@within-7/minto 0.4.2 → 0.4.3

package/dist/core/permissions/rules/autoEscalationRule.js

@@ -1,296 +0,0 @@
-import { isSensitivePath, getSensitivePathInfo } from "./sensitivePathsRule.js";
-import {
-  isOutsideProject,
-  calculateExternalOperationRisk
-} from "./projectBoundaryRule.js";
-import { logSecurityEvent } from "../auditLog.js";
-const ESCALATION_PATTERNS = [
-  // Privilege escalation
-  {
-    pattern: /\bsudo\s+/,
-    reason: "privilege_escalation",
-    description: "sudo command"
-  },
-  {
-    pattern: /\bsu\s+(-|\w)/,
-    reason: "privilege_escalation",
-    description: "su command"
-  },
-  {
-    pattern: /\bchmod\s+[0-7]*[4-7][0-7]*\s/,
-    reason: "privilege_escalation",
-    description: "chmod with execute permissions"
-  },
-  {
-    pattern: /\bchown\s+/,
-    reason: "privilege_escalation",
-    description: "chown command"
-  },
-  // Dangerous file operations
-  {
-    pattern: /\brm\s+(-r|-rf|-fr)\s+/,
-    reason: "dangerous_command",
-    description: "recursive delete"
-  },
-  {
-    pattern: /\bdd\s+.*if=/,
-    reason: "dangerous_command",
-    description: "dd command"
-  },
-  {
-    pattern: /\bmkfs\b/,
-    reason: "dangerous_command",
-    description: "filesystem creation"
-  },
-  {
-    pattern: />\s*\/dev\/(sd|hd|nvme)/,
-    reason: "dangerous_command",
-    description: "write to disk device"
-  },
-  // Network access (potential data exfiltration)
-  {
-    pattern: /\bcurl\s+.*(-d|--data|-F|--form)/,
-    reason: "network_access",
-    description: "curl with data upload"
-  },
-  {
-    pattern: /\bwget\s+--post/,
-    reason: "network_access",
-    description: "wget with POST"
-  },
-  {
-    pattern: /\bnc\s+/,
-    reason: "network_access",
-    description: "netcat"
-  },
-  {
-    pattern: /\bssh\s+/,
-    reason: "network_access",
-    description: "SSH connection"
-  },
-  {
-    pattern: /\bscp\s+/,
-    reason: "network_access",
-    description: "SCP file transfer"
-  },
-  {
-    pattern: /\brsync\s+.*:/,
-    reason: "network_access",
-    description: "rsync to remote"
-  },
-  // Bulk operations
-  {
-    pattern: /\bfind\s+.*-exec.*\brm\b/,
-    reason: "bulk_operation",
-    description: "find with delete"
-  },
-  {
-    pattern: /\bxargs\s+.*\brm\b/,
-    reason: "bulk_operation",
-    description: "xargs with delete"
-  },
-  // Shell/script execution (potential for hidden actions)
-  {
-    pattern: /\beval\s+/,
-    reason: "dangerous_command",
-    description: "eval command"
-  },
-  {
-    pattern: /\bsource\s+/,
-    reason: "dangerous_command",
-    description: "source command"
-  },
-  {
-    pattern: /\.\s+\//,
-    reason: "dangerous_command",
-    description: "dot source"
-  }
-];
-function matchesEscalationPattern(command) {
-  for (const { pattern, reason, description } of ESCALATION_PATTERNS) {
-    if (pattern.test(command)) {
-      return { reason, description };
-    }
-  }
-  return null;
-}
-function getOperationType(toolName, input) {
-  switch (toolName) {
-    case "View":
-    // Actual API name for FileReadTool
-    case "Read":
-    case "FileRead":
-    case "Glob":
-    case "Grep":
-      return "read";
-    case "Replace":
-    // Actual API name for FileWriteTool
-    case "Write":
-    case "FileWrite":
-    case "Edit":
-    case "FileEdit":
-    case "MultiEdit":
-    case "NotebookEdit":
-    case "NotebookEditCell":
-      return "write";
-    case "Bash": {
-      const command = input.command || "";
-      if (/\b(rm|del|rmdir|unlink)\b/.test(command)) {
-        return "delete";
-      }
-      return "execute";
-    }
-    default:
-      return null;
-  }
-}
-function extractFilePath(input) {
-  if (input.file_path) return input.file_path;
-  if (input.filePath) return input.filePath;
-  if (input.path) return input.path;
-  return null;
-}
-const ESCALATION_MESSAGES = {
-  sensitive_path: "\u{1F510} This operation accesses sensitive files",
-  critical_external: "\u{1F6A8} This operation affects files far outside your project",
-  dangerous_command: "\u26A0\uFE0F This command is potentially destructive",
-  bulk_operation: "\u{1F4E6} This operation affects multiple files",
-  privilege_escalation: "\u{1F511} This command may escalate system privileges",
-  network_access: "\u{1F310} This command accesses the network"
-};
-const autoEscalationRule = {
-  name: "auto-escalation",
-  description: "Requires confirmation for high-risk operations",
-  priority: 85,
-  // Below sensitive-paths and project-boundary, but above safe-mode
-  check(context) {
-    const toolName = context.tool.name;
-    const input = context.input;
-    if (toolName === "Bash") {
-      const command = input.command || "";
-      const match = matchesEscalationPattern(command);
-      if (match) {
-        logSecurityEvent({
-          eventType: "security_warning",
-          toolName,
-          operation: "execute",
-          target: command,
-          outcome: "denied",
-          // Will be 'allowed' if user approves
-          riskLevel: "high",
-          context: {
-            escalationReason: match.reason,
-            escalationDescription: match.description
-          },
-          triggeredRule: "auto-escalation"
-        });
-        return {
-          allowed: false,
-          promptUser: true,
-          reason: `High-risk operation: ${match.description}`,
-          message: `${ESCALATION_MESSAGES[match.reason]}
-
-Command: ${command.length > 100 ? command.substring(0, 100) + "..." : command}
-
-Reason: ${match.description}`,
-          permissionKey: `AutoEscalate(${match.reason}:${command.substring(0, 50)})`
-        };
-      }
-    }
-    const operation = getOperationType(toolName, input);
-    if (operation && operation !== "read") {
-      const filePath = extractFilePath(input);
-      if (filePath) {
-        if (isSensitivePath(filePath, operation)) {
-          const info = getSensitivePathInfo(filePath);
-          logSecurityEvent({
-            eventType: "sensitive_path_access",
-            toolName,
-            operation,
-            target: filePath,
-            outcome: "denied",
-            riskLevel: "high",
