@within-7/minto 0.4.1 → 0.4.2

package/dist/utils/toolRiskClassification.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/utils/toolRiskClassification.ts"],
-  "sourcesContent": ["/**\n * Tool Risk Classification System\n *\n * Classifies tools into three risk levels for the Smart Safety Mode:\n * - safe: Read-only operations, no side effects\n * - monitored: Has side effects but reversible/low risk\n * - dangerous: Potentially destructive, requires confirmation\n */\n\nexport type RiskLevel = 'safe' | 'monitored' | 'dangerous'\n\n/**\n * Default risk levels for each tool type\n */\nexport const TOOL_RISK_LEVELS: Record<string, RiskLevel> = {\n  // \uD83D\uDFE2 Safe layer: Read-only, no side effects\n  Read: 'safe',\n  Glob: 'safe',\n  Grep: 'safe',\n  LS: 'safe',\n  WebSearch: 'safe',\n  WebFetch: 'safe',\n  Think: 'safe',\n  AskUserQuestion: 'safe',\n  MemoryRead: 'safe',\n  NotebookRead: 'safe',\n  TaskOutput: 'safe',\n  EnterPlanMode: 'safe',\n  ExitPlanMode: 'safe',\n  TaskList: 'safe',\n  TaskGet: 'safe',\n  Skill: 'safe',\n\n  // \uD83D\uDFE1 Monitored layer: Has side effects but reversible/low risk\n  Edit: 'monitored',\n  Write: 'monitored',\n  NotebookEdit: 'monitored',\n  MemoryWrite: 'monitored',\n  TodoWrite: 'monitored',\n  Task: 'monitored',\n  TaskCreate: 'monitored',\n  TaskUpdate: 'monitored',\n  TaskStop: 'monitored',\n\n  // \uD83D\uDD34 Dangerous layer: Requires confirmation (Bash handled separately)\n  Bash: 'dangerous',\n  MCPTool: 'dangerous',\n}\n\n/**\n * Safe Bash command patterns - automatically allowed even in Smart/Strict mode\n * These patterns match common development commands that are low-risk\n */\nexport const SAFE_BASH_PATTERNS: RegExp[] = [\n  // Git - all common operations\n  /^git\\s+(status|diff|log|branch|show|remote|fetch|pull|push|commit|add|checkout|merge|rebase|stash|tag|clone|init|config|rev-parse|symbolic-ref)/i,\n\n  // File viewing (read-only)\n  /^ls(\\s|$)/i,\n  /^cat\\s/i,\n  /^head\\s/i,\n  /^tail\\s/i,\n  /^pwd$/i,\n  /^echo\\s/i,\n  /^which\\s/i,\n  /^tree(\\s|$)/i,\n  /^date$/i,\n  /^whoami$/i,\n  /^find\\s/i,\n  /^wc\\s/i,\n  /^grep\\s/i,\n  /^rg\\s/i,\n  /^less\\s/i,\n  /^more\\s/i,\n  /^file\\s/i,\n  /^stat\\s/i,\n  /^du\\s/i,\n  /^df\\s/i,\n\n  // Package managers - common development operations\n  /^npm\\s+(install|i|ci|run|test|start|build|list|ls|outdated|view|info|init|publish|pack|version|audit|dedupe)/i,\n  /^npx\\s/i,\n  /^bun\\s+(install|i|add|remove|run|test|build|pm|create|init|link|unlink|update|outdated)/i,\n  /^bunx\\s/i,\n  /^yarn\\s+(install|add|remove|run|test|build|init|create|link|unlink|upgrade|outdated)/i,\n  /^pnpm\\s+(install|i|add|remove|run|test|build|init|create|link|unlink|update|outdated)/i,\n  /^pip\\s+(install|list|show|freeze|check)/i,\n  /^pip3\\s+(install|list|show|freeze|check)/i,\n  /^poetry\\s+(install|add|remove|run|build|init|check|show)/i,\n  /^cargo\\s+(build|run|test|check|clippy|fmt|doc|bench|new|init|add|remove)/i,\n  /^go\\s+(build|run|test|get|mod|fmt|vet|generate)/i,\n  /^composer\\s+(install|require|remove|update|dump-autoload)/i,\n  /^gem\\s+(install|list|update)/i,\n  /^bundle\\s+(install|exec|update)/i,\n\n  // Version queries\n  /^(node|npm|bun|yarn|pnpm|python|python3|pip|pip3|cargo|rustc|go|java|ruby|php)\\s+(--version|-v|-V)$/i,\n  /^(node|npm|bun|yarn|pnpm|python|python3|pip|pip3|cargo|rustc|go|java|ruby|php)\\s+-version$/i,\n\n  // Build and test tools\n  /^make(\\s|$)/i,\n  /^cmake\\s/i,\n  /^ninja(\\s|$)/i,\n  /^pytest(\\s|$)/i,\n  /^jest(\\s|$)/i,\n  /^vitest(\\s|$)/i,\n  /^mocha(\\s|$)/i,\n  /^ava(\\s|$)/i,\n  /^tape(\\s|$)/i,\n  /^tap(\\s|$)/i,\n  /^tsc(\\s|$)/i,\n  /^eslint(\\s|$)/i,\n  /^prettier(\\s|$)/i,\n  /^biome(\\s|$)/i,\n\n  // Docker (read-only and common operations)\n  /^docker\\s+(ps|images|logs|inspect|version|info|stats|top|port|diff)/i,\n  /^docker\\s+(build|run|exec|pull|push|start|stop|restart)/i,\n  /^docker-compose\\s+(ps|logs|config|up|down|build|pull|restart)/i,\n\n  // Kubernetes (read-only)\n  /^kubectl\\s+(get|describe|logs|explain|version|config|cluster-info)/i,\n\n  // Process viewing\n  /^ps(\\s|$)/i,\n  /^top$/i,\n  /^htop$/i,\n\n  // Network diagnostics (read-only)\n  /^ping\\s/i,\n  /^traceroute\\s/i,\n  /^dig\\s/i,\n  /^nslookup\\s/i,\n  /^host\\s/i,\n  /^ifconfig$/i,\n  /^ip\\s+(addr|link|route)/i,\n\n  // Archive viewing\n  /^tar\\s+(-t|--list)/i,\n  /^unzip\\s+-l/i,\n  /^zipinfo\\s/i,\n\n  // Text processing\n  /^sort(\\s|$)/i,\n  /^uniq(\\s|$)/i,\n  /^cut(\\s|$)/i,\n  /^awk\\s/i,\n  /^sed\\s/i,\n  /^tr\\s/i,\n  /^diff\\s/i,\n  /^md5sum\\s/i,\n  /^sha256sum\\s/i,\n\n  // Directory operations (safe)\n  /^mkdir\\s/i,\n  /^touch\\s/i,\n  /^cp\\s/i,\n  /^mv\\s/i,\n]\n\n/**\n * Dangerous Bash command patterns - always require confirmation\n * These patterns match potentially destructive commands\n */\nexport const DANGEROUS_BASH_PATTERNS: RegExp[] = [\n  // File deletion\n  /\\brm\\s/i,\n  /\\brmdir\\s/i,\n  /\\bunlink\\s/i,\n\n  // Privilege escalation\n  /\\bsudo\\s/i,\n  /\\bsu\\s/i,\n  /\\bdoas\\s/i,\n  /\\bpkexec\\s/i,\n\n  // Permission changes\n  /\\bchmod\\s/i,\n  /\\bchown\\s/i,\n  /\\bchgrp\\s/i,\n\n  // Disk operations\n  /\\bmkfs\\b/i,\n  /\\bfdisk\\s/i,\n  /\\bparted\\s/i,\n  /\\bdd\\s+if=/i,\n  /\\bshred\\s/i,\n\n  // System control\n  /\\bsystemctl\\s/i,\n  /\\bservice\\s/i,\n  /\\breboot\\b/i,\n  /\\bshutdown\\s/i,\n  /\\bhalt\\b/i,\n  /\\bpoweroff\\b/i,\n\n  // Dangerous redirections\n  />\\s*\\/(?!tmp|dev\\/null)/i, // Redirect to root paths (except /tmp and /dev/null)\n  />\\s*~\\//i, // Redirect to home directory paths\n\n  // Shell execution from network\n  /\\|\\s*(bash|sh|zsh|fish)/i,\n  /curl.*\\|\\s*(bash|sh)/i,\n  /wget.