open-multi-agent-kit 0.80.7 → 0.90.0

package/dist/core/extensions/builtin/command-safety-gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-safety-gate.d.ts","sourceRoot":"","sources":["../../../../src/core/extensions/builtin/command-safety-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,KAAK,YAAY,EAAuB,MAAM,aAAa,CAAC;AAErE,4EAA4E;AAC5E,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAE9D,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IAClC,iEAAiE;IACjE,KAAK,EAAE,OAAO,CAAC;IACf,mEAAmE;IACnE,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,kGAAkG;IAClG,qBAAqB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACzC,4FAA4F;IAC5F,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,oEAAoE;AACpE,MAAM,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;AAiCzD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CACnC,OAAO,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,EAAE,GAClB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAM7C;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,kBAAkB,GACtB,OAAO,CAAC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAwBxD;AAED,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,4BAAsB,CAAC;AAEpD,yEAAyE;AACzE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAOjE;AAED;;;;GAIG;AACH,MAAM,CAAC,OAAO,UAAU,iBAAiB,CAAC,GAAG,EAAE,YAAY,GAAG,IAAI,CAyBjE","sourcesContent":["/**\n * Built-in command-safety gate extension.\n *\n * Wires the pure `classifyShellCommand` verdict engine into the live bash entry\n * points with one shared decision engine (`evaluateCommandGate`):\n * - LLM tool calls (`tool_call` for the `bash` tool) — block-tier verdicts stop\n *   execution via `{ block, reason }`. confirm-tier verdicts prompt when a\n *   dialog-capable UI is available and otherwise deny headlessly (parity with\n *   user bash). `priv.*` is never auto-allowed.\n * - User `!`/`!!` bash (`user_bash`) — block/confirm verdicts produce a synthetic\n *   FAILED `BashResult` instead of running the command.\n * - RPC bash routes through `AgentSession.executeBash({ safetyGate: \"headless\" })`\n *   which reuses `evaluateCommandGate` and `buildBlockedBashResult` directly.\n *\n * Fail-closed contract:\n * - `user_bash` deny NEVER throws. A thrown `user_bash` handler is logged by the\n *   runner and default execution continues (fail-open). Returning a synthetic\n *   failed `result` short-circuits execution safely.\n * - `confirm`-tier verdicts deny by default when no interactive UI is available.\n * - `priv.*` verdicts are never headless-allowed.\n *\n * This gate reuses `command-safety.ts` read-only and adds no new classification\n * branches. `extraDeny` patterns can only promote allow/confirm to block; they\n * can never relax a block verdict.\n */\n\nimport type { BashResult } from \"../../bash-executor.ts\";\nimport { type CommandVerdict, classifyShellCommand } from \"../../command-safety.ts\";\nimport { type ExtensionAPI, isToolCallEventType } from \"../types.ts\";\n\n/** Confirmation callback. Returns true when the user approves execution. */\nexport type ConfirmFn = (message: string) => Promise<boolean>;\n\n/** Options controlling how a bash command is evaluated by the shared gate. */\nexport interface CommandGateOptions {\n\t/** Whether a dialog-capable UI is available for confirmation. */\n\thasUI: boolean;\n\t/** Interactive confirmation callback used when `hasUI` is true. */\n\tconfirm?: ConfirmFn;\n\t/** Headless policy for `confirm`-tier verdicts. `priv.*` is never allowed. Defaults to \"deny\". */\n\theadlessConfirmPolicy?: \"deny\" | \"allow\";\n\t/** Extra substrings that promote allow/confirm verdicts to block. Never relaxes a block. */\n\textraDeny?: string[];\n}\n\n/** @deprecated Back-compat alias for {@link CommandGateOptions}. */\nexport type UserBashEvaluateOptions = CommandGateOptions;\n\nfunction formatReason(verdict: CommandVerdict): string {\n\treturn `[${verdict.rule}] ${verdict.reason}`;\n}\n\nfunction matchesExtraDeny(command: string, patterns: string[] | undefined): boolean {\n\tif (!patterns || patterns.length === 0) return false;\n\tfor (const pattern of patterns) {\n\t\tif (pattern.length > 0 && command.includes(pattern)) return true;\n\t}\n\treturn false;\n}\n\n/**\n * Classify a command, applying `extraDeny` promotion.\n *\n * `extraDeny` can only escalate allow/confirm to block; an existing block\n * verdict is returned unchanged.\n */\nfunction classifyWithExtraDeny(command: string, extraDeny?: string[]): CommandVerdict {\n\tconst verdict = classifyShellCommand(command);\n\tif (verdict.risk === \"block\") return verdict;\n\tif (matchesExtraDeny(command, extraDeny)) {\n\t\treturn {\n\t\t\trisk: \"block\",\n\t\t\trule: \"command.extra_deny\",\n\t\t\treason: \"Command matches a configured deny pattern.\",\n\t\t};\n\t}\n\treturn verdict;\n}\n\n/**\n * Pure block-only check for an LLM `bash` tool call.\n *\n * Only block-tier verdicts produce a block here; confirm/allow pass through.\n * Used as a low-level non-negotiable floor (for example by the bash tool's\n * effective-command check after commandPrefix/spawnHook) where no confirm UI\n * or policy context exists. The confirm-deny behavior for the live tool_call\n * gate lives in {@link evaluateCommandGate}.\n */\nexport function evaluateBashToolCall(\n\tcommand: string,\n\textraDeny?: string[],\n): { block: true; reason: string } | undefined {\n\tconst verdict = classifyWithExtraDeny(command, extraDeny);\n\tif (verdict.risk === \"block\") {\n\t\treturn { block: true, reason: formatReason(verdict) };\n\t}\n\treturn undefined;\n}\n\n/**\n * Shared gate decision for any bash command (LLM tool call, user bash, RPC bash).\n *\n * - block  => deny.\n * - confirm => hasUI ? (approved ? undefined : deny) : (policy === \"allow\" && !priv ? undefined : deny).\n * - allow  => undefined (preserve later extensions / default execution).\n */\nexport async function evaluateCommandGate(\n\tcommand: string,\n\topts: CommandGateOptions,\n): Promise<{ deny: boolean; reason: string } | undefined> {\n\tconst verdict = classifyWithExtraDeny(command, opts.extraDeny);\n\n\tif (verdict.risk === \"allow\") return undefined;\n\tif (verdict.risk === \"block\") {\n\t\treturn { deny: true, reason: formatReason(verdict) };\n\t}\n\n\t// confirm-tier verdict.\n\tif (opts.hasUI) {\n\t\tif (opts.confirm) {\n\t\t\tconst approved = await opts.confirm(formatReason(verdict));\n\t\t\treturn approved ? undefined : { deny: true, reason: formatReason(verdict) };\n\t\t}\n\t\t// UI claimed but no confirm callback: cannot obtain consent => fail-closed.\n\t\treturn { deny: true, reason: formatReason(verdict) };\n\t}\n\n\t// Headless: privilege escalation is never auto-allowed.\n\tconst isPrivilege = verdict.rule.startsWith(\"priv.\");\n\tif (!isPrivilege && opts.headlessConfirmPolicy === \"allow\") {\n\t\treturn undefined;\n\t}\n\treturn { deny: true, reason: formatReason(verdict) };\n}\n\n/** @deprecated Back-compat alias; prefer {@link evaluateCommandGate}. */\nexport const evaluateUserBash = evaluateCommandGate;\n\n/** Build a synthetic failed `BashResult` surfacing the safety reason. */\nexport function buildBlockedBashResult(reason: string): BashResult {\n\treturn {\n\t\toutput: `command-safety: blocked\\n${reason}`,\n\t\texitCode: 1,\n\t\tcancelled: false,\n\t\ttruncated: false,\n\t};\n}\n\n/**\n * Extension factory. Registered as the first extension so its handlers run\n * before any discovered extension (`tool_call` short-circuits on first block;\n * `user_bash` short-circuits on first truthy result).\n */\nexport default function commandSafetyGate(omk: ExtensionAPI): void {\n\tomk.on(\"tool_call\", async (event, ctx) => {\n\t\tif (!isToolCallEventType(\"bash\", event)) return undefined;\n\t\tconst decision = await evaluateCommandGate(event.input.command, {\n\t\t\thasUI: ctx.hasUI,\n\t\t\tconfirm: ctx.hasUI ? (message) => ctx.ui.confirm(\"Command safety\", message) : undefined,\n\t\t\theadlessConfirmPolicy: \"deny\",\n\t\t});\n\t\tif (decision?.deny) {\n\t\t\treturn { block: true, reason: decision.reason };\n\t\t}\n\t\treturn undefined;\n\t});\n\n\tomk.on(\"user_bash\", async (event, ctx) => {\n\t\tconst decision = await evaluateCommandGate(event.command, {\n\t\t\thasUI: ctx.hasUI,\n\t\t\tconfirm: ctx.hasUI ? (message) => ctx.ui.confirm(\"Command safety\", message) : undefined,\n\t\t\theadlessConfirmPolicy: \"deny\",\n\t\t});\n\t\tif (decision?.deny) {\n\t\t\treturn { result: buildBlockedBashResult(decision.reason) };\n\t\t}\n\t\treturn undefined;\n\t});\n}\n"]}
+{"version":3,"file":"command-safety-gate.d.ts","sourceRoot":"","sources":["../../../../src/core/extensions/builtin/command-safety-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,KAAK,YAAY,EAAuB,MAAM,aAAa,CAAC;AAErE,4EAA4E;AAC5E,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAE9D,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IAClC,iEAAiE;IACjE,KAAK,EAAE,OAAO,CAAC;IACf,mEAAmE;IACnE,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,uFAAuF;IACvF,wBAAwB,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC;IAC3C,kGAAkG;IAClG,qBAAqB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACzC,4FAA4F;IAC5F,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,oEAAoE;AACpE,MAAM,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;AAiCzD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CACnC,OAAO,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,EAAE,GAClB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAM7C;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,kBAAkB,GACtB,OAAO,CAAC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CA2BxD;AAED,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,4BAAsB,CAAC;AAEpD,wBAAgB,+BAA+B,CAC9C,GAAG,GAAE,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAe,GACjF,OAAO,CAET;AASD,yEAAyE;AACzE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAOjE;AAED;;;;GAIG;AACH,MAAM,CAAC,OAAO,UAAU,iBAAiB,CAAC,GAAG,EAAE,YAAY,GAAG,IAAI,CAyBjE","sourcesContent":["/**\n * Built-in command-safety gate extension.\n *\n * Wires the pure `classifyShellCommand` verdict engine into the live bash entry\n * points with one shared decision engine (`evaluateCommandGate`):\n * - LLM tool calls (`tool_call` for the `bash` tool) — block-tier verdicts stop\n *   execution via `{ block, reason }`. confirm-tier verdicts prompt when a\n *   dialog-capable UI is available and otherwise deny headlessly (parity with\n *   user bash). `priv.*` is never auto-allowed.\n * - User `!`/`!!` bash (`user_bash`) — block/confirm verdicts produce a synthetic\n *   FAILED `BashResult` instead of running the command.\n * - RPC bash routes through `AgentSession.executeBash({ safetyGate: \"headless\" })`\n *   which reuses `evaluateCommandGate` and `buildBlockedBashResult` directly.\n *\n * Fail-closed contract:\n * - `user_bash` deny NEVER throws. A thrown `user_bash` handler is logged by the\n *   runner and default execution continues (fail-open). Returning a synthetic\n *   failed `result` short-circuits execution safely.\n * - `confirm`-tier verdicts deny by default when no interactive UI is available.\n * - `priv.*` verdicts are never headless-allowed.\n *\n * This gate reuses `command-safety.ts` read-only and adds no new classification\n * branches. `extraDeny` patterns can only promote allow/confirm to block; they\n * can never relax a block verdict.\n */\n\nimport type { BashResult } from \"../../bash-executor.ts\";\nimport { type CommandVerdict, classifyShellCommand } from \"../../command-safety.ts\";\nimport { type ExtensionAPI, isToolCallEventType } from \"../types.ts\";\n\n/** Confirmation callback. Returns true when the user approves execution. */\nexport type ConfirmFn = (message: string) => Promise<boolean>;\n\n/** Options controlling how a bash command is evaluated by the shared gate. */\nexport interface CommandGateOptions {\n\t/** Whether a dialog-capable UI is available for confirmation. */\n\thasUI: boolean;\n\t/** Interactive confirmation callback used when `hasUI` is true. */\n\tconfirm?: ConfirmFn;\n\t/** Interactive policy for non-privilege `confirm`-tier verdicts. Defaults to \"ask\". */\n\tinteractiveConfirmPolicy?: \"ask\" | \"allow\";\n\t/** Headless policy for `confirm`-tier verdicts. `priv.*` is never allowed. Defaults to \"deny\". */\n\theadlessConfirmPolicy?: \"deny\" | \"allow\";\n\t/** Extra substrings that promote allow/confirm verdicts to block. Never relaxes a block. */\n\textraDeny?: string[];\n}\n\n/** @deprecated Back-compat alias for {@link CommandGateOptions}. */\nexport type UserBashEvaluateOptions = CommandGateOptions;\n\nfunction formatReason(verdict: CommandVerdict): string {\n\treturn `[${verdict.rule}] ${verdict.reason}`;\n}\n\nfunction matchesExtraDeny(command: string, patterns: string[] | undefined): boolean {\n\tif (!patterns || patterns.length === 0) return false;\n\tfor (const pattern of patterns) {\n\t\tif (pattern.length > 0 && command.includes(pattern)) return true;\n\t}\n\treturn false;\n}\n\n/**\n * Classify a command, applying `extraDeny` promotion.\n *\n * `extraDeny` can only escalate allow/confirm to block; an existing block\n * verdict is returned unchanged.\n */\nfunction classifyWithExtraDeny(command: string, extraDeny?: string[]): CommandVerdict {\n\tconst verdict = classifyShellCommand(command);\n\tif (verdict.risk === \"block\") return verdict;\n\tif (matchesExtraDeny(command, extraDeny)) {\n\t\treturn {\n\t\t\trisk: \"block\",\n\t\t\trule: \"command.extra_deny\",\n\t\t\treason: \"Command matches a configured deny pattern.\",\n\t\t};\n\t}\n\treturn verdict;\n}\n\n/**\n * Pure block-only check for an LLM `bash` tool call.\n *\n * Only block-tier verdicts produce a block here; confirm/allow pass through.\n * Used as a low-level non-negotiable floor (for example by the bash tool's\n * effective-command check after commandPrefix/spawnHook) where no confirm UI\n * or policy context exists. The confirm-deny behavior for the live tool_call\n * gate lives in {@link evaluateCommandGate}.