@yagni-app/code 1.0.6 → 1.0.8

package/dist/extension/permissionRules/loadConfig.js

@@ -0,0 +1,105 @@
+/**
+ * Permission-rule settings loader.
+ *
+ * Reads `permissions: { allow, deny, ask }` from the three YAGNI Code
+ * settings files, mirroring the hooks loader (hooks.ts) shape exactly:
+ *   - user:    ~/.yagni-code/config.json       — always active
+ *   - project: .yagni-code/config.json         — deny/ask always active;
+ *              allow gated on workspace trust (Claude Code semantics:
+ *              "deny and ask rules apply right away; allow rules from a
+ *              project file wait for trust")
+ *   - local:   .yagni-code/config.local.json   — the personal per-project
+ *              tier; trust-gated EXACTLY like project (a hostile repo can
+ *              commit a local file — the gitignore convention only covers
+ *              untracked files). Deliberately stricter than Claude Code,
+ *              which does not trust-gate localSettings.
+ *
+ * Lists UNION across sources (Claude Code: lists merge, never replace).
+ * User-source rules are ordered before project-source rules, project before
+ * local, so path-pattern negation (`!exception`) behaves like gitignore
+ * lines across files — higher-precedence sources come later (later wins).
+ *
+ * Fail-soft: a malformed config file is skipped whole with a warning (same
+ * posture as hooks.ts). Malformed individual rule strings parse as bare
+ * tool names (parser degrades, never throws) and are flagged.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { codeStateHome } from "../stateHome.js";
+import { parseRuleString } from "./parser.js";
+/** The tools a rule can actually be consulted for at the gate. */
+export const KNOWN_RULE_TOOLS = new Set([
+    "read", "edit", "write", "grep", "find", "ls", "bash", "web_fetch",
+    "ask_yagni", "ask_advisor", "ask_user_question", "file_ticket",
+    "update_ticket_status", "review_business_match", "suggest_next_work",
+    "record_engineering_context", "record_decision",
+]);
+function readRulesFromFile(path, source, behavior, out, warnings) {
+    try {
+        if (!existsSync(path))
+            return;
+        const raw = readFileSync(path, "utf-8");
+        if (raw.trim() === "")
+            return;
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            warnings.push(`${source} settings: not a JSON object — permissions skipped (${path})`);
+            return;
+        }
+        const permissions = parsed.permissions;
+        if (permissions === undefined)
+            return;
+        if (!permissions || typeof permissions !== "object" || Array.isArray(permissions)) {
+            warnings.push(`${source} settings: "permissions" is not an object — skipped (${path})`);
+            return;
+        }
+        const entries = permissions[behavior];
+        if (entries === undefined)
+            return;
+        const list = Array.isArray(entries) ? entries : [entries];
+        for (const entry of list) {
+            if (typeof entry !== "string") {
+                warnings.push(`${source} settings: non-string ${behavior} rule skipped (${path})`);
+                continue;
+            }
+            const { toolName, ruleContent } = parseRuleString(entry);
+            out.push({ behavior, source, toolName, ruleContent, raw: entry });
+        }
+    }
+    catch {
+        warnings.push(`${source} settings: malformed JSON — permissions skipped (${path})`);
+    }
+}
+/** Load + union rules from all three files. Pure I/O; no throw. */
+export function loadPermissionRules(opts = {}) {
+    const warnings = [];
+    const rules = [];
+    const stateHome = opts.stateHomeOverride ?? codeStateHome(null, opts.env, opts.userHome);
+    const cwd = opts.cwd ?? process.cwd();
+    const userPath = join(stateHome, "config.json");
+    const projectPath = join(cwd, ".yagni-code", "config.json");
+    const localPath = join(cwd, ".yagni-code", "config.local.json");
+    // User, then project, then local — ordering matters for path-rule
+    // negation (later sources win, matching scalar precedence).
