daycare-cli 0.0.0-canary.f57680e

package/dist/engine/scheduling/execGateNormalize.spec.js

@@ -0,0 +1,41 @@
+import { describe, it, expect } from "vitest";
+import { execGateNormalize } from "./execGateNormalize.js";
+describe("execGateNormalize", () => {
+    it("returns undefined for missing command", () => {
+        expect(execGateNormalize(null)).toBeUndefined();
+        expect(execGateNormalize({})).toBeUndefined();
+    });
+    it("normalizes gate fields", () => {
+        const result = execGateNormalize({
+            command: "  echo ok  ",
+            cwd: " /tmp ",
+            timeoutMs: 1500,
+            env: { FOO: "bar", SKIP: 3, FLAG: true },
+            home: " /tmp/sandbox-home ",
+            permissions: ["@network", "  @read:/tmp  ", "", "@network"],
+            packageManagers: [
+                "node",
+                " java ",
+                "rust",
+                "dotnet",
+                "python",
+                "ruby",
+                "php",
+                "dart",
+                "invalid"
+            ],
+            allowedDomains: ["example.com", " example.com "]
+        });
+        expect(result).toEqual({
+            command: "echo ok",
+            cwd: "/tmp",
+            timeoutMs: 1500,
+            env: { FOO: "bar", SKIP: "3", FLAG: "true" },
+            home: "/tmp/sandbox-home",
+            permissions: ["@network", "@read:/tmp"],
+            packageManagers: ["node", "java", "rust", "dotnet", "python", "ruby", "php", "dart"],
+            allowedDomains: ["example.com"]
+        });
+    });
+});
+//# sourceMappingURL=execGateNormalize.spec.js.map

package/dist/engine/scheduling/execGateNormalize.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execGateNormalize.spec.js","sourceRoot":"","sources":["../../../sources/engine/scheduling/execGateNormalize.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAChD,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,MAAM,GAAG,iBAAiB,CAAC;YAC/B,OAAO,EAAE,aAAa;YACtB,GAAG,EAAE,QAAQ;YACb,SAAS,EAAE,IAAI;YACf,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;YACxC,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EAAE,CAAC,UAAU,EAAE,gBAAgB,EAAE,EAAE,EAAE,UAAU,CAAC;YAC3D,eAAe,EAAE;gBACf,MAAM;gBACN,QAAQ;gBACR,MAAM;gBACN,QAAQ;gBACR,QAAQ;gBACR,MAAM;gBACN,KAAK;gBACL,MAAM;gBACN,SAAS;aACV;YACD,cAAc,EAAE,CAAC,aAAa,EAAE,eAAe,CAAC;SACjD,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,OAAO,EAAE,SAAS;YAClB,GAAG,EAAE,MAAM;YACX,SAAS,EAAE,IAAI;YACf,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE;YAC5C,IAAI,EAAE,mBAAmB;YACzB,WAAW,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC;YACvC,eAAe,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC;YACpF,cAAc,EAAE,CAAC,aAAa,CAAC;SAChC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/scheduling/execGateOutputAppend.d.ts

@@ -0,0 +1,7 @@
+import type { ExecGateCheckResult } from "./execGateCheck.js";
+/**
+ * Appends trimmed gate output to a prompt when available.
+ * Returns the original prompt when there is no output.
+ */
+export declare function execGateOutputAppend(prompt: string, result: ExecGateCheckResult): string;
+//# sourceMappingURL=execGateOutputAppend.d.ts.map

package/dist/engine/scheduling/execGateOutputAppend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execGateOutputAppend.d.ts","sourceRoot":"","sources":["../../../sources/engine/scheduling/execGateOutputAppend.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,mBAAmB,GAC1B,MAAM,CAWR"}

package/dist/engine/scheduling/execGateOutputAppend.js

@@ -0,0 +1,23 @@
+/**
+ * Appends trimmed gate output to a prompt when available.
+ * Returns the original prompt when there is no output.
+ */
+export function execGateOutputAppend(prompt, result) {
+    const output = formatGateOutput(result.stdout, result.stderr);
+    if (!output) {
+        return prompt;
+    }
+    const base = prompt.trim();
+    const suffix = `[Gate output]\n${output}`;
+    if (!base) {
+        return suffix;
+    }
+    return `${base}\n\n${suffix}`;
+}
+function formatGateOutput(stdout, stderr) {
+    const parts = [stdout, stderr]
+        .map((value) => value.trim())
+        .filter((value) => value.length > 0);
+    return parts.join("\n").trim();
+}
+//# sourceMappingURL=execGateOutputAppend.js.map

