axon-code 2.4.0

package/dist/organization/index.js

@@ -0,0 +1,237 @@
+/**
+ * Organization and Team Management
+ * Enterprise features for team collaboration
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+// Storage paths
+const ORG_DIR = path.join(os.homedir(), '.axon', 'organization');
+const ORG_FILE = path.join(ORG_DIR, 'org.json');
+// Current organization
+let currentOrg = null;
+/**
+ * Initialize organization module
+ */
+export function initOrganization() {
+    if (!fs.existsSync(ORG_DIR)) {
+        fs.mkdirSync(ORG_DIR, { recursive: true });
+    }
+    // Check environment variables
+    const orgId = process.env.AXON_ORG_ID;
+    const orgName = process.env.AXON_ORG_NAME;
+    if (orgId) {
+        currentOrg = {
+            id: orgId,
+            name: orgName || 'Unknown Organization',
+        };
+        return currentOrg;
+    }
+    // Try to load from file
+    if (fs.existsSync(ORG_FILE)) {
+        try {
+            currentOrg = JSON.parse(fs.readFileSync(ORG_FILE, 'utf-8'));
+            return currentOrg;
+        }
+        catch {
+            // Ignore parse errors
+        }
+    }
+    return null;
+}
+/**
+ * Get current organization
+ */
+export function getOrganization() {
+    return currentOrg;
+}
+/**
+ * Set organization
+ */
+export function setOrganization(org) {
+    currentOrg = org;
+    if (!fs.existsSync(ORG_DIR)) {
+        fs.mkdirSync(ORG_DIR, { recursive: true });
+    }
+    fs.writeFileSync(ORG_FILE, JSON.stringify(org, null, 2), { mode: 0o600 });
+}
+/**
+ * Clear organization
+ */
+export function clearOrganization() {
+    currentOrg = null;
+    if (fs.existsSync(ORG_FILE)) {
+        fs.unlinkSync(ORG_FILE);
+    }
+}
+/**
+ * Check if user is in an organization
+ */
+export function isInOrganization() {
+    return currentOrg !== null;
+}
+/**
+ * Get organization display name
+ */
+export function getOrganizationDisplayName() {
+    return currentOrg?.name || null;
+}
+/**
+ * Check organization permission
+ */
+export function checkOrganizationPermission(action) {
+    if (!currentOrg) {
+        return { allowed: true };
+    }
+    const settings = currentOrg.settings;
+    if (!settings) {
+        return { allowed: true };
+    }
+    // Check model restrictions
+    if (action.startsWith('use_model:')) {
+        const model = action.replace('use_model:', '');
+        if (settings.allowedModels && !settings.allowedModels.includes(model)) {
+            return {
+                allowed: false,
+                reason: `Model ${model} is not allowed by organization policy`,
+            };
+        }
+    }
+    return { allowed: true };
+}
+/**
+ * Log audit event
+ */
+export function logAuditEvent(event) {
+    if (!currentOrg?.settings?.auditLogging) {
+        return;
+    }
+    const auditFile = path.join(ORG_DIR, 'audit.jsonl');
+    const logEntry = {
+        ...event,
+        timestamp: event.timestamp || Date.now(),
+        organizationId: currentOrg.id,
+    };
+    try {
+        fs.appendFileSync(auditFile, JSON.stringify(logEntry) + '\n', { mode: 0o600 });
+    }
+    catch {
+        // Ignore audit log errors
+    }
+}
+/**
+ * Get audit logs
+ */
+export function getAuditLogs(options) {
+    const auditFile = path.join(ORG_DIR, 'audit.jsonl');
+    if (!fs.existsSync(auditFile)) {
+        return [];
+    }
+    try {
+        const content = fs.readFileSync(auditFile, 'utf-8');
+        let logs = content
+            .trim()
+            .split('\n')
+            .filter(Boolean)
+            .map((line) => JSON.parse(line));
+        // Apply filters
+        if (options?.since) {
+            logs = logs.filter((log) => log.timestamp >= options.since);
+        }
+        if (options?.action) {
+            logs = logs.filter((log) => log.action === options.action);
+        }
+        // Sort by timestamp descending
+        logs.sort((a, b) => b.timestamp - a.timestamp);
+        // Apply limit
+        if (options?.limit) {
+            logs = logs.slice(0, options.limit);
+        }
+        return logs;
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Team collaboration features
+ */
+export class TeamManager {
+    mailbox = null;
