daycare-cli 2026.2.9 → 2026.2.12

package/dist/engine/permissions/permissionAccessAllows.spec.js

@@ -1,111 +0,0 @@
-import { promises as fs } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { afterEach, describe, expect, it } from "vitest";
-import { permissionAccessAllows } from "./permissionAccessAllows.js";
-describe("permissionAccessAllows", () => {
-    const tempDirs = [];
-    afterEach(async () => {
-        await Promise.all(tempDirs.map((dir) => fs.rm(dir, { recursive: true, force: true })));
-        tempDirs.length = 0;
-    });
-    it("allows network access when enabled", async () => {
-        const allowed = await permissionAccessAllows({ workingDir: "/tmp", writeDirs: [], readDirs: [], network: true, events: false }, { kind: "network" });
-        expect(allowed).toBe(true);
-    });
-    it("allows events access when enabled", async () => {
-        const allowed = await permissionAccessAllows({ workingDir: "/tmp", writeDirs: [], readDirs: [], network: false, events: true }, { kind: "events" });
-        expect(allowed).toBe(true);
-    });
-    it("allows workspace access when workspace dir is writable", async () => {
-        const workspace = await fs.mkdtemp(path.join(os.tmpdir(), "perm-workspace-access-"));
-        tempDirs.push(workspace);
-        const allowed = await permissionAccessAllows({
-            workspaceDir: workspace,
-            workingDir: workspace,
-            writeDirs: [workspace],
-            readDirs: [workspace],
-            network: false,
-            events: false
-        }, { kind: "workspace" });
-        expect(allowed).toBe(true);
-    });
-    it("denies workspace access for app sandbox by default", async () => {
-        const workspace = await fs.mkdtemp(path.join(os.tmpdir(), "perm-workspace-app-"));
-        tempDirs.push(workspace);
-        const appDataDir = path.join(workspace, "apps", "my-app", "data");
-        await fs.mkdir(appDataDir, { recursive: true });
-        const allowed = await permissionAccessAllows({
-            workspaceDir: workspace,
-            workingDir: appDataDir,
-            writeDirs: [appDataDir],
-            readDirs: [workspace],
-            network: false,
-            events: false
-        }, { kind: "workspace" });
-        expect(allowed).toBe(false);
-    });
-    it("allows read access within allowed directories", async () => {
-        const dir = await fs.mkdtemp(path.join(os.tmpdir(), "perm-allow-"));
-        tempDirs.push(dir);
-        const target = path.join(dir, "file.txt");
-        await fs.writeFile(target, "ok", "utf8");
-        const allowed = await permissionAccessAllows({ workingDir: dir, writeDirs: [], readDirs: [dir], network: false, events: false }, { kind: "read", path: target });
-        expect(allowed).toBe(true);
-    });
-    it("treats empty readDirs as unrestricted read access", async () => {
-        const workspaceDir = await fs.mkdtemp(path.join(os.tmpdir(), "perm-workspace-"));
-        const outsideDir = await fs.mkdtemp(path.join(os.tmpdir(), "perm-outside-"));
-        tempDirs.push(workspaceDir, outsideDir);
-        const outsideFile = path.join(outsideDir, "outside.txt");
-        await fs.writeFile(outsideFile, "ok", "utf8");
-        const allowed = await permissionAccessAllows({ workingDir: workspaceDir, writeDirs: [], readDirs: [], network: false, events: false }, { kind: "read", path: outsideFile });
-        expect(allowed).toBe(true);
-    });
-    it("denies write access outside allowed directories", async () => {
-        const dir = await fs.mkdtemp(path.join(os.tmpdir(), "perm-deny-"));
-        tempDirs.push(dir);
-        const target = path.join(dir, "elsewhere", "file.txt");
-        const allowed = await permissionAccessAllows({ workingDir: "/tmp", writeDirs: ["/tmp"], readDirs: [], network: false, events: false }, { kind: "write", path: target });
-        expect(allowed).toBe(false);
-    });
-    it("does not imply write access from workingDir", async () => {
-        const dir = await fs.mkdtemp(path.join(os.tmpdir(), "perm-working-dir-"));
-        tempDirs.push(dir);
-        const target = path.join(dir, "file.txt");
-        const allowed = await permissionAccessAllows({ workingDir: dir, writeDirs: [], readDirs: [], network: false, events: false }, { kind: "write", path: target });
-        expect(allowed).toBe(false);
-    });
-    it("allows write access when path is explicitly in writeDirs", async () => {
-        const dir = await fs.mkdtemp(path.join(os.tmpdir(), "perm-write-dir-"));
-        tempDirs.push(dir);
-        const target = path.join(dir, "file.txt");
-        const allowed = await permissionAccessAllows({ workingDir: "/tmp", writeDirs: [dir], readDirs: [], network: false, events: false }, { kind: "write", path: target });
-        expect(allowed).toBe(true);
-    });
-    it("denies writing app policy files from broad directory grants", async () => {
-        const workspace = await fs.mkdtemp(path.join(os.tmpdir(), "perm-app-policy-"));
-        tempDirs.push(workspace);
-        const appDir = path.join(workspace, "apps", "my-app");
-        await fs.mkdir(appDir, { recursive: true });
-        const target = path.join(appDir, "PERMISSIONS.md");
-        const allowed = await permissionAccessAllows({ workingDir: workspace, writeDirs: [workspace], readDirs: [], network: false, events: false }, { kind: "write", path: target });
-        expect(allowed).toBe(false);
-    });
-    it("allows writing app policy files only with explicit file grant", async () => {
-        const workspace = await fs.mkdtemp(path.join(os.tmpdir(), "perm-app-policy-explicit-"));
-        tempDirs.push(workspace);
-        const appDir = path.join(workspace, "apps", "my-app");
-        await fs.mkdir(appDir, { recursive: true });
-        const target = path.join(appDir, "APP.md");
-        const allowed = await permissionAccessAllows({
-            workingDir: workspace,
-            writeDirs: [workspace, target],
-            readDirs: [],
-            network: false,
-            events: false
-        }, { kind: "write", path: target });
-        expect(allowed).toBe(true);
-    });
-});
-//# sourceMappingURL=permissionAccessAllows.spec.js.map

