oakode 0.0.0-stage → 0.5.0

package/dist/permissions.js

@@ -0,0 +1,389 @@
+/**
+ * Scoped permissions for operations that change things: editing/writing files, running shell commands, calling MCP tools.
+ *
+ *  - Reads and searches inside the workspace need no permission (and nothing outside it is reachable at all).
+ *  - Everything else asks, unless a rule allows exactly that. A rule names a tool and a precise scope:
+ *      edit / write : a file, a directory subtree, or the whole workspace
+ *      bash         : one exact command line (never a prefix: `npm test` does not allow `npm test; rm -rf …`)
+ *      mcp          : one tool of one server, or all tools of one server
+ *  - Session rules live in memory. Project rules are stored under OAKODE's own data directory (never inside the repository,
+ *    so a cloned repo cannot ship permissions) and are only ever written after the user explicitly chooses "this project".
+ */
+import { createHash } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { home } from "./config.js";
+import { changedFiles, runnerFiles, runnerHashes } from "./runners.js";
+const POLICIES = new Set(["allow", "ask", "deny"]);
+/** Keys of the custom policy table: a built-in tool, `bash:<exact command>`, `mcp:*`, `mcp:<server>` or `mcp:<server>/<tool>`. */
+const POLICY_KEY = /^(read|grep|ls|write|edit|bash|mcp:\*|mcp:[^\s/]{1,100}(\/\S{1,200})?|bash:[\s\S]{1,4000})$/;
+export const DEFAULT_POLICY = { read: "allow", grep: "allow", ls: "allow", write: "ask", edit: "ask", bash: "ask", "mcp:*": "ask" };
+const MAX_RULES = 500;
+export function projectFile(cwd) {
+    return join(home(), "projects", createHash("sha256").update(cwd).digest("hex").slice(0, 16), "permissions.json");
+}
+/**
+ * Files whose contents later run code or instruct the agent, so a write there is never covered by a broad permission:
+ * git metadata (hooks and config run on the user's next git command), project instructions (AGENTS.md / CLAUDE.md are
+ * loaded into every request), project skills (.agents/) and the project's MCP server list (.mcp.json). Auto Edit,
+ * directory and workspace grants and Custom "Always Allow" do not apply to them; an exact per-file grant or a fresh
+ * approval does. Compared case-insensitively (macOS and Windows file systems usually are). Returns why, or undefined.
+ */
+export function protectedPath(path) {
+    // Windows reaches the same file through other spellings: trailing dots and spaces are dropped (".git." is ".git"),
+    // ":stream" names an alternate data stream of the same file, and GIT~1 is .git's 8.3 short name.
+    const parts = path
+        .replace(/\\/g, "/")
+        .toLowerCase()
+        .split("/")
+        .map((p) => p.replace(/:.*$/, "").replace(/[. ]+$/, (m) => (p === m ? m : "")))
+        .map((p) => (/^git~\d+$/.test(p) ? ".git" : p))
+        .filter((p) => p && p !== ".");
+    if (parts.includes(".git"))
+        return "git metadata: hooks and config written here run on later git commands";
+    if (parts.includes(".husky"))
+        return "git hooks (husky): run on later git commands";
+    if (parts.includes(".agents"))
+        return "project skills: instructions the agent can load";
+    const base = parts.at(-1);
+    if (base === "agents.md" || base === "claude.md")
+        return "project instructions: loaded into every request";
+    if (base === ".mcp.json")
+        return "the project's MCP servers: programs OAKODE can start";
+    return undefined;
+}
+/** Strictly below `dir` (a directory rule never matches a file that happens to have the directory's own name). */
+const inTree = (path, dir) => dir === "." || path.startsWith(dir + "/");
+const norm = (p) => p.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "") || ".";
+/** The levels a user can pick for an action, narrowest first, with the default index. */
+export function levelsFor(a) {
+    if (a.tool === "bash")
+        return [{ level: "command", value: a.command.trim(), label: `exactly this command` }];
+    if (a.tool === "mcp") {
+        return [
+            { level: "tool", value: `${a.server}/${a.mcpTool}`, label: `the tool ${a.mcpTool} of server ${a.server}` },
+            { level: "server", value: a.server, label: `every tool of server ${a.server}` },
+        ];
+    }
+    const p = norm(a.path);
+    const dir = p.includes("/") ? p.slice(0, p.lastIndexOf("/")) : ".";
+    const verb = a.tool === "edit" ? "edits" : "writes";
+    if (protectedPath(p))
+        return [{ level: "file", value: p, label: `${verb} to ${p} (protected: only this exact file)` }];
+    return [
+        { level: "file", value: p, label: `${verb} to ${p}` },
+        { level: "directory", value: dir, label: `${verb} to files in ${dir === "." ? "the workspace root" : dir + "/"} and below` },
+        { level: "workspace", value: ".", label: `${verb} to any file in this workspace` },
+    ];
+}
+export function matches(r, a) {
+    if (r.tool !== a.tool)
+        return false;
+    // defense in depth: a path that is absolute or climbs out can never match any rule (tools already refuse such paths)
+    if (a.path !== undefined && (a.path.startsWith("/") || a.path.split(/[\\/]/).includes("..")))
