAAQ;AAEhC,QAAM,eAAe,SAAS,YAAY,YAAY;AAGtD,SAAO,aAAa,WAAW,IAAI,KAAK,WAAW,YAAY;AACjE;AAKO,SAAS,uBAAuB,UAA0B;AAC/D,QAAM,aAAa,eAAe;AAClC,QAAM,eAAe,WAAW,QAAQ,IACpC,QAAQ,QAAQ,IAChB,QAAQ,YAAY,QAAQ;AAEhC,SAAO,SAAS,YAAY,YAAY;AAC1C;AAKO,SAAS,+BACd,WACA,UACuB;AACvB,QAAM,eAAe,uBAAuB,QAAQ;AAGpD,QAAM,YAAY,aAAa,MAAM,OAAO,KAAK,CAAC,GAAG;AAGrD,MACE,WAAW,KACX,SAAS,WAAW,MAAM,KAC1B,SAAS,WAAW,MAAM,GAC1B;AACA,WAAO;AAAA,EACT;AAGA,MAAI,cAAc,YAAY,YAAY,GAAG;AAC3C,WAAO;AAAA,EACT;AAGA,MAAI,cAAc,WAAW,YAAY,GAAG;AAC1C,WAAO;AAAA,EACT;AAGA,SAAO;AACT;AAKA,SAAS,iBACP,UACA,OACgD;AAChD,UAAQ,UAAU;AAAA,IAChB,KAAK;AAAA;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK,QAAQ;AACX,YAAM,UAAW,MAAM,WAAsB;AAC7C,UAAI,4BAA4B,KAAK,OAAO,GAAG;AAC7C,eAAO;AAAA,MACT;AACA,UAAI,mDAAmD,KAAK,OAAO,GAAG;AACpE,eAAO;AAAA,MACT;AACA,UAAI,6CAA6C,KAAK,OAAO,GAAG;AAC9D,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT;AAAA,IACA;AACE,aAAO;AAAA,EACX;AACF;AAKA,SAAS,iBACP,UACA,OACU;AACV,QAAM,QAAkB,CAAC;AAGzB,MAAI,MAAM,UAAW,OAAM,KAAK,MAAM,SAAmB;AACzD,MAAI,MAAM,SAAU,OAAM,KAAK,MAAM,QAAkB;AACvD,MAAI,MAAM,KAAM,OAAM,KAAK,MAAM,IAAc;AAG/C,MAAI,aAAa,QAAQ;AACvB,UAAM,UAAW,MAAM,WAAsB;AAG7C,UAAM,cAAc,QAAQ;AAAA,MAC1B;AAAA,IACF;AACA,eAAW,SAAS,aAAa;AAC/B,UAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,GAAG;AACzC,cAAM,KAAK,MAAM,CAAC,CAAC;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAKA,MAAM,gBAAuD;AAAA,EAC3D,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UACE;AACJ;AAOO,MAAM,sBAAsC;AAAA,EACjD,MAAM;AAAA,EACN,aACE;AAAA,EACF,UAAU;AAAA;AAAA,EAEV,MAAM,SAA8C;AAClD,UAAM,WAAW,QAAQ,KAAK;AAC9B,UAAM,QAAQ,QAAQ;AAGtB,UAAM,YAAY,iBAAiB,UAAU,KAAK;AAClD,QAAI,CAAC,WAAW;AACd,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,QAAI,cAAc,QAAQ;AACxB,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,UAAM,YAAY,iBAAiB,UAAU,KAAK;AAClD,QAAI,UAAU,WAAW,GAAG;AAC1B,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,UAAM,gBAID,CAAC;AAEN,eAAW,YAAY,WAAW;AAChC,UAAI,iBAAiB,QAAQ,GAAG;AAC9B,cAAM,eAAe,uBAAuB,QAAQ;AACpD,cAAM,OAAO,+BAA+B,WAAW,QAAQ;AAC/D,sBAAc,KAAK,EAAE,MAAM,UAAU,cAAc,KAAK,CAAC;AAAA,MAC3D;AAAA,IACF;AAGA,QAAI,cAAc,WAAW,GAAG;AAC9B,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,UAAM,YAAqC;AAAA,MACzC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,UAAM,cAAc,cAAc,OAAO,CAAC,KAAK,SAAS;AACtD,aAAO,UAAU,QAAQ,KAAK,IAAI,IAAI,UAAU,QAAQ,GAAG,IACvD,KAAK,OACL;AAAA,IACN,GAAG,KAA8B;AAGjC,QAAI,gBAAgB,YAAY;AAC9B,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS,GAAG,cAAc,QAAQ;AAAA;AAAA;AAAA,EAAe,cAAc,IAAI,OAAK,YAAO,EAAE,YAAY,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA,MAC7G;AAAA,IACF;AAGA,UAAM,aAAa,eAAe;AAClC,UAAM,WAAW,cACd,IAAI,OAAK,YAAO,EAAE,YAAY,KAAK,EAAE,IAAI,QAAQ,EACjD,KAAK,IAAI;AAEZ,WAAO;AAAA,MACL,SAAS;AAAA,MACT,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,SAAS,GAAG,cAAc,WAAW,CAAC;AAAA;AAAA,WAAgB,UAAU;AAAA;AAAA;AAAA,EAAwB,QAAQ;AAAA;AAAA,aAAkB,SAAS;AAAA,MAC3H,eAAe,cAAc,SAAS,IAAI,cAAc,IAAI,OAAK,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC;AAAA,IACpF;AAAA,EACF;AACF;AAKO,SAAS,oBACd,UACA,WAC6D;AAC7D,MAAI,CAAC,iBAAiB,QAAQ,GAAG;AAC/B,WAAO,EAAE,YAAY,OAAO,MAAM,KAAK;AAAA,EACzC;AAEA,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM,+BAA+B,WAAW,QAAQ;AAAA,EAC1D;AACF;",
   "names": []
 }

package/dist/core/permissions/rules/sensitivePathsRule.js

@@ -226,17 +226,22 @@ function matchesSensitivePath(filePath, sensitivePath) {
 }
 function getOperationType(toolName, input) {
   switch (toolName) {
+    case "View":
+    // Actual API name for FileReadTool
     case "Read":
     case "FileRead":
     case "Glob":
     case "Grep":
       return "read";
+    case "Replace":
+    // Actual API name for FileWriteTool
     case "Write":
     case "FileWrite":
     case "Edit":
     case "FileEdit":
     case "MultiEdit":
     case "NotebookEdit":
+    case "NotebookEditCell":
       return "write";
     case "Bash": {
       const command = input.command || "";

package/dist/core/permissions/rules/sensitivePathsRule.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/core/permissions/rules/sensitivePathsRule.ts"],
-  "sourcesContent": ["/**\n * Sensitive Paths Protection Rule\n *\n * Always requires explicit authorization for operations on sensitive paths,\n * regardless of other permissions. These paths contain sensitive data that\n * should never be accessed without user awareness.\n */\n\nimport type {\n  PermissionRule,\n  PermissionContext,\n  PermissionResult,\n} from '../engine/types'\nimport { resolve, normalize } from 'path'\nimport { homedir } from 'os'\n\n/**\n * Categories of sensitive paths with different protection levels\n */\nexport type SensitivePathCategory =\n  | 'credentials' // API keys, passwords, tokens\n  | 'ssh' // SSH keys and config\n  | 'system' // System configuration files\n  | 'browser' // Browser data (cookies, history, passwords)\n  | 'cloud' // Cloud provider credentials\n  | 'development' // Development secrets (env files, etc.)