open-multi-agent-kit 0.80.6 → 0.80.7

package/dist/core/agent-session.js

@@ -25,9 +25,15 @@ import { calculateContextTokens, collectEntriesForBranchSummary, compact, estima
 import { DEFAULT_THINKING_LEVEL } from "./defaults.js";
 import { exportSessionToHtml } from "./export-html/index.js";
 import { createToolHtmlRenderer } from "./export-html/tool-renderer.js";
+import { buildBlockedBashResult, evaluateCommandGate } from "./extensions/builtin/command-safety-gate.js";
 import { ExtensionRunner, wrapRegisteredTools, } from "./extensions/index.js";
 import { emitSessionShutdownEvent } from "./extensions/runner.js";
+import { applyFreedomEnv, bannerOnce, FREEDOM_CONFIG_DEFAULTS, gate, loadFreedomConfig, } from "./freedom/index.js";
+import { assertLoadoutAccess, decideLoadoutAccess, } from "./loadout-access-policy.js";
 import { expandPromptTemplate } from "./prompt-templates.js";
+import { createMonotonicReadIdFactory, createReadAnchorRegistry, } from "./read-anchor-registry.js";
+import { createReadContentCache } from "./read-content-cache.js";
+import { detectSandboxBackend } from "./sandbox/backend.js";
 import { CURRENT_SESSION_VERSION, getLatestCompactionEntry } from "./session-manager.js";
 import { createSyntheticSourceInfo } from "./source-info.js";
 import { buildSystemPrompt } from "./system-prompt.js";
@@ -54,6 +60,26 @@ export function parseSkillBlock(text) {
 // ============================================================================
 /** Standard thinking levels */
 const THINKING_LEVELS = ["off", "minimal", "low", "medium", "high"];
+function normalizeToolNames(toolNames) {
+    return [...new Set(toolNames.map((name) => name.trim()).filter((name) => name !== ""))].sort();
+}
+function toolNameSetsEqual(left, right) {
+    const normalizedLeft = normalizeToolNames(left);
+    const normalizedRight = normalizeToolNames(right);
+    return (normalizedLeft.length === normalizedRight.length &&
+        normalizedLeft.every((toolName, index) => toolName === normalizedRight[index]));
+}
+function isSandboxDeniedError(error) {
+    return error instanceof Error && error.message.startsWith("sandbox: shell denied");
+}
+function buildSandboxDeniedBashResult(reason) {
+    return {
+        output: reason,
+        exitCode: 1,
+        cancelled: false,
+        truncated: false,
+    };
+}
 // ============================================================================
 // AgentSession Class
 // ============================================================================
@@ -83,6 +109,8 @@ export class AgentSession {
     // Bash execution state
     _bashAbortController = undefined;
     _pendingBashMessages = [];
+    _configuredBashSandboxPreflight = undefined;
+    _detectedBashSandboxBackend = undefined;
     // Extension system
     _extensionRunner;
     _turnIndex = 0;
@@ -95,6 +123,7 @@ export class AgentSession {
     _allowedToolNames;
     _excludedToolNames;
     _baseToolsOverride;
+    _loadoutAccessPolicy;
     _sessionStartEvent;
     _extensionUIContext;
     _extensionMode = "print";
@@ -110,9 +139,22 @@ export class AgentSession {
     _toolDefinitions = new Map();
     _toolPromptSnippets = new Map();
     _toolPromptGuidelines = new Map();
+    // Per-session read/edit anchor coordination. The built-in read and edit tools
+    // share this registry, readId factory, and content cache so anchored
+    // stale-edit protection and content caching work across tool calls within one
+    // session. Reused across reload() so anchors survive an extension reload.
+    _readAnchorRegistry = createReadAnchorRegistry();
+    _readIdFactory = createMonotonicReadIdFactory();
+    _readContentCache = createReadContentCache();
     // Base system prompt (without extension appends) - used to apply fresh appends each turn
     _baseSystemPrompt = "";
     _baseSystemPromptOptions;
+    // Freedom mode (AGENTS.md §0) — loaded once from .omk/config.toml at the
+    // project cwd. The safety floor inside FreedomConfig is always enforced;
+    // approval_policy controls whether ordinary tool calls auto-allow under
+    // yolo mode or fall back to the historical confirm flow.
