daemora 1.0.0-alpha.0

package/dist/safety/ExecApproval.d.ts

@@ -0,0 +1,53 @@
+/**
+ * ExecApproval — dedicated approval gate for shell commands.
+ *
+ * HumanApproval covers tool-level approvals (send_email, broadcast, …);
+ * ExecApproval is the finer-grained sibling that the `execute_command`
+ * tool consults specifically for shell payloads. Matching patterns:
+ *
+ *   • `rm -rf`, `sudo`, `kill -9`, `shutdown`, `reboot`, `mkfs`, `dd if=`
+ *   • Pipe-to-shell installers (`curl|sh`, `wget|bash`)
+ *   • Destructive git (`git push --force`, `git reset --hard`)
+ *   • `npm publish`, `docker rm`, `docker system prune`
+ *   • `drop table/database`
+ *
+ * Modes (from settings or env `APPROVAL_MODE`):
+ *   • `off`             — never pause.
+ *   • `dangerous-only`  — only pause on pattern match (default).
+ *   • `all`             — pause on every shell invocation.
+ *
+ * Pending requests are listable + resolvable via an HTTP API (the
+ * server wires this to `/api/exec-approvals`). Returns `"allow"` /
+ * `"deny"` (with `"allow-once"` mapped to `"allow"` for the caller —
+ * TTL logic for persistent allows can live on top if needed).
+ */
+import { EventEmitter } from "node:events";
+export type ExecMode = "off" | "dangerous-only" | "all";
+export type Decision = "allow" | "allow-once" | "deny";
+export type EffectiveDecision = "allow" | "deny";
+export interface ExecApprovalOpts {
+    readonly mode?: ExecMode;
+    readonly timeoutMs?: number;
+}
+export declare class ExecApproval extends EventEmitter {
+    private _mode;
+    private readonly timeoutMs;
+    private readonly pending;
+    constructor(opts?: ExecApprovalOpts);
+    get mode(): ExecMode;
+    setMode(mode: ExecMode): void;
+    needsApproval(command: string): boolean;
+    requestApproval(command: string, taskId: string): Promise<EffectiveDecision>;
+    /** Resolve a pending approval. Returns true if the id was found. */
+    resolveApproval(approvalId: string, decision: Decision): boolean;
+    /** Snapshot of currently-pending approvals. Safe for UI consumption. */
+    listPending(): readonly {
+        id: string;
+        command: string;
+        taskId: string;
+        createdAt: number;
+        expiresInMs: number;
+    }[];
+}
+export declare const execApproval: ExecApproval;
+//# sourceMappingURL=ExecApproval.d.ts.map

package/dist/safety/ExecApproval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExecApproval.d.ts","sourceRoot":"","sources":["../../src/safety/ExecApproval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAO3C,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,gBAAgB,GAAG,KAAK,CAAC;AACxD,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,YAAY,GAAG,MAAM,CAAC;AACvD,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,MAAM,CAAC;AAoBjD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAUD,qBAAa,YAAa,SAAQ,YAAY;IAC5C,OAAO,CAAC,KAAK,CAAW;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;gBAE1C,IAAI,GAAE,gBAAqB;IAMvC,IAAI,IAAI,IAAI,QAAQ,CAEnB;IAED,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI;IAK7B,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAMvC,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA6B5E,oEAAoE;IACpE,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO;IAYhE,wEAAwE;IACxE,WAAW,IAAI,SAAS;QACtB,EAAE,EAAE,MAAM,CAAC;QACX,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,EAAE;CAUJ;AAED,eAAO,MAAM,YAAY,cAAqB,CAAC"}

package/dist/safety/ExecApproval.js

@@ -0,0 +1,120 @@
+/**
+ * ExecApproval — dedicated approval gate for shell commands.
+ *
+ * HumanApproval covers tool-level approvals (send_email, broadcast, …);
+ * ExecApproval is the finer-grained sibling that the `execute_command`
+ * tool consults specifically for shell payloads. Matching patterns:
+ *
+ *   • `rm -rf`, `sudo`, `kill -9`, `shutdown`, `reboot`, `mkfs`, `dd if=`
+ *   • Pipe-to-shell installers (`curl|sh`, `wget|bash`)
+ *   • Destructive git (`git push --force`, `git reset --hard`)
+ *   • `npm publish`, `docker rm`, `docker system prune`
+ *   • `drop table/database`
+ *
+ * Modes (from settings or env `APPROVAL_MODE`):
+ *   • `off`             — never pause.
+ *   • `dangerous-only`  — only pause on pattern match (default).
