daycare-cli 0.0.0-canary.f57680e

package/dist/engine/apps/appReviewPromptBuild.spec.js

@@ -0,0 +1,49 @@
+import { describe, expect, it } from "vitest";
+import { appReviewPromptBuild } from "./appReviewPromptBuild.js";
+describe("appReviewPromptBuild", () => {
+    it("includes tool details and allow/deny rules", async () => {
+        const prompt = await appReviewPromptBuild({
+            appName: "GitHub Reviewer",
+            appSystemPrompt: "You are a secure review assistant. Use only approved tooling and avoid destructive actions.",
+            rlmEnabled: true,
+            sourceIntent: "Review pull requests safely.",
+            toolName: "exec",
+            args: { command: "git diff" },
+            availableTools: [
+                {
+                    name: "exec",
+                    description: "Run a shell command in the workspace.",
+                    parameters: {
+                        type: "object",
+                        properties: { command: { type: "string" } },
+                        required: ["command"]
+                    }
+                }
+            ],
+            rules: {
+                allow: [{ text: "Run read-only git commands" }],
+                deny: [{ text: "Rewrite git history" }]
+            }
+        });
+        expect(prompt).toContain('app "GitHub Reviewer"');
+        expect(prompt).toContain("- Tool: exec");
+        expect(prompt).toContain('"command": "git diff"');
+        expect(prompt).toContain("## Available Tools In This Sandbox");
+        expect(prompt).toContain("Name: exec");
+        expect(prompt).toContain("not Python exec()");
+        expect(prompt).toContain("## Execution Mode");
+        expect(prompt).toContain("RLM mode is enabled.");
+        expect(prompt).toContain("`run_python` tool");
+        expect(prompt).toContain("minimal Python runtime (Monty)");
+        expect(prompt).toContain("not full CPython");
+        expect(prompt).toContain("do not assume standard-library or third-party modules are available");
+        expect(prompt).toContain("`read(...)`, `exec(...)`");
+        expect(prompt).toContain("## App System Prompt");
+        expect(prompt).toContain("You are a secure review assistant.");
+        expect(prompt).toContain("Review pull requests safely.");
+        expect(prompt).toContain("- Run read-only git commands");
+        expect(prompt).toContain("- Rewrite git history");
+        expect(prompt).toContain("DENY: <reason>");
+    });
+});
+//# sourceMappingURL=appReviewPromptBuild.spec.js.map

package/dist/engine/apps/appReviewPromptBuild.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appReviewPromptBuild.spec.js","sourceRoot":"","sources":["../../../sources/engine/apps/appReviewPromptBuild.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC;YACxC,OAAO,EAAE,iBAAiB;YAC1B,eAAe,EACb,6FAA6F;YAC/F,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,8BAA8B;YAC5C,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE;YAC7B,cAAc,EAAE;gBACd;oBACE,IAAI,EAAE,MAAM;oBACZ,WAAW,EAAE,uCAAuC;oBACpD,UAAU,EAAE;wBACV,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;wBAC3C,QAAQ,EAAE,CAAC,SAAS,CAAC;qBACtB;iBACF;aACF;YACD,KAAK,EAAE;gBACL,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC;gBAC/C,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC;aACxC;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,qEAAqE,CAAC,CAAC;QAChG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/apps/appReviewProvidersResolve.d.ts

@@ -0,0 +1,8 @@
+import type { ProviderSettings } from "../../settings.js";
+import type { Config } from "@/types";
+/**
+ * Resolves optional provider overrides for app review model selection.
+ * Expects: model is either empty/default, `provider:model`, or a raw model id.
+ */
+export declare function appReviewProvidersResolve(config: Config, model: string | undefined): ProviderSettings[] | undefined;
+//# sourceMappingURL=appReviewProvidersResolve.d.ts.map

package/dist/engine/apps/appReviewProvidersResolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appReviewProvidersResolve.d.ts","sourceRoot":"","sources":["../../../sources/engine/apps/appReviewProvidersResolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGtC;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,gBAAgB,EAAE,GAAG,SAAS,CA0BhC"}