+        return false;
+    switch (r.level) {
+        case "file": return norm(a.path ?? "") === r.value;
+        case "directory":
+        case "workspace": return !protectedPath(a.path ?? "") && inTree(norm(a.path ?? ""), r.value);
+        case "command": return typeof a.command === "string" && a.command.trim() === r.value;
+        case "tool": return `${a.server}/${a.mcpTool}` === r.value;
+        case "server": return a.server === r.value;
+    }
+}
+export const describe = (r) => {
+    switch (r.level) {
+        case "file": return `${r.tool}: the file ${r.value}`;
+        case "directory": return `${r.tool}: files in ${r.value === "." ? "the workspace root" : r.value + "/"} and below`;
+        case "workspace": return `${r.tool}: any file in this workspace`;
+        case "command": return `bash: exactly \`${r.value.length > 80 ? r.value.slice(0, 79) + "…" : r.value}\``;
+        case "tool": return `mcp: tool ${r.value}`;
+        case "server": return `mcp: every tool of server ${r.value}`;
+    }
+};
+const VALID_TOOLS = new Set(["edit", "write", "bash", "mcp"]);
+const VALID_LEVELS = new Set(["file", "directory", "workspace", "command", "tool", "server"]);
+/** Untrusted-input validation for the stored file: anything unexpected is dropped. */
+function validRule(r) {
+    if (!r || typeof r !== "object")
+        return false;
+    const x = r;
+    if (typeof x.tool !== "string" || !VALID_TOOLS.has(x.tool) || typeof x.level !== "string" || !VALID_LEVELS.has(x.level))
+        return false;
+    if (typeof x.value !== "string" || x.value.length === 0 || x.value.length > 4000)
+        return false;
+    if (x.level === "file" || x.level === "directory" || x.level === "workspace") {
+        if (x.tool !== "edit" && x.tool !== "write")
+            return false;
+        if (x.value.startsWith("/") || x.value.split("/").includes(".."))
+            return false; // can never reach outside the workspace
+    }
+    if (x.level === "command" && x.tool !== "bash")
+        return false;
+    if ((x.level === "tool" || x.level === "server") && x.tool !== "mcp")
+        return false;
+    return true;
+}
+export class Permissions {
+    session = [];
+    project = [];
+    file;
+    seq = 0;
+    saved = {};
+    temp = {};
+    cwd;
+    /** Runner command → its command-defining files as they were when it was approved (see runners.ts). */
+    runners = Object.create(null);
+    constructor(cwd) {
+        if (cwd) {
+            this.cwd = cwd;
+            this.file = projectFile(cwd);
+            this.load();
+            // approvals saved before runner tracking: their baseline is the files as they are at this session's start
+            let adopted = false;
+            for (const c of this.allowedCommands())
+                if (!this.runners[c] && runnerFiles(c, this.cwd).length)
+                    (this.runners[c] = this.hashes(c)), (adopted = true);
+            if (adopted)
+                this.save();
+        }
+    }
+    hashes(command) {
+        return runnerHashes(this.cwd, runnerFiles(command, this.cwd));
+    }
+    /** Exact command lines a rule or an Always Allow policy lets run (only the ones stored in the project file: `saved`). */
+    allowedCommands(saved = false) {
+        const bag = saved ? this.saved : { ...this.saved, ...this.temp };
+        const policies = Object.entries(bag).filter(([k, v]) => k.startsWith("bash:") && v === "allow").map(([k]) => k.slice(5).trim());
+        return [...new Set([...(saved ? this.project : this.all()).filter((r) => r.level === "command").map((r) => r.value), ...policies])];
+    }
+    /**
+     * For a runner command (npm test, make, ./run.sh …) that an approval covers: the command-defining files that changed
+     * since it was approved, so it must ask again. Undefined for other commands, or when nothing changed.
