crow-central-agency 0.26.12 → 0.26.14

package/dist/_shared/auto-approve/auto-approve-rule-set.js

@@ -0,0 +1,30 @@
+import { parseRule } from "./rule-format.js";
+import { getRuleStrategy } from "./rule-strategy-registry.js";
+/**
+ * A mutable set of auto-approve rule strings that parses each rule once and caches the result, so
+ * permission checks match against the pre-parsed rules instead of re-parsing the whole list per call.
+ * Raw strings are deduped; malformed rules are dropped on add (same as `parseRules`).
+ */
+export class AutoApproveRuleSet {
+    raw = new Set();
+    parsed = [];
+    constructor(initialRules = []) {
+        this.add(initialRules);
+    }
+    add(rules) {
+        for (const rule of rules) {
+            if (this.raw.has(rule)) {
+                continue;
+            }
+            this.raw.add(rule);
+            const parsedRule = parseRule(rule);
+            if (parsedRule !== undefined) {
+                this.parsed.push(parsedRule);
+            }
+        }
+    }
+    matches(toolName, input) {
+        return getRuleStrategy(toolName).matches(toolName, input, this.parsed);
+    }
+}
+//# sourceMappingURL=auto-approve-rule-set.js.map

package/dist/_shared/auto-approve/auto-approve-rule.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=auto-approve-rule.types.js.map