-            context: {
-              category: info?.category,
-              description: info?.description
-            },
-            triggeredRule: "auto-escalation"
-          });
-          return {
-            allowed: false,
-            promptUser: true,
-            reason: `Sensitive path: ${info?.description || "unknown"}`,
-            message: `${ESCALATION_MESSAGES.sensitive_path}
-
-Path: ${filePath}
-Category: ${info?.category || "unknown"}`,
-            permissionKey: `AutoEscalate(sensitive:${filePath})`
-          };
-        }
-        if (isOutsideProject(filePath)) {
-          const risk = calculateExternalOperationRisk(operation, filePath);
-          if (risk === "critical" || risk === "high") {
-            logSecurityEvent({
-              eventType: "external_operation",
-              toolName,
-              operation,
-              target: filePath,
-              outcome: "denied",
-              riskLevel: risk,
-              triggeredRule: "auto-escalation"
-            });
-            return {
-              allowed: false,
-              promptUser: true,
-              reason: `${risk} risk external operation`,
-              message: `${ESCALATION_MESSAGES.critical_external}
-
-Path: ${filePath}
-Risk Level: ${risk.toUpperCase()}`,
-              permissionKey: `AutoEscalate(external:${filePath})`
-            };
-          }
-        }
-      }
-    }
-    return { allowed: true };
-  }
-};
-function shouldAutoEscalate(toolName, input) {
-  if (toolName === "Bash") {
-    const command = input.command || "";
-    const match = matchesEscalationPattern(command);
-    if (match) {
-      return { shouldEscalate: true, ...match };
-    }
-  }
-  const filePath = extractFilePath(input);
-  if (filePath) {
-    const operation = getOperationType(toolName, input);
-    if (operation && operation !== "read") {
-      if (isSensitivePath(filePath, operation)) {
-        return {
-          shouldEscalate: true,
-          reason: "sensitive_path",
-          description: "Sensitive file access"
-        };
-      }
-      if (isOutsideProject(filePath)) {
-        const risk = calculateExternalOperationRisk(operation, filePath);
-        if (risk === "critical" || risk === "high") {
-          return {
-            shouldEscalate: true,
-            reason: "critical_external",
-            description: `${risk} risk external operation`
-          };
-        }
-      }
-    }
-  }
-  return { shouldEscalate: false };
-}
-export {
-  autoEscalationRule,
-  shouldAutoEscalate
-};
-//# sourceMappingURL=autoEscalationRule.js.map

package/dist/core/permissions/rules/autoEscalationRule.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/core/permissions/rules/autoEscalationRule.ts"],
-  "sourcesContent": ["/**\n * Auto-Escalation Rule\n *\n * Automatically escalates permission requirements when detecting\n * high-risk operations, even if safe mode is not explicitly enabled.\n * This provides defense-in-depth by requiring confirmation for\n * particularly dangerous actions regardless of mode.\n */\n\nimport type {\n  PermissionRule,\n  PermissionContext,\n  PermissionResult,\n} from '../engine/types'\nimport { isSensitivePath, getSensitivePathInfo } from './sensitivePathsRule'\nimport {\n  isOutsideProject,\n  calculateExternalOperationRisk,\n} from './projectBoundaryRule'\nimport { logSecurityEvent } from '../auditLog'\n\n/**\n * Escalation trigger reasons\n */\nexport type EscalationReason =\n  | 'sensitive_path' // Accessing sensitive paths\n  | 'critical_external' // Critical external operation\n  | 'dangerous_command' // Known dangerous command pattern\n  | 'bulk_operation' // Bulk file operations\n  | 'privilege_escalation' // Commands that might escalate privileges\n  | 'network_access' // Network-related commands\n\n/**\n * Patterns that should always trigger escalation\n */\nconst ESCALATION_PATTERNS: Array<{\n  pattern: RegExp\n  reason: EscalationReason\n  description: string\n}> = [\n  // Privilege escalation\n  {\n    pattern: /\\bsudo\\s+/,\n    reason: 'privilege_escalation',\n    description: 'sudo command',\n  },\n  {\n    pattern: /\\bsu\\s+(-|\\w)/,\n    reason: 'privilege_escalation',\n    description: 'su command',\n  },\n  {\n    pattern: /\\bchmod\\s+[0-7]*[4-7][0-7]*\\s/,\n    reason: 'privilege_escalation',\n    description: 'chmod with execute permissions',\n  },\n  {\n    pattern: /\\bchown\\s+/,\n    reason: 'privilege_escalation',\n    description: 'chown command',\n  },\n\n  // Dangerous file operations\n  {\n    pattern: /\\brm\\s+(-r|-rf|-fr)\\s+/,\n    reason: 'dangerous_command',\n    description: 'recursive delete',\n  },\n  {\n    pattern: /\\bdd\\s+.*if=/,\n    reason: 'dangerous_command',\n    description: 'dd command',\n  },\n  {\n    pattern: /\\bmkfs\\b/,\n    reason: 'dangerous_command',\n    description: 'filesystem creation',\n  },\n  {\n    pattern: />\\s*\\/dev\\/(sd|hd|nvme)/,\n    reason: 'dangerous_command',\n    description: 'write to disk device',\n  },\n\n  // Network access (potential data exfiltration)\n  {\n    pattern: /\\bcurl\\s+.*(-d|--data|-F|--form)/,\n    reason: 'network_access',\n    description: 'curl with data upload',\n  },\n  {\n    pattern: /\\bwget\\s+--post/,\n    reason: 'network_access',\n    description: 'wget with POST',\n  },\n  {\n    pattern: /\\bnc\\s+/,\n    reason: 'network_access',\n    description: 'netcat',\n  },\n  {\n    pattern: /\\bssh\\s+/,\n    reason: 'network_access',\n    description: 'SSH connection',\n  },\n  {\n    pattern: /\\bscp\\s+/,\n    reason: 'network_access',\n    description: 'SCP file transfer',\n  },\n  {\n    pattern: /\\brsync\\s+.*:/,\n    reason: 'network_access',\n    description: 'rsync to remote',\n  },\n\n  // Bulk operations\n  {\n    pattern: /\\bfind\\s+.*-exec.*\\brm\\b/,\n    reason: 'bulk_operation',\n    description: 'find with delete',\n  },\n  {\n    pattern: /\\bxargs\\s+.*\\brm\\b/,\n    reason: 'bulk_operation',\n    description: 'xargs with delete',\n  },\n\n  // Shell/script execution (potential for hidden actions)\n  {\n    pattern: /\\beval\\s+/,\n    reason: 'dangerous_command',\n    description: 'eval command',\n  },\n  {\n    pattern: /\\bsource\\s+/,\n    reason: 'dangerous_command',\n    description: 'source command',\n  },\n  {\n    pattern: /\\.