privateer-agent 0.2.1 → 0.3.0

package/src/tools/sendFileToClient.ts

@@ -1,55 +0,0 @@
-import { existsSync, readFileSync, statSync } from "node:fs";
-import { basename } from "node:path";
-import { tool } from "ai";
-import { z } from "zod";
-import type { ToolContext } from "./context.ts";
-import { resolveInCwd, displayPath, guardScope } from "./context.ts";
-import { mediaTypeForPath } from "../util/images.ts";
-
-// Per-file ceiling for the relay's chunked file channel; mirrors the relay
-// client's MAX_ATTACH_BYTES so the tool fails fast with a friendly message
-// instead of letting the transfer be rejected mid-flight.
-const MAX_SEND_BYTES = 10 * 1024 * 1024;
-
-export function sendFileToClientTool(ctx: ToolContext) {
-  return tool({
-    description:
-      "Send a file from disk to the connected Privateer app (the phone/web client driving this " +
-      "terminal remotely), where the user can preview it and save/share it on their device. Use " +
-      "when the user asks to see, download, or receive a file on their phone or browser. Only " +
-      "works while remote access is on and the app is connected; max 10 MB per file.",
-    inputSchema: z.object({
-      path: z.string().describe("Path of the file to send, relative to cwd or absolute."),
-    }),
-    execute: async ({ path }) => {
-      if (!ctx.sendFileToController) {
-        return "Cannot send: remote access is not enabled in this session (/remote-access to enable).";
-      }
-      const abs = resolveInCwd(ctx, path);
-      if (!existsSync(abs)) return `File not found: ${displayPath(ctx, abs)}`;
-      const stat = statSync(abs);
-      if (stat.isDirectory()) return `${displayPath(ctx, abs)} is a directory — send a single file.`;
-      if (stat.size === 0) return `${displayPath(ctx, abs)} is empty — nothing to send.`;
-      if (stat.size > MAX_SEND_BYTES) {
-        return (
-          `${displayPath(ctx, abs)} is ${(stat.size / (1024 * 1024)).toFixed(1)} MB; ` +
-          `the remote channel caps at ${MAX_SEND_BYTES / (1024 * 1024)} MB per file.`
-        );
-      }
-      const blocked = await guardScope(ctx, abs, { kind: "read", title: "Send file to connected app" });
-      if (blocked) return blocked;
-
-      const bytes = readFileSync(abs);
-      const mediaType = mediaTypeForPath(abs);
-      const res = await ctx.sendFileToController({
-        name: basename(abs),
-        mediaType,
-        base64: bytes.toString("base64"),
-        size: bytes.length,
-      });
-      return res.ok
-        ? `Sent ${basename(abs)} (${bytes.length} bytes, ${mediaType}) to the connected app.`
-        : `Couldn't send ${basename(abs)}: ${res.reason ?? "unknown error"}. Is the app currently connected?`;
-    },
-  });
-}

package/src/tools/skill.ts

@@ -1,44 +0,0 @@
-import { tool } from "ai";
-import { z } from "zod";
-import type { ToolContext } from "./context.ts";
-import { loadSkills, type SkillDefinition } from "../skills/loader.ts";
-
-// Progressive disclosure for skills: the model sees only the catalog (names +
-// descriptions, embedded in this tool's description — same pattern as `task`
-// advertising sub-agents) and pulls a skill's full instructions into the
-// conversation by calling the tool. Loading a skill also unlocks reads of its
-// bundled files, which live outside cwd for user-scoped skills.
-export function skillTool(ctx: ToolContext, skills?: SkillDefinition[]) {
-  const list = skills ?? loadSkills(ctx.cwd).skills;
-  return tool({
-    description:
-      "Load a skill — a package of expert instructions for a specific kind of task. " +
-      "When a listed skill matches the user's request, load it BEFORE attempting the " +
-      "task and follow its instructions. Available skills:\n" +
-      list.map((s) => `- ${s.name}: ${s.description}`).join("\n"),
-    inputSchema: z.object({
-      skill: z.string().describe("Name of the skill to load."),
-    }),
-    execute: async ({ skill }) => {
-      const def = list.find((s) => s.name === skill);
-      if (!def) {
-        const names = list.map((s) => s.name).join(", ") || "(none)";
-        return `No skill named "${skill}". Available: ${names}.`;
-      }
-      // Bundled files (scripts/, references/, ...) sit next to SKILL.md — for a
-      // user-scoped skill that's outside cwd, so mark the directory in-scope for
-      // this session rather than prompting on every read.
-      const roots = (ctx.allowedOutsideRoots ??= []);
-      if (!roots.includes(def.dir)) roots.push(def.dir);
-      const advisory = def.allowedTools?.length
-        ? `\nDeclared allowed-tools: ${def.allowedTools.join(", ")} (advisory in this version).`
-        : "";
-      return (
-        `Skill "${def.name}" loaded (base directory: ${def.dir}). ` +
-        `Bundled files can be read with the read tool using paths under that directory.` +
-        advisory +
-        `\n\n${def.body}`
-      );
-    },
-  });
-}