package/dist/_shared/auto-approve/command-decomposition.js

@@ -0,0 +1,238 @@
+import { matchesSpecifier, WORD_BOUNDARY_SUFFIX } from "./rule-format.js";
+/** Prefix depth for derived rules (first N tokens of a subcommand). */
+export const DEFAULT_PREFIX_DEPTH = 2;
+/** Maximum number of rules derived from a single compound command, mirroring the SDK cap. */
+export const MAX_DERIVED_RULES = 5;
+/**
+ * Shell separators that decompose a compound command. Two-character separators are matched before
+ * the single-character ones so `&&`/`||`/`|&` win over `&`/`|`.
+ */
+export const TWO_CHAR_SEPARATORS = ["&&", "||", "|&"];
+export const SINGLE_CHAR_SEPARATORS = [";", "|", "&", "\n", "\r"];
+/**
+ * Process wrappers stripped from the front of a subcommand before matching. `timeout`/`nice` also
+ * consume a leading numeric argument (duration / priority).
+ */
+export const PROCESS_WRAPPERS = new Set(["timeout", "time", "nice", "nohup", "stdbuf"]);
+const WRAPPERS_WITH_NUMERIC_ARG = new Set(["timeout", "nice"]);
+const XARGS_WRAPPER = "xargs";
+/**
+ * Read-only shell builtins that run with no prompt. `cd` and `git` are handled separately
+ * (in-cwd `cd` only; read-only `git` subcommands only).
+ */
+export const READ_ONLY_BUILTINS = new Set([
+    "ls",
+    "cat",
+    "echo",
+    "pwd",
+    "head",
+    "tail",
+    "grep",
+    "find",
+    "wc",
+    "which",
+    "diff",
+    "stat",
+    "du",
+]);
+const CD_COMMAND = "cd";
+const IN_CWD_CD_ARGS = new Set([".", "./"]);
+const GIT_COMMAND = "git";
+const READ_ONLY_GIT_SUBCOMMANDS = new Set(["status", "log", "diff", "show"]);
+const SINGLE_QUOTE = "'";
+const DOUBLE_QUOTE = '"';
+const REDIRECT_CHAR = ">";
+/** Split a command string into whitespace-delimited tokens, respecting single/double quotes. */
+function tokenize(command) {
+    const tokens = [];
+    let current = "";
+    let hasToken = false;
+    let quote;
+    for (const char of command) {
+        if (quote !== undefined) {
+            if (char === quote) {
+                quote = undefined;
+            }
+            else {
+                current += char;
+            }
+            continue;
+        }
+        if (char === SINGLE_QUOTE || char === DOUBLE_QUOTE) {
+            quote = char;
+            hasToken = true;
+            continue;
+        }
+        if (char === " " || char === "\t") {
+            if (hasToken) {
+                tokens.push(current);
+                current = "";
+                hasToken = false;
+            }
+            continue;
+        }
+        current += char;
+        hasToken = true;
+    }
+    if (hasToken) {
+        tokens.push(current);
+    }
+    return tokens;
+}
+/** Return the shell separator starting at `index`, or `undefined` if none. */
+function separatorAt(command, index) {
+    const twoChar = command.slice(index, index + 2);
+    for (const separator of TWO_CHAR_SEPARATORS) {
+        if (twoChar === separator) {
+            return separator;
+        }
+    }
+    const char = command[index];
+    if (char === "&") {
+        // Guard shell redirects (`2>&1`, `&>file`) from being read as a background separator.
+        if (command[index - 1] === REDIRECT_CHAR || command[index + 1] === REDIRECT_CHAR) {
+            return undefined;
+        }
+    }
+    for (const separator of SINGLE_CHAR_SEPARATORS) {
+        if (char === separator) {
+            return separator;
+        }
+    }
+    return undefined;
+}
+/** Strip leading process wrappers (and their option/numeric args) from a token list. */
+function stripWrappers(tokens) {
+    let remaining = tokens;
+    while (remaining.length > 0) {
+        const head = remaining[0];
+        if (head === XARGS_WRAPPER) {
+            // Only bare `xargs` (no flags) is transparent; flagged xargs stays and simply won't match.
+            const next = remaining[1];
+            if (next !== undefined && next.startsWith("-")) {
+                break;
+            }
+            remaining = remaining.slice(1);
+            continue;
+        }
+        if (!PROCESS_WRAPPERS.has(head)) {
+            break;
+        }
+        remaining = remaining.slice(1);
+        while (remaining.length > 0 && remaining[0].startsWith("-")) {
+            remaining = remaining.slice(1);
+        }
+        if (WRAPPERS_WITH_NUMERIC_ARG.has(head) && remaining.length > 0 && /^[0-9]/.test(remaining[0])) {
+            remaining = remaining.slice(1);
+        }
+    }
+    return remaining;
+}
+/**
+ * Split a compound command into its normalized subcommands. Splits on shell separators outside
+ * quotes, strips process wrappers, and drops empty segments. The returned strings are re-joined
+ * from parsed tokens (quotes removed, whitespace collapsed) for stable matching.
+ */
+export function splitSubcommands(command) {
+    const rawSegments = [];
+    let current = "";
+    let quote;
+    let index = 0;
+    while (index < command.length) {
+        const char = command[index];
+        if (quote !== undefined) {
+            current += char;
+            if (char === quote) {
+                quote = undefined;
+            }
+            index += 1;
+            continue;
+        }
+        if (char === SINGLE_QUOTE || char === DOUBLE_QUOTE) {
+            quote = char;
+            current += char;
+            index += 1;
+            continue;
+        }
+        const separator = separatorAt(command, index);
+        if (separator !== undefined) {
+            rawSegments.push(current);
+            current = "";
+            index += separator.length;
+            continue;
+        }
+        current += char;
+        index += 1;
+    }
+    rawSegments.push(current);
+    const subcommands = [];
+    for (const segment of rawSegments) {
+        const tokens = stripWrappers(tokenize(segment));
+        if (tokens.length > 0) {
+            subcommands.push(tokens.join(" "));
+        }
+    }
+    return subcommands;
+}
+/** Whether a normalized subcommand is a read-only builtin, in-cwd `cd`, or read-only `git`. */
+export function isReadOnlyCommand(subcommand) {
+    const tokens = tokenize(subcommand);
+    const head = tokens[0];
+    if (head === undefined) {
+        return false;
+    }
+    if (head === CD_COMMAND) {
+        const target = tokens[1];
+        return target === undefined || IN_CWD_CD_ARGS.has(target);
+    }
+    if (head === GIT_COMMAND) {
+        const gitSubcommand = tokens[1];
+        return gitSubcommand !== undefined && READ_ONLY_GIT_SUBCOMMANDS.has(gitSubcommand);
+    }
+    return READ_ONLY_BUILTINS.has(head);
+}
+/**
+ * Capture side: derive one prefix-`depth` specifier per non-read-only subcommand (in-cwd `cd` and
+ * read-only builtins contribute nothing), deduped and capped at {@link MAX_DERIVED_RULES}.
+ */
+export function deriveRules(command, depth = DEFAULT_PREFIX_DEPTH) {
+    const specifiers = [];
+    for (const subcommand of splitSubcommands(command)) {
+        if (specifiers.length >= MAX_DERIVED_RULES) {
+            break;
+        }
+        if (isReadOnlyCommand(subcommand)) {
+            continue;
+        }
+        const tokens = tokenize(subcommand);
+        if (tokens.length === 0) {
+            continue;
+        }
+        const prefix = tokens.slice(0, depth).join(" ");
+        const specifier = `${prefix}${WORD_BOUNDARY_SUFFIX}`;
+        if (!specifiers.includes(specifier)) {
+            specifiers.push(specifier);
+        }
+    }
+    return specifiers;
+}
+/**
+ * Match side: fails closed. Every subcommand must be a read-only builtin or match one of the
+ * specifiers. Empty/unparseable input yields `false`.
+ */
+export function matchesRules(command, specifiers) {
+    const subcommands = splitSubcommands(command);
+    if (subcommands.length === 0) {
+        return false;
+    }
+    for (const subcommand of subcommands) {
+        if (isReadOnlyCommand(subcommand)) {
+            continue;
+        }
+        if (!specifiers.some((specifier) => matchesSpecifier(subcommand, specifier))) {
+            return false;
+        }
+    }
+    return true;
+}
+//# sourceMappingURL=command-decomposition.js.map

