daycare-cli 0.0.1

package/dist/engine/permissions/pathResolveSecure.js

@@ -0,0 +1,96 @@
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { pathSanitize } from "./pathSanitize.js";
+/**
+ * Securely resolves a path, following symlinks and verifying containment.
+ *
+ * Addresses symlink following attacks by:
+ * 1. Resolving all symlinks using fs.realpath()
+ * 2. Checking containment against the real paths
+ *
+ * @param allowedDirs - Directories the path is allowed to be within
+ * @param target - The target path to resolve
+ * @returns The resolved real path and the base directory it's within
+ * @throws Error if path is outside allowed directories or doesn't exist
+ */
+export async function pathResolveSecure(allowedDirs, target) {
+    pathSanitize(target);
+    if (!path.isAbsolute(target)) {
+        throw new Error("Path must be absolute.");
+    }
+    // Resolve the target path following all symlinks
+    let realPath;
+    try {
+        realPath = await fs.realpath(target);
+    }
+    catch {
+        realPath = await resolveMissingPath(target);
+    }
+    // Check containment against each allowed directory (also resolve their real paths)
+    for (const dir of allowedDirs) {
+        let realDir;
+        try {
+            realDir = await fs.realpath(dir);
+        }
+        catch {
+            // If the allowed dir doesn't exist, use logical resolution
+            realDir = path.resolve(dir);
+        }
+        if (isWithinSecure(realDir, realPath)) {
+            return { realPath, allowedBase: realDir };
+        }
+    }
+    throw new Error("Path is outside the allowed directories.");
+}
+async function resolveMissingPath(target) {
+    const missing = [path.basename(target)];
+    let parent = path.dirname(target);
+    while (true) {
+        try {
+            const realParent = await fs.realpath(parent);
+            return path.join(realParent, ...missing);
+        }
+        catch {
+            const next = path.dirname(parent);
+            if (next === parent) {
+                return path.resolve(target);
+            }
+            missing.unshift(path.basename(parent));
+            parent = next;
+        }
+    }
+}
+/**
+ * Synchronous version that checks if a path would be within allowed dirs.
+ * Does NOT resolve symlinks - use only when you've already resolved.
+ */
+export function isWithinSecure(base, target) {
+    const relative = path.relative(base, target);
+    return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+}
+/**
+ * Opens a file handle securely with O_NOFOLLOW semantics.
+ * This prevents TOCTOU attacks by atomically opening without following symlinks.
+ *
+ * @param filePath - Path to open
+ * @param flags - File system flags (e.g., "r", "w", "a")
+ * @returns File handle
+ */
+export async function openSecure(filePath, flags) {
+    pathSanitize(filePath);
+    // Check if target is a symlink before opening
+    try {
+        const stats = await fs.lstat(filePath);
+        if (stats.isSymbolicLink()) {
+            throw new Error("Cannot open symbolic link directly.");
+        }
+    }
+    catch (error) {
+        // File doesn't exist - OK for write/create operations
+        if (error.code !== "ENOENT") {
+            throw error;
+        }
+    }
+    return fs.open(filePath, flags);
+}
+//# sourceMappingURL=pathResolveSecure.js.map

package/dist/engine/permissions/pathResolveSecure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathResolveSecure.js","sourceRoot":"","sources":["../../../sources/engine/permissions/pathResolveSecure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAYjD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,WAAqB,EACrB,MAAc;IAEd,YAAY,CAAC,MAAM,CAAC,CAAC;IAErB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,iDAAiD;IACjD,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,mFAAmF;IACnF,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;YAC3D,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QAED,IAAI,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,MAAc;IAC9C,MAAM,OAAO,GAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAClD,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAElC,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;YACD,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACvC,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,MAAc;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,QAAgB,EAChB,KAAa;IAEb,YAAY,CAAC,QAAQ,CAAC,CAAC;IAEvB,8CAA8C;IAC9C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sDAAsD;QACtD,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC"}

package/dist/engine/permissions/pathResolveSecure.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=pathResolveSecure.spec.d.ts.map

package/dist/engine/permissions/pathResolveSecure.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathResolveSecure.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/pathResolveSecure.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/pathResolveSecure.spec.js