+    constructor() {
+        this.loadMailbox();
+    }
+    loadMailbox() {
+        const mailboxFile = path.join(ORG_DIR, 'mailbox.json');
+        if (fs.existsSync(mailboxFile)) {
+            try {
+                this.mailbox = JSON.parse(fs.readFileSync(mailboxFile, 'utf-8'));
+            }
+            catch {
+                // Ignore
+            }
+        }
+    }
+    saveMailbox() {
+        if (!this.mailbox)
+            return;
+        const mailboxFile = path.join(ORG_DIR, 'mailbox.json');
+        fs.writeFileSync(mailboxFile, JSON.stringify(this.mailbox, null, 2), { mode: 0o600 });
+    }
+    /**
+     * Send team message
+     */
+    sendMessage(to, subject, content) {
+        if (!currentOrg) {
+            return null;
+        }
+        if (!this.mailbox) {
+            this.mailbox = {
+                id: `mailbox_${Date.now()}`,
+                organizationId: currentOrg.id,
+                messages: [],
+            };
+        }
+        const message = {
+            id: `msg_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
+            from: process.env.USER || 'unknown',
+            to,
+            subject,
+            content,
+            timestamp: Date.now(),
+            read: false,
+        };
+        this.mailbox.messages.push(message);
+        this.saveMailbox();
+        return message;
+    }
+    /**
+     * Get unread messages
+     */
+    getUnreadMessages() {
+        return this.mailbox?.messages.filter((m) => !m.read) || [];
+    }
+    /**
+     * Mark message as read
+     */
+    markAsRead(messageId) {
+        if (!this.mailbox)
+            return false;
+        const message = this.mailbox.messages.find((m) => m.id === messageId);
+        if (message) {
+            message.read = true;
+            this.saveMailbox();
+            return true;
+        }
+        return false;
+    }
+    /**
+     * Get all messages
+     */
+    getAllMessages() {
+        return this.mailbox?.messages || [];
+    }
+}
+// Default team manager
+export const teamManager = new TeamManager();
+//# sourceMappingURL=index.js.map

package/dist/organization/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/organization/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AA+CzB,gBAAgB;AAChB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;AACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAEhD,uBAAuB;AACvB,IAAI,UAAU,GAAwB,IAAI,CAAC;AAE3C;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,8BAA8B;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAE1C,IAAI,KAAK,EAAE,CAAC;QACV,UAAU,GAAG;YACX,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,OAAO,IAAI,sBAAsB;SACxC,CAAC;QACF,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,wBAAwB;IACxB,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YAC5D,OAAO,UAAU,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,GAAiB;IAC/C,UAAU,GAAG,GAAG,CAAC;IAEjB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,UAAU,GAAG,IAAI,CAAC;IAElB,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,UAAU,KAAK,IAAI,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,UAAU,EAAE,IAAI,IAAI,IAAI,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAc;IAIxD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,2BAA2B;IAC3B,IAAI,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,QAAQ,CAAC,aAAa,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACtE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,KAAK,wCAAwC;aAC/D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,KAK7B;IACC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;QACxC,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG;QACf,GAAG,KAAK;QACR,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;QACxC,cAAc,EAAE,UAAU,CAAC,EAAE;KAC9B,CAAC;IAEF,IAAI,CAAC;QACH,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,OAI5B;IAOC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAEpD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,IAAI,GAAG,OAAO;aACf,IAAI,EAAE;aACN,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAEnC,gBAAgB;QAChB,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,KAAM,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACpB,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7D,CAAC;QAED,+BAA+B;QAC/B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;QAE/C,cAAc;QACd,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,WAAW;IACd,OAAO,GAAuB,IAAI,CAAC;IAE3C;QACE,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC;IAEO,WAAW;QACjB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAEvD,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;YACnE,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;IACH,CAAC;IAEO,WAAW;QACjB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAE1B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACvD,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxF,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,EAAU,EAAE,OAAe,EAAE,OAAe;QACtD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,OAAO,GAAG;gBACb,EAAE,EAAE,WAAW,IAAI,CAAC,GAAG,EAAE,EAAE;gBAC3B,cAAc,EAAE,UAAU,CAAC,EAAE;gBAC7B,QAAQ,EAAE,EAAE;aACb,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAgB;YAC3B,EAAE,EAAE,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;YACjE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,SAAS;YACnC,EAAE;YACF,OAAO;YACP,OAAO;YACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,IAAI,EAAE,KAAK;SACZ,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,SAAiB;QAC1B,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAEhC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QACtE,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,OAAO,EAAE,QAAQ,IAAI,EAAE,CAAC;IACtC,CAAC;CACF;AAED,uBAAuB;AACvB,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC"}

package/dist/permissions/elevated-commands.d.ts

@@ -0,0 +1,38 @@
+/**
+ * 管理员权限命令模块
+ *
+ * 设计理念：
+ * - 利用现有的权限弹框机制
+ * - Worker 调用 Bash 时，自动检测是否需要管理员权限
+ * - 如果需要，触发权限请求，让用户确认
+ * - 用户确认后，以提升权限执行命令
+ *
+ * 这不是一个新工具，而是 Bash 工具的增强功能
+ */
+/**
+ * 检测命令是否需要管理员权限
+ */
+export declare function needsElevation(command: string): boolean;
+/**
+ * 获取命令需要管理员权限的原因
+ */
+export declare function getElevationReason(command: string): string;
+export interface ElevatedExecutionResult {
+    success: boolean;
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+    error?: string;
+}
+/**
+ * 以提升权限执行命令
+ * 这个函数只在用户通过权限弹框确认后调用
+ */
+export declare function executeElevated(command: string, workingDir?: string, timeout?: number): Promise<ElevatedExecutionResult>;
+declare const _default: {
+    needsElevation: typeof needsElevation;
+    getElevationReason: typeof getElevationReason;
+    executeElevated: typeof executeElevated;
+};
+export default _default;
+//# sourceMappingURL=elevated-commands.d.ts.map

package/dist/permissions/elevated-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"elevated-commands.d.ts","sourceRoot":"","sources":["../../src/permissions/elevated-commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAmDH;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAQvD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAc1D;AAMD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,GAAE,MAAe,GACvB,OAAO,CAAC,uBAAuB,CAAC,CAoBlC;;;;;;AAqKD,wBAIE"}

package/dist/permissions/elevated-commands.js

@@ -0,0 +1,256 @@
+/**
+ * 管理员权限命令模块
+ *
+ * 设计理念：
+ * - 利用现有的权限弹框机制
+ * - Worker 调用 Bash 时，自动检测是否需要管理员权限
+ * - 如果需要，触发权限请求，让用户确认
+ * - 用户确认后，以提升权限执行命令
+ *
+ * 这不是一个新工具，而是 Bash 工具的增强功能
+ */
+import { execSync } from 'child_process';
+import * as os from 'os';
+import * as path from 'path';
+import * as fs from 'fs';
+// ============================================================================
+// 命令检测
+// ============================================================================
+/**
+ * 需要管理员权限的命令模式
+ */
+const ELEVATED_COMMAND_PATTERNS = {
+    windows: [
+        // 软件安装
+        /^winget\s+install/i,
+        /^choco\s+install/i,
+        /^scoop\s+install/i,
+        // 服务管理
+        /^net\s+start/i,
+        /^net\s+stop/i,
+        /^sc\s+(start|stop|config)/i,
+        // 系统配置
+        /^setx\s+.*\/m/i,
+        /^reg\s+(add|delete)/i,
+        // Docker（可能需要管理员）
+        /^docker\s+service/i,
+    ],
+    darwin: [
+        // 软件安装
+        /^brew\s+install.*--cask/i,
+        /^sudo\s+/i,
+        // 服务管理
+        /^launchctl\s+(start|stop|load|unload)/i,
+        // 系统配置
+        /^defaults\s+write/i,