\\s+\\//,\n    reason: 'dangerous_command',\n    description: 'dot source',\n  },\n]\n\n/**\n * Check if a command matches any escalation pattern\n */\nfunction matchesEscalationPattern(\n  command: string,\n): { reason: EscalationReason; description: string } | null {\n  for (const { pattern, reason, description } of ESCALATION_PATTERNS) {\n    if (pattern.test(command)) {\n      return { reason, description }\n    }\n  }\n  return null\n}\n\n/**\n * Get operation type from tool\n */\nfunction getOperationType(\n  toolName: string,\n  input: Record<string, unknown>,\n): 'read' | 'write' | 'delete' | 'execute' | null {\n  switch (toolName) {\n    case 'View': // Actual API name for FileReadTool\n    case 'Read':\n    case 'FileRead':\n    case 'Glob':\n    case 'Grep':\n      return 'read'\n    case 'Replace': // Actual API name for FileWriteTool\n    case 'Write':\n    case 'FileWrite':\n    case 'Edit':\n    case 'FileEdit':\n    case 'MultiEdit':\n    case 'NotebookEdit':\n    case 'NotebookEditCell': // Actual API name for NotebookEditTool\n      return 'write'\n    case 'Bash': {\n      const command = (input.command as string) || ''\n      if (/\\b(rm|del|rmdir|unlink)\\b/.test(command)) {\n        return 'delete'\n      }\n      return 'execute'\n    }\n    default:\n      return null\n  }\n}\n\n/**\n * Extract file path from input\n */\nfunction extractFilePath(input: Record<string, unknown>): string | null {\n  if (input.file_path) return input.file_path as string\n  if (input.filePath) return input.filePath as string\n  if (input.path) return input.path as string\n  return null\n}\n\n/**\n * Escalation messages by reason\n */\nconst ESCALATION_MESSAGES: Record<EscalationReason, string> = {\n  sensitive_path: '\uD83D\uDD10 This operation accesses sensitive files',\n  critical_external: '\uD83D\uDEA8 This operation affects files far outside your project',\n  dangerous_command: '\u26A0\uFE0F This command is potentially destructive',\n  bulk_operation: '\uD83D\uDCE6 This operation affects multiple files',\n  privilege_escalation: '\uD83D\uDD11 This command may escalate system privileges',\n  network_access: '\uD83C\uDF10 This command accesses the network',\n}\n\n/**\n * Auto-Escalation Rule\n *\n * Requires confirmation for high-risk operations even without safe mode.\n */\nexport const autoEscalationRule: PermissionRule = {\n  name: 'auto-escalation',\n  description: 'Requires confirmation for high-risk operations',\n  priority: 85, // Below sensitive-paths and project-boundary, but above safe-mode\n\n  check(context: PermissionContext): PermissionResult {\n    const toolName = context.tool.name\n    const input = context.input\n\n    // For Bash commands, check escalation patterns\n    if (toolName === 'Bash') {\n      const command = (input.command as string) || ''\n      const match = matchesEscalationPattern(command)\n\n      if (match) {\n        // Log the escalation trigger\n        logSecurityEvent({\n          eventType: 'security_warning',\n          toolName,\n          operation: 'execute',\n          target: command,\n          outcome: 'denied', // Will be 'allowed' if user approves\n          riskLevel: 'high',\n          context: {\n            escalationReason: match.reason,\n            escalationDescription: match.description,\n          },\n          triggeredRule: 'auto-escalation',\n        })\n\n        return {\n          allowed: false,\n          promptUser: true,\n          reason: `High-risk operation: ${match.description}`,\n          message: `${ESCALATION_MESSAGES[match.reason]}\\n\\nCommand: ${command.length > 100 ? command.substring(0, 100) + '...' : command}\\n\\nReason: ${match.description}`,\n          permissionKey: `AutoEscalate(${match.reason}:${command.substring(0, 50)})`,\n        }\n      }\n    }\n\n    // Check file operations for sensitive paths\n    const operation = getOperationType(toolName, input)\n    if (operation && operation !== 'read') {\n      const filePath = extractFilePath(input)\n\n      if (filePath) {\n        // Check if it's a sensitive path\n        if (isSensitivePath(filePath, operation)) {\n          const info = getSensitivePathInfo(filePath)\n\n          logSecurityEvent({\n            eventType: 'sensitive_path_access',\n            toolName,\n            operation,\n            target: filePath,\n            outcome: 'denied',\n            riskLevel: 'high',\n            context: {\n              category: info?.category,\n              description: info?.description,\n            },\n            triggeredRule: 'auto-escalation',\n          })\n\n          return {\n            allowed: false,\n            promptUser: true,\n            reason: `Sensitive path: ${info?.description || 'unknown'}`,\n            message: `${ESCALATION_MESSAGES.sensitive_path}\\n\\nPath: ${filePath}\\nCategory: ${info?.category || 'unknown'}`,\n            permissionKey: `AutoEscalate(sensitive:${filePath})`,\n          }\n        }\n\n        // Check if it's a critical external operation\n        if (isOutsideProject(filePath)) {\n          const risk = calculateExternalOperationRisk(operation, filePath)\n\n          if (risk === 'critical' || risk === 'high') {\n            logSecurityEvent({\n              eventType: 'external_operation',\n              toolName,\n              operation,\n              target: filePath,\n              outcome: 'denied',\n              riskLevel: risk,\n              triggeredRule: 'auto-escalation',\n            })\n\n            return {\n              allowed: false,\n              promptUser: true,\n              reason: `${risk} risk external operation`,\n              message: `${ESCALATION_MESSAGES.critical_external}\\n\\nPath: ${filePath}\\nRisk Level: ${risk.toUpperCase()}`,\n              permissionKey: `AutoEscalate(external:${filePath})`,\n            }\n          }\n        }\n      }\n    }\n\n    return { allowed: true }\n  },\n}\n\n/**\n * Check if an operation should trigger auto-escalation\n */\nexport function shouldAutoEscalate(\n  toolName: string,\n  input: Record<string, unknown>,\n): {\n  shouldEscalate: boolean\n  reason?: EscalationReason\n  description?: string\n} {\n  // Check command patterns\n  if (toolName === 'Bash') {\n    const command = (input.command as string) || ''\n    const match = matchesEscalationPattern(command)\n    if (match) {\n      return { shouldEscalate: true, ...match }\n    }\n  }\n\n  // Check file paths\n  const filePath = extractFilePath(input)\n  if (filePath) {\n    const operation = getOperationType(toolName, input)\n\n    if (operation && operation !