kritya 0.8.2-beta

package/dist/permissions/permissions.js

@@ -0,0 +1,62 @@
+import { matchesRule } from "./rules.js";
+/**
+ * Permission policy. Read-only tools never prompt; mutating tools prompt
+ * unless allowed by a settings-file rule or the user chose "always allow"
+ * for that tool earlier in the session. A deny rule blocks the call outright
+ * and cannot be overridden by an allow rule or an "always" choice.
+ */
+/**
+ * Key under which an "always allow" decision is recorded for a tool call.
+ * For `shell`, this is scoped to the *exact* command string, so approving
+ * one invocation (e.g. `python train.py`) only pre-approves that same
+ * invocation again — not every future command starting with the same
+ * program (`python -c "..."`, `python other_script.py`). Interpreters and
+ * other general-purpose runners make a first-word-only key unsafe: the
+ * first word tells you almost nothing about what the full command does.
+ * Users who want broader pre-approval on purpose can still write a wildcard
+ * rule (e.g. `shell(git *)`) into settings.json — see rules.ts.
+ */
+function alwaysAllowKey(toolName, args) {
+    if (toolName !== "shell")
+        return toolName;
+    const command = String(args.command ?? "").trim();
+    return command ? `shell:${command}` : "shell";
+}
+export class PermissionManager {
+    alwaysAllowed = new Set();
+    allow;
+    deny;
+    constructor(rules = []) {
+        if (Array.isArray(rules)) {
+            this.allow = rules;
+            this.deny = [];
+        }
+        else {
+            this.allow = rules.allow;
+            this.deny = rules.deny;
+        }
+    }
+    /** True if a deny rule blocks this call; such calls are never prompted, always refused. */
+    isDenied(tool, args = {}) {
+        return this.deny.some((rule) => matchesRule(rule, tool.name, args));
+    }
+    needsPrompt(tool, args = {}) {
+        if (!tool.requiresPermission)
+            return false;
+        if (this.alwaysAllowed.has(alwaysAllowKey(tool.name, args)))
+            return false;
+        return !this.allow.some((rule) => matchesRule(rule, tool.name, args));
+    }
+    record(toolName, decision, args = {}) {
+        if (decision === "always")
+            this.alwaysAllowed.add(alwaysAllowKey(toolName, args));
+    }
+    /**
+     * True if this call is pre-approved by an earlier "always allow" choice this
+     * session (as opposed to a settings allow rule). Lets the audit log record
+     * the precise source of an allowed decision.
+     */
+    isAlwaysAllowed(toolName, args = {}) {
+        return this.alwaysAllowed.has(alwaysAllowKey(toolName, args));
+    }
+}