package/dist/engine/apps/appReviewProvidersResolve.js

@@ -0,0 +1,30 @@
+import { listActiveInferenceProviders } from "../../providers/catalog.js";
+/**
+ * Resolves optional provider overrides for app review model selection.
+ * Expects: model is either empty/default, `provider:model`, or a raw model id.
+ */
+export function appReviewProvidersResolve(config, model) {
+    const requested = model?.trim();
+    if (!requested || requested.toLowerCase() === "default") {
+        return undefined;
+    }
+    const providers = listActiveInferenceProviders(config.settings);
+    if (providers.length === 0) {
+        return undefined;
+    }
+    const separator = requested.indexOf(":");
+    if (separator > 0 && separator < requested.length - 1) {
+        const providerId = requested.slice(0, separator);
+        const modelId = requested.slice(separator + 1);
+        const provider = providers.find((entry) => entry.id === providerId);
+        if (provider) {
+            return [{ ...provider, model: modelId }];
+        }
+    }
+    const firstProvider = providers[0];
+    if (!firstProvider) {
+        return undefined;
+    }
+    return [{ ...firstProvider, model: requested }];
+}
+//# sourceMappingURL=appReviewProvidersResolve.js.map

package/dist/engine/apps/appReviewProvidersResolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appReviewProvidersResolve.js","sourceRoot":"","sources":["../../../sources/engine/apps/appReviewProvidersResolve.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAE1E;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAc,EACd,KAAyB;IAEzB,MAAM,SAAS,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,SAAS,EAAE,CAAC;QACxD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAG,4BAA4B,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;QACpE,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,CAAC,EAAE,GAAG,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;AAClD,CAAC"}

package/dist/engine/apps/appReviewProvidersResolve.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=appReviewProvidersResolve.spec.d.ts.map

package/dist/engine/apps/appReviewProvidersResolve.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appReviewProvidersResolve.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/apps/appReviewProvidersResolve.spec.ts"],"names":[],"mappings":""}

package/dist/engine/apps/appReviewProvidersResolve.spec.js

@@ -0,0 +1,29 @@
+import { describe, expect, it } from "vitest";
+import { configResolve } from "../../config/configResolve.js";
+import { appReviewProvidersResolve } from "./appReviewProvidersResolve.js";
+describe("appReviewProvidersResolve", () => {
+    it("returns undefined for default model selector", () => {
+        const config = configResolve({
+            inference: { providers: [{ id: "openai", model: "gpt-5-mini" }] },
+            engine: { dataDir: "/tmp/daycare-test-data" },
+            assistant: { workspaceDir: "/tmp/daycare-test-workspace" }
+        }, "/tmp/daycare-test-settings.json");
+        expect(appReviewProvidersResolve(config, "default")).toBeUndefined();
+    });
+    it("supports provider:model selector", () => {
+        const config = configResolve({
+            inference: {
+                providers: [
+                    { id: "openai", model: "gpt-5-mini" },
+                    { id: "anthropic", model: "claude-sonnet-4-5" }
+                ]
+            },
+            engine: { dataDir: "/tmp/daycare-test-data-2" },
+            assistant: { workspaceDir: "/tmp/daycare-test-workspace-2" }
+        }, "/tmp/daycare-test-settings-2.json");
+        const override = appReviewProvidersResolve(config, "anthropic:claude-opus-4");
+        expect(override).toHaveLength(1);
+        expect(override?.[0]).toMatchObject({ id: "anthropic", model: "claude-opus-4" });
+    });
+});
+//# sourceMappingURL=appReviewProvidersResolve.spec.js.map

package/dist/engine/apps/appReviewProvidersResolve.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appReviewProvidersResolve.spec.js","sourceRoot":"","sources":["../../../sources/engine/apps/appReviewProvidersResolve.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,MAAM,GAAG,aAAa,CAC1B;YACE,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE;YACjE,MAAM,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE;YAC7C,SAAS,EAAE,EAAE,YAAY,EAAE,6BAA6B,EAAE;SAC3D,EACD,iCAAiC,CAClC,CAAC;QAEF,MAAM,CAAC,yBAAyB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,MAAM,GAAG,aAAa,CAC1B;YACE,SAAS,EAAE;gBACT,SAAS,EAAE;oBACT,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE;oBACrC,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,mBAAmB,EAAE;iBAChD;aACF;YACD,MAAM,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE;YAC/C,SAAS,EAAE,EAAE,YAAY,EAAE,+BAA+B,EAAE;SAC7D,EACD,mCAAmC,CACpC,CAAC;QAEF,MAAM,QAAQ,GAAG,yBAAyB,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;QAC9E,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/apps/appRuleApply.d.ts

