airaknit 1.1.2-rc.9

package/src/shared/log-sink.test.ts

@@ -0,0 +1,112 @@
+import { describe, test, expect } from "bun:test"
+import {
+  toLogLine,
+  serializeBatch,
+  createLogShipper,
+  installConsoleTee,
+  type LogLine,
+  type LogSinkBase,
+} from "./log-sink"
+
+const base: LogSinkBase = { source: "backend", component: "server", host: "h", pid: 42 }
+
+describe("toLogLine", () => {
+  test("joins string args into _msg and stamps fields", () => {
+    const at = new Date("2026-05-27T10:00:00.000Z")
+    const line = toLogLine("warn", ["[tinkaria]", "boom", 7], base, at)
+    expect(line).toEqual({
+      _time: "2026-05-27T10:00:00.000Z",
+      _msg: "[tinkaria] boom 7",
+      level: "warn",
+      source: "backend",
+      component: "server",
+      host: "h",
+      pid: 42,
+    })
+  })
+
+  test("serializes Error args to stack/message, objects to JSON", () => {
+    const line = toLogLine("error", [new Error("nope"), { a: 1 }], base)
+    expect(line._msg).toContain("nope")
+    expect(line._msg).toContain('{"a":1}')
+  })
+
+  test("does not throw on circular objects", () => {
+    const circular: Record<string, unknown> = {}
+    circular.self = circular
+    const line = toLogLine("info", [circular], base)
+    expect(typeof line._msg).toBe("string")
+  })
+})
+
+describe("serializeBatch", () => {
+  test("produces newline-delimited JSON", () => {
+    const lines: LogLine[] = [
+      toLogLine("info", ["a"], base, new Date("2026-05-27T10:00:00Z")),
+      toLogLine("info", ["b"], base, new Date("2026-05-27T10:00:01Z")),
+    ]
+    const out = serializeBatch(lines)
+    expect(out.split("\n")).toHaveLength(2)
+    expect(JSON.parse(out.split("\n")[0])._msg).toBe("a")
+  })
+})
+
+describe("createLogShipper", () => {
+  test("POSTs ndjson to /insert/jsonline with stream fields, and swallows fetch errors", async () => {
+    const calls: { url: string; body: string }[] = []
+    const fetchFn = (async (url: string, init?: RequestInit) => {
+      calls.push({ url, body: String(init?.body) })
+      return new Response(null, { status: 204 })
+    }) as unknown as typeof fetch
+
+    const shipper = createLogShipper({ url: "http://127.0.0.1:9428/", base, fetchFn })
+    shipper.add(toLogLine("info", ["one"], base))
+    shipper.add(toLogLine("info", ["two"], base))
+    await shipper.flush()
+    shipper.stop()
+
+    expect(calls).toHaveLength(1)
+    expect(calls[0].url).toBe("http://127.0.0.1:9428/insert/jsonline?_stream_fields=source,component")
+    expect(calls[0].body.split("\n")).toHaveLength(2)
+  })
+
+  test("flush with empty buffer makes no request", async () => {
+    let n = 0
+    const fetchFn = (async () => { n++; return new Response(null) }) as unknown as typeof fetch
+    const shipper = createLogShipper({ url: "http://x", base, fetchFn })
+    await shipper.flush()
+    shipper.stop()
+    expect(n).toBe(0)
+  })
+
+  test("fetch rejection is swallowed (no throw)", async () => {
+    const fetchFn = (async () => { throw new Error("network down") }) as unknown as typeof fetch
+    const shipper = createLogShipper({ url: "http://x", base, fetchFn })
+    shipper.add(toLogLine("error", ["x"], base))
+    await expect(shipper.flush()).resolves.toBeUndefined()
+    shipper.stop()
+  })
+})
+
+describe("installConsoleTee", () => {
+  test("no-op when VICTORIALOGS_URL unset (console unchanged)", () => {
+    const before = console.warn
+    const uninstall = installConsoleTee({} as NodeJS.ProcessEnv, "server")
+    expect(console.warn).toBe(before)
+    uninstall()
+  })
+
+  test("when set, tees but still calls the original console method", () => {
+    const seen: unknown[][] = []
+    const origWarn = console.warn
+    console.warn = ((...a: unknown[]) => seen.push(a)) as typeof console.warn
+    const uninstall = installConsoleTee(
+      { VICTORIALOGS_URL: "http://127.0.0.1:9428" } as unknown as NodeJS.ProcessEnv,
+      "server",
+    )
+    console.warn("hello", 1)
+    expect(seen).toEqual([["hello", 1]]) // original still invoked
+    uninstall()
+    console.warn = origWarn
+  })
+})

