clawmini 0.0.7 → 0.0.9

package/dist/cli/{propose-policy.mjs → manage-policies.mjs}

@@ -2,6 +2,8 @@
 import { createRequire } from "node:module";
 import path from "node:path";
 import fs from "node:fs";
+import { pathToFileURL } from "node:url";
+import { randomBytes } from "node:crypto";
 
 //#region \0rolldown/runtime.js
 var __create = Object.create;
@@ -3054,7 +3056,77 @@ var require_commander = /* @__PURE__ */ __commonJSMin(((exports) => {
 //#endregion
 //#region node_modules/commander/esm.mjs
 var import_commander = /* @__PURE__ */ __toESM(require_commander(), 1);
-const { program: program$1, createCommand, createArgument, createOption, CommanderError, InvalidArgumentError, InvalidOptionArgumentError, Command, Argument, Option, Help } = import_commander.default;
+const { program, createCommand, createArgument, createOption, CommanderError, InvalidArgumentError, InvalidOptionArgumentError, Command, Argument, Option, Help } = import_commander.default;
+
+//#endregion
+//#region src/shared/policies.ts
+const BUILTIN_POLICY_SCRIPTS_DIR = ".clawmini/policy-scripts";
+const BUILTIN_POLICIES = {
+	"manage-policies": {
+		description: "Add, update, or remove clawmini policies (subcommands: add, update, remove). Reads are unrestricted via `requests show`.",
+		command: `./${BUILTIN_POLICY_SCRIPTS_DIR}/manage-policies.js`,
+		allowHelp: true,
+		autoApprove: false
+	},
+	"run-host": {
+		description: "Run an arbitrary shell command on the host via `sh -c`",
+		command: `./${BUILTIN_POLICY_SCRIPTS_DIR}/run-host.js`,
+		allowHelp: true,
+		autoApprove: false
+	}
+};
+
+//#endregion
+//#region src/shared/utils/shell.ts
+function parseShellArgs(input) {
+	const args = [];
+	let current = "";
+	let inSingle = false;
+	let inDouble = false;
+	let hasContent = false;
+	for (let i = 0; i < input.length; i++) {
+		const ch = input[i];
+		if (inSingle) {
+			if (ch === "'") inSingle = false;
+			else current += ch;
+			continue;
+		}
+		if (inDouble) {
+			if (ch === "\"") inDouble = false;
+			else if (ch === "\\" && i + 1 < input.length) {
+				const next = input[i + 1];
+				if (next === "\"" || next === "\\") {
+					current += next;
+					i++;
+				} else current += ch;
+			} else current += ch;
+			continue;
+		}
+		if (ch === "'") {
+			inSingle = true;
+			hasContent = true;
+		} else if (ch === "\"") {
+			inDouble = true;
+			hasContent = true;
+		} else if (ch === "\\" && i + 1 < input.length) {
+			current += input[i + 1];
+			i++;
+			hasContent = true;
+		} else if (ch === " " || ch === "	") {
+			if (hasContent) {
+				args.push(current);
+				current = "";
+				hasContent = false;
+			}
+		} else {
+			current += ch;
+			hasContent = true;
+		}
+	}
+	if (inSingle || inDouble) throw new Error("Unterminated quote in command string.");
+	if (hasContent) args.push(current);
+	return args;
+}
 
 //#endregion
 //#region node_modules/zod/v4/core/core.js
@@ -6987,6 +7059,13 @@ const meta = meta$1;
 
 //#endregion
 //#region src/shared/config.ts
+const PolicyDefinitionSchema = looseObject({
+	description: string().optional(),
+	command: string(),
+	args: array(string()).optional(),
+	allowHelp: boolean().optional(),
+	autoApprove: boolean().optional()
+});
 const FallbackSchema = looseObject({
 	commands: looseObject({
 		new: string().optional(),
@@ -6999,6 +7078,7 @@ const FallbackSchema = looseObject({
 	delayMs: number().int().min(0).default(1e3)
 });
 const AgentSchema = looseObject({
+	extends: string().optional(),
 	commands: looseObject({
 		new: string().optional(),
 		append: string().optional(),
@@ -7009,8 +7089,9 @@ const AgentSchema = looseObject({
 	apiUrlEnvVar: string().optional(),
 	env: record(string(), union([string(), boolean()])).optional(),
