sliccy 3.39.2 → 3.40.0

package/dist/node-server/cdp-proxy/session-url-tracker.js

@@ -0,0 +1,153 @@
+/**
+ * CdpSessionUrlTracker — sniffs the Chrome→Client leg of the CDP WebSocket
+ * proxy and maintains a `sessionId -> currentUrl` map keyed the same way
+ * navigation-watcher.ts keys its session state. The map feeds the Client→
+ * Chrome unmask gate (cdp-unmask.ts) so per-frame unmasking is scoped to
+ * the target tab's actual current URL.
+ *
+ * Three CDP events feed the tracker:
+ *   - `Target.attachedToTarget`    → seed via `params.sessionId` + `params.targetInfo.url`
+ *   - `Target.targetInfoChanged`   → keyed by `params.targetInfo.targetId`; updates
+ *     every session pointing at that target
+ *   - `Page.frameNavigated` (root) → `sessionId` lives at the wire-frame top level;
+ *     only the root frame (no parentId) updates the session url
+ *
+ * `Target.detachedFromTarget` clears the entry. Everything else is a no-op.
+ *
+ * Hostname resolution is done lazily via `getHostname(sessionId)`. Empty,
+ * un-parseable, or `about:blank`-style URLs fail closed (return null).
+ */
+function asObject(v) {
+    return v && typeof v === 'object' && !Array.isArray(v) ? v : null;
+}
+function parseHostname(url) {
+    if (!url || typeof url !== 'string')
+        return null;
+    try {
+        const u = new URL(url);
+        if (!u.hostname)
+            return null;
+        return u.hostname;
+    }
+    catch {
+        return null;
+    }
+}
+export function createCdpSessionUrlTracker() {
+    // sessionId -> targetId
+    const sessionToTarget = new Map();
+    // sessionId -> url
+    const sessionToUrl = new Map();
+    // targetId -> url (last-seen, for hop-back resolution on targetInfoChanged)
+    const targetToUrl = new Map();
+    function setSessionUrl(sessionId, url) {
+        if (!url || typeof url !== 'string')
+            return;
+        sessionToUrl.set(sessionId, url);
+        const targetId = sessionToTarget.get(sessionId);
+        if (targetId)
+            targetToUrl.set(targetId, url);
+    }
+    function handleAttached(frame) {
+        const params = frame.params;
+        if (!params)
+            return;
+        const sessionId = params['sessionId'];
+        if (typeof sessionId !== 'string')
+            return;
+        const info = asObject(params['targetInfo']);
+        if (!info)
+            return;
+        const targetId = info['targetId'];
+        const url = info['url'];
+        if (typeof targetId === 'string') {
+            sessionToTarget.set(sessionId, targetId);
+            if (typeof url === 'string')
+                targetToUrl.set(targetId, url);
+        }
+        if (typeof url === 'string')
+            sessionToUrl.set(sessionId, url);
+    }
+    function handleDetached(frame) {
+        const sessionId = frame.params?.['sessionId'];
+        if (typeof sessionId !== 'string')
+            return;
+        sessionToUrl.delete(sessionId);
+        sessionToTarget.delete(sessionId);
+    }
+    function handleTargetInfoChanged(frame) {
+        const info = asObject(frame.params?.['targetInfo']);
+        if (!info)
+            return;
+        const targetId = info['targetId'];
+        const url = info['url'];
+        if (typeof targetId !== 'string' || typeof url !== 'string')
+            return;
+        targetToUrl.set(targetId, url);
+        for (const [sid, tid] of sessionToTarget.entries()) {
+            if (tid === targetId)
+                sessionToUrl.set(sid, url);
+        }
+    }
+    function handleFrameNavigated(frame) {
+        // sessionId is at the wire-frame top level for routed events.
+        const sessionId = frame.sessionId;
+        if (typeof sessionId !== 'string')
+            return;
+        const inner = asObject(frame.params?.['frame']);
+        if (!inner)
+            return;
+        // Only the root frame (no parentId) drives the per-tab URL.
