kira-glasses-bridge 2.0.0 → 2.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kira-glasses-bridge",
-  "version": "2.0.0",
+  "version": "2.2.0",
   "description": "Connects your Mac to Kira, the assistant for Even G2 glasses: Claude Code sessions, files, folders and apps, by voice.",
   "type": "module",
   "bin": {

package/src/agents/claude.mjs

@@ -4,14 +4,11 @@ import { query } from '@anthropic-ai/claude-agent-sdk'
 import { homedir } from 'node:os'
 import { relative, resolve, sep } from 'node:path'
 import { PERMISSION_OPTIONS, PLAN_OPTIONS, requestId } from './protocol.mjs'
+import { decide, ruleFor } from './policy.mjs'
 
 const TEXT_CAP = 4000
 const DIFF_CAP = 6000
 
-const READ_ONLY = new Set(['Read', 'Glob', 'Grep', 'LS', 'WebFetch', 'WebSearch', 'TodoWrite', 'TodoRead', 'NotebookRead', 'Task', 'Skill'])
-const EDITS = new Set(['Edit', 'Write', 'MultiEdit', 'NotebookEdit'])
-const SAFE_SHELL = /^(?:ls|pwd|cat|head|tail|wc|echo|which|type|env|printenv|date|whoami|tree|find|grep|rg|awk|sort|uniq|diff|stat|file|du|df|git (?:status|diff|log|show|branch|rev-parse|remote|ls-files|blame|describe|stash list)|node (?:-v|--version)|npm (?:-v|--version|ls|list|view|test|run (?:test|lint|typecheck|check|build))|pnpm (?:-v|--version|ls|list|test|typecheck|lint|build|run (?:test|lint|typecheck|check|build))|yarn (?:-v|--version|test|lint|typecheck|build)|cargo (?:check|test|build|fmt|clippy)|go (?:test|build|vet|version)|python3? -m pytest|pytest|make (?:test|check|lint|build))(?:\s|$)/
-
 const short = (s, n = 160) => (String(s ?? '').length > n ? `${String(s).slice(0, n)}…` : String(s ?? ''))
 
 function displayPath(p, cwd) {
@@ -133,40 +130,30 @@ function applyAnswer(name, input, request, answer, suggestions) {
  * @param io.ask(request)      resolves to { answer, by } when a person answers (the caller times it out)
  * @returns { ok, text, error, sessionId, stats }
  */
-/** "Always allow" answers, remembered for the rest of the process per session: `${sessionId}` -> Set of rule keys. */
-const sessionAllows = new Map()
-function ruleKey(toolName, input) {
-  if (toolName === 'Bash') return `Bash:${String(input.command ?? '').trim().split(/\s+/)[0]}`
-  return toolName
-}
-
-/**
- * The bridge's own policy, applied to every tool call regardless of what the
- * user's local Claude Code settings would do. Returns 'allow' or 'ask'.
- */
-function policy(toolName, input, cwd, session) {
-  if (READ_ONLY.has(toolName)) return 'allow'
-  if (EDITS.has(toolName) && inside(cwd, input.file_path ?? input.notebook_path)) return 'allow'
-  if (toolName === 'Bash' && SAFE_SHELL.test(String(input.command ?? '').trim())) return 'allow'
-  if (session && sessionAllows.get(session)?.has(ruleKey(toolName, input))) return 'allow'
-  return 'ask'
-}
+/** "Always allow" answers, kept for the rest of the process per session: sessionId -> Set of rules. */
+const sessionRules = new Map()
 
-export async function run({ prompt, sessionId, cwd }, io) {
+export async function run({ prompt, sessionId, cwd, policy }, io) {
   let session = sessionId ?? null
   let text = ''
   let error = null
+  const rulesFor = () => (session && sessionRules.get(session)) || new Set()
+  const judge = (toolName, input) => decide(policy, toolName, input ?? {}, cwd, rulesFor())
 
-  // Pre-tool hook: force the prompt for anything the policy does not allow, so
-  // a permissive local config (e.g. Bash(*) allowed) cannot bypass the person.
+  // Pre-tool hook: the policy is authoritative. It forces the prompt for what
+  // it does not allow (so a permissive local config cannot bypass the person)
+  // and refuses outright what it denies.
   const preToolUse = async input => {
     if (input.hook_event_name !== 'PreToolUse') return {}
-    const decision = policy(input.tool_name, input.tool_input ?? {}, cwd, session)
-    return { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: decision, permissionDecisionReason: decision === 'ask' ? 'Kira asks the user' : 'Kira policy' } }
+    const { decision, reason } = judge(input.tool_name, input.tool_input)
+    if (decision === 'deny') io.emit({ kind: 'request_resolved', id: `policy-${Date.now().toString(36)}`, answer: { optionIds: ['deny'] }, by: 'policy', tool: input.tool_name, reason })
+    return { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: decision, permissionDecisionReason: `Kira: ${reason}` } }
   }
 