+ *   • `all`             — pause on every shell invocation.
+ *
+ * Pending requests are listable + resolvable via an HTTP API (the
+ * server wires this to `/api/exec-approvals`). Returns `"allow"` /
+ * `"deny"` (with `"allow-once"` mapped to `"allow"` for the caller —
+ * TTL logic for persistent allows can live on top if needed).
+ */
+import { EventEmitter } from "node:events";
+import { randomUUID } from "node:crypto";
+import { createLogger } from "../util/logger.js";
+const log = createLogger("exec-approval");
+const DANGEROUS_PATTERNS = [
+    /\brm\s+(-rf?|--recursive)\b/i,
+    /\bsudo\b/,
+    /\bdrop\s+(table|database)\b/i,
+    /\bkill\s+-9\b/,
+    /\bshutdown\b/,
+    /\breboot\b/,
+    /\bmkfs\b/,
+    /\bdd\s+if=/,
+    /\bcurl\b.*\|\s*(sh|bash|zsh)\b/,
+    /\bwget\b.*\|\s*(sh|bash|zsh)\b/,
+    /\bnpm\s+publish\b/,
+    /\bgit\s+push\s+.*--force\b/,
+    /\bgit\s+reset\s+--hard\b/,
+    /\bdocker\s+rm\b/,
+    /\bdocker\s+system\s+prune\b/,
+];
+export class ExecApproval extends EventEmitter {
+    _mode;
+    timeoutMs;
+    pending = new Map();
+    constructor(opts = {}) {
+        super();
+        this._mode = opts.mode ?? (process.env["APPROVAL_MODE"] ?? "off");
+        this.timeoutMs = opts.timeoutMs ?? 60_000;
+    }
+    get mode() {
+        return this._mode;
+    }
+    setMode(mode) {
+        this._mode = mode;
+        log.info({ mode }, "exec approval mode changed");
+    }
+    needsApproval(command) {
+        if (this._mode === "off")
+            return false;
+        if (this._mode === "all")
+            return true;
+        return DANGEROUS_PATTERNS.some((p) => p.test(command));
+    }
+    requestApproval(command, taskId) {
+        return new Promise((resolve) => {
+            const approvalId = randomUUID().slice(0, 12);
+            const timer = setTimeout(() => {
+                this.pending.delete(approvalId);
+                log.info({ approvalId }, "exec approval timed out → deny");
+                resolve("deny");
+            }, this.timeoutMs);
+            const pending = {
+                command,
+                taskId,
+                createdAt: Date.now(),
+                resolve,
+                timer,
+            };
+            this.pending.set(approvalId, pending);
+            log.info({ approvalId, command: command.slice(0, 120), taskId }, "exec approval requested");
+            this.emit("request", {
+                approvalId,
+                command,
+                taskId,
+                createdAt: pending.createdAt,
+                timeoutMs: this.timeoutMs,
+            });
+        });
+    }
+    /** Resolve a pending approval. Returns true if the id was found. */
+    resolveApproval(approvalId, decision) {
+        const entry = this.pending.get(approvalId);
+        if (!entry)
+            return false;
+        clearTimeout(entry.timer);
+        this.pending.delete(approvalId);
+        const effective = decision === "allow-once" ? "allow" : decision;
+        log.info({ approvalId, decision }, "exec approval resolved");
+        this.emit("resolved", { approvalId, decision, effective });
+        entry.resolve(effective);
+        return true;
+    }
+    /** Snapshot of currently-pending approvals. Safe for UI consumption. */
+    listPending() {
+        const now = Date.now();
+        return [...this.pending.entries()].map(([id, entry]) => ({
+            id,
+            command: entry.command,
+            taskId: entry.taskId,
+            createdAt: entry.createdAt,
+            expiresInMs: Math.max(0, this.timeoutMs - (now - entry.createdAt)),
+        }));
+    }
+}
+export const execApproval = new ExecApproval();
+//# sourceMappingURL=ExecApproval.js.map

package/dist/safety/ExecApproval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExecApproval.js","sourceRoot":"","sources":["../../src/safety/ExecApproval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,GAAG,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAM1C,MAAM,kBAAkB,GAAsB;IAC5C,8BAA8B;IAC9B,UAAU;IACV,8BAA8B;IAC9B,eAAe;IACf,cAAc;IACd,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,gCAAgC;IAChC,gCAAgC;IAChC,mBAAmB;IACnB,4BAA4B;IAC5B,0BAA0B;IAC1B,iBAAiB;IACjB,6BAA6B;CAC9B,CAAC;AAeF,MAAM,OAAO,YAAa,SAAQ,YAAY;IACpC,KAAK,CAAW;IACP,SAAS,CAAS;IAClB,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAEtD,YAAY,OAAyB,EAAE;QACrC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,IAAI,CAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAA0B,IAAI,KAAK,CAAC,CAAC;QAC5F,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;IAC5C,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,OAAO,CAAC,IAAc;QACpB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,4BAA4B,CAAC,CAAC;IACnD,CAAC;IAED,aAAa,CAAC,OAAe;QAC3B,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QACvC,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACtC,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,eAAe,CAAC,OAAe,EAAE,MAAc;QAC7C,OAAO,IAAI,OAAO,CAAoB,CAAC,OAAO,EAAE,EAAE;YAChD,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAChC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,EAAE,gCAAgC,CAAC,CAAC;gBAC3D,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAEnB,MAAM,OAAO,GAAY;gBACvB,OAAO;gBACP,MAAM;gBACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,OAAO;gBACP,KAAK;aACN,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAEtC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC;YAC5F,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;gBACnB,UAAU;gBACV,OAAO;gBACP,MAAM;gBACN,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,eAAe,CAAC,UAAkB,EAAE,QAAkB;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAChC,MAAM,SAAS,GAAsB,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QACpF,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,wBAAwB,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3D,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wEAAwE;IACxE,WAAW;QAOT,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACvD,EAAE;YACF,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,GAAG,CAAC,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;SACnE,CAAC,CAAC,CAAC;IACN,CAAC;CACF;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC"}

package/dist/safety/FilesystemGuard.d.ts

@@ -0,0 +1,94 @@
+/**
+ * FilesystemGuard — central policy point for filesystem access.
+ *
+ * Every FS tool (read_file, write_file, edit_file, list_directory) and
+ * every shell command (execute_command) routes through this guard. It
+ * does one job: answer "is this path allowed for this kind of access?"
+ *
+ * Design principles
+ * -----------------
+ *  1. Path normalisation is centralised. Tools pass whatever the LLM
+ *     gave us; the guard resolves, absolutises, and canonicalises (via
+ *     realpath when the target exists, lexical otherwise) before any
+ *     comparison. This closes the `../../../etc/shadow` family of bugs.
+ *
+ *  2. Symlinks are resolved. If `/tmp/x -> /etc/shadow`, writing to
+ *     `/tmp/x` is treated as writing to `/etc/shadow` and denied.
+ *
+ *  3. Denylist > allowlist. By default we run in "moderate" mode — most
+ *     of the disk is allowed (the user ASKED the agent to work on their
+ *     files), but a curated set of sensitive directories is hard-denied
+ *     for both reads and writes. Strict mode tightens this to "nothing
+ *     outside $HOME + $WORKSPACE_ROOT".
+ *
+ *  4. Tools call `ensureAllowed(path, mode)` and get a canonical
+ *     resolved path back. They MUST use that returned path for the
+ *     actual fs call — otherwise a symlink swap between check and use
+ *     re-introduces the race we're closing.
+ *
+ *  5. Every denial throws `BlockedActionError` with a stable reason code
+ *     so the UI can surface WHY (and so tests can assert on it).
+ */
+export type FsAccess = "read" | "write" | "execute";
+/**
+ * Guard modes, in order of strictness:
+ *   off       — no checks. Escape hatch for trusted environments.
+ *   moderate  — denylist of sensitive dirs (.ssh, .aws, /etc, ...) + Daemora's
+ *               own data dir is read-blocked. Default for general use.
+ *   strict    — only $HOME + extraAllow roots are reachable.
+ *   sandbox   — only extraAllow roots are reachable. $HOME is NOT auto-included.
+ *               Use this to confine the agent to a specific project directory.
+ */
+export type FsGuardMode = "off" | "moderate" | "strict" | "sandbox";
+export interface FilesystemGuardOptions {
+    readonly mode?: FsGuardMode;
+    /** Extra directories the agent is always allowed to touch. */
+    readonly extraAllow?: readonly string[];
+    /** Extra directories the agent is never allowed to touch. */
+    readonly extraDeny?: readonly string[];
+    /** Daemora's own data dir (vault DB, embeddings). Agent should NOT write here. */
+    readonly dataDir?: string;
+}
+export declare class FilesystemGuard {
+    private mode;
+    private readonly home;
+    private allow;
+    private deny;
+    private readonly dataDir;
+    constructor(opts?: FilesystemGuardOptions);
+    /**
+     * Throws BlockedActionError if the access is not permitted. Returns
+     * the CANONICAL path the caller should use for the actual syscall —
+     * tools MUST use this (not the caller-supplied path) to close the
+     * symlink-swap race.