package/dist/engine/scheduling/execGateOutputAppend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execGateOutputAppend.js","sourceRoot":"","sources":["../../../sources/engine/scheduling/execGateOutputAppend.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAc,EACd,MAA2B;IAE3B,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,kBAAkB,MAAM,EAAE,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,IAAI,OAAO,MAAM,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc,EAAE,MAAc;IACtD,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;SAC3B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AACjC,CAAC"}

package/dist/engine/scheduling/execGateOutputAppend.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=execGateOutputAppend.spec.d.ts.map

package/dist/engine/scheduling/execGateOutputAppend.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execGateOutputAppend.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/scheduling/execGateOutputAppend.spec.ts"],"names":[],"mappings":""}

package/dist/engine/scheduling/execGateOutputAppend.spec.js

@@ -0,0 +1,24 @@
+import { describe, it, expect } from "vitest";
+import { execGateOutputAppend } from "./execGateOutputAppend.js";
+describe("execGateOutputAppend", () => {
+    it("returns prompt when output is empty", () => {
+        const prompt = "Do work.";
+        const result = execGateOutputAppend(prompt, {
+            shouldRun: true,
+            exitCode: 0,
+            stdout: "   ",
+            stderr: ""
+        });
+        expect(result).toBe(prompt);
+    });
+    it("appends trimmed stdout/stderr", () => {
+        const result = execGateOutputAppend("Check status", {
+            shouldRun: true,
+            exitCode: 0,
+            stdout: " ok \n",
+            stderr: " warn "
+        });
+        expect(result).toBe("Check status\n\n[Gate output]\nok\nwarn");
+    });
+});
+//# sourceMappingURL=execGateOutputAppend.spec.js.map

package/dist/engine/scheduling/execGateOutputAppend.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execGateOutputAppend.spec.js","sourceRoot":"","sources":["../../../sources/engine/scheduling/execGateOutputAppend.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,MAAM,GAAG,UAAU,CAAC;QAC1B,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,EAAE;YAC1C,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,EAAE;SACX,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,MAAM,GAAG,oBAAoB,CAAC,cAAc,EAAE;YAClD,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/scheduling/execGateTypes.d.ts

@@ -0,0 +1,15 @@
+import type { SandboxPackageManager } from "../../sandbox/sandboxPackageManagers.js";
+/**
+ * Exec gate configuration for scheduled tasks.
+ */
+export type ExecGateDefinition = {
+    command: string;
+    cwd?: string;
+    timeoutMs?: number;
+    env?: Record<string, string>;
+    home?: string;
+    permissions?: string[];
+    packageManagers?: SandboxPackageManager[];
+    allowedDomains?: string[];
+};
+//# sourceMappingURL=execGateTypes.d.ts.map

package/dist/engine/scheduling/execGateTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execGateTypes.d.ts","sourceRoot":"","sources":["../../../sources/engine/scheduling/execGateTypes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAErF;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,eAAe,CAAC,EAAE,qBAAqB,EAAE,CAAC;IAC1C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B,CAAC"}

package/dist/engine/scheduling/execGateTypes.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=execGateTypes.js.map

package/dist/engine/scheduling/execGateTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execGateTypes.js","sourceRoot":"","sources":["../../../sources/engine/scheduling/execGateTypes.ts"],"names":[],"mappings":""}