package/src/shared/log-sink.ts

@@ -0,0 +1,185 @@
+/**
+ * Backend log sink → VictoriaLogs (observability, decision 0012).
+ *
+ * Tees `console.*` output to VictoriaLogs' JSON-stream ingest API
+ * (`POST /insert/jsonline`) in addition to normal stdout. Used by both the
+ * server (`cli.ts`) and the runner (`runner.ts`) processes.
+ *
+ * Design constraints:
+ * - **Never break the app.** All shipping is fire-and-forget; a down or slow
+ *   VictoriaLogs must not throw into, block, or crash the host process.
+ * - **Opt-in.** Disabled unless `VICTORIALOGS_URL` is set, so default runs are
+ *   byte-identical to before.
+ * - **No deps.** Plain `fetch` + a small in-memory batch.
+ *
+ * Pure helpers (`toLogLine`, `serializeBatch`) are exported for unit tests.
+ */
+
+export type LogLevel = "debug" | "info" | "warn" | "error"
+
+/** One VictoriaLogs jsonline record. `_time`/`_msg` are VL's default time/msg fields. */
+export interface LogLine {
+  _time: string
+  _msg: string
+  level: LogLevel
+  source: string
+  component: string
+  host: string
+  pid: number
+}
+
+export interface LogSinkBase {
+  source: string // "backend"
+  component: string // "server" | "runner"
+  host: string
+  pid: number
+}
+
+/** Flatten console arguments into a single message string (no throwing on cycles). */
+function stringifyArgs(args: unknown[]): string {
+  return args
+    .map((a) => {
+      if (typeof a === "string") return a
+      if (a instanceof Error) return a.stack ?? `${a.name}: ${a.message}`
+      try {
+        return JSON.stringify(a)
+      } catch {
+        return String(a)
+      }
+    })
+    .join(" ")
+}
+
+/** Build a single VL record from a console call. Pure. */
+export function toLogLine(
+  level: LogLevel,
+  args: unknown[],
+  base: LogSinkBase,
+  now: Date = new Date(),
+): LogLine {
+  return {
+    _time: now.toISOString(),
+    _msg: stringifyArgs(args),
+    level,
+    source: base.source,
+    component: base.component,
+    host: base.host,
+    pid: base.pid,
+  }
+}
+
+/** Serialize a batch as newline-delimited JSON for `/insert/jsonline`. Pure. */
+export function serializeBatch(lines: LogLine[]): string {
+  return lines.map((l) => JSON.stringify(l)).join("\n")
+}
+
+export interface LogShipperOptions {
+  url: string
+  base: LogSinkBase
+  flushIntervalMs?: number
+  maxBatch?: number
+  /** Injectable for tests. */
+  fetchFn?: typeof fetch
+}
+
+export interface LogShipper {
+  add(line: LogLine): void
+  flush(): Promise<void>
+  stop(): void
+}
+
+/**
+ * Batching shipper. Buffers records and POSTs them to VictoriaLogs on an
+ * interval or when the buffer is full. All network errors are swallowed.
+ */
+export function createLogShipper(opts: LogShipperOptions): LogShipper {
+  const flushIntervalMs = opts.flushIntervalMs ?? 2000
+  const maxBatch = opts.maxBatch ?? 500
+  const doFetch = opts.fetchFn ?? fetch
+  const endpoint = `${opts.url.replace(/\/$/, "")}/insert/jsonline?_stream_fields=source,component`
+
+  let buffer: LogLine[] = []
+  let timer: ReturnType<typeof setInterval> | null = null
+
+  async function flush(): Promise<void> {
+    if (buffer.length === 0) return
+    const batch = buffer
+    buffer = []
+    try {
+      await doFetch(endpoint, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-ndjson" },
+        body: serializeBatch(batch),
+      })
+    } catch {
+      // Drop on failure — observability must never back-pressure the app.
+    }
+  }
+
+  function add(line: LogLine): void {
+    buffer.push(line)
+    if (buffer.length >= maxBatch) void flush()
+  }
+
+  timer = setInterval(() => void flush(), flushIntervalMs)
+  // Don't keep the event loop alive just for log flushing.
+  if (typeof timer === "object" && timer && "unref" in timer) {
+    ;(timer as { unref: () => void }).unref()
+  }
+
+  return {
+    add,
+    flush,
+    stop() {
+      if (timer) clearInterval(timer)
+      timer = null
+    },
+  }
+}
+
+/**
+ * Tee `console.{debug,info,warn,error,log}` to VictoriaLogs while preserving the
+ * original stdout behavior. No-op (returns a no-op uninstaller) when
+ * `VICTORIALOGS_URL` is not set. Returns an uninstall function.
+ */
+export function installConsoleTee(env: NodeJS.ProcessEnv, component: string): () => void {
+  const url = env.VICTORIALOGS_URL?.trim()
+  if (!url) return () => {}
+
+  const base: LogSinkBase = {
+    source: "backend",
+    component,
+    host: env.HOSTNAME || "unknown",
+    pid: typeof process !== "undefined" ? process.pid : 0,
+  }
+  const shipper = createLogShipper({ url, base })
+
+  const levels: Array<[keyof Console, LogLevel]> = [
+    ["debug", "debug"],
+    ["info", "info"],
+    ["log", "info"],
+    ["warn", "warn"],
+    ["error", "error"],
+  ]
+  const originals = new Map<keyof Console, (...a: unknown[]) => void>()
+
+  for (const [method, level] of levels) {
+    const original = console[method] as (...a: unknown[]) => void
+    originals.set(method, original)
+    ;(console[method] as unknown) = (...args: unknown[]) => {
+      try {
+        shipper.add(toLogLine(level, args, base))
+      } catch {
+        // never let logging shipping break a console call
+      }
+      original(...args)
+    }
+  }
+
+  return () => {
+    for (const [method, original] of originals) {
+      ;(console[method] as unknown) = original
+    }
+    shipper.stop()
+  }
+}

