bridgerator 1.0.8 → 1.1.0

package/src/search-tool.mjs

@@ -0,0 +1,189 @@
+// LOGIC: see critical-logic/bridge.md ("Extra tools" / fast_search). Instant search: Everything (if
+// installed and running) → the Windows Search index (SystemIndex over OLE DB) → the engine's own
+// search (start_search, already under the policy). Every hit goes through the same folder rules as the
+// file tools (visiblePath): excluded folders and folders outside the allowed list never show up.
+// Queries are built here (escaped); search.ps1 only runs them.
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { psJson, guard, visiblePath, fail, json, needAction, str, int, ToolError, errorText } from './tool-lib.mjs';
+
+const PS = fileURLToPath(new URL('./search.ps1', import.meta.url));
+const ACTIONS = ['files', 'text', 'status'];
+const MAX = 500;
+const POLL_MS = 400, BASIC_WAIT_MS = 20000;
+
+export const defs = [{
+  name: 'fast_search',
+  title: 'Fast search',
+  description: 'Fast file search on this PC. action "files": names or masks like *.pdf; "text": words inside documents (Windows Search index); "status": which search sources this PC has. Uses Everything when it is installed, then the Windows Search index, then a plain folder scan. Results follow the folder rules of this PC.',
+  inputSchema: {
+    type: 'object', additionalProperties: false, required: ['action'],
+    properties: {
+      action: { type: 'string', enum: ACTIONS },
+      query: { type: 'string', maxLength: 300, description: 'Name, mask (* ?) or words' },
+      folder: { type: 'string', description: 'Search only inside this folder (full path)' },
+      kind: { type: 'string', maxLength: 12, description: 'File extension, e.g. pdf or .docx' },
+      limit: { type: 'integer', minimum: 1, maximum: MAX, description: 'Default 100' },
+    },
+  },
+  annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
+}];
+
+const b64 = (s) => Buffer.from(String(s), 'utf8').toString('base64');
+const sq = (s) => String(s).replace(/'/g, "''");                         // SQL string literal
+const ctl = (s) => String(s).replace(/[\u0000-\u001f\u007f]/g, ' ').trim();
+export function extOf(kind) {
+  if (kind === undefined) return undefined;
+  const k = String(kind).trim().replace(/^\*?\./, '');
+  if (!/^[\p{L}\p{N}_-]{1,10}$/u.test(k)) fail('BAD_ARGS', 'kind must be a file extension like pdf or .docx.');
+  return k.toLowerCase();
+}
+/** Name / mask → LIKE pattern: LIKE's own specials are literal, * ? are the wildcards. */
+export function likePattern(q) {
+  const lit = ctl(q).replace(/[[%_]/g, (c) => `[${c}]`);
+  const w = lit.replace(/\*/g, '%').replace(/\?/g, '_');
+  return /[*?]/.test(q) ? w : `%${w}%`;
+}
+const scopeUrl = (d) => `file:${d.replace(/\\/g, '/')}`;
+/** The SystemIndex query for files / text, scoped to folders (none = whole index). */
+export function indexSql({ action, query, folders = [], ext, limit }) {
+  const where = [];
+  if (folders.length) where.push(`(${folders.map((d) => `SCOPE='${sq(scopeUrl(d))}'`).join(' OR ')})`);
+  if (action === 'text') { where.push(`FREETEXT('${sq(ctl(query))}')`); where.push("System.ItemType <> 'Directory'"); }
+  else if (query) where.push(`System.FileName LIKE '${sq(likePattern(query))}'`);
+  if (ext) where.push(`System.FileExtension = '.${sq(ext)}'`);
+  return `SELECT TOP ${limit} System.ItemUrl, System.Size, System.DateModified FROM SystemIndex${where.length ? ` WHERE ${where.join(' AND ')}` : ''} ORDER BY System.DateModified DESC`;
+}
+export const coverSql = (folder) => `SELECT TOP 1 System.ItemUrl FROM SystemIndex WHERE SCOPE='${sq(scopeUrl(folder))}'`;
+/** es.exe arguments: words only — nothing that starts like an option (-export-…, /a) reaches it. Every
+ * double quote goes first (a quoted "-export-txt" or a"b must never turn into a switch), then a leading - or /. */
+export function esArgs({ query, folder, ext, limit }) {
+  const words = ctl(query || '').replace(/["\u201c\u201d]/g, '').split(/\s+/).map((w) => w.replace(/^[-/]+/, '')).filter(Boolean);
+  return ['-n', String(limit), ...(folder ? ['-path', folder] : []), ...(ext ? [`ext:${ext}`] : []), ...words];
+}
+export const urlToPath = (u) => String(u).replace(/^file:/i, '').replace(/\//g, '\\');
+
+const run = (ctx, env, timeout = 30000) => psJson(ctx, { files: [PS], env, timeout });
+async function status(ctx, folder) {
+  return run(ctx, { BRX_MODE: 'status', ...(folder ? { BRX_SCOPE_SQL: b64(coverSql(folder)) } : {}) }, 20000);
+}
+
+function keep(ctx, items, limit) {
+  const out = [];
+  let hidden = 0;
+  for (const it of items) {
+    if (!it?.path || typeof it.path !== 'string') continue;
+    if (!visiblePath(ctx, it.path)) { hidden++; continue; }
+    out.push({ path: it.path, ...(Number.isFinite(it.size) ? { size: it.size } : {}), ...(it.modified ? { modified: it.modified } : {}), ...(it.dir ? { folder: true } : {}) });
+    if (out.length >= limit) break;
+  }
+  return { items: out, hidden };
+}
+
+// The engine's own search: "📁 path" (files) / "📄 path:line - text" (content) lines.