package/dist/engine/permissions/permissionAccessAllows.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"permissionAccessAllows.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessAllows.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAEzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACpC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,SAAS,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACvF,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,OAAO,GAAG,MAAM,sBAAsB,CACxC,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EACjF,EAAE,IAAI,EAAE,SAAS,EAAE,CACtB,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,OAAO,GAAG,MAAM,sBAAsB,CACxC,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EACjF,EAAE,IAAI,EAAE,QAAQ,EAAE,CACrB,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;QACrF,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,sBAAsB,CACxC;YACI,YAAY,EAAE,SAAS;YACvB,UAAU,EAAE,SAAS;YACrB,SAAS,EAAE,CAAC,SAAS,CAAC;YACtB,QAAQ,EAAE,CAAC,SAAS,CAAC;YACrB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SAChB,EACD,EAAE,IAAI,EAAE,WAAW,EAAE,CACxB,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAClF,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClE,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,sBAAsB,CACxC;YACI,YAAY,EAAE,SAAS;YACvB,UAAU,EAAE,UAAU;YACtB,SAAS,EAAE,CAAC,UAAU,CAAC;YACvB,QAAQ,EAAE,CAAC,SAAS,CAAC;YACrB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SAChB,EACD,EAAE,IAAI,EAAE,WAAW,EAAE,CACxB,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;QACpE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC1C,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,sBAAsB,CACxC,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAClF,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CACjC,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;QACjF,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;QAC7E,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QACzD,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAE9C,MAAM,OAAO,GAAG,MAAM,sBAAsB,CACxC,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EACxF,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,CACtC,CAAC;QAEF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;QACnE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,sBAAsB,CACxC,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EACxF,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAClC,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAC1E,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,sBAAsB,CACxC,EAAE,UAAU,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAC/E,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAClC,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;QACxE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,sBAAsB,CACxC,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EACrF,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAClC,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;QAC/E,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtD,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAEnD,MAAM,OAAO,GAAG,MAAM,sBAAsB,CACxC,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAC9F,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAClC,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAC,CAAC;QACxF,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtD,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAE3C,MAAM,OAAO,GAAG,MAAM,sBAAsB,CACxC;YACI,UAAU,EAAE,SAAS;YACrB,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;YAC9B,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SAChB,EACD,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAClC,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionAccessApply.d.ts