+        if (typeof inner['parentId'] === 'string')
+            return;
+        const url = inner['url'];
+        if (typeof url === 'string')
+            setSessionUrl(sessionId, url);
+    }
+    function observe(raw) {
+        let frame;
+        if (typeof raw === 'string') {
+            try {
+                frame = JSON.parse(raw);
+            }
+            catch {
+                return;
+            }
+        }
+        else if (raw && typeof raw === 'object') {
+            frame = raw;
+        }
+        else {
+            return;
+        }
+        if (!frame || typeof frame.method !== 'string')
+            return;
+        switch (frame.method) {
+            case 'Target.attachedToTarget':
+                handleAttached(frame);
+                return;
+            case 'Target.detachedFromTarget':
+                handleDetached(frame);
+                return;
+            case 'Target.targetInfoChanged':
+                handleTargetInfoChanged(frame);
+                return;
+            case 'Page.frameNavigated':
+                handleFrameNavigated(frame);
+                return;
+            default:
+                return;
+        }
+    }
+    return {
+        observeChromeToClient: observe,
+        getUrl: (sessionId) => (sessionId ? (sessionToUrl.get(sessionId) ?? null) : null),
+        getHostname: (sessionId) => parseHostname(sessionId ? sessionToUrl.get(sessionId) : undefined),
+        size: () => sessionToUrl.size,
+        clear: () => {
+            sessionToUrl.clear();
+            sessionToTarget.clear();
+            targetToUrl.clear();
+        },
+    };
+}

package/dist/node-server/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { promises as fsPromises } from 'node:fs';
 import { createSubstrate } from './_cloud_core/src/index.js';
+import { previewSecret } from './_shared/index.js';
 import { spawn } from 'child_process';
 import express from 'express';
 import { existsSync, readFileSync } from 'fs';
@@ -12,6 +13,8 @@ import { Readable, Transform } from 'stream';
 import { StringDecoder } from 'string_decoder';
 import { fileURLToPath } from 'url';
 import { WebSocket, WebSocketServer } from 'ws';
+import { applyCdpUnmask } from './cdp-proxy/cdp-unmask.js';
+import { createCdpSessionUrlTracker } from './cdp-proxy/session-url-tracker.js';
 import { buildChromeLaunchArgs, clearStaleDevToolsActivePort, ensureQaProfileScaffold, findChromeExecutable, legacyChromeCandidates, migrateLegacyDefaultChromeProfile, planChromeSpawn, resolveChromeLaunchProfile, waitForCdpPort, } from './chrome-launch.js';
 import { CliLogDedup } from './cli-log-dedup.js';
 import { parseCloudArgs } from './cloud/dispatch.js';
@@ -37,6 +40,7 @@ import { SecretProxyManager } from './secrets/proxy-manager.js';
 import { readOrCreateSessionId } from './secrets/session-id-file.js';
 import { handleDaSignAndForward, handleS3SignAndForward } from './secrets/sign-and-forward.js';
 import { registerSecretsReloadEndpoint } from './secrets-reload-endpoint.js';
+import { registerSudoApproveEndpoint } from './sudo/endpoint.js';
 const Dirname = fileURLToPath(new URL('.', import.meta.url));
 const PROJECT_ROOT = resolve(Dirname, '..', '..');
 // ---------------------------------------------------------------------------
@@ -937,6 +941,90 @@ async function main() {
                 .json({ error: err instanceof Error ? err.message : 'Failed to list secrets' });
         }
     });
+    // Persisted-set — write a secret to ~/.slicc/secrets.env. Gated by the agent's
+    // intrinsic sudo prompt before the request is ever sent.
+    app.post('/api/secrets', express.json(), async (req, res) => {
+        const { name, value, domains } = req.body ?? {};
+        if (typeof name !== 'string' ||
+            typeof value !== 'string' ||
+            !Array.isArray(domains) ||
+            domains.some((d) => typeof d !== 'string')) {
+            return res.status(400).json({ error: 'bad-request' });
+        }
+        try {
+            secretStore.set(name, value, domains);
+            await secretProxy.reload();
+            res.json({ ok: true });
+        }
+        catch (err) {
+            res.status(500).json({ error: err instanceof Error ? err.message : 'Failed to set secret' });
+        }
+    });
+    // Scope edit — update the allowed domains of an existing secret (persisted or
+    // session), preserving the value. Gated by the agent before sending.