package/dist/engine/scheduling/gatePermissionRequest.d.ts

@@ -0,0 +1,21 @@
+import type { AgentSystem } from "../agents/agentSystem.js";
+import type { ConnectorRegistry } from "../modules/connectorRegistry.js";
+import type { PermissionRequestRegistry } from "../modules/tools/permissionRequestRegistry.js";
+export type GatePermissionRequestInput = {
+    missing: string[];
+    taskLabel: string;
+    agentSystem: AgentSystem;
+    connectorRegistry: ConnectorRegistry;
+    permissionRequestRegistry: PermissionRequestRegistry;
+    agentId: string;
+    timeoutMs?: number;
+};
+export type GatePermissionRequestResult = {
+    granted: boolean;
+};
+/**
+ * Requests missing gate permissions from the most-recent foreground user.
+ * Expects: missing values are valid permission tags and agentId identifies the gated task agent.
+ */
+export declare function gatePermissionRequest(input: GatePermissionRequestInput): Promise<GatePermissionRequestResult>;
+//# sourceMappingURL=gatePermissionRequest.d.ts.map

package/dist/engine/scheduling/gatePermissionRequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gatePermissionRequest.d.ts","sourceRoot":"","sources":["../../../sources/engine/scheduling/gatePermissionRequest.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAK/F,MAAM,MAAM,0BAA0B,GAAG;IACvC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,WAAW,CAAC;IACzB,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,yBAAyB,EAAE,yBAAyB,CAAC;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,2BAA2B,CAAC,CAoGtC"}

package/dist/engine/scheduling/gatePermissionRequest.js

@@ -0,0 +1,98 @@
+import { createId } from "@paralleldrive/cuid2";
+import path from "node:path";
+import { agentDescriptorLabel } from "../agents/ops/agentDescriptorLabel.js";
+import { agentDescriptorTargetResolve } from "../agents/ops/agentDescriptorTargetResolve.js";
+import { permissionAccessParse } from "../permissions/permissionAccessParse.js";
+const DEFAULT_TIMEOUT_MS = 15 * 60_000;
+/**
+ * Requests missing gate permissions from the most-recent foreground user.
+ * Expects: missing values are valid permission tags and agentId identifies the gated task agent.
+ */
+export async function gatePermissionRequest(input) {
+    if (input.missing.length === 0) {
+        return { granted: true };
+    }
+    const foregroundAgentId = input.agentSystem.agentFor("most-recent-foreground");
+    if (!foregroundAgentId) {
+        throw new Error("No foreground agent available for permission requests.");
+    }
+    const foregroundDescriptor = input.agentSystem.getAgentDescriptor(foregroundAgentId);
+    if (!foregroundDescriptor) {
+        throw new Error("Foreground agent descriptor not found.");
+    }
+    const target = agentDescriptorTargetResolve(foregroundDescriptor);
+    if (!target) {
+        throw new Error("Foreground agent has no user target for permission requests.");
+    }
+    const connector = input.connectorRegistry.get(target.connector);
+    if (!connector) {
+        throw new Error("Connector not available for permission requests.");
+    }
+    const requesterDescriptor = input.agentSystem.getAgentDescriptor(input.agentId);
+    if (!requesterDescriptor) {
+        throw new Error("Requesting agent descriptor not found.");
+    }
+    const permissions = input.missing.map((permission) => {
+        const access = permissionAccessParse(permission);
+        if ((access.kind === "read" || access.kind === "write") && !path.isAbsolute(access.path)) {
+            throw new Error("Path must be absolute.");
+        }
+        return { permission, access };
+    });
+    const reason = `Gate check for ${input.taskLabel} requires additional permissions.`;
+    const message = [
+        `Permission request for ${input.taskLabel}:`,
+        ...permissions.map((entry) => `- ${entry.permission}`),
+        `Reason: ${reason}`,
+        "Scope: always"
+    ].join("\n");
+    const request = {
+        token: createId(),
+        agentId: input.agentId,
+        reason,
+        message,
+        permissions,
+        scope: "always",
+        requester: {
+            id: input.agentId,
+            type: requesterDescriptor.type,
+            label: agentDescriptorLabel(requesterDescriptor),
+            kind: "background"
+        }
+    };
+    if (connector.requestPermission) {
+        await connector.requestPermission(target.targetId, request, {}, foregroundDescriptor);
+    }
+    else {
+        await connector.sendMessage(target.targetId, { text: request.message });
+    }
+    const timeoutMs = input.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    let decision;
+    try {
+        decision = await input.permissionRequestRegistry.register(request.token, timeoutMs);
+    }
+    catch (error) {
+        const isTimeout = error instanceof Error && error.message === "Permission request timed out.";
+        if (isTimeout) {
+            return { granted: false };
+        }
+        throw error;
+    }
+    if (!decision.approved) {
+        return { granted: false };
+    }
+    const targetAgentId = decision.agentId || input.agentId;
+    const resolvedDecision = {
+        ...decision,
+        agentId: targetAgentId,
+        scope: "always"
+    };
+    for (const entry of decision.permissions) {
+        await input.agentSystem.grantPermission({ agentId: targetAgentId }, entry.access, {
+            source: target.connector,
+            decision: resolvedDecision
+        });
+    }
+    return { granted: true };
+}
+//# sourceMappingURL=gatePermissionRequest.js.map