+    for (const behavior of ["deny", "ask", "allow"]) {
+        readRulesFromFile(userPath, "user", behavior, rules, warnings);
+        readRulesFromFile(projectPath, "project", behavior, rules, warnings);
+        readRulesFromFile(localPath, "local", behavior, rules, warnings);
+    }
+    const neverConsultedTools = [
+        ...new Set(rules.map((r) => r.toolName).filter((t) => !KNOWN_RULE_TOOLS.has(t) && !t.startsWith("mcp__"))),
+    ];
+    return { rules, diagnostics: { warnings, neverConsultedTools } };
+}
+/**
+ * Filter rules by behavior + trust. Untrusted repos keep deny/ask from every
+ * source but lose allow rules from BOTH project and local files — a
+ * committed config.local.json must not smuggle allow rules past the trust
+ * gate (see the module header; stricter than Claude Code's localSettings).
+ */
+export function effectiveRules(rules, isProjectTrusted) {
+    if (isProjectTrusted)
+        return [...rules];
+    return rules.filter((r) => !(r.source !== "user" && r.behavior === "allow"));
+}
+//# sourceMappingURL=loadConfig.js.map

package/dist/extension/permissionRules/parser.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Permission-rule string parser.
+ *
+ * Parses `ToolName` / `ToolName(content)` rule strings — the exact format
+ * Claude Code uses in settings.json `permissions.allow/deny/ask` arrays —
+ * so a rule pasted from Claude Code works unchanged.
+ *
+ * Tool-name aliasing: Claude Code names (Read/Edit/Write/…) map onto this
+ * agent's tool names (read/edit/write/…). Both spellings are accepted; rules
+ * for tools that do not exist here parse fine but are flagged
+ * never-consulted by the loader's diagnostics.
+ *
+ * Ported from Claude Code's permissionRuleParser.ts (escaping semantics,
+ * `ToolName(*)` ≡ tool-wide) with the alias table added.
+ */
+export interface ParsedRuleValue {
+    /** Normalized tool name this rule targets (after aliasing). */
+    toolName: string;
+    /** The raw content inside the parens, unescaped; undefined for bare rules. */
+    ruleContent?: string;
+}
+/** Normalize a rule's tool name: lowercase → alias → MCP passthrough. */
+export declare function normalizeRuleToolName(raw: string): string;
+/** Escape parens/backslashes in rule content for storage (parser inverse). */
+export declare function escapeRuleContent(content: string): string;
+/** Unescape rule content after parsing. */
+export declare function unescapeRuleContent(content: string): string;
+/**
+ * Parse a rule string into its components. Malformed shapes degrade the same
+ * way Claude Code's parser degrades them: treat the whole string as a bare
+ * tool name (never throw) — the loader's diagnostics flag them.
+ *
+ * `Bash(*)` and `Bash()` are tool-wide rules, same as bare `Bash`.
+ */
+export declare function parseRuleString(ruleString: string): ParsedRuleValue;
+/** Serialize a parsed rule back to its string form (loader diagnostics). */
+export declare function ruleValueToString(value: ParsedRuleValue): string;
+//# sourceMappingURL=parser.d.ts.map

package/dist/extension/permissionRules/parser.js

@@ -0,0 +1,136 @@
+/**
+ * Permission-rule string parser.
+ *
+ * Parses `ToolName` / `ToolName(content)` rule strings — the exact format
+ * Claude Code uses in settings.json `permissions.allow/deny/ask` arrays —
+ * so a rule pasted from Claude Code works unchanged.
+ *
+ * Tool-name aliasing: Claude Code names (Read/Edit/Write/…) map onto this
+ * agent's tool names (read/edit/write/…). Both spellings are accepted; rules
+ * for tools that do not exist here parse fine but are flagged
+ * never-consulted by the loader's diagnostics.
+ *
+ * Ported from Claude Code's permissionRuleParser.ts (escaping semantics,
+ * `ToolName(*)` ≡ tool-wide) with the alias table added.
+ */
+import { mcpInfoFromString } from "../mcp/names.js";
+/**
+ * Claude Code tool names → this agent's tool names. Keys are matched
+ * case-insensitively at parse time (Claude Code rules use PascalCase; our
+ * registered tools are lowercase). MCP names (`mcp__server__tool`) pass
+ * through untouched — naming is already byte-identical (mcp/names.ts).