\n  | 'wallet' // Cryptocurrency wallets\n\n/**\n * Sensitive path definition\n */\nexport interface SensitivePath {\n  /** Pattern to match (supports * wildcards) */\n  pattern: string\n  /** Category of sensitive data */\n  category: SensitivePathCategory\n  /** Human-readable description */\n  description: string\n  /** Whether this path is always blocked (vs requiring confirmation) */\n  alwaysBlock?: boolean\n  /** Applicable operations (read, write, delete, execute) */\n  operations?: ('read' | 'write' | 'delete' | 'execute')[]\n}\n\n/**\n * Default sensitive paths list\n */\nexport const SENSITIVE_PATHS: SensitivePath[] = [\n  // SSH\n  {\n    pattern: '~/.ssh/*',\n    category: 'ssh',\n    description: 'SSH keys and configuration',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.ssh',\n    category: 'ssh',\n    description: 'SSH directory',\n    operations: ['write', 'delete'],\n  },\n\n  // Credentials\n  {\n    pattern: '~/.aws/*',\n    category: 'cloud',\n    description: 'AWS credentials and configuration',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.config/gcloud/*',\n    category: 'cloud',\n    description: 'Google Cloud credentials',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.azure/*',\n    category: 'cloud',\n    description: 'Azure credentials',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.config/gh/*',\n    category: 'credentials',\n    description: 'GitHub CLI credentials',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.docker/config.json',\n    category: 'credentials',\n    description: 'Docker registry credentials',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.npmrc',\n    category: 'credentials',\n    description: 'NPM credentials',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.netrc',\n    category: 'credentials',\n    description: 'Network credentials',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.gnupg/*',\n    category: 'credentials',\n    description: 'GPG keys and configuration',\n    operations: ['read', 'write', 'delete'],\n  },\n\n  // Development secrets\n  {\n    pattern: '**/.env',\n    category: 'development',\n    description: 'Environment variables file',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/.env.*',\n    category: 'development',\n    description: 'Environment variables file',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/credentials.json',\n    category: 'development',\n    description: 'Credentials file',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/secrets.json',\n    category: 'development',\n    description: 'Secrets file',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/secrets.yaml',\n    category: 'development',\n    description: 'Secrets file',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/secrets.yml',\n    category: 'development',\n    description: 'Secrets file',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/*.pem',\n    category: 'credentials',\n    description: 'Private key file',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/*.key',\n    category: 'credentials',\n    description: 'Private key file',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/id_rsa',\n    category: 'ssh',\n    description: 'SSH private key',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/id_ed25519',\n    category: 'ssh',\n    description: 'SSH private key',\n    operations: ['read', 'write', 'delete'],\n  },\n\n  // Browser data\n  {\n    pattern: '~/Library/Application Support/Google/Chrome/*',\n    category: 'browser',\n    description: 'Chrome browser data',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/Library/Application Support/Firefox/*',\n    category: 'browser',\n    description: 'Firefox browser data',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.config/google-chrome/*',\n    category: 'browser',\n    description: 'Chrome browser data (Linux)',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.mozilla/firefox/*',\n    category: 'browser',\n    description: 'Firefox browser data (Linux)',\n    operations: ['read', 'write', 'delete'],\n  },\n\n  // System configuration\n  {\n    pattern: '/etc/passwd',\n    category: 'system',\n    description: 'System user database',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '/etc/shadow',\n    category: 'system',\n    description: 'System password hashes',\n    alwaysBlock: true,\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '/etc/sudoers',\n    category: 'system',\n    description: 'Sudo configuration',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '/etc/hosts',\n    category: 'system',\n    description: 'Host file',\n    operations: ['write', 'delete'],\n  },\n\n  // Cryptocurrency wallets\n  {\n    pattern: '~/.bitcoin/*',\n    category: 'wallet',\n    description: 'Bitcoin