talos-code 0.0.1 → 0.1.0

package/dist/automations/windows-task.js

@@ -0,0 +1,53 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import { join, win32 } from 'node:path';
+import { spawnSync } from 'node:child_process';
+export const TALOS_AUTOMATION_TASK_NAME = 'TALOS CLI Automation Runner';
+function requireWindows(platform) { if (platform !== 'win32')
+    throw Object.assign(new Error('WINDOWS_REQUIRED'), { code: 'WINDOWS_REQUIRED' }); }
+function xmlEscape(value) { return value.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;').replaceAll('"', '&quot;').replaceAll("'", '&apos;'); }
+function output(value) { if (Buffer.isBuffer(value))
+    return value.toString('utf8'); return typeof value === 'string' ? value : ''; }
+function schtasksPath(systemRoot) { return systemRoot ? win32.join(systemRoot, 'System32', 'schtasks.exe') : 'schtasks.exe'; }
+function ensureSuccess(result, operation) { if (result.error)
+    throw Object.assign(new Error(`${operation}: ${result.error.message}`), { code: 'AUTOMATION_TASK_FAILED' }); if (result.status !== 0)
+    throw Object.assign(new Error(`${operation}: ${output(result.stderr) || output(result.stdout) || `exit ${result.status}`}`), { code: 'AUTOMATION_TASK_FAILED' }); }
+export function windowsAutomationTaskDefinition(input) {
+    const command = `\"${input.launcher}\" automation serve`;
+    return `<?xml version="1.0" encoding="UTF-8"?>\n<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">\n  <RegistrationInfo><Description>${TALOS_AUTOMATION_TASK_NAME}</Description></RegistrationInfo>\n  <Triggers><LogonTrigger><Enabled>true</Enabled><UserId>${xmlEscape(input.username)}</UserId></LogonTrigger></Triggers>\n  <Principals><Principal id="Author"><UserId>${xmlEscape(input.username)}</UserId><LogonType>InteractiveToken</LogonType><RunLevel>LeastPrivilege</RunLevel></Principal></Principals>\n  <Settings><MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy><DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries><StopIfGoingOnBatteries>false</StopIfGoingOnBatteries><AllowHardTerminate>true</AllowHardTerminate><StartWhenAvailable>true</StartWhenAvailable><Enabled>true</Enabled><ExecutionTimeLimit>PT0S</ExecutionTimeLimit></Settings>\n  <Actions Context="Author"><Exec><Command>${xmlEscape(input.launcher)}</Command><Arguments>automation serve</Arguments></Exec></Actions>\n</Task>\n<!-- Equivalent action: ${xmlEscape(command)} -->\n`;
+}
+export async function installWindowsAutomationRunner(input) {
+    const platform = input.platform ?? process.platform;
+    requireWindows(platform);
+    if (!input.username.trim())
+        throw Object.assign(new Error('AUTOMATION_USERNAME_REQUIRED'), { code: 'AUTOMATION_USERNAME_REQUIRED' });
+    const launcher = win32.join(input.cliRoot, 'bin', 'talos.cmd');
+    await mkdir(input.definitionDir, { recursive: true });
+    const definitionFile = join(input.definitionDir, 'windows-task.xml');
+    await writeFile(definitionFile, windowsAutomationTaskDefinition({ launcher, username: input.username }), 'utf8');
+    const action = `\"${launcher}\" automation serve`;
+    const spawnImpl = input.spawnSyncImpl ?? spawnSync;
+    const result = spawnImpl(schtasksPath(input.systemRoot ?? process.env.SystemRoot), ['/Create', '/F', '/TN', TALOS_AUTOMATION_TASK_NAME, '/SC', 'ONLOGON', '/RU', input.username, '/RL', 'LIMITED', '/TR', action], { encoding: 'utf8', windowsHide: true });
+    ensureSuccess(result, 'schtasks /Create');
+    return { ok: true, taskName: TALOS_AUTOMATION_TASK_NAME, definitionFile, launcher };
+}
+export function uninstallWindowsAutomationRunner(input = {}) {
+    requireWindows(input.platform ?? process.platform);
+    const spawnImpl = input.spawnSyncImpl ?? spawnSync;
+    const result = spawnImpl(schtasksPath(input.systemRoot ?? process.env.SystemRoot), ['/Delete', '/F', '/TN', TALOS_AUTOMATION_TASK_NAME], { encoding: 'utf8', windowsHide: true });
+    ensureSuccess(result, 'schtasks /Delete');
+    return { ok: true, taskName: TALOS_AUTOMATION_TASK_NAME };
+}
+export async function probeWindowsAutomationRunner(input = {}) {
+    const platform = input.platform ?? process.platform;
+    if (platform !== 'win32')
+        return { state: 'unsupported', platform, taskName: TALOS_AUTOMATION_TASK_NAME };
+    const spawnImpl = input.spawnSyncImpl ?? spawnSync;
+    const result = spawnImpl(schtasksPath(input.systemRoot ?? process.env.SystemRoot), ['/Query', '/TN', TALOS_AUTOMATION_TASK_NAME, '/XML'], { encoding: 'utf8', windowsHide: true });
+    if (result.status === 1 && !result.error)
+        return { state: 'missing', platform, taskName: TALOS_AUTOMATION_TASK_NAME };
+    if (result.error || result.status !== 0)
+        return { state: 'unhealthy', platform, taskName: TALOS_AUTOMATION_TASK_NAME, code: 'AUTOMATION_TASK_QUERY_FAILED' };
+    const xml = output(result.stdout);
+    const healthy = /<Arguments>\s*automation serve\s*<\/Arguments>/u.test(xml);
+    return healthy ? { state: 'healthy', platform, taskName: TALOS_AUTOMATION_TASK_NAME } : { state: 'unhealthy', platform, taskName: TALOS_AUTOMATION_TASK_NAME, code: 'AUTOMATION_TASK_DEFINITION_MISMATCH' };
+}