+export function parseBasic(text) {
+  const items = [];
+  for (const line of String(text || '').split(/\r?\n/)) {
+    let m = /^📁 (.+)$/u.exec(line);
+    if (m) { items.push({ path: m[1].trim() }); continue; }
+    m = /^📄 (.+?):(\d+) - (.*)$/u.exec(line);
+    if (m && !items.some((x) => x.path === m[1])) items.push({ path: m[1], line: Number(m[2]), match: m[3].slice(0, 200) });
+  }
+  return items;
+}
+const textOf = (r) => (r?.content || []).filter((c) => c?.type === 'text').map((c) => c.text).join('\n');
+async function basic(ctx, { action, query, folder, ext, limit }, wait = BASIC_WAIT_MS) {
+  if (!ctx.engine) throw new ToolError('NO_BASIC', 'The plain folder search is not available here.');
+  const root = folder || ctx.cfg?.allowedDirectories?.[0] || process.env.USERPROFILE;
+  if (!root) throw new ToolError('NO_FOLDER', 'Say which folder to search.', 'Pass folder.');
+  // Names: the engine takes masks (* ?) as globs and plain text as "contains"; content: literal text.
+  const started = await ctx.engine('start_search', { path: root, pattern: query, searchType: action === 'text' ? 'content' : 'files', ...(ext ? { filePattern: `*.${ext}` } : {}), maxResults: limit, literalSearch: true });
+  const t0 = textOf(started);
+  if (started?.isError) throw new ToolError('BASIC_FAILED', t0.slice(0, 300) || 'The folder search did not start.');
+  const id = /session:\s*(\S+)/i.exec(t0)?.[1];
+  if (!id) return parseBasic(t0);
+  let all = [], done = /COMPLETED/.test(t0);
+  const until = Date.now() + wait;
+  try {
+    for (;;) {
+      const r = await ctx.engine('get_more_search_results', { sessionId: id, offset: 0, length: limit });
+      const t = textOf(r);
+      all = parseBasic(t);
+      done = /Status:\s*COMPLETED/i.test(t);
+      if (done || r?.isError || Date.now() > until) break;
+      await new Promise((res) => setTimeout(res, POLL_MS));
+    }
+  } finally {
+    // Also when a poll throws (engine timeout / restart): the search must not keep running.
+    if (!done) await Promise.resolve().then(() => ctx.engine('stop_search', { sessionId: id })).catch(() => null);
+  }
+  return all;
+}
+
+export async function handle(name, args, ctx) {
+  const action = needAction(args, ACTIONS);
+  const folder = args.folder !== undefined ? guard(ctx, str(args, 'folder', { max: 1000 })) : undefined;
+  if (action === 'status') {
+    const s = await status(ctx, folder);
+    return json({
+      everything: s.everything?.path ? (s.everything.running ? 'ready' : 'installed, not running') : s.everything?.untrusted ? 'not used (es.exe is outside Program Files and not signed by voidtools)' : 'not installed',
+      windows_index: s.index?.service === 'Running' ? 'ready' : `not available (service ${String(s.index?.service || 'unknown')})`,
+      ...(folder ? { folder, folder_indexed: s.index?.covered === true ? 'yes' : s.index?.covered === false ? 'no (not in the index — the plain scan is used)' : 'unknown' } : {}),
+      plain_scan: 'always available',
+    });
+  }
+  const query = str(args, 'query', { required: true, max: 300 });
+  const limit = int(args, 'limit', { min: 1, max: MAX, def: 100 });
+  const ext = extOf(args.kind);
+  const allowed = ctx.cfg?.allowedDirectories || [];
+  const folders = folder ? [folder] : allowed.map((d) => path.resolve(d));
+  const want = Math.min(MAX, limit * 2);       // room for hits the folder rules hide
+  const tried = [];
+  let firstError = null;
+  const note = (src, e) => { tried.push(`${src}: ${e instanceof ToolError ? e.code : e?.code || 'error'}`); firstError ||= e; };
+  // null = every hit was hidden by the folder rules → the next source is tried.
+  const answer = (source, items, extra = {}) => {
+    const k = keep(ctx, items, limit);
+    if (!k.items.length && k.hidden) { tried.push(`${source}: ${k.hidden} result(s) hidden by this PC's folder rules`); return null; }
+    return json({ source, count: k.items.length, results: k.items, ...(k.hidden ? { hidden: `${k.hidden} result(s) hidden by this PC's folder rules` } : {}), ...(tried.length ? { skipped_sources: tried } : {}), ...extra });
+  };
+
+  let st = null;
+  try { st = await status(ctx, folder); } catch (e) { note('status', e); }
+
+  if (action === 'files' && st?.everything?.path && st.everything.running) {
+    try {
+      // Scoped like the index: the folder, or the one allowed folder (several: hits are filtered below).
+      const esFolder = folder || (folders.length === 1 ? folders[0] : undefined);
+      const r = await run(ctx, { BRX_MODE: 'everything', BRX_ES: st.everything.path, BRX_ARGS: b64(JSON.stringify(esArgs({ query, folder: esFolder, ext, limit: want }))) });
+      if (r.error) throw new ToolError(r.error, r.error === 'ES_START_FAILED' ? 'Everything\'s es.exe could not start (an antivirus may block it).' : 'Everything did not answer.');
+      const a = r.items?.length ? answer('everything', r.items) : null;
+      if (a) return a;
+      if (!r.items?.length) tried.push('everything: nothing found');
+    } catch (e) { note('everything', e); }
+  } else if (action === 'files') tried.push(`everything: ${st?.everything?.path ? 'not running' : 'not installed'}`);
+
+  let indexNote;
+  if (st?.index?.service === 'Running') {
+    try {
+      const r = await run(ctx, { BRX_MODE: 'index', BRX_SQL: b64(indexSql({ action, query, folders, ext, limit: want })) });
+      if (r.error) throw new ToolError(r.error, 'The Windows Search index did not answer.');
+      const items = (r.items || []).map((x) => ({ ...x, path: urlToPath(x.url) }));
+      const a = items.length ? answer('windows_index', items, folder && st.index.covered === false ? { note: 'This folder is not in the Windows Search index; results may be incomplete.' } : {}) : null;
+      if (a) return a;
+      if (!items.length) {
+        indexNote = folder && st.index.covered === false ? 'This folder is not in the Windows Search index' : 'Nothing found in the Windows Search index';
+        tried.push(`windows_index: ${indexNote.toLowerCase()}`);
+      }
+    } catch (e) { note('windows_index', e); }
+  } else tried.push(`windows_index: service ${String(st?.index?.service || 'unknown')}`);
+
+  try {
+    const items = await basic(ctx, { action, query, folder, ext, limit: want });
+    return answer('basic', items, { note: `Plain folder scan${indexNote ? ` (${indexNote.toLowerCase()})` : ''}.` })
+      || json({ source: 'basic', count: 0, results: [], skipped_sources: tried });
+  } catch (e) {
+    note('basic', e);
+    throw new ToolError('SEARCH_FAILED', `Search did not work: ${errorText(firstError).replace(/\s*\(code [A-Z_0-9]+\)$/, '')}`, 'Pass a folder, or check the PC with bridgerator_doctor.');
+  }
+}

package/src/search.ps1

@@ -0,0 +1,129 @@
+# LOGIC: see critical-logic/bridge.md ("Extra tools" / fast_search). Instant search sources for the
+# bridge (search-tool.mjs builds every query; this script only runs it).