@@ -1,7 +0,0 @@
-import type { PermissionAccess, SessionPermissions } from "@/types";
-/**
- * Applies a permission access to a permissions object in place.
- * Returns true when applied; false when invalid or unsupported.
- */
-export declare function permissionAccessApply(permissions: SessionPermissions, access: PermissionAccess): boolean;
-//# sourceMappingURL=permissionAccessApply.d.ts.map

package/dist/engine/permissions/permissionAccessApply.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"permissionAccessApply.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessApply.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAIpE;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,kBAAkB,EAAE,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAoDxG"}

package/dist/engine/permissions/permissionAccessApply.js

@@ -1,55 +0,0 @@
-import path from "node:path";
-import { pathSanitizeAndResolve } from "./pathSanitize.js";
-import { permissionWorkspacePathResolve } from "./permissionWorkspacePathResolve.js";
-/**
- * Applies a permission access to a permissions object in place.
- * Returns true when applied; false when invalid or unsupported.
- */
-export function permissionAccessApply(permissions, access) {
-    if (access.kind === "network") {
-        permissions.network = true;
-        return true;
-    }
-    if (access.kind === "events") {
-        permissions.events = true;
-        return true;
-    }
-    if (access.kind === "workspace") {
-        const resolvedWorkspace = permissionWorkspacePathResolve(permissions);
-        const writeDirs = new Set(permissions.writeDirs);
-        writeDirs.add(resolvedWorkspace);
-        permissions.writeDirs = Array.from(writeDirs.values());
-        const readDirs = new Set(permissions.readDirs);
-        readDirs.add(resolvedWorkspace);
-        permissions.readDirs = Array.from(readDirs.values());
-        return true;
-    }
-    if (!path.isAbsolute(access.path)) {
-        return false;
-    }
-    let resolved;
-    try {
-        resolved = pathSanitizeAndResolve(access.path);
-    }
-    catch {
-        return false;
-    }
-    if (access.kind === "write") {
-        const writeDirs = new Set(permissions.writeDirs);
-        writeDirs.add(resolved);
-        permissions.writeDirs = Array.from(writeDirs.values());
-        // Write access requires read access to the same path.
-        const readDirs = new Set(permissions.readDirs);
-        readDirs.add(resolved);
-        permissions.readDirs = Array.from(readDirs.values());
-        return true;
-    }
-    if (access.kind === "read") {
-        const next = new Set(permissions.readDirs);
-        next.add(resolved);
-        permissions.readDirs = Array.from(next.values());
-        return true;
-    }
-    return false;
-}
-//# sourceMappingURL=permissionAccessApply.js.map

package/dist/engine/permissions/permissionAccessApply.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"permissionAccessApply.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessApply.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AAErF;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAA+B,EAAE,MAAwB;IAC3F,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,WAAW,CAAC,OAAO,GAAG,IAAI,CAAC;QAC3B,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,WAAW,CAAC,MAAM,GAAG,IAAI,CAAC;QAC1B,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC9B,MAAM,iBAAiB,GAAG,8BAA8B,CAAC,WAAW,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACjD,SAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACjC,WAAW,CAAC,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QAEvD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC/C,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAChC,WAAW,CAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACD,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACjD,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxB,WAAW,CAAC,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QAEvD,sDAAsD;QACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC/C,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvB,WAAW,CAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnB,WAAW,CAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC"}

package/dist/engine/permissions/permissionAccessApply.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=permissionAccessApply.spec.d.ts.map

package/dist/engine/permissions/permissionAccessApply.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"permissionAccessApply.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessApply.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionAccessApply.spec.js