package/dist/engine/scheduling/gatePermissionRequest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gatePermissionRequest.js","sourceRoot":"","sources":["../../../sources/engine/scheduling/gatePermissionRequest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAI7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAEhF,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC;AAgBvC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,iBAAiB,GAAG,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;IAC/E,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,oBAAoB,GAAG,KAAK,CAAC,WAAW,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;IACrF,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,MAAM,GAAG,4BAA4B,CAAC,oBAAoB,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAChE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,mBAAmB,GAAG,KAAK,CAAC,WAAW,CAAC,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChF,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;QACnD,MAAM,MAAM,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACzF,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,kBAAkB,KAAK,CAAC,SAAS,mCAAmC,CAAC;IACpF,MAAM,OAAO,GAAG;QACd,0BAA0B,KAAK,CAAC,SAAS,GAAG;QAC5C,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;QACtD,WAAW,MAAM,EAAE;QACnB,eAAe;KAChB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,OAAO,GAAsB;QACjC,KAAK,EAAE,QAAQ,EAAE;QACjB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM;QACN,OAAO;QACP,WAAW;QACX,KAAK,EAAE,QAAQ;QACf,SAAS,EAAE;YACT,EAAE,EAAE,KAAK,CAAC,OAAO;YACjB,IAAI,EAAE,mBAAmB,CAAC,IAAI;YAC9B,KAAK,EAAE,oBAAoB,CAAC,mBAAmB,CAAC;YAChD,IAAI,EAAE,YAAY;SACnB;KACF,CAAC;IAEF,IAAI,SAAS,CAAC,iBAAiB,EAAE,CAAC;QAChC,MAAM,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,oBAAoB,CAAC,CAAC;IACxF,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACxD,IAAI,QAA4B,CAAC;IACjC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,yBAAyB,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,+BAA+B,CAAC;QAC9F,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC;IACxD,MAAM,gBAAgB,GAAuB;QAC3C,GAAG,QAAQ;QACX,OAAO,EAAE,aAAa;QACtB,KAAK,EAAE,QAAQ;KAChB,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,KAAK,CAAC,WAAW,CAAC,eAAe,CACrC,EAAE,OAAO,EAAE,aAAa,EAAE,EAC1B,KAAK,CAAC,MAAM,EACZ;YACE,MAAM,EAAE,MAAM,CAAC,SAAS;YACxB,QAAQ,EAAE,gBAAgB;SAC3B,CACF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC"}

package/dist/engine/scheduling/gatePermissionRequest.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=gatePermissionRequest.spec.d.ts.map

package/dist/engine/scheduling/gatePermissionRequest.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gatePermissionRequest.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/scheduling/gatePermissionRequest.spec.ts"],"names":[],"mappings":""}