*\\|\\s*(bash|sh)/i,\n\n  // Environment destruction\n  /\\bkillall\\s/i,\n  /\\bpkill\\s/i,\n  /kill\\s+-9/i,\n\n  // Network dangerous\n  /\\bnc\\s+-l/i, // netcat listen mode\n  /\\biptables\\s/i,\n  /\\bufw\\s/i,\n\n  // Crontab\n  /\\bcrontab\\s+-r/i,\n\n  // Git destructive\n  /\\bgit\\s+(reset\\s+--hard|clean\\s+-f|push\\s+--force|push\\s+-f)/i,\n]\n\n/**\n * Classify a Bash command into a risk level\n *\n * @param command The bash command to classify\n * @returns The risk level of the command\n */\nexport function classifyBashCommand(command: string): RiskLevel {\n  // Trim and normalize whitespace\n  const normalizedCommand = command.trim().replace(/\\s+/g, ' ')\n\n  // Check dangerous patterns first (higher priority)\n  if (DANGEROUS_BASH_PATTERNS.some(p => p.test(normalizedCommand))) {\n    return 'dangerous'\n  }\n\n  // Check safe patterns\n  if (SAFE_BASH_PATTERNS.some(p => p.test(normalizedCommand))) {\n    return 'safe'\n  }\n\n  // Default to monitored (allows in Smart mode, asks in Strict mode)\n  return 'monitored'\n}\n\n/**\n * Get the risk level for a tool\n *\n * @param toolName The name of the tool\n * @param input Optional tool input for command-specific classification\n * @returns The risk level of the tool\n */\nexport function getToolRiskLevel(\n  toolName: string,\n  input?: { command?: string },\n): RiskLevel {\n  // Special handling for Bash commands\n  if (toolName === 'Bash' && input?.command) {\n    return classifyBashCommand(input.command)\n  }\n\n  // Look up in the static table\n  return TOOL_RISK_LEVELS[toolName] ?? 'dangerous'\n}\n"],
-  "mappings": "AAcO,MAAM,mBAA8C;AAAA;AAAA,EAEzD,MAAM;AAAA,EACN,MAAM;AAAA,EACN,MAAM;AAAA,EACN,IAAI;AAAA,EACJ,WAAW;AAAA,EACX,UAAU;AAAA,EACV,OAAO;AAAA,EACP,iBAAiB;AAAA,EACjB,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,cAAc;AAAA,EACd,UAAU;AAAA,EACV,SAAS;AAAA,EACT,OAAO;AAAA;AAAA,EAGP,MAAM;AAAA,EACN,OAAO;AAAA,EACP,cAAc;AAAA,EACd,aAAa;AAAA,EACb,WAAW;AAAA,EACX,MAAM;AAAA,EACN,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,UAAU;AAAA;AAAA,EAGV,MAAM;AAAA,EACN,SAAS;AACX;AAMO,MAAM,qBAA+B;AAAA;AAAA,EAE1C;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAMO,MAAM,0BAAoC;AAAA;AAAA,EAE/C;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA;AAAA,EAGA;AACF;AAQO,SAAS,oBAAoB,SAA4B;AAE9D,QAAM,oBAAoB,QAAQ,KAAK,EAAE,QAAQ,QAAQ,GAAG;AAG5D,MAAI,wBAAwB,KAAK,OAAK,EAAE,KAAK,iBAAiB,CAAC,GAAG;AAChE,WAAO;AAAA,EACT;AAGA,MAAI,mBAAmB,KAAK,OAAK,EAAE,KAAK,iBAAiB,CAAC,GAAG;AAC3D,WAAO;AAAA,EACT;AAGA,SAAO;AACT;AASO,SAAS,iBACd,UACA,OACW;AAEX,MAAI,aAAa,UAAU,OAAO,SAAS;AACzC,WAAO,oBAAoB,MAAM,OAAO;AAAA,EAC1C;AAGA,SAAO,iBAAiB,QAAQ,KAAK;AACvC;",
+  "sourcesContent": ["/**\n * Tool Risk Classification System\n *\n * Classifies tools into three risk levels for the Smart Safety Mode:\n * - safe: Read-only operations, no side effects\n * - monitored: Has side effects but reversible/low risk\n * - dangerous: Potentially destructive, requires confirmation\n */\n\nexport type RiskLevel = 'safe' | 'monitored' | 'dangerous'\n\n/**\n * Default risk levels for each tool type\n */\nexport const TOOL_RISK_LEVELS: Record<string, RiskLevel> = {\n  // \uD83D\uDFE2 Safe