+    app.post('/api/secrets/scope', express.json(), async (req, res) => {
+        const { name, domains } = req.body ?? {};
+        if (typeof name !== 'string' ||
+            !Array.isArray(domains) ||
+            domains.some((d) => typeof d !== 'string')) {
+            return res.status(400).json({ error: 'bad-request' });
+        }
+        try {
+            if (secretProxy.sessionStore.has(name)) {
+                secretProxy.sessionStore.setDomains(name, domains);
+            }
+            else {
+                const existing = secretStore.get(name);
+                if (!existing)
+                    return res.status(404).json({ error: `no secret named "${name}"` });
+                secretStore.set(name, existing.value, domains);
+            }
+            await secretProxy.reload();
+            res.json({ ok: true });
+        }
+        catch (err) {
+            res
+                .status(500)
+                .json({ error: err instanceof Error ? err.message : 'Failed to update scope' });
+        }
+    });
+    // Session secrets — in-memory only, never written to disk. Free for the agent
+    // to create; the masking pipeline picks them up on the reload below.
+    app.get('/api/secrets/session', (_req, res) => {
+        res.json(secretProxy.sessionStore.list());
+    });
+    app.post('/api/secrets/session', express.json(), async (req, res) => {
+        const { name, value, domains } = req.body ?? {};
+        if (typeof name !== 'string' ||
+            typeof value !== 'string' ||
+            (domains !== undefined &&
+                (!Array.isArray(domains) || domains.some((d) => typeof d !== 'string')))) {
+            return res.status(400).json({ error: 'bad-request' });
+        }
+        secretProxy.sessionStore.set(name, value, Array.isArray(domains) ? domains : []);
+        await secretProxy.reload();
+        res.json({ ok: true });
+    });
+    // Peek — elided preview of the unmasked value (session or persisted). The
+    // full value never leaves the server.
+    app.get('/api/secrets/peek', (req, res) => {
+        const name = typeof req.query.name === 'string' ? req.query.name : '';
+        if (!name)
+            return res.status(400).json({ error: 'bad-request' });
+        const session = secretProxy.sessionStore.getRecord(name);
+        if (session) {
+            return res.json({ name, preview: previewSecret(session.value), domains: session.domains });
+        }
+        const persisted = secretStore.get(name);
+        if (persisted) {
+            return res.json({
+                name,
+                preview: previewSecret(persisted.value),
+                domains: persisted.domains,
+            });
+        }
+        return res.status(404).json({ error: `no secret named "${name}"` });
+    });
     // S3 sign-and-forward — browser-side mount backend posts envelopes here;
     // server resolves the s3.<profile>.* secrets, signs SigV4 v4, forwards to
     // the upstream, returns the response as a JSON envelope. The browser
@@ -991,6 +1079,27 @@ async function main() {
             }
         }
     });
+    // Tool-output real→masked scrub. The browser-side agent realm
+    // never holds real secret values, so the defense-in-depth scrub of
+    // bash / read_file / other tool results runs here against the
+    // node-server-owned `SecretProxyManager`. Direction is real→masked
+    // ONLY (`scrubResponse`), so it is always safe and is idempotent
+    // for already-masked tokens and secret-free output. The caller
+    // (`packages/webapp/src/core/secret-scrub.ts`) treats any non-2xx
+    // or malformed response as "return input unchanged" — the scrub is
+    // defense-in-depth, not the primary defense.
+    app.post('/api/secrets/scrub', express.json({ limit: '32mb' }), (req, res) => {
+        const text = req.body?.text;
+        if (typeof text !== 'string') {
+            return res.status(400).json({ error: 'bad-request' });
+        }
+        try {
+            res.json({ text: secretProxy.scrubResponse(text) });
+        }
+        catch (err) {
+            res.status(500).json({ error: err instanceof Error ? err.message : 'scrub failed', text });
+        }
+    });
     // Masked secrets endpoint — returns name + maskedValue pairs for shell env population.
     // The browser fetches this at shell init to populate env vars with masked values.
     // Real values are never exposed; only deterministic session-scoped masks.
