boten-gemma 0.1.0

package/dist/config/schema.js

@@ -0,0 +1,119 @@
+import { z } from 'zod';
+// --- Sub-schemas ---
+export const OAuthConfigSchema = z.object({
+    clientId: z.string().optional(),
+    clientSecret: z.string().optional(),
+});
+export const OpenAICompatConfigSchema = z.object({
+    baseUrl: z.string().url(),
+    model: z.string(),
+});
+export const ModelConfigSchema = z.object({
+    provider: z.enum(['gemini', 'openai-compat']).default('gemini'),
+    model: z.string().default('gemini-2.5-flash'),
+    fallbackModel: z.string().optional(),
+    auth: z.enum(['oauth', 'api-key', 'adc']).optional(),
+    apiKey: z.string().optional(),
+    oauth: OAuthConfigSchema.optional(),
+    openaiCompat: OpenAICompatConfigSchema.optional(),
+});
+export const GatewayAuthConfigSchema = z.object({
+    token: z.string().optional(),
+});
+export const GatewayConfigSchema = z.object({
+    port: z.number().int().min(1).max(65535).default(process.env['GEMMA_PORT'] ? parseInt(process.env['GEMMA_PORT'], 10) : 18789),
+    bind: z.string().default(process.env['GEMMA_BIND'] || '127.0.0.1'),
+    auth: GatewayAuthConfigSchema.optional(),
+});
+export const TelegramChannelConfigSchema = z.object({
+    enabled: z.boolean().default(false),
+    token: z.string().optional(),
+    webhookUrl: z.string().optional(),
+    allowFrom: z.array(z.number()).default([]),
+});
+export const WebChannelConfigSchema = z.object({
+    enabled: z.boolean().default(true),
+});
+export const CliChannelConfigSchema = z.object({
+    enabled: z.boolean().default(false),
+});
+export const ChannelsConfigSchema = z.object({
+    telegram: TelegramChannelConfigSchema.default({ enabled: false, allowFrom: [] }),
+    web: WebChannelConfigSchema.default({ enabled: true }),
+    cli: CliChannelConfigSchema.default({ enabled: false }),
+});
+export const AutoApproveConfigSchema = z.object({
+    internalReads: z.boolean().default(true),
+    memoryWrites: z.boolean().default(false),
+});
+export const ConfirmConfigSchema = z.object({
+    timeout: z.number().int().min(1).default(300),
+    autoApprove: AutoApproveConfigSchema.default({ internalReads: true, memoryWrites: false }),
+});
+export const WorkspaceConfigSchema = z.object({
+    path: z.string().default('~/.gemma/workspace'),
+});
+export const ExecToolConfigSchema = z.object({
+    timeout: z.number().int().min(1).default(30),
+    shell: z.string().default('/bin/bash'),
+});
+export const WebSearchToolConfigSchema = z.object({
+    provider: z.enum(['brave']).default('brave'),
+    apiKey: z.string().optional(),
+});
+export const ToolsConfigSchema = z.object({
+    exec: ExecToolConfigSchema.default({ timeout: 30, shell: '/bin/bash' }),
+    webSearch: WebSearchToolConfigSchema.default({ provider: 'brave' }),
+});
+export const SkillsConfigSchema = z.object({
+    dirs: z.array(z.string()).default([]),
+    entries: z.record(z.string(), z.unknown()).default({}),
+});
+export const PanelsConfigSchema = z.object({
+    enabled: z.boolean().default(true),
+    dir: z.string().default('~/.gemma/panels'),
+    maxDataSize: z.number().int().default(5_242_880),
+    disabled: z.array(z.string()).default([]),
+    devMode: z.boolean().default(false),
+    serviceTimeout: z.number().int().default(30_000),
+});
+export const HeartbeatConfigSchema = z.object({
+    enabled: z.boolean().default(true),
+    intervalMinutes: z.number().int().min(1).default(30),
+    prompt: z.string().default('Read HEARTBEAT.md if it exists. Follow it strictly. If nothing needs attention, reply HEARTBEAT_OK.'),
+});
+export const CronConfigSchema = z.object({
+    enabled: z.boolean().default(true),
+    store: z.string().default('~/.gemma/cron/jobs.json'),
+});
+export const AgentLoopConfigSchema = z.object({
+    maxIterations: z.number().int().min(1).max(100).default(25),
+    compactionThreshold: z.number().int().min(10_000).default(200_000),
+    maxContextChars: z.number().int().min(10_000).default(320_000),
+    maxToolResultChars: z.number().int().min(1_000).default(30_000),
+});
+export const MCPServerConfigSchema = z.object({
+    command: z.string(),
+    args: z.array(z.string()).default([]),
+    env: z.record(z.string(), z.string()).optional(),
+    enabled: z.boolean().default(true),
+});
+export const MCPConfigSchema = z.object({
+    servers: z.record(z.string(), MCPServerConfigSchema).default({}),
+});
+// --- Root config schema ---
+export const GemmaConfigSchema = z.object({
+    model: ModelConfigSchema.default(() => ModelConfigSchema.parse({})),
+    gateway: GatewayConfigSchema.default(() => GatewayConfigSchema.parse({})),
+    channels: ChannelsConfigSchema.default(() => ChannelsConfigSchema.parse({})),
+    confirm: ConfirmConfigSchema.default(() => ConfirmConfigSchema.parse({})),
+    workspace: WorkspaceConfigSchema.default(() => WorkspaceConfigSchema.parse({})),
+    tools: ToolsConfigSchema.default(() => ToolsConfigSchema.parse({})),
+    skills: SkillsConfigSchema.default(() => SkillsConfigSchema.parse({})),
+    panels: PanelsConfigSchema.default(() => PanelsConfigSchema.parse({})),
+    heartbeat: HeartbeatConfigSchema.default(() => HeartbeatConfigSchema.parse({})),
+    agent: AgentLoopConfigSchema.default(() => AgentLoopConfigSchema.parse({})),
+    cron: CronConfigSchema.default(() => CronConfigSchema.parse({})),
+    mcp: MCPConfigSchema.default(() => MCPConfigSchema.parse({})),
+});
+//# sourceMappingURL=schema.js.map

