daycare-cli 0.0.1

package/dist/engine/permissions/permissionAccessParse.js

@@ -0,0 +1,26 @@
+/**
+ * Parses a permission tag string into a PermissionAccess union.
+ * Expects: value is @network, @read:<path>, or @write:<path>.
+ */
+export function permissionAccessParse(value) {
+    const trimmed = value.trim();
+    if (trimmed === "@network") {
+        return { kind: "network" };
+    }
+    if (trimmed.startsWith("@read:")) {
+        const pathValue = trimmed.slice("@read:".length).trim();
+        if (!pathValue) {
+            throw new Error("Read permission requires a path.");
+        }
+        return { kind: "read", path: pathValue };
+    }
+    if (trimmed.startsWith("@write:")) {
+        const pathValue = trimmed.slice("@write:".length).trim();
+        if (!pathValue) {
+            throw new Error("Write permission requires a path.");
+        }
+        return { kind: "write", path: pathValue };
+    }
+    throw new Error("Permission must be @network, @read:<path>, or @write:<path>.");
+}
+//# sourceMappingURL=permissionAccessParse.js.map

package/dist/engine/permissions/permissionAccessParse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionAccessParse.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessParse.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;AAClF,CAAC"}

package/dist/engine/permissions/permissionAccessParse.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permissionAccessParse.spec.d.ts.map

package/dist/engine/permissions/permissionAccessParse.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionAccessParse.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessParse.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionAccessParse.spec.js

@@ -0,0 +1,15 @@
+import { describe, it, expect } from "vitest";
+import { permissionAccessParse } from "./permissionAccessParse.js";
+describe("permissionAccessParse", () => {
+    it("parses @network", () => {
+        expect(permissionAccessParse("@network")).toEqual({ kind: "network" });
+    });
+    it("parses @read and @write paths", () => {
+        expect(permissionAccessParse("@read:/tmp")).toEqual({ kind: "read", path: "/tmp" });
+        expect(permissionAccessParse("@write:/var/log")).toEqual({ kind: "write", path: "/var/log" });
+    });
+    it("rejects invalid tags", () => {
+        expect(() => permissionAccessParse("read:/tmp")).toThrow("Permission must be");
+    });
+});
+//# sourceMappingURL=permissionAccessParse.spec.js.map

package/dist/engine/permissions/permissionAccessParse.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionAccessParse.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessParse.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,iBAAiB,EAAE,GAAG,EAAE;QACzB,MAAM,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACpF,MAAM,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionApply.d.ts

@@ -0,0 +1,4 @@
+import type { PermissionDecision } from "@/types";
+import type { SessionPermissions } from "../permissions.js";
+export declare function permissionApply(permissions: SessionPermissions, decision: PermissionDecision): void;
+//# sourceMappingURL=permissionApply.d.ts.map

package/dist/engine/permissions/permissionApply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionApply.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionApply.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAG5D,wBAAgB,eAAe,CAC7B,WAAW,EAAE,kBAAkB,EAC/B,QAAQ,EAAE,kBAAkB,GAC3B,IAAI,CAKN"}

package/dist/engine/permissions/permissionApply.js

@@ -0,0 +1,8 @@
+import { permissionAccessApply } from "./permissionAccessApply.js";
+export function permissionApply(permissions, decision) {
+    if (!decision.approved) {
+        return;
+    }
+    permissionAccessApply(permissions, decision.access);
+}
+//# sourceMappingURL=permissionApply.js.map

package/dist/engine/permissions/permissionApply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionApply.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionApply.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,MAAM,UAAU,eAAe,CAC7B,WAA+B,EAC/B,QAA4B;IAE5B,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACvB,OAAO;IACT,CAAC;IACD,qBAAqB,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;AACtD,CAAC"}

package/dist/engine/permissions/permissionApply.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permissionApply.spec.d.ts.map

package/dist/engine/permissions/permissionApply.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionApply.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionApply.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionApply.spec.js