package/src/tools/task.ts

@@ -1,52 +0,0 @@
-import { tool } from "ai";
-import { z } from "zod";
-import type { ToolContext } from "./context.ts";
-import { loadAgents, findAgent } from "../agents/loader.ts";
-
-// Delegation tool: hand an open-ended investigation to a sub-agent that runs its own
-// loop and returns just a summary, keeping the parent conversation small. Without a
-// subagent_type it runs the default read-only agent (read/glob/grep); with one it uses
-// that custom agent's tools/model/instructions. Sub-agents cannot spawn further
-// sub-agents (no recursion).
-//
-// When the model emits several `task` calls in one turn the AI SDK runs their
-// execute()s concurrently, so sub-agents fan out in parallel — bounded by the
-// session's `maxSubagents` limiter.
-export function taskTool(ctx: ToolContext) {
-  const agents = loadAgents(ctx.cwd);
-  const agentList = agents.length
-    ? ` Available subagent_type values: ${agents.map((a) => `${a.name} (${a.description})`).join("; ")}.`
-    : "";
-  return tool({
-    description:
-      "Delegate a search or task to a sub-agent. Give it a complete, self-contained prompt; it " +
-      "explores and returns a text summary, keeping the main thread focused. Omit subagent_type " +
-      "for the default read-only agent (read/glob/grep, cannot modify files)." +
-      agentList,
-    inputSchema: z.object({
-      description: z.string().describe("Short 3–6 word description of the task."),
-      prompt: z.string().describe("The full, self-contained task for the sub-agent."),
-      subagent_type: z.string().optional().describe("Name of a custom sub-agent to use."),
-    }),
-    execute: async ({ description, prompt, subagent_type }, { toolCallId }) => {
-      if (!ctx.runSubAgent) return "Sub-agents are not available in this context.";
-      let agent;
-      if (subagent_type) {
-        agent = findAgent(subagent_type, ctx.cwd);
-        if (!agent) {
-          const names = loadAgents(ctx.cwd).map((a) => a.name).join(", ") || "(none defined)";
-          return `No sub-agent named "${subagent_type}". Available: ${names}.`;
-        }
-      }
-      try {
-        const { text, toolUses, tokens } = await ctx.runSubAgent({ description, prompt, agent });
-        // Report run metrics out-of-band (keyed by this call's id) for the grouped
-        // agents view; the model itself only ever sees the text summary.
-        ctx.onSubAgentMetrics?.(toolCallId, { toolUses, tokens });
-        return text;
-      } catch (err) {
-        return `Sub-agent failed: ${err instanceof Error ? err.message : String(err)}`;
-      }
-    },
-  });
-}

package/src/tools/todo.ts

@@ -1,36 +0,0 @@
-import { tool } from "ai";
-import { z } from "zod";
-import type { ToolContext } from "./context.ts";
-
-// The planning tool: the model maintains a single flat task list, rewriting the
-// whole list each call. State lives in the session's
-// TodoStore so the TUI can render it live. No filesystem mutation, so it isn't gated.
-export function todoTool(ctx: ToolContext) {
-  return tool({
-    description:
-      "Record and update your task list for multi-step work. Pass the COMPLETE list every " +
-      "time (it replaces the previous one). Keep exactly one item 'in_progress'; mark items " +
-      "'completed' as you finish them. Use this to plan non-trivial tasks and keep the user oriented.",
-    inputSchema: z.object({
-      todos: z
-        .array(
-          z.object({
-            content: z.string().describe("Imperative task description, e.g. 'Add auth middleware'."),
-            status: z.enum(["pending", "in_progress", "completed"]),
-            activeForm: z
-              .string()
-              .optional()
-              .describe("Present-continuous label shown while running, e.g. 'Adding auth middleware'."),
-          }),
-        )
-        .describe("The full task list, in order."),
-    }),
-    execute: async ({ todos }) => {
-      ctx.todos?.set(todos);
-      const done = todos.filter((t) => t.status === "completed").length;
-      const active = todos.find((t) => t.status === "in_progress");
-      const summary = `Updated todo list (${done}/${todos.length} done).`;
-      return active ? `${summary} In progress: ${active.content}` : summary;
-    },
-  });
-}