   const canUseTool = async (toolName, input, { signal, suggestions }) => {
-    if (policy(toolName, input, cwd, session) === 'allow') return { behavior: 'allow', updatedInput: input }
+    const { decision, reason } = judge(toolName, input)
+    if (decision === 'allow') return { behavior: 'allow', updatedInput: input }
+    if (decision === 'deny') return { behavior: 'deny', message: `Refused by the user's policy (${reason}). Do not achieve the same effect another way; say what you could not do.` }
     const request = toRequest(toolName, input, cwd, suggestions)
     io.emit({ kind: 'request', request })
     let resolved
@@ -175,10 +162,11 @@ export async function run({ prompt, sessionId, cwd }, io) {
     } catch (err) {
       resolved = { answer: { optionIds: [], text: err.message }, by: 'timeout' }
     }
-    io.emit({ kind: 'request_resolved', id: request.id, answer: resolved.answer, by: resolved.by })
+    const rule = ruleFor(toolName, input)
+    io.emit({ kind: 'request_resolved', id: request.id, answer: resolved.answer, by: resolved.by, rule })
     if ((resolved.answer.optionIds ?? []).includes('always') && session) {
-      if (!sessionAllows.has(session)) sessionAllows.set(session, new Set())
-      sessionAllows.get(session).add(ruleKey(toolName, input))
+      if (!sessionRules.has(session)) sessionRules.set(session, new Set())
+      sessionRules.get(session).add(rule)
     }
     return applyAnswer(toolName, input, request, resolved.answer, suggestions)
   }