@@ -1039,6 +1148,10 @@ async function main() {
         registerHostedBootstrapEndpoint(app, { secretStore });
         registerSecretsReloadEndpoint(app, { secretProxy });
     }
+    // Sudo approval endpoint — raises a native OS dialog / TTY prompt from this
+    // trusted process so the in-browser agent can request, but never fabricate,
+    // an approval. Loopback-only; selects a backend by environment at call time.
+    registerSudoApproveEndpoint(app);
     // Fetch proxy — forwards cross-origin requests from the browser to bypass CORS.
     // Used by just-bash's curl which calls the browser's fetch() API.
     // Note: express.json() may have already parsed the body, so we check req.body first.
@@ -1498,6 +1611,10 @@ async function main() {
     let activeClientWs = null;
     let messageBuffer = null;
     const cdpDedup = new CliLogDedup();
+    // Tracks per-session current URL by sniffing Chrome→Client events; feeds
+    // the Client→Chrome unmask gate so per-frame unmasking is scoped to
+    // the target tab's actual hostname (fail-closed when unknown).
+    const cdpSessionUrls = createCdpSessionUrlTracker();
     // Ensure everything is cleaned up when CLI exits
     const gracefulShutdown = async () => {
         if (shuttingDown)
@@ -1585,13 +1702,25 @@ async function main() {
             }
         }
     });
+    // Apply the Client→Chrome unmask gate to a buffered frame on flush.
+    // Defined here so both buffer-drain sites (ensureChromeConnection
+    // already-open path + chromeWs 'open' handler) share one
+    // implementation; falls back to the original bytes on any error.
+    const flushClientFrame = (target, raw) => {
+        const original = String(raw);
+        const { output } = applyCdpUnmask(original, {
+            tracker: cdpSessionUrls,
+            pipeline: secretProxy.rawPipeline,
+        });
+        target.send(output);
+    };
     function ensureChromeConnection(url) {
         return new Promise((resolve, reject) => {
             if (chromeWs && chromeWs.readyState === WebSocket.OPEN) {
                 // Already connected — flush any buffered messages and go direct
                 if (messageBuffer) {
                     for (const msg of messageBuffer) {
-                        chromeWs.send(String(msg));
+                        flushClientFrame(chromeWs, msg);
                     }
                     messageBuffer = null;
                 }
@@ -1624,7 +1753,7 @@ async function main() {
                 // Flush buffered messages
                 if (messageBuffer) {
                     for (const msg of messageBuffer) {
-                        chromeWs.send(String(msg));
+                        flushClientFrame(chromeWs, msg);
                     }
                     messageBuffer = null;
                 }
@@ -1697,6 +1826,9 @@ async function main() {
                 const msg = `[cdp-proxy] Chrome→Client: ${preview}`;
                 if (cdpDedup.shouldLog(msg))
                     console.debug(msg);
+                // Sniff Target.attachedToTarget / targetInfoChanged / Page.frameNavigated
+                // so the Client→Chrome unmask gate can resolve per-session hostnames.
+                cdpSessionUrls.observeChromeToClient(str);
                 if (activeClientWs && activeClientWs.readyState === WebSocket.OPEN) {
                     activeClientWs.send(str);
                 }
@@ -1728,14 +1860,21 @@ async function main() {
             }
             // Register ALL handlers BEFORE any async work so no messages are lost
             clientWs.on('message', (data) => {
-                const preview = String(data).slice(0, 200);
+                const original = String(data);
+                const preview = original.slice(0, 200);
                 if (chromeWs && chromeWs.readyState === WebSocket.OPEN && messageBuffer === null) {
                     const msg = `[cdp-proxy] Client→Chrome: ${preview}`;
                     if (cdpDedup.shouldLog(msg))
                         console.debug(msg);
-                    chromeWs.send(String(data));
+                    const { output } = applyCdpUnmask(original, {
+                        tracker: cdpSessionUrls,
+                        pipeline: secretProxy.rawPipeline,
+                    });
+                    chromeWs.send(output);
                 }
                 else if (messageBuffer !== null) {
+                    // Buffer the ORIGINAL bytes; unmask runs on flush so the
+                    // hostname tracker reflects the state at send time.
                     messageBuffer.push(data);
                     const msg = `[cdp-proxy] Client→Chrome (buffered): ${preview}`;
                     if (cdpDedup.shouldLog(msg))

package/dist/node-server/secrets/proxy-manager.d.ts

@@ -7,6 +7,7 @@
  *
  * As of Task 1.4, this is a thin wrapper around SecretsPipeline from @slicc/shared-ts.