@@ -0,0 +1,20 @@
+import type { AppPermissions } from "./appTypes.js";
+export type AppRuleAction = "add_deny" | "add_allow" | "remove_deny" | "remove_allow";
+type AppRuleApplyInput = {
+    appDir: string;
+    action: AppRuleAction;
+    rule: string;
+    addedBy?: string;
+};
+type AppRuleApplyResult = {
+    permissions: AppPermissions;
+    changed: boolean;
+    message: string;
+};
+/**
+ * Applies one rule change action to app permissions and persists PERMISSIONS.md.
+ * Expects: appDir points to an installed app folder with PERMISSIONS.md.
+ */
+export declare function appRuleApply(input: AppRuleApplyInput): Promise<AppRuleApplyResult>;
+export {};
+//# sourceMappingURL=appRuleApply.d.ts.map

package/dist/engine/apps/appRuleApply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appRuleApply.d.ts","sourceRoot":"","sources":["../../../sources/engine/apps/appRuleApply.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,WAAW,GAAG,aAAa,GAAG,cAAc,CAAC;AAEtF,KAAK,iBAAiB,GAAG;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,aAAa,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,KAAK,kBAAkB,GAAG;IACxB,WAAW,EAAE,cAAc,CAAC;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;GAGG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA4CxF"}

package/dist/engine/apps/appRuleApply.js

@@ -0,0 +1,54 @@
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { appPermissionsParse } from "./appPermissionsParse.js";
+import { appPermissionsSerialize } from "./appPermissionsSerialize.js";
+import { appPermissionsValidate } from "./appPermissionsValidate.js";
+/**
+ * Applies one rule change action to app permissions and persists PERMISSIONS.md.
+ * Expects: appDir points to an installed app folder with PERMISSIONS.md.
+ */
+export async function appRuleApply(input) {
+    const ruleText = input.rule.trim();
+    if (!ruleText) {
+        throw new Error("Rule text is required.");
+    }
+    const permissionsPath = path.join(path.resolve(input.appDir), "PERMISSIONS.md");
+    const raw = await fs.readFile(permissionsPath, "utf8");
+    const permissions = appPermissionsValidate(appPermissionsParse(raw));
+    const next = structuredClone(permissions);
+    let changed = false;
+    let message = "No changes applied.";
+    if (input.action === "add_deny" || input.action === "add_allow") {
+        const bucket = input.action === "add_deny" ? next.rules.deny : next.rules.allow;
+        if (!bucket.some((rule) => rule.text === ruleText)) {
+            bucket.push(input.addedBy ? { text: ruleText, addedBy: input.addedBy } : { text: ruleText });
+            changed = true;
+            message = `Rule added to ${input.action === "add_deny" ? "deny" : "allow"} list.`;
+        }
+        else {
+            message = "Rule already exists; no change made.";
+        }
+    }
+    else {
+        const bucket = input.action === "remove_deny" ? next.rules.deny : next.rules.allow;
+        const index = bucket.findIndex((rule) => rule.text === ruleText);
+        if (index >= 0) {
+            bucket.splice(index, 1);
+            changed = true;
+            message = `Rule removed from ${input.action === "remove_deny" ? "deny" : "allow"} list.`;
+        }
+        else {
+            message = "Rule not found; no change made.";
+        }
+    }
+    const validated = appPermissionsValidate(next);
+    if (changed) {
+        await fs.writeFile(permissionsPath, appPermissionsSerialize(validated), "utf8");
+    }
+    return {
+        permissions: validated,
+        changed,
+        message
+    };
+}
+//# sourceMappingURL=appRuleApply.js.map