+ */
+const TOOL_NAME_ALIASES = {
+    read: "read",
+    edit: "edit",
+    write: "write",
+    grep: "grep",
+    find: "find",
+    glob: "find", // Claude Code's Glob ≈ our find (pattern-based file search)
+    ls: "ls",
+    bash: "bash",
+    webfetch: "web_fetch", // Claude Code's WebFetch → our web_fetch
+    // YAGNI-registered tools, accepted under their own names (aliases exist so
+    // a rule copied from a Claude Code setup that wrapped the same capability
+    // under a different name still lands on ours where sensible).
+    ask_yagni: "ask_yagni",
+    ask_advisor: "ask_advisor",
+    ask_user_question: "ask_user_question",
+    web_fetch: "web_fetch",
+    file_ticket: "file_ticket",
+    update_ticket_status: "update_ticket_status",
+    review_business_match: "review_business_match",
+    suggest_next_work: "suggest_next_work",
+    record_engineering_context: "record_engineering_context",
+    record_decision: "record_decision",
+};
+/** Normalize a rule's tool name: lowercase → alias → MCP passthrough. */
+export function normalizeRuleToolName(raw) {
+    const lower = raw.toLowerCase();
+    const aliased = TOOL_NAME_ALIASES[lower];
+    if (aliased)
+        return aliased;
+    // MCP names are lowercase by construction (mcp/names.ts); no aliasing.
+    if (mcpInfoFromString(raw) !== null)
+        return raw;
+    // Unknown tool: keep the lowercased name so diagnostics can name it.
+    return lower;
+}
+/** Escape parens/backslashes in rule content for storage (parser inverse). */
+export function escapeRuleContent(content) {
+    return content
+        .replace(/\\/g, "\\\\")
+        .replace(/\(/g, "\\(")
+        .replace(/\)/g, "\\)");
+}
+/** Unescape rule content after parsing. */
+export function unescapeRuleContent(content) {
+    return content
+        .replace(/\\\(/g, "(")
+        .replace(/\\\)/g, ")")
+        .replace(/\\\\/g, "\\");
+}
+/** Index of the first occurrence of `ch` not escaped by an odd backslash run. */
+function findFirstUnescapedChar(str, ch) {
+    for (let i = 0; i < str.length; i++) {
+        if (str[i] !== ch)
+            continue;
+        let backslashes = 0;
+        let j = i - 1;
+        while (j >= 0 && str[j] === "\\") {
+            backslashes++;
+            j--;
+        }
+        if (backslashes % 2 === 0)
+            return i;
+    }
+    return -1;
+}
+function findLastUnescapedChar(str, ch) {
+    for (let i = str.length - 1; i >= 0; i--) {
+        if (str[i] !== ch)
+            continue;
+        let backslashes = 0;
+        let j = i - 1;
+        while (j >= 0 && str[j] === "\\") {
+            backslashes++;
+            j--;
+        }
+        if (backslashes % 2 === 0)
+            return i;
+    }
+    return -1;
+}
+/**
+ * Parse a rule string into its components. Malformed shapes degrade the same
+ * way Claude Code's parser degrades them: treat the whole string as a bare
+ * tool name (never throw) — the loader's diagnostics flag them.
+ *
+ * `Bash(*)` and `Bash()` are tool-wide rules, same as bare `Bash`.