  */
+import { SecretsPipeline, SessionSecretStore } from '../_shared/index.js';
 import type { EnvSecretStore } from './env-secret-store.js';
 import type { OauthSecretStore } from './oauth-secret-store.js';
 export declare class SecretProxyManager {
@@ -14,10 +15,19 @@ export declare class SecretProxyManager {
     private readonly _sessionId;
     private _envStore?;
     private _oauthStore?;
-    constructor(store?: EnvSecretStore, sessionId?: string, oauthStore?: OauthSecretStore);
+    /** In-memory session secrets, layered into the pipeline; never persisted. */
+    readonly sessionStore: SessionSecretStore;
+    constructor(store?: EnvSecretStore, sessionId?: string, oauthStore?: OauthSecretStore, sessionStore?: SessionSecretStore);
     private buildSource;
     setOauthStore(store: OauthSecretStore): void;
     get sessionId(): string;
+    /**
+     * Underlying pipeline. Exposed for CDP proxy unmasking, which needs to
+     * call `unmaskCdpFrame(frame, hostname, pipeline)` (whole-token, gated
+     * on the target tab's current hostname). Do not use for new fetch-proxy
+     * paths — prefer the typed `unmask*` methods above.
+     */
+    get rawPipeline(): SecretsPipeline;
     reload(): Promise<void>;
     hasSecrets(): boolean;
     getMaskedEntries(): Array<{

package/dist/node-server/secrets/proxy-manager.js

@@ -8,19 +8,23 @@
  * As of Task 1.4, this is a thin wrapper around SecretsPipeline from @slicc/shared-ts.
  */
 import { randomUUID } from 'node:crypto';
-import { SecretsPipeline } from '../_shared/index.js';
+import { SecretsPipeline, SessionSecretStore } from '../_shared/index.js';
 export class SecretProxyManager {
     pipeline;
     _sessionId;
     _envStore;
     _oauthStore;
-    constructor(store, sessionId, oauthStore) {
+    /** In-memory session secrets, layered into the pipeline; never persisted. */
+    sessionStore;
+    constructor(store, sessionId, oauthStore, sessionStore) {
         this._sessionId = sessionId ?? randomUUID();
         this._envStore = store;
         this._oauthStore = oauthStore;
+        this.sessionStore = sessionStore ?? new SessionSecretStore();
         this.pipeline = new SecretsPipeline({
             sessionId: this._sessionId,
             source: this.buildSource(),
+            sessionStore: this.sessionStore,
         });
     }
     buildSource() {
@@ -59,6 +63,15 @@ export class SecretProxyManager {
     get sessionId() {
         return this._sessionId;
     }
+    /**
+     * Underlying pipeline. Exposed for CDP proxy unmasking, which needs to
+     * call `unmaskCdpFrame(frame, hostname, pipeline)` (whole-token, gated
+     * on the target tab's current hostname). Do not use for new fetch-proxy
+     * paths — prefer the typed `unmask*` methods above.
+     */
+    get rawPipeline() {
+        return this.pipeline;
+    }
     async reload() {
         await this.pipeline.reload();
     }

package/dist/node-server/sudo/dialog-backends.d.ts

@@ -0,0 +1,29 @@
+/**
+ * GUI + fail-closed native sudo backends for the node-server float.
+ *
+ * Each backend turns a {@link SudoApproveRequest} into a real OS gesture
+ * (osascript / PowerShell / zenity / kdialog) and parses the result into a
+ * {@link SudoDecision}. They are deliberately injectable via {@link ExecFn} so
+ * tests can assert the argv and parsing without spawning a real dialog.
+ *
+ * Fail-closed contract: a dismissed dialog, a non-zero exit, an unparsable
+ * result, or a thrown error all resolve to `deny`. An `always` result with an
+ * empty pattern falls back to the suggested default.