package/dist/_shared/auto-approve/rule-format.js

@@ -0,0 +1,79 @@
+/** Glob wildcard used in rule specifiers. */
+export const GLOB_STAR = "*";
+/**
+ * A space before a trailing `*` enforces a word boundary: `ls *` matches `ls` and `ls -la`,
+ * but never `lsof`.
+ */
+export const WORD_BOUNDARY_SUFFIX = " *";
+/** Claude's `:*` prefix suffix, treated as equivalent to a trailing ` *`. */
+export const PREFIX_STAR_SUFFIX = ":*";
+const RULE_PATTERN = /^([^()]+)(?:\((.*)\))?$/;
+const REGEXP_SPECIAL_CHARS = /[.+?^${}()|[\]\\]/g;
+/**
+ * Parse a rule string into its tool + optional specifier. Fails closed: any malformed rule
+ * (unbalanced parentheses, empty tool, stray `(` in the tool name) yields `undefined`.
+ */
+export function parseRule(rule) {
+    const trimmed = rule.trim();
+    if (trimmed.length === 0) {
+        return undefined;
+    }
+    const match = RULE_PATTERN.exec(trimmed);
+    if (!match) {
+        return undefined;
+    }
+    const tool = match[1];
+    const specifier = match[2]?.trim();
+    if (tool.length === 0) {
+        return undefined;
+    }
+    return specifier === undefined ? { tool } : { tool, specifier };
+}
+/** Parse a list of rule strings, discarding any that fail to parse. */
+export function parseRules(rules) {
+    const parsed = [];
+    for (const rule of rules) {
+        const result = parseRule(rule);
+        if (result !== undefined) {
+            parsed.push(result);
+        }
+    }
+    return parsed;
+}
+/** Format a parsed rule back into its canonical string form. */
+export function formatRule(rule) {
+    return rule.specifier === undefined ? rule.tool : `${rule.tool}(${rule.specifier})`;
+}
+/** Normalize Claude's `:*` prefix suffix into the equivalent word-boundary ` *` form. */
+function normalizeSpecifier(specifier) {
+    if (specifier.endsWith(PREFIX_STAR_SUFFIX)) {
+        return `${specifier.slice(0, -PREFIX_STAR_SUFFIX.length)}${WORD_BOUNDARY_SUFFIX}`;
+    }
+    return specifier;
+}
+function globToRegExp(pattern) {
+    const source = pattern
+        .split(GLOB_STAR)
+        .map((segment) => segment.replace(REGEXP_SPECIAL_CHARS, "\\$&"))
+        .join(".*");
+    return new RegExp(`^${source}$`);
+}
+/**
+ * Whether a single command/value matches a rule specifier under glob semantics. A specifier
+ * ending in a word-boundary ` *` (or `:*`) matches the exact prefix or the prefix followed by a
+ * space; any other `*` is a general wildcard. No wildcard means an exact match.
+ */
+export function matchesSpecifier(value, specifier) {
+    const normalized = normalizeSpecifier(specifier);
+    if (normalized.endsWith(WORD_BOUNDARY_SUFFIX)) {
+        const base = normalized.slice(0, -WORD_BOUNDARY_SUFFIX.length);
+        if (!base.includes(GLOB_STAR)) {
+            return value === base || value.startsWith(`${base} `);
+        }
+    }
+    if (normalized.includes(GLOB_STAR)) {
+        return globToRegExp(normalized).test(value);
+    }
+    return value === normalized;
+}
+//# sourceMappingURL=rule-format.js.map