wallet',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.ethereum/*',\n    category: 'wallet',\n    description: 'Ethereum wallet',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/*wallet*.json',\n    category: 'wallet',\n    description: 'Wallet file',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/*keystore*',\n    category: 'wallet',\n    description: 'Keystore file',\n    operations: ['read', 'write', 'delete'],\n  },\n\n  // Minto/Claude configuration (protect our own config)\n  {\n    pattern: '~/.minto.json',\n    category: 'credentials',\n    description: 'Minto global configuration (may contain API keys)',\n    operations: ['delete'], // Only protect delete, read/write allowed for config\n  },\n]\n\n/**\n * Expand ~ to home directory and normalize path\n */\nfunction expandPath(pattern: string): string {\n  const home = homedir()\n  let expanded = pattern.replace(/^~/, home)\n  return normalize(expanded)\n}\n\n/**\n * Convert glob pattern to regex\n */\nfunction patternToRegex(pattern: string): RegExp {\n  const expanded = expandPath(pattern)\n  // Escape special regex characters except * and **\n  let regex = expanded\n    .replace(/[.+?^${}()|[\\]\\\\]/g, '\\\\$&')\n    .replace(/\\*\\*/g, '<<<DOUBLESTAR>>>')\n    .replace(/\\*/g, '[^/]*')\n    .replace(/<<<DOUBLESTAR>>>/g, '.*')\n\n  return new RegExp(`^${regex}$`, 'i')\n}\n\n/**\n * Check if a path matches a sensitive path pattern\n */\nexport function matchesSensitivePath(\n  filePath: string,\n  sensitivePath: SensitivePath,\n): boolean {\n  const normalizedPath = normalize(resolve(filePath))\n  const regex = patternToRegex(sensitivePath.pattern)\n  return regex.test(normalizedPath)\n}\n\n/**\n * Get operation type from tool name and input\n */\nfunction getOperationType(\n  toolName: string,\n  input: Record<string, unknown>,\n): 'read' | 'write' | 'delete' | 'execute' | null {\n  switch (toolName) {\n    case 'Read':\n    case 'FileRead':\n    case 'Glob':\n    case 'Grep':\n      return 'read'\n    case 'Write':\n    case 'FileWrite':\n    case 'Edit':\n    case 'FileEdit':\n    case 'MultiEdit':\n    case 'NotebookEdit':\n      return 'write'\n    case 'Bash': {\n      const command = (input.command as string) || ''\n      // Check for delete commands\n      if (/\\b(rm|del|rmdir|unlink)\\b/.test(command)) {\n        return 'delete'\n      }\n      // Check for write commands\n      if (/\\b(mv|cp|touch|mkdir|echo\\s+.*>|cat\\s+.*>|tee)\\b/.test(command)) {\n        return 'write'\n      }\n      // Check for read commands\n      if (/\\b(cat|head|tail|less|more|grep|find|ls)\\b/.test(command)) {\n        return 'read'\n      }\n      return 'execute'\n    }\n    default:\n      return null\n  }\n}\n\n/**\n * Extract file path from tool input\n */\nfunction extractFilePath(\n  toolName: string,\n  input: Record<string, unknown>,\n): string | null {\n  // Direct file path tools\n  if (input.file_path) return input.file_path as string\n  if (input.filePath) return input.filePath as string\n  if (input.path) return input.path as string\n\n  // For Bash commands, try to extract file paths\n  if (toolName === 'Bash') {\n    const command = (input.command as string) || ''\n    // Simple extraction - look for paths after common commands\n    const pathMatch = command.match(\n      /(?:cat|rm|mv|cp|head|tail|less|more|touch|mkdir)\\s+[\"']?([^\\s\"'|&;>]+)/,\n    )\n    if (pathMatch) {\n      return pathMatch[1] || null\n    }\n  }\n\n  return null\n}\n\n/**\n * Find matching sensitive paths for a given file path and operation\n */\nexport function findMatchingSensitivePaths(\n  filePath: string,\n  operation: 'read' | 'write' | 'delete' | 'execute',\n): SensitivePath[] {\n  return SENSITIVE_PATHS.filter(sp => {\n    // Check if operation is applicable\n    if (sp.operations && !sp.operations.includes(operation)) {\n      return false\n    }\n    return matchesSensitivePath(filePath, sp)\n  })\n}\n\n/**\n * Sensitive Paths Rule\n *\n * Always prompts for sensitive paths, even if other permissions are granted.\n */\nexport const sensitivePathsRule: PermissionRule = {\n  name: 'sensitive-paths',\n  description: 'Protects sensitive paths from unauthorized access',\n  priority: 100, // Highest priority - checked before all other rules\n\n  check(context: PermissionContext): PermissionResult {\n    const toolName = context.tool.name\n    const input = context.input\n\n    // Get operation type\n    const operation = getOperationType(toolName, input)\n    if (!operation) {\n      return { allowed: true }\n    }\n\n    // Extract file path\n    const filePath = extractFilePath(toolName, input)\n    if (!filePath) {\n      return { allowed: true }\n    }\n\n    // Find matching sensitive paths\n    const matches = findMatchingSensitivePaths(filePath, operation)\n    if (matches.length === 0) {\n      return { allowed: true }\n    }\n\n    // Check if any match is always blocked\n    const blocked = matches.find(m => m.alwaysBlock)\n    if (blocked) {\n      return {\n        allowed: false,\n        reason: `Access to ${blocked.description} is blocked for security`,\n        message: `\uD83D\uDD12 Access denied: ${blocked.description} (${blocked.category})`,\n      }\n    }\n\n    // Require explicit user confirmation for sensitive paths\n    const categories = [...new Set(matches.map(m => m.category))]\n    const descriptions = matches.map(m => m.description).join(', ')\n\n    return {\n      allowed: false,\n      promptUser: true,\n      reason: `Sensitive path access requires confirmation`,\n      message: `\u26A0\uFE0F Sensitive ${operation} operation on: ${descriptions}\\nCategories: ${categories.join(', ')}`,\n      permissionKey: `SensitivePath(${operation}:${filePath})`,\n    }\n  },\n}\n\n/**\n * Check if a path is sensitive (utility function for external use)\n */\nexport function isSensitivePath(\n  filePath: string,\n  operation: 'read' | 'write' | 'delete' | 'execute' = 'read',\n): boolean {\n  return findMatchingSensitivePaths(filePath, operation).length > 0\n}\n\n/**\n * Get sensitive path info for a file\n */\nexport function getSensitivePathInfo(filePath: string): SensitivePath | null {\n  for (const sp of SENSITIVE_PATHS) {\n    if (matchesSensitivePath(filePath, sp)) {\n      return sp\n    }\n  }\n  return null\n}\n"],
-  "mappings": "AAaA,SAAS,SAAS,iBAAiB;AACnC,SAAS,eAAe;AAiCjB,MAAM,kBAAmC;AAAA;AAAA,EAE9C;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,SAAS,QAAQ;AAAA,EAChC;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,SAAS,QAAQ;AAAA,EAChC;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ;AAAA;AAAA,EACvB;AACF;AAKA,SAAS,WAAW,SAAyB;AAC3C,QAAM,OAAO,QAAQ;AACrB,MAAI,WAAW,QAAQ,QAAQ,MAAM,IAAI;AACzC,SAAO,UAAU,QAAQ;AAC3B;AAKA,SAAS,eAAe,SAAyB;AAC/C,QAAM,WAAW,WAAW,OAAO;AAEnC,MAAI,QAAQ,SACT,QAAQ,sBAAsB,MAAM,EACpC,QAAQ,SAAS,kBAAkB,EACnC,QAAQ,OAAO,OAAO,EACtB,QAAQ,qBAAqB,IAAI;AAEpC,SAAO,IAAI,OAAO,IAAI,KAAK,KAAK,GAAG;AACrC;AAKO,SAAS,qBACd,UACA,eACS;AACT,QAAM,iBAAiB,UAAU,QAAQ,QAAQ,CAAC;AAClD,QAAM,QAAQ,eAAe,cAAc,OAAO;AAClD,SAAO,MAAM,KAAK,cAAc;AAClC;AAKA,SAAS,iBACP,UACA,OACgD;AAChD,UAAQ,UAAU;AAAA,IAChB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK,QAAQ;AACX,YAAM,UAAW,MAAM,WAAsB;AAE7C,UAAI,4BAA4B,KAAK,OAAO,GAAG;AAC7C,eAAO;AAAA,MACT;AAEA,UAAI,mDAAmD,KAAK,OAAO,GAAG;AACpE,eAAO;AAAA,MACT;AAEA,UAAI,6CAA6C,KAAK,OAAO,GAAG;AAC9D,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT;AAAA,IACA;AACE,aAAO;AAAA,EACX;AACF;AAKA,SAAS,gBACP,UACA,OACe;AAEf,MAAI,MAAM,UAAW,QAAO,MAAM;AAClC,MAAI,MAAM,SAAU,QAAO,MAAM;AACjC,MAAI,MAAM,KAAM,QAAO,MAAM;AAG7B,MAAI,aAAa,QAAQ;AACvB,UAAM,UAAW,MAAM,WAAsB;AAE7C,UAAM,YAAY,QAAQ;AAAA,MACxB;AAAA,IACF;AACA,QAAI,WAAW;AACb,aAAO,UAAU,CAAC,KAAK;AAAA,IACzB;AAAA,EACF;AAEA,SAAO;AACT;AAKO,SAAS,2BACd,UACA,WACiB;AACjB,SAAO,gBAAgB,OAAO,QAAM;AAElC,QAAI,GAAG,cAAc,CAAC,GAAG,WAAW,SAAS,SAAS,GAAG;AACvD,aAAO;AAAA,IACT;AACA,WAAO,qBAAqB,UAAU,EAAE;AAAA,EAC1C,CAAC;AACH;AAOO,MAAM,qBAAqC;AAAA,EAChD,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU;AAAA;AAAA,EAEV,MAAM,SAA8C;AAClD,UAAM,WAAW,QAAQ,KAAK;AAC9B,UAAM,QAAQ,QAAQ;AAGtB,UAAM,YAAY,iBAAiB,UAAU,KAAK;AAClD,QAAI,CAAC,WAAW;AACd,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,UAAM,WAAW,gBAAgB,UAAU,KAAK;AAChD,QAAI,CAAC,UAAU;AACb,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,UAAM,UAAU,2BAA2B,UAAU,SAAS;AAC9D,QAAI,QAAQ,WAAW,GAAG;AACxB,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,UAAM,UAAU,QAAQ,KAAK,OAAK,EAAE,WAAW;AAC/C,QAAI,SAAS;AACX,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ,aAAa,QAAQ,WAAW;AAAA,QACxC,SAAS,4BAAqB,QAAQ,WAAW,KAAK,QAAQ,QAAQ;AAAA,MACxE;AAAA,IACF;AAGA,UAAM,aAAa,CAAC,GAAG,IAAI,IAAI,QAAQ,IAAI,OAAK,EAAE,QAAQ,CAAC,CAAC;AAC5D,UAAM,eAAe,QAAQ,IAAI,OAAK,EAAE,WAAW,EAAE,KAAK,IAAI;AAE9D,WAAO;AAAA,MACL,SAAS;AAAA,MACT,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,SAAS,0BAAgB,SAAS,kBAAkB,YAAY;AAAA,cAAiB,WAAW,KAAK,IAAI,CAAC;AAAA,MACtG,eAAe,iBAAiB,SAAS,IAAI,QAAQ;AAAA,IACvD;AAAA,EACF;AACF;AAKO,SAAS,gBACd,UACA,YAAqD,QAC5C;AACT,SAAO,2BAA2B,UAAU,SAAS,EAAE,SAAS;AAClE;AAKO,SAAS,qBAAqB,UAAwC;AAC3E,aAAW,MAAM,iBAAiB;AAChC,QAAI,qBAAqB,UAAU,EAAE,GAAG;AACtC,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;",