package/dist/engine/scheduling/gatePermissionRequest.spec.js

@@ -0,0 +1,126 @@
+import { describe, expect, it, vi } from "vitest";
+import { PermissionRequestRegistry } from "../modules/tools/permissionRequestRegistry.js";
+import { gatePermissionRequest } from "./gatePermissionRequest.js";
+describe("gatePermissionRequest", () => {
+    it("requests permission, waits for approval, and grants missing access", async () => {
+        const registry = new PermissionRequestRegistry();
+        const grantPermission = vi.fn(async () => undefined);
+        const requestPermission = vi.fn(async (_targetId, _request) => undefined);
+        const pending = gatePermissionRequest({
+            missing: ["@network"],
+            taskLabel: "cron task alpha",
+            agentId: "agent-1",
+            agentSystem: agentSystemBuild({
+                grantPermission
+            }),
+            connectorRegistry: connectorRegistryBuild({ requestPermission }),
+            permissionRequestRegistry: registry
+        });
+        const request = await permissionRequestWait(requestPermission);
+        await registryResolveWhenReady(registry, {
+            token: request.token,
+            agentId: request.agentId,
+            approved: true,
+            permissions: request.permissions,
+            scope: "always"
+        });
+        const result = await pending;
+        expect(result.granted).toBe(true);
+        expect(request.scope).toBe("always");
+        expect(grantPermission).toHaveBeenCalledTimes(1);
+        expect(grantPermission).toHaveBeenCalledWith({ agentId: "agent-1" }, { kind: "network" }, expect.objectContaining({ source: "telegram" }));
+    });
+    it("returns false when permission is denied", async () => {
+        const registry = new PermissionRequestRegistry();
+        const grantPermission = vi.fn(async () => undefined);
+        const requestPermission = vi.fn(async (_targetId, _request) => undefined);
+        const pending = gatePermissionRequest({
+            missing: ["@network"],
+            taskLabel: "heartbeat task beta",
+            agentId: "agent-1",
+            agentSystem: agentSystemBuild({
+                grantPermission
+            }),
+            connectorRegistry: connectorRegistryBuild({ requestPermission }),
+            permissionRequestRegistry: registry
+        });
+        const request = await permissionRequestWait(requestPermission);
+        await registryResolveWhenReady(registry, {
+            token: request.token,
+            agentId: request.agentId,
+            approved: false,
+            permissions: request.permissions,
+            scope: "always"
+        });
+        const result = await pending;
+        expect(result.granted).toBe(false);
+        expect(grantPermission).not.toHaveBeenCalled();
+    });
+    it("returns false on timeout", async () => {
+        const result = await gatePermissionRequest({
+            missing: ["@network"],
+            taskLabel: "cron task gamma",
+            agentId: "agent-1",
+            agentSystem: agentSystemBuild({}),
+            connectorRegistry: connectorRegistryBuild({ requestPermission: vi.fn(async () => undefined) }),
+            permissionRequestRegistry: new PermissionRequestRegistry(),
+            timeoutMs: 10
+        });
+        expect(result.granted).toBe(false);
+    });
+});
+function agentSystemBuild(overrides) {
+    const descriptors = new Map([
+        [
+            "foreground-1",
+            {
+                type: "user",
+                connector: "telegram",
+                userId: "u1",
+                channelId: "c1"
+            }
+        ],
+        [
+            "agent-1",
+            {
+                type: "system",
+                tag: "cron"
+            }
+        ]
+    ]);
+    return {
+        agentFor: vi.fn(() => "foreground-1"),
+        getAgentDescriptor: vi.fn((agentId) => descriptors.get(agentId) ?? null),
+        grantPermission: overrides.grantPermission ?? (async () => undefined)
+    };
+}
+function connectorRegistryBuild(options) {
+    return {
+        get: vi.fn(() => ({
+            capabilities: { sendText: true },
+            onMessage: vi.fn(() => () => undefined),
+            sendMessage: vi.fn(async () => undefined),
+            requestPermission: options.requestPermission
+        }))
+    };
+}
+async function permissionRequestWait(requestPermission) {
+    for (let attempt = 0; attempt < 50; attempt += 1) {
+        const request = requestPermission.mock.calls[0]?.[1];
+        if (request) {
+            return request;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 0));
+    }
+    throw new Error("Expected permission request payload");
+}
+async function registryResolveWhenReady(registry, decision) {
+    for (let attempt = 0; attempt < 20; attempt += 1) {
+        if (registry.resolve(decision.token, decision)) {
+            return;
+        }
+        await Promise.resolve();
+    }
+    throw new Error("Permission token was never registered.");
+}
+//# sourceMappingURL=gatePermissionRequest.spec.js.map