+     */
+    ensureAllowed(rawPath: string, access: FsAccess): string;
+    /**
+     * Best-effort scan of a shell command for absolute paths and
+     * enforce the deny rules on any we find. Not a sandbox — just a
+     * defence-in-depth layer so a model that convinces itself to run
+     * `cat /etc/shadow` still gets blocked at the tool boundary.
+     *
+     * We look for tokens that begin with `/` (POSIX absolute) OR with a
+     * drive letter (Windows absolute). We check them for "execute"
+     * denial (covers the whole deny set on macOS/Linux for this use).
+     */
+    ensureCommandAllowed(command: string): void;
+    /** Public inspect so /api/config and tests can see what's configured. */
+    describe(): {
+        mode: FsGuardMode;
+        allow: readonly string[];
+        deny: readonly {
+            path: string;
+            access: readonly FsAccess[];
+        }[];
+        dataDir: string | undefined;
+    };
+    /**
+     * Hot-reconfigure. Used by PUT /api/security/fs so users can change the
+     * guard from the UI without restarting the server. Same constructor logic
+     * as the original setup, applied to `this` in place.
+     */
+    update(opts: Pick<FilesystemGuardOptions, "mode" | "extraAllow" | "extraDeny">): void;
+}
+//# sourceMappingURL=FilesystemGuard.d.ts.map

package/dist/safety/FilesystemGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FilesystemGuard.d.ts","sourceRoot":"","sources":["../../src/safety/FilesystemGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAQH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;AAIpD;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEpE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,kFAAkF;IAClF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAsBD,qBAAa,eAAe;IAI1B,OAAO,CAAC,IAAI,CAAc;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,KAAK,CAAoB;IACjC,OAAO,CAAC,IAAI,CAA2D;IACvE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;gBAEjC,IAAI,GAAE,sBAA2B;IA6B7C;;;;;OAKG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,MAAM;IAoExD;;;;;;;;;OASG;IACH,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IA8B3C,yEAAyE;IACzE,QAAQ,IAAI;QACV,IAAI,EAAE,WAAW,CAAC;QAClB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;QACzB,IAAI,EAAE,SAAS;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAA;SAAE,EAAE,CAAC;QAC/D,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;KAC7B;IAID;;;;OAIG;IACH,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,sBAAsB,EAAE,MAAM,GAAG,YAAY,GAAG,WAAW,CAAC,GAAG,IAAI;CAqBtF"}

package/dist/safety/FilesystemGuard.js

@@ -0,0 +1,275 @@
+/**
+ * FilesystemGuard — central policy point for filesystem access.
+ *
+ * Every FS tool (read_file, write_file, edit_file, list_directory) and
+ * every shell command (execute_command) routes through this guard. It
+ * does one job: answer "is this path allowed for this kind of access?"
+ *
+ * Design principles
+ * -----------------
+ *  1. Path normalisation is centralised. Tools pass whatever the LLM
+ *     gave us; the guard resolves, absolutises, and canonicalises (via
+ *     realpath when the target exists, lexical otherwise) before any
+ *     comparison. This closes the `../../../etc/shadow` family of bugs.
+ *
+ *  2. Symlinks are resolved. If `/tmp/x -> /etc/shadow`, writing to
+ *     `/tmp/x` is treated as writing to `/etc/shadow` and denied.
+ *
+ *  3. Denylist > allowlist. By default we run in "moderate" mode — most
+ *     of the disk is allowed (the user ASKED the agent to work on their
+ *     files), but a curated set of sensitive directories is hard-denied
+ *     for both reads and writes. Strict mode tightens this to "nothing
+ *     outside $HOME + $WORKSPACE_ROOT".
+ *
+ *  4. Tools call `ensureAllowed(path, mode)` and get a canonical
+ *     resolved path back. They MUST use that returned path for the
+ *     actual fs call — otherwise a symlink swap between check and use
+ *     re-introduces the race we're closing.
+ *
+ *  5. Every denial throws `BlockedActionError` with a stable reason code
+ *     so the UI can surface WHY (and so tests can assert on it).
+ */
+import { realpathSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { isAbsolute, resolve, sep } from "node:path";
+import { BlockedActionError } from "../util/errors.js";
+const ALL_ACCESS = ["read", "write", "execute"];
+/**
+ * Baseline denied-for-write paths across all modes. These contain
+ * secrets or OS-level config an agent has no business mutating.
+ * Reads are permitted by default but individual paths can override.