package/src/tools/todoStore.ts

@@ -1,31 +0,0 @@
-// Session-scoped todo list. The `todo` tool replaces it; the TUI subscribes to it to
-// render the live task panel. Kept deliberately tiny — it's just an observable array.
-
-export type TodoStatus = "pending" | "in_progress" | "completed";
-
-export interface TodoItem {
-  content: string;
-  status: TodoStatus;
-  activeForm?: string; // present-continuous label shown while in_progress
-}
-
-export class TodoStore {
-  private items: TodoItem[] = [];
-  private listeners = new Set<(items: TodoItem[]) => void>();
-
-  get(): TodoItem[] {
-    return this.items;
-  }
-
-  set(items: TodoItem[]): void {
-    this.items = items;
-    for (const l of this.listeners) l(items);
-  }
-
-  subscribe(fn: (items: TodoItem[]) => void): () => void {
-    this.listeners.add(fn);
-    return () => {
-      this.listeners.delete(fn);
-    };
-  }
-}

package/src/tools/walk.ts

@@ -1,44 +0,0 @@
-import { readdirSync } from "node:fs";
-import { join, relative, sep } from "node:path";
-
-// Directories we never descend into, so searches stay fast and relevant without
-// needing a full .gitignore parser. (A richer ignore story can come later.)
-const SKIP_DIRS = new Set([
-  ".git",
-  "node_modules",
-  "dist",
-  "build",
-  ".next",
-  ".cache",
-  "coverage",
-  ".venv",
-  "__pycache__",
-  ".turbo",
-]);
-
-const MAX_FILES = 20_000;
-
-// Recursively list files under `root`, returning paths relative to `root` with
-// forward slashes (so glob patterns behave consistently across platforms).
-export function walkFiles(root: string): string[] {
-  const out: string[] = [];
-  const stack: string[] = [root];
-  while (stack.length && out.length < MAX_FILES) {
-    const dir = stack.pop()!;
-    let entries;
-    try {
-      entries = readdirSync(dir, { withFileTypes: true });
-    } catch {
-      continue; // unreadable dir — skip
-    }
-    for (const e of entries) {
-      if (e.isDirectory()) {
-        if (SKIP_DIRS.has(e.name)) continue;
-        stack.push(join(dir, e.name));
-      } else if (e.isFile()) {
-        out.push(relative(root, join(dir, e.name)).split(sep).join("/"));
-      }
-    }
-  }
-  return out;
-}

