daycare-cli 0.0.0-canary.f57680e

package/dist/engine/permissions/pathResolveSecure.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathResolveSecure.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/pathResolveSecure.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEvF,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,IAAI,OAAe,CAAC;IACpB,IAAI,WAAmB,CAAC;IAExB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;QACzE,wEAAwE;QACxE,WAAW,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QAC9C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QAChD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,SAAS,CAAC,CAAC;QACzE,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,WAAW,EACX,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,CAC1C,CAAC;QACF,mEAAmE;QACnE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QAC5E,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QACpD,MAAM,MAAM,CACV,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,CAC9E,CAAC,OAAO,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,qDAAqD;QACrD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC5D,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;QAE/D,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QAEpD,oEAAoE;QACpE,MAAM,MAAM,CACV,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CACrE,CAAC,OAAO,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,wEAAwE;QACxE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;QACxD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;QAChF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;QAEvE,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,WAAW,EACX,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CACnC,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,WAAW,EACX,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,CAAC,CAC7C,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,WAAW,EACX,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,CAC/D,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC1B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,CACnE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QACpD,MAAM,MAAM,CACV,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAC3E,CAAC,OAAO,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;QACtC,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QACpD,MAAM,MAAM,CACV,iBAAiB,CAAC,WAAW,EAAE,eAAe,CAAC,CAChD,CAAC,OAAO,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzE,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChE,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,IAAI,OAAe,CAAC;IAEpB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;QACxE,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,SAAS,CAAC,CAAC;QACjE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC7C,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;QACnC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kBAAkB,EAAE,KAAK,IAAI,EAAE;QAChC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACnD,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,WAAW,CAAC,CAAC;QAEjE,MAAM,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACxD,qCAAqC,CACtC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC9C,MAAM,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACtC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAErB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,MAAM,CACV,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,GAAG,CAAC,CACpD,CAAC,OAAO,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/pathSanitize.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Validates a path for dangerous characters and patterns.
+ * Throws an error if the path is invalid.
+ *
+ * Checks for:
+ * - Null bytes (can truncate strings in C libraries)
+ * - Control characters (ASCII 0-31 except tab/newline)
+ * - Excessively long paths (DoS potential)
+ */
+export declare function pathSanitize(target: string): void;
+/**
+ * Sanitizes and resolves a path, ensuring it's absolute.
+ * Returns the resolved absolute path.
+ */
+export declare function pathSanitizeAndResolve(target: string): string;
+//# sourceMappingURL=pathSanitize.d.ts.map

package/dist/engine/permissions/pathSanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathSanitize.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/pathSanitize.ts"],"names":[],"mappings":"AAIA;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAiBjD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAM7D"}

package/dist/engine/permissions/pathSanitize.js

@@ -0,0 +1,39 @@
+import path from "node:path";
+const MAX_PATH_LENGTH = 4096;
+/**
+ * Validates a path for dangerous characters and patterns.
+ * Throws an error if the path is invalid.
+ *
+ * Checks for:
+ * - Null bytes (can truncate strings in C libraries)
+ * - Control characters (ASCII 0-31 except tab/newline)
+ * - Excessively long paths (DoS potential)
+ */
+export function pathSanitize(target) {
+    if (target.length > MAX_PATH_LENGTH) {
+        throw new Error(`Path exceeds maximum length of ${MAX_PATH_LENGTH} characters.`);
+    }
+    // Check for null bytes
+    if (target.includes("\x00")) {
+        throw new Error("Path contains null byte.");
+    }
+    // Check for control characters (ASCII 0-31, except 9=tab and 10=newline)
+    for (let i = 0; i < target.length; i++) {
+        const code = target.charCodeAt(i);
+        if (code < 32 && code !== 9 && code !== 10) {
+            throw new Error("Path contains invalid control character.");
+        }
+    }
+}
+/**
+ * Sanitizes and resolves a path, ensuring it's absolute.
+ * Returns the resolved absolute path.
+ */
+export function pathSanitizeAndResolve(target) {
+    pathSanitize(target);
+    if (!path.isAbsolute(target)) {
+        throw new Error("Path must be absolute.");
+    }
+    return path.resolve(target);
+}
+//# sourceMappingURL=pathSanitize.js.map