@@ -0,0 +1,115 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { pathResolveSecure, isWithinSecure, openSecure } from "./pathResolveSecure.js";
+describe("pathResolveSecure", () => {
+    let tempDir;
+    let realTempDir;
+    beforeEach(async () => {
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "path-resolve-test-"));
+        // On macOS, /var is a symlink to /private/var, so we need the real path
+        realTempDir = await fs.realpath(tempDir);
+        await fs.mkdir(path.join(tempDir, "allowed"));
+        await fs.mkdir(path.join(tempDir, "forbidden"));
+        await fs.writeFile(path.join(tempDir, "allowed", "file.txt"), "content");
+        await fs.writeFile(path.join(tempDir, "forbidden", "secret.txt"), "secret");
+    });
+    afterEach(async () => {
+        await fs.rm(tempDir, { recursive: true, force: true });
+    });
+    it("resolves paths within allowed directories", async () => {
+        const allowedDirs = [path.join(tempDir, "allowed")];
+        const result = await pathResolveSecure(allowedDirs, path.join(tempDir, "allowed", "file.txt"));
+        // fs.realpath resolves symlinks, so we compare against realTempDir
+        expect(result.realPath).toBe(path.join(realTempDir, "allowed", "file.txt"));
+        expect(result.allowedBase).toBe(path.join(realTempDir, "allowed"));
+    });
+    it("rejects paths outside allowed directories", async () => {
+        const allowedDirs = [path.join(tempDir, "allowed")];
+        await expect(pathResolveSecure(allowedDirs, path.join(tempDir, "forbidden", "secret.txt"))).rejects.toThrow("Path is outside the allowed directories.");
+    });
+    it("prevents symlink escape attack", async () => {
+        // Create symlink inside allowed dir pointing outside
+        const symlinkPath = path.join(tempDir, "allowed", "escape");
+        await fs.symlink(path.join(tempDir, "forbidden"), symlinkPath);
+        const allowedDirs = [path.join(tempDir, "allowed")];
+        // Attempting to access forbidden/secret.txt via symlink should fail
+        await expect(pathResolveSecure(allowedDirs, path.join(symlinkPath, "secret.txt"))).rejects.toThrow("Path is outside the allowed directories.");
+    });
+    it("allows symlinks that resolve within allowed dirs", async () => {
+        // Create symlink within allowed dir pointing to another file in allowed
+        await fs.mkdir(path.join(tempDir, "allowed", "subdir"));
+        await fs.writeFile(path.join(tempDir, "allowed", "subdir", "data.txt"), "data");
+        const symlinkPath = path.join(tempDir, "allowed", "link");
+        await fs.symlink(path.join(tempDir, "allowed", "subdir"), symlinkPath);
+        const allowedDirs = [path.join(tempDir, "allowed")];
+        const result = await pathResolveSecure(allowedDirs, path.join(symlinkPath, "data.txt"));
+        expect(result.realPath).toBe(path.join(realTempDir, "allowed", "subdir", "data.txt"));
+    });
+    it("handles non-existent files for write operations", async () => {
+        const allowedDirs = [path.join(tempDir, "allowed")];
+        const result = await pathResolveSecure(allowedDirs, path.join(tempDir, "allowed", "newfile.txt"));
+        expect(result.realPath).toBe(path.join(realTempDir, "allowed", "newfile.txt"));
+    });
+    it("handles nested non-existent files for write operations", async () => {
+        const allowedDirs = [path.join(tempDir, "allowed")];
+        const result = await pathResolveSecure(allowedDirs, path.join(tempDir, "allowed", "nested", "deep", "newfile.txt"));
+        expect(result.realPath).toBe(path.join(realTempDir, "allowed", "nested", "deep", "newfile.txt"));
+    });
+    it("rejects paths with null bytes", async () => {
+        const allowedDirs = [path.join(tempDir, "allowed")];
+        await expect(pathResolveSecure(allowedDirs, path.join(tempDir, "allowed\x00forbidden"))).rejects.toThrow("Path contains null byte.");
+    });
+    it("rejects relative paths", async () => {
+        const allowedDirs = [path.join(tempDir, "allowed")];
+        await expect(pathResolveSecure(allowedDirs, "relative/path")).rejects.toThrow("Path must be absolute.");
+    });
+});
+describe("isWithinSecure", () => {
+    it("returns true for paths within base", () => {
+        expect(isWithinSecure("/home/user", "/home/user/file.txt")).toBe(true);
+        expect(isWithinSecure("/home/user", "/home/user/sub/file.txt")).toBe(true);
+        expect(isWithinSecure("/home/user", "/home/user")).toBe(true);
+    });
+    it("returns false for paths outside base", () => {
+        expect(isWithinSecure("/home/user", "/home/other/file.txt")).toBe(false);
+        expect(isWithinSecure("/home/user", "/etc/passwd")).toBe(false);
+        expect(isWithinSecure("/home/user", "/home/user/../other")).toBe(false);
+    });
+});
+describe("openSecure", () => {
+    let tempDir;
+    beforeEach(async () => {
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "open-secure-test-"));
+        await fs.writeFile(path.join(tempDir, "regular.txt"), "content");
+        await fs.mkdir(path.join(tempDir, "target"));
+        await fs.writeFile(path.join(tempDir, "target", "secret.txt"), "secret");
+    });
+    afterEach(async () => {
+        await fs.rm(tempDir, { recursive: true, force: true });
+    });
+    it("opens regular files", async () => {
+        const handle = await openSecure(path.join(tempDir, "regular.txt"), "r");
+        const content = await handle.readFile("utf8");
+        await handle.close();
+        expect(content).toBe("content");
+    });
+    it("rejects symlinks", async () => {
+        const symlinkPath = path.join(tempDir, "link.txt");
+        await fs.symlink(path.join(tempDir, "regular.txt"), symlinkPath);
+        await expect(openSecure(symlinkPath, "r")).rejects.toThrow("Cannot open symbolic link directly.");
+    });
+    it("allows creating new files", async () => {
+        const newPath = path.join(tempDir, "new.txt");
+        const handle = await openSecure(newPath, "w");
+        await handle.writeFile("new content");
+        await handle.close();
+        const content = await fs.readFile(newPath, "utf8");
+        expect(content).toBe("new content");
+    });
+    it("rejects paths with null bytes", async () => {
+        await expect(openSecure(path.join(tempDir, "file\x00.txt"), "r")).rejects.toThrow("Path contains null byte.");
+    });
+});
+//# sourceMappingURL=pathResolveSecure.spec.js.map

