eminiar 0.8.0 → 0.8.1

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "eminiar",
   "displayName": "Eminiar",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Local-first context, memory and knowledge graph for Claude Code: sandboxed execution, FTS5 + vector search, session continuity, code graph.",
   "author": {
     "name": "Ryan Dick"

package/README.md

@@ -58,7 +58,8 @@ Everything runs locally in one SQLite database per project.
 `em_execute`, `em_batch_execute` and `em_execute_file` run shell, JavaScript and TypeScript, plus
 Python, Ruby, Go, PHP, Perl, R, Elixir, Rust and C# when they are installed. Output over 5 KB is
 indexed. Claude gets back only the sections that match its `intent`. Snippets obey your Claude
-Code `permissions.deny` rules.
+Code `Bash` deny rules, and `em_execute_file` refuses a `path` that one of your `Read` deny rules
+matches ([which rule forms](docs/how-it-works.md#sandbox)).
 
 ### 🔎 Hybrid search — keyword and meaning together
 

package/dist/hook.js

@@ -3941,11 +3941,11 @@ var require_out = __commonJS({
       async.read(path2, getSettings(optionsOrSettingsOrCallback), callback);
     }
     exports.stat = stat;
-    function statSync5(path2, optionsOrSettings) {
+    function statSync6(path2, optionsOrSettings) {
       const settings = getSettings(optionsOrSettings);
       return sync.read(path2, settings);
     }
-    exports.statSync = statSync5;
+    exports.statSync = statSync6;
     function getSettings(settingsOrOptions = {}) {
       if (settingsOrOptions instanceof settings_1.default) {
         return settingsOrOptions;
@@ -4403,7 +4403,7 @@ var require_queue = __commonJS({
       if (!(_concurrency >= 1)) {
         throw new Error("fastqueue concurrency must be equal to or greater than 1");
       }
-      var cache2 = reusify(Task);
+      var cache3 = reusify(Task);
       var queueHead = null;
       var queueTail = null;
       var _running = 0;
@@ -4482,7 +4482,7 @@ var require_queue = __commonJS({
         return _running === 0 && self.length() === 0;
       }
       function push(value, done) {
-        var current = cache2.get();
+        var current = cache3.get();
         current.context = context;
         current.release = release;
         current.value = value;
@@ -4503,7 +4503,7 @@ var require_queue = __commonJS({
         }
       }
       function unshift(value, done) {
-        var current = cache2.get();
+        var current = cache3.get();
         current.context = context;
         current.release = release;
         current.value = value;
@@ -4525,7 +4525,7 @@ var require_queue = __commonJS({
       }
       function release(holder) {
         if (holder) {
-          cache2.release(holder);
+          cache3.release(holder);
         }
         var next = queueHead;
         if (next && _running <= _concurrency) {
@@ -4575,7 +4575,7 @@ var require_queue = __commonJS({
             errorHandler2(new Error("abort"), val);
           }
           callback.call(context2, new Error("abort"));
-          cache2.release(current);
+          cache3.release(current);
           current = next;
         }
         self.drain = noop;
@@ -25733,21 +25733,21 @@ function visit(schema, fnOrHandlers) {
     const h = fnOrHandlers[node2._zod.def.type];
     return h ? h(node2, rewritten) : node2;
   };
-  const cache2 = /* @__PURE__ */ new Map();
+  const cache3 = /* @__PURE__ */ new Map();
   function run(s) {
-    const cached3 = cache2.get(s);
+    const cached3 = cache3.get(s);
     if (cached3 === RESOLVING) {
       return new $ZodLazy({
         type: "lazy",
-        getter: () => cache2.get(s)
+        getter: () => cache3.get(s)
       });
     }
     if (cached3 !== void 0)
       return cached3;
-    cache2.set(s, RESOLVING);
+    cache3.set(s, RESOLVING);
     const inner = mapInner(s);
     const mapped = fn(inner, inner !== s);
-    cache2.set(s, mapped);
+    cache3.set(s, mapped);
     return mapped;
   }
   function mapInner(s) {
@@ -28947,8 +28947,8 @@ var preCompact = (input2) => {
 