+    ],
+    linux: [
+        // 软件安装
+        /^(sudo\s+)?(apt|apt-get|yum|dnf|pacman)\s+install/i,
+        /^sudo\s+/i,
+        // 服务管理
+        /^(sudo\s+)?systemctl\s+(start|stop|enable|disable)/i,
+        /^(sudo\s+)?service\s+\w+\s+(start|stop|restart)/i,
+        // Docker（可能需要管理员）
+        /^(sudo\s+)?docker\s+/i,
+    ],
+};
+/**
+ * 检测命令是否需要管理员权限
+ */
+export function needsElevation(command) {
+    const platform = os.platform();
+    const patterns = ELEVATED_COMMAND_PATTERNS[platform === 'win32' ? 'windows' :
+        platform === 'darwin' ? 'darwin' : 'linux'];
+    return patterns.some(pattern => pattern.test(command));
+}
+/**
+ * 获取命令需要管理员权限的原因
+ */
+export function getElevationReason(command) {
+    if (/install/i.test(command)) {
+        return 'Installing software requires administrator privileges';
+    }
+    if (/start|stop|restart|enable|disable/i.test(command)) {
+        return 'Managing system services requires administrator privileges';
+    }
+    if (/docker/i.test(command)) {
+        return 'Docker operations may require administrator privileges';
+    }
+    if (/sudo/i.test(command)) {
+        return 'Command contains sudo, requires administrator privileges';
+    }
+    return 'This command may require administrator privileges';
+}
+/**
+ * 以提升权限执行命令
+ * 这个函数只在用户通过权限弹框确认后调用
+ */
+export async function executeElevated(command, workingDir, timeout = 300000) {
+    const platform = os.platform();
+    try {
+        if (platform === 'win32') {
+            return await executeElevatedWindows(command, workingDir, timeout);
+        }
+        else if (platform === 'darwin') {
+            return await executeElevatedMac(command, workingDir, timeout);
+        }
+        else {
+            return await executeElevatedLinux(command, workingDir, timeout);
+        }
+    }
+    catch (error) {
+        return {
+            success: false,
+            stdout: '',
+            stderr: '',
+            exitCode: -1,
+            error: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+/**
+ * Windows: 使用 PowerShell 提升权限（会弹出 UAC 对话框）
+ */
+async function executeElevatedWindows(command, workingDir, timeout = 300000) {
+    // 创建临时脚本
+    const tempScript = path.join(os.tmpdir(), `elevated-${Date.now()}.ps1`);
+    const outputFile = path.join(os.tmpdir(), `elevated-stdout-${Date.now()}.txt`);
+    const errorFile = path.join(os.tmpdir(), `elevated-stderr-${Date.now()}.txt`);
+    const exitCodeFile = path.join(os.tmpdir(), `elevated-exitcode-${Date.now()}.txt`);
+    // 如果命令已经是 PowerShell 格式，直接执行；否则通过 cmd 执行
+    const isPowerShellCommand = command.startsWith('powershell') || command.startsWith('pwsh');
+    const actualCommand = isPowerShellCommand ? command : `cmd /c "${command.replace(/"/g, '\\"')}"`;
+    const scriptContent = `
+$ErrorActionPreference = "Continue"
+${workingDir ? `Set-Location "${workingDir}"` : ''}
+try {
+    $output = ${actualCommand} 2>&1
+    $stdout = $output | Where-Object { $_ -isnot [System.Management.Automation.ErrorRecord] } | Out-String
+    $stderr = $output | Where-Object { $_ -is [System.Management.Automation.ErrorRecord] } | Out-String
+    $stdout | Out-File -FilePath "${outputFile.replace(/\\/g, '\\\\')}" -Encoding UTF8
+    $stderr | Out-File -FilePath "${errorFile.replace(/\\/g, '\\\\')}" -Encoding UTF8
+    $LASTEXITCODE | Out-File -FilePath "${exitCodeFile.replace(/\\/g, '\\\\')}" -Encoding UTF8
+} catch {
+    $_.Exception.Message | Out-File -FilePath "${errorFile.replace(/\\/g, '\\\\')}" -Encoding UTF8
+    "1" | Out-File -FilePath "${exitCodeFile.replace(/\\/g, '\\\\')}" -Encoding UTF8
+}
+`;
+    fs.writeFileSync(tempScript, scriptContent, 'utf-8');
+    try {
+        // 使用 Start-Process 以管理员权限运行（会弹出 UAC）
+        execSync(`powershell -Command "Start-Process powershell -ArgumentList '-ExecutionPolicy Bypass -File \\"${tempScript}\\"' -Verb RunAs -Wait"`, { timeout, stdio: 'pipe' });
+        // 读取输出
+        const stdout = fs.existsSync(outputFile) ? fs.readFileSync(outputFile, 'utf-8').trim() : '';
+        const stderr = fs.existsSync(errorFile) ? fs.readFileSync(errorFile, 'utf-8').trim() : '';