+# In (env): BRX_MODE = status | everything | index; BRX_ES (es.exe path), BRX_ARGS (base64 UTF-8 JSON
+# array of es.exe arguments), BRX_SQL (base64 UTF-8 SystemIndex query), BRX_SCOPE_SQL (status: the
+# coverage query, optional), BRX_ES_WAIT (ms es.exe may run, default 20000). Out: ONE JSON line. Errors are codes, never localized message text.
+function Out-Json($o) { [Console]::Out.WriteLine(($o | ConvertTo-Json -Compress -Depth 5)) }
+function From-B64($s) { if (-not $s) { return '' }; [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($s)) }
+
+# es.exe runs only from a place a standard user cannot write (Program Files, Windows) or when it is
+# signed by voidtools: a planted es.exe on the PATH / in a user folder never runs.
+function Test-TrustedEs([string]$p) {
+  if (-not $p -or -not (Test-Path -LiteralPath $p -PathType Leaf)) { return $false }
+  $full = [IO.Path]::GetFullPath($p)
+  foreach ($d in @($env:ProgramFiles, ${env:ProgramFiles(x86)})) {
+    if ($d -and $full.StartsWith(([IO.Path]::GetFullPath($d).TrimEnd('\') + '\'), [StringComparison]::OrdinalIgnoreCase)) { return $true }
+  }
+  # Windows itself: only the folder and System32 (subfolders like Temp are writable by users).
+  $parent = [IO.Path]::GetDirectoryName($full)
+  if ($env:SystemRoot -and @($env:SystemRoot, (Join-Path $env:SystemRoot 'System32')) -contains $parent) { return $true }
+  try {
+    $sig = Get-AuthenticodeSignature -LiteralPath $full
+    return ($sig.Status -eq 'Valid' -and [string]$sig.SignerCertificate.Subject -match '(^|,\s*)(CN|O)=voidtools(,|$)')
+  } catch { return $false }
+}
+function Find-Es {
+  $found = $null
+  $cands = @(Get-Command es.exe -CommandType Application -All -ErrorAction SilentlyContinue | ForEach-Object { $_.Source })
+  foreach ($d in @($env:ProgramFiles, ${env:ProgramFiles(x86)}, (Join-Path $env:LOCALAPPDATA 'Programs'))) { if ($d) { $cands += (Join-Path $d 'Everything\es.exe') } }
+  foreach ($p in $cands) {
+    if (-not $p -or -not (Test-Path -LiteralPath $p -PathType Leaf)) { continue }
+    if (Test-TrustedEs $p) { return @{ path = $p } }
+    if (-not $found) { $found = $p }
+  }
+  return @{ path = $null; untrusted = $found }
+}
+# One Windows command-line argument (words carry no quotes: search-tool.mjs strips them). Quoted, a
+# trailing \ is doubled: "C:\My Files\" would end in \" (a literal quote) and swallow the next arguments.
+function Quote-Arg([string]$a) { if ($a -match '[\s"]' -or -not $a) { return '"' + (($a -replace '"', '') -replace '(\\+)$', '$1$1') + '"' }; return $a }
+
+function Invoke-Index($sql) {
+  $conn = $null; $rs = $null
+  try {
+    $conn = New-Object -ComObject ADODB.Connection
+    $conn.Open("Provider=Search.CollatorDSO;Extended Properties='Application=Windows';")
+    $rs = New-Object -ComObject ADODB.Recordset
+    $rs.Open($sql, $conn)
+    $items = New-Object System.Collections.ArrayList
+    while (-not $rs.EOF) {
+      $url = [string]$rs.Fields.Item('System.ItemUrl').Value
+      $size = $rs.Fields.Item('System.Size').Value
+      $mod = $rs.Fields.Item('System.DateModified').Value
+      $o = @{ url = $url }
+      if ($size -ne $null -and $size -isnot [DBNull]) { $o.size = [int64]$size }
+      if ($mod -is [DateTime]) { $o.modified = $mod.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') }
+      [void]$items.Add($o)
+      $rs.MoveNext()
+    }
+    return @{ items = @($items) }
+  } catch {
+    return @{ error = 'INDEX_UNAVAILABLE'; hresult = ('0x{0:X8}' -f $_.Exception.HResult) }
+  } finally {
+    if ($rs) { try { $rs.Close() } catch { } }
+    if ($conn) { try { $conn.Close() } catch { } }
+  }
+}
+
+$mode = $env:BRX_MODE
+if ($mode -eq 'status') {
+  $es = Find-Es
+  $running = [bool](Get-Process -Name 'Everything', 'Everything64' -ErrorAction SilentlyContinue)
+  $svc = Get-Service -Name WSearch -ErrorAction SilentlyContinue
+  $state = if ($svc) { [string]$svc.Status } else { 'Missing' }
+  $covered = $null
+  $scopeSql = From-B64 $env:BRX_SCOPE_SQL
+  if ($scopeSql -and $state -eq 'Running') {
+    $r = Invoke-Index $scopeSql
+    $covered = if ($r.error) { $null } else { $r.items.Count -gt 0 }
+  }
+  Out-Json @{ everything = @{ path = $es.path; untrusted = [bool]$es.untrusted; running = $running }; index = @{ service = $state; covered = $covered } }
+  exit 0
+}
+if ($mode -eq 'everything') {
+  $es = $env:BRX_ES
+  if (-not $es -or -not (Test-Path -LiteralPath $es)) { Out-Json @{ error = 'ES_MISSING' }; exit 0 }
+  # Held open (others may only read) from the trust check until it has started: it can't be swapped in between.