== 'read') {\n      if (isSensitivePath(filePath, operation)) {\n        return {\n          shouldEscalate: true,\n          reason: 'sensitive_path',\n          description: 'Sensitive file access',\n        }\n      }\n\n      if (isOutsideProject(filePath)) {\n        const risk = calculateExternalOperationRisk(operation, filePath)\n        if (risk === 'critical' || risk === 'high') {\n          return {\n            shouldEscalate: true,\n            reason: 'critical_external',\n            description: `${risk} risk external operation`,\n          }\n        }\n      }\n    }\n  }\n\n  return { shouldEscalate: false }\n}\n"],
-  "mappings": "AAcA,SAAS,iBAAiB,4BAA4B;AACtD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,wBAAwB;AAgBjC,MAAM,sBAID;AAAA;AAAA,EAEH;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA;AAAA,EAGA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AACF;AAKA,SAAS,yBACP,SAC0D;AAC1D,aAAW,EAAE,SAAS,QAAQ,YAAY,KAAK,qBAAqB;AAClE,QAAI,QAAQ,KAAK,OAAO,GAAG;AACzB,aAAO,EAAE,QAAQ,YAAY;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;AAKA,SAAS,iBACP,UACA,OACgD;AAChD,UAAQ,UAAU;AAAA,IAChB,KAAK;AAAA;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK,QAAQ;AACX,YAAM,UAAW,MAAM,WAAsB;AAC7C,UAAI,4BAA4B,KAAK,OAAO,GAAG;AAC7C,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT;AAAA,IACA;AACE,aAAO;AAAA,EACX;AACF;AAKA,SAAS,gBAAgB,OAA+C;AACtE,MAAI,MAAM,UAAW,QAAO,MAAM;AAClC,MAAI,MAAM,SAAU,QAAO,MAAM;AACjC,MAAI,MAAM,KAAM,QAAO,MAAM;AAC7B,SAAO;AACT;AAKA,MAAM,sBAAwD;AAAA,EAC5D,gBAAgB;AAAA,EAChB,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,gBAAgB;AAClB;AAOO,MAAM,qBAAqC;AAAA,EAChD,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU;AAAA;AAAA,EAEV,MAAM,SAA8C;AAClD,UAAM,WAAW,QAAQ,KAAK;AAC9B,UAAM,QAAQ,QAAQ;AAGtB,QAAI,aAAa,QAAQ;AACvB,YAAM,UAAW,MAAM,WAAsB;AAC7C,YAAM,QAAQ,yBAAyB,OAAO;AAE9C,UAAI,OAAO;AAET,yBAAiB;AAAA,UACf,WAAW;AAAA,UACX;AAAA,UACA,WAAW;AAAA,UACX,QAAQ;AAAA,UACR,SAAS;AAAA;AAAA,UACT,WAAW;AAAA,UACX,SAAS;AAAA,YACP,kBAAkB,MAAM;AAAA,YACxB,uBAAuB,MAAM;AAAA,UAC/B;AAAA,UACA,eAAe;AAAA,QACjB,CAAC;AAED,eAAO;AAAA,UACL,SAAS;AAAA,UACT,YAAY;AAAA,UACZ,QAAQ,wBAAwB,MAAM,WAAW;AAAA,UACjD,SAAS,GAAG,oBAAoB,MAAM,MAAM,CAAC;AAAA;AAAA,WAAgB,QAAQ,SAAS,MAAM,QAAQ,UAAU,GAAG,GAAG,IAAI,QAAQ,OAAO;AAAA;AAAA,UAAe,MAAM,WAAW;AAAA,UAC/J,eAAe,gBAAgB,MAAM,MAAM,IAAI,QAAQ,UAAU,GAAG,EAAE,CAAC;AAAA,QACzE;AAAA,MACF;AAAA,IACF;AAGA,UAAM,YAAY,iBAAiB,UAAU,KAAK;AAClD,QAAI,aAAa,cAAc,QAAQ;AACrC,YAAM,WAAW,gBAAgB,KAAK;AAEtC,UAAI,UAAU;AAEZ,YAAI,gBAAgB,UAAU,SAAS,GAAG;AACxC,gBAAM,OAAO,qBAAqB,QAAQ;AAE1C,2BAAiB;AAAA,YACf,WAAW;AAAA,YACX;AAAA,YACA;AAAA,YACA,QAAQ;AAAA,YACR,SAAS;AAAA,YACT,WAAW;AAAA,YACX,SAAS;AAAA,cACP,UAAU,MAAM;AAAA,cAChB,aAAa,MAAM;AAAA,YACrB;AAAA,YACA,eAAe;AAAA,UACjB,CAAC;AAED,iBAAO;AAAA,YACL,SAAS;AAAA,YACT,YAAY;AAAA,YACZ,QAAQ,mBAAmB,MAAM,eAAe,SAAS;AAAA,YACzD,SAAS,GAAG,oBAAoB,cAAc;AAAA;AAAA,QAAa,QAAQ;AAAA,YAAe,MAAM,YAAY,SAAS;AAAA,YAC7G,eAAe,0BAA0B,QAAQ;AAAA,UACnD;AAAA,QACF;AAGA,YAAI,iBAAiB,QAAQ,GAAG;AAC9B,gBAAM,OAAO,+BAA+B,WAAW,QAAQ;AAE/D,cAAI,SAAS,cAAc,SAAS,QAAQ;AAC1C,6BAAiB;AAAA,cACf,WAAW;AAAA,cACX;AAAA,cACA;AAAA,cACA,QAAQ;AAAA,cACR,SAAS;AAAA,cACT,WAAW;AAAA,cACX,eAAe;AAAA,YACjB,CAAC;AAED,mBAAO;AAAA,cACL,SAAS;AAAA,cACT,YAAY;AAAA,cACZ,QAAQ,GAAG,IAAI;AAAA,cACf,SAAS,GAAG,oBAAoB,iBAAiB;AAAA;AAAA,QAAa,QAAQ;AAAA,cAAiB,KAAK,YAAY,CAAC;AAAA,cACzG,eAAe,yBAAyB,QAAQ;AAAA,YAClD;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACF;AAKO,SAAS,mBACd,UACA,OAKA;AAEA,MAAI,aAAa,QAAQ;AACvB,UAAM,UAAW,MAAM,WAAsB;AAC7C,UAAM,QAAQ,yBAAyB,OAAO;AAC9C,QAAI,OAAO;AACT,aAAO,EAAE,gBAAgB,MAAM,GAAG,MAAM;AAAA,IAC1C;AAAA,EACF;AAGA,QAAM,WAAW,gBAAgB,KAAK;AACtC,MAAI,UAAU;AACZ,UAAM,YAAY,iBAAiB,UAAU,KAAK;AAElD,QAAI,aAAa,cAAc,QAAQ;AACrC,UAAI,gBAAgB,UAAU,SAAS,GAAG;AACxC,eAAO;AAAA,UACL,gBAAgB;AAAA,UAChB,QAAQ;AAAA,UACR,aAAa;AAAA,QACf;AAAA,MACF;AAEA,UAAI,iBAAiB,QAAQ,GAAG;AAC9B,cAAM,OAAO,+BAA+B,WAAW,QAAQ;AAC/D,YAAI,SAAS,cAAc,SAAS,QAAQ;AAC1C,iBAAO;AAAA,YACL,gBAAgB;AAAA,YAChB,QAAQ;AAAA,YACR,aAAa,GAAG,IAAI;AAAA,UACtB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,gBAAgB,MAAM;AACjC;",
-  "names": []
-}

package/dist/core/permissions/rules/index.js

@@ -1,46 +0,0 @@
-export * from "./planModeRule.js";
-export * from "./safeModeRule.js";
-export * from "./allowedToolsRule.js";
-export * from "./sensitivePathsRule.js";
-export * from "./projectBoundaryRule.js";
-export * from "./autoEscalationRule.js";
-import { planModeRule } from "./planModeRule.js";
-import { safeModeRule } from "./safeModeRule.js";
-import { allowedToolsRule } from "./allowedToolsRule.js";
-import { sensitivePathsRule } from "./sensitivePathsRule.js";
-import { projectBoundaryRule } from "./projectBoundaryRule.js";
-import { autoEscalationRule } from "./autoEscalationRule.js";
-const builtInRules = [
-  sensitivePathsRule,
-  // Priority 100 - Sensitive paths always checked first
-  projectBoundaryRule,
-  // Priority 95 - External operations
-  planModeRule,
-  // Priority 95 - Plan mode restrictions
-  safeModeRule,
-  // Priority 90 - Safe mode restrictions
-  autoEscalationRule,
-  // Priority 85 - Auto-escalation for high-risk ops
-  allowedToolsRule
-  // Priority 50 - Standard tool permissions
-];
-const securityRules = [
-  sensitivePathsRule,
-  projectBoundaryRule,
-  autoEscalationRule
-];
-const modeRules = [planModeRule, safeModeRule];
-function registerBuiltInRules(engine) {
-  engine.registerRules(builtInRules);
-}
-function registerSecurityRules(engine) {
-  engine.registerRules(securityRules);
-}
-export {
-  builtInRules,
-  modeRules,
-  registerBuiltInRules,
-  registerSecurityRules,
-  securityRules