package/dist/config/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,sBAAsB;AAEtB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC/D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC7C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACnC,YAAY,EAAE,wBAAwB,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAC9C,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAC5E;IACD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,WAAW,CAAC;IAClE,IAAI,EAAE,uBAAuB,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC3C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,2BAA2B,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAChF,GAAG,EAAE,sBAAsB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACtD,GAAG,EAAE,sBAAsB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;CACxD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACxC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACzC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAC7C,WAAW,EAAE,uBAAuB,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;CAC3F,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC;CAC/C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IACvE,SAAS,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAgB,EAAE,CAAC;CAC7E,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACvD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IAChD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;CACjD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CACxB,qGAAqG,CACtG;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,yBAAyB,CAAC;CACrD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3D,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAClE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CAChE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACjE,CAAC,CAAC;AAEH,6BAA6B;AAE7B,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnE,OAAO,EAAE,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzE,QAAQ,EAAE,oBAAoB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5E,OAAO,EAAE,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzE,SAAS,EAAE,qBAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/E,KAAK,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnE,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtE,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtE,SAAS,EAAE,qBAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/E,KAAK,EAAE,qBAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3E,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChE,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;CAC9D,CAAC,CAAC"}

package/dist/confirm/audit.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Audit Logger — records all tool proposals and user decisions.
+ *
+ * Every confirmation cycle is logged to ~/.gemma/logs/audit.jsonl
+ * Format:
+ * {
+ *   "timestamp": "2026-02-17T14:30:00.000Z",
+ *   "session": "main",
+ *   "proposed": [{"tool": "read", "args": {"path": "..."}}],
+ *   "approved": [0],
+ *   "rejected": [1],
+ *   "auto_approved": [2],
+ *   "user_response_time_ms": 4200
+ * }
+ */
+import type { ToolCall } from '../llm/types.js';
+import type { ConfirmationResult } from '../tools/types.js';
+export interface AuditEntry {
+    timestamp: string;
+    session: string;
+    proposed: Array<{
+        tool: string;
+        args: Record<string, unknown>;
+    }>;
+    approved: number[];
+    rejected: number[];
+    auto_approved: number[];
+    user_response_time_ms: number;
+}
+/**
+ * Log a confirmation gate cycle to the audit log.
+ */
+export declare function logAudit(sessionId: string, calls: ToolCall[], result: ConfirmationResult, autoApprovedIndices: number[], responseTimeMs: number): Promise<void>;
+//# sourceMappingURL=audit.d.ts.map