@@ -0,0 +1,88 @@
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+import { permissionApply } from "./permissionApply.js";
+describe("permissionApply", () => {
+    const basePermissions = () => ({
+        workingDir: "/workspace",
+        writeDirs: [],
+        readDirs: [],
+        network: false
+    });
+    it("ignores unapproved decisions", () => {
+        const permissions = basePermissions();
+        const decision = {
+            token: "token-1",
+            agentId: "agent-1",
+            approved: false,
+            permission: "@network",
+            access: { kind: "network" }
+        };
+        permissionApply(permissions, decision);
+        expect(permissions.network).toBe(false);
+    });
+    it("adds approved write paths", () => {
+        const permissions = basePermissions();
+        const target = path.resolve("tmp", "write");
+        const decision = {
+            token: "token-2",
+            agentId: "agent-1",
+            approved: true,
+            permission: `@write:${target}`,
+            access: { kind: "write", path: target }
+        };
+        permissionApply(permissions, decision);
+        expect(permissions.writeDirs).toEqual(expect.arrayContaining([target]));
+        expect(permissions.readDirs).toEqual(expect.arrayContaining([target]));
+    });
+    it("skips relative paths", () => {
+        const permissions = basePermissions();
+        const decision = {
+            token: "token-3",
+            agentId: "agent-1",
+            approved: true,
+            permission: "@read:relative/path",
+            access: { kind: "read", path: "relative/path" }
+        };
+        permissionApply(permissions, decision);
+        expect(permissions.readDirs).toHaveLength(0);
+    });
+    it("rejects paths with null bytes", () => {
+        const permissions = basePermissions();
+        const decision = {
+            token: "token-4",
+            agentId: "agent-1",
+            approved: true,
+            permission: "@read:/etc/passwd\x00.txt",
+            access: { kind: "read", path: "/etc/passwd\x00.txt" }
+        };
+        permissionApply(permissions, decision);
+        // Path should be silently rejected
+        expect(permissions.readDirs).toHaveLength(0);
+    });
+    it("rejects paths with control characters", () => {
+        const permissions = basePermissions();
+        const decision = {
+            token: "token-5",
+            agentId: "agent-1",
+            approved: true,
+            permission: "@write:/home/user\x01file",
+            access: { kind: "write", path: "/home/user\x01file" }
+        };
+        permissionApply(permissions, decision);
+        expect(permissions.writeDirs).toHaveLength(0);
+    });
+    it("rejects excessively long paths", () => {
+        const permissions = basePermissions();
+        const longPath = "/" + "a".repeat(5000);
+        const decision = {
+            token: "token-6",
+            agentId: "agent-1",
+            approved: true,
+            permission: `@read:${longPath}`,
+            access: { kind: "read", path: longPath }
+        };
+        permissionApply(permissions, decision);
+        expect(permissions.readDirs).toHaveLength(0);
+    });
+});
+//# sourceMappingURL=permissionApply.spec.js.map

package/dist/engine/permissions/permissionApply.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionApply.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionApply.spec.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAI9C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,MAAM,eAAe,GAAG,GAAuB,EAAE,CAAC,CAAC;QACjD,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,KAAK;KACf,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAuB;YACnC,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,UAAU;YACtB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;SAC5B,CAAC;QAEF,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEvC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAuB;YACnC,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,UAAU,MAAM,EAAE;YAC9B,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;SACxC,CAAC;QAEF,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEvC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAuB;YACnC,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,qBAAqB;YACjC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE;SAChD,CAAC;QAEF,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEvC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAuB;YACnC,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,2BAA2B;YACvC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE;SACtD,CAAC;QAEF,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEvC,mCAAmC;QACnC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAuB;YACnC,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,2BAA2B;YACvC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE;SACtD,CAAC;QAEF,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEvC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAuB;YACnC,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,SAAS,QAAQ,EAAE;YAC/B,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;SACzC,CAAC;QAEF,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEvC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionBuildCron.d.ts