package/src/shared/mention-pattern.ts

@@ -0,0 +1,7 @@
+// Single source of truth for `@agent/<name>` mention parsing.
+// Server is authoritative; the client uses this for picker chips only.
+export const AGENT_MENTION_PATTERN = "(^|[\\s\\n\\t])@agent/([a-z0-9_-]+)"
+
+export function createAgentMentionRegex(): RegExp {
+  return new RegExp(AGENT_MENTION_PATTERN, "gi")
+}

package/src/shared/merge-presets.ts

@@ -0,0 +1,41 @@
+import { type PresetDefinition, getPreset } from "./preset-types"
+
+export type MergePresetDefinition = PresetDefinition
+
+export const MERGE_PRESETS: readonly MergePresetDefinition[] = [
+  {
+    id: "synthesis",
+    label: "Synthesis",
+    description: "Combine findings and decisions into a unified understanding.",
+    defaultIntent: "Synthesize these sessions into a unified understanding. Extract the key findings, decisions, and constraints from each, resolve any contradictions, and frame the merged context as a single coherent brief for the next step.",
+    generatorHint: "Bias toward a cohesive narrative that resolves contradictions and surfaces the strongest decisions from each source session.",
+  },
+  {
+    id: "compare_decide",
+    label: "Compare & decide",
+    description: "Compare approaches explored in different sessions and surface trade-offs.",
+    defaultIntent: "Compare the approaches explored across these sessions. Surface the trade-offs, identify which constraints each approach satisfies or violates, and frame the merged context to support a clear decision.",
+    generatorHint: "Emphasize trade-offs, differences in assumptions, and decision criteria. Present approaches side-by-side.",
+  },
+  {
+    id: "consolidate_progress",
+    label: "Consolidate progress",
+    description: "Merge partial work from several sessions into a single next-step brief.",
+    defaultIntent: "Consolidate the progress from these sessions into a single next-step brief. Identify what was completed, what remains, and any blockers or dependencies across the sessions.",
+    generatorHint: "Prioritize what was accomplished, what's left to do, and any cross-session dependencies or blockers.",
+  },
+  {
+    id: "knowledge_base",
+    label: "Knowledge base",
+    description: "Extract and unify learned patterns, constraints, and decisions.",
+    defaultIntent: "Extract and unify the learned patterns, constraints, and key decisions from these sessions. Organize them as a reference brief that can guide future work without re-reading the originals.",
+    generatorHint: "Bias toward structured reference content: patterns, constraints, conventions, and decisions. Avoid execution steps.",
+  },
+] as const
+
+export const MAX_MERGE_SESSIONS = 5
+export const DEFAULT_MERGE_PRESET_ID = MERGE_PRESETS[0]!.id
+
+export function getMergePreset(id?: string | null): MergePresetDefinition | null {
+  return getPreset(MERGE_PRESETS, id)
+}