package/dist/confirm/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/confirm/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAWD;;GAEG;AACH,wBAAsB,QAAQ,CAC5B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,QAAQ,EAAE,EACjB,MAAM,EAAE,kBAAkB,EAC1B,mBAAmB,EAAE,MAAM,EAAE,EAC7B,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,IAAI,CAAC,CAmBf"}

package/dist/confirm/audit.js

@@ -0,0 +1,49 @@
+/**
+ * Audit Logger — records all tool proposals and user decisions.
+ *
+ * Every confirmation cycle is logged to ~/.gemma/logs/audit.jsonl
+ * Format:
+ * {
+ *   "timestamp": "2026-02-17T14:30:00.000Z",
+ *   "session": "main",
+ *   "proposed": [{"tool": "read", "args": {"path": "..."}}],
+ *   "approved": [0],
+ *   "rejected": [1],
+ *   "auto_approved": [2],
+ *   "user_response_time_ms": 4200
+ * }
+ */
+import { appendFile, mkdir } from 'node:fs/promises';
+import { resolve, dirname } from 'node:path';
+import { homedir } from 'node:os';
+/** Resolve the audit log path. */
+function getAuditLogPath() {
+    const gemmaHome = process.env['GEMMA_HOME'] || '~/.gemma';
+    const base = gemmaHome === '~' || gemmaHome.startsWith('~/') || gemmaHome.startsWith('~\\')
+        ? resolve(homedir(), gemmaHome.slice(2))
+        : resolve(gemmaHome);
+    return resolve(base, 'logs', 'audit.jsonl');
+}
+/**
+ * Log a confirmation gate cycle to the audit log.
+ */
+export async function logAudit(sessionId, calls, result, autoApprovedIndices, responseTimeMs) {
+    const logPath = getAuditLogPath();
+    const entry = {
+        timestamp: new Date().toISOString(),
+        session: sessionId,
+        proposed: calls.map((c) => ({ tool: c.tool, args: c.args })),
+        approved: result.approved,
+        rejected: result.rejected,
+        auto_approved: autoApprovedIndices,
+        user_response_time_ms: Math.round(responseTimeMs),
+    };
+    try {
+        await mkdir(dirname(logPath), { recursive: true });
+        await appendFile(logPath, JSON.stringify(entry) + '\n', 'utf-8');
+    }
+    catch {
+        // Audit logging is best-effort — don't crash the gate if logging fails
+    }
+}
+//# sourceMappingURL=audit.js.map

package/dist/confirm/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/confirm/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAclC,kCAAkC;AAClC,SAAS,eAAe;IACtB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC;IAC1D,MAAM,IAAI,GAAG,SAAS,KAAK,GAAG,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC;QACzF,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvB,OAAO,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,SAAiB,EACjB,KAAiB,EACjB,MAA0B,EAC1B,mBAA6B,EAC7B,cAAsB;IAEtB,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAElC,MAAM,KAAK,GAAe;QACxB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,aAAa,EAAE,mBAAmB;QAClC,qBAAqB,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;KAClD,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;IACzE,CAAC;AACH,CAAC"}

package/dist/confirm/auto-approve.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Auto-approve rules for the confirmation gate.
+ *
+ * Determines which tool calls can be auto-approved (executed without user confirmation).
+ * The boundary is intentionally narrow: only reads of Gemma's own internal files,
+ * and optionally memory writes.
+ */
+import type { ToolCall } from '../llm/types.js';
+import type { ConfirmConfig } from '../config/schema.js';
+/**
+ * Determine if a tool call needs user confirmation.
+ *
+ * Returns false (auto-approved) only for:
+ * - `read` calls targeting files inside GEMMA_HOME (when internalReads is enabled)
+ * - `write`/`edit` calls targeting MEMORY.md or memory/*.md (when memoryWrites is enabled)
+ *
+ * Everything else requires confirmation.
+ */
+export declare function needsConfirmation(call: ToolCall, config: ConfirmConfig, gemmaHome?: string): boolean;
+//# sourceMappingURL=auto-approve.d.ts.map