+  "sourcesContent": ["/**\n * Sensitive Paths Protection Rule\n *\n * Always requires explicit authorization for operations on sensitive paths,\n * regardless of other permissions. These paths contain sensitive data that\n * should never be accessed without user awareness.\n */\n\nimport type {\n  PermissionRule,\n  PermissionContext,\n  PermissionResult,\n} from '../engine/types'\nimport { resolve, normalize } from 'path'\nimport { homedir } from 'os'\n\n/**\n * Categories of sensitive paths with different protection levels\n */\nexport type SensitivePathCategory =\n  | 'credentials' // API keys, passwords, tokens\n  | 'ssh' // SSH keys and config\n  | 'system' // System configuration files\n  | 'browser' // Browser data (cookies, history, passwords)\n  | 'cloud' // Cloud provider credentials\n  | 'development' // Development secrets (env files, etc.)\n  | 'wallet' // Cryptocurrency wallets\n\n/**\n * Sensitive path definition\n */\nexport interface SensitivePath {\n  /** Pattern to match (supports * wildcards) */\n  pattern: string\n  /** Category of sensitive data */\n  category: SensitivePathCategory\n  /** Human-readable description */\n  description: string\n  /** Whether this path is always blocked (vs requiring confirmation) */\n  alwaysBlock?: boolean\n  /** Applicable operations (read, write, delete, execute) */\n  operations?: ('read' | 'write' | 'delete' | 'execute')[]\n}\n\n/**\n * Default sensitive paths list\n */\nexport const SENSITIVE_PATHS: SensitivePath[] = [\n  // SSH\n  {\n    pattern: '~/.ssh/*',\n    category: 'ssh',\n    description: 'SSH keys and configuration',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.ssh',\n    category: 'ssh',\n    description: 'SSH directory',\n    operations: ['write', 'delete'],\n  },\n\n  // Credentials\n  {\n    pattern: '~/.aws/*',\n    category: 'cloud',\n    description: 'AWS credentials and configuration',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.config/gcloud/*',\n    category: 'cloud',\n    description: 'Google Cloud credentials',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.azure/*',\n    category: 'cloud',\n    description: 'Azure credentials',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.config/gh/*',\n    category: 'credentials',\n    description: 'GitHub CLI credentials',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.docker/config.json',\n    category: 'credentials',\n    description: 'Docker registry credentials',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.npmrc',\n    category: 'credentials',\n    description: 'NPM credentials',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.netrc',\n    category: 'credentials',\n    description: 'Network credentials',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.gnupg/*',\n    category: 'credentials',\n    description: 'GPG keys and configuration',\n    operations: ['read', 'write', 'delete'],\n  },\n\n  // Development secrets\n  {\n    pattern: '**/.env',\n    category: 'development',\n    description: 'Environment variables file',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/.env.*',\n    category: 'development',\n    description: 'Environment variables file',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/credentials.json',\n    category: 'development',\n    description: 'Credentials file',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/secrets.json',\n    category: 'development',\n    description: 'Secrets file',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/secrets.yaml',\n    category: 'development',\n    description: 'Secrets file',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/secrets.yml',\n    category: 'development',\n    description: 'Secrets file',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/*.pem',\n    category: 'credentials',\n    description: 'Private key file',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/*.key',\n    category: 'credentials',\n    description: 'Private key file',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/id_rsa',\n    category: 'ssh',\n    description: 'SSH private key',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/id_ed25519',\n    category: 'ssh',\n    description: 'SSH private key',\n    operations: ['read', 'write', 'delete'],\n  },\n\n  // Browser data\n  {\n    pattern: '~/Library/Application Support/Google/Chrome/*',\n    category: 'browser',\n    description: 'Chrome browser data',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/Library/Application Support/Firefox/*',\n    category: 'browser',\n    description: 'Firefox browser data',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.config/google-chrome/*',\n    category: 'browser',\n    description: 'Chrome browser data (Linux)',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.mozilla/firefox/*',\n    category: 'browser',\n    description: 'Firefox browser data (Linux)',\n    operations: ['read', 'write', 'delete'],\n  },\n\n  // System configuration\n  {\n    pattern: '/etc/passwd',\n    category: 'system',\n    description: 'System user database',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '/etc/shadow',\n    category: 'system',\n    description: 'System password hashes',\n    alwaysBlock: true,\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '/etc/sudoers',\n    category: 'system',\n    description: 'Sudo configuration',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '/etc/hosts',\n    category: 'system',\n    description: 