@@ -0,0 +1,3 @@
+import { type SessionPermissions } from "../permissions.js";
+export declare function permissionBuildCron(defaultPermissions: SessionPermissions, filesPath: string): SessionPermissions;
+//# sourceMappingURL=permissionBuildCron.d.ts.map

package/dist/engine/permissions/permissionBuildCron.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionBuildCron.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionBuildCron.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAIlF,wBAAgB,mBAAmB,CACjC,kBAAkB,EAAE,kBAAkB,EACtC,SAAS,EAAE,MAAM,GAChB,kBAAkB,CAYpB"}

package/dist/engine/permissions/permissionBuildCron.js

@@ -0,0 +1,13 @@
+import { normalizePermissions } from "../permissions.js";
+import { permissionEnsureDefaultFile } from "./permissionEnsureDefaultFile.js";
+export function permissionBuildCron(defaultPermissions, filesPath) {
+    const permissions = normalizePermissions({
+        workingDir: filesPath,
+        writeDirs: defaultPermissions.writeDirs,
+        readDirs: defaultPermissions.readDirs,
+        network: defaultPermissions.network
+    }, defaultPermissions.workingDir);
+    permissionEnsureDefaultFile(permissions, defaultPermissions);
+    return permissions;
+}
+//# sourceMappingURL=permissionBuildCron.js.map

package/dist/engine/permissions/permissionBuildCron.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionBuildCron.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionBuildCron.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAA2B,MAAM,mBAAmB,CAAC;AAElF,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAE/E,MAAM,UAAU,mBAAmB,CACjC,kBAAsC,EACtC,SAAiB;IAEjB,MAAM,WAAW,GAAG,oBAAoB,CACtC;QACE,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,kBAAkB,CAAC,SAAS;QACvC,QAAQ,EAAE,kBAAkB,CAAC,QAAQ;QACrC,OAAO,EAAE,kBAAkB,CAAC,OAAO;KACpC,EACD,kBAAkB,CAAC,UAAU,CAC9B,CAAC;IACF,2BAA2B,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IAC7D,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/engine/permissions/permissionBuildCron.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permissionBuildCron.spec.d.ts.map

package/dist/engine/permissions/permissionBuildCron.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionBuildCron.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionBuildCron.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionBuildCron.spec.js

@@ -0,0 +1,19 @@
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+import { permissionBuildCron } from "./permissionBuildCron.js";
+describe("permissionBuildCron", () => {
+    it("copies defaults into cron permissions", () => {
+        const defaults = {
+            workingDir: path.resolve("tmp", "workspace"),
+            writeDirs: [path.resolve("tmp", "write")],
+            readDirs: [path.resolve("tmp", "read")],
+            network: true
+        };
+        const permissions = permissionBuildCron(defaults, path.resolve("tmp", "cron"));
+        expect(permissions.workingDir).toBe(path.resolve("tmp", "cron"));
+        expect(permissions.writeDirs).toEqual(expect.arrayContaining(defaults.writeDirs));
+        expect(permissions.readDirs).toEqual(expect.arrayContaining(defaults.readDirs));
+        expect(permissions.network).toBe(true);
+    });
+});
+//# sourceMappingURL=permissionBuildCron.spec.js.map

package/dist/engine/permissions/permissionBuildCron.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionBuildCron.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionBuildCron.spec.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAG9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,QAAQ,GAAuB;YACnC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC;YAC5C,SAAS,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACzC,QAAQ,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACvC,OAAO,EAAE,IAAI;SACd,CAAC;QAEF,MAAM,WAAW,GAAG,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QAE/E,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QACjE,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QAClF,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChF,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionBuildDefault.d.ts

@@ -0,0 +1,3 @@
+import type { SessionPermissions } from "../permissions.js";
+export declare function permissionBuildDefault(workingDir: string, configDir: string): SessionPermissions;
+//# sourceMappingURL=permissionBuildDefault.d.ts.map

package/dist/engine/permissions/permissionBuildDefault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionBuildDefault.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionBuildDefault.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,kBAAkB,CAuBpB"}