+     */
+    runnerChanged(command) {
+        const c = command.trim();
+        if (!this.cwd || !runnerFiles(c, this.cwd).length)
+            return undefined;
+        const base = this.runners[c];
+        if (!base)
+            return undefined;
+        const changed = changedFiles(base, this.hashes(c));
+        return changed.length ? changed : undefined;
+    }
+    /** The person approved this command just now, seeing why it asked: its files as they are now become the baseline. */
+    approvedNow(command) {
+        const c = command.trim();
+        if (!this.cwd || !runnerFiles(c, this.cwd).length || !this.allowedCommands().includes(c))
+            return;
+        this.runners[c] = this.hashes(c);
+        this.save();
+    }
+    load() {
+        try {
+            const j = JSON.parse(readFileSync(this.file, "utf8"));
+            this.saved = {};
+            if (j.policies && typeof j.policies === "object" && !Array.isArray(j.policies)) {
+                for (const [k, v] of Object.entries(j.policies).slice(0, MAX_RULES))
+                    if (POLICY_KEY.test(k) && typeof v === "string" && POLICIES.has(v))
+                        this.saved[k] = v;
+            }
+            this.project = (Array.isArray(j.rules) ? j.rules : []).filter(validRule).slice(0, MAX_RULES).map((r) => ({ ...r, scope: "project", id: `p${++this.seq}` }));
+            this.runners = Object.create(null);
+            const rs = j.runners;
+            if (rs && typeof rs === "object" && !Array.isArray(rs)) {
+                for (const [cmd, files] of Object.entries(rs).slice(0, MAX_RULES)) {
+                    if (!POLICY_KEY.test(`bash:${cmd}`) || !files || typeof files !== "object" || Array.isArray(files))
+                        continue;
+                    const ok = Object.entries(files).slice(0, 500).filter(([f, h]) => typeof h === "string" && /^[0-9a-f]{0,64}$/.test(h) && f.length < 1000 && !f.startsWith("/") && !f.split("/").includes(".."));
+                    this.runners[cmd] = Object.assign(Object.create(null), Object.fromEntries(ok));
+                }
+            }
+        }
+        catch {
+            this.project = [];
+        }
+    }
+    all() {
+        return [...this.session, ...this.project];
+    }
+    /** The rule that allows this action, if any. */
+    allowedBy(a) {
+        return this.all().find((r) => matches(r, a));
+    }
+    grant(a, level, scope) {
+        const opt = levelsFor(a).find((l) => l.level === level);
+        if (!opt)
+            throw new Error(`no such scope: ${level}`);
+        const existing = this.all().find((r) => r.tool === a.tool && r.level === level && r.value === opt.value && r.scope === scope);
+        if (existing)
+            return existing;
+        const rule = { id: `${scope[0]}${++this.seq}`, tool: a.tool, level, value: opt.value, scope, created: new Date().toISOString() };
+        if (level === "command" && this.cwd && runnerFiles(opt.value, this.cwd).length)
+            this.runners[opt.value] = this.hashes(opt.value);
+        if (scope === "session")
+            this.session.push(rule);
+        else {
+            if (this.project.length >= MAX_RULES)
+                throw new Error("too many project permissions; revoke some with /permissions");
+            this.project.push(rule);
+            this.save();
+        }
+        return rule;
+    }
+    /** Remove one rule by id (or all). Returns how many were removed. */