package/dist/engine/permissions/pathSanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathSanitize.js","sourceRoot":"","sources":["../../../sources/engine/permissions/pathSanitize.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,IAAI,MAAM,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,kCAAkC,eAAe,cAAc,CAAC,CAAC;IACnF,CAAC;IAED,uBAAuB;IACvB,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,yEAAyE;IACzE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,IAAI,GAAG,EAAE,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,YAAY,CAAC,MAAM,CAAC,CAAC;IACrB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC"}

package/dist/engine/permissions/pathSanitize.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=pathSanitize.spec.d.ts.map

package/dist/engine/permissions/pathSanitize.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathSanitize.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/pathSanitize.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/pathSanitize.spec.js

@@ -0,0 +1,43 @@
+import { describe, it, expect } from "vitest";
+import { pathSanitize, pathSanitizeAndResolve } from "./pathSanitize.js";
+describe("pathSanitize", () => {
+    it("accepts valid paths", () => {
+        expect(() => pathSanitize("/home/user/file.txt")).not.toThrow();
+        expect(() => pathSanitize("/path/with spaces/file.txt")).not.toThrow();
+        expect(() => pathSanitize("/unicode/日本語/文件.txt")).not.toThrow();
+    });
+    it("rejects paths with null bytes", () => {
+        expect(() => pathSanitize("/home/user\x00/malicious")).toThrow("Path contains null byte.");
+        expect(() => pathSanitize("/etc/passwd\x00.txt")).toThrow("Path contains null byte.");
+    });
+    it("rejects paths with control characters", () => {
+        expect(() => pathSanitize("/home/user\x01file")).toThrow("Path contains invalid control character.");
+        expect(() => pathSanitize("/home/user\x1Ffile")).toThrow("Path contains invalid control character.");
+    });
+    it("allows tabs and newlines", () => {
+        // Tabs and newlines are uncommon but not dangerous in the same way
+        expect(() => pathSanitize("/home/user\tfile")).not.toThrow();
+        expect(() => pathSanitize("/home/user\nfile")).not.toThrow();
+    });
+    it("rejects excessively long paths", () => {
+        const longPath = "/" + "a".repeat(5000);
+        expect(() => pathSanitize(longPath)).toThrow("Path exceeds maximum length of 4096 characters.");
+    });
+    it("accepts paths at the limit", () => {
+        const maxPath = "/" + "a".repeat(4095);
+        expect(() => pathSanitize(maxPath)).not.toThrow();
+    });
+});
+describe("pathSanitizeAndResolve", () => {
+    it("sanitizes and resolves valid absolute paths", () => {
+        const result = pathSanitizeAndResolve("/home/user/../user/file.txt");
+        expect(result).toBe("/home/user/file.txt");
+    });
+    it("rejects relative paths", () => {
+        expect(() => pathSanitizeAndResolve("relative/path")).toThrow("Path must be absolute.");
+    });
+    it("rejects paths with null bytes before checking absolute", () => {
+        expect(() => pathSanitizeAndResolve("/etc/passwd\x00")).toThrow("Path contains null byte.");
+    });
+});
+//# sourceMappingURL=pathSanitize.spec.js.map

package/dist/engine/permissions/pathSanitize.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathSanitize.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/pathSanitize.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAEzE,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAChE,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACvE,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,0BAA0B,CAAC,CAAC,CAAC,OAAO,CAC5D,0BAA0B,CAC3B,CAAC;QACF,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CACvD,0BAA0B,CAC3B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CACtD,0CAA0C,CAC3C,CAAC;QACF,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CACtD,0CAA0C,CAC3C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,mEAAmE;QACnE,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC7D,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,QAAQ,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAC1C,iDAAiD,CAClD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,OAAO,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,MAAM,GAAG,sBAAsB,CAAC,6BAA6B,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAC3D,wBAAwB,CACzB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAC7D,0BAA0B,CAC3B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionAccessAllows.d.ts