package/dist/engine/apps/appRuleApply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appRuleApply.js","sourceRoot":"","sources":["../../../sources/engine/apps/appRuleApply.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAkBrE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAwB;IACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAChF,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,sBAAsB,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;IAErE,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,OAAO,GAAG,qBAAqB,CAAC;IAEpC,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAChF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC7F,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,GAAG,iBAAiB,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,QAAQ,CAAC;QACpF,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,sCAAsC,CAAC;QACnD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QACnF,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACjE,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACf,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACxB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,GAAG,qBAAqB,KAAK,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,QAAQ,CAAC;QAC3F,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,iCAAiC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,uBAAuB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;IAClF,CAAC;IAED,OAAO;QACL,WAAW,EAAE,SAAS;QACtB,OAAO;QACP,OAAO;KACR,CAAC;AACJ,CAAC"}

package/dist/engine/apps/appRuleApply.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=appRuleApply.spec.d.ts.map

package/dist/engine/apps/appRuleApply.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appRuleApply.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/apps/appRuleApply.spec.ts"],"names":[],"mappings":""}

package/dist/engine/apps/appRuleApply.spec.js

@@ -0,0 +1,87 @@
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { appPermissionsParse } from "./appPermissionsParse.js";
+import { appPermissionsValidate } from "./appPermissionsValidate.js";
+import { appRuleApply } from "./appRuleApply.js";
+describe("appRuleApply", () => {
+    let appDir;
+    beforeEach(async () => {
+        const root = await fs.mkdtemp(path.join(os.tmpdir(), "daycare-app-rules-"));
+        appDir = path.join(root, "github-reviewer");
+        await fs.mkdir(appDir, { recursive: true });
+        await fs.writeFile(path.join(appDir, "APP.md"), [
+            "---",
+            "name: github-reviewer",
+            "title: GitHub Reviewer",
+            "description: Reviews pull requests",
+            "---",
+            "",
+            "## System Prompt",
+            "",
+            "You are a focused PR review assistant."
+        ].join("\n"));
+        await fs.writeFile(path.join(appDir, "PERMISSIONS.md"), [
+            "## Source Intent",
+            "",
+            "Review pull requests safely.",
+            "",
+            "## Rules",
+            "",
+            "### Allow",
+            "- Read files",
+            "",
+            "### Deny",
+            "- Delete files"
+        ].join("\n"));
+    });
+    afterEach(async () => {
+        await fs.rm(path.dirname(appDir), { recursive: true, force: true });
+    });
+    it("adds deny rules", async () => {
+        const result = await appRuleApply({
+            appDir,
+            action: "add_deny",
+            rule: "Access secrets"
+        });
+        expect(result.changed).toBe(true);
+        const permissions = await permissionsRead(appDir);
+        expect(permissions.rules.deny.map((rule) => rule.text)).toContain("Access secrets");
+    });
+    it("adds allow rules", async () => {
+        const result = await appRuleApply({
+            appDir,
+            action: "add_allow",
+            rule: "Access network"
+        });
+        expect(result.changed).toBe(true);
+        const permissions = await permissionsRead(appDir);
+        expect(permissions.rules.allow.map((rule) => rule.text)).toContain("Access network");
+    });
+    it("removes deny rules", async () => {
+        const result = await appRuleApply({
+            appDir,
+            action: "remove_deny",
+            rule: "Delete files"
+        });
+        expect(result.changed).toBe(true);
+        const permissions = await permissionsRead(appDir);
+        expect(permissions.rules.deny.map((rule) => rule.text)).not.toContain("Delete files");
+    });
+    it("removes allow rules", async () => {
+        const result = await appRuleApply({
+            appDir,
+            action: "remove_allow",
+            rule: "Read files"
+        });
+        expect(result.changed).toBe(true);
+        const permissions = await permissionsRead(appDir);
+        expect(permissions.rules.allow.map((rule) => rule.text)).not.toContain("Read files");
+    });
+});
+async function permissionsRead(appDir) {
+    const raw = await fs.readFile(path.join(appDir, "PERMISSIONS.md"), "utf8");
+    return appPermissionsValidate(appPermissionsParse(raw));
+}
+//# sourceMappingURL=appRuleApply.spec.js.map