package/src/shared/nats-subjects.test.ts

@@ -0,0 +1,61 @@
+import { describe, test, expect } from "bun:test"
+import {
+  snapshotSubject,
+  terminalEventSubject,
+  commandSubject,
+  ALL_SNAPSHOTS,
+  ALL_TERMINAL_EVENTS,
+  ALL_COMMANDS,
+} from "./nats-subjects"
+
+describe("snapshotSubject", () => {
+  test("sidebar", () => {
+    expect(snapshotSubject({ type: "sidebar" })).toBe("runtime.snap.sidebar")
+  })
+
+  test("local-workspaces", () => {
+    expect(snapshotSubject({ type: "local-workspaces" })).toBe("runtime.snap.local-workspaces")
+  })
+
+  test("update", () => {
+    expect(snapshotSubject({ type: "update" })).toBe("runtime.snap.update")
+  })
+
+  test("chat with chatId", () => {
+    expect(snapshotSubject({ type: "chat", chatId: "abc-123" })).toBe("runtime.snap.chat.abc-123")
+  })
+
+  test("terminal with terminalId", () => {
+    expect(snapshotSubject({ type: "terminal", terminalId: "term-456" })).toBe("runtime.snap.terminal.term-456")
+  })
+})
+
+describe("terminalEventSubject", () => {
+  test("generates correct subject", () => {
+    expect(terminalEventSubject("term-789")).toBe("runtime.evt.terminal.term-789")
+  })
+})
+
+describe("commandSubject", () => {
+  test("generates correct subject", () => {
+    expect(commandSubject("chat.send")).toBe("runtime.cmd.chat.send")
+  })
+
+  test("system commands", () => {
+    expect(commandSubject("system.ping")).toBe("runtime.cmd.system.ping")
+  })
+})
+
+describe("wildcards", () => {
+  test("ALL_SNAPSHOTS", () => {
+    expect(ALL_SNAPSHOTS).toBe("runtime.snap.>")
+  })
+
+  test("ALL_TERMINAL_EVENTS", () => {
+    expect(ALL_TERMINAL_EVENTS).toBe("runtime.evt.terminal.>")
+  })
+
+  test("ALL_COMMANDS", () => {
+    expect(ALL_COMMANDS).toBe("runtime.cmd.>")
+  })
+})