@@ -1,56 +0,0 @@
-import path from "node:path";
-import { describe, expect, it } from "vitest";
-import { permissionAccessApply } from "./permissionAccessApply.js";
-describe("permissionAccessApply", () => {
-    const basePermissions = () => ({
-        workspaceDir: "/workspace",
-        workingDir: "/tmp",
-        writeDirs: [],
-        readDirs: [],
-        network: false,
-        events: false
-    });
-    it("applies network access", () => {
-        const permissions = basePermissions();
-        const applied = permissionAccessApply(permissions, { kind: "network" });
-        expect(applied).toBe(true);
-        expect(permissions.network).toBe(true);
-    });
-    it("applies events access", () => {
-        const permissions = basePermissions();
-        const applied = permissionAccessApply(permissions, { kind: "events" });
-        expect(applied).toBe(true);
-        expect(permissions.events).toBe(true);
-    });
-    it("applies workspace access to the shared workspace root", () => {
-        const permissions = {
-            workspaceDir: "/workspace",
-            workingDir: "/workspace/apps/my-app/data",
-            writeDirs: ["/workspace/apps/my-app/data"],
-            readDirs: ["/workspace"],
-            network: false,
-            events: false
-        };
-        const applied = permissionAccessApply(permissions, { kind: "workspace" });
-        expect(applied).toBe(true);
-        expect(permissions.writeDirs).toContain("/workspace");
-        expect(permissions.readDirs).toContain("/workspace");
-    });
-    it("applies read/write paths", () => {
-        const permissions = basePermissions();
-        const readPath = path.resolve("/tmp/read");
-        const writePath = path.resolve("/tmp/write");
-        expect(permissionAccessApply(permissions, { kind: "read", path: readPath })).toBe(true);
-        expect(permissionAccessApply(permissions, { kind: "write", path: writePath })).toBe(true);
-        expect(permissions.readDirs).toContain(readPath);
-        expect(permissions.readDirs).toContain(writePath);
-        expect(permissions.writeDirs).toContain(writePath);
-    });
-    it("rejects non-absolute paths", () => {
-        const permissions = basePermissions();
-        const applied = permissionAccessApply(permissions, { kind: "read", path: "relative" });
-        expect(applied).toBe(false);
-        expect(permissions.readDirs).toHaveLength(0);
-    });
-});
-//# sourceMappingURL=permissionAccessApply.spec.js.map

package/dist/engine/permissions/permissionAccessApply.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"permissionAccessApply.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessApply.spec.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACnC,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,CAAC;QAC3B,YAAY,EAAE,YAAY;QAC1B,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,EAAc;QACzB,QAAQ,EAAE,EAAc;QACxB,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,KAAK;KAChB,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAC9B,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,qBAAqB,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC7B,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,qBAAqB,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvE,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC7D,MAAM,WAAW,GAAG;YAChB,YAAY,EAAE,YAAY;YAC1B,UAAU,EAAE,6BAA6B;YACzC,SAAS,EAAE,CAAC,6BAA6B,CAAC;YAC1C,QAAQ,EAAE,CAAC,YAAY,CAAC;YACxB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SAChB,CAAC;QACF,MAAM,OAAO,GAAG,qBAAqB,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QACtD,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAChC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,CAAC,qBAAqB,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxF,MAAM,CAAC,qBAAqB,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1F,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QAClC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,qBAAqB,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACvF,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionAccessParse.d.ts

@@ -1,7 +0,0 @@
-import type { PermissionAccess } from "@/types";
-/**
- * Parses a permission tag string into a PermissionAccess union.
- * Expects: value is @network, @events, @workspace, @read:<path>, or @write:<path>.
- */
-export declare function permissionAccessParse(value: string): PermissionAccess;
-//# sourceMappingURL=permissionAccessParse.d.ts.map

package/dist/engine/permissions/permissionAccessParse.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"permissionAccessParse.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessParse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAEhD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,CA0BrE"}

package/dist/engine/permissions/permissionAccessParse.js

@@ -1,32 +0,0 @@
-/**
- * Parses a permission tag string into a PermissionAccess union.
- * Expects: value is @network, @events, @workspace, @read:<path>, or @write:<path>.
- */
-export function permissionAccessParse(value) {
-    const trimmed = value.trim();
-    if (trimmed === "@network") {
-        return { kind: "network" };
-    }
-    if (trimmed === "@events") {
-        return { kind: "events" };
-    }
-    if (trimmed === "@workspace") {
-        return { kind: "workspace" };
-    }
-    if (trimmed.startsWith("@read:")) {
-        const pathValue = trimmed.slice("@read:".length).trim();
-        if (!pathValue) {
-            throw new Error("Read permission requires a path.");
-        }
-        return { kind: "read", path: pathValue };
-    }
-    if (trimmed.startsWith("@write:")) {
-        const pathValue = trimmed.slice("@write:".length).trim();
-        if (!pathValue) {
-            throw new Error("Write permission requires a path.");
-        }
-        return { kind: "write", path: pathValue };
-    }
-    throw new Error("Permission must be @network, @events, @workspace, @read:<path>, or @write:<path>.");
-}
-//# sourceMappingURL=permissionAccessParse.js.map

package/dist/engine/permissions/permissionAccessParse.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"permissionAccessParse.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessParse.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;AACzG,CAAC"}

package/dist/engine/permissions/permissionAccessParse.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=permissionAccessParse.spec.d.ts.map

package/dist/engine/permissions/permissionAccessParse.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"permissionAccessParse.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessParse.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionAccessParse.spec.js