+ */
+const SENSITIVE_DIRS = (home) => [
+    // OS
+    { path: "/etc", access: ["write"] },
+    { path: "/System", access: ["read", "write", "execute"] },
+    { path: "/private/etc", access: ["write"] },
+    { path: "/Library/LaunchDaemons", access: ["write", "execute"] },
+    // User secrets — both read AND write blocked
+    { path: `${home}/.ssh`, access: ["read", "write"] },
+    { path: `${home}/.aws`, access: ["read", "write"] },
+    { path: `${home}/.gnupg`, access: ["read", "write"] },
+    { path: `${home}/.config/gcloud`, access: ["read", "write"] },
+    { path: `${home}/.netrc`, access: ["read", "write"] },
+    { path: `${home}/.kube`, access: ["read", "write"] },
+];
+export class FilesystemGuard {
+    // These are mutated by `update()` so a live guard can be reconfigured
+    // (via PUT /api/security/fs) without restarting the server. Tools hold
+    // a reference to this instance, so mutating in place beats rebuilding.
+    mode;
+    home;
+    allow;
+    deny;
+    dataDir;
+    constructor(opts = {}) {
+        this.mode = opts.mode ?? "moderate";
+        this.home = homedir();
+        this.dataDir = opts.dataDir;
+        // strict  → $HOME + extras are the only reachable roots.
+        // sandbox → ONLY extras are reachable ($HOME is NOT auto-allowed). Use
+        //           this to confine the agent to a specific project directory.
+        if (this.mode === "strict") {
+            const strictRoots = [this.home, ...(opts.extraAllow ?? [])];
+            this.allow = strictRoots.map((p) => normaliseLexical(p));
+        }
+        else if (this.mode === "sandbox") {
+            // Always include the data dir so the agent can write its own state
+            // (memory, costs, audit). Without this, every write would 403.
+            const sandboxRoots = [...(opts.extraAllow ?? [])];
+            if (opts.dataDir)
+                sandboxRoots.push(opts.dataDir);
+            this.allow = sandboxRoots.map((p) => normaliseLexical(p));
+        }
+        else {
+            this.allow = [];
+        }
+        const baseDeny = SENSITIVE_DIRS(this.home);
+        const extraDeny = (opts.extraDeny ?? []).map((p) => ({
+            path: p,
+            access: ["read", "write", "execute"],
+        }));
+        this.deny = [...baseDeny, ...extraDeny];
+    }
+    /**
+     * Throws BlockedActionError if the access is not permitted. Returns
+     * the CANONICAL path the caller should use for the actual syscall —
+     * tools MUST use this (not the caller-supplied path) to close the
+     * symlink-swap race.
+     */
+    ensureAllowed(rawPath, access) {
+        if (this.mode === "off")
+            return absolute(rawPath);
+        const target = absolute(rawPath);
+        const canonical = canonicalise(target);
+        // 1a) (Removed.) Previously this block denied ALL writes anywhere
+        //    under dataDir. Too aggressive — agents are explicitly told to
+        //    write journal entries, research files, generated artifacts,
+        //    etc. into `data/journal/`, `data/research/`, `data/artifacts/`.
+        //    The actually-sensitive files (vault, sqlite database, salt)
+        //    are protected by the targeted rule below (1b), which catches
+        //    them by suffix regardless of subpath.
+        // 1b) Block ALL access (read OR write) to Daemora's own SQLite
+        //    database + WAL / SHM sidecar files. Even reading is off-limits
+        //    — the DB holds vault blobs, session history, memory rows. An
+        //    agent that could open it raw would trivially exfiltrate every
+        //    secret the user ever stored. The file-tool paths (read_file,
+        //    execute_command, grep, etc.) all route through ensureAllowed,
+        //    so this one check covers every pathway.
+        if (this.dataDir) {
+            const dataCanon = canonicalise(this.dataDir);
+            const looksLikeOurDb = canonical === dataCanon ||
+                canonical.startsWith(dataCanon + sep);
+            if (looksLikeOurDb) {
+                const base = canonical.slice(dataCanon.length + 1);
+                if (/\.(?:db|sqlite)(?:-wal|-shm|-journal)?$/i.test(base) || base.endsWith(".vault.enc") || base.endsWith(".vault.salt")) {
+                    throw new BlockedActionError(`Access to Daemora's own database / vault files denied: ${canonical}`, { rawPath, canonical, reason: "self_db_access" });
+                }
+            }
+        }
+        // 2) Check denylist (applies to both canonical AND pre-realpath
+        //    target — so a symlink pointing INTO a denied dir is caught).