'Host file',\n    operations: ['write', 'delete'],\n  },\n\n  // Cryptocurrency wallets\n  {\n    pattern: '~/.bitcoin/*',\n    category: 'wallet',\n    description: 'Bitcoin wallet',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '~/.ethereum/*',\n    category: 'wallet',\n    description: 'Ethereum wallet',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/*wallet*.json',\n    category: 'wallet',\n    description: 'Wallet file',\n    operations: ['read', 'write', 'delete'],\n  },\n  {\n    pattern: '**/*keystore*',\n    category: 'wallet',\n    description: 'Keystore file',\n    operations: ['read', 'write', 'delete'],\n  },\n\n  // Minto/Claude configuration (protect our own config)\n  {\n    pattern: '~/.minto.json',\n    category: 'credentials',\n    description: 'Minto global configuration (may contain API keys)',\n    operations: ['delete'], // Only protect delete, read/write allowed for config\n  },\n]\n\n/**\n * Expand ~ to home directory and normalize path\n */\nfunction expandPath(pattern: string): string {\n  const home = homedir()\n  let expanded = pattern.replace(/^~/, home)\n  return normalize(expanded)\n}\n\n/**\n * Convert glob pattern to regex\n */\nfunction patternToRegex(pattern: string): RegExp {\n  const expanded = expandPath(pattern)\n  // Escape special regex characters except * and **\n  let regex = expanded\n    .replace(/[.+?^${}()|[\\]\\\\]/g, '\\\\$&')\n    .replace(/\\*\\*/g, '<<<DOUBLESTAR>>>')\n    .replace(/\\*/g, '[^/]*')\n    .replace(/<<<DOUBLESTAR>>>/g, '.*')\n\n  return new RegExp(`^${regex}$`, 'i')\n}\n\n/**\n * Check if a path matches a sensitive path pattern\n */\nexport function matchesSensitivePath(\n  filePath: string,\n  sensitivePath: SensitivePath,\n): boolean {\n  const normalizedPath = normalize(resolve(filePath))\n  const regex = patternToRegex(sensitivePath.pattern)\n  return regex.test(normalizedPath)\n}\n\n/**\n * Get operation type from tool name and input\n */\nfunction getOperationType(\n  toolName: string,\n  input: Record<string, unknown>,\n): 'read' | 'write' | 'delete' | 'execute' | null {\n  switch (toolName) {\n    case 'View': // Actual API name for FileReadTool\n    case 'Read':\n    case 'FileRead':\n    case 'Glob':\n    case 'Grep':\n      return 'read'\n    case 'Replace': // Actual API name for FileWriteTool\n    case 'Write':\n    case 'FileWrite':\n    case 'Edit':\n    case 'FileEdit':\n    case 'MultiEdit':\n    case 'NotebookEdit':\n    case 'NotebookEditCell': // Actual API name for NotebookEditTool\n      return 'write'\n    case 'Bash': {\n      const command = (input.command as string) || ''\n      // Check for delete commands\n      if (/\\b(rm|del|rmdir|unlink)\\b/.test(command)) {\n        return 'delete'\n      }\n      // Check for write commands\n      if (/\\b(mv|cp|touch|mkdir|echo\\s+.*>|cat\\s+.*>|tee)\\b/.test(command)) {\n        return 'write'\n      }\n      // Check for read commands\n      if (/\\b(cat|head|tail|less|more|grep|find|ls)\\b/.test(command)) {\n        return 'read'\n      }\n      return 'execute'\n    }\n    default:\n      return null\n  }\n}\n\n/**\n * Extract file path from tool input\n */\nfunction extractFilePath(\n  toolName: string,\n  input: Record<string, unknown>,\n): string | null {\n  // Direct file path tools\n  if (input.file_path) return input.file_path as string\n  if (input.filePath) return input.filePath as string\n  if (input.path) return input.path as string\n\n  // For Bash commands, try to extract file paths\n  if (toolName === 'Bash') {\n    const command = (input.command as string) || ''\n    // Simple extraction - look for paths after common commands\n    const pathMatch = command.match(\n      /(?:cat|rm|mv|cp|head|tail|less|more|touch|mkdir)\\s+[\"']?([^\\s\"'|&;>]+)/,\n    )\n    if (pathMatch) {\n      return pathMatch[1] || null\n    }\n  }\n\n  return null\n}\n\n/**\n * Find matching sensitive paths for a given file path and operation\n */\nexport function findMatchingSensitivePaths(\n  filePath: string,\n  operation: 'read' | 'write' | 'delete' | 'execute',\n): SensitivePath[] {\n  return SENSITIVE_PATHS.filter(sp => {\n    // Check if operation is applicable\n    if (sp.operations && !sp.operations.includes(operation)) {\n      return false\n    }\n    return matchesSensitivePath(filePath, sp)\n  })\n}\n\n/**\n * Sensitive Paths Rule\n *\n * Always prompts for sensitive paths, even if other permissions are granted.