@@ -1,17 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { permissionAccessParse } from "./permissionAccessParse.js";
-describe("permissionAccessParse", () => {
-    it("parses @network, @events, and @workspace", () => {
-        expect(permissionAccessParse("@network")).toEqual({ kind: "network" });
-        expect(permissionAccessParse("@events")).toEqual({ kind: "events" });
-        expect(permissionAccessParse("@workspace")).toEqual({ kind: "workspace" });
-    });
-    it("parses @read and @write paths", () => {
-        expect(permissionAccessParse("@read:/tmp")).toEqual({ kind: "read", path: "/tmp" });
-        expect(permissionAccessParse("@write:/var/log")).toEqual({ kind: "write", path: "/var/log" });
-    });
-    it("rejects invalid tags", () => {
-        expect(() => permissionAccessParse("read:/tmp")).toThrow("Permission must be");
-    });
-});
-//# sourceMappingURL=permissionAccessParse.spec.js.map

package/dist/engine/permissions/permissionAccessParse.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"permissionAccessParse.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionAccessParse.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACvE,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACpF,MAAM,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC5B,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionApply.d.ts

@@ -1,4 +0,0 @@
-import type { PermissionDecision } from "@/types";
-import type { SessionPermissions } from "../permissions.js";
-export declare function permissionApply(permissions: SessionPermissions, decision: PermissionDecision): void;
-//# sourceMappingURL=permissionApply.d.ts.map

package/dist/engine/permissions/permissionApply.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"permissionApply.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionApply.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAG5D,wBAAgB,eAAe,CAAC,WAAW,EAAE,kBAAkB,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAOnG"}

package/dist/engine/permissions/permissionApply.js

@@ -1,10 +0,0 @@
-import { permissionAccessApply } from "./permissionAccessApply.js";
-export function permissionApply(permissions, decision) {
-    if (!decision.approved) {
-        return;
-    }
-    for (const permission of decision.permissions) {
-        permissionAccessApply(permissions, permission.access);
-    }
-}
-//# sourceMappingURL=permissionApply.js.map

package/dist/engine/permissions/permissionApply.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"permissionApply.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionApply.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,MAAM,UAAU,eAAe,CAAC,WAA+B,EAAE,QAA4B;IACzF,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO;IACX,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC5C,qBAAqB,CAAC,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1D,CAAC;AACL,CAAC"}

package/dist/engine/permissions/permissionApply.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=permissionApply.spec.d.ts.map

package/dist/engine/permissions/permissionApply.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"permissionApply.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionApply.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionApply.spec.js