\n */\nexport function evaluateBashToolCall(\n\tcommand: string,\n\textraDeny?: string[],\n): { block: true; reason: string } | undefined {\n\tconst verdict = classifyWithExtraDeny(command, extraDeny);\n\tif (verdict.risk === \"block\") {\n\t\treturn { block: true, reason: formatReason(verdict) };\n\t}\n\treturn undefined;\n}\n\n/**\n * Shared gate decision for any bash command (LLM tool call, user bash, RPC bash).\n *\n * - block  => deny.\n * - confirm => hasUI ? (approved ? undefined : deny) : (policy === \"allow\" && !priv ? undefined : deny).\n * - allow  => undefined (preserve later extensions / default execution).\n */\nexport async function evaluateCommandGate(\n\tcommand: string,\n\topts: CommandGateOptions,\n): Promise<{ deny: boolean; reason: string } | undefined> {\n\tconst verdict = classifyWithExtraDeny(command, opts.extraDeny);\n\n\tif (verdict.risk === \"allow\") return undefined;\n\tif (verdict.risk === \"block\") {\n\t\treturn { deny: true, reason: formatReason(verdict) };\n\t}\n\n\t// confirm-tier verdict.\n\tconst isPrivilege = verdict.rule.startsWith(\"priv.\");\n\tif (opts.hasUI) {\n\t\tif (!isPrivilege && opts.interactiveConfirmPolicy === \"allow\") {\n\t\t\treturn undefined;\n\t\t}\n\t\tif (opts.confirm) {\n\t\t\tconst approved = await opts.confirm(formatReason(verdict));\n\t\t\treturn approved ? undefined : { deny: true, reason: formatReason(verdict) };\n\t\t}\n\t\t// UI claimed but no confirm callback: cannot obtain consent => fail-closed.\n\t\treturn { deny: true, reason: formatReason(verdict) };\n\t}\n\n\t// Headless: privilege escalation is never auto-allowed.\n\tif (!isPrivilege && opts.headlessConfirmPolicy === \"allow\") {\n\t\treturn undefined;\n\t}\n\treturn { deny: true, reason: formatReason(verdict) };\n}\n\n/** @deprecated Back-compat alias; prefer {@link evaluateCommandGate}. */\nexport const evaluateUserBash = evaluateCommandGate;\n\nexport function isCommandSafetyAssumeYesEnabled(\n\tenv: NodeJS.ProcessEnv | Readonly<Record<string, string | undefined>> = process.env,\n): boolean {\n\treturn env.OMK_COMMAND_SAFETY_ASSUME_YES === \"1\" || env.OMK_COMMAND_SAFETY_ASSUME_YES === \"true\";\n}\n\nfunction getAssumeYesConfirmPolicies(): Pick<CommandGateOptions, \"interactiveConfirmPolicy\" | \"headlessConfirmPolicy\"> {\n\tif (!isCommandSafetyAssumeYesEnabled()) {\n\t\treturn { interactiveConfirmPolicy: \"ask\", headlessConfirmPolicy: \"deny\" };\n\t}\n\treturn { interactiveConfirmPolicy: \"allow\", headlessConfirmPolicy: \"allow\" };\n}\n\n/** Build a synthetic failed `BashResult` surfacing the safety reason. */\nexport function buildBlockedBashResult(reason: string): BashResult {\n\treturn {\n\t\toutput: `command-safety: blocked\\n${reason}`,\n\t\texitCode: 1,\n\t\tcancelled: false,\n\t\ttruncated: false,\n\t};\n}\n\n/**\n * Extension factory. Registered as the first extension so its handlers run\n * before any discovered extension (`tool_call` short-circuits on first block;\n * `user_bash` short-circuits on first truthy result).\n */\nexport default function commandSafetyGate(omk: ExtensionAPI): void {\n\tomk.on(\"tool_call\", async (event, ctx) => {\n\t\tif (!isToolCallEventType(\"bash\", event)) return undefined;\n\t\tconst decision = await evaluateCommandGate(event.input.command, {\n\t\t\thasUI: ctx.hasUI,\n\t\t\tconfirm: ctx.hasUI ? (message) => ctx.ui.confirm(\"Command safety\", message) : undefined,\n\t\t\t...getAssumeYesConfirmPolicies(),\n\t\t});\n\t\tif (decision?.deny) {\n\t\t\treturn { block: true, reason: decision.reason };\n\t\t}\n\t\treturn undefined;\n\t});\n\n\tomk.on(\"user_bash\", async (event, ctx) => {\n\t\tconst decision = await evaluateCommandGate(event.command, {\n\t\t\thasUI: ctx.hasUI,\n\t\t\tconfirm: ctx.hasUI ? (message) => ctx.ui.confirm(\"Command safety\", message) : undefined,\n\t\t\t...getAssumeYesConfirmPolicies(),\n\t\t});\n\t\tif (decision?.deny) {\n\t\t\treturn { result: buildBlockedBashResult(decision.reason) };\n\t\t}\n\t\treturn undefined;\n\t});\n}\n"]}

package/dist/core/extensions/builtin/command-safety-gate.js

@@ -87,7 +87,11 @@ export async function evaluateCommandGate(command, opts) {
         return { deny: true, reason: formatReason(verdict) };
     }
     // confirm-tier verdict.
+    const isPrivilege = verdict.rule.startsWith("priv.");
     if (opts.hasUI) {
+        if (!isPrivilege && opts.interactiveConfirmPolicy === "allow") {
+            return undefined;
+        }
         if (opts.confirm) {
             const approved = await opts.confirm(formatReason(verdict));
             return approved ? undefined : { deny: true, reason: formatReason(verdict) };
@@ -96,7 +100,6 @@ export async function evaluateCommandGate(command, opts) {
         return { deny: true, reason: formatReason(verdict) };
     }
     // Headless: privilege escalation is never auto-allowed.
-    const isPrivilege = verdict.rule.startsWith("priv.");
     if (!isPrivilege && opts.headlessConfirmPolicy === "allow") {
         return undefined;
     }
@@ -104,6 +107,15 @@ export async function evaluateCommandGate(command, opts) {
 }
 /** @deprecated Back-compat alias; prefer {@link evaluateCommandGate}. */
 export const evaluateUserBash = evaluateCommandGate;
+export function isCommandSafetyAssumeYesEnabled(env = process.env) {
+    return env.OMK_COMMAND_SAFETY_ASSUME_YES === "1" || env.OMK_COMMAND_SAFETY_ASSUME_YES === "true";
+}
+function getAssumeYesConfirmPolicies() {
+    if (!isCommandSafetyAssumeYesEnabled()) {
+        return { interactiveConfirmPolicy: "ask", headlessConfirmPolicy: "deny" };
+    }
+    return { interactiveConfirmPolicy: "allow", headlessConfirmPolicy: "allow" };
+}
 /** Build a synthetic failed `BashResult` surfacing the safety reason. */
 export function buildBlockedBashResult(reason) {
     return {
@@ -125,7 +137,7 @@ export default function commandSafetyGate(omk) {
         const decision = await evaluateCommandGate(event.input.command, {
             hasUI: ctx.hasUI,
             confirm: ctx.hasUI ? (message) => ctx.ui.confirm("Command safety", message) : undefined,
-            headlessConfirmPolicy: "deny",
+            ...getAssumeYesConfirmPolicies(),
         });
         if (decision?.deny) {
             return { block: true, reason: decision.reason };
@@ -136,7 +148,7 @@ export default function commandSafetyGate(omk) {
         const decision = await evaluateCommandGate(event.command, {
             hasUI: ctx.hasUI,
             confirm: ctx.hasUI ? (message) => ctx.ui.confirm("Command safety", message) : undefined,
-            headlessConfirmPolicy: "deny",
+            ...getAssumeYesConfirmPolicies(),
         });
         if (decision?.deny) {
             return { result: buildBlockedBashResult(decision.reason) };

package/dist/core/extensions/builtin/command-safety-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"command-safety-gate.js","sourceRoot":"","sources":["../../../../src/core/extensions/builtin/command-safety-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EAAuB,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACpF,OAAO,EAAqB,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAoBrE,SAAS,YAAY,CAAC,OAAuB,EAAU;IACtD,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;AAAA,CAC7C;AAED,SAAS,gBAAgB,CAAC,OAAe,EAAE,QAA8B,EAAW;IACnF,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,OAAe,EAAE,SAAoB,EAAkB;IACrF,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IAC7C,IAAI,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;QAC1C,OAAO;YACN,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,4CAA4C;SACpD,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AAAA,CACf;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CACnC,OAAe,EACf,SAAoB,EAC0B;IAC9C,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAe,EACf,IAAwB,EACiC;IACzD,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAE/D,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,CAAC;IAED,wBAAwB;IACxB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAChB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3D,OAAO,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7E,CAAC;QACD,4EAA4E;QAC5E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,CAAC;IAED,wDAAwD;IACxD,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,qBAAqB,KAAK,OAAO,EAAE,CAAC;QAC5D,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;AAAA,CACrD;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAEpD,yEAAyE;AACzE,MAAM,UAAU,sBAAsB,CAAC,MAAc,EAAc;IAClE,OAAO;QACN,MAAM,EAAE,4BAA4B,MAAM,EAAE;QAC5C,QAAQ,EAAE,CAAC;QACX,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,KAAK;KAChB,CAAC;AAAA,CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,OAAO,UAAU,iBAAiB,CAAC,GAAiB,EAAQ;IAClE,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;YAC/D,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;YACvF,qBAAqB,EAAE,MAAM;SAC7B,CAAC,CAAC;QACH,IAAI,QAAQ,EAAE,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACjD,CAAC;QACD,OAAO,SAAS,CAAC;IAAA,CACjB,CAAC,CAAC;IAEH,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE;YACzD,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;YACvF,qBAAqB,EAAE,MAAM;SAC7B,CAAC,CAAC;QACH,IAAI,QAAQ,EAAE,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,CAAC;QACD,OAAO,SAAS,CAAC;IAAA,CACjB,CAAC,CAAC;AAAA,CACH","sourcesContent":["/**\n * Built-in command-safety gate extension.\n *\n * Wires the pure `classifyShellCommand` verdict engine into the live bash entry\n * points with one shared decision engine (`evaluateCommandGate`):\n * - LLM tool calls (`tool_call` for the `bash` tool) — block-tier verdicts stop\n *   execution via `{ block, reason }`. confirm-tier verdicts prompt when a\n *   dialog-capable UI is available and otherwise deny headlessly (parity with\n *   user bash). `priv.*` is never auto-allowed.\n * - User `!`/`!!` bash (`user_bash`) — block/confirm verdicts produce a synthetic\n *   FAILED `BashResult` instead of running the command.\n * - RPC bash routes through `AgentSession.executeBash({ safetyGate: \"headless\" })`\n *   which reuses `evaluateCommandGate` and `buildBlockedBashResult` directly.\n *\n * Fail-closed contract:\n * - `user_bash` deny NEVER throws. A thrown `user_bash` handler is logged by the\n *   runner and default execution continues (fail-open). Returning a synthetic\n *   failed `result` short-circuits execution safely.\n * - `confirm`-tier verdicts deny by default when no interactive UI is available.\n * - `priv.*` verdicts are never headless-allowed.\n *\n * This gate reuses `command-safety.ts` read-only and adds no new classification\n * branches. `extraDeny` patterns can only promote allow/confirm to block; they\n * can never relax a block verdict.\n */\n\nimport type { BashResult } from \"../../bash-executor.ts\";\nimport { type CommandVerdict, classifyShellCommand } from \"../../command-safety.ts\";\nimport { type ExtensionAPI, isToolCallEventType } from \"../types.ts\";\n\n/** Confirmation callback. Returns true when the user approves execution. */\nexport type ConfirmFn = (message: string) => Promise<boolean>;\n\n/** Options controlling how a bash command is evaluated by the shared gate. */\nexport interface CommandGateOptions {\n\t/** Whether a dialog-capable UI is available for confirmation. */\n\thasUI: boolean;\n\t/** Interactive confirmation callback used when `hasUI` is true. */\n\tconfirm?: ConfirmFn;\n\t/** Headless policy for `confirm`-tier verdicts. `priv.*` is never allowed. Defaults to \"deny\". */\n\theadlessConfirmPolicy?: \"deny\" | \"allow\";\n\t/** Extra substrings that promote allow/confirm verdicts to block. Never relaxes a block. */\n\textraDeny?: string[];\n}\n\n/** @deprecated Back-compat alias for {@link CommandGateOptions}. */\nexport type UserBashEvaluateOptions = CommandGateOptions;\n\nfunction formatReason(verdict: CommandVerdict): string {\n\treturn `[${verdict.rule}] ${verdict.reason}`;\n}\n\nfunction matchesExtraDeny(command: string, patterns: string[] | undefined): boolean {\n\tif (!patterns || patterns.length === 0) return false;\n\tfor (const pattern of patterns) {\n\t\tif (pattern.length > 0 && command.includes(pattern)) return true;\n\t}\n\treturn false;\n}\n\n/**\n * Classify a command, applying `extraDeny` promotion.\n *\n * `extraDeny` can only escalate allow/confirm to block; an existing block\n * verdict is returned unchanged.\n */\nfunction classifyWithExtraDeny(command: string, extraDeny?: string[]): CommandVerdict {\n\tconst verdict = classifyShellCommand(command);\n\tif (verdict.risk === \"block\") return verdict;\n\tif (matchesExtraDeny(command, extraDeny)) {\n\t\treturn {\n\t\t\trisk: \"block\",\n\t\t\trule: \"command.extra_deny\",\n\t\t\treason: \"Command matches a configured deny pattern.\",\n\t\t};\n\t}\n\treturn verdict;\n}\n\n/**\n * Pure block-only check for an LLM `bash` tool call.\n *\n * Only block-tier verdicts produce a block here; confirm/allow pass through.\n * Used as a low-level non-negotiable floor (for example by the bash tool's\n * effective-command check after commandPrefix/spawnHook) where no confirm UI\n * or policy context exists. The confirm-deny behavior for the live tool_call\n * gate lives in {@link evaluateCommandGate}.\n */\nexport function evaluateBashToolCall(\n\tcommand: string,\n\textraDeny?: string[],\n): { block: true; reason: string } | undefined {\n\tconst verdict = classifyWithExtraDeny(command, extraDeny);\n\tif (verdict.risk === \"block\") {\n\t\treturn { block: true, reason: formatReason(verdict) };\n\t}\n\treturn undefined;\n}\n\n/**\n * Shared gate decision for any bash command (LLM tool call, user bash, RPC bash).\n *\n * - block  => deny.\n * - confirm => hasUI ? (approved ? undefined : deny) : (policy === \"allow\" && !priv ? undefined : deny).\n * - allow  => undefined (preserve later extensions / default execution).