 // src/hooks/routing.ts
 init_esm_shims();
-import { realpathSync as realpathSync3, statSync as statSync3 } from "fs";
-import { extname as extname2, join as join10, relative as relative4, resolve as resolve3 } from "path";
+import { realpathSync as realpathSync4, statSync as statSync4 } from "fs";
+import { extname as extname2, join as join11, relative as relative4, resolve as resolve3 } from "path";
 
 // src/docs/manifest.ts
 init_esm_shims();
@@ -28998,10 +28998,107 @@ function readManifest(ctx) {
   return readManifestAt(manifestPath(ctx));
 }
 
+// src/permissions/settings.ts
+init_esm_shims();
+import { existsSync as existsSync4, readFileSync as readFileSync4, realpathSync as realpathSync3, statSync as statSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join5 } from "path";
+
+// src/permissions/rules.ts
+init_esm_shims();
+function parseRule(raw) {
+  const m = /^([A-Za-z][\w-]*)(?:\((.*)\))?$/s.exec(raw.trim());
+  if (!m) return void 0;
+  return { raw, tool: m[1], pattern: m[2] };
+}
+function escapeRe(s) {
+  return s.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+}
+var readRegexCache = /* @__PURE__ */ new Map();
+function readRegex(pattern) {
+  let re = readRegexCache.get(pattern);
+  if (!re) {
+    if (readRegexCache.size >= 1024) readRegexCache.clear();
+    re = new RegExp(
+      `^${pattern.split("**").map((seg) => seg.split("*").map(escapeRe).join("[^/]*")).join(".*")}$`
+    );
+    readRegexCache.set(pattern, re);
+  }
+  return re;
+}
+function matchRead(rule, absPath) {
+  if (rule.tool !== "Read") return false;
+  if (rule.pattern === void 0) return true;
+  let p = rule.pattern;
+  if (p.startsWith("~")) p = (process.env.HOME ?? "") + p.slice(1);
+  return readRegex(p).test(absPath);
+}
+
+// src/permissions/split.ts
+init_esm_shims();
+
+// src/permissions/settings.ts
+function readRules(file3) {
+  if (!existsSync4(file3)) return {};
+  try {
+    const s = JSON.parse(readFileSync4(file3, "utf8"));
+    return s.permissions ?? {};
+  } catch {
+    return {};
+  }
+}
+function stamp(file3) {
+  try {
+    return statSync2(file3).mtimeMs;
+  } catch {
+    return -1;
+  }
+}
+var cache2 = /* @__PURE__ */ new Map();
+function loadPermissionRules(root, extraDeny = []) {
+  const files = [
+    join5(homedir2(), ".claude", "settings.json"),
+    join5(root, ".claude", "settings.json"),
+    join5(root, ".claude", "settings.local.json")
+  ];
+  const key = `${root}\0${extraDeny.join("\0")}`;
+  const stamps = files.map(stamp);
+  const hit = cache2.get(key);
+  if (hit?.stamps.every((s, i) => s === stamps[i])) return hit.rules;
+  const out = { allow: [], deny: [], ask: [] };
+  const push = (list, raws) => {
+    for (const raw of raws ?? []) {
+      const r = parseRule(raw);
+      if (r) list.push(r);
+    }
+  };
+  for (const f of files) {
+    const p = readRules(f);
+    push(out.allow, p.allow);
+    push(out.deny, p.deny);
+    push(out.ask, p.ask);
+  }
+  push(out.deny, extraDeny);
+  if (cache2.size >= 16) cache2.clear();
+  cache2.set(key, { stamps, rules: out });
+  return out;
+}
+function checkRead(rules, absPaths) {
+  for (const kind of ["deny", "ask"]) {
+    for (const r of rules[kind]) {
+      if (absPaths.some((p) => matchRead(r, p))) return { allowed: false, rule: r.raw, kind };
+    }
+  }
+  return { allowed: true };
+}
+function checkReadPath(rules, abs) {
+  return checkRead(rules, [.../* @__PURE__ */ new Set([abs, realpathSync3(abs), realpathSync3.native(abs)])]);
+}
+
 // src/session/brief.ts
 init_esm_shims();
-import { existsSync as existsSync5, readFileSync as readFileSync5 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
+import { join as join7 } from "path";
 