 	subagentEnv: record(string(), union([string(), boolean()])).optional(),
+	modelShorthands: record(string(), string()).optional(),
 	directory: string().optional(),
-	skillsDir: string().optional(),
+	skillsDir: string().nullable().optional(),
 	fallbacks: array(FallbackSchema).optional(),
 	files: string().default("./attachments").optional()
 });
@@ -7063,13 +7144,16 @@ const ChatSettingsSchema = looseObject({
 });
 const AgentSessionSettingsSchema = looseObject({ env: record(string(), union([string(), boolean()])).optional() });
 const EnvironmentSchema = looseObject({
+	extends: string().optional(),
 	init: string().optional(),
 	up: string().optional(),
 	down: string().optional(),
 	prefix: string().optional(),
 	envFormat: string().optional(),
 	exportLiteTo: string().optional(),
-	env: record(string(), union([string(), boolean()])).optional()
+	baseDir: string().optional(),
+	env: record(string(), union([string(), boolean()])).optional(),
+	policies: record(string(), PolicyDefinitionSchema).optional()
 });
 const SettingsSchema = looseObject({
 	chats: looseObject({ defaultId: string().optional() }).optional(),
@@ -7084,6 +7168,11 @@ const SettingsSchema = looseObject({
 	})]).optional()
 });
 
+//#endregion
+//#region src/shared/template-manifest.ts
+const TemplateManifestSchema = looseObject({ files: record(string(), _enum(["track", "seed-once"])).optional() });
+const InstalledFilesSchema = looseObject({ files: record(string(), looseObject({ sha: string() })).optional() });
+
 //#endregion
 //#region src/shared/workspace.ts
 function getWorkspaceRoot(startDir = process.cwd()) {
@@ -7100,60 +7189,194 @@ function getClawminiDir(startDir = process.cwd()) {
 }
 
 //#endregion
-//#region src/cli/propose-policy.ts
-const program = new Command();
-program.name("propose-policy").description("Proposes and registers a new policy.").requiredOption("--name <policy_name>", "Name of the policy").requiredOption("--description <description>", "Description of the policy").option("--command <command_string>", "The shell command to run (e.g. \"npm install -g\")").option("--script-file <path>", "Path to a script file (mapped securely via --file)").addHelpText("after", `
-Examples:
-  1. Propose a policy using a direct shell command:
-     clawmini-lite request propose-policy -- --name npm-install --description "Run npm install" --command "npm install"
-
-  2. Propose a policy using a custom script file:
-     # First, write your script to a file (e.g., install.sh)
-     clawmini-lite request propose-policy --file script=./install.sh -- --name custom-install --description "Run custom install script" --script-file "{{script}}"
-`).parse(process.argv);
-const options = program.opts();
-const name = options.name;
-const description = options.description;
-const commandStr = options.command;
-const scriptFile = options.scriptFile;
-if (!/^[a-z0-9-]+$/.test(name)) {
-	console.error("Error: Policy name must only contain lowercase letters, numbers, and hyphens.");
+//#region src/cli/manage-policies-utils.ts
+const NAME_RE = /^[a-z0-9-]+$/;
+function fail(message) {
+	console.error(`Error: ${message}`);
 	process.exit(1);
 }
-if (!commandStr && !scriptFile) {
-	console.error("Error: Must provide either --command or --script-file.");
-	process.exit(1);
+function assertValidName(name) {
+	if (!NAME_RE.test(name)) fail("Policy name must only contain lowercase letters, numbers, and hyphens.");
 }
-const dirPath = getClawminiDir();
-const policiesPath = path.join(dirPath, "policies.json");
-if (!fs.existsSync(dirPath)) {
-	console.error("Error: .clawmini directory not found. Please run \"clawmini init\" first.");
-	process.exit(1);
+function loadPolicies() {
+	const dirPath = getClawminiDir();