package/dist/engine/apps/appRuleApply.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appRuleApply.spec.js","sourceRoot":"","sources":["../../../sources/engine/apps/appRuleApply.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAErE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,IAAI,MAAc,CAAC;IAEnB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;QAC5E,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAC5C,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,EAC3B;YACE,KAAK;YACL,uBAAuB;YACvB,wBAAwB;YACxB,oCAAoC;YACpC,KAAK;YACL,EAAE;YACF,kBAAkB;YAClB,EAAE;YACF,wCAAwC;SACzC,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,EACnC;YACE,kBAAkB;YAClB,EAAE;YACF,8BAA8B;YAC9B,EAAE;YACF,UAAU;YACV,EAAE;YACF,WAAW;YACX,cAAc;YACd,EAAE;YACF,UAAU;YACV,gBAAgB;SACjB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iBAAiB,EAAE,KAAK,IAAI,EAAE;QAC/B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,MAAM;YACN,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,gBAAgB;SACvB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAElC,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kBAAkB,EAAE,KAAK,IAAI,EAAE;QAChC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,MAAM;YACN,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,gBAAgB;SACvB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAElC,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;QAClC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,MAAM;YACN,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,cAAc;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAElC,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;QACnC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,MAAM;YACN,MAAM,EAAE,cAAc;YACtB,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAElC,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,eAAe,CAAC,MAAc;IAC3C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3E,OAAO,sBAAsB,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,CAAC"}

package/dist/engine/apps/appRuleToolBuild.d.ts

@@ -0,0 +1,8 @@
+import type { ToolDefinition } from "@/types";
+import type { Apps } from "./appManager.js";
+/**
+ * Builds the app_rules tool for mutable app allow/deny policies.
+ * Expects: target app id exists in the app manager index.
+ */
+export declare function appRuleToolBuild(apps: Apps): ToolDefinition;
+//# sourceMappingURL=appRuleToolBuild.d.ts.map

package/dist/engine/apps/appRuleToolBuild.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appRuleToolBuild.d.ts","sourceRoot":"","sources":["../../../sources/engine/apps/appRuleToolBuild.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAsB,MAAM,SAAS,CAAC;AAClE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAqC5C;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,IAAI,GAAG,cAAc,CAwF3D"}