package/dist/confirm/auto-approve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-approve.d.ts","sourceRoot":"","sources":["../../src/confirm/auto-approve.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAezD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,aAAa,EACrB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAmCT"}

package/dist/confirm/auto-approve.js

@@ -0,0 +1,62 @@
+/**
+ * Auto-approve rules for the confirmation gate.
+ *
+ * Determines which tool calls can be auto-approved (executed without user confirmation).
+ * The boundary is intentionally narrow: only reads of Gemma's own internal files,
+ * and optionally memory writes.
+ */
+import { resolve, sep, basename } from 'node:path';
+import { homedir } from 'node:os';
+/** Resolve a path that might start with ~ to an absolute path. */
+function expandHome(p) {
+    if (p === '~' || p.startsWith('~/') || p.startsWith('~\\')) {
+        return resolve(homedir(), p.slice(2));
+    }
+    return resolve(p);
+}
+/** Get the resolved GEMMA_HOME path. */
+function resolveGemmaHome() {
+    return expandHome(process.env['GEMMA_HOME'] || '~/.gemma');
+}
+/**
+ * Determine if a tool call needs user confirmation.
+ *
+ * Returns false (auto-approved) only for:
+ * - `read` calls targeting files inside GEMMA_HOME (when internalReads is enabled)
+ * - `write`/`edit` calls targeting MEMORY.md or memory/*.md (when memoryWrites is enabled)
+ *
+ * Everything else requires confirmation.
+ */
+export function needsConfirmation(call, config, gemmaHome) {
+    const home = gemmaHome ?? resolveGemmaHome();
+    // Auto-approve reads of Gemma's own workspace files
+    if (call.tool === 'read' && config.autoApprove.internalReads) {
+        const filePath = call.args['path'];
+        if (typeof filePath === 'string') {
+            const resolved = resolve(expandHome(filePath));
+            if (resolved === home || resolved.startsWith(home + sep)) {
+                return false;
+            }
+            // Also auto-approve HEARTBEAT.md reads (heartbeat prompt)
+            if (basename(resolved) === 'HEARTBEAT.md') {
+                return false;
+            }
+        }
+    }
+    // Auto-approve memory writes when configured
+    if ((call.tool === 'write' || call.tool === 'edit') && config.autoApprove.memoryWrites) {
+        const filePath = call.args['path'];
+        if (typeof filePath === 'string') {
+            const resolved = resolve(expandHome(filePath));
+            const workspacePath = resolve(home, 'workspace');
+            const memoryFile = resolve(workspacePath, 'MEMORY.md');
+            const memoryDir = resolve(workspacePath, 'memory') + sep;
+            if (resolved === memoryFile || resolved.startsWith(memoryDir)) {
+                return false;
+            }
+        }
+    }
+    // Everything else requires confirmation
+    return true;
+}
+//# sourceMappingURL=auto-approve.js.map