+	const policiesPath = path.join(dirPath, "policies.json");
+	if (!fs.existsSync(dirPath)) fail(".clawmini directory not found. Please run \"clawmini init\" first.");
+	let policies = { policies: {} };
+	if (fs.existsSync(policiesPath)) policies = JSON.parse(fs.readFileSync(policiesPath, "utf8"));
+	return {
+		dirPath,
+		policies,
+		policiesPath
+	};
 }
-let policies = { policies: {} };
-if (fs.existsSync(policiesPath)) policies = JSON.parse(fs.readFileSync(policiesPath, "utf8"));
-const policyDefinition = {
-	description,
-	allowHelp: true,
-	command: ""
-};
-if (scriptFile) {
+function writePolicies(policiesPath, policies) {
+	const tmpPath = `${policiesPath}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+	try {
+		fs.writeFileSync(tmpPath, JSON.stringify(policies, null, 2));
+		fs.renameSync(tmpPath, policiesPath);
+	} catch (err) {
+		try {
+			fs.unlinkSync(tmpPath);
+		} catch {}
+		throw err;
+	}
+}
+function installScript(dirPath, name, scriptFile) {
 	const scriptsDir = path.join(dirPath, "policy-scripts");
 	if (!fs.existsSync(scriptsDir)) fs.mkdirSync(scriptsDir, { recursive: true });
 	const ext = path.extname(scriptFile) || ".sh";
 	const destScript = path.join(scriptsDir, `${name}${ext}`);
 	fs.copyFileSync(scriptFile, destScript);
 	fs.chmodSync(destScript, 493);
-	policyDefinition.command = `./.clawmini/policy-scripts/${path.basename(destScript)}`;
-} else if (commandStr) {
-	const parts = commandStr.split(" ");
-	if (parts[0]) policyDefinition.command = parts[0];
-	if (parts.length > 1) policyDefinition.args = parts.slice(1);
-}
-policies.policies[name] = policyDefinition;
-fs.writeFileSync(policiesPath, JSON.stringify(policies, null, 2));
-console.log(`Successfully proposed and registered policy '${name}'.`);
+	return `./.clawmini/policy-scripts/${path.basename(destScript)}`;
+}
+function scriptInsidePolicyScripts(dirPath, command) {
+	const workspaceRoot = path.dirname(dirPath);
+	const abs = path.resolve(workspaceRoot, command);
+	const scriptsDir = path.join(dirPath, "policy-scripts");
+	const sep = path.sep;
+	const dirWithSep = scriptsDir.endsWith(sep) ? scriptsDir : scriptsDir + sep;
+	return abs.startsWith(dirWithSep) ? abs : null;
+}
+function unlinkIfExists(filePath) {
+	try {
+		fs.unlinkSync(filePath);
+	} catch (err) {
+		if (err.code !== "ENOENT") throw err;
+	}
+}
+function applyCommandString(definition, commandStr) {
+	let parts;
+	try {
+		parts = parseShellArgs(commandStr);
+	} catch (err) {
+		fail(`--command: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	const [head, ...rest] = parts;
+	if (head === void 0) fail("--command must contain a command to run.");
+	definition.command = head;
+	if (rest.length > 0) definition.args = rest;
+}
+
+//#endregion
+//#region src/cli/manage-policies.ts
+const root = new Command("manage-policies");
+root.description("Manage clawmini policies. Subcommands: add, update, remove. Reads are unrestricted — use `clawmini-lite requests show <name>` instead.");
+root.command("add").description("Register a new policy. Errors if the name already exists.").requiredOption("--name <policy_name>", "Name of the policy").requiredOption("--description <description>", "Description of the policy").option("--command <command_string>", "The shell command to run (e.g. \"npm install -g\")").option("--script-file <path>", "Path to a script file (mapped securely via --file)").option("--dangerously-auto-approve", "Skip user approval for every invocation of this policy. Only safe for fully sandboxed, side-effect-free commands.", false).option("--dangerously-allow-help", "Allow the agent to run the policy with `--help` without approval. Only safe if the underlying command treats `--help` as read-only.", false).addHelpText("after", `
