ai-fs-permissions 0.1.0

package/dist/stdin.js

@@ -0,0 +1,127 @@
+import { TOOL_OPERATIONS } from './types.js';
+/**
+ * Type-safe property check
+ */
+function hasProperty(obj, key) {
+    return Object.prototype.hasOwnProperty.call(obj, key);
+}
+/**
+ * Type-safe property access
+ */
+function getProperty(obj, key) {
+    const entries = Object.entries(obj);
+    for (const entry of entries) {
+        if (entry[0] === key) {
+            return entry[1];
+        }
+    }
+    return undefined;
+}
+/**
+ * Extracts file path from various JSON structures
+ */
+function extractPathFromJson(parsed) {
+    // Claude Code format: { tool_input: { file_path: "..." } }
+    if (hasProperty(parsed, 'tool_input')) {
+        const toolInput = getProperty(parsed, 'tool_input');
+        if (typeof toolInput === 'object' && toolInput !== null) {
+            // Check for file_path (Read, Write, Edit tools)
+            if (hasProperty(toolInput, 'file_path')) {
+                const filePath = getProperty(toolInput, 'file_path');
+                if (typeof filePath === 'string') {
+                    return filePath;
+                }
+            }
+            // Check for path (Glob tool)
+            if (hasProperty(toolInput, 'path')) {
+                const path = getProperty(toolInput, 'path');
+                if (typeof path === 'string') {
+                    return path;
+                }
+            }
+            // Check for notebook_path (NotebookEdit tool)
+            if (hasProperty(toolInput, 'notebook_path')) {
+                const notebookPath = getProperty(toolInput, 'notebook_path');
+                if (typeof notebookPath === 'string') {
+                    return notebookPath;
+                }
+            }
+        }
+    }
+    // Generic JSON formats
+    const pathKeys = ['file_path', 'path', 'filePath', 'file', 'notebook_path'];
+    for (const key of pathKeys) {
+        if (hasProperty(parsed, key)) {
+            const value = getProperty(parsed, key);
+            if (typeof value === 'string') {
+                return value;
+            }
+        }
+    }
+    return null;
+}
+/**
+ * Extracts tool name from JSON input
+ */
+function extractToolFromJson(parsed) {
+    // Check for tool_name field
+    if (hasProperty(parsed, 'tool_name')) {
+        const toolName = getProperty(parsed, 'tool_name');
+        if (typeof toolName === 'string') {
+            return toolName;
+        }
+    }
+    // Check for tool field
+    if (hasProperty(parsed, 'tool')) {
+        const tool = getProperty(parsed, 'tool');
+        if (typeof tool === 'string') {
+            return tool;
+        }
+    }
+    return null;
+}
+/**
+ * Parses stdin input and extracts file path
+ */
+export function parseStdin(input) {
+    const trimmed = input.trim();
+    // Try JSON parsing first
+    if (trimmed.startsWith('{')) {
+        try {
+            const parsed = JSON.parse(trimmed);
+            if (typeof parsed === 'object' && parsed !== null) {
+                const path = extractPathFromJson(parsed);
+                const tool = extractToolFromJson(parsed);
+                const inferredOperation = tool ? TOOL_OPERATIONS[tool] : undefined;
+                return { path, tool: tool ?? undefined, inferredOperation };
+            }
+        }
+        catch {
+            // Not valid JSON, fall through to plain text
+        }
+    }
+    // Plain text - treat as file path
+    return { path: trimmed || null };
+}
+/**
+ * Reads stdin asynchronously
+ */
+export async function readStdin() {
+    return new Promise((resolve, reject) => {
+        let data = '';
+        process.stdin.setEncoding('utf8');
+        process.stdin.on('data', chunk => {
+            data += chunk;
+        });
+        process.stdin.on('end', () => {
+            resolve(data);
+        });
+        process.stdin.on('error', err => {
+            reject(err);
+        });
+        if (process.stdin.isTTY) {
+            resolve('');
+        }
+    });
+}
+//# sourceMappingURL=stdin.js.map