-};
-//# sourceMappingURL=index.js.map

package/dist/core/permissions/rules/index.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/core/permissions/rules/index.ts"],
-  "sourcesContent": ["/**\n * Permission Rules Index\n *\n * Export all built-in permission rules.\n * Rules are sorted by priority (highest first):\n * - sensitivePathsRule: 100 (highest - always checked first)\n * - projectBoundaryRule: 95\n * - planModeRule: 95 (same level as project boundary)\n * - safeModeRule: 90\n * - autoEscalationRule: 85\n * - allowedToolsRule: 50 (lowest - checked last)\n */\n\nexport * from './planModeRule'\nexport * from './safeModeRule'\nexport * from './allowedToolsRule'\nexport * from './sensitivePathsRule'\nexport * from './projectBoundaryRule'\nexport * from './autoEscalationRule'\n\nimport { planModeRule } from './planModeRule'\nimport { safeModeRule } from './safeModeRule'\nimport { allowedToolsRule } from './allowedToolsRule'\nimport { sensitivePathsRule } from './sensitivePathsRule'\nimport { projectBoundaryRule } from './projectBoundaryRule'\nimport { autoEscalationRule } from './autoEscalationRule'\nimport type { PermissionRule } from '../engine/types'\n\n/**\n * All built-in permission rules in priority order (highest first)\n */\nexport const builtInRules: PermissionRule[] = [\n  sensitivePathsRule, // Priority 100 - Sensitive paths always checked first\n  projectBoundaryRule, // Priority 95 - External operations\n  planModeRule, // Priority 95 - Plan mode restrictions\n  safeModeRule, // Priority 90 - Safe mode restrictions\n  autoEscalationRule, // Priority 85 - Auto-escalation for high-risk ops\n  allowedToolsRule, // Priority 50 - Standard tool permissions\n]\n\n/**\n * Security-focused rules (high priority)\n */\nexport const securityRules: PermissionRule[] = [\n  sensitivePathsRule,\n  projectBoundaryRule,\n  autoEscalationRule,\n]\n\n/**\n * Mode-based rules\n */\nexport const modeRules: PermissionRule[] = [planModeRule, safeModeRule]\n\n/**\n * Register all built-in rules with an engine\n */\nexport function registerBuiltInRules(engine: {\n  registerRules: (rules: PermissionRule[]) => void\n}): void {\n  engine.registerRules(builtInRules)\n}\n\n/**\n * Register only security rules with an engine\n */\nexport function registerSecurityRules(engine: {\n  registerRules: (rules: PermissionRule[]) => void\n}): void {\n  engine.registerRules(securityRules)\n}\n"],
-  "mappings": "AAaA,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAEd,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB;AACjC,SAAS,0BAA0B;AACnC,SAAS,2BAA2B;AACpC,SAAS,0BAA0B;AAM5B,MAAM,eAAiC;AAAA,EAC5C;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACF;AAKO,MAAM,gBAAkC;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AACF;AAKO,MAAM,YAA8B,CAAC,cAAc,YAAY;AAK/D,SAAS,qBAAqB,QAE5B;AACP,SAAO,cAAc,YAAY;AACnC;AAKO,SAAS,sBAAsB,QAE7B;AACP,SAAO,cAAc,aAAa;AACpC;",
-  "names": []
-}

package/dist/core/permissions/rules/planModeRule.js

@@ -1,55 +0,0 @@
-const WRITE_TOOLS = /* @__PURE__ */ new Set([
-  "Edit",
-  "Write",
-  "MultiEdit",
-  "NotebookEdit",
-  "Bash"
-  // May write files
-]);
-const READ_ONLY_TOOLS = /* @__PURE__ */ new Set([
-  "Read",
-  "Glob",
-  "Grep",
-  "LS",
-  "LSP",
-  "WebSearch",
-  "WebFetch",
-  "Agent",
-  // Can spawn read-only agents
-  "TodoWrite",
-  // Planning notes
-  "AskUserQuestion",
-  "EnterPlanMode",
-  "ExitPlanMode"
-]);
-const planModeRule = {
-  name: "plan-mode",
-  description: "Restricts write operations in plan mode",
-  priority: 100,
-  // High priority
-  check(context) {
-    if (!context.planMode) {
-      return { allowed: true };
-    }
-    const toolName = context.tool.name;
-    if (READ_ONLY_TOOLS.has(toolName)) {
-      return { allowed: true };
-    }
-    if (WRITE_TOOLS.has(toolName)) {
-      return {
-        allowed: false,
-        reason: `Tool ${toolName} is not allowed in plan mode. Only read-only operations are permitted.`,
-        message: "Cannot modify files while in plan mode. Use ExitPlanMode to implement changes."
-      };
-    }
-    if (context.tool.isReadOnly && context.tool.isReadOnly()) {
-      return { allowed: true };
-    }
-    console.warn(`Unknown tool ${toolName} used in plan mode`);
-    return { allowed: true };
-  }
-};
-export {
-  planModeRule
-};
-//# sourceMappingURL=planModeRule.js.map

package/dist/core/permissions/rules/planModeRule.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/core/permissions/rules/planModeRule.ts"],
-  "sourcesContent": ["/**\n * Plan Mode Permission Rule\n *\n * Restricts write operations when in plan mode.\n */\n\nimport type {\n  PermissionRule,\n  PermissionContext,\n  PermissionResult,\n} from '../engine/types'\n\n/**\n * Tools that modify state (not allowed in plan mode)\n */\nconst WRITE_TOOLS = new Set([\n  'Edit',\n  'Write',\n  'MultiEdit',\n  'NotebookEdit',\n  'Bash', // May write files\n])\n\n/**\n * Read-only tools (always allowed in plan mode)\n */\nconst READ_ONLY_TOOLS = new Set([\n  'Read',\n  'Glob',\n  'Grep',\n  'LS',\n  'LSP',\n  'WebSearch',\n  'WebFetch',\n  'Agent', // Can spawn read-only agents\n  'TodoWrite', // Planning notes\n  'AskUserQuestion',\n  'EnterPlanMode',\n  'ExitPlanMode',\n])\n\n/**\n * Plan Mode Rule\n *\n * When in plan mode, only allow read-only operations.\n */\nexport const planModeRule: PermissionRule = {\n  name: 'plan-mode',\n  description: 'Restricts write operations in plan mode',\n  priority: 100, // High priority\n\n  check(context: PermissionContext): PermissionResult {\n    // Skip if not in plan mode\n    if (!context.planMode) {\n      return { allowed: true }\n    }\n\n    const toolName = context.tool.name\n\n    // Always allow read-only tools\n    if (READ_ONLY_TOOLS.has(toolName)) {\n      return { allowed: true }\n    }\n\n    // Block write tools in plan mode\n    if (WRITE_TOOLS.has(toolName)) {\n      return {\n        allowed: false,\n        reason: `Tool ${toolName} is not allowed in plan mode. Only read-only operations are permitted.`,\n        message:\n          'Cannot modify files while in plan mode. Use ExitPlanMode to implement changes.',\n      }\n    }\n\n    // Check if tool explicitly declares read-only\n    if (context.tool.isReadOnly && context.tool.isReadOnly()) {\n      return { allowed: true }\n    }\n\n    // Default: allow unknown tools but log warning\n    console.warn(`Unknown tool ${toolName} used in plan mode`)\n    return { allowed: true }\n  },\n}\n"],