\n */\nexport async function evaluateCommandGate(\n\tcommand: string,\n\topts: CommandGateOptions,\n): Promise<{ deny: boolean; reason: string } | undefined> {\n\tconst verdict = classifyWithExtraDeny(command, opts.extraDeny);\n\n\tif (verdict.risk === \"allow\") return undefined;\n\tif (verdict.risk === \"block\") {\n\t\treturn { deny: true, reason: formatReason(verdict) };\n\t}\n\n\t// confirm-tier verdict.\n\tif (opts.hasUI) {\n\t\tif (opts.confirm) {\n\t\t\tconst approved = await opts.confirm(formatReason(verdict));\n\t\t\treturn approved ? undefined : { deny: true, reason: formatReason(verdict) };\n\t\t}\n\t\t// UI claimed but no confirm callback: cannot obtain consent => fail-closed.\n\t\treturn { deny: true, reason: formatReason(verdict) };\n\t}\n\n\t// Headless: privilege escalation is never auto-allowed.\n\tconst isPrivilege = verdict.rule.startsWith(\"priv.\");\n\tif (!isPrivilege && opts.headlessConfirmPolicy === \"allow\") {\n\t\treturn undefined;\n\t}\n\treturn { deny: true, reason: formatReason(verdict) };\n}\n\n/** @deprecated Back-compat alias; prefer {@link evaluateCommandGate}. */\nexport const evaluateUserBash = evaluateCommandGate;\n\n/** Build a synthetic failed `BashResult` surfacing the safety reason. */\nexport function buildBlockedBashResult(reason: string): BashResult {\n\treturn {\n\t\toutput: `command-safety: blocked\\n${reason}`,\n\t\texitCode: 1,\n\t\tcancelled: false,\n\t\ttruncated: false,\n\t};\n}\n\n/**\n * Extension factory. Registered as the first extension so its handlers run\n * before any discovered extension (`tool_call` short-circuits on first block;\n * `user_bash` short-circuits on first truthy result).\n */\nexport default function commandSafetyGate(omk: ExtensionAPI): void {\n\tomk.on(\"tool_call\", async (event, ctx) => {\n\t\tif (!isToolCallEventType(\"bash\", event)) return undefined;\n\t\tconst decision = await evaluateCommandGate(event.input.command, {\n\t\t\thasUI: ctx.hasUI,\n\t\t\tconfirm: ctx.hasUI ? (message) => ctx.ui.confirm(\"Command safety\", message) : undefined,\n\t\t\theadlessConfirmPolicy: \"deny\",\n\t\t});\n\t\tif (decision?.deny) {\n\t\t\treturn { block: true, reason: decision.reason };\n\t\t}\n\t\treturn undefined;\n\t});\n\n\tomk.on(\"user_bash\", async (event, ctx) => {\n\t\tconst decision = await evaluateCommandGate(event.command, {\n\t\t\thasUI: ctx.hasUI,\n\t\t\tconfirm: ctx.hasUI ? (message) => ctx.ui.confirm(\"Command safety\", message) : undefined,\n\t\t\theadlessConfirmPolicy: \"deny\",\n\t\t});\n\t\tif (decision?.deny) {\n\t\t\treturn { result: buildBlockedBashResult(decision.reason) };\n\t\t}\n\t\treturn undefined;\n\t});\n}\n"]}
+{"version":3,"file":"command-safety-gate.js","sourceRoot":"","sources":["../../../../src/core/extensions/builtin/command-safety-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EAAuB,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACpF,OAAO,EAAqB,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAsBrE,SAAS,YAAY,CAAC,OAAuB,EAAU;IACtD,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;AAAA,CAC7C;AAED,SAAS,gBAAgB,CAAC,OAAe,EAAE,QAA8B,EAAW;IACnF,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,OAAe,EAAE,SAAoB,EAAkB;IACrF,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IAC7C,IAAI,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;QAC1C,OAAO;YACN,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,4CAA4C;SACpD,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AAAA,CACf;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CACnC,OAAe,EACf,SAAoB,EAC0B;IAC9C,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAe,EACf,IAAwB,EACiC;IACzD,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAE/D,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,CAAC;IAED,wBAAwB;IACxB,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,wBAAwB,KAAK,OAAO,EAAE,CAAC;YAC/D,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3D,OAAO,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7E,CAAC;QACD,4EAA4E;QAC5E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,CAAC;IAED,wDAAwD;IACxD,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,qBAAqB,KAAK,OAAO,EAAE,CAAC;QAC5D,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;AAAA,CACrD;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAEpD,MAAM,UAAU,+BAA+B,CAC9C,GAAG,GAAqE,OAAO,CAAC,GAAG,EACzE;IACV,OAAO,GAAG,CAAC,6BAA6B,KAAK,GAAG,IAAI,GAAG,CAAC,6BAA6B,KAAK,MAAM,CAAC;AAAA,CACjG;AAED,SAAS,2BAA2B,GAAmF;IACtH,IAAI,CAAC,+BAA+B,EAAE,EAAE,CAAC;QACxC,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,wBAAwB,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,CAAC;AAAA,CAC7E;AAED,yEAAyE;AACzE,MAAM,UAAU,sBAAsB,CAAC,MAAc,EAAc;IAClE,OAAO;QACN,MAAM,EAAE,4BAA4B,MAAM,EAAE;QAC5C,QAAQ,EAAE,CAAC;QACX,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,KAAK;KAChB,CAAC;AAAA,CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,OAAO,UAAU,iBAAiB,CAAC,GAAiB,EAAQ;IAClE,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;YAC/D,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;YACvF,GAAG,2BAA2B,EAAE;SAChC,CAAC,CAAC;QACH,IAAI,QAAQ,EAAE,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACjD,CAAC;QACD,OAAO,SAAS,CAAC;IAAA,CACjB,CAAC,CAAC;IAEH,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE;YACzD,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;YACvF,GAAG,2BAA2B,EAAE;SAChC,CAAC,CAAC;QACH,IAAI,QAAQ,EAAE,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,CAAC;QACD,OAAO,SAAS,CAAC;IAAA,CACjB,CAAC,CAAC;AAAA,CACH","sourcesContent":["/**\n * Built-in command-safety gate extension.\n *\n * Wires the pure `classifyShellCommand` verdict engine into the live bash entry\n * points with one shared decision engine (`evaluateCommandGate`):\n * - LLM tool calls (`tool_call` for the `bash` tool) — block-tier verdicts stop\n *   execution via `{ block, reason }`. confirm-tier verdicts prompt when a\n *   dialog-capable UI is available and otherwise deny headlessly (parity with\n *   user bash). `priv.*` is never auto-allowed.\n * - User `!`/`!!` bash (`user_bash`) — block/confirm verdicts produce a synthetic\n *   FAILED `BashResult` instead of running the command.\n * - RPC bash routes through `AgentSession.executeBash({ safetyGate: \"headless\" })`\n *   which reuses `evaluateCommandGate` and `buildBlockedBashResult` directly.\n *\n * Fail-closed contract:\n * - `user_bash` deny NEVER throws. A thrown `user_bash` handler is logged by the\n *   runner and default execution continues (fail-open). Returning a synthetic\n *   failed `result` short-circuits execution safely.\n * - `confirm`-tier verdicts deny by default when no interactive UI is available.\n * - `priv.*` verdicts are never headless-allowed.\n *\n * This gate reuses `command-safety.ts` read-only and adds no new classification\n * branches. `extraDeny` patterns can only promote allow/confirm to block; they\n * can never relax a block verdict.\n */\n\nimport type { BashResult } from \"../../bash-executor.ts\";\nimport { type CommandVerdict, classifyShellCommand } from \"../../command-safety.ts\";\nimport { type ExtensionAPI, isToolCallEventType } from \"../types.ts\";\n\n/** Confirmation callback. Returns true when the user approves execution. */\nexport type ConfirmFn = (message: string) => Promise<boolean>;\n\n/** Options controlling how a bash command is evaluated by the shared gate. */\nexport interface CommandGateOptions {\n\t/** Whether a dialog-capable UI is available for confirmation. */\n\thasUI: boolean;\n\t/** Interactive confirmation callback used when `hasUI` is true. */\n\tconfirm?: ConfirmFn;\n\t/** Interactive policy for non-privilege `confirm`-tier verdicts. Defaults to \"ask\". */\n\tinteractiveConfirmPolicy?: \"ask\" | \"allow\";\n\t/** Headless policy for `confirm`-tier verdicts. `priv.*` is never allowed. Defaults to \"deny\". */\n\theadlessConfirmPolicy?: \"deny\" | \"allow\";\n\t/** Extra substrings that promote allow/confirm verdicts to block. Never relaxes a block. */\n\textraDeny?: string[];\n}\n\n/** @deprecated Back-compat alias for {@link CommandGateOptions}. */\nexport type UserBashEvaluateOptions = CommandGateOptions;\n\nfunction formatReason(verdict: CommandVerdict): string {\n\treturn `[${verdict.rule}] ${verdict.reason}`;\n}\n\nfunction matchesExtraDeny(command: string, patterns: string[] | undefined): boolean {\n\tif (!patterns || patterns.length === 0) return false;\n\tfor (const pattern of patterns) {\n\t\tif (pattern.length > 0 && command.includes(pattern)) return true;\n\t}\n\treturn false;\n}\n\n/**\n * Classify a command, applying `extraDeny` promotion.\n *\n * `extraDeny` can only escalate allow/confirm to block; an existing block\n * verdict is returned unchanged.\n */\nfunction classifyWithExtraDeny(command: string, extraDeny?: string[]): CommandVerdict {\n\tconst verdict = classifyShellCommand(command);\n\tif (verdict.risk === \"block\") return verdict;\n\tif (matchesExtraDeny(command, extraDeny)) {\n\t\treturn {\n\t\t\trisk: \"block\",\n\t\t\trule: \"command.extra_deny\",\n\t\t\treason: \"Command matches a configured deny pattern.\",\n\t\t};\n\t}\n\treturn verdict;\n}\n\n/**\n * Pure block-only check for an LLM `bash` tool call.\n *\n * Only block-tier verdicts produce a block here; confirm/allow pass through.\n * Used as a low-level non-negotiable floor (for example by the bash tool's\n * effective-command check after commandPrefix/spawnHook) where no confirm UI\n * or policy context exists. The confirm-deny behavior for the live tool_call\n * gate lives in {@link evaluateCommandGate}.\n */\nexport function evaluateBashToolCall(\n\tcommand: string,\n\textraDeny?: string[],\n): { block: true; reason: string } | undefined {\n\tconst verdict = classifyWithExtraDeny(command, extraDeny);\n\tif (verdict.risk === \"block\") {\n\t\treturn { block: true, reason: formatReason(verdict) };\n\t}\n\treturn undefined;\n}\n\n/**\n * Shared gate decision for any bash command (LLM tool call, user bash, RPC bash).\n *\n * - block  => deny.\n * - confirm => hasUI ? (approved ? undefined : deny) : (policy === \"allow\" && !priv ? undefined : deny).\n * - allow  => undefined (preserve later extensions / default execution).\n */\nexport async function evaluateCommandGate(\n\tcommand: string,\n\topts: CommandGateOptions,\n): Promise<{ deny: boolean; reason: string } | undefined> {\n\tconst verdict = classifyWithExtraDeny(command, opts.extraDeny);\n\n\tif (verdict.risk === \"allow\") return undefined;\n\tif (verdict.risk === \"block\") {\n\t\treturn { deny: true, reason: formatReason(verdict) };\n\t}\n\n\t// confirm-tier verdict.\n\tconst isPrivilege = verdict.rule.startsWith(\"priv.\");\n\tif (opts.hasUI) {\n\t\tif (!isPrivilege && opts.interactiveConfirmPolicy === \"allow\") {\n\t\t\treturn undefined;\n\t\t}\n\t\tif (opts.confirm) {\n\t\t\tconst approved = await opts.confirm(formatReason(verdict));\n\t\t\treturn approved ? undefined : { deny: true, reason: formatReason(verdict) };\n\t\t}\n\t\t// UI claimed but no confirm callback: cannot obtain consent => fail-closed.\n\t\treturn { deny: true, reason: formatReason(verdict) };\n\t}\n\n\t// Headless: privilege escalation is never auto-allowed.\n\tif (!isPrivilege && opts.headlessConfirmPolicy === \"allow\") {\n\t\treturn undefined;\n\t}\n\treturn { deny: true, reason: formatReason(verdict) };\n}\n\n/** @deprecated Back-compat alias; prefer {@link evaluateCommandGate}. */\nexport const evaluateUserBash = evaluateCommandGate;\n\nexport function isCommandSafetyAssumeYesEnabled(\n\tenv: NodeJS.ProcessEnv | Readonly<Record<string, string | undefined>> = process.env,\n): boolean {\n\treturn env.OMK_COMMAND_SAFETY_ASSUME_YES === \"1\" || env.OMK_COMMAND_SAFETY_ASSUME_YES === \"true\";\n}\n\nfunction getAssumeYesConfirmPolicies(): Pick<CommandGateOptions, \"interactiveConfirmPolicy\" | \"headlessConfirmPolicy\"> {\n\tif (!isCommandSafetyAssumeYesEnabled()) {\n\t\treturn { interactiveConfirmPolicy: \"ask\", headlessConfirmPolicy: \"deny\" };\n\t}\n\treturn { interactiveConfirmPolicy: \"allow\", headlessConfirmPolicy: \"allow\" };\n}\n\n/** Build a synthetic failed `BashResult` surfacing the safety reason. */\nexport function buildBlockedBashResult(reason: string): BashResult {\n\treturn {\n\t\toutput: `command-safety: blocked\\n${reason}`,\n\t\texitCode: 1,\n\t\tcancelled: false,\n\t\ttruncated: false,\n\t};\n}\n\n/**\n * Extension factory. Registered as the first extension so its handlers run\n * before any discovered extension (`tool_call` short-circuits on first block;\n * `user_bash` short-circuits on first truthy result).\n */\nexport default function commandSafetyGate(omk: ExtensionAPI): void {\n\tomk.on(\"tool_call\", async (event, ctx) => {\n\t\tif (!isToolCallEventType(\"bash\", event)) return undefined;\n\t\tconst decision = await evaluateCommandGate(event.input.command, {\n\t\t\thasUI: ctx.hasUI,\n\t\t\tconfirm: ctx.hasUI ? (message) => ctx.ui.confirm(\"Command safety\", message) : undefined,\n\t\t\t...getAssumeYesConfirmPolicies(),\n\t\t});\n\t\tif (decision?.deny) {\n\t\t\treturn { block: true, reason: decision.reason };\n\t\t}\n\t\treturn undefined;\n\t});\n\n\tomk.on(\"user_bash\", async (event, ctx) => {\n\t\tconst decision = await evaluateCommandGate(event.command, {\n\t\t\thasUI: ctx.hasUI,\n\t\t\tconfirm: ctx.hasUI ? (message) => ctx.ui.confirm(\"Command safety\", message) : undefined,\n\t\t\t...getAssumeYesConfirmPolicies(),\n\t\t});\n\t\tif (decision?.deny) {\n\t\t\treturn { result: buildBlockedBashResult(decision.reason) };\n\t\t}\n\t\treturn undefined;\n\t});\n}\n"]}

package/dist/core/extensions/builtin/todo-checklist.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Built-in TODO checklist extension.
+ *
+ * Exposes an `update_todo` tool the model calls to maintain a visible,
+ * dynamically-generated checklist of the current plan. The checklist is NOT
+ * hardcoded: the LLM emits the items on every call (replacing the previous
+ * list), and they render live in the terminal UI above the editor.