package/dist/confirm/auto-approve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-approve.js","sourceRoot":"","sources":["../../src/confirm/auto-approve.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAIlC,kEAAkE;AAClE,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,wCAAwC;AACxC,SAAS,gBAAgB;IACvB,OAAO,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAc,EACd,MAAqB,EACrB,SAAkB;IAElB,MAAM,IAAI,GAAG,SAAS,IAAI,gBAAgB,EAAE,CAAC;IAE7C,oDAAoD;IACpD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC/C,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;gBACzD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,0DAA0D;YAC1D,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,cAAc,EAAE,CAAC;gBAC1C,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QACvF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC/C,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;YACvD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,GAAG,GAAG,CAAC;YAEzD,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9D,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/confirm/gate.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The Confirmation Gate — core security boundary.
+ *
+ * No tool call executes unless it passes through this gate.
+ * The executor is ONLY callable from within this file.
+ *
+ * Flow:
+ * 1. Receive proposed tool calls from agent loop
+ * 2. Check auto-approve rules (internal reads, optionally memory writes)
+ * 3. Auto-approved calls: execute immediately, collect results
+ * 4. Remaining calls: present to user via channel for confirmation
+ * 5. Wait for user approval (with timeout)
+ * 6. Execute approved calls sequentially
+ * 7. Return rejected calls with rejection result
+ * 8. Audit log every cycle
+ */
+import type { ToolCall, ToolResult } from '../llm/types.js';
+import type { ConfirmConfig } from '../config/schema.js';
+import type { ToolContext, ConfirmationResult } from '../tools/types.js';
+import type { ToolRegistry } from '../tools/registry.js';
+import type { Channel } from '../channels/types.js';
+/** Callback that presents confirmation to user and returns their decision */
+export type ConfirmationPresenter = (channelId: string, calls: ToolCall[], timeout: number) => Promise<ConfirmationResult>;
+/** Options for the gate's process method */
+export interface GateOptions {
+    sessionId: string;
+    channelId: string;
+    toolContext: ToolContext;
+    cowboyMode?: boolean;
+}
+/**
+ * The Confirmation Gate.
+ * Instantiate once per gateway with the tool registry and config.
+ * Each process() call handles one batch of tool calls from the agent loop.
+ */
+export declare class ConfirmationGate {
+    private readonly registry;
+    private readonly config;
+    constructor(registry: ToolRegistry, config: ConfirmConfig);
+    /**
+     * Process a batch of tool calls through the confirmation gate.
+     *
+     * @param calls - Tool calls proposed by the LLM
+     * @param options - Session, channel, and context info
+     * @param channel - The channel to present confirmations through
+     * @returns ToolResult[] for all calls (approved, auto-approved, and rejected)
+     */
+    process(calls: ToolCall[], options: GateOptions, channel: Channel): Promise<ToolResult[]>;
+}
+//# sourceMappingURL=gate.d.ts.map

package/dist/confirm/gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/confirm/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAOpD,6EAA6E;AAC7E,MAAM,MAAM,qBAAqB,GAAG,CAClC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,QAAQ,EAAE,EACjB,OAAO,EAAE,MAAM,KACZ,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAEjC,4CAA4C;AAC5C,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,WAAW,CAAC;IACzB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;;GAIG;AACH,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,QAAQ,EAAE,YAAY,EACtB,MAAM,EAAE,aAAa;IAGxC;;;;;;;OAOG;IACG,OAAO,CACX,KAAK,EAAE,QAAQ,EAAE,EACjB,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,UAAU,EAAE,CAAC;CAqIzB"}