package/dist/_shared/auto-approve/rule-strategies.js

@@ -0,0 +1,72 @@
+import { CLAUDE_CODE_TOOL } from "../schemas/agent.schema.js";
+import { deriveRules as deriveCommandRules, matchesRules as matchesCommandRules } from "./command-decomposition.js";
+import { formatRule, GLOB_STAR } from "./rule-format.js";
+/** Input field carrying the shell command for Bash/PowerShell tools. */
+const COMMAND_INPUT_KEY = "command";
+/**
+ * Command-scoped tools, compared case-insensitively to cover Claude (`Bash`, `PowerShell`) and
+ * GitHub Copilot (`bash`, `powershell`).
+ */
+const COMMAND_TOOL_BASE_NAMES = new Set([
+    CLAUDE_CODE_TOOL.BASH.toLowerCase(),
+    CLAUDE_CODE_TOOL.POWER_SHELL.toLowerCase(),
+]);
+/**
+ * Whole-tool matching, preserving the legacy `isToolAutoApproved` behavior: exact tool-name match,
+ * plus a trailing `*` (including a bare `*` and MCP prefixes like `mcp__crow-artifacts__*`) as a
+ * prefix match.
+ */
+function wholeToolMatches(toolName, rules) {
+    for (const rule of rules) {
+        if (rule.specifier !== undefined) {
+            continue;
+        }
+        const pattern = rule.tool;
+        if (pattern === toolName) {
+            return true;
+        }
+        if (pattern.endsWith(GLOB_STAR) && toolName.startsWith(pattern.slice(0, -GLOB_STAR.length))) {
+            return true;
+        }
+    }
+    return false;
+}
+function extractCommand(input) {
+    const command = input[COMMAND_INPUT_KEY];
+    return typeof command === "string" ? command : undefined;
+}
+/** Default strategy: today's whole-tool behavior, used for any tool without a specialization. */
+export const defaultRuleStrategy = {
+    appliesTo: () => true,
+    deriveRules: (toolName) => [toolName],
+    matches: (toolName, _input, rules) => wholeToolMatches(toolName, rules),
+};
+/** Command strategy: Bash/PowerShell decomposition on top of the whole-tool behavior. */
+export const commandRuleStrategy = {
+    appliesTo: (toolName) => COMMAND_TOOL_BASE_NAMES.has(toolName.toLowerCase()),
+    deriveRules: (toolName, input) => {
+        const command = extractCommand(input);
+        if (command === undefined) {
+            return [];
+        }
+        return deriveCommandRules(command).map((specifier) => formatRule({ tool: toolName, specifier }));
+    },
+    matches: (toolName, input, rules) => {
+        if (wholeToolMatches(toolName, rules)) {
+            return true;
+        }
+        const command = extractCommand(input);
+        if (command === undefined) {
+            return false;
+        }
+        const targetTool = toolName.toLowerCase();
+        const specifiers = [];
+        for (const rule of rules) {
+            if (rule.specifier !== undefined && rule.tool.toLowerCase() === targetTool) {
+                specifiers.push(rule.specifier);
+            }
+        }
+        return matchesCommandRules(command, specifiers);
+    },
+};
+//# sourceMappingURL=rule-strategies.js.map