layer: Read-only, no side effects\n  Read: 'safe',\n  Glob: 'safe',\n  Grep: 'safe',\n  LS: 'safe',\n  WebSearch: 'safe',\n  WebFetch: 'safe',\n  Think: 'safe',\n  AskUserQuestion: 'safe',\n  MemoryRead: 'safe',\n  NotebookRead: 'safe',\n  TaskOutput: 'safe',\n  EnterPlanMode: 'safe',\n  ExitPlanMode: 'safe',\n  TaskList: 'safe',\n  TaskGet: 'safe',\n  Skill: 'safe',\n\n  // \uD83D\uDFE1 Monitored layer: Has side effects but reversible/low risk\n  Edit: 'monitored',\n  Write: 'monitored',\n  NotebookEdit: 'monitored',\n  MemoryWrite: 'monitored',\n  TodoWrite: 'monitored',\n  Task: 'monitored',\n  TaskCreate: 'monitored',\n  TaskUpdate: 'monitored',\n  TaskStop: 'monitored',\n\n  // \uD83D\uDD34 Dangerous layer: Requires confirmation (Bash handled separately)\n  Bash: 'dangerous',\n  MCPTool: 'dangerous',\n}\n\n/**\n * Safe Bash command patterns - automatically allowed even in Smart/Strict mode\n * These patterns match common development commands that are low-risk\n */\nexport const SAFE_BASH_PATTERNS: RegExp[] = [\n  // Git - read-only operations (safe)\n  /^git\\s+(status|diff|log|branch|show|remote|fetch|rev-parse|symbolic-ref)/i,\n\n  // File viewing (read-only)\n  /^ls(\\s|$)/i,\n  /^cat\\s/i,\n  /^head\\s/i,\n  /^tail\\s/i,\n  /^pwd$/i,\n  /^echo\\s/i,\n  /^which\\s/i,\n  /^tree(\\s|$)/i,\n  /^date$/i,\n  /^whoami$/i,\n  /^find\\s/i,\n  /^wc\\s/i,\n  /^grep\\s/i,\n  /^rg\\s/i,\n  /^less\\s/i,\n  /^more\\s/i,\n  /^file\\s/i,\n  /^stat\\s/i,\n  /^du\\s/i,\n  /^df\\s/i,\n\n  // Package managers - common development operations (npx/bunx moved to monitored)\n  /^npm\\s+(install|i|ci|run|test|start|build|list|ls|outdated|view|info|init|publish|pack|version|audit|dedupe)/i,\n  /^bun\\s+(install|i|add|remove|run|test|build|pm|create|init|link|unlink|update|outdated)/i,\n  /^yarn\\s+(install|add|remove|run|test|build|init|create|link|unlink|upgrade|outdated)/i,\n  /^pnpm\\s+(install|i|add|remove|run|test|build|init|create|link|unlink|update|outdated)/i,\n  /^pip\\s+(install|list|show|freeze|check)/i,\n  /^pip3\\s+(install|list|show|freeze|check)/i,\n  /^poetry\\s+(install|add|remove|run|build|init|check|show)/i,\n  /^cargo\\s+(build|run|test|check|clippy|fmt|doc|bench|new|init|add|remove)/i,\n  /^go\\s+(build|run|test|get|mod|fmt|vet|generate)/i,\n  /^composer\\s+(install|require|remove|update|dump-autoload)/i,\n  /^gem\\s+(install|list|update)/i,\n  /^bundle\\s+(install|exec|update)/i,\n\n  // Version queries\n  /^(node|npm|bun|yarn|pnpm|python|python3|pip|pip3|cargo|rustc|go|java|ruby|php)\\s+(--version|-v|-V)$/i,\n  /^(node|npm|bun|yarn|pnpm|python|python3|pip|pip3|cargo|rustc|go|java|ruby|php)\\s+-version$/i,\n\n  // Test tools (make/cmake/ninja moved to monitored \u2014 can execute arbitrary code)\n  /^pytest(\\s|$)/i,\n  /^jest(\\s|$)/i,\n  /^vitest(\\s|$)/i,\n  /^mocha(\\s|$)/i,\n  /^ava(\\s|$)/i,\n  /^tape(\\s|$)/i,\n  /^tap(\\s|$)/i,\n  /^tsc(\\s|$)/i,\n  /^eslint(\\s|$)/i,\n  /^prettier(\\s|$)/i,\n  /^biome(\\s|$)/i,\n\n  // Docker (read-only only \u2014 mutating commands moved to monitored)\n  /^docker\\s+(ps|images|logs|inspect|version|info|stats|top|port|diff)/i,\n  /^docker\\s+(build|pull)/i,\n  /^docker-compose\\s+(ps|logs|config)/i,\n\n  // Kubernetes (read-only)\n  /^kubectl\\s+(get|describe|logs|explain|version|config|cluster-info)/i,\n\n  // Process viewing\n  /^ps(\\s|$)/i,\n  /^top$/i,\n  /^htop$/i,\n\n  // Network diagnostics (read-only)\n  /^ping\\s/i,\n  /^traceroute\\s/i,\n  /^dig\\s/i,\n  /^nslookup\\s/i,\n  /^host\\s/i,\n  /^ifconfig$/i,\n  /^ip\\s+(addr|link|route)/i,\n\n  // Archive viewing\n  /^tar\\s+(-t|--list)/i,\n  /^unzip\\s+-l/i,\n  /^zipinfo\\s/i,\n\n  // Text processing\n  /^sort(\\s|$)/i,\n  /^uniq(\\s|$)/i,\n  /^cut(\\s|$)/i,\n  /^tr\\s/i,\n  /^diff\\s/i,\n  /^md5sum\\s/i,\n  /^sha256sum\\s/i,\n\n  // Directory operations (safe creation; cp/mv moved to monitored)\n  /^mkdir\\s/i,\n  /^touch\\s/i,\n]\n\n/**\n * Monitored Bash command patterns - logged but auto-allowed in Smart mode,\n * require confirmation in Strict mode. Covers mutating but non-destructive commands.\n */\nexport const MONITORED_BASH_PATTERNS: RegExp[] = [\n  // Git - mutating operations\n  /^git\\s+(commit|add|checkout|merge|rebase|stash|tag|push|pull|clone|init|config)/i,\n  // Package runner / arbitrary code execution\n  /^npx\\s/i,\n  /^bunx\\s/i,\n  // Build tools (can execute arbitrary code via Makefiles, etc.)\n  /^make(\\s|$)/i,\n  /^cmake\\s/i,\n  /^ninja(\\s|$)/i,\n  // File copy/move\n  /^cp\\s/i,\n  /^mv\\s/i,\n  // Docker mutating operations\n  /^docker\\s+(start|stop|restart|push)/i,\n  /^docker-compose\\s+(up|down|build|pull|restart)/i,\n]\n\n/**\n * Dangerous Bash command patterns - always require confirmation\n * These patterns match potentially destructive commands\n */\nexport const DANGEROUS_BASH_PATTERNS: RegExp[] = [\n  // File deletion\n  /\\brm\\s/i,\n  /\\brmdir\\s/i,\n  /\\bunlink\\s/i,\n\n  // Privilege escalation\n  /\\bsudo\\s/i,\n  /\\bsu\\s/i,\n  /\\bdoas\\s/i,\n  /\\bpkexec\\s/i,\n\n  // Permission changes\n  /\\bchmod\\s/i,\n  /\\bchown\\s/i,\n  /\\bchgrp\\s/i,\n\n  // Disk operations\n  /\\bmkfs\\b/i,\n  /\\bfdisk\\s/i,\n  /\\bparted\\s/i,\n  /\\bdd\\s+if=/i,\n  /\\bshred\\s/i,\n\n  // System control\n  /\\bsystemctl\\s/i,\n  /\\bservice\\s/i,\n  /\\breboot\\b/i,\n  /\\bshutdown\\s/i,\n  /\\bhalt\\b/i,\n  /\\bpoweroff\\b/i,\n\n  // Dangerous redirections\n  />\\s*\\/(?!tmp|dev\\/null)/i, // Redirect to root paths (except /tmp and /dev/null)\n  />\\s*~\\//i, // Redirect to home directory paths\n\n  // Shell execution from network\n  /\\|\\s*(bash|sh|zsh|fish)/i,\n  /curl.*\\|\\s*(bash|sh)/i,\n  /wget.