+ */
+export function parseRuleString(ruleString) {
+    const openIdx = findFirstUnescapedChar(ruleString, "(");
+    if (openIdx === -1) {
+        return { toolName: normalizeRuleToolName(ruleString.trim()) };
+    }
+    const closeIdx = findLastUnescapedChar(ruleString, ")");
+    if (closeIdx === -1 || closeIdx <= openIdx || closeIdx !== ruleString.length - 1) {
+        return { toolName: normalizeRuleToolName(ruleString.trim()) };
+    }
+    const toolName = ruleString.slice(0, openIdx).trim();
+    if (!toolName) {
+        return { toolName: normalizeRuleToolName(ruleString.trim()) };
+    }
+    const rawContent = ruleString.slice(openIdx + 1, closeIdx);
+    if (rawContent === "" || rawContent === "*") {
+        return { toolName: normalizeRuleToolName(toolName) };
+    }
+    return { toolName: normalizeRuleToolName(toolName), ruleContent: unescapeRuleContent(rawContent) };
+}
+/** Serialize a parsed rule back to its string form (loader diagnostics). */
+export function ruleValueToString(value) {
+    if (value.ruleContent === undefined)
+        return value.toolName;
+    return `${value.toolName}(${escapeRuleContent(value.ruleContent)})`;
+}
+//# sourceMappingURL=parser.js.map

package/dist/extension/permissionRules/pathRules.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Path-based permission rules — ported from Claude Code's
+ * filesystem.ts (patternWithRoot + matchingRuleForInput), powered by the
+ * vendored `ignore` package (the gitignore engine) so pattern semantics are
+ * byte-compatible with both git's .gitignore and Claude Code.
+ *
+ * Pattern anchors (Claude Code parity):
+ *   //path   absolute from filesystem root
+ *   ~/path   relative to the user's home directory
+ *   /path    relative to the SETTINGS FILE's directory (user config →
+ *            ~/.yagni-code/, project AND local configs → the project root —
+ *            local lives in the same .yagni-code dir as project)
+ *   path     relative to the session cwd; a bare filename matches at ANY
+ *            depth (`.env` equals `**` / `.env` in glob terms)
+ *
+ * Compile semantics: all patterns for one (tool-class, behavior) compile
+ * into ONE ordered `ignore` instance — user-source patterns first, then
+ * project, then local — so gitignore's later-line-wins and `!exception`
+ * negation work across rules from all three files (Claude Code's
+ * matchingRuleForInput builds one ignore().add(patterns) per root the same
+ * way; local patterns are the last/highest-precedence "lines").
+ *
+ * Behavior asymmetry (Claude Code parity): allow rules with a rootless
+ * single-segment pattern anchor at the settings dir (narrow); deny/ask
+ * rules match at any depth (broad — the fail-safe direction).
+ */
+import type { RuleSource } from "./loadConfig.js";
+export interface PathMatchOptions {
+    cwd: string;
+    /** Overrides ~ expansion (tests); defaults to os.homedir(). */
+    homeDir?: string;
+}
+export type PathToolClass = "read" | "edit";
+/** Which tools a rule's toolName maps to for path purposes. */
+export declare function pathClassForTool(toolName: string): PathToolClass | null;
+/** One path-pattern rule, resolved to a root + relative pattern. */
+export interface ResolvedPathPattern {
+    relativePattern: string;
+    /** The directory the pattern resolves against; null = cwd-relative. */
+    root: string | null;
+    source: RuleSource;
+}
+/**
+ * Split an anchored pattern into (root, relativePattern). Mirrors Claude
+ * Code's patternWithRoot. Project- and local-source `/` anchors at the
+ * project root (passed in) — local shares project's .yagni-code dir;
+ * user-source `/` anchors at the YAGNI Code state home (~/.yagni-code).
+ */
+export declare function resolvePatternRoot(pattern: string, source: RuleSource, opts: {
+    userStateHome: string;
+    projectRoot: string | null;
+    homeDir?: string;
+}): ResolvedPathPattern;
+/**
+ * Does the (absolute or cwd-relative) target path match the given patterns?
+ * Patterns are tried in order; later patterns win (gitignore semantics) —
+ * so the caller must pass user-source patterns before project-source.
+ */
+export declare function pathMatches(patterns: readonly ResolvedPathPattern[], targetPath: string, opts: PathMatchOptions): boolean;
+//# sourceMappingURL=pathRules.d.ts.map

package/dist/extension/permissionRules/pathRules.js

@@ -0,0 +1,122 @@
+/**
+ * Path-based permission rules — ported from Claude Code's
+ * filesystem.ts (patternWithRoot + matchingRuleForInput), powered by the
+ * vendored `ignore` package (the gitignore engine) so pattern semantics are
+ * byte-compatible with both git's .gitignore and Claude Code.