+    revoke(id) {
+        const before = this.all().length;
+        const keep = (r) => id !== "all" && r.id !== id;
+        const hadProject = this.project.some((r) => !keep(r));
+        this.session = this.session.filter(keep);
+        this.project = this.project.filter(keep);
+        if (hadProject)
+            this.save();
+        return before - this.all().length;
+    }
+    // ---- custom policy table (used by Custom mode) ----
+    /** The explicitly configured policy for a key (this session's change wins over the saved one). */
+    policyOf(key) {
+        if (Object.hasOwn(this.temp, key))
+            return { policy: this.temp[key], scope: "session" };
+        if (Object.hasOwn(this.saved, key))
+            return { policy: this.saved[key], scope: "project" };
+        return undefined;
+    }
+    /** Policy as shown in the table: configured, else the built-in default. */
+    shownPolicy(key) {
+        const p = this.policyOf(key);
+        return p ?? { policy: DEFAULT_POLICY[key] ?? "ask", scope: "default" };
+    }
+    /** Keys that have an explicit setting (for listing rows such as specific commands and MCP tools). */
+    policyKeys() {
+        return [...new Set([...Object.keys(this.saved), ...Object.keys(this.temp)])];
+    }
+    /** Set (or with `undefined` clear) a policy. "project" persists it outside the repository; "session" lasts until exit. */
+    setPolicy(key, policy, scope) {
+        if (!POLICY_KEY.test(key))
+            throw new Error(`invalid policy key: ${key}`);
+        const bag = scope === "session" ? this.temp : this.saved;
+        if (policy === undefined)
+            delete bag[key];
+        else {
+            if (!Object.hasOwn(bag, key) && Object.keys(bag).length >= MAX_RULES)
+                throw new Error("too many policy entries");
+            bag[key] = policy;
+            const cmd = key.startsWith("bash:") ? key.slice(5).trim() : "";
+            if (policy === "allow" && cmd && this.cwd && runnerFiles(cmd, this.cwd).length)
+                this.runners[cmd] = this.hashes(cmd);
+        }
+        if (scope === "project")
+            this.save();
+    }
+    get storagePath() {
+        return this.file;
+    }
+    save() {
+        if (!this.file)
+            return;
+        mkdirSync(dirname(this.file), { recursive: true, mode: 0o700 });
+        const tmp = this.file + `.${process.pid}.tmp`;
+        const keep = this.allowedCommands(true);
+        const runners = Object.fromEntries(Object.entries(this.runners).filter(([c]) => keep.includes(c)));
+        writeFileSync(tmp, JSON.stringify({ version: 1, rules: this.project.map(({ id: _id, scope: _s, ...r }) => r), policies: this.saved, runners }, null, 2), { mode: 0o600 });
+        chmodSync(tmp, 0o600);
+        renameSync(tmp, this.file);
+    }
+}
+export { existsSync };
+/**
+ * Explicit, per-project trust decisions for things a repository can ship: its skills and its MCP server configuration.
+ * Stored next to the permissions (outside the repo). Nothing a repository contains can set these.
+ */
+export class ProjectTrust {
+    file;
+    /**
+     * `skills`: the fingerprint each trusted project skill had when the user trusted it. Files written before fingerprints
+     * existed hold `skills: true`; their skills are adopted with their current contents the next time they load, and
+     * from then on a change disables them like any other.