package/dist/engine/apps/appRuleToolBuild.js

@@ -0,0 +1,129 @@
+import { toolMessageTextExtract } from "../modules/tools/toolReturnOutcome.js";
+import { Type } from "@sinclair/typebox";
+import path from "node:path";
+import { appRuleApply } from "./appRuleApply.js";
+const schema = Type.Object({
+    app_id: Type.String({ minLength: 1 }),
+    action: Type.Union([
+        Type.Literal("add_deny"),
+        Type.Literal("add_allow"),
+        Type.Literal("remove_deny"),
+        Type.Literal("remove_allow")
+    ]),
+    rule: Type.String({ minLength: 1 })
+}, { additionalProperties: false });
+const appRuleResultSchema = Type.Object({
+    summary: Type.String(),
+    appId: Type.String(),
+    action: Type.String(),
+    changed: Type.Boolean(),
+    approved: Type.Boolean()
+}, { additionalProperties: false });
+const appRuleReturns = {
+    schema: appRuleResultSchema,
+    toLLMText: (result) => result.summary
+};
+/**
+ * Builds the app_rules tool for mutable app allow/deny policies.
+ * Expects: target app id exists in the app manager index.
+ */
+export function appRuleToolBuild(apps) {
+    return {
+        tool: {
+            name: "app_rules",
+            description: "Manage app allow/deny rules. All mutations require permission approval.",
+            parameters: schema
+        },
+        returns: appRuleReturns,
+        execute: async (args, context, toolCall) => {
+            const payload = args;
+            const appId = payload.app_id.trim();
+            if (!appId) {
+                throw new Error("app_id is required.");
+            }
+            let descriptor = apps.get(appId);
+            if (!descriptor) {
+                await apps.discover();
+                descriptor = apps.get(appId);
+            }
+            if (!descriptor) {
+                throw new Error(`Unknown app: ${appId}`);
+            }
+            const permissionsPath = path.join(path.resolve(descriptor.path), "PERMISSIONS.md");
+            const permissionResult = await context.agentSystem.toolResolver.execute({
+                id: `${toolCall.id}:permission`,
+                name: "request_permission",
+                type: "toolCall",
+                arguments: {
+                    permissions: [`@write:${permissionsPath}`],
+                    reason: appRulePermissionReasonBuild(payload.action, payload.rule)
+                }
+            }, context);
+            const approved = permissionApprovedRead(permissionResult.toolMessage.details);
+            if (permissionResult.toolMessage.isError || !approved) {
+                return {
+                    toolMessage: permissionResult.toolMessage,
+                    typedResult: {
+                        summary: toolMessageTextExtract(permissionResult.toolMessage),
+                        appId,
+                        action: payload.action,
+                        changed: false,
+                        approved: false
+                    }
+                };
+            }
+            const result = await appRuleApply({
+                appDir: descriptor.path,
+                action: payload.action,
+                rule: payload.rule,
+                addedBy: context.agent.id
+            });
+            if (result.changed) {
+                await apps.discover();
+                apps.registerTools(context.agentSystem.toolResolver);
+            }
+            const toolMessage = {
+                role: "toolResult",
+                toolCallId: toolCall.id,
+                toolName: toolCall.name,
+                content: [{ type: "text", text: result.message }],
+                details: {
+                    appId,
+                    action: payload.action,
+                    changed: result.changed
+                },
+                isError: false,
+                timestamp: Date.now()
+            };
+            return {
+                toolMessage,
+                typedResult: {
+                    summary: result.message,
+                    appId,
+                    action: payload.action,
+                    changed: result.changed,
+                    approved: true
+                }
+            };
+        }
+    };
+}
+function appRulePermissionReasonBuild(action, rule) {
+    const normalizedRule = rule.trim();
+    const actionLabel = action === "add_allow"
+        ? "add allow rule"
+        : action === "add_deny"
+            ? "add deny rule"
+            : action === "remove_allow"
+                ? "remove allow rule"
+                : "remove deny rule";
+    return `Confirm app policy change (${actionLabel}): ${normalizedRule}`;
+}
+function permissionApprovedRead(details) {
+    if (typeof details !== "object" || details === null) {
+        return false;
+    }
+    const approved = details.approved;
+    return approved === true;
+}
+//# sourceMappingURL=appRuleToolBuild.js.map