package/src/shared/nats-subjects.ts

@@ -0,0 +1,131 @@
+import type { SubscriptionTopic } from "./protocol"
+
+const PREFIX = "runtime"
+const SNAP_PREFIX = `${PREFIX}.snap.`
+
+/** Map a subscription topic to a KV key (also the subject suffix after `runtime.snap.`) */
+export function snapshotKvKey(topic: SubscriptionTopic): string {
+  switch (topic.type) {
+    case "chat": return `chat.${topic.chatId}`
+    case "terminal": return `terminal.${topic.terminalId}`
+    case "orchestration": return `orchestration.${topic.chatId}`
+    case "workspace": return `workspace.${topic.workspaceId}`
+    case "agent-config": return `agent-config.${topic.workspaceId}`
+    case "repos": return `repos.${topic.workspaceId}`
+    case "workflow-runs": return `workflow-runs.${topic.workspaceId}`
+    case "sandbox-status": return `sandbox-status.${topic.workspaceId}`
+    default: return topic.type
+  }
+}
+
+export function snapshotSubject(topic: SubscriptionTopic): string {
+  return `${SNAP_PREFIX}${snapshotKvKey(topic)}`
+}
+
+export function terminalEventSubject(terminalId: string): string {
+  return `${PREFIX}.evt.terminal.${terminalId}`
+}
+
+export function chatMessageSubject(chatId: string): string {
+  return `${PREFIX}.evt.chat.${chatId}`
+}
+
+export function commandSubject(commandType: string): string {
+  return `${PREFIX}.cmd.${commandType}`
+}
+
+/** Wildcard: all snapshot subjects */
+export const ALL_SNAPSHOTS = `${SNAP_PREFIX}>`
+
+/** Wildcard: all terminal events */
+export const ALL_TERMINAL_EVENTS = `${PREFIX}.evt.terminal.>`
+
+/** Wildcard: all chat message events */
+export const ALL_CHAT_MESSAGE_EVENTS = `${PREFIX}.evt.chat.>`
+
+/** Wildcard: all commands */
+export const ALL_COMMANDS = `${PREFIX}.cmd.>`
+
+/** JetStream stream name for chat message events */
+export const CHAT_MESSAGE_EVENTS_STREAM_NAME = "KANNA_CHAT_MESSAGE_EVENTS"
+
+/** KV bucket name for snapshot caching */
+export const KV_BUCKET = "runtime_snapshots"
+
+/** JetStream stream name for workspace coordination events */
+export const WORKSPACE_COORDINATION_EVENTS_STREAM_NAME = "KANNA_WORKSPACE_COORDINATION_EVENTS"
+
+/** Subject for workspace coordination events */
+export function workspaceCoordinationEventSubject(workspaceId: string): string {
+  return `${PREFIX}.evt.workspace.${workspaceId}`
+}
+
+/** Wildcard: all workspace coordination events */
+export const ALL_WORKSPACE_COORDINATION_EVENTS = `${PREFIX}.evt.workspace.>`
+
+/** JetStream stream name for workflow run events */
+export const WORKFLOW_RUN_EVENTS_STREAM_NAME = "KANNA_WORKFLOW_RUN_EVENTS"
+
+/** Subject for workflow run events */
+export function workflowRunEventSubject(workspaceId: string): string {
+  return `${PREFIX}.evt.workflow.${workspaceId}`
+}
+
+/** Wildcard: all workflow run events */
+export const ALL_WORKFLOW_RUN_EVENTS = `${PREFIX}.evt.workflow.>`
+
+/** JetStream stream name for sandbox events */
+export const SANDBOX_EVENTS_STREAM_NAME = "KANNA_SANDBOX_EVENTS"
+
+/** Subject for sandbox events */
+export function sandboxEventSubject(workspaceId: string): string {
+  return `${PREFIX}.evt.sandbox.${workspaceId}`
+}
+
+/** Wildcard: all sandbox events */
+export const ALL_SANDBOX_EVENTS = `${PREFIX}.evt.sandbox.>`
+
+// === claude-pty subjects ===
+
+export type PtyCommandType =
+  | "pty.spawn"
+  | "pty.input"
+  | "pty.resize"
+  | "pty.cancel"
+  | "pty.exit"
+  | "pty.snapshot"
+
+export function ptyCommandSubject(commandType: PtyCommandType): string {
+  return `${PREFIX}.cmd.${commandType}`
+}
+
+export function ptyDeltaSubject(): string {
+  return `${PREFIX}.evt.pty.delta`
+}
+
+export function ptyInstanceEventSubject(chatId: string): string {
+  return `${PREFIX}.evt.pty.${chatId}`
+}
+
+export const ALL_PTY_COMMANDS = `${PREFIX}.cmd.pty.>`
+export const ALL_PTY_EVENTS = `${PREFIX}.evt.pty.>`
+
+// === oauth pool subjects ===
+
+export type OAuthCommandType =
+  | "oauth.list"
+  | "oauth.add"
+  | "oauth.remove"
+  | "oauth.update"
+  | "oauth.setConcurrencyDefault"
+
+export function oauthCommandSubject(commandType: OAuthCommandType): string {
+  return `${PREFIX}.cmd.${commandType}`
+}
+
+export function oauthChangedSubject(): string {
+  return `${PREFIX}.evt.oauth.changed`
+}
+
+export const ALL_OAUTH_COMMANDS = `${PREFIX}.cmd.oauth.>`
+export const ALL_OAUTH_EVENTS = `${PREFIX}.evt.oauth.>`