package/dist/engine/permissions/pathResolveSecure.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathResolveSecure.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/pathResolveSecure.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEvF,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,IAAI,OAAe,CAAC;IACpB,IAAI,WAAmB,CAAC;IAExB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;QACzE,wEAAwE;QACxE,WAAW,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QAC9C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QAChD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,SAAS,CAAC,CAAC;QACzE,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,WAAW,EACX,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,CAC1C,CAAC;QACF,mEAAmE;QACnE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QAC5E,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QACpD,MAAM,MAAM,CACV,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,CAC9E,CAAC,OAAO,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,qDAAqD;QACrD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC5D,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;QAE/D,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QAEpD,oEAAoE;QACpE,MAAM,MAAM,CACV,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CACrE,CAAC,OAAO,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,wEAAwE;QACxE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;QACxD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;QAChF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;QAEvE,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,WAAW,EACX,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CACnC,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,WAAW,EACX,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,CAAC,CAC7C,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,WAAW,EACX,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,CAC/D,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC1B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,CACnE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QACpD,MAAM,MAAM,CACV,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAC3E,CAAC,OAAO,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;QACtC,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QACpD,MAAM,MAAM,CACV,iBAAiB,CAAC,WAAW,EAAE,eAAe,CAAC,CAChD,CAAC,OAAO,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzE,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChE,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,IAAI,OAAe,CAAC;IAEpB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;QACxE,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,SAAS,CAAC,CAAC;QACjE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC7C,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;QACnC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kBAAkB,EAAE,KAAK,IAAI,EAAE;QAChC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACnD,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,WAAW,CAAC,CAAC;QAEjE,MAAM,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACxD,qCAAqC,CACtC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC9C,MAAM,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACtC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAErB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,MAAM,CACV,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,GAAG,CAAC,CACpD,CAAC,OAAO,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/pathSanitize.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Validates a path for dangerous characters and patterns.
+ * Throws an error if the path is invalid.
+ *
+ * Checks for:
+ * - Null bytes (can truncate strings in C libraries)
+ * - Control characters (ASCII 0-31 except tab/newline)
+ * - Excessively long paths (DoS potential)
+ */
+export declare function pathSanitize(target: string): void;
+/**
+ * Sanitizes and resolves a path, ensuring it's absolute.
+ * Returns the resolved absolute path.
+ */
+export declare function pathSanitizeAndResolve(target: string): string;
+//# sourceMappingURL=pathSanitize.d.ts.map