@@ -0,0 +1,7 @@
+import type { PermissionAccess, SessionPermissions } from "@/types";
+/**
+ * Checks whether a permission access is already allowed by current permissions.
+ * Expects: access.kind is network/events/workspace/read/write; paths must be absolute for read/write.
+ */
+export declare function permissionAccessAllows(permissions: SessionPermissions, access: PermissionAccess): Promise<boolean>;
+//# sourceMappingURL=permissionAccessAllows.d.ts.map

package/dist/engine/permissions/permissionAccessAllows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionAccessAllows.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessAllows.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAKpE;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,kBAAkB,EAC/B,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC,OAAO,CAAC,CAgDlB"}

package/dist/engine/permissions/permissionAccessAllows.js

@@ -0,0 +1,72 @@
+import path from "node:path";
+import { pathResolveSecure } from "./pathResolveSecure.js";
+import { pathSanitizeAndResolve } from "./pathSanitize.js";
+import { permissionWorkspacePathResolve } from "./permissionWorkspacePathResolve.js";
+/**
+ * Checks whether a permission access is already allowed by current permissions.
+ * Expects: access.kind is network/events/workspace/read/write; paths must be absolute for read/write.
+ */
+export async function permissionAccessAllows(permissions, access) {
+    if (access.kind === "network") {
+        return permissions.network;
+    }
+    if (access.kind === "events") {
+        return permissions.events;
+    }
+    if (access.kind === "workspace") {
+        const workspacePath = permissionWorkspacePathResolve(permissions);
+        try {
+            await pathResolveSecure(permissions.writeDirs, workspacePath);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    if (!path.isAbsolute(access.path)) {
+        return false;
+    }
+    let resolved;
+    try {
+        resolved = pathSanitizeAndResolve(access.path);
+    }
+    catch {
+        return false;
+    }
+    if (access.kind === "write" &&
+        permissionIsProtectedAppPolicyPath(resolved) &&
+        !permissionHasExplicitFileWriteGrant(permissions, resolved)) {
+        return false;
+    }
+    const allowedDirs = access.kind === "write"
+        ? [...permissions.writeDirs]
+        : permissions.readDirs.length > 0
+            ? [permissions.workingDir, ...permissions.readDirs, ...permissions.writeDirs]
+            : [path.parse(resolved).root];
+    try {
+        await pathResolveSecure(allowedDirs, resolved);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function permissionIsProtectedAppPolicyPath(target) {
+    const baseName = path.basename(target);
+    if (baseName !== "APP.md" && baseName !== "PERMISSIONS.md") {
+        return false;
+    }
+    const appDir = path.dirname(target);
+    const appsDir = path.dirname(appDir);
+    return path.basename(appsDir) === "apps";
+}
+function permissionHasExplicitFileWriteGrant(permissions, target) {
+    const resolvedTarget = path.resolve(target);
+    for (const entry of permissions.writeDirs) {
+        if (path.resolve(entry) === resolvedTarget) {
+            return true;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=permissionAccessAllows.js.map