package/dist/permissions/rules.js

@@ -0,0 +1,69 @@
+import fs from "node:fs";
+import path from "node:path";
+import { CONFIG_DIR } from "../config/config.js";
+export function loadRules(workspace, trustWorkspace = true) {
+    const allow = [];
+    const deny = [];
+    const files = [
+        { file: path.join(CONFIG_DIR, "settings.json"), includeAllow: true },
+        { file: path.join(workspace, ".kritya", "settings.json"), includeAllow: trustWorkspace },
+    ];
+    for (const { file, includeAllow } of files) {
+        try {
+            const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+            if (includeAllow && Array.isArray(parsed.allow)) {
+                allow.push(...parsed.allow.filter((r) => typeof r === "string"));
+            }
+            if (Array.isArray(parsed.deny)) {
+                deny.push(...parsed.deny.filter((r) => typeof r === "string"));
+            }
+        }
+        catch {
+            // Missing or malformed settings file — no rules from it.
+        }
+    }
+    return { allow, deny };
+}
+const RULE_RE = /^([a-z_]+)(?:\((.*)\))?$/;
+/** The string a pattern is matched against for a given tool. */
+function subjectFor(toolName, args) {
+    if (toolName === "shell")
+        return String(args.command ?? "").trim();
+    return String(args.path ?? args.pattern ?? "").trim();
+}
+/**
+ * Shell metacharacters that chain/substitute commands or redirect I/O
+ * (&&, ||, ;, |, `, $(...), ${...}, >, >>, <, <<, a bare & to background /
+ * chain, and newlines). Redirection is included because `shell(git *)` must
+ * not silently allow `git log > ~/.bashrc` or `git log < /etc/passwd` just
+ * because the allowed pattern never spelled those characters out.
+ */
+const SHELL_METACHAR_RE = /&&|\|\||[;|`&\n]|\$\(|\$\{|<|>/;
+export function matchesRule(rule, toolName, args) {
+    const m = RULE_RE.exec(rule.trim());
+    if (!m)
+        return false;
+    const [, ruleTool, pattern] = m;
+    if (ruleTool !== toolName)
+        return false;
+    if (pattern === undefined)
+        return true;
+    const trimmedPattern = pattern.trim();
+    const subject = subjectFor(toolName, args);
+    // A wildcard shell(...) rule (e.g. shell(git *)) is only meant to allow one
+    // command, not an arbitrary chain appended after it. If the actual command
+    // contains shell metacharacters that the allowed pattern itself didn't
+    // spell out, refuse the match so it falls through to a permission prompt
+    // instead of silently auto-approving `git status && rm -rf /`.
+    if (toolName === "shell" &&
+        trimmedPattern.includes("*") &&
+        SHELL_METACHAR_RE.test(subject) &&
+        !SHELL_METACHAR_RE.test(trimmedPattern)) {
+        return false;
+    }
+    const regex = new RegExp("^" + trimmedPattern.split("*").map(escapeRegExp).join(".*") + "$");
+    return regex.test(subject);
+}
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}

package/dist/plugins/discover.js

@@ -0,0 +1,108 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+/**
+ * Scans each root for `<name>/plugin.json` folders, in name order, and reports
+ * both what loaded and why anything didn't. Roots that don't exist are
+ * skipped silently -- an unconfigured plugins directory isn't noteworthy. A
+ * folder without a plugin.json is not a plugin and isn't reported at all. On
+ * a name collision across or within roots, the first one found wins.
+ */
+export function scanPluginsDetailed(roots) {
+    const seen = new Map();
+    const skipped = [];
+    for (const root of roots) {
+        let entries;
+        try {
+            entries = fs.readdirSync(root, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        const dirs = entries
+            .filter((e) => e.isDirectory())
+            .sort((a, b) => a.name.localeCompare(b.name));
+        for (const entry of dirs) {
+            const dir = path.join(root, entry.name);
+            const manifestFile = path.join(dir, "plugin.json");
+            let raw;
+            try {
+                raw = fs.readFileSync(manifestFile, "utf8");
+            }
+            catch {
+                continue;
+            }
+            let manifest;
+            try {
+                manifest = JSON.parse(raw);
+            }
+            catch {
+                skipped.push({ name: entry.name, dir, reason: "invalid JSON in plugin.json" });
+                continue;
+            }
+            const name = manifest.name;
+            const version = manifest.version;
+            if (typeof name !== "string" || typeof version !== "string") {
+                skipped.push({
+                    name: entry.name,
+                    dir,
+                    reason: 'plugin.json must include "name" and "version"',
+                });
+                continue;
+            }
+            if (name !== entry.name) {
+                skipped.push({
+                    name: entry.name,
+                    dir,
+                    reason: `folder name "${entry.name}" does not match manifest name "${name}"`,
+                });
+                continue;
+            }
+            const existing = seen.get(name);
+            if (existing) {
+                skipped.push({
+                    name: entry.name,
+                    dir,
+                    reason: `duplicate plugin name "${name}" (already loaded from ${existing.dir})`,
+                });
+                continue;
+            }
+            seen.set(name, { name, dir, manifest });
+        }
+    }
+    return { loaded: [...seen.values()], skipped };
+}
+let warnSink = (message) => {
+    process.stderr.write(`kritya: ${message}\n`);
+};
+function warn(message) {
+    warnSink(message);
+}
+/** For testing: override the warning sink. Returns the previous sink. */
+export function _setWarnSink(sink) {
+    const prev = warnSink;
+    warnSink = sink;
+    return prev;
+}
+/**
+ * Same scan as scanPluginsDetailed, but for the common case that only wants
+ * the loaded list, warning (once per skip) about anything malformed.
+ */
+export function scanPlugins(roots) {
+    const { loaded, skipped } = scanPluginsDetailed(roots);
+    for (const s of skipped) {
+        warn(`skipping ${path.join(s.dir, "plugin.json")}: ${s.reason}`);
+    }
+    return loaded;
+}
+export function pluginsDir(workspace) {
+    return path.join(workspace, ".kritya", "plugins");
+}
+/** User-global plugins root, available across all workspaces. */
+export function userPluginsDir() {
+    return path.join(os.homedir(), ".kritya", "plugins");
+}
+/** Maps each discovered plugin to its skills/ subfolder, for use as extra skill roots. */
+export function pluginSkillsRoots(plugins) {
+    return plugins.map((p) => ({ dir: path.join(p.dir, "skills"), pluginName: p.name }));
+}