package/dist/engine/permissions/pathSanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathSanitize.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/pathSanitize.ts"],"names":[],"mappings":"AAIA;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAiBjD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAM7D"}

package/dist/engine/permissions/pathSanitize.js

@@ -0,0 +1,39 @@
+import path from "node:path";
+const MAX_PATH_LENGTH = 4096;
+/**
+ * Validates a path for dangerous characters and patterns.
+ * Throws an error if the path is invalid.
+ *
+ * Checks for:
+ * - Null bytes (can truncate strings in C libraries)
+ * - Control characters (ASCII 0-31 except tab/newline)
+ * - Excessively long paths (DoS potential)
+ */
+export function pathSanitize(target) {
+    if (target.length > MAX_PATH_LENGTH) {
+        throw new Error(`Path exceeds maximum length of ${MAX_PATH_LENGTH} characters.`);
+    }
+    // Check for null bytes
+    if (target.includes("\x00")) {
+        throw new Error("Path contains null byte.");
+    }
+    // Check for control characters (ASCII 0-31, except 9=tab and 10=newline)
+    for (let i = 0; i < target.length; i++) {
+        const code = target.charCodeAt(i);
+        if (code < 32 && code !== 9 && code !== 10) {
+            throw new Error("Path contains invalid control character.");
+        }
+    }
+}
+/**
+ * Sanitizes and resolves a path, ensuring it's absolute.
+ * Returns the resolved absolute path.
+ */
+export function pathSanitizeAndResolve(target) {
+    pathSanitize(target);
+    if (!path.isAbsolute(target)) {
+        throw new Error("Path must be absolute.");
+    }
+    return path.resolve(target);
+}
+//# sourceMappingURL=pathSanitize.js.map

package/dist/engine/permissions/pathSanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathSanitize.js","sourceRoot":"","sources":["../../../sources/engine/permissions/pathSanitize.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,IAAI,MAAM,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,kCAAkC,eAAe,cAAc,CAAC,CAAC;IACnF,CAAC;IAED,uBAAuB;IACvB,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,yEAAyE;IACzE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,IAAI,GAAG,EAAE,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,YAAY,CAAC,MAAM,CAAC,CAAC;IACrB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC"}

package/dist/engine/permissions/pathSanitize.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=pathSanitize.spec.d.ts.map

package/dist/engine/permissions/pathSanitize.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathSanitize.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/pathSanitize.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/pathSanitize.spec.js

@@ -0,0 +1,43 @@
+import { describe, it, expect } from "vitest";
+import { pathSanitize, pathSanitizeAndResolve } from "./pathSanitize.js";
+describe("pathSanitize", () => {
+    it("accepts valid paths", () => {
+        expect(() => pathSanitize("/home/user/file.txt")).not.toThrow();
+        expect(() => pathSanitize("/path/with spaces/file.txt")).not.toThrow();
+        expect(() => pathSanitize("/unicode/日本語/文件.txt")).not.toThrow();
+    });
+    it("rejects paths with null bytes", () => {
+        expect(() => pathSanitize("/home/user\x00/malicious")).toThrow("Path contains null byte.");
+        expect(() => pathSanitize("/etc/passwd\x00.txt")).toThrow("Path contains null byte.");
+    });
+    it("rejects paths with control characters", () => {
+        expect(() => pathSanitize("/home/user\x01file")).toThrow("Path contains invalid control character.");
+        expect(() => pathSanitize("/home/user\x1Ffile")).toThrow("Path contains invalid control character.");
+    });
+    it("allows tabs and newlines", () => {
+        // Tabs and newlines are uncommon but not dangerous in the same way
+        expect(() => pathSanitize("/home/user\tfile")).not.toThrow();
+        expect(() => pathSanitize("/home/user\nfile")).not.toThrow();
+    });
+    it("rejects excessively long paths", () => {
+        const longPath = "/" + "a".repeat(5000);
+        expect(() => pathSanitize(longPath)).toThrow("Path exceeds maximum length of 4096 characters.");
+    });
+    it("accepts paths at the limit", () => {
+        const maxPath = "/" + "a".repeat(4095);
+        expect(() => pathSanitize(maxPath)).not.toThrow();
+    });
+});
+describe("pathSanitizeAndResolve", () => {
+    it("sanitizes and resolves valid absolute paths", () => {
+        const result = pathSanitizeAndResolve("/home/user/../user/file.txt");
+        expect(result).toBe("/home/user/file.txt");
+    });
+    it("rejects relative paths", () => {
+        expect(() => pathSanitizeAndResolve("relative/path")).toThrow("Path must be absolute.");
+    });
+    it("rejects paths with null bytes before checking absolute", () => {
+        expect(() => pathSanitizeAndResolve("/etc/passwd\x00")).toThrow("Path contains null byte.");
+    });
+});
+//# sourceMappingURL=pathSanitize.spec.js.map