+     */
+    data = { skills: {}, legacySkills: false, mcp: {} };
+    constructor(cwd) {
+        this.file = join(dirname(projectFile(cwd)), "trust.json");
+        const fp = (v, k) => typeof v === "string" && /^[0-9a-f]{16,64}$/.test(v) && k.length <= 100;
+        try {
+            const j = JSON.parse(readFileSync(this.file, "utf8"));
+            if (j.skills === true)
+                this.data.legacySkills = true;
+            else if (j.skills && typeof j.skills === "object" && !Array.isArray(j.skills)) {
+                for (const [k, v] of Object.entries(j.skills))
+                    if (fp(v, k))
+                        this.data.skills[k] = v;
+            }
+            if (j.mcp && typeof j.mcp === "object") {
+                for (const [k, v] of Object.entries(j.mcp))
+                    if (fp(v, k))
+                        this.data.mcp[k] = v;
+            }
+        }
+        catch { }
+    }
+    /** Whether any project skill is trusted. */
+    get skills() {
+        return this.data.legacySkills || Object.keys(this.data.skills).length > 0;
+    }
+    /** May this project skill, with this fingerprint, be active? */
+    skillStatus(name, fingerprint) {
+        const known = Object.hasOwn(this.data.skills, name) ? this.data.skills[name] : undefined;
+        if (known)
+            return known === fingerprint() ? true : "changed";
+        if (!this.data.legacySkills)
+            return false;
+        const fp = fingerprint();
+        if (!fp)
+            return false; // too large to verify
+        this.data.skills[name] = fp; // trusted before fingerprints: adopt what is there now
+        this.save();
+        return true;
+    }
+    /**
+     * Ends the adoption of skills trusted before fingerprints: called once the first load after starting has
+     * fingerprinted the skills that were there. A skill that appears later needs an explicit /skills trust.
+     */
+    endLegacyMigration() {
+        if (!this.data.legacySkills)
+            return;
+        this.data.legacySkills = false;
+        this.save();
+    }
+    /** Trust these skills with exactly these contents. */
+    trustSkills(skills) {
+        for (const s of skills)
+            if (s.fingerprint)
+                this.data.skills[s.name] = s.fingerprint;
+        this.save();
+    }
+    /** Disable every project skill again. */
+    untrustSkills() {
+        this.data.skills = {};
+        this.data.legacySkills = false;
+        this.save();
+    }
+    /** The config fingerprint the user approved for this server, if any. A changed config needs a new approval. */
+    mcp(name) {
+        return Object.hasOwn(this.data.mcp, name) ? this.data.mcp[name] : undefined;
+    }
+    setMcp(name, fingerprint) {
+        if (fingerprint)
+            this.data.mcp[name] = fingerprint;
+        else
+            delete this.data.mcp[name];
+        this.save();
+    }
+    save() {
+        mkdirSync(dirname(this.file), { recursive: true, mode: 0o700 });
+        const tmp = this.file + `.${process.pid}.tmp`;
+        const { legacySkills, skills, mcp } = this.data;
+        writeFileSync(tmp, JSON.stringify({ version: 1, skills: legacySkills && !Object.keys(skills).length ? true : skills, mcp }, null, 2), { mode: 0o600 });
+        chmodSync(tmp, 0o600);
+        renameSync(tmp, this.file);
+    }
+}

package/dist/permissions_ui.js

@@ -0,0 +1,134 @@
+import { MODE_LABEL, POLICY_LABEL, decide } from "./modes.js";
+import { DEFAULT_POLICY, describe as describeRule } from "./permissions.js";
+import { bold, dim, padEnd, yellow } from "./ui.js";
+const ORDER = ["allow", "ask", "deny"];
+const ICON = { allow: "✓", ask: "?", deny: "✗" };
+/** Wildcard Always Allow for MCP would also approve tools a server adds later: not offered. */
+const allowed = (key) => (key === "mcp:*" ? ["ask", "deny"] : ORDER);
+function rows(app) {
+    const out = [
+        { kind: "policy", key: "read", name: "read" },
+        { kind: "policy", key: "grep", name: "grep" },
+        { kind: "policy", key: "ls", name: "ls" },
+        { kind: "policy", key: "write", name: "write (workspace)" },
+        { kind: "policy", key: "edit", name: "edit (workspace)" },
+        { kind: "policy", key: "bash", name: "bash (any command)", note: "unsandboxed" },
+    ];
+    const keys = app.permissions.policyKeys();
+    for (const k of keys.filter((k) => k.startsWith("bash:")).sort())