+ *
+ * Pattern anchors (Claude Code parity):
+ *   //path   absolute from filesystem root
+ *   ~/path   relative to the user's home directory
+ *   /path    relative to the SETTINGS FILE's directory (user config →
+ *            ~/.yagni-code/, project AND local configs → the project root —
+ *            local lives in the same .yagni-code dir as project)
+ *   path     relative to the session cwd; a bare filename matches at ANY
+ *            depth (`.env` equals `**` / `.env` in glob terms)
+ *
+ * Compile semantics: all patterns for one (tool-class, behavior) compile
+ * into ONE ordered `ignore` instance — user-source patterns first, then
+ * project, then local — so gitignore's later-line-wins and `!exception`
+ * negation work across rules from all three files (Claude Code's
+ * matchingRuleForInput builds one ignore().add(patterns) per root the same
+ * way; local patterns are the last/highest-precedence "lines").
+ *
+ * Behavior asymmetry (Claude Code parity): allow rules with a rootless
+ * single-segment pattern anchor at the settings dir (narrow); deny/ask
+ * rules match at any depth (broad — the fail-safe direction).
+ */
+import { homedir } from "node:os";
+import { isAbsolute, posix, sep } from "node:path";
+import ignore from "../vendor/ignore.js";
+/** Which tools a rule's toolName maps to for path purposes. */
+export function pathClassForTool(toolName) {
+    switch (toolName) {
+        case "read":
+        case "grep":
+        case "find":
+        case "ls":
+            return "read";
+        case "edit":
+        case "write":
+            return "edit";
+        default:
+            return null;
+    }
+}
+/**
+ * Split an anchored pattern into (root, relativePattern). Mirrors Claude
+ * Code's patternWithRoot. Project- and local-source `/` anchors at the
+ * project root (passed in) — local shares project's .yagni-code dir;
+ * user-source `/` anchors at the YAGNI Code state home (~/.yagni-code).
+ */
+export function resolvePatternRoot(pattern, source, opts) {
+    if (pattern.startsWith("//")) {
+        return { relativePattern: pattern.slice(1), root: "/", source };
+    }
+    if (pattern.startsWith("~/") || pattern === "~") {
+        const rel = pattern === "~" ? "" : pattern.slice(1);
+        return { relativePattern: rel, root: opts.homeDir ?? homedir(), source };
+    }
+    if (pattern.startsWith("/") && !pattern.startsWith("//")) {
+        const base = source === "user" ? opts.userStateHome : opts.projectRoot;
+        return { relativePattern: pattern, root: base ?? opts.userStateHome, source };
+    }
+    // Rootless: `./x` normalized to `x`; bare names keep any-depth semantics.
+    let normalized = pattern;
+    if (normalized.startsWith("./"))
+        normalized = normalized.slice(2);
+    return { relativePattern: normalized, root: null, source };
+}
+/** Strip a trailing `/**` — the ignore lib treats `path` as dir+children. */
+function forIgnore(relativePattern) {
+    if (relativePattern.endsWith("/**"))
+        return relativePattern.slice(0, -3);
+    return relativePattern;
+}
+/**
+ * Does the (absolute or cwd-relative) target path match the given patterns?
+ * Patterns are tried in order; later patterns win (gitignore semantics) —
+ * so the caller must pass user-source patterns before project-source.
+ */
+export function pathMatches(patterns, targetPath, opts) {
+    if (patterns.length === 0)
+        return false;
+    const target = toPosix(targetPath);
+    const groups = new Map();
+    for (const p of patterns) {
+        const key = p.root;
+        const list = groups.get(key) ?? [];
+        list.push(forIgnore(p.relativePattern));
+        groups.set(key, list);
+    }
+    for (const [root, plist] of groups) {
+        const ig = ignore().add(plist);
+        const base = root ?? opts.cwd;
+        // Lexical normalization BEFORE relativization: `a/../.env` and `a//b`
+        // must resolve against the same relative form the pattern matches, or a
+        // traversal-shaped spelling of a denied path slips past (probe:
+        // `/work/proj/../.env` was NOT caught by `Read(./.env)` without this).