+  $hold = $null; try { $hold = [IO.File]::Open($es, 'Open', 'Read', 'Read') } catch { Out-Json @{ error = 'ES_START_FAILED' }; exit 0 }
+  if (-not (Test-TrustedEs $es)) { $hold.Dispose(); Out-Json @{ error = 'ES_UNTRUSTED' }; exit 0 }
+  # PowerShell 5.1 ConvertFrom-Json emits an array as ONE object: enumerate it into separate arguments.
+  $argv = @((From-B64 $env:BRX_ARGS) | ConvertFrom-Json | ForEach-Object { $_ })
+  # The export file lives in our own cache folder (not TEMP); es.exe is stopped when it takes too long.
+  $dir = Join-Path $env:LOCALAPPDATA 'Bridgerator\cache'
+  [void][IO.Directory]::CreateDirectory($dir)
+  $tmp = Join-Path $dir ('es-' + [guid]::NewGuid().ToString('N') + '.efu')
+  $wait = 20000; $w = 0; if ([int]::TryParse([string]$env:BRX_ES_WAIT, [ref]$w) -and $w -gt 0) { $wait = $w }
+  $proc = $null
+  try {
+    $psi = New-Object Diagnostics.ProcessStartInfo
+    $psi.FileName = $es
+    $psi.Arguments = ((@($argv) + @('-export-efu', $tmp)) | ForEach-Object { Quote-Arg ([string]$_) }) -join ' '
+    # Its own pipes (our stdout stays the one JSON line for the bridge), both drained at once: a full pipe
+    # (usage / error text) would block es.exe until the kill.
+    $psi.UseShellExecute = $false; $psi.CreateNoWindow = $true; $psi.RedirectStandardOutput = $true; $psi.RedirectStandardError = $true
+    try { $proc = [Diagnostics.Process]::Start($psi) } catch { Out-Json @{ error = 'ES_START_FAILED' }; exit 0 } finally { $hold.Dispose() }
+    [void]$proc.StandardOutput.ReadToEndAsync(); [void]$proc.StandardError.ReadToEndAsync()
+    if (-not $proc.WaitForExit($wait)) { try { $proc.Kill() } catch { }; [void]$proc.WaitForExit(5000); Out-Json @{ error = 'ES_TIMEOUT' }; exit 0 }
+    $code = $proc.ExitCode
+    if ($code -ne 0) { Out-Json @{ error = ('ES_EXIT_' + $code) }; exit 0 }
+    $items = New-Object System.Collections.ArrayList
+    if (Test-Path -LiteralPath $tmp) {
+      foreach ($row in (Import-Csv -LiteralPath $tmp -Encoding UTF8)) {
+        $o = @{ path = [string]$row.Filename }
+        $s = 0L; if ([int64]::TryParse([string]$row.Size, [ref]$s)) { $o.size = $s }
+        $ft = 0L; if ([int64]::TryParse([string]$row.'Date Modified', [ref]$ft) -and $ft -gt 0) { $o.modified = [DateTime]::FromFileTimeUtc($ft).ToString('yyyy-MM-ddTHH:mm:ssZ') }
+        $a = 0; if ([int]::TryParse([string]$row.Attributes, [ref]$a)) { $o.dir = [bool]($a -band 16) }
+        [void]$items.Add($o)
+      }
+    }
+    Out-Json @{ items = @($items) }
+  } finally {
+    if ($proc) { try { if (-not $proc.HasExited) { $proc.Kill() } } catch { }; $proc.Dispose() }
+    Remove-Item -LiteralPath $tmp -Force -ErrorAction SilentlyContinue
+  }
+  exit 0
+}
+if ($mode -eq 'index') {
+  Out-Json (Invoke-Index (From-B64 $env:BRX_SQL))
+  exit 0
+}
+Out-Json @{ error = 'BAD_MODE' }

package/src/settings-tool.mjs

@@ -0,0 +1,186 @@
+// bridgerator_settings: ChatGPT can read every setting of the Bridgerator window and change them.
+// Changes apply at once (owner 21.10). With "Ask before AI changes settings" (askSettings, off by default)
+// anything that lowers protection or widens access needs Apply on the PC.
+// LOGIC: see critical-logic/bridge.md ("Settings", "Access presets").
+import { CATEGORIES, LABEL, readSettings } from './confirm.mjs';
+import { validateSetup } from './setup-tool.mjs';
+import { SNAP_DEFAULTS } from './undo.mjs';
+import { FUSE_DEFAULTS } from './guard.mjs';
+import { extraRegistry } from './extra-tools.mjs';
+
+// Settings of the extra tools (screen capture…): declared by their modules (extra-tools.mjs).