package/dist/engine/apps/appRuleToolBuild.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appRuleToolBuild.js","sourceRoot":"","sources":["../../../sources/engine/apps/appRuleToolBuild.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAe,MAAM,mBAAmB,CAAC;AACtD,OAAO,IAAI,MAAM,WAAW,CAAC;AAI7B,OAAO,EAAE,YAAY,EAAsB,MAAM,mBAAmB,CAAC;AAErE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CACxB;IACE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACrC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC;QACjB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;KAC7B,CAAC;IACF,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;CACpC,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC,CAAC;AAIF,MAAM,mBAAmB,GAAG,IAAI,CAAC,MAAM,CACrC;IACE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE;IACtB,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;IACpB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;IACvB,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE;CACzB,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC,CAAC;AAIF,MAAM,cAAc,GAAsC;IACxD,MAAM,EAAE,mBAAmB;IAC3B,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO;CACtC,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAU;IACzC,OAAO;QACL,IAAI,EAAE;YACJ,IAAI,EAAE,WAAW;YACjB,WAAW,EAAE,yEAAyE;YACtF,UAAU,EAAE,MAAM;SACnB;QACD,OAAO,EAAE,cAAc;QACvB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;YACzC,MAAM,OAAO,GAAG,IAAmB,CAAC;YACpC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACzC,CAAC;YAED,IAAI,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACtB,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;YACD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC;YAC3C,CAAC;YAED,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC,CAAC;YACnF,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,OAAO,CACrE;gBACE,EAAE,EAAE,GAAG,QAAQ,CAAC,EAAE,aAAa;gBAC/B,IAAI,EAAE,oBAAoB;gBAC1B,IAAI,EAAE,UAAU;gBAChB,SAAS,EAAE;oBACT,WAAW,EAAE,CAAC,UAAU,eAAe,EAAE,CAAC;oBAC1C,MAAM,EAAE,4BAA4B,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC;iBACnE;aACF,EACD,OAAO,CACR,CAAC;YACF,MAAM,QAAQ,GAAG,sBAAsB,CAAC,gBAAgB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAC9E,IAAI,gBAAgB,CAAC,WAAW,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACtD,OAAO;oBACL,WAAW,EAAE,gBAAgB,CAAC,WAAW;oBACzC,WAAW,EAAE;wBACX,OAAO,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,WAAW,CAAC;wBAC7D,KAAK;wBACL,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,OAAO,EAAE,KAAK;wBACd,QAAQ,EAAE,KAAK;qBAChB;iBACF,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;gBAChC,MAAM,EAAE,UAAU,CAAC,IAAI;gBACvB,MAAM,EAAE,OAAO,CAAC,MAAuB;gBACvC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE;aAC1B,CAAC,CAAC;YAEH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACtB,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;YACvD,CAAC;YAED,MAAM,WAAW,GAAsB;gBACrC,IAAI,EAAE,YAAY;gBAClB,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjD,OAAO,EAAE;oBACP,KAAK;oBACL,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,OAAO,EAAE,MAAM,CAAC,OAAO;iBACxB;gBACD,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC;YACF,OAAO;gBACL,WAAW;gBACX,WAAW,EAAE;oBACX,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,KAAK;oBACL,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,QAAQ,EAAE,IAAI;iBACf;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,MAAqB,EAAE,IAAY;IACvE,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,WAAW,GACf,MAAM,KAAK,WAAW;QACpB,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,MAAM,KAAK,UAAU;YACrB,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,MAAM,KAAK,cAAc;gBACzB,CAAC,CAAC,mBAAmB;gBACrB,CAAC,CAAC,kBAAkB,CAAC;IAC7B,OAAO,8BAA8B,WAAW,MAAM,cAAc,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAgB;IAC9C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAI,OAAkC,CAAC,QAAQ,CAAC;IAC9D,OAAO,QAAQ,KAAK,IAAI,CAAC;AAC3B,CAAC"}

package/dist/engine/apps/appRuleToolBuild.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=appRuleToolBuild.spec.d.ts.map

package/dist/engine/apps/appRuleToolBuild.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appRuleToolBuild.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/apps/appRuleToolBuild.spec.ts"],"names":[],"mappings":""}