package/src/agents/policy.mjs

@@ -0,0 +1,97 @@
+// The agent policy, enforced here on the Mac. The API sends the user's policy
+// with every job; this decides allow / ask / deny for each tool call.
+//
+//   { edits, editsOutside, shell, web, delegate, plan, allowRules, askRules, denyRules }
+//
+// Shell commands are split into their pieces (`;`, `&&`, `||`, `|`, newlines)
+// and every piece has to be safe for the whole command to be safe.
+import { relative, resolve, sep } from 'node:path'
+
+export const READ_ONLY = new Set(['Read', 'Glob', 'Grep', 'LS', 'TodoWrite', 'TodoRead', 'NotebookRead', 'Skill'])
+export const EDITS = new Set(['Edit', 'Write', 'MultiEdit', 'NotebookEdit'])
+export const WEB = new Set(['WebFetch', 'WebSearch'])
+
+/** Read-only commands: looking, listing, testing, type-checking, building. Nothing that writes, sends or installs. */
+const SAFE_CMD = /^(?:ls|ll|pwd|cat|head|tail|wc|echo|printf|which|type|env|printenv|date|whoami|id|uname|tree|find|fd|grep|rg|ag|awk|cut|tr|sort|uniq|diff|comm|stat|file|du|df|basename|dirname|realpath|readlink|jq|yq|xxd|hexdump|strings|test|\[|true|false|sleep|md5|shasum|sha256sum|md5sum|column|nl|less|more|open -n --args|sed -n|sed -E -n|sed -n -E|git (?:status|diff|log|show|branch|rev-parse|remote|ls-files|ls-tree|blame|describe|stash list|tag|config --get|config -l|cat-file|grep|shortlog|count-objects|reflog)|node (?:-v|--version|-e|-p|--eval|--print)|npm (?:-v|--version|ls|list|view|outdated|why|test|run (?:test|lint|typecheck|check|build|format:check))|pnpm (?:-v|--version|ls|list|why|outdated|test|typecheck|lint|build|run (?:test|lint|typecheck|check|build))|yarn (?:-v|--version|list|test|lint|typecheck|build)|npx (?:tsc|eslint|prettier --check|jest|vitest|playwright test)|tsc|eslint|prettier --check|jest|vitest|cargo (?:check|test|build|fmt --check|clippy|tree|metadata)|go (?:test|build|vet|version|list|env)|python3? (?:-V|--version|-m pytest|-c)|pytest|ruby -v|make (?:test|check|lint|build)|mvn (?:test|compile)|gradle (?:test|build)|swift (?:build|test)|xcodebuild -list|brew (?:list|info|--version)|docker (?:ps|images|version)|gh (?:pr (?:list|view|status|checks)|issue (?:list|view)|run (?:list|view)|repo view|api)|heroku (?:logs|ps|releases|config(?::get)?|apps|info))(?:\s|$)/
+
+/** Redirections that write somewhere other than nowhere. */
+const WRITES = /(^|[^&\d])>(?!&)|>>|\btee\b|\bxargs\b|\beval\b|\bexec\b|`/
+
+function pieces(command) {
+  // Strip quoted strings so separators inside them do not split; keep a placeholder.
+  const stripped = String(command).replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g, '""')
+  return stripped
+    .split(/\n|;|&&|\|\||\|/)
+    .map(p => p.trim())
+    // Shell keywords are structure, not commands: drop them, and a "for x in …" header entirely.
+    .map(p => p.replace(/^(?:if|then|else|elif|fi|do|done|while|until)\b\s*/, '').replace(/^for\s+\w+\s+in\b.*$/, '').trim())
+    .filter(Boolean)
+}
+
+function matchesRule(rules, toolName, command) {
+  const c = (command ?? '').trim()
+  for (const r of rules) {
+    const rule = String(r).trim()
+    if (!rule) continue
+    if (rule === toolName) return true
+    if (toolName === 'Bash' && c && (c === rule || c.startsWith(rule + ' ') || pieces(c).some(p => p === rule || p.startsWith(rule + ' ')))) return true
+  }
+  return false
+}
+
+export function insideFolder(cwd, p) {
+  const rel = relative(cwd, resolve(cwd, String(p ?? '')))
+  return !!rel && !rel.startsWith('..') && !rel.startsWith(sep)
+}
+
+/** Is this shell command read-only, judged piece by piece? Command substitutions are judged by what is inside them. */
+export function shellIsSafe(command, allowRules = []) {
+  let c = String(command ?? '').trim()
+  if (!c) return false
+  // $(inner): safe only if the inner command is; then drop it so the outer check sees plain text.
+  for (let guard = 0; guard < 20; guard++) {
+    const m = /\$\(([^()]*)\)/.exec(c)
+    if (!m) break
+    if (!shellIsSafe(m[1], allowRules)) return false
+    c = c.slice(0, m.index) + '""' + c.slice(m.index + m[0].length)
+  }
+  if (WRITES.test(c.replace(/2>&1|2>\/dev\/null|>\/dev\/null|&>\/dev\/null/g, ''))) return false
+  return pieces(c).every(p => SAFE_CMD.test(p) || allowRules.some(r => r && (p === r || p.startsWith(String(r) + ' '))))
+}
+
+/** The rule key an "always allow" answer produces. */
+export function ruleFor(toolName, input) {
+  if (toolName !== 'Bash') return toolName
+  const first = pieces(String(input?.command ?? ''))[0] ?? ''
+  const words = first.split(/\s+/)
+  // Two words for package managers and git ("npm run", "git push"), one otherwise.
+  return /^(?:git|npm|pnpm|yarn|npx|cargo|go|docker|gh|heroku|make)$/.test(words[0]) && words[1] ? `${words[0]} ${words[1]}` : words[0]
+}
+
+/**
+ * Decide for one tool call. Returns { decision: 'allow'|'ask'|'deny', reason }.
+ * @param sessionRules rules allowed earlier in this session ("always allow")
+ */
+export function decide(policy, toolName, input, cwd, sessionRules = new Set()) {
+  const p = policy ?? {}
+  const command = toolName === 'Bash' ? String(input?.command ?? '') : ''
+  if (matchesRule(p.denyRules ?? [], toolName, command)) return { decision: 'deny', reason: 'refused by your policy' }
+  if (toolName === 'AskUserQuestion') return { decision: 'ask', reason: 'a question for you' }
+  if (matchesRule(p.askRules ?? [], toolName, command)) return { decision: 'ask', reason: 'your policy always asks for this' }
+  if (matchesRule([...(p.allowRules ?? []), ...sessionRules], toolName, command)) return { decision: 'allow', reason: 'allowed by your policy' }
+  if (READ_ONLY.has(toolName)) return { decision: 'allow', reason: 'read-only' }
+  if (EDITS.has(toolName)) {
+    const file = input?.file_path ?? input?.notebook_path
+    if (insideFolder(cwd, file)) return { decision: p.edits === 'ask' ? 'ask' : 'allow', reason: 'edit inside the project' }
+    return { decision: p.editsOutside === 'deny' ? 'deny' : 'ask', reason: 'edit outside the project folder' }
+  }
+  if (toolName === 'Bash') {
+    if (p.shell === 'allow') return { decision: 'allow', reason: 'shell allowed by your policy' }
+    if (p.shell !== 'ask' && shellIsSafe(command, p.allowRules ?? [])) return { decision: 'allow', reason: 'read-only command' }
+    return { decision: 'ask', reason: 'shell command' }
+  }
+  if (WEB.has(toolName)) return { decision: p.web === 'ask' ? 'ask' : 'allow', reason: 'web' }
+  if (toolName === 'Task') return { decision: p.delegate === 'ask' ? 'ask' : 'allow', reason: 'subagent' }
+  if (toolName === 'ExitPlanMode') return { decision: p.plan === 'allow' ? 'allow' : 'ask', reason: 'plan approval' }
+  return { decision: 'ask', reason: 'unfamiliar tool' }
+}