+        out.push({ kind: "policy", key: k, name: `bash: ${k.slice(5).replace(/\s+/g, " ").slice(0, 40)}` });
+    out.push({ kind: "policy", key: "mcp:*", name: "mcp:* (all MCP tools)" });
+    const seen = new Set();
+    for (const sv of app.mcp.servers()) {
+        seen.add(`mcp:${sv.def.name}`);
+        out.push({ kind: "policy", key: `mcp:${sv.def.name}`, name: `mcp:${sv.def.name} (server)` });
+        for (const t of sv.tools) {
+            seen.add(`mcp:${sv.def.name}/${t.name}`);
+            out.push({ kind: "policy", key: `mcp:${sv.def.name}/${t.name}`, name: `  ${t.name}` });
+        }
+    }
+    for (const k of keys.filter((k) => k.startsWith("mcp:") && k !== "mcp:*" && !seen.has(k)).sort())
+        out.push({ kind: "policy", key: k, name: k });
+    out.push({ kind: "add" });
+    for (const r of app.permissions.all())
+        out.push({ kind: "grant", id: r.id });
+    return out;
+}
+/** What the active mode does for this key right now (shown when the mode is not Custom). */
+function now(app, key) {
+    if (app.mode === "custom")
+        return "";
+    const s = key.startsWith("mcp:") ? (() => { const [sv, t] = key.slice(4).split("/"); return { kind: "mcp", server: sv === "*" ? "" : sv, mcpTool: t ?? "" }; })() : key.startsWith("bash") ? { kind: "bash", command: key.slice(5) } : key === "write" || key === "edit" ? { kind: "file", tool: key, path: "x" } : { kind: "read", name: key };
+    const d = decide(app.mode, app.permissions, s);
+    return `now: ${ICON[d.decision]} ${d.decision}`;
+}
+export async function permissionsUi(app) {
+    const perms = app.permissions;
+    let target = "project";
+    let sel = 0;
+    const set = (key, p) => {
+        perms.setPolicy(key, p, target);
+        if (p === "allow" && key === "bash")
+            app.tui.flash("⚠ Always Allow for bash: any command runs without asking, unsandboxed, with your full permissions.", 5000);
+        else if (p === "allow" && (key === "write" || key === "edit"))
+            app.tui.flash(`${key} stays confined to the workspace; Always Allow only removes the prompt.`, 4000);
+    };
+    const line = (r) => {
+        if (r.kind === "add")
+            return { label: dim("+ Add a rule for a specific bash command…") };
+        if (r.kind === "grant") {
+            const g = perms.all().find((x) => x.id === r.id);
+            return { label: g ? `${padEnd(`granted ${g.id}`, 12)} ${describeRule(g)}` : r.id, hint: g ? (g.scope === "project" ? "saved · Enter: revoke" : "session only · Enter: revoke") : "" };
+        }
+        const p = perms.shownPolicy(r.key);
+        const tag = p.scope === "default" ? "default" : p.scope === "session" ? "session only" : "saved";
+        return { label: `${padEnd(r.name, 30)} ${padEnd(`${ICON[p.policy]} ${POLICY_LABEL[p.policy]}`, 17)}`, hint: [tag, now(app, r.key), r.note].filter(Boolean).join(" · ") };
+    };
+    for (;;) {
+        const list = rows(app);
+        sel = Math.min(sel, list.length - 1);
+        const i = await app.tui.chooseFrom({
+            title: `Permissions · ${MODE_LABEL[app.mode]}`,
+            lines: () => [
+                dim(`Editing the Custom policy (used when the mode is Custom). Changes apply to: `) + bold(target === "project" ? "saved for this project" : "this session only") + dim(" (Tab toggles)"),
+                ...(app.mode !== "custom" ? [dim(`The active mode is ${MODE_LABEL[app.mode]}; "now" shows what it does. Shift+Tab switches modes.`)] : []),
+                ...(app.autoApprove ? [yellow("--yes is ON: nothing asks, whatever is configured here (Deny and Plan still apply).")] : []),
+                dim("Tool / Operation".padEnd(31) + "Policy"),
+            ],
+            options: () => rows(app).map(line),
+            initial: sel,
+            onTab: () => void (target = target === "project" ? "session" : "project"),
+            hint: "↑↓ navigate · ←→ change · Tab saved/session · Enter details · Esc close",
+            onKey: (key, at) => {
+                if (key.k !== "left" && key.k !== "right")
+                    return false;
+                sel = at;
+                const r = rows(app)[at];
+                if (r?.kind !== "policy")
+                    return true;
+                const opts = allowed(r.key);
+                const cur = opts.indexOf(perms.shownPolicy(r.key).policy);
+                const next = opts[(Math.max(cur, 0) + (key.k === "right" ? 1 : opts.length - 1)) % opts.length];
+                set(r.key, next);