 // src/memory/frontmatter.ts
 init_esm_shims();
@@ -29035,15 +29132,15 @@ function parseMemoryFile(text) {
 init_esm_shims();
 var import_fast_glob2 = __toESM(require_out4(), 1);
 import {
-  existsSync as existsSync4,
+  existsSync as existsSync5,
   mkdirSync as mkdirSync3,
-  readFileSync as readFileSync4,
+  readFileSync as readFileSync5,
   renameSync,
-  statSync as statSync2,
+  statSync as statSync3,
   unlinkSync,
   writeFileSync as writeFileSync2
 } from "fs";
-import { dirname as dirname3, join as join5, relative as relative3, sep } from "path";
+import { dirname as dirname3, join as join6, relative as relative3, sep } from "path";
 
 // src/storage/types.ts
 init_esm_shims();
@@ -29055,7 +29152,7 @@ function memoriesRel(ctx) {
   return ctx.config.memories.dir.replace(/^\.\//, "").replace(/\/+$/, "");
 }
 function memoriesDir(ctx) {
-  return join5(ctx.root, memoriesRel(ctx));
+  return join6(ctx.root, memoriesRel(ctx));
 }
 
 // src/session/brief.ts
@@ -29098,10 +29195,10 @@ function historyLine(db) {
   return `${parts.join("; ")}. em_history {action:"file", path} before editing, {action:"risk"} before committing.`;
 }
 function overviewParagraph(ctx) {
-  const file3 = join6(memoriesDir(ctx), "onboarding", "overview.md");
-  if (!existsSync5(file3)) return void 0;
+  const file3 = join7(memoriesDir(ctx), "onboarding", "overview.md");
+  if (!existsSync6(file3)) return void 0;
   try {
-    const body = parseMemoryFile(readFileSync5(file3, "utf8")).body.trim();
+    const body = parseMemoryFile(readFileSync6(file3, "utf8")).body.trim();
     const para = body.split(/\n\s*\n/).map(
       (p) => p.replace(/^#+\s.*$/m, "").replace(/\s+/g, " ").trim()
     ).find((p) => p.length > 20);
@@ -29150,10 +29247,10 @@ function fitBudget(lines, budget) {
 
 // src/session/server-alive.ts
 init_esm_shims();
-import { existsSync as existsSync6, mkdirSync as mkdirSync4, readdirSync, rmSync, writeFileSync as writeFileSync3 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, readdirSync, rmSync, writeFileSync as writeFileSync3 } from "fs";
+import { join as join8 } from "path";
 function markersDir(ctx) {
-  return join7(projectDir(ctx.id), "servers");
+  return join8(projectDir(ctx.id), "servers");
 }
 function processAlive(pid) {
   try {
@@ -29165,13 +29262,13 @@ function processAlive(pid) {
 }
 function liveServers(ctx) {
   const dir = markersDir(ctx);
-  if (!existsSync6(dir)) return [];
+  if (!existsSync7(dir)) return [];
   const live2 = [];
   for (const name of readdirSync(dir)) {
     const pid = Number(name);
     if (!Number.isInteger(pid) || pid <= 0) continue;
     if (processAlive(pid)) live2.push(pid);
-    else rmSync(join7(dir, name), { force: true });
+    else rmSync(join8(dir, name), { force: true });
   }
   return live2;
 }
@@ -29181,30 +29278,30 @@ function serverAlive(ctx) {
 
 // src/hooks/coexist.ts
 init_esm_shims();
-import { readFileSync as readFileSync7 } from "fs";
-import { join as join9 } from "path";
+import { readFileSync as readFileSync8 } from "fs";
+import { join as join10 } from "path";
 
 // src/install/claude-config.ts
 init_esm_shims();
 import {
   copyFileSync,
-  existsSync as existsSync7,
+  existsSync as existsSync8,
   mkdirSync as mkdirSync5,
   readdirSync as readdirSync2,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync7,
   writeFileSync as writeFileSync4
 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname4, join as join8 } from "path";
-var claudeDir = () => process.env.CLAUDE_CONFIG_DIR || join8(homedir2(), ".claude");
-var pluginsDir = () => join8(claudeDir(), "plugins");
+import { homedir as homedir3 } from "os";
+import { dirname as dirname4, join as join9 } from "path";
+var claudeDir = () => process.env.CLAUDE_CONFIG_DIR || join9(homedir3(), ".claude");
+var pluginsDir = () => join9(claudeDir(), "plugins");
 