+ *
+ * Design notes:
+ * - State is held per-loaded-extension and reset on session_start.
+ * - The widget is mounted via ctx.ui.setWidget with a factory that binds the
+ *   latest state snapshot, so each update re-renders with current items.
+ * - Headless / no-UI sessions still update state and return a summary; the
+ *   setWidget call is wrapped so a missing UI never breaks the tool.
+ * - Web/extension observations are never involved; this tool only carries the
+ *   model's own plan text.
+ */
+import type { ExtensionAPI } from "../types.ts";
+export default function todoChecklist(omk: ExtensionAPI): void;
+//# sourceMappingURL=todo-checklist.d.ts.map

package/dist/core/extensions/builtin/todo-checklist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"todo-checklist.d.ts","sourceRoot":"","sources":["../../../../src/core/extensions/builtin/todo-checklist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAOH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,CAAC,OAAO,UAAU,aAAa,CAAC,GAAG,EAAE,YAAY,GAAG,IAAI,CA2D7D","sourcesContent":["/**\n * Built-in TODO checklist extension.\n *\n * Exposes an `update_todo` tool the model calls to maintain a visible,\n * dynamically-generated checklist of the current plan. The checklist is NOT\n * hardcoded: the LLM emits the items on every call (replacing the previous\n * list), and they render live in the terminal UI above the editor.\n *\n * Design notes:\n * - State is held per-loaded-extension and reset on session_start.\n * - The widget is mounted via ctx.ui.setWidget with a factory that binds the\n *   latest state snapshot, so each update re-renders with current items.\n * - Headless / no-UI sessions still update state and return a summary; the\n *   setWidget call is wrapped so a missing UI never breaks the tool.\n * - Web/extension observations are never involved; this tool only carries the\n *   model's own plan text.\n */\n\nimport { StringEnum, Type } from \"omk-ai\";\nimport { TodoChecklistComponent } from \"../../../modes/interactive/components/todo-checklist.ts\";\nimport { resetCurrentTodoState, setCurrentTodoState } from \"../../todo-runtime-state.ts\";\nimport type { TodoState, TodoStatus } from \"../../todo-state.ts\";\nimport { EMPTY_TODO_STATE, setTodoItems, summary } from \"../../todo-state.ts\";\nimport type { ExtensionAPI } from \"../types.ts\";\n\nexport default function todoChecklist(omk: ExtensionAPI): void {\n\tlet state: TodoState = EMPTY_TODO_STATE;\n\n\tomk.on(\"session_start\", () => {\n\t\tstate = EMPTY_TODO_STATE;\n\t\tresetCurrentTodoState();\n\t});\n\n\tomk.registerTool({\n\t\tname: \"update_todo\",\n\t\tlabel: \"Update TODO checklist\",\n\t\tdescription:\n\t\t\t\"Update the visible TODO checklist shown in the terminal UI with the current plan. Pass the FULL current list of tasks on every call (this replaces the previous list). Use this to keep the user informed of progress: mark items pending/active/done/blocked as work proceeds.\",\n\t\tpromptSnippet:\n\t\t\t\"Maintain a live TODO checklist in the terminal UI by calling update_todo with the current plan and item statuses.\",\n\t\tpromptGuidelines: [\n\t\t\t\"Call update_todo at the start of non-trivial multi-step work and after each task transitions state.\",\n\t\t\t\"Pass the complete current list each call (the tool replaces, not appends). Keep labels short and verb-led.\",\n\t\t\t\"Set exactly one item to 'active' (the task in progress); mark finished items 'done' and blockers 'blocked'.\",\n\t\t],\n\t\tparameters: Type.Object({\n\t\t\titems: Type.Array(\n\t\t\t\tType.Object({\n\t\t\t\t\tid: Type.String({ description: \"Stable identifier for the task (reuse across updates).\" }),\n\t\t\t\t\tlabel: Type.String({ description: \"Short human-readable task description.\" }),\n\t\t\t\t\tstatus: StringEnum([\"pending\", \"active\", \"done\", \"blocked\"], {\n\t\t\t\t\t\tdescription: \"pending=not started, active=in progress, done=complete, blocked=stuck.\",\n\t\t\t\t\t}),\n\t\t\t\t\tdetail: Type.Optional(Type.String({ description: \"Optional extra context for the task.\" })),\n\t\t\t\t}),\n\t\t\t\t{ description: \"Full current list of checklist items.\" },\n\t\t\t),\n\t\t}),\n\t\tasync execute(_toolCallId, params, _signal, _onUpdate, ctx) {\n\t\t\tstate = setTodoItems(\n\t\t\t\tstate,\n\t\t\t\tparams.items.map((item) => ({ ...item, status: item.status as TodoStatus })),\n\t\t\t);\n\t\t\tsetCurrentTodoState(state);\n\t\t\tconst snapshot = state;\n\t\t\ttry {\n\t\t\t\tctx.ui.setWidget(\"omk-todo\", () => new TodoChecklistComponent(() => snapshot), {\n\t\t\t\t\tplacement: \"aboveEditor\",\n\t\t\t\t});\n\t\t\t} catch {\n\t\t\t\t// UI may be unavailable in headless mode; state still updates.\n\t\t\t}\n\t\t\tconst s = summary(state);\n\t\t\treturn {\n\t\t\t\tcontent: [\n\t\t\t\t\t{\n\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\ttext: `TODO updated: ${s.done}/${s.total} done · ${s.active} active · ${s.pending} pending · ${s.blocked} blocked`,\n\t\t\t\t\t},\n\t\t\t\t],\n\t\t\t\tdetails: { summary: s, total: s.total },\n\t\t\t};\n\t\t},\n\t});\n}\n"]}

package/dist/core/extensions/builtin/todo-checklist.js

@@ -0,0 +1,73 @@
+/**
+ * Built-in TODO checklist extension.
+ *
+ * Exposes an `update_todo` tool the model calls to maintain a visible,
+ * dynamically-generated checklist of the current plan. The checklist is NOT
+ * hardcoded: the LLM emits the items on every call (replacing the previous
+ * list), and they render live in the terminal UI above the editor.
+ *
+ * Design notes:
+ * - State is held per-loaded-extension and reset on session_start.
+ * - The widget is mounted via ctx.ui.setWidget with a factory that binds the
+ *   latest state snapshot, so each update re-renders with current items.
+ * - Headless / no-UI sessions still update state and return a summary; the
+ *   setWidget call is wrapped so a missing UI never breaks the tool.
+ * - Web/extension observations are never involved; this tool only carries the
+ *   model's own plan text.
+ */
+import { StringEnum, Type } from "omk-ai";
+import { TodoChecklistComponent } from "../../../modes/interactive/components/todo-checklist.js";
+import { resetCurrentTodoState, setCurrentTodoState } from "../../todo-runtime-state.js";
+import { EMPTY_TODO_STATE, setTodoItems, summary } from "../../todo-state.js";
+export default function todoChecklist(omk) {
+    let state = EMPTY_TODO_STATE;
+    omk.on("session_start", () => {
+        state = EMPTY_TODO_STATE;
+        resetCurrentTodoState();
+    });
+    omk.registerTool({
+        name: "update_todo",
+        label: "Update TODO checklist",
+        description: "Update the visible TODO checklist shown in the terminal UI with the current plan. Pass the FULL current list of tasks on every call (this replaces the previous list). Use this to keep the user informed of progress: mark items pending/active/done/blocked as work proceeds.",
+        promptSnippet: "Maintain a live TODO checklist in the terminal UI by calling update_todo with the current plan and item statuses.",
+        promptGuidelines: [
+            "Call update_todo at the start of non-trivial multi-step work and after each task transitions state.",
+            "Pass the complete current list each call (the tool replaces, not appends). Keep labels short and verb-led.",
+            "Set exactly one item to 'active' (the task in progress); mark finished items 'done' and blockers 'blocked'.",
+        ],
+        parameters: Type.Object({
+            items: Type.Array(Type.Object({
+                id: Type.String({ description: "Stable identifier for the task (reuse across updates)." }),
+                label: Type.String({ description: "Short human-readable task description." }),
+                status: StringEnum(["pending", "active", "done", "blocked"], {
+                    description: "pending=not started, active=in progress, done=complete, blocked=stuck.",
+                }),
+                detail: Type.Optional(Type.String({ description: "Optional extra context for the task." })),
+            }), { description: "Full current list of checklist items." }),
+        }),
+        async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
+            state = setTodoItems(state, params.items.map((item) => ({ ...item, status: item.status })));
+            setCurrentTodoState(state);
+            const snapshot = state;
+            try {
+                ctx.ui.setWidget("omk-todo", () => new TodoChecklistComponent(() => snapshot), {
+                    placement: "aboveEditor",
+                });
+            }
+            catch {
+                // UI may be unavailable in headless mode; state still updates.
+            }
+            const s = summary(state);
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `TODO updated: ${s.done}/${s.total} done · ${s.active} active · ${s.pending} pending · ${s.blocked} blocked`,
+                    },
+                ],
+                details: { summary: s, total: s.total },
+            };
+        },
+    });
+}
+//# sourceMappingURL=todo-checklist.js.map

package/dist/core/extensions/builtin/todo-checklist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"todo-checklist.js","sourceRoot":"","sources":["../../../../src/core/extensions/builtin/todo-checklist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACjG,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEzF,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAG9E,MAAM,CAAC,OAAO,UAAU,aAAa,CAAC,GAAiB,EAAQ;IAC9D,IAAI,KAAK,GAAc,gBAAgB,CAAC;IAExC,GAAG,CAAC,EAAE,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC;QAC7B,KAAK,GAAG,gBAAgB,CAAC;QACzB,qBAAqB,EAAE,CAAC;IAAA,CACxB,CAAC,CAAC;IAEH,GAAG,CAAC,YAAY,CAAC;QAChB,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EACV,iRAAiR;QAClR,aAAa,EACZ,mHAAmH;QACpH,gBAAgB,EAAE;YACjB,qGAAqG;YACrG,4GAA4G;YAC5G,6GAA6G;SAC7G;QACD,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK,CAChB,IAAI,CAAC,MAAM,CAAC;gBACX,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,wDAAwD,EAAE,CAAC;gBAC1F,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;gBAC7E,MAAM,EAAE,UAAU,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE;oBAC5D,WAAW,EAAE,wEAAwE;iBACrF,CAAC;gBACF,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC,CAAC;aAC3F,CAAC,EACF,EAAE,WAAW,EAAE,uCAAuC,EAAE,CACxD;SACD,CAAC;QACF,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE;YAC3D,KAAK,GAAG,YAAY,CACnB,KAAK,EACL,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAoB,EAAE,CAAC,CAAC,CAC5E,CAAC;YACF,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC3B,MAAM,QAAQ,GAAG,KAAK,CAAC;YACvB,IAAI,CAAC;gBACJ,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,sBAAsB,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE;oBAC9E,SAAS,EAAE,aAAa;iBACxB,CAAC,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACR,+DAA+D;YAChE,CAAC;YACD,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YACzB,OAAO;gBACN,OAAO,EAAE;oBACR;wBACC,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,iBAAiB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,YAAW,CAAC,CAAC,MAAM,cAAa,CAAC,CAAC,OAAO,eAAc,CAAC,CAAC,OAAO,UAAU;qBAClH;iBACD;gBACD,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;aACvC,CAAC;QAAA,CACF;KACD,CAAC,CAAC;AAAA,CACH","sourcesContent":["/**\n * Built-in TODO checklist extension.\n *\n * Exposes an `update_todo` tool the model calls to maintain a visible,\n * dynamically-generated checklist of the current plan. The checklist is NOT\n * hardcoded: the LLM emits the items on every call (replacing the previous\n * list), and they render live in the terminal UI above the editor.\n *\n * Design notes:\n * - State is held per-loaded-extension and reset on session_start.\n * - The widget is mounted via ctx.ui.setWidget with a factory that binds the\n *   latest state snapshot, so each update re-renders with current items.\n * - Headless / no-UI sessions still update state and return a summary; the\n *   setWidget call is wrapped so a missing UI never breaks the tool.\n * - Web/extension observations are never involved; this tool only carries the\n *   model's own plan text.\n */\n\nimport { StringEnum, Type } from \"omk-ai\";\nimport { TodoChecklistComponent } from \"../../../modes/interactive/components/todo-checklist.ts\";\nimport { resetCurrentTodoState, setCurrentTodoState } from \"../../todo-runtime-state.ts\";\nimport type { TodoState, TodoStatus } from \"../../todo-state.ts\";\nimport { EMPTY_TODO_STATE, setTodoItems, summary } from \"../../todo-state.ts\";\nimport type { ExtensionAPI } from \"../types.ts\";\n\nexport default function todoChecklist(omk: ExtensionAPI): void {\n\tlet state: TodoState = EMPTY_TODO_STATE;\n\n\tomk.on(\"session_start\", () => {\n\t\tstate = EMPTY_TODO_STATE;\n\t\tresetCurrentTodoState();\n\t});\n\n\tomk.registerTool({\n\t\tname: \"update_todo\",\n\t\tlabel: \"Update TODO checklist\",\n\t\tdescription:\n\t\t\t\"Update the visible TODO checklist shown in the terminal UI with the current plan. Pass the FULL current list of tasks on every call (this replaces the previous list). Use this to keep the user informed of progress: mark items pending/active/done/blocked as work proceeds.\",\n\t\tpromptSnippet:\n\t\t\t\"Maintain a live TODO checklist in the terminal UI by calling update_todo with the current plan and item statuses.\",\n\t\tpromptGuidelines: [\n\t\t\t\"Call update_todo at the start of non-trivial multi-step work and after each task transitions state.\",\n\t\t\t\"Pass the complete current list each call (the tool replaces, not appends). Keep labels short and verb-led.\",\n\t\t\t\"Set exactly one item to 'active' (the task in progress); mark finished items 'done' and blockers 'blocked'.\",\n\t\t],\n\t\tparameters: Type.Object({\n\t\t\titems: Type.Array(\n\t\t\t\tType.Object({\n\t\t\t\t\tid: Type.String({ description: \"Stable identifier for the task (reuse across updates).\" }),\n\t\t\t\t\tlabel: Type.String({ description: \"Short human-readable task description.\" }),\n\t\t\t\t\tstatus: StringEnum([\"pending\", \"active\", \"done\", \"blocked\"], {\n\t\t\t\t\t\tdescription: \"pending=not started, active=in progress, done=complete, blocked=stuck.\",\n\t\t\t\t\t}),\n\t\t\t\t\tdetail: Type.Optional(Type.String({ description: \"Optional extra context for the task.\" })),\n\t\t\t\t}),\n\t\t\t\t{ description: \"Full current list of checklist items.\" },\n\t\t\t),\n\t\t}),\n\t\tasync execute(_toolCallId, params, _signal, _onUpdate, ctx) {\n\t\t\tstate = setTodoItems(\n\t\t\t\tstate,\n\t\t\t\tparams.items.map((item) => ({ ...item, status: item.status as TodoStatus })),\n\t\t\t);\n\t\t\tsetCurrentTodoState(state);\n\t\t\tconst snapshot = state;\n\t\t\ttry {\n\t\t\t\tctx.ui.setWidget(\"omk-todo\", () => new TodoChecklistComponent(() => snapshot), {\n\t\t\t\t\tplacement: \"aboveEditor\",\n\t\t\t\t});\n\t\t\t} catch {\n\t\t\t\t// UI may be unavailable in headless mode; state still updates.\n\t\t\t}\n\t\t\tconst s = summary(state);\n\t\t\treturn {\n\t\t\t\tcontent: [\n\t\t\t\t\t{\n\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\ttext: `TODO updated: ${s.done}/${s.total} done · ${s.active} active · ${s.pending} pending · ${s.blocked} blocked`,\n\t\t\t\t\t},\n\t\t\t\t],\n\t\t\t\tdetails: { summary: s, total: s.total },\n\t\t\t};\n\t\t},\n\t});\n}\n"]}

package/dist/core/extensions/loader.d.ts

@@ -3,7 +3,7 @@
  *
  */
 import { type EventBus } from "../event-bus.ts";
-import type { Extension, ExtensionFactory, ExtensionRuntime, LoadExtensionsOptions, LoadExtensionsResult } from "./types.ts";
+import type { Extension, ExtensionFactory, ExtensionRuntime, LoadExtensionsResult } from "./types.ts";
 /**
  * Create a runtime with throwing stubs for action methods.