+        const exitCode = fs.existsSync(exitCodeFile) ? parseInt(fs.readFileSync(exitCodeFile, 'utf-8').trim()) || 0 : 0;
+        return {
+            success: exitCode === 0,
+            stdout,
+            stderr,
+            exitCode,
+        };
+    }
+    finally {
+        // 清理临时文件
+        try {
+            if (fs.existsSync(tempScript))
+                fs.unlinkSync(tempScript);
+            if (fs.existsSync(outputFile))
+                fs.unlinkSync(outputFile);
+            if (fs.existsSync(errorFile))
+                fs.unlinkSync(errorFile);
+            if (fs.existsSync(exitCodeFile))
+                fs.unlinkSync(exitCodeFile);
+        }
+        catch {
+            // 忽略清理错误
+        }
+    }
+}
+/**
+ * macOS: 使用 osascript 请求管理员权限（会弹出密码对话框）
+ */
+async function executeElevatedMac(command, workingDir, timeout = 300000) {
+    const fullCommand = workingDir ? `cd "${workingDir}" && ${command}` : command;
+    // 移除已有的 sudo 前缀（osascript 会处理权限）
+    const cleanCommand = fullCommand.replace(/^sudo\s+/, '');
+    // 使用 osascript 弹出密码对话框
+    const script = `do shell script "${cleanCommand.replace(/"/g, '\\"')}" with administrator privileges`;
+    try {
+        const stdout = execSync(`osascript -e '${script}'`, {
+            timeout,
+            encoding: 'utf-8',
+        });
+        return {
+            success: true,
+            stdout,
+            stderr: '',
+            exitCode: 0,
+        };
+    }
+    catch (error) {
+        return {
+            success: false,
+            stdout: '',
+            stderr: error.stderr || '',
+            exitCode: error.status || 1,
+            error: error.message,
+        };
+    }
+}
+/**
+ * Linux: 使用 pkexec（图形化）或 sudo（终端）
+ */
+async function executeElevatedLinux(command, workingDir, timeout = 300000) {
+    const fullCommand = workingDir ? `cd "${workingDir}" && ${command}` : command;
+    // 移除已有的 sudo 前缀
+    const cleanCommand = fullCommand.replace(/^sudo\s+/, '');
+    // 优先尝试 pkexec（图形化密码提示）
+    try {
+        const stdout = execSync(`pkexec sh -c '${cleanCommand}'`, {
+            timeout,
+            encoding: 'utf-8',
+        });
+        return {
+            success: true,
+            stdout,
+            stderr: '',
+            exitCode: 0,
+        };
+    }
+    catch (pkexecError) {
+        // 如果 pkexec 失败，尝试 sudo
+        try {
+            const stdout = execSync(`sudo sh -c '${cleanCommand}'`, {
+                timeout,
+                encoding: 'utf-8',
+                stdio: 'pipe',
+            });
+            return {
+                success: true,
+                stdout,
+                stderr: '',
+                exitCode: 0,
+            };
+        }
+        catch (error) {
+            return {
+                success: false,
+                stdout: '',
+                stderr: error.stderr || '',
+                exitCode: error.status || 1,
+                error: `Elevated execution failed: ${error.message}`,
+            };
+        }
+    }
+}
+// ============================================================================
+// 导出
+// ============================================================================
+export default {
+    needsElevation,
+    getElevationReason,
+    executeElevated,
+};
+//# sourceMappingURL=elevated-commands.js.map

package/dist/permissions/elevated-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"elevated-commands.js","sourceRoot":"","sources":["../../src/permissions/elevated-commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAS,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAEzB,+EAA+E;AAC/E,OAAO;AACP,+EAA+E;AAE/E;;GAEG;AACH,MAAM,yBAAyB,GAAG;IAChC,OAAO,EAAE;QACP,OAAO;QACP,oBAAoB;QACpB,mBAAmB;QACnB,mBAAmB;QACnB,OAAO;QACP,eAAe;QACf,cAAc;QACd,4BAA4B;QAC5B,OAAO;QACP,gBAAgB;QAChB,sBAAsB;QACtB,kBAAkB;QAClB,oBAAoB;KACrB;IACD,MAAM,EAAE;QACN,OAAO;QACP,0BAA0B;QAC1B,WAAW;QACX,OAAO;QACP,wCAAwC;QACxC,OAAO;QACP,oBAAoB;KACrB;IACD,KAAK,EAAE;QACL,OAAO;QACP,oDAAoD;QACpD,WAAW;QACX,OAAO;QACP,qDAAqD;QACrD,kDAAkD;QAClD,kBAAkB;QAClB,uBAAuB;KACxB;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,yBAAyB,CACxC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAClC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAC3C,CAAC;IAEF,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,uDAAuD,CAAC;IACjE,CAAC;IACD,IAAI,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,OAAO,4DAA4D,CAAC;IACtE,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,wDAAwD,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,0DAA0D,CAAC;IACpE,CAAC;IACD,OAAO,mDAAmD,CAAC;AAC7D,CAAC;AAcD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAe,EACf,UAAmB,EACnB,UAAkB,MAAM;IAExB,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAE/B,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,OAAO,MAAM,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QACpE,CAAC;aAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,OAAO,MAAM,kBAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,OAAO,MAAM,oBAAoB,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,CAAC,CAAC;YACZ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,sBAAsB,CACnC,OAAe,EACf,UAAmB,EACnB,UAAkB,MAAM;IAExB,SAAS;IACT,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,YAAY,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mBAAmB,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mBAAmB,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,qBAAqB,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAEnF,yCAAyC;IACzC,MAAM,mBAAmB,GAAG,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC3F,MAAM,aAAa,GAAG,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;IAEjG,MAAM,aAAa,GAAG;;EAEtB,UAAU,CAAC,CAAC,CAAC,iBAAiB,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE;;gBAElC,aAAa;;;oCAGO,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;oCACjC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;0CAC1B,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;;iDAE5B,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;gCACjD,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;;CAElE,CAAC;IAEA,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IAErD,IAAI,CAAC;QACH,qCAAqC;QACrC,QAAQ,CACN,iGAAiG,UAAU,yBAAyB,EACpI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAC3B,CAAC;QAEF,OAAO;QACP,MAAM,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,MAAM,GAAG,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEhH,OAAO;YACL,OAAO,EAAE,QAAQ,KAAK,CAAC;YACvB,MAAM;YACN,MAAM;YACN,QAAQ;SACT,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,SAAS;QACT,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;gBAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACzD,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;gBAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACzD,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACvD,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;gBAAE,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,kBAAkB,CAC/B,OAAe,EACf,UAAmB,EACnB,UAAkB,MAAM;IAExB,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,OAAO,UAAU,QAAQ,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAE9E,iCAAiC;IACjC,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAEzD,uBAAuB;IACvB,MAAM,MAAM,GAAG,oBAAoB,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,iCAAiC,CAAC;IAEtG,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,iBAAiB,MAAM,GAAG,EAAE;YAClD,OAAO;YACP,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM;YACN,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;YAC1B,QAAQ,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC;YAC3B,KAAK,EAAE,KAAK,CAAC,OAAO;SACrB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,oBAAoB,CACjC,OAAe,EACf,UAAmB,EACnB,UAAkB,MAAM;IAExB,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,OAAO,UAAU,QAAQ,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAE9E,gBAAgB;IAChB,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAEzD,uBAAuB;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,iBAAiB,YAAY,GAAG,EAAE;YACxD,OAAO;YACP,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM;YACN,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;IAAC,OAAO,WAAW,EAAE,CAAC;QACrB,uBAAuB;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,QAAQ,CAAC,eAAe,YAAY,GAAG,EAAE;gBACtD,OAAO;gBACP,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM;gBACN,MAAM,EAAE,EAAE;gBACV,QAAQ,EAAE,CAAC;aACZ,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;gBAC1B,QAAQ,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC;gBAC3B,KAAK,EAAE,8BAA8B,KAAK,CAAC,OAAO,EAAE;aACrD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,KAAK;AACL,+EAA+E;AAE/E,eAAe;IACb,cAAc;IACd,kBAAkB;IAClB,eAAe;CAChB,CAAC"}