+const EXTRA = extraRegistry();
+
+const BOOL = { type: 'boolean' };
+const b = (description) => ({ type: 'boolean', description });
+const int = (minimum, maximum, description) => ({ type: 'integer', minimum, maximum, description });
+export const PRESETS = ['read_only', 'files', 'full'];
+export const TIMEOUTS = [60, 120, 300];
+/** What a fresh install has (owner 21.10: nothing restricted, like the engine on its own). */
+export const DEFAULTS = {
+  preset: 'full', terminal: true, allowedDirectories: [], readOnlyDirectories: [], protectSensitive: false,
+  confirm: { enabled: false, ...readSettings('').ask, timeoutSeconds: 120 },   // no confirm.ini = the defaults per category
+  recycleBin: true, snapshots: { ...SNAP_DEFAULTS }, fuse: { ...FUSE_DEFAULTS }, keepAwake: true, askSettings: false,
+  theme: 'system', language: 'en', popupStyle: 'toast', notify: { sound: true, offline: true, queueDone: true, limit: true },
+  deviceName: '', autostart: true, localHistory: false, telemetryEnabled: true,
+  ...EXTRA.defaults(),
+};
+const NOTIFY = ['sound', 'offline', 'queueDone', 'limit'];
+const dirs = { type: 'array', maxItems: 20, items: { type: 'string' } };
+export const SETTINGS_TOOL_DEF = {
+  name: 'bridgerator_settings',
+  description: 'Reads ("get": current values and defaults) or changes ("set") every Bridgerator setting of this PC, the same as its window. Changes apply at once (the PC asks first only if the person turned on askSettings). Bridgerator\'s own folders and blocked commands are not settings.',
+  inputSchema: {
+    type: 'object', additionalProperties: false, required: ['action'],
+    properties: {
+      action: { type: 'string', enum: ['get', 'set'] },
+      settings: {
+        type: 'object', additionalProperties: false,
+        properties: {
+          preset: { type: 'string', enum: PRESETS, description: 'Access level: read_only = terminal off and every folder read-only; files = terminal off; full = files and terminal (default).' },
+          terminal: b('Running commands and programs (start_process, interact_with_process, kill_process).'),
+          allowedDirectories: { ...dirs, description: 'Folders ChatGPT may use; empty = all folders (default).' },
+          readOnlyDirectories: { ...dirs, description: 'Folders that can be read but not changed by the file tools. Terminal commands are only checked as a courtesy (a script can still write there): for a hard limit turn the terminal off.' },
+          protectSensitive: b('Block startup programs, PowerShell profiles, .ssh/.aws/cloud logins and AppData (default off).'),
+          confirm: { type: 'object', additionalProperties: false, description: 'Ask the person on this PC before risky actions (default off).', properties: { ...Object.fromEntries(['enabled', ...CATEGORIES].map((k) => [k, BOOL])), timeoutSeconds: { type: 'integer', enum: TIMEOUTS, description: 'No answer in this time = Deny.' } } },
+          recycleBin: b('Simple delete commands move files to the Recycle Bin instead of deleting them (default on).'),
+          snapshots: { type: 'object', additionalProperties: false, description: 'Copies of files before ChatGPT changes them, for bridgerator_undo (default on, 7 days, 500 MB, files up to 50 MB).', properties: { enabled: BOOL, days: int(1, 30), maxMb: int(50, 5000), maxFileMb: int(1, 500) } },
+          fuse: { type: 'object', additionalProperties: false, description: 'Pause Bridgerator and ask the person when more than limit files are deleted or moved within a minute (default off, 20).', properties: { enabled: BOOL, limit: int(3, 1000) } },
+          keepAwake: b('Keep the PC from sleeping while ChatGPT works or the queue has tasks, on AC power only (default on).'),
+          askSettings: b('Ask the person on the PC before an AI change to these settings that lowers protection (default off: every change applies at once).'),
+          theme: { type: 'string', enum: ['system', 'light', 'dark'] }, language: { type: 'string', enum: ['en', 'ru'] },
+          popupStyle: { type: 'string', enum: ['toast', 'popup'] },
+          notify: { type: 'object', additionalProperties: false, properties: Object.fromEntries(NOTIFY.map((k) => [k, BOOL])) },
+          deviceName: { type: 'string', maxLength: 40 }, autostart: BOOL, localHistory: b('Keep the Recent list on disk for 7 days.'), telemetryEnabled: b('Anonymous usage counts.'),
+          ...EXTRA.schema(),
+        },
+      },
+    },
+  },
+};
+
+const TOP = ['theme', 'language', 'popupStyle', 'notify', 'deviceName', 'autostart', 'localHistory', 'telemetryEnabled', 'confirm', 'allowedDirectories', 'readOnlyDirectories',
+  'preset', 'terminal', 'protectSensitive', 'recycleBin', 'snapshots', 'fuse', 'keepAwake', 'askSettings', ...EXTRA.groups()];
+const RANGES = { 'snapshots.days': [1, 30], 'snapshots.maxMb': [50, 5000], 'snapshots.maxFileMb': [1, 500], 'fuse.limit': [3, 1000] };
+const ENUM = { theme: ['system', 'light', 'dark'], language: ['en', 'ru'], popupStyle: ['toast', 'popup'] };
+
+/** → { changes: [{key, value}] } (setSetting keys of the window) or { error }. */
+export function validateSettings(input, opts) {
+  if (!input || typeof input !== 'object' || Array.isArray(input)) return { error: 'settings must be an object' };
+  const bad = Object.keys(input).filter((k) => !TOP.includes(k));
+  if (bad.length) return { error: `unknown setting(s): ${bad.join(', ')}` };
+  const changes = [];
+  for (const k of ['theme', 'language', 'popupStyle']) if (input[k] !== undefined) { if (!ENUM[k].includes(input[k])) return { error: `${k} must be one of ${ENUM[k].join(', ')}` }; changes.push({ key: k, value: input[k] }); }
+  if (input.preset !== undefined) { if (!PRESETS.includes(input.preset)) return { error: `preset must be one of ${PRESETS.join(', ')}` }; changes.push({ key: 'preset', value: input.preset }); }
+  for (const k of ['autostart', 'localHistory', 'telemetryEnabled', 'terminal', 'protectSensitive', 'recycleBin', 'keepAwake', 'askSettings']) if (input[k] !== undefined) { if (typeof input[k] !== 'boolean') return { error: `${k} must be true or false` }; changes.push({ key: k, value: input[k] }); }
+  if (input.deviceName !== undefined) { if (typeof input.deviceName !== 'string' || input.deviceName.trim().length > 40 || /[\u0000-\u001f]/.test(input.deviceName)) return { error: 'deviceName must be text, up to 40 characters' }; changes.push({ key: 'deviceName', value: input.deviceName.trim() }); }
+  for (const [group, keys] of [['notify', NOTIFY], ['confirm', ['enabled', ...CATEGORIES, 'timeoutSeconds']], ['snapshots', ['enabled', 'days', 'maxMb', 'maxFileMb']], ['fuse', ['enabled', 'limit']]]) {
+    const g = input[group];
+    if (g === undefined) continue;