+    _freedomConfig = FREEDOM_CONFIG_DEFAULTS;
+    _freedomBannerMemo = {};
     constructor(config) {
         this.agent = config.agent;
         this.sessionManager = config.sessionManager;
@@ -127,7 +169,21 @@ export class AgentSession {
         this._allowedToolNames = config.allowedToolNames ? new Set(config.allowedToolNames) : undefined;
         this._excludedToolNames = config.excludedToolNames ? new Set(config.excludedToolNames) : undefined;
         this._baseToolsOverride = config.baseToolsOverride;
+        this._loadoutAccessPolicy = config.loadoutAccessPolicy;
+        this._configuredBashSandboxPreflight = config.bashSandboxPreflight;
         this._sessionStartEvent = config.sessionStartEvent ?? { type: "session_start", reason: "startup" };
+        // Load freedom config from the project cwd. Returns FREEDOM_CONFIG_DEFAULTS
+        // when .omk/config.toml is absent, so projects without an opt-in see no
+        // behavioral change.
+        try {
+            this._freedomConfig = loadFreedomConfig(this._cwd);
+        }
+        catch (error) {
+            // Surface config errors loudly. The session still starts with defaults
+            // so a single typo cannot brick interactive mode.
+            console.error(`OMK freedom config error: ${error instanceof Error ? error.message : String(error)}. Falling back to defaults.`);
+            this._freedomConfig = FREEDOM_CONFIG_DEFAULTS;
+        }
         // Always subscribe to agent events for internal handling
         // (session persistence, extensions, auto-compaction, retry logic)
         this._unsubscribeAgent = this.agent.subscribe(this._handleAgentEvent);
@@ -141,6 +197,39 @@ export class AgentSession {
     get modelRegistry() {
         return this._modelRegistry;
     }
+    /**
+     * Current freedom-mode configuration loaded from `.omk/config.toml`.
+     * Returns defaults when the file is absent or invalid. The TUI consumes
+     * this through `badgeText()` to render the footer badge; the session
+     * itself consumes it via the safety-floor gate before each tool call.
+     */
+    get freedomConfig() {
+        return this._freedomConfig;
+    }
+    /**
+     * One-shot banner per interactive session. Returns the banner text the
+     * first time it is called when freedom mode is enabled; returns undefined
+     * afterward. The memo lives on the session so re-renders never repeat it.
+     */
+    consumeFreedomBanner() {
+        return bannerOnce(this._freedomConfig, this._freedomBannerMemo);
+    }
+    /**
+     * Apply freedom-mode env exports to a spawn env. Used by bash spawners
+     * that want subprocesses to see OMK_FREEDOM_MODE without reaching into
+     * the freedom module directly.
+     */
+    decorateFreedomEnv(env) {
+        return applyFreedomEnv(env, this._freedomConfig);
+    }
+    _getBashSandboxPreflight(override) {
+        const preflight = override ?? this._configuredBashSandboxPreflight;
+        if (!preflight || preflight.policy.mode === "off" || preflight.backend) {
+            return preflight;
+        }
+        this._detectedBashSandboxBackend ??= detectSandboxBackend();
+        return { ...preflight, backend: this._detectedBashSandboxBackend };
+    }
     async _getRequiredRequestAuth(model) {
         const result = await this._modelRegistry.getApiKeyAndHeaders(model);
         if (!result.ok) {
@@ -177,6 +266,9 @@ export class AgentSession {
      */
     _installAgentToolHooks() {
         this.agent.beforeToolCall = async ({ toolCall, args }) => {
+            if (this._loadoutAccessPolicy && !this._loadoutAccessPolicy.activeTools.includes(toolCall.name)) {
+                throw new Error(`loadout: inactive tool: ${toolCall.name}`);
+            }
             const runner = this._extensionRunner;
             if (!runner.hasHandlers("tool_call")) {
                 return undefined;
@@ -480,7 +572,7 @@ export class AgentSession {
         catch {
             // Dispose must succeed even if an abort hook throws.
         }
-        this._extensionRunner.invalidate("This extension ctx is stale after session replacement or reload. Do not use a captured pi or command ctx after ctx.newSession(), ctx.fork(), ctx.switchSession(), or ctx.reload(). For newSession, fork, and switchSession, move post-replacement work into withSession and use the ctx passed to withSession. For reload, do not use the old ctx after await ctx.reload().");
+        this._extensionRunner.invalidate("This extension ctx is stale after session replacement or reload. Do not use a captured omk or command ctx after ctx.newSession(), ctx.fork(), ctx.switchSession(), or ctx.reload(). For newSession, fork, and switchSession, move post-replacement work into withSession and use the ctx passed to withSession. For reload, do not use the old ctx after await ctx.reload().");
         this._disconnectFromAgent();
         this._eventListeners = [];
         cleanupSessionResources(this.sessionId);
@@ -541,14 +633,23 @@ export class AgentSession {
      * Changes take effect on the next agent turn.