package/dist/_shared/auto-approve/rule-strategy-registry.js

@@ -0,0 +1,7 @@
+import { commandRuleStrategy, defaultRuleStrategy } from "./rule-strategies.js";
+const REGISTERED_STRATEGIES = [commandRuleStrategy];
+/** Resolve the auto-approve strategy for a tool, falling back to the default whole-tool strategy. */
+export function getRuleStrategy(toolName) {
+    return REGISTERED_STRATEGIES.find((strategy) => strategy.appliesTo(toolName)) ?? defaultRuleStrategy;
+}
+//# sourceMappingURL=rule-strategy-registry.js.map

package/dist/_shared/index.js

@@ -5,7 +5,7 @@ export { SessionUsageSchema, PendingPermissionInfoSchema, PendingInstructionRemi
 export { ClientMessageSchema, ServerMessageSchema, SendMessageSchema, InjectMessageSchema, PermissionResponseWsSchema, CommandMessageSchema, AgentTextWsMessageSchema, AgentActivityWsMessageSchema, AgentResultWsMessageSchema, AgentStatusWsMessageSchema, AgentCreatedWsMessageSchema, AgentUpdatedWsMessageSchema, AgentDeletedWsMessageSchema, AgentUsageWsMessageSchema, PermissionRequestWsMessageSchema, PermissionCancelledWsMessageSchema, ErrorWsMessageSchema, AgentMessageWsMessageSchema, AgentToolProgressWsMessageSchema, TaskAddedWsMessageSchema, TaskUpdatedWsMessageSchema, TaskAssignedWsMessageSchema, TaskStateChangedWsMessageSchema, TaskDeletedWsMessageSchema, CircleCreatedWsMessageSchema, CircleUpdatedWsMessageSchema, CircleDeletedWsMessageSchema, RelationshipCreatedWsMessageSchema, RelationshipDeletedWsMessageSchema, AgentBuilderDraftUpdatedWsMessageSchema, isAgentServerMessage, CLIENT_MESSAGE_TYPE, SERVER_MESSAGE_TYPE, } from "./schemas/websocket.schema.js";
 export { PERMISSION_DECISION, PermissionRequestSchema, PermissionResponseSchema, } from "./schemas/permission.schema.js";
 export { AgentMessageSchema, MessageAnnotationSchema, AGENT_MESSAGE_ROLE, AGENT_MESSAGE_TYPE, } from "./schemas/agent-message.schema.js";
-export { ARTIFACT_TYPE, ARTIFACT_CONTENT_TYPE, ArtifactTypeSchema, ArtifactContentTypeSchema, ArtifactMetadataSchema, ArtifactTagsUpdateSchema, } from "./schemas/artifact.schema.js";
+export { ARTIFACT_TYPE, ARTIFACT_CONTENT_TYPE, ArtifactTypeSchema, ArtifactContentTypeSchema, ArtifactMetadataSchema, ArtifactUpdateSchema, } from "./schemas/artifact.schema.js";
 export { AGENT_TASK_STATE, AGENT_TASK_SOURCE_TYPE, AgentTaskStateSchema, AgentTaskSourceSchema, AgentTaskItemSchema, AgentTaskDatabaseSchema, CreateTaskInputSchema, UpdateTaskInputSchema, UpdateTaskStateInputSchema, AssignTaskInputSchema, } from "./schemas/agent-task.schema.js";
 export { MCP_CONFIG_TYPE, InternalMcpConfigSchema, McpServerConfigSchema, CreateMcpConfigInputSchema, UpdateMcpConfigInputSchema, } from "./schemas/mcp-config.schema.js";
 export { SensorInfoSchema } from "./schemas/sensor.schema.js";
@@ -24,4 +24,9 @@ export { MESSAGE_SOURCE_TYPE, MessageSourceSchema, } from "./schemas/message-sou
 export { AGENT_COMMAND, AgentCommandSchema } from "./schemas/agent-command.schema.js";
 export { GraphNodeSchema, GraphEdgeSchema, GraphDataSchema, } from "./schemas/graph.schema.js";
 export { ConnectorConnectionSchema, ConnectorInfoSchema, ConnectConnectorResponseSchema, } from "./schemas/connector.schema.js";
+export { parseRule, parseRules, formatRule, matchesSpecifier, GLOB_STAR, WORD_BOUNDARY_SUFFIX, PREFIX_STAR_SUFFIX, } from "./auto-approve/rule-format.js";
+export { splitSubcommands, deriveRules, matchesRules, isReadOnlyCommand, DEFAULT_PREFIX_DEPTH, MAX_DERIVED_RULES, READ_ONLY_BUILTINS, PROCESS_WRAPPERS, } from "./auto-approve/command-decomposition.js";
+export { defaultRuleStrategy, commandRuleStrategy } from "./auto-approve/rule-strategies.js";
+export { getRuleStrategy } from "./auto-approve/rule-strategy-registry.js";
+export { AutoApproveRuleSet } from "./auto-approve/auto-approve-rule-set.js";
 //# sourceMappingURL=index.js.map