package/dist/confirm/gate.js

@@ -0,0 +1,138 @@
+/**
+ * The Confirmation Gate — core security boundary.
+ *
+ * No tool call executes unless it passes through this gate.
+ * The executor is ONLY callable from within this file.
+ *
+ * Flow:
+ * 1. Receive proposed tool calls from agent loop
+ * 2. Check auto-approve rules (internal reads, optionally memory writes)
+ * 3. Auto-approved calls: execute immediately, collect results
+ * 4. Remaining calls: present to user via channel for confirmation
+ * 5. Wait for user approval (with timeout)
+ * 6. Execute approved calls sequentially
+ * 7. Return rejected calls with rejection result
+ * 8. Audit log every cycle
+ */
+// SECURITY: Direct import of executor — not re-exported anywhere
+import { executeTool } from '../tools/executor.js';
+import { needsConfirmation } from './auto-approve.js';
+import { logAudit } from './audit.js';
+/**
+ * The Confirmation Gate.
+ * Instantiate once per gateway with the tool registry and config.
+ * Each process() call handles one batch of tool calls from the agent loop.
+ */
+export class ConfirmationGate {
+    registry;
+    config;
+    constructor(registry, config) {
+        this.registry = registry;
+        this.config = config;
+    }
+    /**
+     * Process a batch of tool calls through the confirmation gate.
+     *
+     * @param calls - Tool calls proposed by the LLM
+     * @param options - Session, channel, and context info
+     * @param channel - The channel to present confirmations through
+     * @returns ToolResult[] for all calls (approved, auto-approved, and rejected)
+     */
+    async process(calls, options, channel) {
+        if (calls.length === 0)
+            return [];
+        const startTime = Date.now();
+        // Cowboy mode: bypass all confirmation, execute everything directly
+        if (options.cowboyMode) {
+            const results = [];
+            for (const call of calls) {
+                results.push(await executeTool(call, options.toolContext, this.registry));
+            }
+            const elapsed = Date.now() - startTime;
+            await logAudit(options.sessionId, calls, { approved: calls.map((_, i) => i), rejected: [], timedOut: false }, calls.map((_, i) => i), // all treated as auto-approved
+            elapsed);
+            return results;
+        }
+        // Partition calls into auto-approved and needs-confirmation
+        const autoApproved = [];
+        const needsApproval = [];
+        for (let i = 0; i < calls.length; i++) {
+            if (needsConfirmation(calls[i], this.config)) {
+                needsApproval.push(i);
+            }
+            else {
+                autoApproved.push(i);
+            }
+        }
+        // Execute auto-approved calls immediately
+        const results = new Array(calls.length);
+        for (const idx of autoApproved) {
+            results[idx] = await executeTool(calls[idx], options.toolContext, this.registry);
+        }
+        // If all calls were auto-approved, log and return
+        if (needsApproval.length === 0) {
+            const elapsed = Date.now() - startTime;
+            await logAudit(options.sessionId, calls, { approved: autoApproved, rejected: [], timedOut: false }, autoApproved, elapsed);
+            return results;
+        }
+        // Present remaining calls to user for confirmation
+        const pendingCalls = needsApproval.map((i) => calls[i]);
+        let confirmation;
+        try {
+            confirmation = await channel.presentConfirmation(options.channelId, pendingCalls, this.config.timeout);
+        }
+        catch {
+            // If presentation fails, reject all pending calls
+            confirmation = {
+                approved: [],
+                rejected: Array.from({ length: needsApproval.length }, (_, i) => i),
+                timedOut: false,
+            };
+        }
+        const confirmTime = Date.now() - startTime;
+        // Map confirmation indices back to original call indices
+        const approvedOriginal = [];
+        const rejectedOriginal = [];
+        for (const localIdx of confirmation.approved) {
+            const originalIdx = needsApproval[localIdx];
+            if (originalIdx !== undefined) {
+                approvedOriginal.push(originalIdx);
+            }
+        }
+        for (const localIdx of confirmation.rejected) {
+            const originalIdx = needsApproval[localIdx];
+            if (originalIdx !== undefined) {
+                rejectedOriginal.push(originalIdx);
+            }
+        }
+        // Handle any indices not covered (shouldn't happen, but be safe)
+        for (const idx of needsApproval) {
+            if (!approvedOriginal.includes(idx) && !rejectedOriginal.includes(idx)) {
+                rejectedOriginal.push(idx);
+            }
+        }
+        // Execute approved calls sequentially
+        for (const idx of approvedOriginal) {
+            results[idx] = await executeTool(calls[idx], options.toolContext, this.registry);
+        }
+        // Fill in rejection results
+        const rejectionMessage = confirmation.timedOut
+            ? 'All proposed actions timed out waiting for user approval.'
+            : 'The user declined this action.';
+        for (const idx of rejectedOriginal) {
+            results[idx] = {
+                toolCallId: calls[idx].id,
+                content: rejectionMessage,
+                isError: false,
+            };
+        }
+        // Audit log
+        await logAudit(options.sessionId, calls, {
+            approved: [...autoApproved, ...approvedOriginal],
+            rejected: rejectedOriginal,
+            timedOut: confirmation.timedOut,
+        }, autoApproved, confirmTime);
+        return results;
+    }
+}
+//# sourceMappingURL=gate.js.map