\n */\nexport const sensitivePathsRule: PermissionRule = {\n  name: 'sensitive-paths',\n  description: 'Protects sensitive paths from unauthorized access',\n  priority: 100, // Highest priority - checked before all other rules\n\n  check(context: PermissionContext): PermissionResult {\n    const toolName = context.tool.name\n    const input = context.input\n\n    // Get operation type\n    const operation = getOperationType(toolName, input)\n    if (!operation) {\n      return { allowed: true }\n    }\n\n    // Extract file path\n    const filePath = extractFilePath(toolName, input)\n    if (!filePath) {\n      return { allowed: true }\n    }\n\n    // Find matching sensitive paths\n    const matches = findMatchingSensitivePaths(filePath, operation)\n    if (matches.length === 0) {\n      return { allowed: true }\n    }\n\n    // Check if any match is always blocked\n    const blocked = matches.find(m => m.alwaysBlock)\n    if (blocked) {\n      return {\n        allowed: false,\n        reason: `Access to ${blocked.description} is blocked for security`,\n        message: `\uD83D\uDD12 Access denied: ${blocked.description} (${blocked.category})`,\n      }\n    }\n\n    // Require explicit user confirmation for sensitive paths\n    const categories = [...new Set(matches.map(m => m.category))]\n    const descriptions = matches.map(m => m.description).join(', ')\n\n    return {\n      allowed: false,\n      promptUser: true,\n      reason: `Sensitive path access requires confirmation`,\n      message: `\u26A0\uFE0F Sensitive ${operation} operation on: ${descriptions}\\nCategories: ${categories.join(', ')}`,\n      permissionKey: `SensitivePath(${operation}:${filePath})`,\n    }\n  },\n}\n\n/**\n * Check if a path is sensitive (utility function for external use)\n */\nexport function isSensitivePath(\n  filePath: string,\n  operation: 'read' | 'write' | 'delete' | 'execute' = 'read',\n): boolean {\n  return findMatchingSensitivePaths(filePath, operation).length > 0\n}\n\n/**\n * Get sensitive path info for a file\n */\nexport function getSensitivePathInfo(filePath: string): SensitivePath | null {\n  for (const sp of SENSITIVE_PATHS) {\n    if (matchesSensitivePath(filePath, sp)) {\n      return sp\n    }\n  }\n  return null\n}\n"],
+  "mappings": "AAaA,SAAS,SAAS,iBAAiB;AACnC,SAAS,eAAe;AAiCjB,MAAM,kBAAmC;AAAA;AAAA,EAE9C;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,SAAS,QAAQ;AAAA,EAChC;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,SAAS,QAAQ;AAAA,EAChC;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ,SAAS,QAAQ;AAAA,EACxC;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,YAAY,CAAC,QAAQ;AAAA;AAAA,EACvB;AACF;AAKA,SAAS,WAAW,SAAyB;AAC3C,QAAM,OAAO,QAAQ;AACrB,MAAI,WAAW,QAAQ,QAAQ,MAAM,IAAI;AACzC,SAAO,UAAU,QAAQ;AAC3B;AAKA,SAAS,eAAe,SAAyB;AAC/C,QAAM,WAAW,WAAW,OAAO;AAEnC,MAAI,QAAQ,SACT,QAAQ,sBAAsB,MAAM,EACpC,QAAQ,SAAS,kBAAkB,EACnC,QAAQ,OAAO,OAAO,EACtB,QAAQ,qBAAqB,IAAI;AAEpC,SAAO,IAAI,OAAO,IAAI,KAAK,KAAK,GAAG;AACrC;AAKO,SAAS,qBACd,UACA,eACS;AACT,QAAM,iBAAiB,UAAU,QAAQ,QAAQ,CAAC;AAClD,QAAM,QAAQ,eAAe,cAAc,OAAO;AAClD,SAAO,MAAM,KAAK,cAAc;AAClC;AAKA,SAAS,iBACP,UACA,OACgD;AAChD,UAAQ,UAAU;AAAA,IAChB,KAAK;AAAA;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK,QAAQ;AACX,YAAM,UAAW,MAAM,WAAsB;AAE7C,UAAI,4BAA4B,KAAK,OAAO,GAAG;AAC7C,eAAO;AAAA,MACT;AAEA,UAAI,mDAAmD,KAAK,OAAO,GAAG;AACpE,eAAO;AAAA,MACT;AAEA,UAAI,6CAA6C,KAAK,OAAO,GAAG;AAC9D,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT;AAAA,IACA;AACE,aAAO;AAAA,EACX;AACF;AAKA,SAAS,gBACP,UACA,OACe;AAEf,MAAI,MAAM,UAAW,QAAO,MAAM;AAClC,MAAI,MAAM,SAAU,QAAO,MAAM;AACjC,MAAI,MAAM,KAAM,QAAO,MAAM;AAG7B,MAAI,aAAa,QAAQ;AACvB,UAAM,UAAW,MAAM,WAAsB;AAE7C,UAAM,YAAY,QAAQ;AAAA,MACxB;AAAA,IACF;AACA,QAAI,WAAW;AACb,aAAO,UAAU,CAAC,KAAK;AAAA,IACzB;AAAA,EACF;AAEA,SAAO;AACT;AAKO,SAAS,2BACd,UACA,WACiB;AACjB,SAAO,gBAAgB,OAAO,QAAM;AAElC,QAAI,GAAG,cAAc,CAAC,GAAG,WAAW,SAAS,SAAS,GAAG;AACvD,aAAO;AAAA,IACT;AACA,WAAO,qBAAqB,UAAU,EAAE;AAAA,EAC1C,CAAC;AACH;AAOO,MAAM,qBAAqC;AAAA,EAChD,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU;AAAA;AAAA,EAEV,MAAM,SAA8C;AAClD,UAAM,WAAW,QAAQ,KAAK;AAC9B,UAAM,QAAQ,QAAQ;AAGtB,UAAM,YAAY,iBAAiB,UAAU,KAAK;AAClD,QAAI,CAAC,WAAW;AACd,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,UAAM,WAAW,gBAAgB,UAAU,KAAK;AAChD,QAAI,CAAC,UAAU;AACb,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,UAAM,UAAU,2BAA2B,UAAU,SAAS;AAC9D,QAAI,QAAQ,WAAW,GAAG;AACxB,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,UAAM,UAAU,QAAQ,KAAK,OAAK,EAAE,WAAW;AAC/C,QAAI,SAAS;AACX,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ,aAAa,QAAQ,WAAW;AAAA,QACxC,SAAS,4BAAqB,QAAQ,WAAW,KAAK,QAAQ,QAAQ;AAAA,MACxE;AAAA,IACF;AAGA,UAAM,aAAa,CAAC,GAAG,IAAI,IAAI,QAAQ,IAAI,OAAK,EAAE,QAAQ,CAAC,CAAC;AAC5D,UAAM,eAAe,QAAQ,IAAI,OAAK,EAAE,WAAW,EAAE,KAAK,IAAI;AAE9D,WAAO;AAAA,MACL,SAAS;AAAA,MACT,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,SAAS,0BAAgB,SAAS,kBAAkB,YAAY;AAAA,cAAiB,WAAW,KAAK,IAAI,CAAC;AAAA,MACtG,eAAe,iBAAiB,SAAS,IAAI,QAAQ;AAAA,IACvD;AAAA,EACF;AACF;AAKO,SAAS,gBACd,UACA,YAAqD,QAC5C;AACT,SAAO,2BAA2B,UAAU,SAAS,EAAE,SAAS;AAClE;AAKO,SAAS,qBAAqB,UAAwC;AAC3E,aAAW,MAAM,iBAAiB;AAChC,QAAI,qBAAqB,UAAU,EAAE,GAAG;AACtC,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;",
   "names": []
 }

package/dist/core/tokenStats.js

@@ -0,0 +1,9 @@
+const DEFAULT_ESTIMATION_CONFIG = {