  * Runner.bindCore() replaces these with real implementations.
@@ -12,13 +12,13 @@ export declare function createExtensionRuntime(): ExtensionRuntime;
 /**
  * Create an Extension from an inline factory function.
  */
-export declare function loadExtensionFromFactory(factory: ExtensionFactory, cwd: string, eventBus: EventBus, runtime: ExtensionRuntime, extensionPath?: string, options?: LoadExtensionsOptions): Promise<Extension>;
+export declare function loadExtensionFromFactory(factory: ExtensionFactory, cwd: string, eventBus: EventBus, runtime: ExtensionRuntime, extensionPath?: string): Promise<Extension>;
 /**
  * Load extensions from paths.
  */
-export declare function loadExtensions(paths: string[], cwd: string, eventBus?: EventBus, options?: LoadExtensionsOptions): Promise<LoadExtensionsResult>;
+export declare function loadExtensions(paths: string[], cwd: string, eventBus?: EventBus): Promise<LoadExtensionsResult>;
 /**
  * Discover and load extensions from standard locations.
  */
-export declare function discoverAndLoadExtensions(configuredPaths: string[], cwd: string, agentDir?: string, eventBus?: EventBus, options?: LoadExtensionsOptions): Promise<LoadExtensionsResult>;
+export declare function discoverAndLoadExtensions(configuredPaths: string[], cwd: string, agentDir?: string, eventBus?: EventBus): Promise<LoadExtensionsResult>;
 //# sourceMappingURL=loader.d.ts.map

package/dist/core/extensions/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../src/core/extensions/loader.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAuBH,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAMhE,OAAO,KAAK,EACX,SAAS,EAGT,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EAKpB,MAAM,YAAY,CAAC;AAgJpB;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,gBAAgB,CA8CzD;AA+OD;;GAEG;AACH,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,gBAAgB,EACzB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,gBAAgB,EACzB,aAAa,SAAa,EAC1B,OAAO,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,SAAS,CAAC,CAMpB;AAED;;GAEG;AACH,wBAAsB,cAAc,CACnC,KAAK,EAAE,MAAM,EAAE,EACf,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,QAAQ,EACnB,OAAO,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,oBAAoB,CAAC,CA+B/B;AA6GD;;GAEG;AACH,wBAAsB,yBAAyB,CAC9C,eAAe,EAAE,MAAM,EAAE,EACzB,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,MAAsB,EAChC,QAAQ,CAAC,EAAE,QAAQ,EACnB,OAAO,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,oBAAoB,CAAC,CA2C/B","sourcesContent":["/**\n * Extension loader - loads TypeScript extension modules using jiti.\n *\n */\n\nimport * as fs from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport * as path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport * as _bundledOmkAgentCore from \"@earendil-works/omk-agent-core\";\nimport * as _bundledOmkAi from \"@earendil-works/omk-ai\";\nimport * as _bundledOmkAiOauth from \"@earendil-works/omk-ai/oauth\";\nimport type { KeyId } from \"@earendil-works/omk-tui\";\nimport * as _bundledOmkTui from \"@earendil-works/omk-tui\";\nimport { createJiti } from \"jiti/static\";\n// Static imports of packages that extensions may use.\n// These MUST be static so Bun bundles them into the compiled binary.\n// The virtualModules option then makes them available to extensions.\nimport * as _bundledTypebox from \"typebox\";\nimport * as _bundledTypeboxCompile from \"typebox/compile\";\nimport * as _bundledTypeboxValue from \"typebox/value\";\nimport { CONFIG_DIR_NAME, getAgentDir, isBunBinary } from \"../../config.ts\";\n// NOTE: This import works because loader.ts exports are NOT re-exported from index.ts,\n// avoiding a circular dependency. Extensions can import from open-multi-agent-kit.\nimport * as _bundledOmkCodingAgent from \"../../index.ts\";\nimport { resolvePath } from \"../../utils/paths.ts\";\nimport { createEventBus, type EventBus } from \"../event-bus.ts\";\nimport type { ExecOptions } from \"../exec.ts\";\nimport { execCommand } from \"../exec.ts\";\nimport type { SandboxBackendStatus, SandboxPlatform } from \"../sandbox/policy.ts\";\nimport { buildSandboxedSpawnRequest } from \"../sandbox/spawn.ts\";\nimport { createSyntheticSourceInfo } from \"../source-info.ts\";\nimport type {\n\tExtension,\n\tExtensionAPI,\n\tExtensionExecSandbox,\n\tExtensionFactory,\n\tExtensionRuntime,\n\tLoadExtensionsOptions,\n\tLoadExtensionsResult,\n\tMessageRenderer,\n\tProviderConfig,\n\tRegisteredCommand,\n\tToolDefinition,\n} from \"./types.ts\";\n\n/** Modules available to extensions via virtualModules (for compiled Bun binary) */\nconst VIRTUAL_MODULES: Record<string, unknown> = {\n\ttypebox: _bundledTypebox,\n\t\"typebox/compile\": _bundledTypeboxCompile,\n\t\"typebox/value\": _bundledTypeboxValue,\n\t\"@sinclair/typebox\": _bundledTypebox,\n\t\"@sinclair/typebox/compile\": _bundledTypeboxCompile,\n\t\"@sinclair/typebox/value\": _bundledTypeboxValue,\n\t\"@earendil-works/omk-agent-core\": _bundledOmkAgentCore,\n\t\"@earendil-works/omk-tui\": _bundledOmkTui,\n\t\"@earendil-works/omk-ai\": _bundledOmkAi,\n\t\"@earendil-works/omk-ai/oauth\": _bundledOmkAiOauth,\n\t\"open-multi-agent-kit\": _bundledOmkCodingAgent,\n\t\"@earendil-works/pi-agent-core\": _bundledOmkAgentCore,\n\t\"@earendil-works/pi-tui\": _bundledOmkTui,\n\t\"@earendil-works/pi-ai\": _bundledOmkAi,\n\t\"@earendil-works/pi-ai/oauth\": _bundledOmkAiOauth,\n\t\"@earendil-works/pi-coding-agent\": _bundledOmkCodingAgent,\n\t\"@mariozechner/pi-agent-core\": _bundledOmkAgentCore,\n\t\"@mariozechner/pi-tui\": _bundledOmkTui,\n\t\"@mariozechner/pi-ai\": _bundledOmkAi,\n\t\"@mariozechner/pi-ai/oauth\": _bundledOmkAiOauth,\n\t\"@mariozechner/pi-coding-agent\": _bundledOmkCodingAgent,\n};\n\nconst require = createRequire(import.meta.url);\n\n/**\n * Default sandbox backend status for extension exec when none is supplied: no\n * OS-level backend, on the current platform. This makes enforce mode fail closed\n * unless the caller explicitly provides an available backend.\n */\nfunction defaultExtensionExecBackend(): SandboxBackendStatus {\n\tconst platform: SandboxPlatform =\n\t\tprocess.platform === \"linux\" ? \"linux\" : process.platform === \"darwin\" ? \"macos\" : \"unsupported\";\n\treturn { platform, backendAvailable: false };\n}\n\ninterface ExtensionExecCommandPlan {\n\treadonly command: string;\n\treadonly args: readonly string[];\n\treadonly cwd: string;\n\treadonly env?: NodeJS.ProcessEnv;\n}\n\nfunction planExtensionExecCommand(\n\tcommand: string,\n\targs: readonly string[],\n\tcwd: string,\n\toptions: ExecOptions | undefined,\n\texecSandbox: ExtensionExecSandbox | undefined,\n): ExtensionExecCommandPlan {\n\tconst requestedCwd = options?.cwd ?? cwd;\n\tif (!execSandbox) {\n\t\treturn { command, args, cwd: requestedCwd, env: options?.env };\n\t}\n\n\tconst sandbox = buildSandboxedSpawnRequest({\n\t\targv: [command, ...args],\n\t\tcwd: requestedCwd,\n\t\tenv: options?.env ?? process.env,\n\t\tpolicy: execSandbox.policy,\n\t\tbackend: execSandbox.backend ?? defaultExtensionExecBackend(),\n\t\tresolver: execSandbox.resolver,\n\t});\n\tif (!sandbox.allowed) {\n\t\tthrow new Error(`sandbox: exec denied\\n[${sandbox.rule}] ${sandbox.reason}`);\n\t}\n\n\tconst [sandboxedCommand, ...sandboxedArgs] = sandbox.argv;\n\tif (!sandboxedCommand) {\n\t\tthrow new Error(\"sandbox: exec denied\\n[sandbox.empty_argv] Sandbox wrapper returned an empty argv.\");\n\t}\n\n\treturn {\n\t\tcommand: sandboxedCommand,\n\t\targs: sandboxedArgs,\n\t\tcwd: sandbox.cwd,\n\t\tenv: sandbox.env,\n\t};\n}\n\n/**\n * Get aliases for jiti (used in Node.js/development mode).\n * In Bun binary mode, virtualModules is used instead.\n */\nlet _aliases: Record<string, string> | null = null;\n\nfunction getAliases(): Record<string, string> {\n\tif (_aliases) return _aliases;\n\n\tconst __dirname = path.dirname(fileURLToPath(import.meta.url));\n\tconst packageIndex = path.resolve(__dirname, \"../..\", \"index.js\");\n\n\tconst typeboxEntry = require.resolve(\"typebox\");\n\tconst typeboxCompileEntry = require.resolve(\"typebox/compile\");\n\tconst typeboxValueEntry = require.resolve(\"typebox/value\");\n\n\tconst packagesRoot = path.resolve(__dirname, \"../../../../\");\n\tconst resolveWorkspaceOrImport = (workspaceRelativePath: string, specifier: string): string => {\n\t\tconst workspacePath = path.join(packagesRoot, workspaceRelativePath);\n\t\tif (fs.existsSync(workspacePath)) {\n\t\t\treturn workspacePath;\n\t\t}\n\t\treturn fileURLToPath(import.meta.resolve(specifier));\n\t};\n\n\tconst omkCodingAgentEntry = packageIndex;\n\tconst omkAgentCoreEntry = resolveWorkspaceOrImport(\"agent/dist/index.js\", \"@earendil-works/omk-agent-core\");\n\tconst omkTuiEntry = resolveWorkspaceOrImport(\"tui/dist/index.js\", \"@earendil-works/omk-tui\");\n\tconst omkAiEntry = resolveWorkspaceOrImport(\"ai/dist/index.js\", \"@earendil-works/omk-ai\");\n\tconst omkAiOauthEntry = resolveWorkspaceOrImport(\"ai/dist/oauth.js\", \"@earendil-works/omk-ai/oauth\");\n\n\t_aliases = {\n\t\t\"open-multi-agent-kit\": omkCodingAgentEntry,\n\t\t\"@earendil-works/omk-agent-core\": omkAgentCoreEntry,\n\t\t\"@earendil-works/omk-tui\": omkTuiEntry,\n\t\t\"@earendil-works/omk-ai\": omkAiEntry,\n\t\t\"@earendil-works/omk-ai/oauth\": omkAiOauthEntry,\n\t\t\"@earendil-works/pi-coding-agent\": omkCodingAgentEntry,\n\t\t\"@earendil-works/pi-agent-core\": omkAgentCoreEntry,\n\t\t\"@earendil-works/pi-tui\": omkTuiEntry,\n\t\t\"@earendil-works/pi-ai\": omkAiEntry,\n\t\t\"@earendil-works/pi-ai/oauth\": omkAiOauthEntry,\n\t\t\"@mariozechner/pi-coding-agent\": omkCodingAgentEntry,\n\t\t\"@mariozechner/pi-agent-core\": omkAgentCoreEntry,\n\t\t\"@mariozechner/pi-tui\": omkTuiEntry,\n\t\t\"@mariozechner/pi-ai\": omkAiEntry,\n\t\t\"@mariozechner/pi-ai/oauth\": omkAiOauthEntry,\n\t\ttypebox: typeboxEntry,\n\t\t\"typebox/compile\": typeboxCompileEntry,\n\t\t\"typebox/value\": typeboxValueEntry,\n\t\t\"@sinclair/typebox\": typeboxEntry,\n\t\t\"@sinclair/typebox/compile\": typeboxCompileEntry,\n\t\t\"@sinclair/typebox/value\": typeboxValueEntry,\n\t};\n\n\treturn _aliases;\n}\n\ntype HandlerFn = (...args: unknown[]) => Promise<unknown>;\n\n/**\n * Create a runtime with throwing stubs for action methods.\n * Runner.bindCore() replaces these with real implementations.\n */\nexport function createExtensionRuntime(): ExtensionRuntime {\n\tconst notInitialized = () => {\n\t\tthrow new Error(\"Extension runtime not initialized. Action methods cannot be called during extension loading.\");\n\t};\n\tconst state: { staleMessage?: string } = {};\n\tconst assertActive = () => {\n\t\tif (state.staleMessage) {\n\t\t\tthrow new Error(state.staleMessage);\n\t\t}\n\t};\n\n\tconst runtime: ExtensionRuntime = {\n\t\tsendMessage: notInitialized,\n\t\tsendUserMessage: notInitialized,\n\t\tappendEntry: notInitialized,\n\t\tsetSessionName: notInitialized,\n\t\tgetSessionName: notInitialized,\n\t\tsetLabel: notInitialized,\n\t\tgetActiveTools: notInitialized,\n\t\tgetAllTools: notInitialized,\n\t\tsetActiveTools: notInitialized,\n\t\t// registerTool() is valid during extension load; refresh is only needed post-bind.\n\t\trefreshTools: () => {},\n\t\tgetCommands: notInitialized,\n\t\tsetModel: () => Promise.reject(new Error(\"Extension runtime not initialized\")),\n\t\tgetThinkingLevel: notInitialized,\n\t\tsetThinkingLevel: notInitialized,\n\t\tflagValues: new Map(),\n\t\tpendingProviderRegistrations: [],\n\t\tassertActive,\n\t\tinvalidate: (message) => {\n\t\t\tstate.staleMessage ??=\n\t\t\t\tmessage ??\n\t\t\t\t\"This extension ctx is stale after session replacement or reload. Do not use a captured omk or command ctx after ctx.newSession(), ctx.fork(), ctx.switchSession(), or ctx.reload(). For newSession, fork, and switchSession, move post-replacement work into withSession and use the ctx passed to withSession. For reload, do not use the old ctx after await ctx.reload().\";\n\t\t},\n\t\t// Pre-bind: queue registrations so bindCore() can flush them once the\n\t\t// model registry is available. bindCore() replaces both with direct calls.