package/dist/engine/permissions/permissionAccessAllows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionAccessAllows.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessAllows.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AAErF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,WAA+B,EAC/B,MAAwB;IAExB,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,WAAW,CAAC,OAAO,CAAC;IAC7B,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,WAAW,CAAC,MAAM,CAAC;IAC5B,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,MAAM,aAAa,GAAG,8BAA8B,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,iBAAiB,CAAC,WAAW,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IACE,MAAM,CAAC,IAAI,KAAK,OAAO;QACvB,kCAAkC,CAAC,QAAQ,CAAC;QAC5C,CAAC,mCAAmC,CAAC,WAAW,EAAE,QAAQ,CAAC,EAC3D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,KAAK,OAAO;QACzC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,SAAS,CAAC;QAC5B,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC/B,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,EAAE,GAAG,WAAW,CAAC,QAAQ,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC;YAC7E,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC;IAElC,IAAI,CAAC;QACH,MAAM,iBAAiB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,kCAAkC,CAAC,MAAc;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC;AAC3C,CAAC;AAED,SAAS,mCAAmC,CAC1C,WAA+B,EAC/B,MAAc;IAEd,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;QAC1C,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,cAAc,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/engine/permissions/permissionAccessAllows.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permissionAccessAllows.spec.d.ts.map

package/dist/engine/permissions/permissionAccessAllows.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionAccessAllows.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessAllows.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionAccessAllows.spec.js

@@ -0,0 +1,111 @@
+import { describe, it, expect, afterEach } from "vitest";
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { permissionAccessAllows } from "./permissionAccessAllows.js";
+describe("permissionAccessAllows", () => {
+    const tempDirs = [];
+    afterEach(async () => {
+        await Promise.all(tempDirs.map((dir) => fs.rm(dir, { recursive: true, force: true })));
+        tempDirs.length = 0;
+    });
+    it("allows network access when enabled", async () => {
+        const allowed = await permissionAccessAllows({ workingDir: "/tmp", writeDirs: [], readDirs: [], network: true, events: false }, { kind: "network" });
+        expect(allowed).toBe(true);
+    });
+    it("allows events access when enabled", async () => {
+        const allowed = await permissionAccessAllows({ workingDir: "/tmp", writeDirs: [], readDirs: [], network: false, events: true }, { kind: "events" });
+        expect(allowed).toBe(true);
+    });
+    it("allows workspace access when workspace dir is writable", async () => {
+        const workspace = await fs.mkdtemp(path.join(os.tmpdir(), "perm-workspace-access-"));
+        tempDirs.push(workspace);
+        const allowed = await permissionAccessAllows({
+            workspaceDir: workspace,
+            workingDir: workspace,
+            writeDirs: [workspace],
+            readDirs: [workspace],
+            network: false,
+            events: false
+        }, { kind: "workspace" });
+        expect(allowed).toBe(true);
+    });
+    it("denies workspace access for app sandbox by default", async () => {
+        const workspace = await fs.mkdtemp(path.join(os.tmpdir(), "perm-workspace-app-"));
+        tempDirs.push(workspace);
+        const appDataDir = path.join(workspace, "apps", "my-app", "data");
+        await fs.mkdir(appDataDir, { recursive: true });
+        const allowed = await permissionAccessAllows({
+            workspaceDir: workspace,
+            workingDir: appDataDir,
+            writeDirs: [appDataDir],
+            readDirs: [workspace],
+            network: false,
+            events: false
+        }, { kind: "workspace" });
+        expect(allowed).toBe(false);
+    });
+    it("allows read access within allowed directories", async () => {
+        const dir = await fs.mkdtemp(path.join(os.tmpdir(), "perm-allow-"));
+        tempDirs.push(dir);
+        const target = path.join(dir, "file.txt");
+        await fs.writeFile(target, "ok", "utf8");
+        const allowed = await permissionAccessAllows({ workingDir: dir, writeDirs: [], readDirs: [dir], network: false, events: false }, { kind: "read", path: target });
+        expect(allowed).toBe(true);
+    });
+    it("treats empty readDirs as unrestricted read access", async () => {
+        const workspaceDir = await fs.mkdtemp(path.join(os.tmpdir(), "perm-workspace-"));
+        const outsideDir = await fs.mkdtemp(path.join(os.tmpdir(), "perm-outside-"));
+        tempDirs.push(workspaceDir, outsideDir);
+        const outsideFile = path.join(outsideDir, "outside.txt");
+        await fs.writeFile(outsideFile, "ok", "utf8");
+        const allowed = await permissionAccessAllows({ workingDir: workspaceDir, writeDirs: [], readDirs: [], network: false, events: false }, { kind: "read", path: outsideFile });
+        expect(allowed).toBe(true);
+    });
+    it("denies write access outside allowed directories", async () => {
+        const dir = await fs.mkdtemp(path.join(os.tmpdir(), "perm-deny-"));
+        tempDirs.push(dir);
+        const target = path.join(dir, "elsewhere", "file.txt");
+        const allowed = await permissionAccessAllows({ workingDir: "/tmp", writeDirs: ["/tmp"], readDirs: [], network: false, events: false }, { kind: "write", path: target });
+        expect(allowed).toBe(false);
+    });
+    it("does not imply write access from workingDir", async () => {
+        const dir = await fs.mkdtemp(path.join(os.tmpdir(), "perm-working-dir-"));
+        tempDirs.push(dir);
+        const target = path.join(dir, "file.txt");
+        const allowed = await permissionAccessAllows({ workingDir: dir, writeDirs: [], readDirs: [], network: false, events: false }, { kind: "write", path: target });
+        expect(allowed).toBe(false);
+    });
+    it("allows write access when path is explicitly in writeDirs", async () => {
+        const dir = await fs.mkdtemp(path.join(os.tmpdir(), "perm-write-dir-"));
+        tempDirs.push(dir);
+        const target = path.join(dir, "file.txt");
+        const allowed = await permissionAccessAllows({ workingDir: "/tmp", writeDirs: [dir], readDirs: [], network: false, events: false }, { kind: "write", path: target });
+        expect(allowed).toBe(true);
+    });
+    it("denies writing app policy files from broad directory grants", async () => {
+        const workspace = await fs.mkdtemp(path.join(os.tmpdir(), "perm-app-policy-"));
+        tempDirs.push(workspace);
+        const appDir = path.join(workspace, "apps", "my-app");
+        await fs.mkdir(appDir, { recursive: true });
+        const target = path.join(appDir, "PERMISSIONS.md");
+        const allowed = await permissionAccessAllows({ workingDir: workspace, writeDirs: [workspace], readDirs: [], network: false, events: false }, { kind: "write", path: target });
+        expect(allowed).toBe(false);
+    });
+    it("allows writing app policy files only with explicit file grant", async () => {
+        const workspace = await fs.mkdtemp(path.join(os.tmpdir(), "perm-app-policy-explicit-"));
+        tempDirs.push(workspace);
+        const appDir = path.join(workspace, "apps", "my-app");
+        await fs.mkdir(appDir, { recursive: true });
+        const target = path.join(appDir, "APP.md");
+        const allowed = await permissionAccessAllows({
+            workingDir: workspace,
+            writeDirs: [workspace, target],
+            readDirs: [],
+            network: false,
+            events: false
+        }, { kind: "write", path: target });
+        expect(allowed).toBe(true);
+    });
+});
+//# sourceMappingURL=permissionAccessAllows.spec.js.map