package/dist/confirm/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/confirm/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAQH,iEAAiE;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAiBtC;;;;GAIG;AACH,MAAM,OAAO,gBAAgB;IAER;IACA;IAFnB,YACmB,QAAsB,EACtB,MAAqB;QADrB,aAAQ,GAAR,QAAQ,CAAc;QACtB,WAAM,GAAN,MAAM,CAAe;IACrC,CAAC;IAEJ;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CACX,KAAiB,EACjB,OAAoB,EACpB,OAAgB;QAEhB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAElC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,oEAAoE;QACpE,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,OAAO,GAAiB,EAAE,CAAC;YACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACvC,MAAM,QAAQ,CACZ,OAAO,CAAC,SAAS,EACjB,KAAK,EACL,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EACnE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,+BAA+B;YACvD,OAAO,CACR,CAAC;YACF,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,4DAA4D;QAC5D,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,aAAa,GAAa,EAAE,CAAC;QAEnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9C,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,0CAA0C;QAC1C,MAAM,OAAO,GAAiB,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEtD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,GAAG,CAAE,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpF,CAAC;QAED,kDAAkD;QAClD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACvC,MAAM,QAAQ,CACZ,OAAO,CAAC,SAAS,EACjB,KAAK,EACL,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EACzD,YAAY,EACZ,OAAO,CACR,CAAC;YACF,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,mDAAmD;QACnD,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QAEzD,IAAI,YAAgC,CAAC;QACrC,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAC9C,OAAO,CAAC,SAAS,EACjB,YAAY,EACZ,IAAI,CAAC,MAAM,CAAC,OAAO,CACpB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;YAClD,YAAY,GAAG;gBACb,QAAQ,EAAE,EAAE;gBACZ,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;gBACnE,QAAQ,EAAE,KAAK;aAChB,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE3C,yDAAyD;QACzD,MAAM,gBAAgB,GAAa,EAAE,CAAC;QACtC,MAAM,gBAAgB,GAAa,EAAE,CAAC;QAEtC,KAAK,MAAM,QAAQ,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,KAAK,MAAM,QAAQ,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,iEAAiE;QACjE,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,sCAAsC;QACtC,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,GAAG,CAAE,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpF,CAAC;QAED,4BAA4B;QAC5B,MAAM,gBAAgB,GAAG,YAAY,CAAC,QAAQ;YAC5C,CAAC,CAAC,2DAA2D;YAC7D,CAAC,CAAC,gCAAgC,CAAC;QAErC,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,GAAG;gBACb,UAAU,EAAE,KAAK,CAAC,GAAG,CAAE,CAAC,EAAE;gBAC1B,OAAO,EAAE,gBAAgB;gBACzB,OAAO,EAAE,KAAK;aACf,CAAC;QACJ,CAAC;QAED,YAAY;QACZ,MAAM,QAAQ,CACZ,OAAO,CAAC,SAAS,EACjB,KAAK,EACL;YACE,QAAQ,EAAE,CAAC,GAAG,YAAY,EAAE,GAAG,gBAAgB,CAAC;YAChD,QAAQ,EAAE,gBAAgB;YAC1B,QAAQ,EAAE,YAAY,CAAC,QAAQ;SAChC,EACD,YAAY,EACZ,WAAW,CACZ,CAAC;QAEF,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/confirm/parser.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Confirmation Parser — parses user approval responses.
+ *
+ * Handles:
+ * - "a" or "all" or "y" or "yes" -> approve all
+ * - "n" or "none" or "no" or "reject" -> reject all
+ * - Comma-separated numbers -> selective approval (e.g., "1,2" or "1, 3")
+ * - Inline keyboard callback data from Telegram (e.g., "approve_all", "reject_all", "select:0,1")
+ */
+import type { ConfirmationResult } from '../tools/types.js';
+/**
+ * Parse a user's approval response into a ConfirmationResult.
+ *
+ * @param response - Raw user response string
+ * @param totalCalls - Total number of pending tool calls
+ * @returns Parsed confirmation result
+ */
+export declare function parseApprovalResponse(response: string, totalCalls: number): ConfirmationResult;
+/**
+ * Create a timeout result — all calls rejected.
+ */
+export declare function createTimeoutResult(totalCalls: number): ConfirmationResult;
+//# sourceMappingURL=parser.d.ts.map

package/dist/confirm/parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../src/confirm/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,kBAAkB,CA2BpB;AAkCD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,CAM1E"}