+                return true;
+            },
+        });
+        if (i < 0)
+            return;
+        sel = i;
+        const r = list[i];
+        if (r.kind === "grant") {
+            const j = await app.tui.chooseFrom({ title: `Revoke ${r.id}?`, options: () => [{ label: "Revoke this permission" }, { label: "Keep it" }] });
+            if (j === 0) {
+                perms.revoke(r.id);
+                app.view.note(`Revoked ${r.id}.`);
+            }
+        }
+        else if (r.kind === "add") {
+            app.view.note("Type the exact bash command this rule is for (Enter to continue, empty to cancel). It matches that exact command line only.");
+            const cmd = (await app.tui.readMessage({ prefill: "", multiline: false }))?.trim();
+            if (!cmd)
+                continue;
+            const j = await app.tui.chooseFrom({ title: `Policy for: ${cmd.slice(0, 70)}`, options: () => [...ORDER.map((p) => ({ label: POLICY_LABEL[p] })), { label: "Cancel" }] });
+            if (j >= 0 && j < 3)
+                set(`bash:${cmd}`, ORDER[j]);
+        }
+        else {
+            const explicit = perms.policyOf(r.key);
+            const opts = allowed(r.key);
+            const j = await app.tui.chooseFrom({
+                title: `${r.name.trim()} — ${target === "project" ? "saved for this project" : "this session only"}`,
+                options: () => [...opts.map((p) => ({ label: POLICY_LABEL[p], hint: p === perms.shownPolicy(r.key).policy ? "current" : DEFAULT_POLICY[r.key] === p ? "default" : "" })), ...(explicit ? [{ label: "Reset to default" }] : []), { label: "Cancel" }],
+                initial: Math.max(0, opts.indexOf(perms.shownPolicy(r.key).policy)),
+            });
+            if (j >= 0 && j < opts.length)
+                set(r.key, opts[j]);
+            else if (explicit && j === opts.length) {
+                perms.setPolicy(r.key, undefined, explicit.scope);
+                // a saved entry hidden behind a session one (or vice versa) is cleared too, so Reset really resets
+                if (perms.policyOf(r.key))
+                    perms.setPolicy(r.key, undefined, explicit.scope === "session" ? "project" : "session");
+            }
+        }
+    }
+}

package/dist/print.js

@@ -0,0 +1,76 @@
+import { clip, cyan, dim, fmtTokens, green, red, yellow } from "./ui.js";
+export function makePrintEmitter() {
+    let streaming = false;
+    let toolLines = 0;
+    const emit = (e) => {
+        switch (e.type) {
+            case "text":
+                if (!streaming)
+                    (process.stdout.write("\n"), (streaming = true));
+                process.stdout.write(e.delta);
+                break;
+            case "tool_start":
+                if (streaming)
+                    (process.stdout.write("\n"), (streaming = false));
+                toolLines = 0;
+                console.log(cyan(`\n▸ ${e.summary}`));
+                break;
+            case "tool_output":
+                for (const l of e.chunk.split("\n")) {
+                    if (!l && toolLines >= 12)
+                        continue;
+                    if (toolLines < 12)
+                        console.log(dim("  │ " + l.slice(0, 200)));
+                    toolLines++;
+                }
+                break;
+            case "tool_end":
+                if (e.isError)
+                    console.log(red("  ✗ " + clip(e.result, 4)));
+                else if (toolLines === 0)
+                    console.log(dim("  " + clip(e.result, 6).replace(/\n/g, "\n  ")));
+                else if (toolLines > 12)
+                    console.log(dim(`  … (+${toolLines - 12} more lines, full output sent to the model)`));
+                break;
+            case "usage":
+            case "reasoning":
+                break;
+            case "compacting":
+                console.log(dim("\n⟳ Compacting conversation (one model call)…"));
+                break;
+            case "compacted":
+                console.log(dim(`✓ Compacted: ~${fmtTokens(e.before)} → ~${fmtTokens(e.after)} tokens.`));
+                break;
+            case "notice":
+                console.log(yellow("\n" + e.text));
+        }
+    };
+    return { emit, end: () => streaming && process.stdout.write("\n") };
+}
+export { green };
+/**
+ * All of stdin, decoded once at the end: decoding chunk by chunk would split multibyte characters at chunk boundaries.