package/dist/engine/apps/appRuleToolBuild.spec.js

@@ -0,0 +1,137 @@
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { ToolResolver } from "../modules/toolResolver.js";
+import { Apps } from "./appManager.js";
+import { appPermissionsParse } from "./appPermissionsParse.js";
+import { appPermissionsValidate } from "./appPermissionsValidate.js";
+import { appRuleToolBuild } from "./appRuleToolBuild.js";
+describe("appRuleToolBuild", () => {
+    let workspaceDir;
+    beforeEach(async () => {
+        workspaceDir = await fs.mkdtemp(path.join(os.tmpdir(), "daycare-app-rules-tool-"));
+        const appDir = path.join(workspaceDir, "apps", "github-reviewer");
+        await fs.mkdir(appDir, { recursive: true });
+        await fs.writeFile(path.join(appDir, "APP.md"), [
+            "---",
+            "name: github-reviewer",
+            "title: GitHub Reviewer",
+            "description: Reviews pull requests",
+            "---",
+            "",
+            "## System Prompt",
+            "",
+            "You are a focused PR review assistant."
+        ].join("\n"));
+        await fs.writeFile(path.join(appDir, "PERMISSIONS.md"), [
+            "## Source Intent",
+            "",
+            "Review pull requests safely.",
+            "",
+            "## Rules",
+            "",
+            "### Allow",
+            "- Read files",
+            "",
+            "### Deny",
+            "- Delete files"
+        ].join("\n"));
+    });
+    afterEach(async () => {
+        await fs.rm(workspaceDir, { recursive: true, force: true });
+    });
+    it("returns the permission result when approval is denied", async () => {
+        const apps = new Apps({ workspaceDir });
+        await apps.discover();
+        const tool = appRuleToolBuild(apps);
+        const context = contextBuild(workspaceDir);
+        const executeSpy = vi
+            .spyOn(context.agentSystem.toolResolver, "execute")
+            .mockResolvedValue(permissionResultBuild({ approved: false, text: "Permission denied for write access." }));
+        const denied = await tool.execute({
+            app_id: "github-reviewer",
+            action: "add_allow",
+            rule: "Access network"
+        }, context, { id: "tool-1", name: "app_rules" });
+        expect(denied.toolMessage.isError).toBe(false);
+        expect(contentText(denied.toolMessage.content)).toContain("Permission denied");
+        expect(executeSpy).toHaveBeenCalledTimes(1);
+        expect(executeSpy.mock.calls[0]?.[0]).toMatchObject({
+            name: "request_permission",
+            arguments: expect.objectContaining({
+                permissions: [expect.stringContaining("/apps/github-reviewer/PERMISSIONS.md")]
+            })
+        });
+        const permissions = await permissionsRead(path.join(workspaceDir, "apps", "github-reviewer", "PERMISSIONS.md"));
+        expect(permissions.rules.allow.map((rule) => rule.text)).not.toContain("Access network");
+    });
+    it("applies rule changes after permission approval", async () => {
+        const apps = new Apps({ workspaceDir });
+        await apps.discover();
+        const tool = appRuleToolBuild(apps);
+        const context = contextBuild(workspaceDir);
+        const executeSpy = vi
+            .spyOn(context.agentSystem.toolResolver, "execute")
+            .mockResolvedValue(permissionResultBuild({ approved: true }));
+        const applyResult = await tool.execute({
+            app_id: "github-reviewer",
+            action: "add_deny",
+            rule: "Delete files recursively"
+        }, context, { id: "tool-2", name: "app_rules" });
+        expect(applyResult.toolMessage.isError).toBe(false);
+        expect(contentText(applyResult.toolMessage.content)).toContain("Rule added");
+        expect(executeSpy).toHaveBeenCalledTimes(1);
+        const permissions = await permissionsRead(path.join(workspaceDir, "apps", "github-reviewer", "PERMISSIONS.md"));
+        expect(permissions.rules.deny.map((rule) => rule.text)).toContain("Delete files recursively");
+    });
+});
+function contextBuild(workspaceDir) {
+    return {
+        connectorRegistry: null,
+        fileStore: null,
+        auth: null,
+        logger: console,
+        assistant: null,
+        permissions: {
+            workingDir: workspaceDir,
+            writeDirs: [workspaceDir],
+            readDirs: [workspaceDir],
+            network: false,
+            events: false
+        },
+        agent: { id: "agent-1" },
+        source: "test",
+        messageContext: {},
+        agentSystem: { toolResolver: new ToolResolver() },
+        heartbeats: null
+    };
+}
+async function permissionsRead(permissionsPath) {
+    const raw = await fs.readFile(permissionsPath, "utf8");
+    return appPermissionsValidate(appPermissionsParse(raw));
+}
+function contentText(content) {
+    if (!Array.isArray(content)) {
+        return "";
+    }
+    return content
+        .filter((entry) => typeof entry === "object" && entry !== null && entry.type === "text")
+        .map((entry) => entry.text ?? "")
+        .join("\n");
+}
+function permissionResultBuild(input) {
+    return {
+        toolMessage: {
+            role: "toolResult",
+            toolCallId: "permission-call",
+            toolName: "request_permission",
+            content: [{ type: "text", text: input.text ?? "Permission granted for write access." }],
+            details: { approved: input.approved },
+            isError: false,
+            timestamp: Date.now()
+        },
+        typedResult: { text: input.text ?? "Permission granted for write access." }
+    };
+}
+//# sourceMappingURL=appRuleToolBuild.spec.js.map