+Examples:
+  1. Add a policy that wraps a shell command:
+     clawmini-lite request manage-policies -- add --name npm-install --description "Run npm install" --command "npm install"
+
+  2. Add a policy backed by a script file:
+     clawmini-lite request manage-policies --file script=./install.sh -- add --name custom-install --description "Run custom install script" --script-file "{{script}}"
+
+  3. Add a read-only policy that auto-approves and exposes --help:
+     clawmini-lite request manage-policies -- add --name list-files --description "List files" --command "ls" --dangerously-auto-approve --dangerously-allow-help
+`).action((options) => {
+	const name = options.name;
+	const description = options.description;
+	const commandStr = options.command;
+	const scriptFile = options.scriptFile;
+	const autoApprove = !!options.dangerouslyAutoApprove;
+	const allowHelp = !!options.dangerouslyAllowHelp;
+	assertValidName(name);
+	if (!commandStr && !scriptFile) fail("Must provide either --command or --script-file.");
+	if (commandStr && scriptFile) fail("--command and --script-file are mutually exclusive.");
+	const { dirPath, policies, policiesPath } = loadPolicies();
+	if (Object.prototype.hasOwnProperty.call(policies.policies, name)) fail(`Policy '${name}' is already registered. Use 'manage-policies update' to modify it, or 'manage-policies remove' first.`);
+	const definition = {
+		description,
+		allowHelp,
+		autoApprove,
+		command: ""
+	};
+	if (scriptFile) definition.command = installScript(dirPath, name, scriptFile);
+	else if (commandStr) applyCommandString(definition, commandStr);
+	policies.policies[name] = definition;
+	writePolicies(policiesPath, policies);
+	console.log(`Successfully added policy '${name}'.`);
+});
+root.command("update").description("Modify fields on an existing user-registered policy.").requiredOption("--name <policy_name>", "Name of the policy to update").option("--description <description>", "New description").option("--command <command_string>", "Replace the shell command (e.g. \"npm install -g\")").option("--script-file <path>", "Replace the policy with a script file (mapped via --file)").option("--dangerously-auto-approve", "Enable autoApprove. Only safe for fully sandboxed, side-effect-free commands.").option("--no-dangerously-auto-approve", "Disable autoApprove.").option("--dangerously-allow-help", "Enable allowHelp. Only safe if the underlying command treats `--help` as read-only.").option("--no-dangerously-allow-help", "Disable allowHelp.").addHelpText("after", `
+Examples:
+  1. Update the description of an existing policy:
+     clawmini-lite request manage-policies -- update --name npm-install --description "Run npm install (with cache)"
+
+  2. Replace the command:
+     clawmini-lite request manage-policies -- update --name npm-install --command "npm ci"
+
+  3. Enable the dangerous flags:
+     clawmini-lite request manage-policies -- update --name list-files --dangerously-auto-approve --dangerously-allow-help
+
+  4. Turn a dangerous flag off again:
+     clawmini-lite request manage-policies -- update --name list-files --no-dangerously-auto-approve
+`).action((options) => {
+	const name = options.name;
+	const description = options.description;
+	const commandStr = options.command;
+	const scriptFile = options.scriptFile;
+	const autoApprove = options.dangerouslyAutoApprove;
+	const allowHelp = options.dangerouslyAllowHelp;
+	assertValidName(name);
+	if (commandStr && scriptFile) fail("--command and --script-file are mutually exclusive.");
+	if (description === void 0 && commandStr === void 0 && scriptFile === void 0 && autoApprove === void 0 && allowHelp === void 0) fail("No fields specified to update. Pass at least one of --description, --command, --script-file, --dangerously-auto-approve, --dangerously-allow-help.");