package/dist/plugins/mcp.js

@@ -0,0 +1,80 @@
+import fs from "node:fs";
+import path from "node:path";
+function isServerConfig(v) {
+    if (!v || typeof v !== "object")
+        return false;
+    const cfg = v;
+    return typeof cfg.command === "string" || typeof cfg.url === "string";
+}
+/**
+ * Reads each plugin's mcp.json (same `{ mcpServers: { name: config } }` shape
+ * as a workspace's .mcp.json). Entries requesting the legacy HTTP+SSE
+ * transport are skipped with a reason -- kritya's MCP client only speaks
+ * stdio and Streamable HTTP, and that older transport is deprecated in the
+ * spec itself.
+ */
+export function scanPluginMcpServers(plugins) {
+    const loaded = [];
+    const skipped = [];
+    const seen = new Set();
+    for (const plugin of plugins) {
+        let parsed;
+        try {
+            parsed = JSON.parse(fs.readFileSync(path.join(plugin.dir, "mcp.json"), "utf8"));
+        }
+        catch {
+            continue;
+        }
+        if (!parsed?.mcpServers || typeof parsed.mcpServers !== "object")
+            continue;
+        for (const [name, raw] of Object.entries(parsed.mcpServers)) {
+            if (seen.has(name)) {
+                skipped.push({
+                    pluginName: plugin.name,
+                    name,
+                    reason: `duplicate server name "${name}" (already loaded from another plugin)`,
+                });
+                continue;
+            }
+            const entry = raw;
+            if (entry?.transport === "sse" || entry?.type === "sse") {
+                skipped.push({
+                    pluginName: plugin.name,
+                    name,
+                    reason: "legacy HTTP+SSE transport is not supported",
+                });
+                continue;
+            }
+            if (!isServerConfig(raw)) {
+                skipped.push({
+                    pluginName: plugin.name,
+                    name,
+                    reason: 'must include "command" or "url"',
+                });
+                continue;
+            }
+            seen.add(name);
+            loaded.push({ name, pluginName: plugin.name, cfg: raw });
+        }
+    }
+    return { loaded, skipped };
+}
+/**
+ * Same scan as scanPluginMcpServers, but returns merge-ready shapes: a plain
+ * name->config map for mergeMcpServers, and a name->plugin-name provenance
+ * map for labeling `/mcp` output. Skips are reported via `warn` (defaults to
+ * stderr, like scanPlugins/scanSkills).
+ */
+export function loadPluginMcpServers(plugins, warn = (m) => process.stderr.write(`kritya: ${m}\n`)) {
+    const { loaded, skipped } = scanPluginMcpServers(plugins);
+    for (const s of skipped) {
+        warn(`skipping mcp server "${s.name}" from plugin "${s.pluginName}": ${s.reason}`);
+    }
+    const servers = {};
+    const provenance = {};
+    for (const s of loaded) {
+        servers[s.name] = s.cfg;
+        provenance[s.name] = s.pluginName;
+    }
+    return { servers, provenance };
+}