+        // posix.normalize keeps this lexical — no filesystem access, so a
+        // symlinked target still needs its own rule (documented limitation,
+        // same as pi's own tools resolving paths literally).
+        const absTarget = isAbsolute(target) ? posix.normalize(target) : posix.normalize(posix.join(opts.cwd, target));
+        const rel = toPosix(posixRelative(base, absTarget));
+        if (rel.startsWith(".."))
+            continue; // outside this root — not matched
+        // ignore() rejects empty paths; an empty relative means the target IS
+        // the root itself (e.g. `rg` defaulting to "."). Nothing matches that
+        // unless a pattern covers "" — treat as not-matched (safe default: a
+        // cwd-wide read goes through the normal gate, not a deny).
+        if (rel === "" || rel === ".")
+            continue;
+        if (ig.ignores(rel))
+            return true;
+    }
+    return false;
+}
+function toPosix(p) {
+    return sep === "\\" ? p.replaceAll("\\", "/") : p;
+}
+function posixRelative(from, to) {
+    return posix.relative(toPosix(from), toPosix(to));
+}
+//# sourceMappingURL=pathRules.js.map

package/dist/extension/permissionRules/shellRules.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Bash command-rule matching — ported from Claude Code's
+ * shellRuleMatching.ts + the matching half of BashTool/bashPermissions.ts.
+ *
+ * A bash rule's content is one of:
+ *   - exact:   `npm run build`        — matches that exact command string
+ *   - prefix:  `npm install:*`        — `:*` suffix = trailing wildcard
+ *   - wildcard: `git log *`           — `*` anywhere; `*` matches any text
+ *                                         including spaces; `\*` literal
+ *
+ * Security invariants (Claude Code parity, enforced here):
+ *   - compound commands are split on ;, &&, ||, |, and newlines, and EVERY
+ *     subcommand must pass the rule check independently. Wildcards and
+ *     prefixes never run against the raw compound string (`cd /x && rm -rf`
+ *     must not ride a `cd:*` allow).
+ *   - prefix matching requires a word boundary: `ls:*` matches `ls` and
+ *     `ls -la` but never `lsof`.
+ *   - a trailing ` *` wildcard that is the rule's ONLY wildcard also matches
+ *     the bare command (`git log *` matches `git log`).
+ *   - safe wrappers (timeout/time/nice/nohup) are stripped before matching,
+ *     so `Bash(npm install:*)` matches `timeout 10 npm install foo`.
+ *   - for DENY and ASK rules, ALL leading env-var assignments are stripped
+ *     (fixed-point, mirroring Claude's stripAllLeadingEnvVars) so
+ *     `FOO=bar denied_cmd` stays denied. For ALLOW rules only the safe-list
+ *     env prefixes are stripped — an env var must never widen an allow
+ *     (Claude's asymmetry, HackerOne #3543050).
+ */
+export type ShellRuleShape = {
+    type: "exact";
+    command: string;
+} | {
+    type: "prefix";
+    prefix: string;
+} | {
+    type: "wildcard";
+    pattern: string;
+};
+export declare function parseShellRule(ruleContent: string): ShellRuleShape;
+/** Match a command string against a `*`-wildcard pattern. */
+export declare function matchWildcardPattern(pattern: string, command: string): boolean;
+/** Split a command into its subcommand strings (operators are boundaries). */
+export declare function splitSubcommands(command: string): string[];
+/** Strip ALL leading env assignments — deny/ask rules only. Fixed-point. */
+export declare function stripAllEnvVars(command: string): string;
+/**
+ * Does this bash rule match the full command? Mirrors Claude Code's
+ * matchingRulesForInput: compound commands split, every subcommand must
+ * pass, candidates include stripped variants, and deny/ask additionally
+ * try all-env-stripped variants.
+ */
+export declare function shellRuleMatches(ruleContent: string, command: string, behavior: "allow" | "deny" | "ask"): boolean;
+//# sourceMappingURL=shellRules.d.ts.map