+ * UTF-16 with a byte-order mark (Windows PowerShell pipes) is decoded as such; a UTF-8 BOM is dropped. If nothing has
+ * arrived after 3 s, says on stderr that it is waiting, so a pipe that never closes is not a silent hang.
+ */
+export async function readAll(stream = process.stdin) {
+    const chunks = [];
+    const waiting = setTimeout(() => chunks.length || console.error(dim("Reading input from stdin… (end it with Ctrl+D, or pass the prompt as an argument)")), 3000);
+    try {
+        for await (const c of stream)
+            chunks.push(typeof c === "string" ? Buffer.from(c) : c);
+    }
+    finally {
+        clearTimeout(waiting);
+    }
+    return decodeInput(Buffer.concat(chunks));
+}
+export function decodeInput(b) {
+    if (b[0] === 0xff && b[1] === 0xfe)
+        return new TextDecoder("utf-16le").decode(b.subarray(2));
+    if (b[0] === 0xfe && b[1] === 0xff)
+        return new TextDecoder("utf-16be").decode(b.subarray(2));
+    if (b[0] === 0xef && b[1] === 0xbb && b[2] === 0xbf)
+        return b.subarray(3).toString("utf8");
+    return b.toString("utf8");
+}

package/dist/proc.js

@@ -0,0 +1,63 @@
+/** Child processes: their environment, starting a shell command, and stopping them (with everything they started). */
+import { spawn } from "node:child_process";
+import { shell } from "./shell.js";
+/**
+ * Environment for processes OAKODE starts. Strips credentials this application holds so an approved command cannot
+ * read them from its environment. Other variables are inherited: this is NOT a sandbox.
+ */
+export function childEnv(env = process.env) {
+    const out = {};
+    for (const [k, v] of Object.entries(env))
+        if (!/^(OICKI|OAKODE)_/i.test(k))
+            out[k] = v;
+    return out;
+}
+/**
+ * For the model's shell commands: no pager waiting for a keypress, no git credential prompt nobody can answer, and
+ * no forced color in output the model reads. (Not CI=1: that changes how test runners behave.)
+ */
+export function commandEnv(env = process.env) {
+    const out = childEnv(env);
+    delete out.FORCE_COLOR;
+    return { ...out, NO_COLOR: "1", PAGER: "cat", GIT_PAGER: "cat", GH_PAGER: "cat", GIT_TERMINAL_PROMPT: "0" };
+}
+/** Runs a command line in the agent's shell, in its own process group (so it can be stopped with what it starts). */
+export function spawnShell(command, cwd) {
+    const sh = shell();
+    const child = spawn(sh.bin, sh.args(command), {
+        cwd,
+        env: commandEnv(),
+        detached: process.platform !== "win32",
+        windowsHide: true,
+        windowsVerbatimArguments: sh.verbatim,
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    live.add(child);
+    return child;
+}
+/** Running children, so a signal to OAKODE can take them down with it. */
+const live = new Set();
+/** Register a long-lived child (an MCP server) so shutdown kills it with the rest. */
+export const trackChild = (c) => void live.add(c);
+export const untrackChild = (c) => void live.delete(c);
+export function killAllChildren(sig = "SIGTERM") {
+    for (const c of live)
+        killTreeOf(c, sig);
+}
+/** Signals a child and everything it started. Windows has no process groups or SIGINT for them: always a kill. */
+export function killTreeOf(c, sig) {
+    if (!c.pid)
+        return;
+    if (process.platform === "win32") {
+        // taskkill /T takes the whole tree (a shell and what it started).
+        try {
+            spawn("taskkill", ["/pid", String(c.pid), "/T", "/F"], { stdio: "ignore", windowsHide: true }).on("error", () => { });
+        }
+        catch { }
+        return;
+    }
+    try {
+        process.kill(-c.pid, sig);
+    }
+    catch { }
+}