package/dist/engine/permissions/pathSanitize.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathSanitize.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/pathSanitize.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAEzE,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAChE,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACvE,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,0BAA0B,CAAC,CAAC,CAAC,OAAO,CAC5D,0BAA0B,CAC3B,CAAC;QACF,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,CACvD,0BAA0B,CAC3B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CACtD,0CAA0C,CAC3C,CAAC;QACF,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CACtD,0CAA0C,CAC3C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,mEAAmE;QACnE,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC7D,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,QAAQ,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAC1C,iDAAiD,CAClD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,OAAO,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,MAAM,GAAG,sBAAsB,CAAC,6BAA6B,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAC3D,wBAAwB,CACzB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAC7D,0BAA0B,CAC3B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionAccessAllows.d.ts

@@ -0,0 +1,7 @@
+import type { PermissionAccess, SessionPermissions } from "@/types";
+/**
+ * Checks whether a permission access is already allowed by current permissions.
+ * Expects: access.kind is network/read/write; paths must be absolute.
+ */
+export declare function permissionAccessAllows(permissions: SessionPermissions, access: PermissionAccess): Promise<boolean>;
+//# sourceMappingURL=permissionAccessAllows.d.ts.map

package/dist/engine/permissions/permissionAccessAllows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionAccessAllows.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessAllows.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAIpE;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,WAAW,EAAE,kBAAkB,EAC/B,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC,OAAO,CAAC,CA4BlB"}

package/dist/engine/permissions/permissionAccessAllows.js

@@ -0,0 +1,35 @@
+import path from "node:path";
+import { pathResolveSecure } from "./pathResolveSecure.js";
+import { pathSanitizeAndResolve } from "./pathSanitize.js";
+/**
+ * Checks whether a permission access is already allowed by current permissions.
+ * Expects: access.kind is network/read/write; paths must be absolute.
+ */
+export async function permissionAccessAllows(permissions, access) {
+    if (access.kind === "network") {
+        return permissions.network;
+    }
+    if (!path.isAbsolute(access.path)) {
+        return false;
+    }
+    let resolved;
+    try {
+        resolved = pathSanitizeAndResolve(access.path);
+    }
+    catch {
+        return false;
+    }
+    const allowedDirs = access.kind === "write"
+        ? [...permissions.writeDirs]
+        : permissions.readDirs.length > 0
+            ? [permissions.workingDir, ...permissions.readDirs, ...permissions.writeDirs]
+            : [path.parse(resolved).root];
+    try {
+        await pathResolveSecure(allowedDirs, resolved);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=permissionAccessAllows.js.map

package/dist/engine/permissions/permissionAccessAllows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionAccessAllows.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessAllows.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE3D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,WAA+B,EAC/B,MAAwB;IAExB,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,WAAW,CAAC,OAAO,CAAC;IAC7B,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,KAAK,OAAO;QACzC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,SAAS,CAAC;QAC5B,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAC/B,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,EAAE,GAAG,WAAW,CAAC,QAAQ,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC;YAC7E,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC;IAElC,IAAI,CAAC;QACH,MAAM,iBAAiB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/engine/permissions/permissionAccessAllows.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permissionAccessAllows.spec.d.ts.map

package/dist/engine/permissions/permissionAccessAllows.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionAccessAllows.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessAllows.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionAccessAllows.spec.js