package/dist/engine/permissions/permissionAccessAllows.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionAccessAllows.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessAllows.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACvF,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EACjF,EAAE,IAAI,EAAE,SAAS,EAAE,CACpB,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EACjF,EAAE,IAAI,EAAE,QAAQ,EAAE,CACnB,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;QACrF,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C;YACE,YAAY,EAAE,SAAS;YACvB,UAAU,EAAE,SAAS;YACrB,SAAS,EAAE,CAAC,SAAS,CAAC;YACtB,QAAQ,EAAE,CAAC,SAAS,CAAC;YACrB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,EACD,EAAE,IAAI,EAAE,WAAW,EAAE,CACtB,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAClF,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClE,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C;YACE,YAAY,EAAE,SAAS;YACvB,UAAU,EAAE,UAAU;YACtB,SAAS,EAAE,CAAC,UAAU,CAAC;YACvB,QAAQ,EAAE,CAAC,SAAS,CAAC;YACrB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,EACD,EAAE,IAAI,EAAE,WAAW,EAAE,CACtB,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;QACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC1C,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAClF,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAC/B,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;QACjF,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;QAC7E,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QACzD,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAE9C,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EACxF,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,CACpC,CAAC;QAEF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;QACnE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EACxF,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAChC,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAC1E,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAC/E,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAChC,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;QACxE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EACrF,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAChC,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;QAC/E,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtD,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAEnD,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAC9F,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAChC,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAC,CAAC;QACxF,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtD,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAE3C,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C;YACE,UAAU,EAAE,SAAS;YACrB,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;YAC9B,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,EACD,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAChC,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionAccessApply.d.ts