+ */
+import type { SudoApproveRequest, SudoBackend } from './types.js';
+/** Minimal exec seam: run a binary with args, resolve its stdout. */
+export type ExecFn = (cmd: string, args: string[]) => Promise<{
+    stdout: string;
+}>;
+/** Human-readable one-liner describing the gated action. */
+export declare function describeRequest(req: SudoApproveRequest): string;
+/** macOS: single `osascript display dialog` with 3 buttons + a text field. */
+export declare function createOsascriptBackend(exec?: ExecFn): SudoBackend;
+/** Windows: MessageBox (Yes/No/Cancel) + InputBox for the "Always" pattern. */
+export declare function createPowerShellBackend(exec?: ExecFn): SudoBackend;
+/** Linux GUI: `zenity --question` (+ `--entry` for the pattern). */
+export declare function createZenityBackend(exec?: ExecFn): SudoBackend;
+/** Linux GUI: `kdialog --warningyesnocancel` (+ `--inputbox`). */
+export declare function createKdialogBackend(exec?: ExecFn): SudoBackend;
+/** A backend that always denies — used when no native channel exists. */
+export declare function createDenyBackend(name?: string): SudoBackend;

package/dist/node-server/sudo/dialog-backends.js

@@ -0,0 +1,181 @@
+/**
+ * GUI + fail-closed native sudo backends for the node-server float.
+ *
+ * Each backend turns a {@link SudoApproveRequest} into a real OS gesture
+ * (osascript / PowerShell / zenity / kdialog) and parses the result into a
+ * {@link SudoDecision}. They are deliberately injectable via {@link ExecFn} so
+ * tests can assert the argv and parsing without spawning a real dialog.
+ *
+ * Fail-closed contract: a dismissed dialog, a non-zero exit, an unparsable
+ * result, or a thrown error all resolve to `deny`. An `always` result with an
+ * empty pattern falls back to the suggested default.
+ */
+import { execFile as nodeExecFile } from 'child_process';
+import { promisify } from 'util';
+const defaultExec = promisify(nodeExecFile);
+/** Human-readable one-liner describing the gated action. */
+export function describeRequest(req) {
+    return `${req.kind}: ${req.detail}`;
+}
+function fallbackPattern(req) {
+    return req.suggestedPattern?.trim() || req.detail.trim();
+}
+/** macOS: single `osascript display dialog` with 3 buttons + a text field. */
+export function createOsascriptBackend(exec = defaultExec) {
+    return {
+        name: 'osascript',
+        async prompt(req) {
+            const suggested = fallbackPattern(req);
+            const message = `SLICC sudo — approve ${describeRequest(req)}\n\nEdit pattern for "Always":`;
+            const script = `display dialog ${q(message)} default answer ${q(suggested)} ` +
+                `buttons {"Deny", "Allow Once", "Always"} default button "Allow Once" ` +
+                `with title "SLICC sudo" with icon caution`;
+            try {
+                const { stdout } = await exec('osascript', ['-e', script]);
+                const button = /button returned:([^,\n]*)/.exec(stdout)?.[1]?.trim() ?? '';
+                const text = /text returned:([\s\S]*)$/.exec(stdout)?.[1]?.trim() ?? '';
+                if (button === 'Allow Once')
+                    return { decision: 'allow' };
+                if (button === 'Always') {
+                    return { decision: 'always', pattern: text.length > 0 ? text : suggested };
+                }
+                return { decision: 'deny' };
+            }
+            catch {
+                return { decision: 'deny' };
+            }
+        },
+    };
+}
+/** Windows: MessageBox (Yes/No/Cancel) + InputBox for the "Always" pattern. */
+export function createPowerShellBackend(exec = defaultExec) {
+    return {
+        name: 'powershell',
+        async prompt(req) {
+            const suggested = fallbackPattern(req);
+            const msg = `SLICC sudo — approve ${describeRequest(req)}\n\nYes = Allow once   No = Deny   Cancel = Always`;
+            const script = [
+                'Add-Type -AssemblyName System.Windows.Forms,Microsoft.VisualBasic;',
+                `$r=[System.Windows.Forms.MessageBox]::Show(${ps(msg)},'SLICC sudo','YesNoCancel','Warning');`,
+                "if($r -eq 'Yes'){Write-Output 'ALLOW'}",
+                `elseif($r -eq 'Cancel'){Write-Output 'ALWAYS'; Write-Output ([Microsoft.VisualBasic.Interaction]::InputBox('Edit the Always pattern','SLICC sudo',${ps(suggested)}))}`,
+                "else{Write-Output 'DENY'}",