-  "mappings": "AAeA,MAAM,cAAc,oBAAI,IAAI;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AACF,CAAC;AAKD,MAAM,kBAAkB,oBAAI,IAAI;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOM,MAAM,eAA+B;AAAA,EAC1C,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU;AAAA;AAAA,EAEV,MAAM,SAA8C;AAElD,QAAI,CAAC,QAAQ,UAAU;AACrB,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAEA,UAAM,WAAW,QAAQ,KAAK;AAG9B,QAAI,gBAAgB,IAAI,QAAQ,GAAG;AACjC,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,QAAI,YAAY,IAAI,QAAQ,GAAG;AAC7B,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ,QAAQ,QAAQ;AAAA,QACxB,SACE;AAAA,MACJ;AAAA,IACF;AAGA,QAAI,QAAQ,KAAK,cAAc,QAAQ,KAAK,WAAW,GAAG;AACxD,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,YAAQ,KAAK,gBAAgB,QAAQ,oBAAoB;AACzD,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACF;",
-  "names": []
-}

package/dist/core/permissions/rules/projectBoundaryRule.js

@@ -1,173 +0,0 @@
-import { resolve, relative, isAbsolute } from "path";
-import { getOriginalCwd } from "../../../utils/state.js";
-function isOutsideProject(filePath) {
-  const projectDir = getOriginalCwd();
-  const absolutePath = isAbsolute(filePath) ? resolve(filePath) : resolve(projectDir, filePath);
-  const relativePath = relative(projectDir, absolutePath);
-  return relativePath.startsWith("..") || isAbsolute(relativePath);
-}
-function getRelativeFromProject(filePath) {
-  const projectDir = getOriginalCwd();
-  const absolutePath = isAbsolute(filePath) ? resolve(filePath) : resolve(projectDir, filePath);
-  return relative(projectDir, absolutePath);
-}
-function calculateExternalOperationRisk(operation, filePath) {
-  const relativePath = getRelativeFromProject(filePath);
-  const levelsUp = (relativePath.match(/\.\./g) || []).length;
-  if (levelsUp > 3 || filePath.startsWith("/etc") || filePath.startsWith("/usr")) {
-    return "critical";
-  }
-  if (operation === "delete" || levelsUp >= 2) {
-    return "high";
-  }
-  if (operation === "write" && levelsUp >= 1) {
-    return "medium";
-  }
-  return "low";
-}
-function getOperationType(toolName, input) {
-  switch (toolName) {
-    case "View":
-    // Actual API name for FileReadTool
-    case "Read":
-    case "FileRead":
-    case "Glob":
-    case "Grep":
-      return "read";
-    case "Replace":
-    // Actual API name for FileWriteTool
-    case "Write":
-    case "FileWrite":
-    case "Edit":
-    case "FileEdit":
-    case "MultiEdit":
-    case "NotebookEdit":
-    case "NotebookEditCell":
-      return "write";
-    case "Bash": {
-      const command = input.command || "";
-      if (/\b(rm|del|rmdir|unlink)\b/.test(command)) {
-        return "delete";
-      }
-      if (/\b(mv|cp|touch|mkdir|echo\s+.*>|cat\s+.*>|tee)\b/.test(command)) {
-        return "write";
-      }
-      if (/\b(cat|head|tail|less|more|grep|find|ls)\b/.test(command)) {
-        return "read";
-      }
-      return "execute";
-    }
-    default:
-      return null;
-  }
-}
-function extractFilePaths(toolName, input) {
-  const paths = [];
-  if (input.file_path) paths.push(input.file_path);
-  if (input.filePath) paths.push(input.filePath);
-  if (input.path) paths.push(input.path);
-  if (toolName === "Bash") {
-    const command = input.command || "";
-    const pathMatches = command.matchAll(
-      /(?:cat|rm|mv|cp|head|tail|less|more|touch|mkdir|rmdir|>\s*)\s*["']?([^\s"'|&;><]+)/g
-    );
-    for (const match of pathMatches) {
-      if (match[1] && !match[1].startsWith("-")) {
-        paths.push(match[1]);
-      }
-    }
-  }
-  return paths;
-}
-const RISK_MESSAGES = {
-  low: "\u{1F4C1} This file is outside your project directory.",
-  medium: "\u26A0\uFE0F This operation modifies a file outside your project.",
-  high: "\u{1F536} High-risk operation: This file is significantly outside your project boundary.",
-  critical: "\u{1F6A8} Critical: This operation affects system or deeply external files!"
-};
-const projectBoundaryRule = {
-  name: "project-boundary",
-  description: "Requires confirmation for write/delete operations outside project directory",
-  priority: 95,
-  // High priority, but below sensitive paths
-  check(context) {
-    const toolName = context.tool.name;
-    const input = context.input;
-    const operation = getOperationType(toolName, input);
-    if (!operation) {
-      return { allowed: true };
-    }
-    if (operation === "read") {
-      return { allowed: true };
-    }
-    const filePaths = extractFilePaths(toolName, input);
-    if (filePaths.length === 0) {
-      return { allowed: true };
-    }
-    const externalPaths = [];
-    for (const filePath of filePaths) {
-      if (isOutsideProject(filePath)) {
-        const relativePath = getRelativeFromProject(filePath);
-        const risk = calculateExternalOperationRisk(operation, filePath);
-        externalPaths.push({ path: filePath, relativePath, risk });
-      }
-    }
-    if (externalPaths.length === 0) {
-      return { allowed: true };
-    }
-    const riskOrder = [
-      "low",
-      "medium",
-      "high",
-      "critical"
-    ];
-    const highestRisk = externalPaths.reduce((max, curr) => {
-      return riskOrder.indexOf(curr.risk) > riskOrder.indexOf(max) ? curr.risk : max;
-    }, "low");
-    if (highestRisk === "critical") {
-      return {
-        allowed: false,
-        reason: "Critical external operation blocked",
-        message: `${RISK_MESSAGES.critical}
-
-Paths:
-${externalPaths.map((p) => `  \u2022 ${p.relativePath}`).join("\n")}
-
-This operation is too risky to allow. Please reconsider.`
-      };
-    }
-    const projectDir = getOriginalCwd();
-    const pathList = externalPaths.map((p) => `  \u2022 ${p.relativePath} (${p.risk} risk)`).join("\n");
-    return {
-      allowed: false,
-      promptUser: true,
-      reason: "External operation requires confirmation",