package/dist/engine/scheduling/gatePermissionRequest.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gatePermissionRequest.spec.js","sourceRoot":"","sources":["../../../sources/engine/scheduling/gatePermissionRequest.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAKlD,OAAO,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,QAAQ,GAAG,IAAI,yBAAyB,EAAE,CAAC;QACjD,MAAM,eAAe,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,iBAAiB,GAAG,EAAE,CAAC,EAAE,CAC7B,KAAK,EACH,SAAiB,EACjB,QAA2B,EAC3B,EAAE,CAAC,SAAS,CACf,CAAC;QAEF,MAAM,OAAO,GAAG,qBAAqB,CAAC;YACpC,OAAO,EAAE,CAAC,UAAU,CAAC;YACrB,SAAS,EAAE,iBAAiB;YAC5B,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,gBAAgB,CAAC;gBAC5B,eAAe;aAChB,CAAC;YACF,iBAAiB,EAAE,sBAAsB,CAAC,EAAE,iBAAiB,EAAE,CAAC;YAChE,yBAAyB,EAAE,QAAQ;SACpC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,iBAAiB,CAAC,CAAC;QAC/D,MAAM,wBAAwB,CAAC,QAAQ,EAAE;YACvC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;QAE7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,CAAC,eAAe,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,eAAe,CAAC,CAAC,oBAAoB,CAC1C,EAAE,OAAO,EAAE,SAAS,EAAE,EACtB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAChD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,QAAQ,GAAG,IAAI,yBAAyB,EAAE,CAAC;QACjD,MAAM,eAAe,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,iBAAiB,GAAG,EAAE,CAAC,EAAE,CAC7B,KAAK,EACH,SAAiB,EACjB,QAA2B,EAC3B,EAAE,CAAC,SAAS,CACf,CAAC;QAEF,MAAM,OAAO,GAAG,qBAAqB,CAAC;YACpC,OAAO,EAAE,CAAC,UAAU,CAAC;YACrB,SAAS,EAAE,qBAAqB;YAChC,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,gBAAgB,CAAC;gBAC5B,eAAe;aAChB,CAAC;YACF,iBAAiB,EAAE,sBAAsB,CAAC,EAAE,iBAAiB,EAAE,CAAC;YAChE,yBAAyB,EAAE,QAAQ;SACpC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,iBAAiB,CAAC,CAAC;QAC/D,MAAM,wBAAwB,CAAC,QAAQ,EAAE;YACvC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC;YACzC,OAAO,EAAE,CAAC,UAAU,CAAC;YACrB,SAAS,EAAE,iBAAiB;YAC5B,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,gBAAgB,CAAC,EAAE,CAAC;YACjC,iBAAiB,EAAE,sBAAsB,CAAC,EAAE,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9F,yBAAyB,EAAE,IAAI,yBAAyB,EAAE;YAC1D,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,SAMzB;IACC,MAAM,WAAW,GAAG,IAAI,GAAG,CAA0B;QACnD;YACE,cAAc;YACd;gBACE,IAAI,EAAE,MAAM;gBACZ,SAAS,EAAE,UAAU;gBACrB,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI;aAChB;SACF;QACD;YACE,SAAS;YACT;gBACE,IAAI,EAAE,QAAQ;gBACd,GAAG,EAAE,MAAM;aACZ;SACF;KACF,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC;QACrC,kBAAkB,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;QAChF,eAAe,EAAE,SAAS,CAAC,eAAe,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;KAC5C,CAAC;AAC9B,CAAC;AAED,SAAS,sBAAsB,CAAC,OAK/B;IACC,OAAO;QACL,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;YAChB,YAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;YAChC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;YACvC,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;YACzC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;SAC7C,CAAC,CAAC;KAC4B,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,iBAAmD;IAEnD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAkC,CAAC;QACtF,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,QAAmC,EACnC,QAMC;IAED,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACjD,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1B,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;AAC5D,CAAC"}

package/dist/engine/scheduling/gatePermissionsCheck.d.ts

@@ -0,0 +1,11 @@
+import type { SessionPermissions } from "@/types";
+export type GatePermissionsCheckResult = {
+    allowed: boolean;
+    missing: string[];
+};
+/**
+ * Checks gate permission tags against the current permissions.
+ * Expects: tags are @network, @events, @workspace, @read:<path>, or @write:<path>.
+ */
+export declare function gatePermissionsCheck(permissions: SessionPermissions, tags?: string[]): Promise<GatePermissionsCheckResult>;
+//# sourceMappingURL=gatePermissionsCheck.d.ts.map