package/dist/stdin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdin.js","sourceRoot":"","sources":["../src/stdin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAkB,MAAM,YAAY,CAAA;AAc5D;;GAEG;AACH,SAAS,WAAW,CAAC,GAAW,EAAE,GAAW;IAC3C,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;AACvD,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,GAAW,EAAE,GAAW;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACnC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,CAAC,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,MAAc;IACzC,2DAA2D;IAC3D,IAAI,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;QACnD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACxD,gDAAgD;YAChD,IAAI,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;gBACxC,MAAM,QAAQ,GAAG,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;gBACpD,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBACjC,OAAO,QAAQ,CAAA;gBACjB,CAAC;YACH,CAAC;YACD,6BAA6B;YAC7B,IAAI,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;gBAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC7B,OAAO,IAAI,CAAA;gBACb,CAAC;YACH,CAAC;YACD,8CAA8C;YAC9C,IAAI,WAAW,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC;gBAC5C,MAAM,YAAY,GAAG,WAAW,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;gBAC5D,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;oBACrC,OAAO,YAAY,CAAA;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC,CAAA;IAC3E,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;YACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,MAAc;IACzC,4BAA4B;IAC5B,IAAI,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QACjD,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAA;QACjB,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACxC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAE5B,yBAAyB;IACzB,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAC3C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBAClD,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAA;gBACxC,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAA;gBACxC,MAAM,iBAAiB,GAAG,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;gBAElE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,SAAS,EAAE,iBAAiB,EAAE,CAAA;YAC7D,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6CAA6C;QAC/C,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,IAAI,EAAE,CAAA;AAClC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAA;QAEb,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QAEjC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAA;QACf,CAAC,CAAC,CAAA;QAEF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YAC3B,OAAO,CAAC,IAAI,CAAC,CAAA;QACf,CAAC,CAAC,CAAA;QAEF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YAC9B,MAAM,CAAC,GAAG,CAAC,CAAA;QACb,CAAC,CAAC,CAAA;QAEF,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACxB,OAAO,CAAC,EAAE,CAAC,CAAA;QACb,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Access levels for file permissions
+ */
+export type AccessLevel = 'none' | 'read' | 'write' | 'readwrite';
+/**
+ * Operation types that can be checked
+ */
+export type Operation = 'read' | 'write';
+/**
+ * Pattern type for matching paths
+ */
+export type PatternType = 'glob' | 'regex';
+/**
+ * A single permission rule
+ */
+export interface Rule {
+    /** Path pattern to match */
+    path: string;
+    /** Pattern type (default: glob) */
+    type: PatternType;
+    /** Access level for this path */
+    access: AccessLevel;
+    /** Human-readable reason for this rule */
+    reason?: string;
+    /** Whether this is a negation rule (starts with !) */
+    negated: boolean;
+}
+/**
+ * Configuration file structure
+ */
+export interface Config {
+    /** Config version */
+    version: number;
+    /** Whether to extend user config (default: true) */
+    extends: boolean;
+    /** Permission rules */
+    rules: Rule[];
+}
+/**
+ * Result of a permission check
+ */
+export interface CheckResult {
+    /** Whether the operation is allowed */
+    allowed: boolean;
+    /** The path that was checked */
+    path: string;
+    /** The operation that was checked */
+    operation: Operation;
+    /** The rule that matched (if any) */
+    rule?: string;
+    /** The access level of the matching rule */
+    access?: AccessLevel;
+    /** Human-readable message */
+    message: string;
+}
+/**
+ * Tool name to operation mapping
+ */
+export declare const TOOL_OPERATIONS: Record<string, Operation>;
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,WAAW,CAAA;AAEjE;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,OAAO,CAAA;AAExC;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,OAAO,CAAA;AAE1C;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,mCAAmC;IACnC,IAAI,EAAE,WAAW,CAAA;IACjB,iCAAiC;IACjC,MAAM,EAAE,WAAW,CAAA;IACnB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,sDAAsD;IACtD,OAAO,EAAE,OAAO,CAAA;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB,qBAAqB;IACrB,OAAO,EAAE,MAAM,CAAA;IACf,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAA;IAChB,uBAAuB;IACvB,KAAK,EAAE,IAAI,EAAE,CAAA;CACd;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,OAAO,EAAE,OAAO,CAAA;IAChB,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,qCAAqC;IACrC,SAAS,EAAE,SAAS,CAAA;IACpB,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,4CAA4C;IAC5C,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAOrD,CAAA"}

package/dist/types.js

@@ -0,0 +1,12 @@
+/**
+ * Tool name to operation mapping
+ */
+export const TOOL_OPERATIONS = {
+    Read: 'read',
+    Glob: 'read',
+    Grep: 'read',
+    Edit: 'write',
+    Write: 'write',
+    NotebookEdit: 'write',
+};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AA6DA;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAA8B;IACxD,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,OAAO;IACd,YAAY,EAAE,OAAO;CACtB,CAAA"}

package/package.json

@@ -0,0 +1,75 @@
+{
+  "name": "ai-fs-permissions",
+  "version": "0.1.0",
+  "description": "CLI tool to enforce file system permissions for AI agents. Protects sensitive files and folders from unauthorized access.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "ai-fs-permissions": "./dist/cli.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "keywords": [
+    "file-permissions",
+    "ai-safety",
+    "claude-code",
+    "gemini-cli",
+    "cursor",
+    "agent-governance",
+    "security",
+    "cli"
+  ],
+  "author": "",
+  "license": "MIT",
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/tupe12334/ai-fs-permissions.git"
+  },
+  "bugs": {
+    "url": "https://github.com/tupe12334/ai-fs-permissions/issues"
+  },
+  "homepage": "https://github.com/tupe12334/ai-fs-permissions#readme",
+  "dependencies": {
+    "minimatch": "^10.0.0",
+    "picomatch": "^4.0.0",
+    "yaml": "^2.7.0",
+    "zod": "^3.24.0"
+  },
+  "devDependencies": {
+    "@eslint/js": "^9.39.2",
+    "@types/node": "^22.0.0",
+    "@types/picomatch": "^3.0.0",
+    "@vitest/coverage-v8": "^3.0.0",
+    "eslint": "^9.0.0",
+    "husky": "^9.0.0",
+    "prettier": "^3.0.0",
+    "typescript": "^5.0.0",
+    "typescript-eslint": "^8.53.1",
+    "vitest": "^3.0.0"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "test": "vitest",
+    "test:watch": "vitest --watch",
+    "test:coverage": "vitest --coverage",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "format": "prettier --write \"src/**/*.{ts,tsx,js,jsx,json,md}\"",
+    "format:check": "prettier --check \"src/**/*.{ts,tsx,js,jsx,json,md}\""
+  }
+}