package/src/tools/web.ts

@@ -1,145 +0,0 @@
-import { tool } from "ai";
-import { z } from "zod";
-import type { ToolContext } from "./context.ts";
-import { PermissionDeniedError } from "../permissions/gate.ts";
-
-const MAX_BYTES = 2_000_000; // cap download size
-const MAX_TEXT = 20_000; // cap returned text
-const TIMEOUT_MS = 20_000;
-
-// Fetch a URL's body as text, with a timeout and size cap. Returns null fields on failure.
-async function fetchText(url: string): Promise<{ status: number; contentType: string; body: string }> {
-  const ac = new AbortController();
-  const timer = setTimeout(() => ac.abort(), TIMEOUT_MS);
-  try {
-    const res = await fetch(url, {
-      signal: ac.signal,
-      redirect: "follow",
-      headers: { "user-agent": "privateer-agent/0.1.0 (+https://github.com/privateer-agent/privateer-agent)" },
-    });
-    const body = (await res.text()).slice(0, MAX_BYTES);
-    return { status: res.status, contentType: res.headers.get("content-type") ?? "", body };
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-// Crude HTML→text: drop scripts/styles, turn block-closers into newlines, strip tags,
-// decode the common entities. Good enough to feed page content to the model.
-function htmlToText(html: string): string {
-  return html
-    .replace(/<script[\s\S]*?<\/script>/gi, " ")
-    .replace(/<style[\s\S]*?<\/style>/gi, " ")
-    .replace(/<\/(p|div|h[1-6]|li|tr|section|article|header|footer)>/gi, "\n")
-    .replace(/<br\s*\/?>/gi, "\n")
-    .replace(/<[^>]+>/g, " ")
-    .replace(/&nbsp;/gi, " ")
-    .replace(/&amp;/gi, "&")
-    .replace(/&lt;/gi, "<")
-    .replace(/&gt;/gi, ">")
-    .replace(/&quot;/gi, '"')
-    .replace(/&#39;/gi, "'")
-    .replace(/[ \t]+/g, " ")
-    .replace(/\n{3,}/g, "\n\n")
-    .trim();
-}
-
-function isHttpUrl(u: string): boolean {
-  try {
-    const parsed = new URL(u);
-    return parsed.protocol === "http:" || parsed.protocol === "https:";
-  } catch {
-    return false;
-  }
-}
-
-export function webFetchTool(ctx: ToolContext) {
-  return tool({
-    description:
-      "Fetch a URL and return its content as text (HTML is stripped to readable text). Use when " +
-      "the user gives a link or you need to read online docs. Network egress, so it may prompt.",
-    inputSchema: z.object({
-      url: z.string().describe("Absolute http(s) URL to fetch."),
-      prompt: z.string().optional().describe("What you're looking for (recorded for context; not a separate model call)."),
-    }),
-    execute: async ({ url, prompt }) => {
-      if (!isHttpUrl(url)) return `Error: not a valid http(s) URL: ${url}`;
-      const decision = await ctx.gate.request({
-        tool: "web_fetch",
-        kind: "fetch",
-        title: "Fetch URL",
-        detail: url,
-      });
-      if (decision === "deny") throw new PermissionDeniedError("web_fetch");
-
-      let result;
-      try {
-        result = await fetchText(url);
-      } catch (err) {
-        return `Error fetching ${url}: ${err instanceof Error ? err.message : String(err)}`;
-      }
-      const text = /html/i.test(result.contentType) ? htmlToText(result.body) : result.body.trim();
-      const capped = text.length > MAX_TEXT ? text.slice(0, MAX_TEXT) + "\n… (truncated)" : text;
-      const header = `[${result.status} · ${result.contentType || "?"}]${prompt ? ` looking for: ${prompt}` : ""}`;
-      return `${header}\n\n${capped || "(empty response)"}`;
-    },
-  });
-}
-
-// DuckDuckGo's keyless HTML endpoint, scraped for result titles + links. No API key
-// required, which keeps web_search working out of the box.
-// Caveat: it scrapes HTML, so it's best-effort and can break if DDG changes markup.
-function parseDdg(html: string, limit: number): string[] {
-  const out: string[] = [];
-  const re = /<a[^>]+class="result__a"[^>]*href="([^"]+)"[^>]*>([\s\S]*?)<\/a>/g;
-  let m: RegExpExecArray | null;
-  while ((m = re.exec(html)) && out.length < limit) {
-    const href = decodeDdgHref(m[1]);
-    const title = htmlToText(m[2]);
-    if (title) out.push(`${title}\n  ${href}`);
-  }
-  return out;
-}
-
-// DDG wraps results as //duckduckgo.com/l/?uddg=<encoded real url>.
-function decodeDdgHref(href: string): string {
-  try {
-    const u = new URL(href, "https://duckduckgo.com");
-    const uddg = u.searchParams.get("uddg");
-    return uddg ? decodeURIComponent(uddg) : u.toString();
-  } catch {
-    return href;
-  }
-}
-
-export function webSearchTool(ctx: ToolContext) {
-  return tool({
-    description:
-      "Search the web and return the top results (title + URL) via DuckDuckGo. Follow up with " +
-      "web_fetch to read a result. Network egress, so it may prompt.",
-    inputSchema: z.object({
-      query: z.string().describe("Search query."),
-    }),
-    execute: async ({ query }) => {
-      const decision = await ctx.gate.request({
-        tool: "web_search",
-        kind: "fetch",
-        title: "Web search",
-        detail: query,
-      });
-      if (decision === "deny") throw new PermissionDeniedError("web_search");
-
-      const url = `https://html.duckduckgo.com/html/?q=${encodeURIComponent(query)}`;
-      let result;
-      try {
-        result = await fetchText(url);
-      } catch (err) {
-        return `Error searching: ${err instanceof Error ? err.message : String(err)}`;
-      }
-      const results = parseDdg(result.body, 8);
-      return results.length
-        ? `Results for "${query}":\n\n${results.join("\n\n")}`
-        : `No results parsed for "${query}" (DuckDuckGo markup may have changed). Try web_fetch with a direct URL.`;
-    },
-  });
-}