package/src/shared/permission-policy.ts

@@ -0,0 +1,136 @@
+export type ToolRequestStatus =
+  | "pending"
+  | "answered"
+  | "timeout"
+  | "canceled"
+  | "session_closed"
+  | "arg_mismatch"
+
+export const POLICY_TERMINAL_STATUSES: ReadonlySet<ToolRequestStatus> = new Set([
+  "answered",
+  "timeout",
+  "canceled",
+  "session_closed",
+  "arg_mismatch",
+])
+
+export type PolicyVerdict = "auto-allow" | "auto-deny" | "ask"
+
+export interface BashGateConfig {
+  autoAllowVerbs: string[]
+}
+
+export interface ToolRule {
+  tool: string
+  /** ECMAScript regex source — no delimiters or flags, passed to `new RegExp(pattern)`. */
+  pattern: string
+}
+
+export interface ChatPermissionPolicy {
+  defaultAction: "ask" | "auto-allow" | "auto-deny"
+  bash: BashGateConfig
+  readPathDeny: string[]
+  /** Paths the model cannot write or edit. Enforced for mcp__kanna__write and mcp__kanna__edit. */
+  writePathDeny: string[]
+  toolDenyList: ToolRule[]
+  toolAllowList: ToolRule[]
+}
+
+/**
+ * Per-chat policy override. Only set fields override the global policy
+ * defaults. Persisted on `ChatRecord.policyOverride` and merged in
+ * `AgentCoordinator` before forwarding to the session.
+ *
+ * `readPathDeny` / `writePathDeny` REPLACE the default list when provided
+ * (so the user can both add and remove entries deliberately).
+ */
+export interface ChatPermissionPolicyOverride {
+  defaultAction?: ChatPermissionPolicy["defaultAction"]
+  readPathDeny?: string[]
+  writePathDeny?: string[]
+}
+
+export function mergePolicyOverride(
+  base: ChatPermissionPolicy,
+  override: ChatPermissionPolicyOverride | null | undefined,
+): ChatPermissionPolicy {
+  if (!override) return base
+  return {
+    ...base,
+    defaultAction: override.defaultAction ?? base.defaultAction,
+    readPathDeny: override.readPathDeny ?? base.readPathDeny,
+    writePathDeny: override.writePathDeny ?? base.writePathDeny,
+  }
+}
+
+export interface ToolRequestDecision {
+  kind: "allow" | "deny" | "answer"
+  payload?: unknown
+  reason?: string
+}
+
+export interface ToolRequest {
+  id: string
+  chatId: string
+  sessionId: string
+  toolUseId: string
+  toolName: string
+  arguments: Record<string, unknown>  // MCP tool arguments — arbitrary MCP tool args, unknown shape by design
+  canonicalArgsHash: string
+  policyVerdict: PolicyVerdict
+  status: ToolRequestStatus
+  decision?: ToolRequestDecision
+  mismatchReason?: string
+  createdAt: number
+  resolvedAt?: number
+  expiresAt: number
+}
+
+export const POLICY_DEFAULT: ChatPermissionPolicy = {
+  defaultAction: "ask",
+  bash: {
+    autoAllowVerbs: ["ls", "pwd", "git status", "git diff", "git log"],
+  },
+  readPathDeny: [
+    "~/.ssh",
+    "~/.aws",
+    "~/.gcp",
+    "~/.config/gh",
+    "~/.claude",
+    "~/.kanna",
+    "~/Library/Keychains",
+    "/etc/shadow",
+    "/etc/sudoers",
+    "~/.gnupg",
+    "~/.gitconfig",
+    "**/.git/config",
+    "~/.npmrc",
+    "~/.netrc",
+    "~/.docker/config.json",
+    "**/.env",
+    "**/.env.*",
+    "**/credentials*",
+    "**/*.pem",
+    "**/*.key",
+    "**/id_rsa*",
+    "**/id_ed25519*",
+  ],
+  writePathDeny: [
+    "/etc/**",
+    "/usr/**",
+    "/System/**",
+    "~/.ssh/**",
+    "~/.aws/**",
+    "~/.config/gh/**",
+    "~/.claude/**",
+    "~/.kanna/**",
+    "~/.gnupg/**",
+    "~/.gitconfig",
+    "**/.git/config",
+  ],
+  toolDenyList: [
+    { tool: "mcp__kanna__bash", pattern: "rm\\s+-rf\\s+(/|~|\\$HOME)(?:\\b|$|\\s)" },
+    { tool: "mcp__kanna__bash", pattern: "git\\s+push\\b.*--force" },
+  ],
+  toolAllowList: [],
+}

package/src/shared/ports.ts

@@ -0,0 +1,3 @@
+export const PROD_SERVER_HOST = "127.0.0.1"
+export const PROD_SERVER_PORT = 3210
+export const DEV_CLIENT_PORT = 5174

package/src/shared/preset-types.ts

@@ -0,0 +1,15 @@
+export interface PresetDefinition {
+  id: string
+  label: string
+  description: string
+  defaultIntent: string
+  generatorHint: string
+}
+
+export function getPreset<T extends PresetDefinition>(
+  presets: readonly T[],
+  id?: string | null,
+): T | null {
+  if (!id) return null
+  return presets.find((preset) => preset.id === id) ?? null
+}