package/dist/engine/permissions/permissionBuildDefault.js

@@ -0,0 +1,27 @@
+import path from "node:path";
+import { DEFAULT_ACTORS_PATH, DEFAULT_MEMORY_PATH, DEFAULT_SOUL_PATH, DEFAULT_TOOLS_PATH, DEFAULT_USER_PATH } from "../../paths.js";
+export function permissionBuildDefault(workingDir, configDir) {
+    const heartbeatDir = configDir ? path.resolve(configDir, "heartbeat") : null;
+    const skillsDir = configDir ? path.resolve(configDir, "skills") : null;
+    const writeDefaults = [
+        DEFAULT_SOUL_PATH,
+        DEFAULT_USER_PATH,
+        DEFAULT_ACTORS_PATH,
+        DEFAULT_TOOLS_PATH,
+        DEFAULT_MEMORY_PATH
+    ].map((entry) => path.resolve(entry));
+    const writeDirs = [
+        path.resolve(workingDir),
+        ...writeDefaults,
+        ...(heartbeatDir ? [heartbeatDir] : []),
+        ...(skillsDir ? [skillsDir] : [])
+    ];
+    const readDirs = [...writeDirs];
+    return {
+        workingDir: path.resolve(workingDir),
+        writeDirs: Array.from(new Set(writeDirs)),
+        readDirs: Array.from(new Set(readDirs)),
+        network: false
+    };
+}
+//# sourceMappingURL=permissionBuildDefault.js.map

package/dist/engine/permissions/permissionBuildDefault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionBuildDefault.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionBuildDefault.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,UAAU,sBAAsB,CACpC,UAAkB,EAClB,SAAiB;IAEjB,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,MAAM,aAAa,GAAG;QACpB,iBAAiB;QACjB,iBAAiB;QACjB,mBAAmB;QACnB,kBAAkB;QAClB,mBAAmB;KACpB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG;QAChB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QACxB,GAAG,aAAa;QAChB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;IAChC,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QACpC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC"}

package/dist/engine/permissions/permissionBuildDefault.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permissionBuildDefault.spec.d.ts.map

package/dist/engine/permissions/permissionBuildDefault.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionBuildDefault.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionBuildDefault.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionBuildDefault.spec.js

@@ -0,0 +1,23 @@
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+import { DEFAULT_MEMORY_PATH, DEFAULT_SOUL_PATH, DEFAULT_USER_PATH } from "../../paths.js";
+import { permissionBuildDefault } from "./permissionBuildDefault.js";
+describe("permissionBuildDefault", () => {
+    it("includes default and config directories", () => {
+        const workingDir = path.resolve("tmp", "workspace");
+        const configDir = path.resolve("tmp", "config");
+        const permissions = permissionBuildDefault(workingDir, configDir);
+        expect(permissions.workingDir).toBe(path.resolve(workingDir));
+        expect(permissions.writeDirs).toEqual(expect.arrayContaining([
+            path.resolve(workingDir),
+            path.resolve(DEFAULT_SOUL_PATH),
+            path.resolve(DEFAULT_USER_PATH),
+            path.resolve(DEFAULT_MEMORY_PATH),
+            path.resolve(configDir, "heartbeat"),
+            path.resolve(configDir, "skills")
+        ]));
+        expect(permissions.readDirs).toEqual(expect.arrayContaining(permissions.writeDirs));
+        expect(permissions.network).toBe(false);
+    });
+});
+//# sourceMappingURL=permissionBuildDefault.spec.js.map

package/dist/engine/permissions/permissionBuildDefault.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionBuildDefault.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionBuildDefault.spec.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAEhD,MAAM,WAAW,GAAG,sBAAsB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAElE,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,CACnC,MAAM,CAAC,eAAe,CAAC;YACrB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC;YACjC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC;SAClC,CAAC,CACH,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;QACpF,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionClone.d.ts