+	const { dirPath, policies, policiesPath } = loadPolicies();
+	const existing = policies.policies[name];
+	if (existing === false) fail(`Policy '${name}' is currently disabled. Run 'manage-policies remove --name ${name}' to clear the disable, then 'manage-policies add' to register it.`);
+	if (existing === void 0) fail(`No user-registered policy '${name}' to update. Use 'manage-policies add' to register one.`);
+	const priorScriptAbs = scriptInsidePolicyScripts(dirPath, existing.command);
+	const updated = { ...existing };
+	if (description !== void 0) updated.description = description;
+	if (scriptFile !== void 0) {
+		updated.command = installScript(dirPath, name, scriptFile);
+		delete updated.args;
+	} else if (commandStr !== void 0) {
+		delete updated.args;
+		applyCommandString(updated, commandStr);
+	}
+	if (autoApprove !== void 0) updated.autoApprove = autoApprove;
+	if (allowHelp !== void 0) updated.allowHelp = allowHelp;
+	policies.policies[name] = updated;
+	writePolicies(policiesPath, policies);
+	const newScriptAbs = scriptInsidePolicyScripts(dirPath, updated.command);
+	if (priorScriptAbs && priorScriptAbs !== newScriptAbs) unlinkIfExists(priorScriptAbs);
+	console.log(`Successfully updated policy '${name}'.`);
+});
+root.command("remove").description("Remove (or disable) a registered policy.").requiredOption("--name <policy_name>", "Name of the policy to remove").option("--disable-builtin", "When the name matches a built-in policy, write `false` to opt out instead of just deleting the user override.", false).addHelpText("after", `
+Examples:
+  1. Remove a user-registered policy:
+     clawmini-lite request manage-policies -- remove --name npm-install
+
+  2. Disable a built-in policy (writes \`false\` to opt out):
+     clawmini-lite request manage-policies -- remove --name manage-policies --disable-builtin
+
+  3. Drop a user override of a built-in (the built-in then surfaces again):
+     clawmini-lite request manage-policies -- remove --name manage-policies
+`).action((options) => {
+	const name = options.name;
+	const disableBuiltin = !!options.disableBuiltin;
+	assertValidName(name);
+	const { policies, policiesPath } = loadPolicies();
+	const isBuiltin = name in BUILTIN_POLICIES;
+	const existing = policies.policies[name];
+	if (disableBuiltin) {
+		if (!isBuiltin) fail(`--disable-builtin can only be used for built-in policies; '${name}' is not a built-in.`);
+		if (existing === false) fail(`Built-in policy '${name}' is already disabled.`);
+		if (existing !== void 0) fail(`Policy '${name}' has a user override that would be lost. Run 'manage-policies remove --name ${name}' first, then re-run with --disable-builtin.`);
+		policies.policies[name] = false;
+		writePolicies(policiesPath, policies);
+		console.log(`Successfully disabled built-in policy '${name}'.`);
+		return;
+	}
+	if (existing === void 0) fail(`No policy entry '${name}' to remove.${isBuiltin ? ` '${name}' is a built-in. To opt out, re-run with --disable-builtin.` : ""}`);
+	delete policies.policies[name];
+	writePolicies(policiesPath, policies);
+	if (existing === false) console.log(`Successfully cleared the disable entry for '${name}'.${isBuiltin ? " The built-in will surface again." : ""}`);
+	else if (isBuiltin) console.log(`Successfully removed user override of built-in policy '${name}'. The built-in will surface again.`);
+	else console.log(`Successfully removed policy '${name}'.`);
+});
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) root.parse(process.argv);
 
 //#endregion
 export {  };
-//# sourceMappingURL=propose-policy.mjs.map
+//# sourceMappingURL=manage-policies.mjs.map