*\\|\\s*(bash|sh)/i,\n\n  // Environment destruction\n  /\\bkillall\\s/i,\n  /\\bpkill\\s/i,\n  /kill\\s+-9/i,\n\n  // Network dangerous\n  /\\bnc\\s+-l/i, // netcat listen mode\n  /\\biptables\\s/i,\n  /\\bufw\\s/i,\n\n  // Crontab\n  /\\bcrontab\\s+-r/i,\n\n  // Git destructive\n  /\\bgit\\s+(reset\\s+--hard|clean\\s+-f|push\\s+--force|push\\s+-f)/i,\n]\n\n/**\n * Classify a Bash command into a risk level\n *\n * @param command The bash command to classify\n * @returns The risk level of the command\n */\nexport function classifyBashCommand(command: string): RiskLevel {\n  // Trim and normalize whitespace\n  const normalizedCommand = command.trim().replace(/\\s+/g, ' ')\n\n  // Check dangerous patterns first (higher priority)\n  if (DANGEROUS_BASH_PATTERNS.some(p => p.test(normalizedCommand))) {\n    return 'dangerous'\n  }\n\n  // Check safe patterns\n  if (SAFE_BASH_PATTERNS.some(p => p.test(normalizedCommand))) {\n    return 'safe'\n  }\n\n  // Default to monitored (allows in Smart mode, asks in Strict mode)\n  return 'monitored'\n}\n\n/**\n * Get the risk level for a tool\n *\n * @param toolName The name of the tool\n * @param input Optional tool input for command-specific classification\n * @returns The risk level of the tool\n */\nexport function getToolRiskLevel(\n  toolName: string,\n  input?: { command?: string },\n): RiskLevel {\n  // Special handling for Bash commands\n  if (toolName === 'Bash' && input?.command) {\n    return classifyBashCommand(input.command)\n  }\n\n  // Look up in the static table\n  return TOOL_RISK_LEVELS[toolName] ?? 'dangerous'\n}\n"],
+  "mappings": "AAcO,MAAM,mBAA8C;AAAA;AAAA,EAEzD,MAAM;AAAA,EACN,MAAM;AAAA,EACN,MAAM;AAAA,EACN,IAAI;AAAA,EACJ,WAAW;AAAA,EACX,UAAU;AAAA,EACV,OAAO;AAAA,EACP,iBAAiB;AAAA,EACjB,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,cAAc;AAAA,EACd,UAAU;AAAA,EACV,SAAS;AAAA,EACT,OAAO;AAAA;AAAA,EAGP,MAAM;AAAA,EACN,OAAO;AAAA,EACP,cAAc;AAAA,EACd,aAAa;AAAA,EACb,WAAW;AAAA,EACX,MAAM;AAAA,EACN,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,UAAU;AAAA;AAAA,EAGV,MAAM;AAAA,EACN,SAAS;AACX;AAMO,MAAM,qBAA+B;AAAA;AAAA,EAE1C;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AACF;AAMO,MAAM,0BAAoC;AAAA;AAAA,EAE/C;AAAA;AAAA,EAEA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AACF;AAMO,MAAM,0BAAoC;AAAA;AAAA,EAE/C;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA;AAAA,EAGA;AACF;AAQO,SAAS,oBAAoB,SAA4B;AAE9D,QAAM,oBAAoB,QAAQ,KAAK,EAAE,QAAQ,QAAQ,GAAG;AAG5D,MAAI,wBAAwB,KAAK,OAAK,EAAE,KAAK,iBAAiB,CAAC,GAAG;AAChE,WAAO;AAAA,EACT;AAGA,MAAI,mBAAmB,KAAK,OAAK,EAAE,KAAK,iBAAiB,CAAC,GAAG;AAC3D,WAAO;AAAA,EACT;AAGA,SAAO;AACT;AASO,SAAS,iBACd,UACA,OACW;AAEX,MAAI,aAAa,UAAU,OAAO,SAAS;AACzC,WAAO,oBAAoB,MAAM,OAAO;AAAA,EAC1C;AAGA,SAAO,iBAAiB,QAAQ,KAAK;AACvC;",
   "names": []
 }

package/dist/utils/tooling/toolError.js

@@ -0,0 +1,12 @@
+function createToolErrorResult(error, prefix) {
+  const errorMessage = error instanceof Error ? error.message : "Unknown error occurred";
+  return {
+    type: "result",
+    data: { error: errorMessage },
+    resultForAssistant: `${prefix}: ${errorMessage}`
+  };
+}
+export {
+  createToolErrorResult
+};
+//# sourceMappingURL=toolError.js.map