+            ].join('\n');
+            try {
+                const { stdout } = await exec('powershell', ['-NoProfile', '-Command', script]);
+                const lines = stdout.split(/\r?\n/).map((l) => l.trim());
+                const verb = lines.find((l) => l.length > 0) ?? '';
+                if (verb === 'ALLOW')
+                    return { decision: 'allow' };
+                if (verb === 'ALWAYS') {
+                    const pattern = lines[lines.indexOf('ALWAYS') + 1]?.trim();
+                    return {
+                        decision: 'always',
+                        pattern: pattern && pattern.length > 0 ? pattern : suggested,
+                    };
+                }
+                return { decision: 'deny' };
+            }
+            catch {
+                return { decision: 'deny' };
+            }
+        },
+    };
+}
+/** Linux GUI: `zenity --question` (+ `--entry` for the pattern). */
+export function createZenityBackend(exec = defaultExec) {
+    return {
+        name: 'zenity',
+        async prompt(req) {
+            const suggested = fallbackPattern(req);
+            const text = `SLICC sudo — approve ${describeRequest(req)}`;
+            let allowed = false;
+            let always = false;
+            try {
+                const { stdout } = await exec('zenity', [
+                    '--question',
+                    '--title=SLICC sudo',
+                    `--text=${text}`,
+                    '--ok-label=Allow once',
+                    '--cancel-label=Deny',
+                    '--extra-button=Always',
+                ]);
+                always = stdout.trim() === 'Always';
+                allowed = true;
+            }
+            catch (err) {
+                // Non-zero exit: either Deny (no stdout) or the extra "Always" button.
+                always = stdoutOf(err).trim() === 'Always';
+                allowed = always;
+            }
+            if (!allowed)
+                return { decision: 'deny' };
+            if (!always)
+                return { decision: 'allow' };
+            return entryDecision(exec, 'zenity', [
+                '--entry',
+                '--title=SLICC sudo',
+                '--text=Edit the Always pattern',
+                `--entry-text=${suggested}`,
+            ], suggested);
+        },
+    };
+}
+/** Linux GUI: `kdialog --warningyesnocancel` (+ `--inputbox`). */
+export function createKdialogBackend(exec = defaultExec) {
+    return {
+        name: 'kdialog',
+        async prompt(req) {
+            const suggested = fallbackPattern(req);
+            const text = `SLICC sudo — approve ${describeRequest(req)}\n\nYes = Allow once   No = Deny   Cancel = Always`;
+            let code;
+            try {
+                await exec('kdialog', ['--warningyesnocancel', text, '--title', 'SLICC sudo']);
+                code = 0; // Yes
+            }
+            catch (err) {
+                code = exitCodeOf(err);
+            }
+            if (code === 0)
+                return { decision: 'allow' };
+            if (code !== 2)
+                return { decision: 'deny' }; // 1 = No / dismissed
+            return entryDecision(exec, 'kdialog', ['--inputbox', 'Edit the Always pattern', suggested, '--title', 'SLICC sudo'], suggested);
+        },
+    };
+}
+/** A backend that always denies — used when no native channel exists. */
+export function createDenyBackend(name = 'none') {
+    return {
+        name,
+        async prompt() {
+            return { decision: 'deny' };
+        },
+    };
+}
+async function entryDecision(exec, cmd, args, suggested) {
+    try {
+        const { stdout } = await exec(cmd, args);
+        const pattern = stdout.trim();
+        return { decision: 'always', pattern: pattern.length > 0 ? pattern : suggested };
+    }
+    catch {
+        return { decision: 'always', pattern: suggested };
+    }
+}
+function stdoutOf(err) {
+    const s = err?.stdout;
+    return typeof s === 'string' ? s : '';
+}
+function exitCodeOf(err) {
+    const c = err?.code;
+    return typeof c === 'number' ? c : 1;
+}
+/** Quote a string for AppleScript. */
+function q(s) {
+    return `"${s.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+}
+/** Quote a string as a PowerShell single-quoted literal. */
+function ps(s) {
+    return `'${s.replace(/'/g, "''")}'`;
+}