\n\t\tregisterProvider: (name, config, extensionPath = \"<unknown>\") => {\n\t\t\truntime.pendingProviderRegistrations.push({ name, config, extensionPath });\n\t\t},\n\t\tunregisterProvider: (name) => {\n\t\t\truntime.pendingProviderRegistrations = runtime.pendingProviderRegistrations.filter((r) => r.name !== name);\n\t\t},\n\t};\n\n\treturn runtime;\n}\n\n/**\n * Create the ExtensionAPI for an extension.\n * Registration methods write to the extension object.\n * Action methods delegate to the shared runtime.\n */\nfunction createExtensionAPI(\n\textension: Extension,\n\truntime: ExtensionRuntime,\n\tcwd: string,\n\teventBus: EventBus,\n\texecSandbox?: ExtensionExecSandbox,\n): ExtensionAPI {\n\tconst api = {\n\t\t// Registration methods - write to extension\n\t\ton(event: string, handler: HandlerFn): void {\n\t\t\truntime.assertActive();\n\t\t\tconst list = extension.handlers.get(event) ?? [];\n\t\t\tlist.push(handler);\n\t\t\textension.handlers.set(event, list);\n\t\t},\n\n\t\tregisterTool(tool: ToolDefinition): void {\n\t\t\truntime.assertActive();\n\t\t\textension.tools.set(tool.name, {\n\t\t\t\tdefinition: tool,\n\t\t\t\tsourceInfo: extension.sourceInfo,\n\t\t\t});\n\t\t\truntime.refreshTools();\n\t\t},\n\n\t\tregisterCommand(name: string, options: Omit<RegisteredCommand, \"name\" | \"sourceInfo\">): void {\n\t\t\truntime.assertActive();\n\t\t\textension.commands.set(name, {\n\t\t\t\tname,\n\t\t\t\tsourceInfo: extension.sourceInfo,\n\t\t\t\t...options,\n\t\t\t});\n\t\t},\n\n\t\tregisterShortcut(\n\t\t\tshortcut: KeyId,\n\t\t\toptions: {\n\t\t\t\tdescription?: string;\n\t\t\t\thandler: (ctx: import(\"./types.ts\").ExtensionContext) => Promise<void> | void;\n\t\t\t},\n\t\t): void {\n\t\t\truntime.assertActive();\n\t\t\textension.shortcuts.set(shortcut, { shortcut, extensionPath: extension.path, ...options });\n\t\t},\n\n\t\tregisterFlag(\n\t\t\tname: string,\n\t\t\toptions: { description?: string; type: \"boolean\" | \"string\"; default?: boolean | string },\n\t\t): void {\n\t\t\truntime.assertActive();\n\t\t\textension.flags.set(name, { name, extensionPath: extension.path, ...options });\n\t\t\tif (options.default !== undefined && !runtime.flagValues.has(name)) {\n\t\t\t\truntime.flagValues.set(name, options.default);\n\t\t\t}\n\t\t},\n\n\t\tregisterMessageRenderer<T>(customType: string, renderer: MessageRenderer<T>): void {\n\t\t\truntime.assertActive();\n\t\t\textension.messageRenderers.set(customType, renderer as MessageRenderer);\n\t\t},\n\n\t\t// Flag access - checks extension registered it, reads from runtime\n\t\tgetFlag(name: string): boolean | string | undefined {\n\t\t\truntime.assertActive();\n\t\t\tif (!extension.flags.has(name)) return undefined;\n\t\t\treturn runtime.flagValues.get(name);\n\t\t},\n\n\t\t// Action methods - delegate to shared runtime\n\t\tsendMessage(message, options): void {\n\t\t\truntime.assertActive();\n\t\t\truntime.sendMessage(message, options);\n\t\t},\n\n\t\tsendUserMessage(content, options): void {\n\t\t\truntime.assertActive();\n\t\t\truntime.sendUserMessage(content, options);\n\t\t},\n\n\t\tappendEntry(customType: string, data?: unknown): void {\n\t\t\truntime.assertActive();\n\t\t\truntime.appendEntry(customType, data);\n\t\t},\n\n\t\tsetSessionName(name: string): void {\n\t\t\truntime.assertActive();\n\t\t\truntime.setSessionName(name);\n\t\t},\n\n\t\tgetSessionName(): string | undefined {\n\t\t\truntime.assertActive();\n\t\t\treturn runtime.getSessionName();\n\t\t},\n\n\t\tsetLabel(entryId: string, label: string | undefined): void {\n\t\t\truntime.assertActive();\n\t\t\truntime.setLabel(entryId, label);\n\t\t},\n\n\t\tasync exec(command: string, args: string[], options?: ExecOptions) {\n\t\t\truntime.assertActive();\n\t\t\tconst planned = planExtensionExecCommand(command, args, cwd, options, execSandbox);\n\t\t\treturn execCommand(planned.command, [...planned.args], planned.cwd, { ...options, env: planned.env });\n\t\t},\n\n\t\tgetActiveTools(): string[] {\n\t\t\truntime.assertActive();\n\t\t\treturn runtime.getActiveTools();\n\t\t},\n\n\t\tgetAllTools() {\n\t\t\truntime.assertActive();\n\t\t\treturn runtime.getAllTools();\n\t\t},\n\n\t\tsetActiveTools(toolNames: string[]): void {\n\t\t\truntime.assertActive();\n\t\t\truntime.setActiveTools(toolNames);\n\t\t},\n\n\t\tgetCommands() {\n\t\t\truntime.assertActive();\n\t\t\treturn runtime.getCommands();\n\t\t},\n\n\t\tsetModel(model) {\n\t\t\truntime.assertActive();\n\t\t\treturn runtime.setModel(model);\n\t\t},\n\n\t\tgetThinkingLevel() {\n\t\t\truntime.assertActive();\n\t\t\treturn runtime.getThinkingLevel();\n\t\t},\n\n\t\tsetThinkingLevel(level) {\n\t\t\truntime.assertActive();\n\t\t\truntime.setThinkingLevel(level);\n\t\t},\n\n\t\tregisterProvider(name: string, config: ProviderConfig) {\n\t\t\truntime.assertActive();\n\t\t\truntime.registerProvider(name, config, extension.path);\n\t\t},\n\n\t\tunregisterProvider(name: string) {\n\t\t\truntime.assertActive();\n\t\t\truntime.unregisterProvider(name, extension.path);\n\t\t},\n\n\t\t// Track omk.events subscriptions on the extension so they can be\n\t\t// unsubscribed on reload instead of stacking duplicate listeners\n\t\t// on the shared event bus.\n\t\tevents: {\n\t\t\temit: (channel, data) => {\n\t\t\t\teventBus.emit(channel, data);\n\t\t\t},\n\t\t\ton: (channel, handler) => {\n\t\t\t\tconst unsubscribe = eventBus.on(channel, handler);\n\t\t\t\textension.eventBusSubscriptions?.push(unsubscribe);\n\t\t\t\treturn unsubscribe;\n\t\t\t},\n\t\t},\n\t} as ExtensionAPI;\n\n\treturn api;\n}\n\nasync function loadExtensionModule(extensionPath: string) {\n\tconst jiti = createJiti(import.meta.url, {\n\t\tmoduleCache: false,\n\t\t// In Bun binary: use virtualModules for bundled packages (no filesystem resolution)\n\t\t// Also disable tryNative so jiti handles ALL imports (not just the entry point)\n\t\t// In Node.js/dev: use aliases to resolve to node_modules paths\n\t\t...(isBunBinary ? { virtualModules: VIRTUAL_MODULES, tryNative: false } : { alias: getAliases() }),\n\t});\n\n\tconst module = await jiti.import(extensionPath, { default: true });\n\tconst factory = module as ExtensionFactory;\n\treturn typeof factory !== \"function\" ? undefined : factory;\n}\n\n/**\n * Create an Extension object with empty collections.\n */\nfunction createExtension(extensionPath: string, resolvedPath: string): Extension {\n\tconst source =\n\t\textensionPath.startsWith(\"<\") && extensionPath.endsWith(\">\")\n\t\t\t? extensionPath.slice(1, -1).split(\":\")[0] || \"temporary\"\n\t\t\t: \"local\";\n\tconst baseDir = extensionPath.startsWith(\"<\") ? undefined : path.dirname(resolvedPath);\n\n\treturn {\n\t\tpath: extensionPath,\n\t\tresolvedPath,\n\t\tsourceInfo: createSyntheticSourceInfo(extensionPath, { source, baseDir }),\n\t\thandlers: new Map(),\n\t\ttools: new Map(),\n\t\tmessageRenderers: new Map(),\n\t\tcommands: new Map(),\n\t\tflags: new Map(),\n\t\tshortcuts: new Map(),\n\t\teventBusSubscriptions: [],\n\t};\n}\n\nasync function loadExtension(\n\textensionPath: string,\n\tcwd: string,\n\teventBus: EventBus,\n\truntime: ExtensionRuntime,\n\texecSandbox?: ExtensionExecSandbox,\n): Promise<{ extension: Extension | null; error: string | null }> {\n\tconst resolvedPath = resolvePath(extensionPath, cwd, { normalizeUnicodeSpaces: true });\n\n\ttry {\n\t\tconst factory = await loadExtensionModule(resolvedPath);\n\t\tif (!factory) {\n\t\t\treturn { extension: null, error: `Extension does not export a valid factory function: ${extensionPath}` };\n\t\t}\n\n\t\tconst extension = createExtension(extensionPath, resolvedPath);\n\t\tconst api = createExtensionAPI(extension, runtime, cwd, eventBus, execSandbox);\n\t\tawait factory(api);\n\n\t\treturn { extension, error: null };\n\t} catch (err) {\n\t\tconst message = err instanceof Error ? err.message : String(err);\n\t\treturn { extension: null, error: `Failed to load extension: ${message}` };\n\t}\n}\n\n/**\n * Create an Extension from an inline factory function.\n */\nexport async function loadExtensionFromFactory(\n\tfactory: ExtensionFactory,\n\tcwd: string,\n\teventBus: EventBus,\n\truntime: ExtensionRuntime,\n\textensionPath = \"<inline>\",\n\toptions?: LoadExtensionsOptions,\n): Promise<Extension> {\n\tconst extension = createExtension(extensionPath, extensionPath);\n\tconst resolvedCwd = resolvePath(cwd);\n\tconst api = createExtensionAPI(extension, runtime, resolvedCwd, eventBus, options?.execSandbox);\n\tawait factory(api);\n\treturn extension;\n}\n\n/**\n * Load extensions from paths.\n */\nexport async function loadExtensions(\n\tpaths: string[],\n\tcwd: string,\n\teventBus?: EventBus,\n\toptions?: LoadExtensionsOptions,\n): Promise<LoadExtensionsResult> {\n\tconst extensions: Extension[] = [];\n\tconst errors: Array<{ path: string; error: string }> = [];\n\tconst resolvedCwd = resolvePath(cwd);\n\tconst resolvedEventBus = eventBus ?? createEventBus();\n\tconst runtime = createExtensionRuntime();\n\n\tfor (const extPath of paths) {\n\t\tconst { extension, error } = await loadExtension(\n\t\t\textPath,\n\t\t\tresolvedCwd,\n\t\t\tresolvedEventBus,\n\t\t\truntime,\n\t\t\toptions?.execSandbox,\n\t\t);\n\n\t\tif (error) {\n\t\t\terrors.push({ path: extPath, error });\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (extension) {\n\t\t\textensions.push(extension);\n\t\t}\n\t}\n\n\treturn {\n\t\textensions,\n\t\terrors,\n\t\truntime,\n\t};\n}\n\ninterface OmkManifest {\n\textensions?: string[];\n\tthemes?: string[];\n\tskills?: string[];\n\tprompts?: string[];\n}\n\nfunction readOmkManifest(packageJsonPath: string): OmkManifest | null {\n\ttry {\n\t\tconst content = fs.readFileSync(packageJsonPath, \"utf-8\");\n\t\tconst pkg = JSON.parse(content) as { omk?: unknown; pi?: unknown };\n\t\tconst manifest = pkg.omk ?? pkg.pi;\n\t\treturn manifest && typeof manifest === \"object\" ? (manifest as OmkManifest) : null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nfunction isExtensionFile(name: string): boolean {\n\treturn name.endsWith(\".ts\") || name.endsWith(\".js\");\n}\n\n/**\n * Resolve extension entry points from a directory.\n *\n * Checks for:\n * 1. package.json with \"omk.extensions\" field -> returns declared paths\n * 2. index.ts or index.js -> returns the index file\n *\n * Returns resolved paths or null if no entry points found.\n */\nfunction resolveExtensionEntries(dir: string): string[] | null {\n\t// Check for package.json with \"omk\" field first\n\tconst packageJsonPath = path.join(dir, \"package.json\");\n\tif (fs.existsSync(packageJsonPath)) {\n\t\tconst manifest = readOmkManifest(packageJsonPath);\n\t\tif (manifest?.extensions?.length) {\n\t\t\tconst entries: string[] = [];\n\t\t\tfor (const extPath of manifest.extensions) {\n\t\t\t\tconst resolvedExtPath = path.resolve(dir, extPath);\n\t\t\t\tif (fs.existsSync(resolvedExtPath)) {\n\t\t\t\t\tentries.push(resolvedExtPath);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (entries.length > 0) {\n\t\t\t\treturn entries;\n\t\t\t}\n\t\t}\n\t}\n\n\t// Check for index.ts or index.js\n\tconst indexTs = path.join(dir, \"index.ts\");\n\tconst indexJs = path.join(dir, \"index.js\");\n\tif (fs.existsSync(indexTs)) {\n\t\treturn [indexTs];\n\t}\n\tif (fs.existsSync(indexJs)) {\n\t\treturn [indexJs];\n\t}\n\n\treturn null;\n}\n\n/**\n * Discover extensions in a directory.\n *\n * Discovery rules:\n * 1. Direct files: `extensions/*.ts` or `*.js` → load\n * 2. Subdirectory with index: `extensions/<name>/index.ts` or `index.js` → load\n * 3. Subdirectory with package.json: `extensions/<name>/package.json` with an `omk` manifest → load what it declares\n *\n * No recursion beyond one level. Complex packages must use package.json manifest.