 // src/hooks/coexist.ts
 var cached2;
 function contextModeInstalled() {
   if (cached2 !== void 0) return cached2;
   try {
-    const reg = JSON.parse(readFileSync7(join9(pluginsDir(), "installed_plugins.json"), "utf8"));
+    const reg = JSON.parse(readFileSync8(join10(pluginsDir(), "installed_plugins.json"), "utf8"));
     cached2 = Object.keys(reg.plugins ?? {}).some((id) => id.startsWith("context-mode@"));
   } catch {
     cached2 = false;
@@ -29259,7 +29356,7 @@ function coverageHint(db, rel) {
 }
 function docsSources(root) {
   try {
-    return readManifestAt(join10(root, ".eminiar", "docs.json")).sources;
+    return readManifestAt(join11(root, ".eminiar", "docs.json")).sources;
   } catch {
     return [];
   }
@@ -29318,9 +29415,11 @@ function suggest(toolName, input2, root) {
       const fp = String(input2.file_path ?? "");
       if (!fp) return void 0;
       try {
-        const st = statSync3(resolve3(root, fp));
+        const abs = resolve3(root, fp);
+        const st = statSync4(abs);
         const ext = extname2(fp).toLowerCase();
         if (st.size > 200 * 1024 || BIG_TEXT_EXT.has(ext) && st.size > 20 * 1024) {
+          if (!checkReadPath(loadPermissionRules(root), abs).allowed) return void 0;
           return {
             tool: "em_execute_file",
             reason: `${fp} is ${Math.round(st.size / 1024)} KB; em_execute_file {path, code} processes it in the sandbox so only what you print enters context`
@@ -29372,7 +29471,7 @@ function projectRel(ctx, fp) {
   if (!fp) return void 0;
   let abs = resolve3(ctx.root, fp);
   try {
-    abs = realpathSync3(abs);
+    abs = realpathSync4(abs);
   } catch {
   }
   const rel = relative4(ctx.root, abs).split("\\").join("/");
@@ -29573,15 +29672,15 @@ function annotate(s, note = "") {
 
 // src/hooks/session-start.ts
 init_esm_shims();
-import { appendFileSync as appendFileSync2, existsSync as existsSync8, readdirSync as readdirSync3 } from "fs";
-import { join as join12 } from "path";
+import { appendFileSync as appendFileSync2, existsSync as existsSync9, readdirSync as readdirSync3 } from "fs";
+import { join as join13 } from "path";
 
 // src/session/current.ts
 init_esm_shims();
-import { readFileSync as readFileSync8, statSync as statSync4, writeFileSync as writeFileSync5 } from "fs";
-import { join as join11 } from "path";
+import { readFileSync as readFileSync9, statSync as statSync5, writeFileSync as writeFileSync5 } from "fs";
+import { join as join12 } from "path";
 function file2(ctx) {
-  return join11(projectDir(ctx.id), "current-session");
+  return join12(projectDir(ctx.id), "current-session");
 }
 function setCurrentSession(ctx, sessionId) {
   writeFileSync5(file2(ctx), sessionId);
@@ -29664,8 +29763,8 @@ ${guide}`);
   } catch {
   }
   try {
-    const onboarding = join12(memoriesDir(ctx), "onboarding");
-    const onboarded = existsSync8(onboarding) && readdirSync3(onboarding).some((f) => f.endsWith(".md"));
+    const onboarding = join13(memoriesDir(ctx), "onboarding");
+    const onboarded = existsSync9(onboarding) && readdirSync3(onboarding).some((f) => f.endsWith(".md"));
     if (!onboarded)
       parts.push(
         "No onboarding memories yet: run /eminiar:em-onboard once so future sessions start with the project's structure, build and test commands."

package/dist/server.js

@@ -51937,7 +51937,7 @@ import { join as join17 } from "path";
 
 // src/permissions/settings.ts
 init_esm_shims();
-import { existsSync as existsSync10, readFileSync as readFileSync11, statSync as statSync8 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync11, realpathSync as realpathSync2, statSync as statSync8 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join15 } from "path";
 