package/dist/utils/tooling/toolError.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/utils/tooling/toolError.ts"],
+  "sourcesContent": ["/**\n * Shared utility for creating consistent tool error results.\n */\nexport function createToolErrorResult(error: unknown, prefix: string) {\n  const errorMessage =\n    error instanceof Error ? error.message : 'Unknown error occurred'\n  return {\n    type: 'result' as const,\n    data: { error: errorMessage },\n    resultForAssistant: `${prefix}: ${errorMessage}`,\n  }\n}\n"],
+  "mappings": "AAGO,SAAS,sBAAsB,OAAgB,QAAgB;AACpE,QAAM,eACJ,iBAAiB,QAAQ,MAAM,UAAU;AAC3C,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAM,EAAE,OAAO,aAAa;AAAA,IAC5B,oBAAoB,GAAG,MAAM,KAAK,YAAY;AAAA,EAChD;AACF;",
+  "names": []
+}

package/dist/version.js

@@ -1,5 +1,5 @@
-const VERSION = "0.4.1";
-const BUILD_DATE = "2026-02-23T23:12:52.791Z";
+const VERSION = "0.4.2";
+const BUILD_DATE = "2026-03-10T11:55:23.450Z";
 export {
   BUILD_DATE,
   VERSION

package/dist/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/version.ts"],
-  "sourcesContent": ["/**\n * Application version\n * This file is auto-generated during build process\n */\n\nexport const VERSION = '0.4.1'\nexport const BUILD_DATE = '2026-02-23T23:12:52.791Z'\n"],
+  "sourcesContent": ["/**\n * Application version\n * This file is auto-generated during build process\n */\n\nexport const VERSION = '0.4.2'\nexport const BUILD_DATE = '2026-03-10T11:55:23.450Z'\n"],
   "mappings": "AAKO,MAAM,UAAU;AAChB,MAAM,aAAa;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@within-7/minto",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "type": "module",
   "description": "AI-powered strategic research and planning assistant",
   "author": "Lib <within-7>",
@@ -57,8 +57,10 @@
     "build:packages": "node scripts/build-platform-packages.mjs",
     "build:website": "node scripts/build-website.mjs",
     "clean": "rm -rf cli.cjs dist binaries packages",
-    "test": "bun test",
-    "test:watch": "bun test --watch",
+    "test": "bun test ./tests ./src",
+    "test:unit": "bun test ./tests",
+    "test:src": "bun test ./src",
+    "test:watch": "bun test --watch ./tests ./src",
     "typecheck": "tsc --noEmit",
     "typecheck:strict": "tsc --noEmit -p tsconfig.strict.json",
     "lint": "prettier --check \"src/**/*.{ts,tsx,js,jsx,json}\"",
@@ -69,11 +71,11 @@
     "release:dry-run": "node scripts/release-full.cjs --dry-run"
   },
   "optionalDependencies": {
-    "@within-7/minto-darwin-arm64": "0.4.1",
-    "@within-7/minto-darwin-x64": "0.4.1",
-    "@within-7/minto-linux-arm64": "0.4.1",
-    "@within-7/minto-linux-x64": "0.4.1",
-    "@within-7/minto-win32-x64": "0.4.1"
+    "@within-7/minto-darwin-arm64": "0.4.2",
+    "@within-7/minto-darwin-x64": "0.4.2",
+    "@within-7/minto-linux-arm64": "0.4.2",
+    "@within-7/minto-linux-x64": "0.4.2",
+    "@within-7/minto-win32-x64": "0.4.2"
   },
   "dependencies": {
     "@anthropic-ai/bedrock-sdk": "^0.12.6",