\n */\nfunction discoverExtensionsInDir(dir: string): string[] {\n\tif (!fs.existsSync(dir)) {\n\t\treturn [];\n\t}\n\n\tconst discovered: string[] = [];\n\n\ttry {\n\t\tconst entries = fs.readdirSync(dir, { withFileTypes: true });\n\n\t\tfor (const entry of entries) {\n\t\t\tconst entryPath = path.join(dir, entry.name);\n\n\t\t\t// 1. Direct files: *.ts or *.js\n\t\t\tif ((entry.isFile() || entry.isSymbolicLink()) && isExtensionFile(entry.name)) {\n\t\t\t\tdiscovered.push(entryPath);\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\t// 2 & 3. Subdirectories\n\t\t\tif (entry.isDirectory() || entry.isSymbolicLink()) {\n\t\t\t\tconst entries = resolveExtensionEntries(entryPath);\n\t\t\t\tif (entries) {\n\t\t\t\t\tdiscovered.push(...entries);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t} catch {\n\t\treturn [];\n\t}\n\n\treturn discovered;\n}\n\n/**\n * Discover and load extensions from standard locations.\n */\nexport async function discoverAndLoadExtensions(\n\tconfiguredPaths: string[],\n\tcwd: string,\n\tagentDir: string = getAgentDir(),\n\teventBus?: EventBus,\n\toptions?: LoadExtensionsOptions,\n): Promise<LoadExtensionsResult> {\n\tconst resolvedCwd = resolvePath(cwd);\n\tconst resolvedAgentDir = resolvePath(agentDir);\n\tconst allPaths: string[] = [];\n\tconst seen = new Set<string>();\n\n\tconst addPaths = (paths: string[]) => {\n\t\tfor (const p of paths) {\n\t\t\tconst resolved = path.resolve(p);\n\t\t\tif (!seen.has(resolved)) {\n\t\t\t\tseen.add(resolved);\n\t\t\t\tallPaths.push(p);\n\t\t\t}\n\t\t}\n\t};\n\n\t// 1. Project-local extensions: cwd/${CONFIG_DIR_NAME}/extensions/\n\tconst localExtDir = path.join(resolvedCwd, CONFIG_DIR_NAME, \"extensions\");\n\taddPaths(discoverExtensionsInDir(localExtDir));\n\n\t// 2. Global extensions: agentDir/extensions/\n\tconst globalExtDir = path.join(resolvedAgentDir, \"extensions\");\n\taddPaths(discoverExtensionsInDir(globalExtDir));\n\n\t// 3. Explicitly configured paths\n\tfor (const p of configuredPaths) {\n\t\tconst resolved = resolvePath(p, resolvedCwd, { normalizeUnicodeSpaces: true });\n\t\tif (fs.existsSync(resolved) && fs.statSync(resolved).isDirectory()) {\n\t\t\t// Check for package.json with omk manifest or index.ts\n\t\t\tconst entries = resolveExtensionEntries(resolved);\n\t\t\tif (entries) {\n\t\t\t\taddPaths(entries);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\t// No explicit entries - discover individual files in directory\n\t\t\taddPaths(discoverExtensionsInDir(resolved));\n\t\t\tcontinue;\n\t\t}\n\n\t\taddPaths([resolved]);\n\t}\n\n\treturn loadExtensions(allPaths, resolvedCwd, eventBus, options);\n}\n"]}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../src/core/extensions/loader.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAuBH,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAIhE,OAAO,KAAK,EACX,SAAS,EAET,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EAKpB,MAAM,YAAY,CAAC;AA+FpB;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,gBAAgB,CA8CzD;AA4OD;;GAEG;AACH,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,gBAAgB,EACzB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,gBAAgB,EACzB,aAAa,SAAa,GACxB,OAAO,CAAC,SAAS,CAAC,CAMpB;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAyBrH;AA6GD;;GAEG;AACH,wBAAsB,yBAAyB,CAC9C,eAAe,EAAE,MAAM,EAAE,EACzB,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,MAAsB,EAChC,QAAQ,CAAC,EAAE,QAAQ,GACjB,OAAO,CAAC,oBAAoB,CAAC,CA2C/B","sourcesContent":["/**\n * Extension loader - loads TypeScript extension modules using jiti.\n *\n */\n\nimport * as fs from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport * as path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { createJiti } from \"jiti/static\";\nimport * as _bundledOmkAgentCore from \"omk-agent-core\";\nimport * as _bundledOmkAi from \"omk-ai\";\nimport * as _bundledOmkAiOauth from \"omk-ai/oauth\";\nimport type { KeyId } from \"omk-tui\";\nimport * as _bundledOmkTui from \"omk-tui\";\n// Static imports of packages that extensions may use.\n// These MUST be static so Bun bundles them into the compiled binary.\n// The virtualModules option then makes them available to extensions.\nimport * as _bundledTypebox from \"typebox\";\nimport * as _bundledTypeboxCompile from \"typebox/compile\";\nimport * as _bundledTypeboxValue from \"typebox/value\";\nimport { CONFIG_DIR_NAME, getAgentDir, isBunBinary } from \"../../config.ts\";\n// NOTE: This import works because loader.ts exports are NOT re-exported from index.ts,\n// avoiding a circular dependency. Extensions can import from open-multi-agent-kit.\nimport * as _bundledOmkCodingAgent from \"../../index.ts\";\nimport { resolvePath } from \"../../utils/paths.ts\";\nimport { createEventBus, type EventBus } from \"../event-bus.ts\";\nimport type { ExecOptions } from \"../exec.ts\";\nimport { execCommand } from \"../exec.ts\";\nimport { createSyntheticSourceInfo } from \"../source-info.ts\";\nimport type {\n\tExtension,\n\tExtensionAPI,\n\tExtensionFactory,\n\tExtensionRuntime,\n\tLoadExtensionsResult,\n\tMessageRenderer,\n\tProviderConfig,\n\tRegisteredCommand,\n\tToolDefinition,\n} from \"./types.ts\";\n\n/** Modules available to extensions via virtualModules (for compiled Bun binary) */\nconst VIRTUAL_MODULES: Record<string, unknown> = {\n\ttypebox: _bundledTypebox,\n\t\"typebox/compile\": _bundledTypeboxCompile,\n\t\"typebox/value\": _bundledTypeboxValue,\n\t\"@sinclair/typebox\": _bundledTypebox,\n\t\"@sinclair/typebox/compile\": _bundledTypeboxCompile,\n\t\"@sinclair/typebox/value\": _bundledTypeboxValue,\n\t\"omk-agent-core\": _bundledOmkAgentCore,\n\t\"omk-tui\": _bundledOmkTui,\n\t\"omk-ai\": _bundledOmkAi,\n\t\"omk-ai/oauth\": _bundledOmkAiOauth,\n\t\"open-multi-agent-kit\": _bundledOmkCodingAgent,\n};\n\nconst require = createRequire(import.meta.url);\n\n/**\n * Get aliases for jiti (used in Node.js/development mode).\n * In Bun binary mode, virtualModules is used instead.\n */\nlet _aliases: Record<string, string> | null = null;\n\nfunction getAliases(): Record<string, string> {\n\tif (_aliases) return _aliases;\n\n\tconst __dirname = path.dirname(fileURLToPath(import.meta.url));\n\tconst packageIndex = path.resolve(__dirname, \"../..\", \"index.js\");\n\n\tconst typeboxEntry = require.resolve(\"typebox\");\n\tconst typeboxCompileEntry = require.resolve(\"typebox/compile\");\n\tconst typeboxValueEntry = require.resolve(\"typebox/value\");\n\n\tconst packagesRoot = path.resolve(__dirname, \"../../../../\");\n\tconst findPackageJsonPath = (specifier: string): string => {\n\t\ttry {\n\t\t\treturn require.resolve(`${specifier}/package.json`);\n\t\t} catch {\n\t\t\tlet current = __dirname;\n\t\t\twhile (true) {\n\t\t\t\tconst candidate = path.join(current, \"node_modules\", ...specifier.split(\"/\"), \"package.json\");\n\t\t\t\tif (fs.existsSync(candidate)) {\n\t\t\t\t\treturn candidate;\n\t\t\t\t}\n\t\t\t\tconst parent = path.dirname(current);\n\t\t\t\tif (parent === current) {\n\t\t\t\t\tthrow new Error(`Unable to resolve package.json for ${specifier}`);\n\t\t\t\t}\n\t\t\t\tcurrent = parent;\n\t\t\t}\n\t\t}\n\t};\n\tconst resolvePackageFile = (specifier: string, packageRelativePath: string): string => {\n\t\tconst packageJsonPath = findPackageJsonPath(specifier);\n\t\treturn path.join(path.dirname(packageJsonPath), packageRelativePath);\n\t};\n\tconst resolveWorkspaceOrPackageFile = (\n\t\tworkspaceRelativePath: string,\n\t\tspecifier: string,\n\t\tpackageRelativePath: string,\n\t): string => {\n\t\tconst workspacePath = path.join(packagesRoot, workspaceRelativePath);\n\t\tif (fs.existsSync(workspacePath)) {\n\t\t\treturn workspacePath;\n\t\t}\n\t\treturn resolvePackageFile(specifier, packageRelativePath);\n\t};\n\n\tconst omkCodingAgentEntry = packageIndex;\n\tconst omkAgentCoreEntry = resolveWorkspaceOrPackageFile(\"agent/dist/index.js\", \"omk-agent-core\", \"dist/index.js\");\n\tconst omkTuiEntry = resolveWorkspaceOrPackageFile(\"tui/dist/index.js\", \"omk-tui\", \"dist/index.js\");\n\tconst omkAiEntry = resolveWorkspaceOrPackageFile(\"ai/dist/index.js\", \"omk-ai\", \"dist/index.js\");\n\tconst omkAiOauthEntry = resolveWorkspaceOrPackageFile(\"ai/dist/oauth.js\", \"omk-ai\", \"dist/oauth.js\");\n\n\t_aliases = {\n\t\t\"open-multi-agent-kit\": omkCodingAgentEntry,\n\t\t\"omk-agent-core\": omkAgentCoreEntry,\n\t\t\"omk-tui\": omkTuiEntry,\n\t\t\"omk-ai\": omkAiEntry,\n\t\t\"omk-ai/oauth\": omkAiOauthEntry,\n\t\ttypebox: typeboxEntry,\n\t\t\"typebox/compile\": typeboxCompileEntry,\n\t\t\"typebox/value\": typeboxValueEntry,\n\t\t\"@sinclair/typebox\": typeboxEntry,\n\t\t\"@sinclair/typebox/compile\": typeboxCompileEntry,\n\t\t\"@sinclair/typebox/value\": typeboxValueEntry,\n\t};\n\n\treturn _aliases;\n}\n\ntype HandlerFn = (...args: unknown[]) => Promise<unknown>;\n\n/**\n * Create a runtime with throwing stubs for action methods.\n * Runner.bindCore() replaces these with real implementations.\n */\nexport function createExtensionRuntime(): ExtensionRuntime {\n\tconst notInitialized = () => {\n\t\tthrow new Error(\"Extension runtime not initialized. Action methods cannot be called during extension loading.\");\n\t};\n\tconst state: { staleMessage?: string } = {};\n\tconst assertActive = () => {\n\t\tif (state.staleMessage) {\n\t\t\tthrow new Error(state.staleMessage);\n\t\t}\n\t};\n\n\tconst runtime: ExtensionRuntime = {\n\t\tsendMessage: notInitialized,\n\t\tsendUserMessage: notInitialized,\n\t\tappendEntry: notInitialized,\n\t\tsetSessionName: notInitialized,\n\t\tgetSessionName: notInitialized,\n\t\tsetLabel: notInitialized,\n\t\tgetActiveTools: notInitialized,\n\t\tgetAllTools: notInitialized,\n\t\tsetActiveTools: notInitialized,\n\t\t// registerTool() is valid during extension load; refresh is only needed post-bind.\n\t\trefreshTools: () => {},\n\t\tgetCommands: notInitialized,\n\t\tsetModel: () => Promise.reject(new Error(\"Extension runtime not initialized\")),\n\t\tgetThinkingLevel: notInitialized,\n\t\tsetThinkingLevel: notInitialized,\n\t\tflagValues: new Map(),\n\t\tpendingProviderRegistrations: [],\n\t\tassertActive,\n\t\tinvalidate: (message) => {\n\t\t\tstate.staleMessage ??=\n\t\t\t\tmessage ??\n\t\t\t\t\"This extension ctx is stale after session replacement or reload. Do not use a captured extension API or command ctx after ctx.newSession(), ctx.fork(), ctx.switchSession(), or ctx.reload(). For newSession, fork, and switchSession, move post-replacement work into withSession and use the ctx passed to withSession. For reload, do not use the old ctx after await ctx.reload().\";\n\t\t},\n\t\t// Pre-bind: queue registrations so bindCore() can flush them once the\n\t\t// model registry is available. bindCore() replaces both with direct calls.\n\t\tregisterProvider: (name, config, extensionPath = \"<unknown>\") => {\n\t\t\truntime.pendingProviderRegistrations.push({ name, config, extensionPath });\n\t\t},\n\t\tunregisterProvider: (name) => {\n\t\t\truntime.pendingProviderRegistrations = runtime.pendingProviderRegistrations.filter((r) => r.name !== name);\n\t\t},\n\t};\n\n\treturn runtime;\n}\n\n/**\n * Create the ExtensionAPI for an extension.\n * Registration methods write to the extension object.\n * Action methods delegate to the shared runtime.\n */\nfunction createExtensionAPI(\n\textension: Extension,\n\truntime: ExtensionRuntime,\n\tcwd: string,\n\teventBus: EventBus,\n): ExtensionAPI {\n\tconst api = {\n\t\t// Registration methods - write to extension\n\t\ton(event: string, handler: HandlerFn): void {\n\t\t\truntime.assertActive();\n\t\t\tconst list = extension.handlers.get(event) ?? [];\n\t\t\tlist.push(handler);\n\t\t\textension.handlers.set(event, list);\n\t\t},\n\n\t\tregisterTool(tool: ToolDefinition): void {\n\t\t\truntime.assertActive();\n\t\t\textension.tools.set(tool.name, {\n\t\t\t\tdefinition: tool,\n\t\t\t\tsourceInfo: extension.sourceInfo,\n\t\t\t});\n\t\t\truntime.refreshTools();\n\t\t},\n\n\t\tregisterCommand(name: string, options: Omit<RegisteredCommand, \"name\" | \"sourceInfo\">): void {\n\t\t\truntime.assertActive();\n\t\t\textension.commands.set(name, {\n\t\t\t\tname,\n\t\t\t\tsourceInfo: extension.sourceInfo,\n\t\t\t\t...options,\n\t\t\t});\n\t\t},\n\n\t\tregisterShortcut(\n\t\t\tshortcut: KeyId,\n\t\t\toptions: {\n\t\t\t\tdescription?: string;\n\t\t\t\thandler: (ctx: import(\"./types.ts\").ExtensionContext) => Promise<void> | void;\n\t\t\t},\n\t\t): void {\n\t\t\truntime.assertActive();\n\t\t\textension.shortcuts.set(shortcut, { shortcut, extensionPath: extension.path, ...options });\n\t\t},\n\n\t\tregisterFlag(\n\t\t\tname: string,\n\t\t\toptions: { description?: string; type: \"boolean\" | \"string\"; default?: boolean | string },\n\t\t): void {\n\t\t\truntime.assertActive();\n\t\t\textension.flags.set(name, { name, extensionPath: extension.path, ...options });\n\t\t\tif (options.default !