+        for (const rule of this.deny) {
+            if (!rule.access.includes(access))
+                continue;
+            const denyCanon = canonicalise(rule.path);
+            const hitsTarget = target === denyCanon || target.startsWith(denyCanon + sep);
+            const hitsCanonical = canonical === denyCanon || canonical.startsWith(denyCanon + sep);
+            if (hitsTarget || hitsCanonical) {
+                throw new BlockedActionError(`${access} denied for sensitive path: ${rule.path}`, { rawPath, canonical, reason: "sensitive_path", rule: rule.path });
+            }
+        }
+        // 3) Strict / sandbox mode: require hit in allowlist.
+        if (this.mode === "strict" || this.mode === "sandbox") {
+            const inAllow = this.allow.some((root) => canonical === root || canonical.startsWith(root + sep));
+            if (!inAllow) {
+                throw new BlockedActionError(`${access} outside allowed roots: ${canonical}`, { rawPath, canonical, reason: "outside_allowlist", mode: this.mode, allow: this.allow });
+            }
+        }
+        return canonical;
+    }
+    /**
+     * Best-effort scan of a shell command for absolute paths and
+     * enforce the deny rules on any we find. Not a sandbox — just a
+     * defence-in-depth layer so a model that convinces itself to run
+     * `cat /etc/shadow` still gets blocked at the tool boundary.
+     *
+     * We look for tokens that begin with `/` (POSIX absolute) OR with a
+     * drive letter (Windows absolute). We check them for "execute"
+     * denial (covers the whole deny set on macOS/Linux for this use).
+     */
+    ensureCommandAllowed(command) {
+        if (this.mode === "off")
+            return;
+        const paths = extractAbsolutePaths(command);
+        for (const p of paths) {
+            // A shell command can touch a path in any way (read, write,
+            // execute). We don't know which ahead of parsing the whole
+            // command line, so we probe ALL three access kinds and refuse
+            // the command if ANY of them is denied.
+            for (const access of ALL_ACCESS) {
+                try {
+                    this.ensureAllowed(p, access);
+                }
+                catch (e) {
+                    if (e instanceof BlockedActionError) {
+                        throw new BlockedActionError(`Command references a blocked path: ${p}`, {
+                            rawPath: p,
+                            command,
+                            reason: "command_path_blocked",
+                            deniedAccess: access,
+                            innerReason: e.context["reason"],
+                        });
+                    }
+                    throw e;
+                }
+            }
+        }
+    }
+    /** Public inspect so /api/config and tests can see what's configured. */
+    describe() {
+        return { mode: this.mode, allow: this.allow, deny: this.deny, dataDir: this.dataDir };
+    }
+    /**
+     * Hot-reconfigure. Used by PUT /api/security/fs so users can change the
+     * guard from the UI without restarting the server. Same constructor logic
+     * as the original setup, applied to `this` in place.
+     */
+    update(opts) {
+        if (opts.mode)
+            this.mode = opts.mode;
+        if (this.mode === "strict") {
+            const strictRoots = [this.home, ...(opts.extraAllow ?? [])];
+            this.allow = strictRoots.map((p) => normaliseLexical(p));
+        }
+        else if (this.mode === "sandbox") {
+            const sandboxRoots = [...(opts.extraAllow ?? [])];
+            if (this.dataDir)
+                sandboxRoots.push(this.dataDir);
+            this.allow = sandboxRoots.map((p) => normaliseLexical(p));
+        }
+        else {
+            this.allow = [];
+        }
+        const baseDeny = SENSITIVE_DIRS(this.home);
+        const extraDeny = (opts.extraDeny ?? []).map((p) => ({
+            path: p,
+            access: ["read", "write", "execute"],
+        }));
+        this.deny = [...baseDeny, ...extraDeny];
+    }
+}
+function absolute(p) {
+    return isAbsolute(p) ? p : resolve(p);
+}
+/** Pure path collapse (no fs). Handles `..`, `.`, trailing `/`. */
+function normaliseLexical(p) {
+    return resolve(p);
+}
+/**
+ * Realpath where the target exists, lexical otherwise. We want the
+ * canonical form when we CAN get it so symlink tricks are closed, but
+ * we must still work for writes to new files (target doesn't exist yet
+ * — the parent dir might though). Strategy: realpath the deepest
+ * ancestor that exists, then rejoin the missing tail.
+ */
+function canonicalise(p) {
+    const abs = absolute(p);
+    try {
+        return realpathSync(abs);
+    }
+    catch {
+        // Fall through to ancestor-walk.