package/src/tools/worktree.ts

@@ -1,145 +0,0 @@
-import { tool } from "ai";
-import { z } from "zod";
-import { basename, resolve } from "node:path";
-import type { ToolContext } from "./context.ts";
-import { exec } from "./exec.ts";
-import { PermissionDeniedError } from "../permissions/gate.ts";
-
-const GIT_TIMEOUT = 60_000;
-
-// Strip a worktree/branch name down to a filesystem- and git-safe slug.
-function sanitizeName(name: string): string {
-  return name
-    .trim()
-    .replace(/[^A-Za-z0-9._-]+/g, "-")
-    .replace(/^-+|-+$/g, "")
-    .slice(0, 60);
-}
-
-// The sibling path a named worktree lives at: ../<repo>-wt-<name>.
-function worktreePath(cwd: string, slug: string): string {
-  return resolve(cwd, "..", `${basename(cwd)}-wt-${slug}`);
-}
-
-async function git(cwd: string, args: string[]) {
-  return exec("git", args, { cwd, timeoutMs: GIT_TIMEOUT });
-}
-
-interface WorktreeEntry {
-  path: string;
-  branch?: string;
-  head?: string;
-}
-
-// Parse `git worktree list --porcelain` into structured entries.
-function parseWorktrees(porcelain: string): WorktreeEntry[] {
-  const entries: WorktreeEntry[] = [];
-  let cur: WorktreeEntry | null = null;
-  for (const line of porcelain.split("\n")) {
-    if (line.startsWith("worktree ")) {
-      if (cur) entries.push(cur);
-      cur = { path: line.slice("worktree ".length) };
-    } else if (line.startsWith("branch ") && cur) {
-      cur.branch = line.slice("branch ".length).replace(/^refs\/heads\//, "");
-    } else if (line.startsWith("HEAD ") && cur) {
-      cur.head = line.slice("HEAD ".length, "HEAD ".length + 8);
-    }
-  }
-  if (cur) entries.push(cur);
-  return entries;
-}
-
-// The `worktree` tool: lets the agent develop a candidate approach in an isolated
-// git worktree (its own branch + working copy) so a risky or exploratory direction
-// never touches the main tree. Combined with `ask_user`, this is the building block
-// for "try an approach, compare the diff, keep or discard it". Mutating actions
-// (create/remove) run git and are routed through the permission gate.
-export function worktreeTool(ctx: ToolContext) {
-  return tool({
-    description:
-      "Manage git worktrees to develop a candidate approach in isolation (its own branch + " +
-      "working copy), so an exploratory or risky direction doesn't touch the main tree. " +
-      "Actions: 'create' a new worktree on a fresh branch, 'list' existing worktrees, 'remove' " +
-      "one when done. Use this to try an approach the user can later compare via its diff and " +
-      "keep or discard. The repository must be a git repo.",
-    inputSchema: z.object({
-      action: z.enum(["create", "list", "remove"]).describe("What to do."),
-      name: z
-        .string()
-        .optional()
-        .describe("Worktree/branch name for create and remove (e.g. 'redis-cache')."),
-      base: z
-        .string()
-        .optional()
-        .describe("For create: the ref to branch from (default: current HEAD)."),
-      deleteBranch: z
-        .boolean()
-        .optional()
-        .describe("For remove: also delete the worktree's branch (default false)."),
-    }),
-    execute: async ({ action, name, base, deleteBranch }) => {
-      if (action === "list") {
-        const { stdout, code } = await git(ctx.cwd, ["worktree", "list", "--porcelain"]);
-        if (code !== 0) return "Not a git repository, or `git worktree` failed.";
-        const entries = parseWorktrees(stdout.trim());
-        if (entries.length <= 1) return "No additional worktrees. Only the main working tree exists.";
-        return entries
-          .map((e) => `${e.path}${e.branch ? `  [${e.branch}]` : ""}${e.head ? `  @${e.head}` : ""}`)
-          .join("\n");
-      }
-
-      const slug = sanitizeName(name ?? "");
-      if (!slug) return "A non-empty `name` is required for this action.";
-      const path = worktreePath(ctx.cwd, slug);
-
-      if (action === "create") {
-        const args = ["worktree", "add", "-b", slug, path];
-        if (base) args.push(base);
-        const cmd = `git ${args.join(" ")}`;
-        const decision = await ctx.gate.request({
-          tool: "worktree",
-          kind: "bash",
-          title: "Create git worktree",
-          detail: cmd,
-        });
-        if (decision === "deny") throw new PermissionDeniedError("worktree");
-        const { stderr, code } = await git(ctx.cwd, args);
-        if (code !== 0) return `git worktree add failed:\n${stderr.trim()}`;
-        // Let the agent edit inside the new worktree without the confinement gate
-        // re-prompting on every file — the user just approved creating it here.
-        if (ctx.allowedOutsideRoots && !ctx.allowedOutsideRoots.includes(path)) {
-          ctx.allowedOutsideRoots.push(path);
-        }
-        return (
-          `Created worktree at ${path} on new branch '${slug}'.\n` +
-          `Work there with absolute paths under that directory; it's isolated from the main tree. ` +
-          `Compare later with: git -C "${path}" diff ${base ?? "HEAD"}`
-        );
-      }
-
-      // remove
-      const cmd = `git worktree remove ${path}${deleteBranch ? ` && git branch -D ${slug}` : ""}`;
-      const decision = await ctx.gate.request({
-        tool: "worktree",
-        kind: "bash",
-        title: "Remove git worktree",
-        detail: cmd,
-      });
-      if (decision === "deny") throw new PermissionDeniedError("worktree");
-      const rm = await git(ctx.cwd, ["worktree", "remove", path]);
-      if (rm.code !== 0) {
-        return `git worktree remove failed (commit or discard changes first, or it doesn't exist):\n${rm.stderr.trim()}`;
-      }
-      if (ctx.allowedOutsideRoots) {
-        const i = ctx.allowedOutsideRoots.indexOf(path);
-        if (i >= 0) ctx.allowedOutsideRoots.splice(i, 1);
-      }
-      let msg = `Removed worktree ${path}.`;
-      if (deleteBranch) {
-        const br = await git(ctx.cwd, ["branch", "-D", slug]);
-        msg += br.code === 0 ? ` Deleted branch '${slug}'.` : ` (branch '${slug}' not deleted: ${br.stderr.trim()})`;
-      }
-      return msg;
-    },
-  });
-}