@@ -0,0 +1,7 @@
+import type { SessionPermissions } from "../permissions.js";
+/**
+ * Clones permissions so callers can mutate without affecting defaults.
+ * Expects: permissions.writeDirs/readDirs are treated as mutable arrays.
+ */
+export declare function permissionClone(permissions: SessionPermissions): SessionPermissions;
+//# sourceMappingURL=permissionClone.d.ts.map

package/dist/engine/permissions/permissionClone.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionClone.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionClone.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D;;;GAGG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,kBAAkB,GAAG,kBAAkB,CAMnF"}

package/dist/engine/permissions/permissionClone.js

@@ -0,0 +1,12 @@
+/**
+ * Clones permissions so callers can mutate without affecting defaults.
+ * Expects: permissions.writeDirs/readDirs are treated as mutable arrays.
+ */
+export function permissionClone(permissions) {
+    return {
+        ...permissions,
+        writeDirs: [...permissions.writeDirs],
+        readDirs: [...permissions.readDirs]
+    };
+}
+//# sourceMappingURL=permissionClone.js.map

package/dist/engine/permissions/permissionClone.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionClone.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionClone.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,WAA+B;IAC7D,OAAO;QACL,GAAG,WAAW;QACd,SAAS,EAAE,CAAC,GAAG,WAAW,CAAC,SAAS,CAAC;QACrC,QAAQ,EAAE,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC;KACpC,CAAC;AACJ,CAAC"}

package/dist/engine/permissions/permissionClone.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permissionClone.spec.d.ts.map

package/dist/engine/permissions/permissionClone.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionClone.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionClone.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionClone.spec.js

@@ -0,0 +1,17 @@
+import { describe, expect, it } from "vitest";
+import { permissionClone } from "./permissionClone.js";
+describe("permissionClone", () => {
+    it("clones arrays while preserving values", () => {
+        const permissions = {
+            workingDir: "/tmp/work",
+            writeDirs: ["/tmp/work"],
+            readDirs: ["/tmp/read"],
+            network: false
+        };
+        const cloned = permissionClone(permissions);
+        expect(cloned).toEqual(permissions);
+        expect(cloned.writeDirs).not.toBe(permissions.writeDirs);
+        expect(cloned.readDirs).not.toBe(permissions.readDirs);
+    });
+});
+//# sourceMappingURL=permissionClone.spec.js.map

package/dist/engine/permissions/permissionClone.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionClone.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionClone.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAG9C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,WAAW,GAAuB;YACtC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,CAAC,WAAW,CAAC;YACxB,QAAQ,EAAE,CAAC,WAAW,CAAC;YACvB,OAAO,EAAE,KAAK;SACf,CAAC;QAEF,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;QAE5C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionDescribeDecision.d.ts

@@ -0,0 +1,3 @@
+import type { PermissionAccess } from "@/types";
+export declare function permissionDescribeDecision(access: PermissionAccess): string;
+//# sourceMappingURL=permissionDescribeDecision.d.ts.map

package/dist/engine/permissions/permissionDescribeDecision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionDescribeDecision.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionDescribeDecision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAEhD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAQ3E"}

package/dist/engine/permissions/permissionDescribeDecision.js

@@ -0,0 +1,10 @@
+export function permissionDescribeDecision(access) {
+    if (access.kind === "network") {
+        return "network access";
+    }
+    if (access.kind === "read") {
+        return `read access to ${access.path}`;
+    }
+    return `write access to ${access.path}`;
+}
+//# sourceMappingURL=permissionDescribeDecision.js.map

package/dist/engine/permissions/permissionDescribeDecision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionDescribeDecision.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionDescribeDecision.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,0BAA0B,CAAC,MAAwB;IACjE,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,kBAAkB,MAAM,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,OAAO,mBAAmB,MAAM,CAAC,IAAI,EAAE,CAAC;AAC1C,CAAC"}

package/dist/engine/permissions/permissionDescribeDecision.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permissionDescribeDecision.spec.d.ts.map

package/dist/engine/permissions/permissionDescribeDecision.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionDescribeDecision.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionDescribeDecision.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionDescribeDecision.spec.js