+    if (!g || typeof g !== 'object' || Array.isArray(g)) return { error: `${group} must be an object` };
+    for (const [k, v] of Object.entries(g)) {
+      const key = `${group}.${k}`;
+      if (key === 'confirm.timeoutSeconds') { if (!TIMEOUTS.includes(v)) return { error: `confirm.timeoutSeconds must be one of ${TIMEOUTS.join(', ')}` }; changes.push({ key: 'confirm.timeout', value: v }); continue; }
+      if (RANGES[key]) { const [lo, hi] = RANGES[key]; if (!Number.isInteger(v) || v < lo || v > hi) return { error: `${key} must be a whole number from ${lo} to ${hi}` }; changes.push({ key, value: v }); continue; }
+      if (!keys.includes(k) || typeof v !== 'boolean') return { error: `${key}: unknown or not true/false` };
+      changes.push({ key, value: v });
+    }
+  }
+  const ex = EXTRA.parse(input);
+  if (ex.error) return { error: ex.error };
+  changes.push(...ex.changes);
+  for (const k of ['allowedDirectories', 'readOnlyDirectories']) if (input[k] !== undefined) {
+    const v = validateSetup({ [k]: input[k] }, opts);
+    if (v.error) return { error: v.error };
+    changes.push({ key: k, value: v.value[k] });
+  }
+  if (!changes.length) return { error: 'nothing to change' };
+  return { changes };
+}
+
+const low = (a) => a.map((x) => x.toLowerCase());
+/** Does this change lower protection or widen access (→ the person's OK on the PC)? */
+export function widens(cur, { key, value }) {
+  if (EXTRA.owns(key)) return EXTRA.widens(cur, { key, value });
+  if (key === 'confirm.enabled') return cur.confirm.enabled && !value;
+  if (key === 'confirm.timeout') return false;
+  if (key.startsWith('confirm.')) return cur.confirm.ask[key.slice(8)] && !value;
+  const was = (k, d) => (cur[k] === undefined ? d : cur[k]);
+  if (key === 'terminal') return value && !was('terminal', DEFAULTS.terminal);
+  if (key === 'protectSensitive' || key === 'recycleBin') return !value && was(key, DEFAULTS[key]);
+  const snap = { ...SNAP_DEFAULTS, ...(cur.snapshots || {}) }, fuse = { ...FUSE_DEFAULTS, ...(cur.fuse || {}) };
+  if (key === 'snapshots.enabled') return !value && snap.enabled;
+  if (key.startsWith('snapshots.')) return value < snap[key.slice(10)];          // less undo history
+  if (key === 'fuse.enabled') return !value && fuse.enabled;
+  if (key === 'fuse.limit') return fuse.enabled && value > fuse.limit;
+  if (key === 'askSettings') return !value && cur.askSettings === true;
+  if (key === 'keepAwake' || key === 'preset') return false;                     // preset: judged by its parts (presetChanges)
+  if (key === 'autostart') return value !== cur.autostart;
+  if (key === 'telemetryEnabled') return value && !cur.telemetry;
+  if (key === 'localHistory') return value && !cur.localHistory;
+  if (key === 'readOnlyDirectories') { const now = low(value); return low(cur.readOnlyDirectories).some((x) => !now.includes(x)); }
+  if (key === 'allowedDirectories') {
+    const before = low(cur.allowedDirectories), after = low(value);
+    if (!after.length) return before.length > 0;            // a list → all folders
+    if (!before.length) return false;                        // all folders → a list: narrower
+    return after.some((x) => !before.includes(x));           // a folder added to the list
+  }
+  return false;                                              // theme, language, notifications, name…
+}
+
+/** One human line per change, for the notification / the window. */
+export function describe(cur, { key, value }) {
+  const onoff = (v) => (v ? 'on' : 'off');
+  if (EXTRA.owns(key)) return EXTRA.describe({ key, value });
+  if (key === 'confirm.enabled') return `Confirmations: ${onoff(value)}`;
+  if (key === 'confirm.timeout') return `No answer = Deny after: ${value} s`;
+  if (key.startsWith('confirm.')) return `Confirm ${LABEL[key.slice(8)]}: ${onoff(value)}`;
+  if (key === 'allowedDirectories') {
+    if (!value.length) return 'Folders: all (except always-blocked)';
+    const before = low(cur.allowedDirectories);
+    const add = value.filter((x) => !before.includes(x.toLowerCase())), rem = cur.allowedDirectories.filter((x) => !low(value).includes(x.toLowerCase()));
+    return `Folders: ${[...add.map((x) => `+${x}`), ...rem.map((x) => `−${x}`)].join(', ') || 'unchanged'}`;
+  }
+  if (key === 'readOnlyDirectories') {
+    const before = low(cur.readOnlyDirectories);
+    const add = value.filter((x) => !before.includes(x.toLowerCase())), rem = cur.readOnlyDirectories.filter((x) => !low(value).includes(x.toLowerCase()));
+    return `Read-only: ${[...add.map((x) => `+${x}`), ...rem.map((x) => `−${x}`)].join(', ') || 'unchanged'}`;
+  }
+  const names = { autostart: 'Start with Windows', telemetryEnabled: 'Usage stats', localHistory: 'Local history', theme: 'Theme', language: 'Language', popupStyle: 'Pop-up style', deviceName: 'Computer name',
+    terminal: 'Terminal (commands)', protectSensitive: 'Protect sensitive folders', recycleBin: 'Recycle Bin instead of deleting', keepAwake: 'Keep the PC awake while ChatGPT works', askSettings: 'Ask before AI changes settings', preset: 'Access',
+    'snapshots.enabled': 'Snapshots and Undo', 'snapshots.days': 'Keep snapshots (days)', 'snapshots.maxMb': 'Snapshots up to (MB)', 'snapshots.maxFileMb': 'Snapshot files up to (MB)',
+    'fuse.enabled': 'Pause on mass deletes / moves', 'fuse.limit': 'Mass-action limit per minute' };
+  return `${names[key] || key}: ${typeof value === 'boolean' ? onoff(value) : value}`;
+}
+
+const covered = (dirs, ro) => { const r = low(ro).map((x) => x.replace(/[\\/]+$/, '')); return dirs.length > 0 && dirs.every((d) => { const n = d.toLowerCase().replace(/[\\/]+$/, ''); return r.some((x) => n === x || n.startsWith(`${x}\\`)); }); };
+/** Folders the Read only preset makes read-only: the folder list, or every drive when there is none. */
+const presetTargets = (s, drives) => (s.allowedDirectories.length ? s.allowedDirectories : drives);
+/** The access preset the settings amount to: full (terminal on), read_only (terminal off, all read-only), files. */
+export function presetOf(s, drives = []) {
+  if (s.terminal !== false) return 'full';
+  return covered(presetTargets(s, drives), s.readOnlyDirectories || []) ? 'read_only' : 'files';
+}
+/** A preset → the setting changes it stands for (terminal, readOnlyDirectories). */
+export function presetChanges(name, s, drives = []) {
+  const t = presetTargets(s, drives), ro = s.readOnlyDirectories || [];
+  const out = [{ key: 'terminal', value: name === 'full' }];
+  if (name === 'read_only') {
+    const add = t.filter((d) => !low(ro).includes(d.toLowerCase()));
+    if (add.length) out.push({ key: 'readOnlyDirectories', value: [...ro, ...add] });
+  } else if (presetOf(s, drives) === 'read_only') {
+    // Leaving Read only: the folders it made read-only go back to writable.