package/src/tools/write.ts

@@ -1,40 +0,0 @@
-import { writeFileSync, mkdirSync, existsSync } from "node:fs";
-import { dirname } from "node:path";
-import { tool } from "ai";
-import { z } from "zod";
-import type { ToolContext } from "./context.ts";
-import { resolveInCwd, displayPath, isOutsideScope } from "./context.ts";
-import { PermissionDeniedError } from "../permissions/gate.ts";
-import { isProtectedPath } from "../permissions/protected.ts";
-
-export function writeTool(ctx: ToolContext) {
-  return tool({
-    description:
-      "Write a file, creating parent directories as needed. Overwrites existing files. " +
-      "Prefer the edit tool for small changes to existing files.",
-    inputSchema: z.object({
-      path: z.string().describe("File path to write."),
-      content: z.string().describe("Full file contents."),
-    }),
-    execute: async ({ path, content }) => {
-      const abs = resolveInCwd(ctx, path);
-      const exists = existsSync(abs);
-      const outside = isOutsideScope(ctx, abs);
-      const decision = await ctx.gate.request({
-        tool: "write",
-        kind: "write",
-        title: outside ? "Write outside working directory" : exists ? "Overwrite file" : "Create file",
-        detail: `${outside ? abs : displayPath(ctx, abs)} (${content.split("\n").length} lines)`,
-        protected: isProtectedPath(abs),
-        outside,
-        path: abs,
-      });
-      if (decision === "deny") throw new PermissionDeniedError("write");
-
-      ctx.recordMutation?.(abs);
-      mkdirSync(dirname(abs), { recursive: true });
-      writeFileSync(abs, content, "utf8");
-      return `${exists ? "Wrote" : "Created"} ${displayPath(ctx, abs)} (${content.length} bytes).`;
-    },
-  });
-}