@@ -0,0 +1,11 @@
+import { describe, expect, it } from "vitest";
+import { permissionDescribeDecision } from "./permissionDescribeDecision.js";
+describe("permissionDescribeDecision", () => {
+    it("describes network access", () => {
+        expect(permissionDescribeDecision({ kind: "network" })).toBe("network access");
+    });
+    it("describes read access", () => {
+        expect(permissionDescribeDecision({ kind: "read", path: "/tmp" })).toBe("read access to /tmp");
+    });
+});
+//# sourceMappingURL=permissionDescribeDecision.spec.js.map

package/dist/engine/permissions/permissionDescribeDecision.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionDescribeDecision.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionDescribeDecision.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAE7E,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,CAAC,0BAA0B,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,0BAA0B,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CACrE,qBAAqB,CACtB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionEnsureDefaultFile.d.ts

@@ -0,0 +1,3 @@
+import type { SessionPermissions } from "../permissions.js";
+export declare function permissionEnsureDefaultFile(permissions: SessionPermissions, defaults: Pick<SessionPermissions, "writeDirs" | "readDirs">): void;
+//# sourceMappingURL=permissionEnsureDefaultFile.d.ts.map

package/dist/engine/permissions/permissionEnsureDefaultFile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionEnsureDefaultFile.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionEnsureDefaultFile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,kBAAkB,EAC/B,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,GAAG,UAAU,CAAC,GAC3D,IAAI,CAKN"}

package/dist/engine/permissions/permissionEnsureDefaultFile.js

@@ -0,0 +1,7 @@
+export function permissionEnsureDefaultFile(permissions, defaults) {
+    const nextWrite = new Set([...permissions.writeDirs, ...defaults.writeDirs]);
+    const nextRead = new Set([...permissions.readDirs, ...defaults.readDirs]);
+    permissions.writeDirs = Array.from(nextWrite.values());
+    permissions.readDirs = Array.from(nextRead.values());
+}
+//# sourceMappingURL=permissionEnsureDefaultFile.js.map

package/dist/engine/permissions/permissionEnsureDefaultFile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionEnsureDefaultFile.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionEnsureDefaultFile.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,2BAA2B,CACzC,WAA+B,EAC/B,QAA4D;IAE5D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,SAAS,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,QAAQ,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1E,WAAW,CAAC,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,WAAW,CAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;AACvD,CAAC"}

package/dist/engine/permissions/permissionEnsureDefaultFile.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permissionEnsureDefaultFile.spec.d.ts.map

package/dist/engine/permissions/permissionEnsureDefaultFile.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionEnsureDefaultFile.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionEnsureDefaultFile.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionEnsureDefaultFile.spec.js

@@ -0,0 +1,19 @@
+import { describe, expect, it } from "vitest";
+import { permissionEnsureDefaultFile } from "./permissionEnsureDefaultFile.js";
+describe("permissionEnsureDefaultFile", () => {
+    it("merges default read/write directories", () => {
+        const permissions = {
+            workingDir: "/workspace",
+            writeDirs: ["/write"],
+            readDirs: ["/read"],
+            network: false
+        };
+        permissionEnsureDefaultFile(permissions, {
+            writeDirs: ["/write", "/extra-write"],
+            readDirs: ["/read", "/extra-read"]
+        });
+        expect(permissions.writeDirs).toEqual(expect.arrayContaining(["/write", "/extra-write"]));
+        expect(permissions.readDirs).toEqual(expect.arrayContaining(["/read", "/extra-read"]));
+    });
+});
+//# sourceMappingURL=permissionEnsureDefaultFile.spec.js.map

package/dist/engine/permissions/permissionEnsureDefaultFile.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionEnsureDefaultFile.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionEnsureDefaultFile.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAG9C,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAE/E,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,WAAW,GAAuB;YACtC,UAAU,EAAE,YAAY;YACxB,SAAS,EAAE,CAAC,QAAQ,CAAC;YACrB,QAAQ,EAAE,CAAC,OAAO,CAAC;YACnB,OAAO,EAAE,KAAK;SACf,CAAC;QAEF,2BAA2B,CAAC,WAAW,EAAE;YACvC,SAAS,EAAE,CAAC,QAAQ,EAAE,cAAc,CAAC;YACrC,QAAQ,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC;SACnC,CAAC,CAAC;QAEH,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,CACnC,MAAM,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CACnD,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,OAAO,CAClC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CACjD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionFormatTag.d.ts