      */
     setActiveToolsByName(toolNames) {
+        const requestedToolNames = normalizeToolNames(toolNames);
+        const lockedToolNames = this._loadoutAccessPolicy?.activeTools;
+        if (lockedToolNames && !toolNameSetsEqual(requestedToolNames, lockedToolNames)) {
+            throw new Error(`loadout active tools are locked: expected ${lockedToolNames.join(", ") || "(none)"}, received ${requestedToolNames.join(", ") || "(none)"}`);
+        }
+        const desiredToolNames = lockedToolNames ? [...lockedToolNames] : toolNames;
         const tools = [];
         const validToolNames = [];
-        for (const name of toolNames) {
+        for (const name of desiredToolNames) {
             const tool = this._toolRegistry.get(name);
             if (tool) {
                 tools.push(tool);
                 validToolNames.push(name);
             }
+            else if (lockedToolNames?.includes(name)) {
+                throw new Error(`loadout locked tool unavailable: ${name}`);
+            }
         }
         this.agent.state.tools = tools;
         // Rebuild base system prompt with new tool set
@@ -691,7 +792,7 @@ export class AgentSession {
     }
     /**
      * Send a prompt to the agent.
-     * - Handles extension commands (registered via pi.registerCommand) immediately, even during streaming
+     * - Handles extension commands (registered via omk.registerCommand) immediately, even during streaming
      * - Expands file-based prompt templates by default
      * - During streaming, queues via steer() or followUp() based on streamingBehavior option
      * - Validates model and API key before sending (when not streaming)
@@ -704,7 +805,7 @@ export class AgentSession {
         let messages;
         try {
             // Handle extension commands first (execute immediately, even during streaming)
-            // Extension commands manage their own LLM interaction via pi.sendMessage()
+            // Extension commands manage their own LLM interaction via omk.sendMessage()
             if (expandPromptTemplates && text.startsWith("/")) {
                 const handled = await this._tryExecuteExtensionCommand(text);
                 if (handled) {
@@ -1852,6 +1953,12 @@ export class AgentSession {
                 sourceInfo: createSyntheticSourceInfo(`<sdk:${definition.name}>`, { source: "sdk" }),
             })),
         ].filter((tool) => isAllowedTool(tool.definition.name));
+        if (this._loadoutAccessPolicy) {
+            const shadowedBuiltins = normalizeToolNames(allCustomTools.map((tool) => tool.definition.name).filter((name) => this._baseToolDefinitions.has(name)));
+            if (shadowedBuiltins.length > 0) {
+                throw new Error(`loadout extension tool shadows builtin: ${shadowedBuiltins.join(", ")}`);
+            }
+        }
         const definitionRegistry = new Map(Array.from(this._baseToolDefinitions.entries())
             .filter(([name]) => isAllowedTool(name))
             .map(([name, definition]) => [
@@ -1893,6 +2000,14 @@ export class AgentSession {
             toolRegistry.set(tool.name, tool);
         }
         this._toolRegistry = toolRegistry;
+        if (this._loadoutAccessPolicy) {
+            const missingLockedTools = this._loadoutAccessPolicy.activeTools.filter((toolName) => !isAllowedTool(toolName) || !this._toolRegistry.has(toolName));
+            if (missingLockedTools.length > 0) {
+                throw new Error(`loadout locked tool unavailable: ${missingLockedTools.join(", ")}`);
+            }
+            this.setActiveToolsByName([...this._loadoutAccessPolicy.activeTools]);
+            return;
+        }
         const nextActiveToolNames = (options?.activeToolNames ? [...options.activeToolNames] : [...previousActiveToolNames]).filter((name) => isAllowedTool(name));
         if (allowedToolNames) {
             for (const toolName of this._toolRegistry.keys()) {
@@ -1919,14 +2034,41 @@ export class AgentSession {
         const autoResizeImages = this.settingsManager.getImageAutoResize();
         const shellCommandPrefix = this.settingsManager.getShellCommandPrefix();
         const shellPath = this.settingsManager.getShellPath();
+        const loadoutAccessPolicy = this._loadoutAccessPolicy;
+        const accessGuard = loadoutAccessPolicy
+            ? (request) => decideLoadoutAccess(loadoutAccessPolicy, request)
+            : undefined;
+        if (loadoutAccessPolicy && this._baseToolsOverride) {
+            throw new Error("loadout cannot use baseToolsOverride because override tools bypass scoped access guards");
+        }
         const baseToolDefinitions = this._baseToolsOverride
             ? Object.fromEntries(Object.entries(this._baseToolsOverride).map(([name, tool]) => [
                 name,
                 createToolDefinitionFromAgentTool(tool),
             ]))
             : createAllToolDefinitions(this._cwd, {