+    const keep = ro.filter((d) => !low(t).includes(d.toLowerCase()));
+    if (keep.length !== ro.length) out.push({ key: 'readOnlyDirectories', value: keep });
+  }
+  return out;
+}
+/** Change list with every preset replaced by what it stands for (the widen check looks at the parts). */
+// The preset is judged on the folder lists of the SAME request (they are applied first, the preset after).
+export function expandPresets(changes, s, drives) {
+  const rest = changes.filter((c) => c.key !== 'preset'), presets = changes.filter((c) => c.key === 'preset');
+  if (!presets.length) return changes;
+  const s2 = { ...s };
+  for (const c of rest) if (c.key === 'allowedDirectories' || c.key === 'readOnlyDirectories' || c.key === 'terminal') s2[c.key] = c.value;
+  return [...rest, ...presets.flatMap((c) => presetChanges(c.value, s2, drives))];
+}

package/src/setup-tool.mjs

@@ -0,0 +1,129 @@
+// bridgerator_setup: the assistant SUGGESTS folders / read-only folders / confirmation checks after
+// a conversation with the person; nothing changes until the person clicks Apply in a window on the
+// PC (no answer = Cancel). It can't touch the built-in exclusions, blockedCommands, telemetry or
+// anything else.
+import fs from 'node:fs';
+import path from 'node:path';
+import { CATEGORIES, readSettings, setIni, restoreIni, writeAtomic, LABEL } from './confirm.mjs';
+import { TERMINAL_TOOLS } from './policy.mjs';
+
+const MAX = 20;
+const CONFIRM_KEYS = ['enabled', ...CATEGORIES];
+const dirList = { type: 'array', maxItems: MAX, items: { type: 'string' } };
+export const SETUP_TOOL_DEF = {
+  name: 'bridgerator_setup',
+  description: 'Limits access on this PC, and only when the person explicitly asks for limits ("only this folder", "read only", "ask me before deleting"). A folder named for a task is not a request to limit: just work there. "Set up Bridgerator" needs no call: the defaults (every folder, terminal on, no confirmations, deletions to the Recycle Bin, Undo on) are the setup. Fields: preset (read_only | files | full), allowedDirectories (empty = every folder), readOnlyDirectories, confirm. Applied at once (the PC asks first only if the person turned on "Ask before AI changes settings"). Absolute local paths only.',
+  inputSchema: {
+    type: 'object',
+    additionalProperties: false,
+    properties: {
+      preset: { type: 'string', enum: ['read_only', 'files', 'full'], description: 'read_only = look only (terminal off, everything read-only); files = files but no terminal; full = files and terminal (default).' },
+      allowedDirectories: dirList,
+      readOnlyDirectories: dirList,
+      confirm: { type: 'object', additionalProperties: false, properties: Object.fromEntries(CONFIRM_KEYS.map((k) => [k, { type: 'boolean' }])) },
+    },
+  },
+};
+
+/** → { value } (normalized) or { error } (text for the assistant). */
+export function validateSetup(input, { isDir = (p) => { try { return fs.statSync(p).isDirectory(); } catch { return false; } } } = {}) {
+  if (!input || typeof input !== 'object' || Array.isArray(input)) return { error: 'expected an object' };
+  const extra = Object.keys(input).filter((k) => !['preset', 'allowedDirectories', 'readOnlyDirectories', 'confirm'].includes(k));
+  if (extra.length) return { error: `unknown setting(s): ${extra.join(', ')} — only preset, allowedDirectories, readOnlyDirectories and confirm can be suggested` };
+  const value = {};
+  if (input.preset !== undefined) {
+    if (!['read_only', 'files', 'full'].includes(input.preset)) return { error: 'preset must be read_only, files or full' };
+    value.preset = input.preset;
+  }
+  for (const k of ['allowedDirectories', 'readOnlyDirectories']) {
+    if (input[k] === undefined) continue;
+    const list = input[k];
+    if (!Array.isArray(list) || list.length > MAX) return { error: `${k} must be a list of at most ${MAX} folders` };
+    const out = [];
+    for (const p of list) {
+      if (typeof p !== 'string' || !p.trim()) return { error: `${k}: every entry must be a folder path` };
+      const s = p.trim();
+      if (/^[\\/]{2}/.test(s) || /^[a-z][a-z0-9+.-]*:\/\//i.test(s)) return { error: `${k}: "${s}" — network paths and URLs are not allowed` };
+      if (!/^[a-z]:[\\/]/i.test(s)) return { error: `${k}: "${s}" is not an absolute local path like C:\\Users\\Name\\Documents` };
+      if (!isDir(s)) return { error: `${k}: "${s}" is not an existing folder` };
+      const n = path.resolve(s);
+      if (!out.some((x) => x.toLowerCase() === n.toLowerCase())) out.push(n);
+    }
+    value[k] = out;
+  }