-      message: `${RISK_MESSAGES[highestRisk]}
-
-Project: ${projectDir}
-
-External paths:
-${pathList}
-
-Operation: ${operation}`,
-      permissionKey: `ExternalOp(${operation}:${externalPaths.map((p) => p.path).join(",")})`
-    };
-  }
-};
-function isExternalOperation(filePath, operation) {
-  if (!isOutsideProject(filePath)) {
-    return { isExternal: false, risk: null };
-  }
-  return {
-    isExternal: true,
-    risk: calculateExternalOperationRisk(operation, filePath)
-  };
-}
-export {
-  calculateExternalOperationRisk,
-  getRelativeFromProject,
-  isExternalOperation,
-  isOutsideProject,
-  projectBoundaryRule
-};
-//# sourceMappingURL=projectBoundaryRule.js.map

package/dist/core/permissions/rules/projectBoundaryRule.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/core/permissions/rules/projectBoundaryRule.ts"],
-  "sourcesContent": ["/**\n * Project Boundary Rule\n *\n * Enforces secondary confirmation for write/delete operations\n * outside the project directory. This prevents accidental modifications\n * to files outside the current working context.\n */\n\nimport type {\n  PermissionRule,\n  PermissionContext,\n  PermissionResult,\n} from '../engine/types'\nimport { resolve, relative, isAbsolute } from 'path'\nimport { getOriginalCwd } from '@utils/state'\n\n/**\n * Operation risk levels for operations outside project directory\n */\nexport type ExternalOperationRisk = 'low' | 'medium' | 'high' | 'critical'\n\n/**\n * Determine if a path is outside the project directory\n */\nexport function isOutsideProject(filePath: string): boolean {\n  const projectDir = getOriginalCwd()\n  const absolutePath = isAbsolute(filePath)\n    ? resolve(filePath)\n    : resolve(projectDir, filePath)\n\n  const relativePath = relative(projectDir, absolutePath)\n\n  // If the relative path starts with '..' or is absolute, it's outside\n  return relativePath.startsWith('..') || isAbsolute(relativePath)\n}\n\n/**\n * Get the relative path from project directory (for display)\n */\nexport function getRelativeFromProject(filePath: string): string {\n  const projectDir = getOriginalCwd()\n  const absolutePath = isAbsolute(filePath)\n    ? resolve(filePath)\n    : resolve(projectDir, filePath)\n\n  return relative(projectDir, absolutePath)\n}\n\n/**\n * Calculate risk level for an external operation\n */\nexport function calculateExternalOperationRisk(\n  operation: 'read' | 'write' | 'delete' | 'execute',\n  filePath: string,\n): ExternalOperationRisk {\n  const relativePath = getRelativeFromProject(filePath)\n\n  // Count how many levels up we're going\n  const levelsUp = (relativePath.match(/\\.\\./g) || []).length\n\n  // Critical: More than 3 levels up or accessing system directories\n  if (\n    levelsUp > 3 ||\n    filePath.startsWith('/etc') ||\n    filePath.startsWith('/usr')\n  ) {\n    return 'critical'\n  }\n\n  // High: Delete operations or 2-3 levels up\n  if (operation === 'delete' || levelsUp >= 2) {\n    return 'high'\n  }\n\n  // Medium: Write operations 1 level up\n  if (operation === 'write' && levelsUp >= 1) {\n    return 'medium'\n  }\n\n  // Low: Other cases\n  return 'low'\n}\n\n/**\n * Get operation type from tool name\n */\nfunction getOperationType(\n  toolName: string,\n  input: Record<string, unknown>,\n): 'read' | 'write' | 'delete' | 'execute' | null {\n  switch (toolName) {\n    case 'View': // Actual API name for FileReadTool\n    case 'Read':\n    case 'FileRead':\n    case 'Glob':\n    case 'Grep':\n      return 'read'\n    case 'Replace': // Actual API name for FileWriteTool\n    case 'Write':\n    case 'FileWrite':\n    case 'Edit':\n    case 'FileEdit':\n    case 'MultiEdit':\n    case 'NotebookEdit':\n    case 'NotebookEditCell': // Actual API name for NotebookEditTool\n      return 'write'\n    case 'Bash': {\n      const command = (input.command as string) || ''\n      if (/\\b(rm|del|rmdir|unlink)\\b/.test(command)) {\n        return 'delete'\n      }\n      if (/\\b(mv|cp|touch|mkdir|echo\\s+.*>|cat\\s+.*>|tee)\\b/.test(command)) {\n        return 'write'\n      }\n      if (/\\b(cat|head|tail|less|more|grep|find|ls)\\b/.test(command)) {\n        return 'read'\n      }\n      return 'execute'\n    }\n    default:\n      return null\n  }\n}\n\n/**\n * Extract file paths from tool input (may return multiple for Bash)\n */\nfunction extractFilePaths(\n  toolName: string,\n  input: Record<string, unknown>,\n): string[] {\n  const paths: string[] = []\n\n  // Direct file path tools\n  if (input.file_path) paths.push(input.file_path as string)\n  if (input.filePath) paths.push(input.filePath as string)\n  if (input.path) paths.push(input.path as string)\n\n  // For Bash commands, extract all paths\n  if (toolName === 'Bash') {\n    const command = (input.command as string) || ''\n\n    // Match paths after file operation commands\n    const pathMatches = command.matchAll(\n      /(?:cat|rm|mv|cp|head|tail|less|more|touch|mkdir|rmdir|>\\s*)\\s*[\"']?([^\\s\"'|&;><]+)/g,\n    )\n    for (const match of pathMatches) {\n      if (match[1] && !match[1].startsWith('-')) {\n        paths.push(match[1])\n      }\n    }\n  }\n\n  return paths\n}\n\n/**\n * Risk level descriptions\n */\nconst RISK_MESSAGES: Record<ExternalOperationRisk, string> = {\n  low: '\uD83D\uDCC1 This file is outside your project directory.',\n  medium: '\u26A0\uFE0F This operation modifies a file outside your project.',\n  high: '\uD83D\uDD36 High-risk operation: This file is significantly outside your project boundary.',\n  critical:\n    '\uD83D\uDEA8 Critical: This operation affects system or deeply external files!',\n}\n\n/**\n * Project Boundary Rule\n *\n * Requires confirmation for write/delete operations outside project.