+    }
+    const parts = abs.split(sep);
+    for (let i = parts.length; i > 0; i--) {
+        const probe = parts.slice(0, i).join(sep) || sep;
+        try {
+            statSync(probe);
+            const real = realpathSync(probe);
+            const tail = parts.slice(i).join(sep);
+            return tail ? `${real}${sep}${tail}` : real;
+        }
+        catch { /* keep walking up */ }
+    }
+    return abs;
+}
+/**
+ * Extract absolute paths from a shell command. Matches POSIX `/…` and
+ * Windows `C:\…`. Handles quotes so `rm "/etc/shadow"` still gets
+ * picked up. This isn't a parser — it's a belt-and-suspenders lint.
+ */
+function extractAbsolutePaths(cmd) {
+    const hits = [];
+    // POSIX: a slash preceded by start/whitespace/quote, continuing to next whitespace/quote/end
+    const posix = /(?:^|[\s"'`(])(\/[^\s"'`)]+)/g;
+    let m;
+    while ((m = posix.exec(cmd)) !== null)
+        hits.push(m[1]);
+    // Windows absolute: C:\foo or C:/foo
+    const win = /(?:^|[\s"'`(])([A-Za-z]:[\\\/][^\s"'`)]+)/g;
+    while ((m = win.exec(cmd)) !== null)
+        hits.push(m[1]);
+    return hits;
+}
+//# sourceMappingURL=FilesystemGuard.js.map

package/dist/safety/FilesystemGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FilesystemGuard.js","sourceRoot":"","sources":["../../src/safety/FilesystemGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAIvD,MAAM,UAAU,GAAwB,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAuBrE;;;;GAIG;AACH,MAAM,cAAc,GAAG,CAAC,IAAY,EAA4D,EAAE,CAAC;IACjG,KAAK;IACL,EAAE,IAAI,EAAE,MAAM,EAAW,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE;IAC5C,EAAE,IAAI,EAAE,SAAS,EAAQ,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE;IAC/D,EAAE,IAAI,EAAE,cAAc,EAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE;IAC5C,EAAE,IAAI,EAAE,wBAAwB,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE;IAChE,6CAA6C;IAC7C,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAI,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;IACrD,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAI,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;IACrD,EAAE,IAAI,EAAE,GAAG,IAAI,SAAS,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;IACrD,EAAE,IAAI,EAAE,GAAG,IAAI,iBAAiB,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;IAC7D,EAAE,IAAI,EAAE,GAAG,IAAI,SAAS,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;IACrD,EAAE,IAAI,EAAE,GAAG,IAAI,QAAQ,EAAG,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;CACtD,CAAC;AAEF,MAAM,OAAO,eAAe;IAC1B,sEAAsE;IACtE,uEAAuE;IACvE,uEAAuE;IAC/D,IAAI,CAAc;IACT,IAAI,CAAS;IACtB,KAAK,CAAoB;IACzB,IAAI,CAA2D;IACtD,OAAO,CAAqB;IAE7C,YAAY,OAA+B,EAAE;QAC3C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,OAAO,EAAE,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAE5B,yDAAyD;QACzD,uEAAuE;QACvE,uEAAuE;QACvE,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;YAC5D,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnC,mEAAmE;YACnE,+DAA+D;YAC/D,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;YAClD,IAAI,IAAI,CAAC,OAAO;gBAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAClB,CAAC;QAED,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnD,IAAI,EAAE,CAAC;YACP,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAU;SAC9C,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,SAAS,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,OAAe,EAAE,MAAgB;QAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;QAElD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QAEvC,kEAAkE;QAClE,mEAAmE;QACnE,iEAAiE;QACjE,qEAAqE;QACrE,iEAAiE;QACjE,kEAAkE;QAClE,2CAA2C;QAE3C,+DAA+D;QAC/D,oEAAoE;QACpE,kEAAkE;QAClE,mEAAmE;QACnE,kEAAkE;QAClE,mEAAmE;QACnE,6CAA6C;QAC7C,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7C,MAAM,cAAc,GAClB,SAAS,KAAK,SAAS;gBACvB,SAAS,CAAC,UAAU,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;YACxC,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACnD,IAAI,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;oBACzH,MAAM,IAAI,kBAAkB,CAC1B,0DAA0D,SAAS,EAAE,EACrE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,CACjD,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,kEAAkE;QAClE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC5C,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;YAC9E,MAAM,aAAa,GAAG,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;YACvF,IAAI,UAAU,IAAI,aAAa,EAAE,CAAC;gBAChC,MAAM,IAAI,kBAAkB,CAC1B,GAAG,MAAM,+BAA+B,IAAI,CAAC,IAAI,EAAE,EACnD,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,sDAAsD;QACtD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAC7B,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CACjE,CAAC;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