+  if (input.confirm !== undefined) {
+    const c = input.confirm;
+    if (!c || typeof c !== 'object' || Array.isArray(c)) return { error: 'confirm must be an object' };
+    const bad = Object.keys(c).filter((k) => !CONFIRM_KEYS.includes(k) || typeof c[k] !== 'boolean');
+    if (bad.length) return { error: `confirm: unknown or non-boolean key(s): ${bad.join(', ')} (allowed: ${CONFIRM_KEYS.join(', ')})` };
+    value.confirm = { ...c };
+  }
+  if (!Object.keys(value).length) return { error: 'nothing to change' };
+  return { value };
+}
+
+/** One line for the notification, e.g. "Folders: D:\\Work, D:\\Photos (read-only) · confirm deletions: on". */
+export function summarizeSetup(cfg, ini, v) {
+  const parts = [];
+  const ro = v.readOnlyDirectories || cfg.readOnlyDirectories || [];
+  const folders = [...(v.allowedDirectories || []).map((d) => (ro.some((r) => r.toLowerCase() === d.toLowerCase()) ? `${d} (read-only)` : d)),
+    ...(v.readOnlyDirectories || []).filter((r) => !(v.allowedDirectories || []).some((d) => d.toLowerCase() === r.toLowerCase())).map((r) => `${r} (read-only)`)];
+  if (folders.length) parts.push(`Folders: ${folders.join(', ')}`);
+  else if (v.readOnlyDirectories) parts.push('Read-only folders: none');
+  if (v.confirm) {
+    const s = readSettings(ini);
+    const on = v.confirm.enabled ?? s.enabled;
+    if (!on) parts.push('confirmations: off');
+    else parts.push(`confirm ${CATEGORIES.filter((k) => (k in v.confirm ? v.confirm[k] : s.ask[k])).map((k) => LABEL[k]).join(', ') || 'nothing'}: on`);
+  }
+  const line = parts.join(' · ');
+  return line.length > 180 ? `${line.slice(0, 179)}…` : line;
+}
+
+/** Before → after as a diff: lines for the window, one short line for the notification. */
+export function diffSetup(cfg, ini, v) {
+  const lines = [], parts = [];
+  const same = (a, b) => a.toLowerCase() === b.toLowerCase();
+  const d = (label, before, after) => {
+    const add = after.filter((x) => !before.some((b) => same(b, x))), rem = before.filter((x) => !after.some((a) => same(a, x)));
+    if (!add.length && !rem.length) return;
+    lines.push(`${label}: ${before.length} → ${after.length}`, ...add.map((x) => `  + ${x}`), ...rem.map((x) => `  − ${x}`));
+    parts.push(`${label}: ${[...add.map((x) => `+${x}`), ...rem.map((x) => `−${x}`)].join(', ')}`);
+  };
+  if (v.allowedDirectories) {
+    const before = cfg.allowedDirectories || [], after = v.allowedDirectories;
+    if (!after.length && before.length) { lines.push('Folders: all folders (except always-blocked)'); parts.push('Folders: all (except always-blocked)'); }
+    else if (after.length && !before.length) { lines.push(`Folders: only these ${after.length}`, ...after.map((x) => `  + ${x}`)); parts.push(`Folders: only ${after.join(', ')}`); }
+    else d('Folders', before, after);
+  }
+  if (v.readOnlyDirectories) d('Read-only', cfg.readOnlyDirectories || [], v.readOnlyDirectories);
+  if (typeof v.terminal === 'boolean' && v.terminal !== !(cfg.disabledTools || []).includes('start_process')) { const t = `Terminal: ${v.terminal ? 'on' : 'off'}`; lines.push(t); parts.push(t); }
+  if (v.confirm) {
+    const s = readSettings(ini);
+    const cur = { enabled: s.enabled, ...s.ask };
+    for (const [k, x] of Object.entries(v.confirm)) if (cur[k] !== x) {
+      const t = `${k === 'enabled' ? 'Confirmations' : `Confirm ${LABEL[k]}`}: ${x ? 'on' : 'off'}`;
+      lines.push(t); parts.push(t);
+    }
+  }
+  return { lines: lines.length ? lines : ['No changes'], short: parts.join(' · ') || 'No changes' };
+}
+
+/** Writes the approved settings: config.json (folders, setupDone) and confirm.ini. → the new cfg. */
+export function applySetup(configFile, ini, v) {
+  const cfg = JSON.parse(fs.readFileSync(configFile, 'utf8'));
+  const next = { ...cfg, ...(v.allowedDirectories ? { allowedDirectories: v.allowedDirectories } : {}), ...(v.readOnlyDirectories ? { readOnlyDirectories: v.readOnlyDirectories } : {}), setupDone: true };
+  if (typeof v.terminal === 'boolean') next.disabledTools = terminalTools(cfg.disabledTools, v.terminal);
+  writeAtomic(configFile, JSON.stringify(next, null, 2));
+  if (v.confirm) {
+    restoreIni(ini);
+    for (const [k, x] of Object.entries(v.confirm)) setIni(ini, k === 'enabled' ? 'confirm' : 'ask', k, x ? 'true' : 'false');
+  }
+  return next;
+}
+
+/** disabledTools with the terminal tools switched on (removed) or off (added). */
+export function terminalTools(list = [], on) {
+  const rest = (list || []).filter((x) => !TERMINAL_TOOLS.includes(x));
+  return on ? rest : [...rest, ...TERMINAL_TOOLS];
+}