@@ -0,0 +1,7 @@
+import type { PermissionAccess, SessionPermissions } from "@/types";
+/**
+ * Applies a permission access to a permissions object in place.
+ * Returns true when applied; false when invalid or unsupported.
+ */
+export declare function permissionAccessApply(permissions: SessionPermissions, access: PermissionAccess): boolean;
+//# sourceMappingURL=permissionAccessApply.d.ts.map

package/dist/engine/permissions/permissionAccessApply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionAccessApply.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessApply.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAIpE;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,kBAAkB,EAC/B,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAoDT"}

package/dist/engine/permissions/permissionAccessApply.js

@@ -0,0 +1,55 @@
+import path from "node:path";
+import { pathSanitizeAndResolve } from "./pathSanitize.js";
+import { permissionWorkspacePathResolve } from "./permissionWorkspacePathResolve.js";
+/**
+ * Applies a permission access to a permissions object in place.
+ * Returns true when applied; false when invalid or unsupported.
+ */
+export function permissionAccessApply(permissions, access) {
+    if (access.kind === "network") {
+        permissions.network = true;
+        return true;
+    }
+    if (access.kind === "events") {
+        permissions.events = true;
+        return true;
+    }
+    if (access.kind === "workspace") {
+        const resolvedWorkspace = permissionWorkspacePathResolve(permissions);
+        const writeDirs = new Set(permissions.writeDirs);
+        writeDirs.add(resolvedWorkspace);
+        permissions.writeDirs = Array.from(writeDirs.values());
+        const readDirs = new Set(permissions.readDirs);
+        readDirs.add(resolvedWorkspace);
+        permissions.readDirs = Array.from(readDirs.values());
+        return true;
+    }
+    if (!path.isAbsolute(access.path)) {
+        return false;
+    }
+    let resolved;
+    try {
+        resolved = pathSanitizeAndResolve(access.path);
+    }
+    catch {
+        return false;
+    }
+    if (access.kind === "write") {
+        const writeDirs = new Set(permissions.writeDirs);
+        writeDirs.add(resolved);
+        permissions.writeDirs = Array.from(writeDirs.values());
+        // Write access requires read access to the same path.
+        const readDirs = new Set(permissions.readDirs);
+        readDirs.add(resolved);
+        permissions.readDirs = Array.from(readDirs.values());
+        return true;
+    }
+    if (access.kind === "read") {
+        const next = new Set(permissions.readDirs);
+        next.add(resolved);
+        permissions.readDirs = Array.from(next.values());
+        return true;
+    }
+    return false;
+}
+//# sourceMappingURL=permissionAccessApply.js.map

package/dist/engine/permissions/permissionAccessApply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionAccessApply.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessApply.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AAErF;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,WAA+B,EAC/B,MAAwB;IAExB,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,WAAW,CAAC,OAAO,GAAG,IAAI,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,WAAW,CAAC,MAAM,GAAG,IAAI,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,MAAM,iBAAiB,GAAG,8BAA8B,CAAC,WAAW,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACjD,SAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACjC,WAAW,CAAC,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QAEvD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC/C,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAChC,WAAW,CAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACjD,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxB,WAAW,CAAC,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QAEvD,sDAAsD;QACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC/C,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvB,WAAW,CAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnB,WAAW,CAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/engine/permissions/permissionAccessApply.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permissionAccessApply.spec.d.ts.map

package/dist/engine/permissions/permissionAccessApply.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionAccessApply.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessApply.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionAccessApply.spec.js