package/dist/permissions/index.d.ts

@@ -0,0 +1,120 @@
+/**
+ * 权限模式系统
+ * 控制工具执行的权限检查
+ *
+ * 功能：
+ * - 工具级权限控制 (allow/deny 特定工具)
+ * - 路径级权限 (支持 glob patterns)
+ * - 命令级权限 (Bash 命令白名单/黑名单)
+ * - 永久记忆和会话记忆
+ * - 权限审计日志
+ */
+import type { PermissionMode } from '../types/index.js';
+export type PermissionType = 'file_read' | 'file_write' | 'file_delete' | 'bash_command' | 'network_request' | 'mcp_server' | 'plugin_install' | 'system_config' | 'elevated_command';
+export interface PermissionRequest {
+    type: PermissionType;
+    tool: string;
+    description: string;
+    resource?: string;
+    details?: Record<string, unknown>;
+}
+export interface PermissionDecision {
+    allowed: boolean;
+    remember?: boolean;
+    scope?: 'once' | 'session' | 'always';
+    reason?: string;
+    /** v2.1.7: 用户在接受权限提示时提供的可选反馈 */
+    feedback?: string;
+}
+export interface PermissionRule {
+    type: PermissionType;
+    pattern?: string | RegExp;
+    action: 'allow' | 'deny' | 'ask';
+    scope?: 'once' | 'session' | 'always';
+}
+export interface PermissionConfig {
+    tools?: {
+        allow?: string[];
+        deny?: string[];
+    };
+    paths?: {
+        allow?: string[];
+        deny?: string[];
+    };
+    commands?: {
+        allow?: string[];
+        deny?: string[];
+    };
+    network?: {
+        allow?: string[];
+        deny?: string[];
+    };
+    audit?: {
+        enabled?: boolean;
+        logFile?: string;
+        maxSize?: number;
+    };
+}
+export declare class PermissionManager {
+    private mode;
+    private rules;
+    private rememberedPermissions;
+    private sessionPermissions;
+    private allowedDirs;
+    private configDir;
+    private permissionConfig;
+    private auditLogPath;
+    private auditEnabled;
+    private additionalDirectories;
+    private alwaysAllowRules;
+    private alwaysDenyRules;
+    private alwaysAskRules;
+    constructor(mode?: PermissionMode);
+    setMode(mode: PermissionMode): void;
+    getMode(): PermissionMode;
+    addAllowedDir(dir: string, source?: string): void;
+    removeAllowedDir(dir: string): void;
+    getAdditionalDirectories(): Map<string, {
+        path: string;
+        source: string;
+    }>;
+    isPathAllowed(filePath: string): boolean;
+    check(request: PermissionRequest): Promise<PermissionDecision>;
+    private autoDecide;
+    private checkWithRules;
+    private ruleMatches;
+    private checkRemembered;
+    private getPermissionKey;
+    private askUser;
+    private rememberPermission;
+    private setupDefaultRules;
+    addRule(rule: PermissionRule): void;
+    addPermissionRule(behavior: 'allow' | 'deny' | 'ask', destination: string, ruleValues: string[]): void;
+    replacePermissionRules(behavior: 'allow' | 'deny' | 'ask', destination: string, ruleValues: string[]): void;
+    removePermissionRule(behavior: 'allow' | 'deny' | 'ask', destination: string, ruleValues: string[]): void;
+    getAllPermissionRules(): {
+        allow: Map<string, string[]>;
+        deny: Map<string, string[]>;
+        ask: Map<string, string[]>;
+    };
+    clearSessionPermissions(): void;
+    private persistPermissions;
+    private loadPersistedPermissions;
+    private loadPermissionConfig;
+    private checkToolPermission;
+    private checkPathPermission;
+    private checkCommandPermission;
+    private checkNetworkPermission;
+    private matchesPattern;
+    private matchesGlobPath;
+    private logAudit;
+    setPermissionConfig(config: PermissionConfig): void;
+    getPermissionConfig(): PermissionConfig;
+    export(): object;
+}
+export declare function requiresPermission(type: PermissionType, descriptionFn?: (input: unknown) => string): (target: unknown, propertyKey: string, descriptor: PropertyDescriptor) => PropertyDescriptor;
+export declare const permissionManager: PermissionManager;
+export * from './tools.js';
+export * from './shell-security.js';
+export * from './rule-parser.js';
+//# sourceMappingURL=index.d.ts.map