-                read: { autoResizeImages },
-                bash: { commandPrefix: shellCommandPrefix, shellPath },
+                read: {
+                    autoResizeImages,
+                    anchorRegistry: this._readAnchorRegistry,
+                    readIdFactory: this._readIdFactory,
+                    contentCache: this._readContentCache,
+                    accessGuard,
+                },
+                bash: {
+                    commandPrefix: shellCommandPrefix,
+                    shellPath,
+                    sandboxPolicy: this._getBashSandboxPreflight(),
+                    accessGuard,
+                },
+                edit: {
+                    anchorRegistry: this._readAnchorRegistry,
+                    contentCache: this._readContentCache,
+                    accessGuard,
+                },
+                write: { accessGuard },
+                grep: { accessGuard },
+                find: { accessGuard },
+                ls: { accessGuard },
             });
         this._baseToolDefinitions = new Map(Object.entries(baseToolDefinitions).map(([name, tool]) => [name, tool]));
         const extensionsResult = this._resourceLoader.getExtensions();
@@ -2075,18 +2217,60 @@ export class AgentSession {
      * @param options.operations Custom BashOperations for remote execution
      */
     async executeBash(command, onChunk, options) {
-        this._bashAbortController = new AbortController();
+        // Freedom-mode safety floor: enforce §0.1 (secrets, privilege, fs
+        // destruction, scope) before spawning any shell. Hard-denied commands
+        // never reach the executor. require-confirm and allow both continue,
+        // because OMK's CLI does not own an interactive confirmation prompt;
+        // the caller decides UX policy from this point on.
+        const freedomDecision = gate({ tool: "bash", args: { command } }, this._freedomConfig);
+        if (freedomDecision.kind === "deny-hard") {
+            throw new Error(`OMK §0.1 safety floor blocked bash: ${freedomDecision.reason}`);
+        }
         // Apply command prefix if configured (e.g., "shopt -s expand_aliases" for alias support)
         const prefix = this.settingsManager.getShellCommandPrefix();
         const shellPath = this.settingsManager.getShellPath();
         const resolvedCommand = prefix ? `${prefix}\n${command}` : command;
-        try {
-            const result = await executeBashWithOperations(resolvedCommand, this.sessionManager.getCwd(), options?.operations ?? createLocalBashOperations({ shellPath }), {
-                onChunk,
-                signal: this._bashAbortController.signal,
+        if (this._loadoutAccessPolicy) {
+            assertLoadoutAccess((request) => decideLoadoutAccess(this._loadoutAccessPolicy, request), { operation: "execute", toolName: "bash", command: resolvedCommand });
+        }
+        // Command-safety parity for non-interactive callers (RPC bash). Interactive
+        // `!`/`!!` bash is gated earlier through the user_bash extension event, which
+        // keeps its prompt-based approval semantics, so it does not pass safetyGate and
+        // is never double-prompted here. confirm/block-tier verdicts deny headlessly;
+        // the EFFECTIVE command (after the shell command prefix) is classified.
+        if (options?.safetyGate === "headless") {
+            const decision = await evaluateCommandGate(resolvedCommand, {
+                hasUI: false,
+                headlessConfirmPolicy: "deny",
             });
-            this.recordBashResult(command, result, options);
-            return result;
+            if (decision?.deny) {
+                const blocked = buildBlockedBashResult(decision.reason);
+                this.recordBashResult(command, blocked, options);
+                return blocked;
+            }
+        }
+        this._bashAbortController = new AbortController();
+        try {
+            try {
+                const result = await executeBashWithOperations(resolvedCommand, this.sessionManager.getCwd(), options?.operations ??
+                    createLocalBashOperations({
+                        shellPath,
+                        sandboxPolicy: this._getBashSandboxPreflight(options?.sandboxPolicy),
+                    }), {
+                    onChunk,
+                    signal: this._bashAbortController.signal,
+                });
+                this.recordBashResult(command, result, options);
+                return result;
+            }
+            catch (error) {
+                if (!isSandboxDeniedError(error)) {
+                    throw error;
+                }
+                const blocked = buildSandboxDeniedBashResult(error.message);
+                this.recordBashResult(command, blocked, options);
+                return blocked;
+            }
         }
         finally {
             this._bashAbortController = undefined;