package/dist/_shared/schemas/artifact.schema.js

@@ -49,11 +49,32 @@ export const ArtifactMetadataSchema = z.object({
     createdBy: AgentTaskSourceSchema,
 });
 /**
- * Request body for updating an artifact's tags. Applies a remove-then-add delta to the
- * current tag set; at least one of addTags/removeTags must be non-empty.
+ * Request body for a PATCH artifact update. Tag changes apply a remove-then-add delta to the current
+ * set; `content` replaces the raw text. `expectedUpdatedTimestamp` guards against clobbering a
+ * concurrent edit — the update is rejected with a conflict when it no longer matches the stored
+ * timestamp. At least one of addTags/removeTags/content must be present, and a content replacement
+ * must carry the expected timestamp.
  */
-export const ArtifactTagsUpdateSchema = z.object({
+export const ArtifactUpdateSchema = z
+    .object({
     addTags: z.array(z.string()).optional(),
     removeTags: z.array(z.string()).optional(),
+    content: z.string().optional(),
+    expectedUpdatedTimestamp: z.number().optional(),
+})
+    .superRefine((update, ctx) => {
+    if ((update.addTags?.length ?? 0) === 0 && (update.removeTags?.length ?? 0) === 0 && update.content === undefined) {
+        ctx.addIssue({
+            code: "custom",
+            message: "At least one of addTags, removeTags, or content is required",
+        });
+    }
+    if (update.content !== undefined && update.expectedUpdatedTimestamp === undefined) {
+        ctx.addIssue({
+            code: "custom",
+            message: "expectedUpdatedTimestamp is required when content is provided",
+            path: ["expectedUpdatedTimestamp"],
+        });
+    }
 });
 //# sourceMappingURL=artifact.schema.js.map

package/dist/bootstrap.js

@@ -91,6 +91,7 @@ export async function bootstrap(options) {
     const taskManager = new AgentTaskManager(storeProvider, broadcaster, circleManager);
     await taskManager.initialize();
     const feedManager = new SimplyFeedManager(storeProvider, folderFileProvider, crowScheduler);
+    await feedManager.initialize();
     const artifactManager = new ArtifactManager(storeProvider, registry, circleManager);
     await artifactManager.initialize();
     const documentSearchService = new DocumentSearchService(artifactManager, taskManager, registry, circleManager);
@@ -175,6 +176,7 @@ export async function bootstrap(options) {
     const shutdown = async () => {
         logger.info("Shutting down...");
         crowScheduler.stop();
+        await feedManager.dispose();
         await discordBotManager.destroy();
         await server.close();
         await copilotClientManager.dispose();