@@ -1,104 +0,0 @@
-import path from "node:path";
-import { describe, expect, it } from "vitest";
-import { permissionApply } from "./permissionApply.js";
-describe("permissionApply", () => {
-    const basePermissions = () => ({
-        workingDir: "/workspace",
-        writeDirs: [],
-        readDirs: [],
-        network: false,
-        events: false
-    });
-    it("ignores unapproved decisions", () => {
-        const permissions = basePermissions();
-        const decision = {
-            token: "token-1",
-            agentId: "agent-1",
-            approved: false,
-            permissions: [{ permission: "@network", access: { kind: "network" } }]
-        };
-        permissionApply(permissions, decision);
-        expect(permissions.network).toBe(false);
-    });
-    it("applies approved events access", () => {
-        const permissions = basePermissions();
-        const decision = {
-            token: "token-events",
-            agentId: "agent-1",
-            approved: true,
-            permissions: [{ permission: "@events", access: { kind: "events" } }]
-        };
-        permissionApply(permissions, decision);
-        expect(permissions.events).toBe(true);
-    });
-    it("adds approved write paths", () => {
-        const permissions = basePermissions();
-        const target = path.resolve("tmp", "write");
-        const decision = {
-            token: "token-2",
-            agentId: "agent-1",
-            approved: true,
-            permissions: [{ permission: `@write:${target}`, access: { kind: "write", path: target } }]
-        };
-        permissionApply(permissions, decision);
-        expect(permissions.writeDirs).toEqual(expect.arrayContaining([target]));
-        expect(permissions.readDirs).toEqual(expect.arrayContaining([target]));
-    });
-    it("skips relative paths", () => {
-        const permissions = basePermissions();
-        const decision = {
-            token: "token-3",
-            agentId: "agent-1",
-            approved: true,
-            permissions: [{ permission: "@read:relative/path", access: { kind: "read", path: "relative/path" } }]
-        };
-        permissionApply(permissions, decision);
-        expect(permissions.readDirs).toHaveLength(0);
-    });
-    it("rejects paths with null bytes", () => {
-        const permissions = basePermissions();
-        const decision = {
-            token: "token-4",
-            agentId: "agent-1",
-            approved: true,
-            permissions: [
-                {
-                    permission: "@read:/etc/passwd\x00.txt",
-                    access: { kind: "read", path: "/etc/passwd\x00.txt" }
-                }
-            ]
-        };
-        permissionApply(permissions, decision);
-        // Path should be silently rejected
-        expect(permissions.readDirs).toHaveLength(0);
-    });
-    it("rejects paths with control characters", () => {
-        const permissions = basePermissions();
-        const decision = {
-            token: "token-5",
-            agentId: "agent-1",
-            approved: true,
-            permissions: [
-                {
-                    permission: "@write:/home/user\x01file",
-                    access: { kind: "write", path: "/home/user\x01file" }
-                }
-            ]
-        };
-        permissionApply(permissions, decision);
-        expect(permissions.writeDirs).toHaveLength(0);
-    });
-    it("rejects excessively long paths", () => {
-        const permissions = basePermissions();
-        const longPath = "/" + "a".repeat(5000);
-        const decision = {
-            token: "token-6",
-            agentId: "agent-1",
-            approved: true,
-            permissions: [{ permission: `@read:${longPath}`, access: { kind: "read", path: longPath } }]
-        };
-        permissionApply(permissions, decision);
-        expect(permissions.readDirs).toHaveLength(0);
-    });
-});
-//# sourceMappingURL=permissionApply.spec.js.map

package/dist/engine/permissions/permissionApply.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"permissionApply.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionApply.spec.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAI9C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC7B,MAAM,eAAe,GAAG,GAAuB,EAAE,CAAC,CAAC;QAC/C,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,KAAK;KAChB,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACpC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAuB;YACjC,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC;SACzE,CAAC;QAEF,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEvC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACtC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAuB;YACjC,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;SACvE,CAAC;QAEF,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEvC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACjC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAuB;YACjC,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,CAAC,EAAE,UAAU,EAAE,UAAU,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;SAC7F,CAAC;QAEF,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEvC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC5B,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAuB;YACjC,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,CAAC,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,CAAC;SACxG,CAAC;QAEF,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEvC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACrC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAuB;YACjC,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE;gBACT;oBACI,UAAU,EAAE,2BAA2B;oBACvC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE;iBACxD;aACJ;SACJ,CAAC;QAEF,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEvC,mCAAmC;QACnC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC7C,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAuB;YACjC,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE;gBACT;oBACI,UAAU,EAAE,2BAA2B;oBACvC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE;iBACxD;aACJ;SACJ,CAAC;QAEF,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEvC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACtC,MAAM,WAAW,GAAG,eAAe,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAuB;YACjC,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;SAC/F,CAAC;QAEF,eAAe,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEvC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionClone.d.ts

@@ -1,7 +0,0 @@
-import type { SessionPermissions } from "../permissions.js";
-/**
- * Clones permissions so callers can mutate without affecting defaults.
- * Expects: permissions.writeDirs/readDirs are treated as mutable arrays.
- */
-export declare function permissionClone(permissions: SessionPermissions): SessionPermissions;
-//# sourceMappingURL=permissionClone.d.ts.map

package/dist/engine/permissions/permissionClone.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"permissionClone.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionClone.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D;;;GAGG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,kBAAkB,GAAG,kBAAkB,CAMnF"}

package/dist/engine/permissions/permissionClone.js

@@ -1,12 +0,0 @@
-/**
- * Clones permissions so callers can mutate without affecting defaults.
- * Expects: permissions.writeDirs/readDirs are treated as mutable arrays.
- */
-export function permissionClone(permissions) {
-    return {
-        ...permissions,
-        writeDirs: [...permissions.writeDirs],
-        readDirs: [...permissions.readDirs]
-    };
-}
-//# sourceMappingURL=permissionClone.js.map