+  charsPerToken: 4,
+  defaultInputCostPerMillion: 3,
+  defaultOutputCostPerMillion: 15
+};
+export {
+  DEFAULT_ESTIMATION_CONFIG
+};
+//# sourceMappingURL=tokenStats.js.map

package/dist/core/tokenStats.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/core/tokenStats.ts"],
+  "sourcesContent": ["/**\n * Token Statistics Types\n *\n * Unified type definitions for token tracking across the application.\n * These types are used by TokenStatsManager to provide consistent\n * token statistics at global, agent, and request levels.\n */\n\n/**\n * Token usage statistics from a single API call\n */\nexport interface TokenUsageRecord {\n  /** Input tokens (prompt) */\n  inputTokens: number\n  /** Output tokens (completion) */\n  outputTokens: number\n  /** Cache creation tokens (Anthropic-specific) */\n  cacheCreationTokens: number\n  /** Cache read tokens (Anthropic-specific) */\n  cacheReadTokens: number\n  /** Total tokens (computed: input + output) */\n  totalTokens: number\n  /** Estimated cost in USD */\n  estimatedCostUSD: number\n  /** Data source: 'api' for actual values, 'estimated' for calculated */\n  source: 'api' | 'estimated'\n  /** Timestamp when this record was created */\n  timestamp: number\n  /** Model used for this request */\n  model: string\n}\n\n/**\n * Aggregated token statistics for a scope (global or per-agent)\n */\nexport interface AggregatedTokenStats {\n  /** Total input tokens across all requests */\n  totalInputTokens: number\n  /** Total output tokens across all requests */\n  totalOutputTokens: number\n  /** Total cache creation tokens */\n  totalCacheCreationTokens: number\n  /** Total cache read tokens */\n  totalCacheReadTokens: number\n  /** Grand total tokens (input + output) */\n  grandTotalTokens: number\n  /** Total estimated cost in USD */\n  totalCostUSD: number\n  /** Number of API requests */\n  requestCount: number\n  /** First request timestamp */\n  firstRequestTime?: number\n  /** Last request timestamp */\n  lastRequestTime?: number\n  /** Breakdown by model */\n  byModel: Map<string, ModelTokenStats>\n}\n\n/**\n * Per-model token statistics\n */\nexport interface ModelTokenStats {\n  /** Model name */\n  model: string\n  /** Input tokens for this model */\n  inputTokens: number\n  /** Output tokens for this model */\n  outputTokens: number\n  /** Total tokens for this model */\n  totalTokens: number\n  /** Estimated cost for this model */\n  estimatedCostUSD: number\n  /** Number of requests to this model */\n  requestCount: number\n}\n\n/**\n * Scope identifier for hierarchical statistics\n */\nexport type TokenStatsScope =\n  | { type: 'global' }\n  | { type: 'agent'; agentId: string }\n  | { type: 'request'; requestId: string }\n\n/**\n * Event emitted when token stats change\n */\nexport interface TokenStatsEvent {\n  /** Type of change */\n  eventType: 'usage_recorded' | 'scope_created' | 'scope_completed'\n  /** Scope that changed */\n  scope: TokenStatsScope\n  /** The usage record (for usage_recorded events) */\n  usage?: TokenUsageRecord\n  /** Current aggregated stats for the scope */\n  aggregated: AggregatedTokenStats\n  /** Global aggregated stats (always included for convenience) */\n  globalStats: AggregatedTokenStats\n}\n\n/**\n * Context for token tracking (passed through the API call chain)\n *\n * This is used to associate token usage with specific agents or tool uses,\n * enabling per-agent token tracking.\n */\nexport interface TokenTrackingContext {\n  /** Agent ID if this request is within an agent context */\n  agentId?: string\n  /** Tool use ID if this request is triggered by a tool */\n  toolUseId?: string\n  /** Model being used for this request */\n  model: string\n}\n\n/**\n * Raw token usage from API response (before processing)\n */\nexport interface RawTokenUsage {\n  /** Input tokens from API */\n  inputTokens: number\n  /** Output tokens from API */\n  outputTokens: number\n  /** Cache creation tokens (optional, Anthropic-specific) */\n  cacheCreationTokens?: number\n  /** Cache read tokens (optional, Anthropic/OpenAI) */\n  cacheReadTokens?: number\n}\n\n/**\n * Configuration for token estimation when API doesn't return usage\n */\nexport interface TokenEstimationConfig {\n  /** Average characters per token (default: 4 for mixed English/Chinese) */\n  charsPerToken: number\n  /** Default input cost per million tokens in USD */\n  defaultInputCostPerMillion: number\n  /** Default output cost per million tokens in USD */\n  defaultOutputCostPerMillion: number\n}\n\n/**\n * Default estimation configuration\n */\nexport const DEFAULT_ESTIMATION_CONFIG: TokenEstimationConfig = {\n  charsPerToken: 4,\n  defaultInputCostPerMillion: 3.0,\n  defaultOutputCostPerMillion: 15.0,\n}\n"],
+  "mappings": "AAgJO,MAAM,4BAAmD;AAAA,EAC9D,eAAe;AAAA,EACf,4BAA4B;AAAA,EAC5B,6BAA6B;AAC/B;",
+  "names": []
+}