@@ -0,0 +1,56 @@
+import { describe, it, expect } from "vitest";
+import path from "node:path";
+import { permissionAccessApply } from "./permissionAccessApply.js";
+describe("permissionAccessApply", () => {
+    const basePermissions = () => ({
+        workspaceDir: "/workspace",
+        workingDir: "/tmp",
+        writeDirs: [],
+        readDirs: [],
+        network: false,
+        events: false
+    });
+    it("applies network access", () => {
+        const permissions = basePermissions();
+        const applied = permissionAccessApply(permissions, { kind: "network" });
+        expect(applied).toBe(true);
+        expect(permissions.network).toBe(true);
+    });
+    it("applies events access", () => {
+        const permissions = basePermissions();
+        const applied = permissionAccessApply(permissions, { kind: "events" });
+        expect(applied).toBe(true);
+        expect(permissions.events).toBe(true);
+    });
+    it("applies workspace access to the shared workspace root", () => {
+        const permissions = {
+            workspaceDir: "/workspace",
+            workingDir: "/workspace/apps/my-app/data",
+            writeDirs: ["/workspace/apps/my-app/data"],
+            readDirs: ["/workspace"],
+            network: false,
+            events: false
+        };
+        const applied = permissionAccessApply(permissions, { kind: "workspace" });
+        expect(applied).toBe(true);
+        expect(permissions.writeDirs).toContain("/workspace");
+        expect(permissions.readDirs).toContain("/workspace");
+    });
+    it("applies read/write paths", () => {
+        const permissions = basePermissions();
+        const readPath = path.resolve("/tmp/read");
+        const writePath = path.resolve("/tmp/write");
+        expect(permissionAccessApply(permissions, { kind: "read", path: readPath })).toBe(true);
+        expect(permissionAccessApply(permissions, { kind: "write", path: writePath })).toBe(true);
+        expect(permissions.readDirs).toContain(readPath);
+        expect(permissions.readDirs).toContain(writePath);
+        expect(permissions.writeDirs).toContain(writePath);
+    });
+    it("rejects non-absolute paths", () => {
+        const permissions = basePermissions();
+        const applied = permissionAccessApply(permissions, { kind: "read", path: "relative" });
+        expect(applied).toBe(false);
+        expect(permissions.readDirs).toHaveLength(0);
+    });
+});
+//# sourceMappingURL=permissionAccessApply.spec.js.map

package/dist/engine/permissions/permissionAccessApply.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionAccessApply.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessApply.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,CAAC;QAC7B,YAAY,EAAE,YAAY;QAC1B,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,EAAc;QACzB,QAAQ,EAAE,EAAc;QACxB,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,qBAAqB,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,qBAAqB,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvE,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,WAAW,GAAG;YAClB,YAAY,EAAE,YAAY;YAC1B,UAAU,EAAE,6BAA6B;YACzC,SAAS,EAAE,CAAC,6BAA6B,CAAC;YAC1C,QAAQ,EAAE,CAAC,YAAY,CAAC;YACxB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC;QACF,MAAM,OAAO,GAAG,qBAAqB,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACtD,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,CAAC,qBAAqB,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxF,MAAM,CAAC,qBAAqB,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1F,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,qBAAqB,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACvF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionAccessParse.d.ts