@@ -51978,15 +51978,24 @@ function matchBash(rule, command) {
   if (rule.pattern === void 0) return true;
   return bashRegex(rule.pattern).test(command);
 }
+var readRegexCache = /* @__PURE__ */ new Map();
+function readRegex(pattern2) {
+  let re = readRegexCache.get(pattern2);
+  if (!re) {
+    if (readRegexCache.size >= 1024) readRegexCache.clear();
+    re = new RegExp(
+      `^${pattern2.split("**").map((seg) => seg.split("*").map(escapeRe2).join("[^/]*")).join(".*")}$`
+    );
+    readRegexCache.set(pattern2, re);
+  }
+  return re;
+}
 function matchRead(rule, absPath) {
   if (rule.tool !== "Read") return false;
   if (rule.pattern === void 0) return true;
   let p = rule.pattern;
   if (p.startsWith("~")) p = (process.env.HOME ?? "") + p.slice(1);
-  const re = new RegExp(
-    `^${p.split("**").map((seg) => seg.split("*").map(escapeRe2).join("[^/]*")).join(".*")}$`
-  );
-  return re.test(absPath);
+  return readRegex(p).test(absPath);
 }
 
 // src/permissions/split.ts
@@ -52148,6 +52157,17 @@ function checkCommand(rules, command) {
   }
   return { allowed: true };
 }
+function checkRead(rules, absPaths) {
+  for (const kind of ["deny", "ask"]) {
+    for (const r of rules[kind]) {
+      if (absPaths.some((p) => matchRead(r, p))) return { allowed: false, rule: r.raw, kind };
+    }
+  }
+  return { allowed: true };
+}
+function checkReadPath(rules, abs) {
+  return checkRead(rules, [.../* @__PURE__ */ new Set([abs, realpathSync2(abs), realpathSync2.native(abs)])]);
+}
 
 // src/sandbox/env.ts
 init_esm_shims();
@@ -57097,16 +57117,18 @@ init_esm_shims();
 
 // src/sandbox/file.ts
 init_esm_shims();
-import { realpathSync as realpathSync2 } from "fs";
+import { realpathSync as realpathSync3 } from "fs";
 import { isAbsolute, relative as relative9, resolve as resolve7 } from "path";
 function confinePath(root, target, rules) {
   const abs = resolve7(root, target);
+  refuse(checkRead(rules, [abs]), target);
   let real;
   try {
-    real = realpathSync2(abs);
+    real = realpathSync3(abs);
   } catch {
     throw new Error(`file not found: ${target}`);
   }
+  refuse(checkReadPath(rules, abs), target);
   const rel = relative9(root, real);
   const inside = rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
   if (inside) return real;
@@ -57115,11 +57137,15 @@ function confinePath(root, target, rules) {
     `${target} is outside the project root; add a Read(${real}) rule to permissions.allow to opt it in`
   );
 }
+function refuse(check3, target) {
+  if (!check3.allowed)
+    throw new Error(`refused by permission rule ${check3.rule} (${check3.kind}) on path: ${target}`);
+}
 
 // src/tools/em_execute_file.ts
 var emExecuteFile = defineTool({
   name: "em_execute_file",
-  description: "Process a file in the sandbox without reading it into context. Your code receives the absolute path as $EM_FILE (shell) / process.env.EM_FILE (node) / os.environ['EM_FILE'] (python); print only what you need. The file must be inside the project root unless a Read(<path>) allow rule opts it in. Omit `code` to get a quick summary (size, lines, head).",
+  description: "Process a file in the sandbox without reading it into context. Your code receives the absolute path as $EM_FILE (shell) / process.env.EM_FILE (node) / os.environ['EM_FILE'] (python); print only what you need. The file must be inside the project root unless a Read(<path>) allow rule opts it in; a matching Read deny or ask rule refuses the path, inside the root or out. Omit `code` to get a quick summary (size, lines, head).",
   schema: {
     path: external_exports.string().describe("File to process, relative to the project root or absolute"),
     language: LANG_ENUM.optional(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eminiar",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Local-first context, memory and knowledge-graph plugin for Claude Code. Sandboxed execution, FTS5 + vector search, session continuity, and a code graph — nothing leaves your machine.",
   "type": "module",
   "license": "MIT",