fullcourtdefense-cli 1.36.0 → 1.36.3

package/dist/askHeader.d.ts

@@ -0,0 +1,87 @@
+export type EnvironmentTag = 'production' | 'staging' | 'dev';
+/** Facts the ask envelope carries besides the reason text (all optional: the MCP gateway has none). */
+export interface AskSubject {
+    /** Hook event: shell | mcp | file | read. */
+    event?: string;
+    /** Engine operation of the action (read / write / DELETE / SHELL …). */
+    operation?: string;
+    /** Grant scope cloud entries, `gcloud|<how>|<where>`. */
+    cloud?: string[];
+    /** Host the action reaches (engine `destination.domain`). */
+    destinationDomain?: string;
+    /** Hosts a credential line sends to (credential binding). */
+    credentialHosts?: string[];
+    /** Rule id: `local-safety:<item>` or the action policy id. */
+    ruleId?: string;
+    /** Why no "Always allow" when the scope itself did not refuse it. */
+    alwaysOff?: 'rule' | 'org' | 'no_rule';
+    /** The client the hook records as `agentClient` on the runtime event (cursor, claude-code, …). */
+    agentClient?: string;
+}
+export interface AskHeaderInput {
+    /** The full action text: the script, else the "What" line. */
+    command?: string;
+    /** "shell command", "file edit", "MCP tool call" … */
+    kind?: string;
+    /** Tool line (MCP gateway). */
+    tool?: string;
+    /** The rule by name. */
+    policy?: string;
+    /** Local Safety rule detail from the Rule line: "id x, credential_commands". */
+    ruleDetail?: string;
+    /** The `IDE:` line of the reason (MCP gateway, older hook builds). */
+    ide?: string;
+    subject?: AskSubject;
+    /** "Always allow" is offered; `covers` says what it would cover. */
+    alwaysOffered: boolean;
+    alwaysCovers?: string;
+    /** The scope's own reason for not offering it (`grantNotOfferedReason`). */
+    alwaysNotOffered?: string;
+}
+export interface AskHeader {
+    /** Who is asking: "Your AI agent (Claude Code) wants to run this command." */
+    who: string;
+    /** One plain sentence. */
+    why: string;
+    /** What the action would change or remove, when the line names it; absent when unreadable. */
+    affects?: string;
+    /** Removes the home folder, a whole drive or the filesystem root: drawn like production (the words say it too). */
+    danger?: boolean;
+    /** Credential rules: where the token / secret is sent ("firestore.googleapis.com" or "unknown"). */
+    secretSentTo?: {
+        label: 'Token sent to' | 'Secret sent to';
+        value: string;
+    };
+    /** "Command" for shell lines, "Tool" for tool calls, "Target" otherwise. */
+    commandLabel: string;
+    command: string;
+    action: string;
+    /** Where the action lands, without the tag. */
+    where: string;
+    tag?: EnvironmentTag;
+    /** `where` with the tag spelled out: "acme-prod · production (by name)". */
+    whereText: string;
+    always: string;
+    /** Which fact the sentence came from; the dialog skips repeating it under "Why it triggered". */
+    source: 'cloud' | 'credential' | 'operation' | 'rule';
+}
+/** The client id as the console labels it; undefined for a missing or placeholder id. */
+export declare function agentClientLabel(raw?: string): string | undefined;
+/**
+ * The guard's credential-command patterns (`deterministicGuard` CREDENTIAL_COMMAND_RULES), for
+ * naming a secret the line sends somewhere when ANOTHER rule asked. Copied because this module stays
+ * pure (the guard reads files); test-ask-dialog.js fails when the two differ.
+ */
+export declare const LINE_CREDENTIAL_PATTERNS: Readonly<Record<string, string>>;
+/** Name tokens of a project id → environment. Deterministic, and only a hint: the dialog says "(by name)". */
+export declare function environmentTag(projectId: string): EnvironmentTag | undefined;
+interface ProjectRead {
+    /** Literal project ids, in order of appearance, unique. */
+    ids: string[];
+    /** A project reference exists but is computed (`$p`, `$(cat p.txt)`). */
+    computed: boolean;
+}
+/** Literal project ids named on the command: `--project x` / `--project=x` and Google API `projects/<id>` paths. */
+export declare function projectsInCommand(command: string): ProjectRead;
+export declare function buildAskHeader(input: AskHeaderInput): AskHeader;
+export {};