@@ -0,0 +1,7 @@
+import type { PermissionAccess } from "@/types";
+/**
+ * Parses a permission tag string into a PermissionAccess union.
+ * Expects: value is @network, @events, @workspace, @read:<path>, or @write:<path>.
+ */
+export declare function permissionAccessParse(value: string): PermissionAccess;
+//# sourceMappingURL=permissionAccessParse.d.ts.map

package/dist/engine/permissions/permissionAccessParse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionAccessParse.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessParse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAEhD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,CA4BrE"}

package/dist/engine/permissions/permissionAccessParse.js

@@ -0,0 +1,32 @@
+/**
+ * Parses a permission tag string into a PermissionAccess union.
+ * Expects: value is @network, @events, @workspace, @read:<path>, or @write:<path>.
+ */
+export function permissionAccessParse(value) {
+    const trimmed = value.trim();
+    if (trimmed === "@network") {
+        return { kind: "network" };
+    }
+    if (trimmed === "@events") {
+        return { kind: "events" };
+    }
+    if (trimmed === "@workspace") {
+        return { kind: "workspace" };
+    }
+    if (trimmed.startsWith("@read:")) {
+        const pathValue = trimmed.slice("@read:".length).trim();
+        if (!pathValue) {
+            throw new Error("Read permission requires a path.");
+        }
+        return { kind: "read", path: pathValue };
+    }
+    if (trimmed.startsWith("@write:")) {
+        const pathValue = trimmed.slice("@write:".length).trim();
+        if (!pathValue) {
+            throw new Error("Write permission requires a path.");
+        }
+        return { kind: "write", path: pathValue };
+    }
+    throw new Error("Permission must be @network, @events, @workspace, @read:<path>, or @write:<path>.");
+}
+//# sourceMappingURL=permissionAccessParse.js.map

package/dist/engine/permissions/permissionAccessParse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionAccessParse.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessParse.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;AACJ,CAAC"}

package/dist/engine/permissions/permissionAccessParse.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permissionAccessParse.spec.d.ts.map

package/dist/engine/permissions/permissionAccessParse.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionAccessParse.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessParse.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionAccessParse.spec.js

@@ -0,0 +1,17 @@
+import { describe, it, expect } from "vitest";
+import { permissionAccessParse } from "./permissionAccessParse.js";
+describe("permissionAccessParse", () => {
+    it("parses @network, @events, and @workspace", () => {
+        expect(permissionAccessParse("@network")).toEqual({ kind: "network" });
+        expect(permissionAccessParse("@events")).toEqual({ kind: "events" });
+        expect(permissionAccessParse("@workspace")).toEqual({ kind: "workspace" });
+    });
+    it("parses @read and @write paths", () => {
+        expect(permissionAccessParse("@read:/tmp")).toEqual({ kind: "read", path: "/tmp" });
+        expect(permissionAccessParse("@write:/var/log")).toEqual({ kind: "write", path: "/var/log" });
+    });
+    it("rejects invalid tags", () => {
+        expect(() => permissionAccessParse("read:/tmp")).toThrow("Permission must be");
+    });
+});
+//# sourceMappingURL=permissionAccessParse.spec.js.map

package/dist/engine/permissions/permissionAccessParse.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionAccessParse.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessParse.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACvE,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACpF,MAAM,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionApply.d.ts

@@ -0,0 +1,4 @@
+import type { PermissionDecision } from "@/types";
+import type { SessionPermissions } from "../permissions.js";
+export declare function permissionApply(permissions: SessionPermissions, decision: PermissionDecision): void;
+//# sourceMappingURL=permissionApply.d.ts.map

package/dist/engine/permissions/permissionApply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionApply.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionApply.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAG5D,wBAAgB,eAAe,CAC7B,WAAW,EAAE,kBAAkB,EAC/B,QAAQ,EAAE,kBAAkB,GAC3B,IAAI,CAON"}

package/dist/engine/permissions/permissionApply.js

@@ -0,0 +1,10 @@
+import { permissionAccessApply } from "./permissionAccessApply.js";
+export function permissionApply(permissions, decision) {
+    if (!decision.approved) {
+        return;
+    }
+    for (const permission of decision.permissions) {
+        permissionAccessApply(permissions, permission.access);
+    }
+}
+//# sourceMappingURL=permissionApply.js.map