package/src/git.mjs

@@ -153,3 +153,31 @@ async function summary(before, root, files, diff, truncated, commits, treeAfter)
     truncated,
   }
 }
+
+/**
+ * Make a project folder ready: create it, then either clone the repo into it
+ * (SSH first, HTTPS as fallback) or start a fresh git repo with a README.
+ */
+export async function setupProjectFolder({ dir, name, description, sshUrl, httpsUrl }) {
+  const { mkdir, readdir, writeFile, stat } = await import('node:fs/promises')
+  const { execFile } = await import('node:child_process')
+  const run = (args, cwd) =>
+    new Promise(resolve => execFile('git', args, { cwd, maxBuffer: 8 * 1024 * 1024, timeout: 120_000 }, (err, stdout, stderr) => resolve({ ok: !err, out: String(stdout ?? ''), err: String(stderr ?? err?.message ?? '') })))
+  await mkdir(dir, { recursive: true })
+  const entries = (await readdir(dir)).filter(e => e !== '.DS_Store')
+  const already = await stat(`${dir}/.git`).then(s => s.isDirectory()).catch(() => false)
+  if (already) return { path: display(dir), existing: true, note: 'already a git repository' }
+  if (sshUrl || httpsUrl) {
+    if (entries.length) return { error: `${display(dir)} is not empty; choose an empty folder to clone into` }
+    let r = sshUrl ? await run(['clone', sshUrl, dir], dir) : { ok: false, err: 'no ssh url' }
+    if (!r.ok && httpsUrl) r = await run(['clone', httpsUrl, dir], dir)
+    if (!r.ok) return { error: `could not clone: ${r.err.trim().split('\n').pop()}` }
+    return { path: display(dir), cloned: true }
+  }
+  const r = await run(['init', '-q'], dir)
+  if (!r.ok) return { error: `git init failed: ${r.err.trim()}` }
+  if (!entries.includes('README.md')) await writeFile(`${dir}/README.md`, `# ${name ?? display(dir).split('/').pop()}\n${description ? `\n${description}\n` : ''}`)
+  await run(['add', '-A'], dir)
+  const c = await run(['commit', '-q', '-m', 'Initial commit'], dir)
+  return { path: display(dir), initialized: true, committed: c.ok, ...(c.ok ? {} : { note: 'git init done; the first commit needs git user.name and user.email configured' }) }
+}

package/src/index.mjs

@@ -3,7 +3,7 @@
 // machine on the user's behalf. Env: KIRA_BRIDGE_URL, KIRA_BRIDGE_TOKEN.
 import WebSocket from 'ws'
 import { listProjects, listSessions, readSession } from './claude-sessions.mjs'
-import { snapshot, changesSince, display } from './git.mjs'
+import { snapshot, changesSince, display, setupProjectFolder } from './git.mjs'
 import { resolveCwd } from './claude-run.mjs'
 import { agentById, AGENTS } from './agents/index.mjs'
 import { normalizeAnswer } from './agents/protocol.mjs'
@@ -103,7 +103,7 @@ const tools = {
           }, { once: true })
         }),
     }
-    void agent.run({ prompt, sessionId: args.session_id, cwd: dir }, io).then(async outcome => {
+    void agent.run({ prompt, sessionId: args.session_id, cwd: dir, policy: args.policy ?? {} }, io).then(async outcome => {
       for (const key of [...answerWaits.keys()]) if (key.startsWith(`${jobId}:`)) answerWaits.delete(key)
       let change = null
       if (before) change = await changesSince(before).catch(err => (log(`git after job failed: ${err.message}`), null))
@@ -118,6 +118,12 @@ const tools = {
     return tools.run_agent({ ...args, agent: 'claude' }, ws)
   },
 
+  /** A new project's folder on this Mac: created, cloned from its repo or started fresh. */
+  async setup_project_folder(args) {
+    const dir = resolveUserPath(String(args.path ?? ''))
+    return setupProjectFolder({ dir, name: args.name, description: args.description, sshUrl: args.ssh_url, httpsUrl: args.https_url })
+  },
+
   /** Read-only git facts for a folder: repo, branch, head, dirty files. */
   async git_status(args) {
     const s = await snapshot(resolveCwd(args.path ?? args.cwd))