@@ -0,0 +1,55 @@
+import { describe, it, expect, afterEach } from "vitest";
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { permissionAccessAllows } from "./permissionAccessAllows.js";
+describe("permissionAccessAllows", () => {
+    const tempDirs = [];
+    afterEach(async () => {
+        await Promise.all(tempDirs.map((dir) => fs.rm(dir, { recursive: true, force: true })));
+        tempDirs.length = 0;
+    });
+    it("allows network access when enabled", async () => {
+        const allowed = await permissionAccessAllows({ workingDir: "/tmp", writeDirs: [], readDirs: [], network: true }, { kind: "network" });
+        expect(allowed).toBe(true);
+    });
+    it("allows read access within allowed directories", async () => {
+        const dir = await fs.mkdtemp(path.join(os.tmpdir(), "perm-allow-"));
+        tempDirs.push(dir);
+        const target = path.join(dir, "file.txt");
+        await fs.writeFile(target, "ok", "utf8");
+        const allowed = await permissionAccessAllows({ workingDir: dir, writeDirs: [], readDirs: [dir], network: false }, { kind: "read", path: target });
+        expect(allowed).toBe(true);
+    });
+    it("treats empty readDirs as unrestricted read access", async () => {
+        const workspaceDir = await fs.mkdtemp(path.join(os.tmpdir(), "perm-workspace-"));
+        const outsideDir = await fs.mkdtemp(path.join(os.tmpdir(), "perm-outside-"));
+        tempDirs.push(workspaceDir, outsideDir);
+        const outsideFile = path.join(outsideDir, "outside.txt");
+        await fs.writeFile(outsideFile, "ok", "utf8");
+        const allowed = await permissionAccessAllows({ workingDir: workspaceDir, writeDirs: [], readDirs: [], network: false }, { kind: "read", path: outsideFile });
+        expect(allowed).toBe(true);
+    });
+    it("denies write access outside allowed directories", async () => {
+        const dir = await fs.mkdtemp(path.join(os.tmpdir(), "perm-deny-"));
+        tempDirs.push(dir);
+        const target = path.join(dir, "elsewhere", "file.txt");
+        const allowed = await permissionAccessAllows({ workingDir: "/tmp", writeDirs: ["/tmp"], readDirs: [], network: false }, { kind: "write", path: target });
+        expect(allowed).toBe(false);
+    });
+    it("does not imply write access from workingDir", async () => {
+        const dir = await fs.mkdtemp(path.join(os.tmpdir(), "perm-working-dir-"));
+        tempDirs.push(dir);
+        const target = path.join(dir, "file.txt");
+        const allowed = await permissionAccessAllows({ workingDir: dir, writeDirs: [], readDirs: [], network: false }, { kind: "write", path: target });
+        expect(allowed).toBe(false);
+    });
+    it("allows write access when path is explicitly in writeDirs", async () => {
+        const dir = await fs.mkdtemp(path.join(os.tmpdir(), "perm-write-dir-"));
+        tempDirs.push(dir);
+        const target = path.join(dir, "file.txt");
+        const allowed = await permissionAccessAllows({ workingDir: "/tmp", writeDirs: [dir], readDirs: [], network: false }, { kind: "write", path: target });
+        expect(allowed).toBe(true);
+    });
+});
+//# sourceMappingURL=permissionAccessAllows.spec.js.map

package/dist/engine/permissions/permissionAccessAllows.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionAccessAllows.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessAllows.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACvF,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAClE,EAAE,IAAI,EAAE,SAAS,EAAE,CACpB,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;QACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC1C,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EACnE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAC/B,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;QACjF,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;QAC7E,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QACzD,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAE9C,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EACzE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,CACpC,CAAC;QAEF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;QACnE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EACzE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAChC,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAC1E,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAChE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAChC,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;QACxE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAC1C,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EACtE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAChC,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionAccessApply.d.ts

@@ -0,0 +1,7 @@
+import type { PermissionAccess, SessionPermissions } from "@/types";
+/**
+ * Applies a permission access to a permissions object in place.
+ * Returns true when applied; false when invalid or unsupported.
+ */
+export declare function permissionAccessApply(permissions: SessionPermissions, access: PermissionAccess): boolean;
+//# sourceMappingURL=permissionAccessApply.d.ts.map

package/dist/engine/permissions/permissionAccessApply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionAccessApply.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessApply.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAGpE;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,kBAAkB,EAC/B,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAqCT"}