\n */\nexport const projectBoundaryRule: PermissionRule = {\n  name: 'project-boundary',\n  description:\n    'Requires confirmation for write/delete operations outside project directory',\n  priority: 95, // High priority, but below sensitive paths\n\n  check(context: PermissionContext): PermissionResult {\n    const toolName = context.tool.name\n    const input = context.input\n\n    // Get operation type\n    const operation = getOperationType(toolName, input)\n    if (!operation) {\n      return { allowed: true }\n    }\n\n    // Only check write/delete operations (read is generally safe)\n    if (operation === 'read') {\n      return { allowed: true }\n    }\n\n    // Extract file paths\n    const filePaths = extractFilePaths(toolName, input)\n    if (filePaths.length === 0) {\n      return { allowed: true }\n    }\n\n    // Check each path\n    const externalPaths: Array<{\n      path: string\n      relativePath: string\n      risk: ExternalOperationRisk\n    }> = []\n\n    for (const filePath of filePaths) {\n      if (isOutsideProject(filePath)) {\n        const relativePath = getRelativeFromProject(filePath)\n        const risk = calculateExternalOperationRisk(operation, filePath)\n        externalPaths.push({ path: filePath, relativePath, risk })\n      }\n    }\n\n    // If no external paths, allow\n    if (externalPaths.length === 0) {\n      return { allowed: true }\n    }\n\n    // Get the highest risk level\n    const riskOrder: ExternalOperationRisk[] = [\n      'low',\n      'medium',\n      'high',\n      'critical',\n    ]\n    const highestRisk = externalPaths.reduce((max, curr) => {\n      return riskOrder.indexOf(curr.risk) > riskOrder.indexOf(max)\n        ? curr.risk\n        : max\n    }, 'low' as ExternalOperationRisk)\n\n    // Critical operations are blocked\n    if (highestRisk === 'critical') {\n      return {\n        allowed: false,\n        reason: 'Critical external operation blocked',\n        message: `${RISK_MESSAGES.critical}\\n\\nPaths:\\n${externalPaths.map(p => `  \u2022 ${p.relativePath}`).join('\\n')}\\n\\nThis operation is too risky to allow. Please reconsider.`,\n      }\n    }\n\n    // All other external operations require explicit confirmation\n    const projectDir = getOriginalCwd()\n    const pathList = externalPaths\n      .map(p => `  \u2022 ${p.relativePath} (${p.risk} risk)`)\n      .join('\\n')\n\n    return {\n      allowed: false,\n      promptUser: true,\n      reason: 'External operation requires confirmation',\n      message: `${RISK_MESSAGES[highestRisk]}\\n\\nProject: ${projectDir}\\n\\nExternal paths:\\n${pathList}\\n\\nOperation: ${operation}`,\n      permissionKey: `ExternalOp(${operation}:${externalPaths.map(p => p.path).join(',')})`,\n    }\n  },\n}\n\n/**\n * Check if an operation is outside project (utility function)\n */\nexport function isExternalOperation(\n  filePath: string,\n  operation: 'read' | 'write' | 'delete' | 'execute',\n): { isExternal: boolean; risk: ExternalOperationRisk | null } {\n  if (!isOutsideProject(filePath)) {\n    return { isExternal: false, risk: null }\n  }\n\n  return {\n    isExternal: true,\n    risk: calculateExternalOperationRisk(operation, filePath),\n  }\n}\n"],
-  "mappings": "AAaA,SAAS,SAAS,UAAU,kBAAkB;AAC9C,SAAS,sBAAsB;AAUxB,SAAS,iBAAiB,UAA2B;AAC1D,QAAM,aAAa,eAAe;AAClC,QAAM,eAAe,WAAW,QAAQ,IACpC,QAAQ,QAAQ,IAChB,QAAQ,YAAY,QAAQ;AAEhC,QAAM,eAAe,SAAS,YAAY,YAAY;AAGtD,SAAO,aAAa,WAAW,IAAI,KAAK,WAAW,YAAY;AACjE;AAKO,SAAS,uBAAuB,UAA0B;AAC/D,QAAM,aAAa,eAAe;AAClC,QAAM,eAAe,WAAW,QAAQ,IACpC,QAAQ,QAAQ,IAChB,QAAQ,YAAY,QAAQ;AAEhC,SAAO,SAAS,YAAY,YAAY;AAC1C;AAKO,SAAS,+BACd,WACA,UACuB;AACvB,QAAM,eAAe,uBAAuB,QAAQ;AAGpD,QAAM,YAAY,aAAa,MAAM,OAAO,KAAK,CAAC,GAAG;AAGrD,MACE,WAAW,KACX,SAAS,WAAW,MAAM,KAC1B,SAAS,WAAW,MAAM,GAC1B;AACA,WAAO;AAAA,EACT;AAGA,MAAI,cAAc,YAAY,YAAY,GAAG;AAC3C,WAAO;AAAA,EACT;AAGA,MAAI,cAAc,WAAW,YAAY,GAAG;AAC1C,WAAO;AAAA,EACT;AAGA,SAAO;AACT;AAKA,SAAS,iBACP,UACA,OACgD;AAChD,UAAQ,UAAU;AAAA,IAChB,KAAK;AAAA;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK,QAAQ;AACX,YAAM,UAAW,MAAM,WAAsB;AAC7C,UAAI,4BAA4B,KAAK,OAAO,GAAG;AAC7C,eAAO;AAAA,MACT;AACA,UAAI,mDAAmD,KAAK,OAAO,GAAG;AACpE,eAAO;AAAA,MACT;AACA,UAAI,6CAA6C,KAAK,OAAO,GAAG;AAC9D,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT;AAAA,IACA;AACE,aAAO;AAAA,EACX;AACF;AAKA,SAAS,iBACP,UACA,OACU;AACV,QAAM,QAAkB,CAAC;AAGzB,MAAI,MAAM,UAAW,OAAM,KAAK,MAAM,SAAmB;AACzD,MAAI,MAAM,SAAU,OAAM,KAAK,MAAM,QAAkB;AACvD,MAAI,MAAM,KAAM,OAAM,KAAK,MAAM,IAAc;AAG/C,MAAI,aAAa,QAAQ;AACvB,UAAM,UAAW,MAAM,WAAsB;AAG7C,UAAM,cAAc,QAAQ;AAAA,MAC1B;AAAA,IACF;AACA,eAAW,SAAS,aAAa;AAC/B,UAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,GAAG;AACzC,cAAM,KAAK,MAAM,CAAC,CAAC;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAKA,MAAM,gBAAuD;AAAA,EAC3D,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UACE;AACJ;AAOO,MAAM,sBAAsC;AAAA,EACjD,MAAM;AAAA,EACN,aACE;AAAA,EACF,UAAU;AAAA;AAAA,EAEV,MAAM,SAA8C;AAClD,UAAM,WAAW,QAAQ,KAAK;AAC9B,UAAM,QAAQ,QAAQ;AAGtB,UAAM,YAAY,iBAAiB,UAAU,KAAK;AAClD,QAAI,CAAC,WAAW;AACd,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,QAAI,cAAc,QAAQ;AACxB,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,UAAM,YAAY,iBAAiB,UAAU,KAAK;AAClD,QAAI,UAAU,WAAW,GAAG;AAC1B,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,UAAM,gBAID,CAAC;AAEN,eAAW,YAAY,WAAW;AAChC,UAAI,iBAAiB,QAAQ,GAAG;AAC9B,cAAM,eAAe,uBAAuB,QAAQ;AACpD,cAAM,OAAO,+BAA+B,WAAW,QAAQ;AAC/D,sBAAc,KAAK,EAAE,MAAM,UAAU,cAAc,KAAK,CAAC;AAAA,MAC3D;AAAA,IACF;AAGA,QAAI,cAAc,WAAW,GAAG;AAC9B,aAAO,EAAE,SAAS,KAAK;AAAA,IACzB;AAGA,UAAM,YAAqC;AAAA,MACzC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,UAAM,cAAc,cAAc,OAAO,CAAC,KAAK,SAAS;AACtD,aAAO,UAAU,QAAQ,KAAK,IAAI,IAAI,UAAU,QAAQ,GAAG,IACvD,KAAK,OACL;AAAA,IACN,GAAG,KAA8B;AAGjC,QAAI,gBAAgB,YAAY;AAC9B,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,SAAS,GAAG,cAAc,QAAQ;AAAA;AAAA;AAAA,EAAe,cAAc,IAAI,OAAK,YAAO,EAAE,YAAY,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA,MAC7G;AAAA,IACF;AAGA,UAAM,aAAa,eAAe;AAClC,UAAM,WAAW,cACd,IAAI,OAAK,YAAO,EAAE,YAAY,KAAK,EAAE,IAAI,QAAQ,EACjD,KAAK,IAAI;AAEZ,WAAO;AAAA,MACL,SAAS;AAAA,MACT,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,SAAS,GAAG,cAAc,WAAW,CAAC;AAAA;AAAA,WAAgB,UAAU;AAAA;AAAA;AAAA,EAAwB,QAAQ;AAAA;AAAA,aAAkB,SAAS;AAAA,MAC3H,eAAe,cAAc,SAAS,IAAI,cAAc,IAAI,OAAK,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC;AAAA,IACpF;AAAA,EACF;AACF;AAKO,SAAS,oBACd,UACA,WAC6D;AAC7D,MAAI,CAAC,iBAAiB,QAAQ,GAAG;AAC/B,WAAO,EAAE,YAAY,OAAO,MAAM,KAAK;AAAA,EACzC;AAEA,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM,+BAA+B,WAAW,QAAQ;AAAA,EAC1D;AACF;",
-  "names": []
-}