package/dist/confirm/parser.js

@@ -0,0 +1,76 @@
+/**
+ * Confirmation Parser — parses user approval responses.
+ *
+ * Handles:
+ * - "a" or "all" or "y" or "yes" -> approve all
+ * - "n" or "none" or "no" or "reject" -> reject all
+ * - Comma-separated numbers -> selective approval (e.g., "1,2" or "1, 3")
+ * - Inline keyboard callback data from Telegram (e.g., "approve_all", "reject_all", "select:0,1")
+ */
+/**
+ * Parse a user's approval response into a ConfirmationResult.
+ *
+ * @param response - Raw user response string
+ * @param totalCalls - Total number of pending tool calls
+ * @returns Parsed confirmation result
+ */
+export function parseApprovalResponse(response, totalCalls) {
+    const trimmed = response.trim().toLowerCase();
+    const allIndices = Array.from({ length: totalCalls }, (_, i) => i);
+    // Approve all
+    if (trimmed === 'a' || trimmed === 'all' || trimmed === 'y' || trimmed === 'yes' || trimmed === 'approve_all') {
+        return { approved: allIndices, rejected: [], timedOut: false };
+    }
+    // Reject all
+    if (trimmed === 'n' || trimmed === 'none' || trimmed === 'no' || trimmed === 'reject' || trimmed === 'reject_all') {
+        return { approved: [], rejected: allIndices, timedOut: false };
+    }
+    // Telegram callback: "select:0,1,2" (always 0-based)
+    if (trimmed.startsWith('select:')) {
+        const nums = trimmed.slice(7);
+        return parseNumberList(nums, totalCalls, true);
+    }
+    // Comma-separated numbers from user (always 1-based, e.g., "1,2,3")
+    if (/^[\d,\s]+$/.test(trimmed)) {
+        return parseNumberList(trimmed, totalCalls, false);
+    }
+    // Unrecognized -> reject all (safe default)
+    return { approved: [], rejected: allIndices, timedOut: false };
+}
+/**
+ * Parse a comma-separated list of numbers into approval indices.
+ *
+ * @param input - Comma-separated numbers
+ * @param totalCalls - Total number of pending calls
+ * @param zeroBased - If true, numbers are 0-based (callback data). If false, 1-based (user input).
+ */
+function parseNumberList(input, totalCalls, zeroBased) {
+    const allIndices = Array.from({ length: totalCalls }, (_, i) => i);
+    const nums = input
+        .split(',')
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0)
+        .map(Number)
+        .filter((n) => !isNaN(n) && Number.isInteger(n));
+    if (nums.length === 0) {
+        return { approved: [], rejected: allIndices, timedOut: false };
+    }
+    const indices = zeroBased
+        ? nums.filter((n) => n >= 0 && n < totalCalls)
+        : nums.map((n) => n - 1).filter((n) => n >= 0 && n < totalCalls);
+    const approvedSet = new Set(indices);
+    const approved = Array.from(approvedSet);
+    const rejected = allIndices.filter((i) => !approvedSet.has(i));
+    return { approved, rejected, timedOut: false };
+}
+/**
+ * Create a timeout result — all calls rejected.
+ */
+export function createTimeoutResult(totalCalls) {
+    return {
+        approved: [],
+        rejected: Array.from({ length: totalCalls }, (_, i) => i),
+        timedOut: true,
+    };
+}
+//# sourceMappingURL=parser.js.map

package/dist/confirm/parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parser.js","sourceRoot":"","sources":["../../src/confirm/parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,UAAkB;IAElB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAEnE,cAAc;IACd,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;QAC9G,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACjE,CAAC;IAED,aAAa;IACb,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QAClH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACjE,CAAC;IAED,qDAAqD;IACrD,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9B,OAAO,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IAED,oEAAoE;IACpE,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,4CAA4C;IAC5C,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,KAAa,EAAE,UAAkB,EAAE,SAAkB;IAC5E,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAEnE,MAAM,IAAI,GAAG,KAAK;SACf,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAC3B,GAAG,CAAC,MAAM,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,OAAO,GAAG,SAAS;QACvB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;IAEnE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAE/D,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkB;IACpD,OAAO;QACL,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACzD,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC"}