package/dist/engine/scheduling/gatePermissionsCheck.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gatePermissionsCheck.d.ts","sourceRoot":"","sources":["../../../sources/engine/scheduling/gatePermissionsCheck.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAoB,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAGpE,MAAM,MAAM,0BAA0B,GAAG;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEF;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,kBAAkB,EAC/B,IAAI,CAAC,EAAE,MAAM,EAAE,GACd,OAAO,CAAC,0BAA0B,CAAC,CAwBrC"}

package/dist/engine/scheduling/gatePermissionsCheck.js

@@ -0,0 +1,58 @@
+import { permissionAccessAllows } from "../permissions/permissionAccessAllows.js";
+/**
+ * Checks gate permission tags against the current permissions.
+ * Expects: tags are @network, @events, @workspace, @read:<path>, or @write:<path>.
+ */
+export async function gatePermissionsCheck(permissions, tags) {
+    if (!tags || tags.length === 0) {
+        return { allowed: true, missing: [] };
+    }
+    const missing = [];
+    for (const entry of tags) {
+        const trimmed = entry.trim();
+        if (!trimmed) {
+            missing.push("<blank> (Permission tag cannot be blank.)");
+            continue;
+        }
+        const parsed = parsePermissionAccess(trimmed);
+        if (!parsed.access) {
+            missing.push(`${trimmed} (${parsed.error ?? "Invalid gate permission."})`);
+            continue;
+        }
+        const allowed = await permissionAccessAllows(permissions, parsed.access);
+        if (!allowed) {
+            missing.push(trimmed);
+        }
+    }
+    return { allowed: missing.length === 0, missing };
+}
+function parsePermissionAccess(tag) {
+    if (tag === "@network") {
+        return { access: { kind: "network" } };
+    }
+    if (tag === "@events") {
+        return { access: { kind: "events" } };
+    }
+    if (tag === "@workspace") {
+        return { access: { kind: "workspace" } };
+    }
+    if (tag.startsWith("@read:")) {
+        const pathValue = tag.slice("@read:".length).trim();
+        if (!pathValue) {
+            return { access: null, error: "Read permission requires a path." };
+        }
+        return { access: { kind: "read", path: pathValue } };
+    }
+    if (tag.startsWith("@write:")) {
+        const pathValue = tag.slice("@write:".length).trim();
+        if (!pathValue) {
+            return { access: null, error: "Write permission requires a path." };
+        }
+        return { access: { kind: "write", path: pathValue } };
+    }
+    return {
+        access: null,
+        error: "Permission must be @network, @events, @workspace, @read:<path>, or @write:<path>."
+    };
+}
+//# sourceMappingURL=gatePermissionsCheck.js.map

package/dist/engine/scheduling/gatePermissionsCheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gatePermissionsCheck.js","sourceRoot":"","sources":["../../../sources/engine/scheduling/gatePermissionsCheck.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAOlF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAA+B,EAC/B,IAAe;IAEf,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YAC1D,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,KAAK,MAAM,CAAC,KAAK,IAAI,0BAA0B,GAAG,CAAC,CAAC;YAC3E,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACzE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,qBAAqB,CAC5B,GAAW;IAEX,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;IACxC,CAAC;IACD,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC;IACvD,CAAC;IAED,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;QACtE,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC;IACxD,CAAC;IAED,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,mFAAmF;KAC3F,CAAC;AACJ,CAAC"}

package/dist/engine/scheduling/gatePermissionsCheck.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=gatePermissionsCheck.spec.d.ts.map

package/dist/engine/scheduling/gatePermissionsCheck.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gatePermissionsCheck.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/scheduling/gatePermissionsCheck.spec.ts"],"names":[],"mappings":""}