@@ -0,0 +1,3 @@
+import type { PermissionAccess } from "@/types";
+export declare function permissionFormatTag(access: PermissionAccess): string;
+//# sourceMappingURL=permissionFormatTag.d.ts.map

package/dist/engine/permissions/permissionFormatTag.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionFormatTag.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionFormatTag.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAEhD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAKpE"}

package/dist/engine/permissions/permissionFormatTag.js

@@ -0,0 +1,7 @@
+export function permissionFormatTag(access) {
+    if (access.kind === "network") {
+        return "@network";
+    }
+    return `@${access.kind}:${access.path}`;
+}
+//# sourceMappingURL=permissionFormatTag.js.map

package/dist/engine/permissions/permissionFormatTag.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionFormatTag.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionFormatTag.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,mBAAmB,CAAC,MAAwB;IAC1D,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;AAC1C,CAAC"}

package/dist/engine/permissions/permissionFormatTag.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permissionFormatTag.spec.d.ts.map

package/dist/engine/permissions/permissionFormatTag.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionFormatTag.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionFormatTag.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionFormatTag.spec.js

@@ -0,0 +1,11 @@
+import { describe, expect, it } from "vitest";
+import { permissionFormatTag } from "./permissionFormatTag.js";
+describe("permissionFormatTag", () => {
+    it("formats network permissions", () => {
+        expect(permissionFormatTag({ kind: "network" })).toBe("@network");
+    });
+    it("formats path permissions", () => {
+        expect(permissionFormatTag({ kind: "read", path: "/tmp" })).toBe("@read:/tmp");
+    });
+});
+//# sourceMappingURL=permissionFormatTag.spec.js.map

package/dist/engine/permissions/permissionFormatTag.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionFormatTag.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionFormatTag.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionMergeDefault.d.ts

@@ -0,0 +1,3 @@
+import type { SessionPermissions } from "../permissions.js";
+export declare function permissionMergeDefault(permissions: SessionPermissions, defaultPermissions: SessionPermissions): SessionPermissions;
+//# sourceMappingURL=permissionMergeDefault.d.ts.map

package/dist/engine/permissions/permissionMergeDefault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionMergeDefault.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionMergeDefault.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,kBAAkB,EAC/B,kBAAkB,EAAE,kBAAkB,GACrC,kBAAkB,CAUpB"}

package/dist/engine/permissions/permissionMergeDefault.js

@@ -0,0 +1,12 @@
+export function permissionMergeDefault(permissions, defaultPermissions) {
+    const nextWrite = new Set([...defaultPermissions.writeDirs, ...permissions.writeDirs]);
+    const nextRead = new Set([...defaultPermissions.readDirs, ...permissions.readDirs]);
+    return {
+        // Use nullish coalescing to properly handle empty string
+        workingDir: permissions.workingDir?.trim() || defaultPermissions.workingDir,
+        writeDirs: Array.from(nextWrite.values()),
+        readDirs: Array.from(nextRead.values()),
+        network: permissions.network || defaultPermissions.network
+    };
+}
+//# sourceMappingURL=permissionMergeDefault.js.map

package/dist/engine/permissions/permissionMergeDefault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionMergeDefault.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionMergeDefault.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,sBAAsB,CACpC,WAA+B,EAC/B,kBAAsC;IAEtC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,kBAAkB,CAAC,SAAS,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;IACvF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,kBAAkB,CAAC,QAAQ,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpF,OAAO;QACL,yDAAyD;QACzD,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,kBAAkB,CAAC,UAAU;QAC3E,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QACzC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACvC,OAAO,EAAE,WAAW,CAAC,OAAO,IAAI,kBAAkB,CAAC,OAAO;KAC3D,CAAC;AACJ,CAAC"}

package/dist/engine/permissions/permissionMergeDefault.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permissionMergeDefault.spec.d.ts.map

package/dist/engine/permissions/permissionMergeDefault.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionMergeDefault.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionMergeDefault.spec.ts"],"names":[],"mappings":""}