package/dist/engine/permissions/permissionClone.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"permissionClone.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionClone.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,WAA+B;IAC3D,OAAO;QACH,GAAG,WAAW;QACd,SAAS,EAAE,CAAC,GAAG,WAAW,CAAC,SAAS,CAAC;QACrC,QAAQ,EAAE,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC;KACtC,CAAC;AACN,CAAC"}

package/dist/engine/permissions/permissionClone.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=permissionClone.spec.d.ts.map

package/dist/engine/permissions/permissionClone.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"permissionClone.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionClone.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionClone.spec.js

@@ -1,18 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { permissionClone } from "./permissionClone.js";
-describe("permissionClone", () => {
-    it("clones arrays while preserving values", () => {
-        const permissions = {
-            workingDir: "/tmp/work",
-            writeDirs: ["/tmp/work"],
-            readDirs: ["/tmp/read"],
-            network: false,
-            events: false
-        };
-        const cloned = permissionClone(permissions);
-        expect(cloned).toEqual(permissions);
-        expect(cloned.writeDirs).not.toBe(permissions.writeDirs);
-        expect(cloned.readDirs).not.toBe(permissions.readDirs);
-    });
-});
-//# sourceMappingURL=permissionClone.spec.js.map

package/dist/engine/permissions/permissionClone.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"permissionClone.spec.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionClone.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAG9C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC7C,MAAM,WAAW,GAAuB;YACpC,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,CAAC,WAAW,CAAC;YACxB,QAAQ,EAAE,CAAC,WAAW,CAAC;YACvB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK;SAChB,CAAC;QAEF,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;QAE5C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/engine/permissions/permissionDescribeDecision.d.ts

@@ -1,3 +0,0 @@
-import type { PermissionAccess } from "@/types";
-export declare function permissionDescribeDecision(access: PermissionAccess): string;
-//# sourceMappingURL=permissionDescribeDecision.d.ts.map

package/dist/engine/permissions/permissionDescribeDecision.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"permissionDescribeDecision.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionDescribeDecision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAEhD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAc3E"}

package/dist/engine/permissions/permissionDescribeDecision.js

@@ -1,16 +0,0 @@
-export function permissionDescribeDecision(access) {
-    if (access.kind === "network") {
-        return "network access";
-    }
-    if (access.kind === "events") {
-        return "events access";
-    }
-    if (access.kind === "workspace") {
-        return "workspace write access";
-    }
-    if (access.kind === "read") {
-        return `read access to ${access.path}`;
-    }
-    return `write access to ${access.path}`;
-}
-//# sourceMappingURL=permissionDescribeDecision.js.map

package/dist/engine/permissions/permissionDescribeDecision.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"permissionDescribeDecision.js","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionDescribeDecision.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,0BAA0B,CAAC,MAAwB;IAC/D,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,gBAAgB,CAAC;IAC5B,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO,eAAe,CAAC;IAC3B,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC9B,OAAO,wBAAwB,CAAC;IACpC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO,kBAAkB,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,mBAAmB,MAAM,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC"}

package/dist/engine/permissions/permissionDescribeDecision.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=permissionDescribeDecision.spec.d.ts.map

package/dist/engine/permissions/permissionDescribeDecision.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"permissionDescribeDecision.spec.d.ts","sourceRoot":"","sources":["../../../sources/engine/permissions/permissionDescribeDecision.spec.ts"],"names":[],"mappings":""}

package/dist/engine/permissions/permissionDescribeDecision.spec.js

@@ -1,17 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { permissionDescribeDecision } from "./permissionDescribeDecision.js";
-describe("permissionDescribeDecision", () => {
-    it("describes network access", () => {
-        expect(permissionDescribeDecision({ kind: "network" })).toBe("network access");
-    });
-    it("describes events access", () => {
-        expect(permissionDescribeDecision({ kind: "events" })).toBe("events access");
-    });
-    it("describes workspace access", () => {
-        expect(permissionDescribeDecision({ kind: "workspace" })).toBe("workspace write access");
-    });
-    it("describes read access", () => {
-        expect(permissionDescribeDecision({ kind: "read", path: "/tmp" })).toBe("read access to /tmp");
-    });
-});
-//# sourceMappingURL=permissionDescribeDecision.spec.js.map