== undefined && !runtime.flagValues.has(name)) {\n\t\t\t\truntime.flagValues.set(name, options.default);\n\t\t\t}\n\t\t},\n\n\t\tregisterMessageRenderer<T>(customType: string, renderer: MessageRenderer<T>): void {\n\t\t\truntime.assertActive();\n\t\t\textension.messageRenderers.set(customType, renderer as MessageRenderer);\n\t\t},\n\n\t\t// Flag access - checks extension registered it, reads from runtime\n\t\tgetFlag(name: string): boolean | string | undefined {\n\t\t\truntime.assertActive();\n\t\t\tif (!extension.flags.has(name)) return undefined;\n\t\t\treturn runtime.flagValues.get(name);\n\t\t},\n\n\t\t// Action methods - delegate to shared runtime\n\t\tsendMessage(message, options): void {\n\t\t\truntime.assertActive();\n\t\t\truntime.sendMessage(message, options);\n\t\t},\n\n\t\tsendUserMessage(content, options): void {\n\t\t\truntime.assertActive();\n\t\t\truntime.sendUserMessage(content, options);\n\t\t},\n\n\t\tappendEntry(customType: string, data?: unknown): void {\n\t\t\truntime.assertActive();\n\t\t\truntime.appendEntry(customType, data);\n\t\t},\n\n\t\tsetSessionName(name: string): void {\n\t\t\truntime.assertActive();\n\t\t\truntime.setSessionName(name);\n\t\t},\n\n\t\tgetSessionName(): string | undefined {\n\t\t\truntime.assertActive();\n\t\t\treturn runtime.getSessionName();\n\t\t},\n\n\t\tsetLabel(entryId: string, label: string | undefined): void {\n\t\t\truntime.assertActive();\n\t\t\truntime.setLabel(entryId, label);\n\t\t},\n\n\t\texec(command: string, args: string[], options?: ExecOptions) {\n\t\t\truntime.assertActive();\n\t\t\treturn execCommand(command, args, options?.cwd ?? cwd, options);\n\t\t},\n\n\t\tgetActiveTools(): string[] {\n\t\t\truntime.assertActive();\n\t\t\treturn runtime.getActiveTools();\n\t\t},\n\n\t\tgetAllTools() {\n\t\t\truntime.assertActive();\n\t\t\treturn runtime.getAllTools();\n\t\t},\n\n\t\tsetActiveTools(toolNames: string[]): void {\n\t\t\truntime.assertActive();\n\t\t\truntime.setActiveTools(toolNames);\n\t\t},\n\n\t\tgetCommands() {\n\t\t\truntime.assertActive();\n\t\t\treturn runtime.getCommands();\n\t\t},\n\n\t\tsetModel(model) {\n\t\t\truntime.assertActive();\n\t\t\treturn runtime.setModel(model);\n\t\t},\n\n\t\tgetThinkingLevel() {\n\t\t\truntime.assertActive();\n\t\t\treturn runtime.getThinkingLevel();\n\t\t},\n\n\t\tsetThinkingLevel(level) {\n\t\t\truntime.assertActive();\n\t\t\truntime.setThinkingLevel(level);\n\t\t},\n\n\t\tregisterProvider(name: string, config: ProviderConfig) {\n\t\t\truntime.assertActive();\n\t\t\truntime.registerProvider(name, config, extension.path);\n\t\t},\n\n\t\tunregisterProvider(name: string) {\n\t\t\truntime.assertActive();\n\t\t\truntime.unregisterProvider(name, extension.path);\n\t\t},\n\n\t\t// Track extension event subscriptions so they can be\n\t\t// unsubscribed on reload instead of stacking duplicate listeners\n\t\t// on the shared event bus.\n\t\tevents: {\n\t\t\temit: (channel, data) => {\n\t\t\t\teventBus.emit(channel, data);\n\t\t\t},\n\t\t\ton: (channel, handler) => {\n\t\t\t\tconst unsubscribe = eventBus.on(channel, handler);\n\t\t\t\textension.eventBusSubscriptions?.push(unsubscribe);\n\t\t\t\treturn unsubscribe;\n\t\t\t},\n\t\t},\n\t} as ExtensionAPI;\n\n\treturn api;\n}\n\nasync function loadExtensionModule(extensionPath: string) {\n\tconst jiti = createJiti(import.meta.url, {\n\t\tmoduleCache: false,\n\t\t// In Bun binary: use virtualModules for bundled packages (no filesystem resolution)\n\t\t// Also disable tryNative so jiti handles ALL imports (not just the entry point)\n\t\t// In Node.js/dev: use aliases to resolve to node_modules paths\n\t\t...(isBunBinary ? { virtualModules: VIRTUAL_MODULES, tryNative: false } : { alias: getAliases() }),\n\t});\n\n\tconst module = await jiti.import(extensionPath, { default: true });\n\tconst factory = module as ExtensionFactory;\n\treturn typeof factory !== \"function\" ? undefined : factory;\n}\n\n/**\n * Create an Extension object with empty collections.\n */\nfunction createExtension(extensionPath: string, resolvedPath: string): Extension {\n\tconst source =\n\t\textensionPath.startsWith(\"<\") && extensionPath.endsWith(\">\")\n\t\t\t? extensionPath.slice(1, -1).split(\":\")[0] || \"temporary\"\n\t\t\t: \"local\";\n\tconst baseDir = extensionPath.startsWith(\"<\") ? undefined : path.dirname(resolvedPath);\n\n\treturn {\n\t\tpath: extensionPath,\n\t\tresolvedPath,\n\t\tsourceInfo: createSyntheticSourceInfo(extensionPath, { source, baseDir }),\n\t\thandlers: new Map(),\n\t\ttools: new Map(),\n\t\tmessageRenderers: new Map(),\n\t\tcommands: new Map(),\n\t\tflags: new Map(),\n\t\tshortcuts: new Map(),\n\t\teventBusSubscriptions: [],\n\t};\n}\n\nasync function loadExtension(\n\textensionPath: string,\n\tcwd: string,\n\teventBus: EventBus,\n\truntime: ExtensionRuntime,\n): Promise<{ extension: Extension | null; error: string | null }> {\n\tconst resolvedPath = resolvePath(extensionPath, cwd, { normalizeUnicodeSpaces: true });\n\n\ttry {\n\t\tconst factory = await loadExtensionModule(resolvedPath);\n\t\tif (!factory) {\n\t\t\treturn { extension: null, error: `Extension does not export a valid factory function: ${extensionPath}` };\n\t\t}\n\n\t\tconst extension = createExtension(extensionPath, resolvedPath);\n\t\tconst api = createExtensionAPI(extension, runtime, cwd, eventBus);\n\t\tawait factory(api);\n\n\t\treturn { extension, error: null };\n\t} catch (err) {\n\t\tconst message = err instanceof Error ? err.message : String(err);\n\t\treturn { extension: null, error: `Failed to load extension: ${message}` };\n\t}\n}\n\n/**\n * Create an Extension from an inline factory function.\n */\nexport async function loadExtensionFromFactory(\n\tfactory: ExtensionFactory,\n\tcwd: string,\n\teventBus: EventBus,\n\truntime: ExtensionRuntime,\n\textensionPath = \"<inline>\",\n): Promise<Extension> {\n\tconst extension = createExtension(extensionPath, extensionPath);\n\tconst resolvedCwd = resolvePath(cwd);\n\tconst api = createExtensionAPI(extension, runtime, resolvedCwd, eventBus);\n\tawait factory(api);\n\treturn extension;\n}\n\n/**\n * Load extensions from paths.\n */\nexport async function loadExtensions(paths: string[], cwd: string, eventBus?: EventBus): Promise<LoadExtensionsResult> {\n\tconst extensions: Extension[] = [];\n\tconst errors: Array<{ path: string; error: string }> = [];\n\tconst resolvedCwd = resolvePath(cwd);\n\tconst resolvedEventBus = eventBus ?? createEventBus();\n\tconst runtime = createExtensionRuntime();\n\n\tfor (const extPath of paths) {\n\t\tconst { extension, error } = await loadExtension(extPath, resolvedCwd, resolvedEventBus, runtime);\n\n\t\tif (error) {\n\t\t\terrors.push({ path: extPath, error });\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (extension) {\n\t\t\textensions.push(extension);\n\t\t}\n\t}\n\n\treturn {\n\t\textensions,\n\t\terrors,\n\t\truntime,\n\t};\n}\n\ninterface OmkManifest {\n\textensions?: string[];\n\tthemes?: string[];\n\tskills?: string[];\n\tprompts?: string[];\n}\n\nfunction readOmkManifest(packageJsonPath: string): OmkManifest | null {\n\ttry {\n\t\tconst content = fs.readFileSync(packageJsonPath, \"utf-8\");\n\t\tconst pkg = JSON.parse(content) as { omk?: unknown };\n\t\tconst manifest = pkg.omk;\n\t\treturn manifest && typeof manifest === \"object\" ? (manifest as OmkManifest) : null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nfunction isExtensionFile(name: string): boolean {\n\treturn name.endsWith(\".ts\") || name.endsWith(\".js\");\n}\n\n/**\n * Resolve extension entry points from a directory.\n *\n * Checks for:\n * 1. package.json with \"omk.extensions\" field -> returns declared paths\n * 2. index.ts or index.js -> returns the index file\n *\n * Returns resolved paths or null if no entry points found.\n */\nfunction resolveExtensionEntries(dir: string): string[] | null {\n\t// Check for package.json with \"omk\" field first\n\tconst packageJsonPath = path.join(dir, \"package.json\");\n\tif (fs.existsSync(packageJsonPath)) {\n\t\tconst manifest = readOmkManifest(packageJsonPath);\n\t\tif (manifest?.extensions?.length) {\n\t\t\tconst entries: string[] = [];\n\t\t\tfor (const extPath of manifest.extensions) {\n\t\t\t\tconst resolvedExtPath = path.resolve(dir, extPath);\n\t\t\t\tif (fs.existsSync(resolvedExtPath)) {\n\t\t\t\t\tentries.push(resolvedExtPath);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (entries.length > 0) {\n\t\t\t\treturn entries;\n\t\t\t}\n\t\t}\n\t}\n\n\t// Check for index.ts or index.js\n\tconst indexTs = path.join(dir, \"index.ts\");\n\tconst indexJs = path.join(dir, \"index.js\");\n\tif (fs.existsSync(indexTs)) {\n\t\treturn [indexTs];\n\t}\n\tif (fs.existsSync(indexJs)) {\n\t\treturn [indexJs];\n\t}\n\n\treturn null;\n}\n\n/**\n * Discover extensions in a directory.\n *\n * Discovery rules:\n * 1. Direct files: `extensions/*.ts` or `*.js` → load\n * 2. Subdirectory with index: `extensions/* /index.ts` or `index.js` → load\n * 3. Subdirectory with package.json: `extensions/* /package.json` with OMK manifest → load what it declares\n *\n * No recursion beyond one level. Complex packages must use package.json manifest.\n */\nfunction discoverExtensionsInDir(dir: string): string[] {\n\tif (!fs.existsSync(dir)) {\n\t\treturn [];\n\t}\n\n\tconst discovered: string[] = [];\n\n\ttry {\n\t\tconst entries = fs.readdirSync(dir, { withFileTypes: true });\n\n\t\tfor (const entry of entries) {\n\t\t\tconst entryPath = path.join(dir, entry.name);\n\n\t\t\t// 1. Direct files: *.ts or *.js\n\t\t\tif ((entry.isFile() || entry.isSymbolicLink()) && isExtensionFile(entry.name)) {\n\t\t\t\tdiscovered.push(entryPath);\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\t// 2 & 3. Subdirectories\n\t\t\tif (entry.isDirectory() || entry.isSymbolicLink()) {\n\t\t\t\tconst entries = resolveExtensionEntries(entryPath);\n\t\t\t\tif (entries) {\n\t\t\t\t\tdiscovered.push(...entries);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t} catch {\n\t\treturn [];\n\t}\n\n\treturn discovered;\n}\n\n/**\n * Discover and load extensions from standard locations.\n */\nexport async function discoverAndLoadExtensions(\n\tconfiguredPaths: string[],\n\tcwd: string,\n\tagentDir: string = getAgentDir(),\n\teventBus?: EventBus,\n): Promise<LoadExtensionsResult> {\n\tconst resolvedCwd = resolvePath(cwd);\n\tconst resolvedAgentDir = resolvePath(agentDir);\n\tconst allPaths: string[] = [];\n\tconst seen = new Set<string>();\n\n\tconst addPaths = (paths: string[]) => {\n\t\tfor (const p of paths) {\n\t\t\tconst resolved = path.resolve(p);\n\t\t\tif (!seen.has(resolved)) {\n\t\t\t\tseen.add(resolved);\n\t\t\t\tallPaths.push(p);\n\t\t\t}\n\t\t}\n\t};\n\n\t// 1. Project-local extensions: cwd/${CONFIG_DIR_NAME}/extensions/\n\tconst localExtDir = path.join(resolvedCwd, CONFIG_DIR_NAME, \"extensions\");\n\taddPaths(discoverExtensionsInDir(localExtDir));\n\n\t// 2. Global extensions: agentDir/extensions/\n\tconst globalExtDir = path.join(resolvedAgentDir, \"extensions\");\n\taddPaths(discoverExtensionsInDir(globalExtDir));\n\n\t// 3. Explicitly configured paths\n\tfor (const p of configuredPaths) {\n\t\tconst resolved = resolvePath(p, resolvedCwd, { normalizeUnicodeSpaces: true });\n\t\tif (fs.existsSync(resolved) && fs.statSync(resolved).isDirectory()) {\n\t\t\t// Check for package.json with omk manifest or index.ts\n\t\t\tconst entries = resolveExtensionEntries(resolved);\n\t\t\tif (entries) {\n\t\t\t\taddPaths(entries);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\t// No explicit entries - discover individual files in directory\n\t\t\taddPaths(discoverExtensionsInDir(resolved));\n\t\t\tcontinue;\n\t\t}\n\n\t\taddPaths([resolved]);\n\t}\n\n\treturn loadExtensions(allPaths, resolvedCwd, eventBus);\n}\n"]}