package/dist/engine/scheduling/gatePermissionsCheck.spec.js

@@ -0,0 +1,67 @@
+import { describe, expect, it } from "vitest";
+import { gatePermissionsCheck } from "./gatePermissionsCheck.js";
+const basePermissions = {
+    workspaceDir: "/tmp",
+    workingDir: "/tmp",
+    readDirs: ["/tmp"],
+    writeDirs: ["/tmp"],
+    network: false,
+    events: false
+};
+describe("gatePermissionsCheck", () => {
+    it("allows empty tags", async () => {
+        const result = await gatePermissionsCheck(basePermissions);
+        expect(result).toEqual({ allowed: true, missing: [] });
+    });
+    it("denies network when not allowed", async () => {
+        const result = await gatePermissionsCheck(basePermissions, ["@network"]);
+        expect(result.allowed).toBe(false);
+        expect(result.missing).toEqual(["@network"]);
+    });
+    it("allows network when permitted", async () => {
+        const permissions = { ...basePermissions, network: true };
+        const result = await gatePermissionsCheck(permissions, ["@network"]);
+        expect(result).toEqual({ allowed: true, missing: [] });
+    });
+    it("denies events when not allowed", async () => {
+        const result = await gatePermissionsCheck(basePermissions, ["@events"]);
+        expect(result.allowed).toBe(false);
+        expect(result.missing).toEqual(["@events"]);
+    });
+    it("allows events when permitted", async () => {
+        const permissions = { ...basePermissions, events: true };
+        const result = await gatePermissionsCheck(permissions, ["@events"]);
+        expect(result).toEqual({ allowed: true, missing: [] });
+    });
+    it("denies workspace when not allowed", async () => {
+        const appPermissions = {
+            workspaceDir: "/tmp",
+            workingDir: "/tmp/apps/my-app/data",
+            readDirs: ["/tmp"],
+            writeDirs: ["/tmp/apps/my-app/data"],
+            network: false,
+            events: false
+        };
+        const result = await gatePermissionsCheck(appPermissions, ["@workspace"]);
+        expect(result.allowed).toBe(false);
+        expect(result.missing).toEqual(["@workspace"]);
+    });
+    it("allows workspace when permitted", async () => {
+        const permissions = { ...basePermissions };
+        const result = await gatePermissionsCheck(permissions, ["@workspace"]);
+        expect(result).toEqual({ allowed: true, missing: [] });
+    });
+    it("denies paths outside allowed roots", async () => {
+        const result = await gatePermissionsCheck(basePermissions, ["@read:/etc"]);
+        expect(result.allowed).toBe(false);
+        expect(result.missing).toEqual(["@read:/etc"]);
+    });
+    it("reports invalid permission tags", async () => {
+        const result = await gatePermissionsCheck(basePermissions, ["@banana"]);
+        expect(result.allowed).toBe(false);
+        expect(result.missing).toEqual([
+            "@banana (Permission must be @network, @events, @workspace, @read:<path>, or @write:<path>.)"
+        ]);
+    });
+});
+//# sourceMappingURL=gatePermissionsCheck.spec.js.map

package/dist/engine/scheduling/gatePermissionsCheck.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gatePermissionsCheck.spec.js","sourceRoot":"","sources":["../../../sources/engine/scheduling/gatePermissionsCheck.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAG9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,MAAM,eAAe,GAAuB;IAC1C,YAAY,EAAE,MAAM;IACpB,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,CAAC,MAAM,CAAC;IAClB,SAAS,EAAE,CAAC,MAAM,CAAC;IACnB,OAAO,EAAE,KAAK;IACd,MAAM,EAAE,KAAK;CACd,CAAC;AAEF,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,mBAAmB,EAAE,KAAK,IAAI,EAAE;QACjC,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,eAAe,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,eAAe,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QACzE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,WAAW,GAAuB,EAAE,GAAG,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC9E,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,eAAe,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,WAAW,GAAuB,EAAE,GAAG,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC7E,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACpE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,cAAc,GAAuB;YACzC,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,uBAAuB;YACnC,QAAQ,EAAE,CAAC,MAAM,CAAC;YAClB,SAAS,EAAE,CAAC,uBAAuB,CAAC;YACpC,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SACd,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,cAAc,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAC1E,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,WAAW,GAAuB,EAAE,GAAG,eAAe,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,eAAe,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAC3E,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,eAAe,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;YAC7B,6FAA6F;SAC9F,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}