package/dist/engine/permissions/permissionAccessApply.js

@@ -0,0 +1,40 @@
+import path from "node:path";
+import { pathSanitizeAndResolve } from "./pathSanitize.js";
+/**
+ * Applies a permission access to a permissions object in place.
+ * Returns true when applied; false when invalid or unsupported.
+ */
+export function permissionAccessApply(permissions, access) {
+    if (access.kind === "network") {
+        permissions.network = true;
+        return true;
+    }
+    if (!path.isAbsolute(access.path)) {
+        return false;
+    }
+    let resolved;
+    try {
+        resolved = pathSanitizeAndResolve(access.path);
+    }
+    catch {
+        return false;
+    }
+    if (access.kind === "write") {
+        const writeDirs = new Set(permissions.writeDirs);
+        writeDirs.add(resolved);
+        permissions.writeDirs = Array.from(writeDirs.values());
+        // Write access requires read access to the same path.
+        const readDirs = new Set(permissions.readDirs);
+        readDirs.add(resolved);
+        permissions.readDirs = Array.from(readDirs.values());
+        return true;
+    }
+    if (access.kind === "read") {
+        const next = new Set(permissions.readDirs);
+        next.add(resolved);
+        permissions.readDirs = Array.from(next.values());
+        return true;
+    }
+    return false;
+}
+//# sourceMappingURL=permissionAccessApply.js.map

package/dist/engine/permissions/permissionAccessApply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionAccessApply.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessApply.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE3D;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,WAA+B,EAC/B,MAAwB;IAExB,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,WAAW,CAAC,OAAO,GAAG,IAAI,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACjD,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxB,WAAW,CAAC,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QAEvD,sDAAsD;QACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC/C,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvB,WAAW,CAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnB,WAAW,CAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/engine/permissions/permissionAccessApply.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permissionAccessApply.spec.d.ts.map

package/dist/engine/permissions/permissionAccessApply.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionAccessApply.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessApply.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionAccessApply.spec.js

@@ -0,0 +1,34 @@
+import { describe, it, expect } from "vitest";
+import path from "node:path";
+import { permissionAccessApply } from "./permissionAccessApply.js";
+describe("permissionAccessApply", () => {
+    const basePermissions = () => ({
+        workingDir: "/tmp",
+        writeDirs: [],
+        readDirs: [],
+        network: false
+    });
+    it("applies network access", () => {
+        const permissions = basePermissions();
+        const applied = permissionAccessApply(permissions, { kind: "network" });
+        expect(applied).toBe(true);
+        expect(permissions.network).toBe(true);
+    });
+    it("applies read/write paths", () => {
+        const permissions = basePermissions();
+        const readPath = path.resolve("/tmp/read");
+        const writePath = path.resolve("/tmp/write");
+        expect(permissionAccessApply(permissions, { kind: "read", path: readPath })).toBe(true);
+        expect(permissionAccessApply(permissions, { kind: "write", path: writePath })).toBe(true);
+        expect(permissions.readDirs).toContain(readPath);
+        expect(permissions.readDirs).toContain(writePath);
+        expect(permissions.writeDirs).toContain(writePath);
+    });
+    it("rejects non-absolute paths", () => {
+        const permissions = basePermissions();
+        const applied = permissionAccessApply(permissions, { kind: "read", path: "relative" });
+        expect(applied).toBe(false);
+        expect(permissions.readDirs).toHaveLength(0);
+    });
+});
+//# sourceMappingURL=permissionAccessApply.spec.js.map

package/dist/engine/permissions/permissionAccessApply.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionAccessApply.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessApply.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,CAAC;QAC7B,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,EAAc;QACzB,QAAQ,EAAE,EAAc;QACxB,OAAO,EAAE,KAAK;KACf,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,qBAAqB,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,CAAC,qBAAqB,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxF,MAAM,CAAC,qBAAqB,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1F,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,qBAAqB,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACvF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionAccessParse.d.ts

@@ -0,0 +1,7 @@
+import type { PermissionAccess } from "@/types";
+/**
+ * Parses a permission tag string into a PermissionAccess union.
+ * Expects: value is @network, @read:<path>, or @write:<path>.
+ */
+export declare function permissionAccessParse(value: string): PermissionAccess;
+//# sourceMappingURL=permissionAccessParse.d.ts.map

package/dist/engine/permissions/permissionAccessParse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionAccessParse.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessParse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAEhD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,CAoBrE"}