,kBAAkB,CAC1B,GAAG,MAAM,2BAA2B,SAAS,EAAE,EAC/C,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CACxF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;OASG;IACH,oBAAoB,CAAC,OAAe;QAClC,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO;QAChC,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,4DAA4D;YAC5D,2DAA2D;YAC3D,8DAA8D;YAC9D,wCAAwC;YACxC,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;gBAChC,IAAI,CAAC;oBACH,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,CAAC,YAAY,kBAAkB,EAAE,CAAC;wBACpC,MAAM,IAAI,kBAAkB,CAC1B,sCAAsC,CAAC,EAAE,EACzC;4BACE,OAAO,EAAE,CAAC;4BACV,OAAO;4BACP,MAAM,EAAE,sBAAsB;4BAC9B,YAAY,EAAE,MAAM;4BACpB,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;yBACjC,CACF,CAAC;oBACJ,CAAC;oBACD,MAAM,CAAC,CAAC;gBACV,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,QAAQ;QAMN,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACxF,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,IAAuE;QAC5E,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QAErC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;YAC5D,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;YAClD,IAAI,IAAI,CAAC,OAAO;gBAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAClB,CAAC;QAED,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnD,IAAI,EAAE,CAAC;YACP,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAU;SAC9C,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,SAAS,CAAC,CAAC;IAC1C,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,mEAAmE;AACnE,SAAS,gBAAgB,CAAC,CAAS;IACjC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;QACjD,IAAI,CAAC;YACH,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChB,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,GAAW;IACvC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,6FAA6F;IAC7F,MAAM,KAAK,GAAG,+BAA+B,CAAC;IAC9C,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IACxD,qCAAqC;IACrC,MAAM,GAAG,GAAG,4CAA4C,CAAC;IACzD,OAAO,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/safety/GitRollback.d.ts

@@ -0,0 +1,47 @@
+/**
+ * GitRollback — snapshots the working tree before the first write in a
+ * task so "undo" stays possible.
+ *
+ * Semantics:
+ *   • `snapshot(taskId)` — call once before the first write tool fires.
+ *     Uses `git stash push --include-untracked -m <msg>` so the user's
+ *     index + untracked files are preserved.
+ *   • `undo(taskId)` — discards agent edits (`git checkout -- .` +
+ *     `git clean -fd`) and reapplies the stash. Returns a user-facing
+ *     status string.
+ *   • `drop(taskId)` — called when the task is confirmed good and the
+ *     stash can be dropped.
+ *
+ * No-ops gracefully if git is unavailable or the cwd isn't inside a
+ * repo. Failures never block the agent.
+ */
+import { EventEmitter } from "node:events";
+export declare class GitRollback extends EventEmitter {
+    private readonly snapshotMessages;
+    private readonly snapshotted;
+    private enabled;
+    enable(): void;
+    disable(): void;
+    isGitRepo(cwd?: string): boolean;
+    /**
+     * Snapshot the working tree for a task. Idempotent — subsequent calls
+     * for the same taskId return null without touching git. Returns the
+     * stash message (used as a lookup key in `git stash list`) or null
+     * when nothing needed stashing.
+     */
+    snapshot(taskId: string, cwd?: string): string | null;
+    /**
+     * Pop the snapshot, overwriting any mid-task edits. Returns a
+     * user-facing status string.
+     */
+    undo(taskId: string, cwd?: string): string;
+    /**
+     * Drop the snapshot for a successful task (cleanup). Safe if the
+     * stash no longer exists.
+     */
+    drop(taskId: string, cwd?: string): void;
+    hasSnapshot(taskId: string): boolean;
+    private findStashIndex;
+}
+export declare const gitRollback: GitRollback;
+//# sourceMappingURL=GitRollback.d.ts.map

package/dist/safety/GitRollback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitRollback.d.ts","sourceRoot":"","sources":["../../src/safety/GitRollback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAO3C,qBAAa,WAAY,SAAQ,YAAY;IAC3C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA6B;IAC9D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,OAAO,CAAQ;IAEvB,MAAM,IAAI,IAAI;IACd,OAAO,IAAI,IAAI;IAEf,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO;IAYhC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAoCrD;;;OAGG;IACH,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM;IAyC1C;;;OAGG;IACH,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI;IAmBxC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAIpC,OAAO,CAAC,cAAc;CASvB;AAED,eAAO,MAAM,WAAW,aAAoB,CAAC"}