package/dist/commands/advanced-cli.js

@@ -0,0 +1,233 @@
+import { dirname, join, resolve } from 'node:path';
+import { assertNoUnknownOptions, takeFlag, takeOption, writeValue } from "./context.js";
+import { importTalosModule } from "../runtime/repo.js";
+import { createResearchFacade } from "../services/research-facade.js";
+import { createAutomationFacade } from "../services/automation-facade.js";
+import { createAutomationPolicyStore } from "../automations/policy-store.js";
+import { createAutomationHistoryStore } from "../automations/history-store.js";
+import { runAutomationTick } from "../automations/runner.js";
+import { installWindowsAutomationRunner, probeWindowsAutomationRunner, uninstallWindowsAutomationRunner } from "../automations/windows-task.js";
+import { keyOriginForEntry, stateKeyOrigin } from "../provider/environment-keys.js";
+function need(v, name) { if (!v)
+    throw new Error(`${name}_REQUIRED`); return v; }
+function int(raw, name, min = 1) { if (raw === undefined)
+    throw new Error(`${name}_REQUIRED`); const n = Number(raw); if (!Number.isSafeInteger(n) || n < min)
+    throw new Error(`${name}_INVALID`); return n; }
+export async function runResearchCommand(ctx, args0) {
+    const args = [...args0];
+    const op = args.shift() ?? 'list';
+    const mod = await importTalosModule(ctx.repoRoot, 'research-store.mjs');
+    if (op === 'start') {
+        const depthRaw = takeOption(args, '--depth') ?? '4';
+        const depth = int(depthRaw, 'RESEARCH_DEPTH', 2);
+        if (![2, 4, 6].includes(depth))
+            throw new Error('RESEARCH_DEPTH_INVALID');
+        assertNoUnknownOptions(args);
+        const question = args.join(' ').trim();
+        if (!question)
+            throw new Error('RESEARCH_QUERY_REQUIRED');
+        const model = ctx.invocation.model ?? 'openai:gpt-5-mini';
+        /* B1 slice 18: a one-shot command that runs a model uses an environment key without asking, states its origin, and names a missing key before sending. */
+        const rc = await ctx.createRuntimeContext({ projectRoot: ctx.projectRoot, paths: ctx.paths, repoRoot: ctx.repoRoot, model, environmentKeys: 'use' });
+        const origin = stateKeyOrigin(ctx.io, ctx.invocation.outputFormat, keyOriginForEntry(rc.runtime, model, { refuseMissing: true }));
+        await rc.registry.ripristina?.();
+        const prompt = `Use TALOS Deep Research for the following question. Start the research with depth ${depth}, follow its verification and source-retention workflow, and report the research id immediately; do not replace Deep Research with an ordinary web summary.\n\n${question}`;
+        const sessionId = await rc.runtime.start({ projectRoot: ctx.projectRoot, prompt, model, permissionMode: 'plan' });
+        writeValue(ctx, { sessionId, question, depth, started: true, ...origin }, `${sessionId}\n`);
+        return 0;
+    }
+    if (op === 'list') {
+        assertNoUnknownOptions(args);
+        const rows = await mod.elencaRicerche({ cartella: ctx.projectRoot });
+        writeValue(ctx, rows);
+        return 0;
+    }
+    const id = need(args.shift(), 'RESEARCH_ID');
+    if (op === 'read') {
+        assertNoUnknownOptions(args);
+        const row = await mod.leggiRicerca({ cartella: ctx.projectRoot, id });
+        if (!row)
+            throw new Error('RESEARCH_NOT_FOUND');
+        writeValue(ctx, row);
+        return 0;
+    }
+    if (op === 'rename') {
+        const title = need(args.shift(), 'RESEARCH_TITLE');
+        assertNoUnknownOptions(args);
+        const row = await mod.aggiornaRicerca({ cartella: ctx.projectRoot, id, titolo: title });
+        writeValue(ctx, row);
+        return 0;
+    }
+    if (op === 'delete') {
+        assertNoUnknownOptions(args);
+        await mod.eliminaRicerca({ cartella: ctx.projectRoot, id });
+        writeValue(ctx, { ok: true, id }, `Deleted research ${id}\n`);
+        return 0;
+    }
+    if (op === 'export') {
+        const format = need(args.shift(), 'RESEARCH_EXPORT_FORMAT');
+        const out = args.shift();
+        const tone = takeOption(args, '--tone');
+        assertNoUnknownOptions(args);
+        const facade = createResearchFacade({ projectRoot: ctx.projectRoot, repoRoot: ctx.repoRoot });
+        const result = await facade.exportFile(id, format, out, tone);
+        writeValue(ctx, result, `${result.path}\n`);
+        return 0;
+    }
+    if (op === 'pause' || op === 'resume' || op === 'cancel') {
+        assertNoUnknownOptions(args);
+        const model = ctx.invocation.model ?? 'openai:gpt-5-mini';
+        const rc = await ctx.createRuntimeContext({ projectRoot: ctx.projectRoot, paths: ctx.paths, repoRoot: ctx.repoRoot, model, environmentKeys: 'use' });
+        await rc.registry.ripristina?.();
+        const facade = createResearchFacade({ projectRoot: ctx.projectRoot, repoRoot: ctx.repoRoot }, { registry: rc.registry });
+        const result = op === 'pause' ? await facade.pause(id, id) : op === 'resume' ? await facade.resume(id, id) : await facade.cancel(id, id);
+        writeValue(ctx, result);
+        return 0;
+    }
+    throw new Error(`Unsupported research operation: ${op}`);
+}
+export async function runAutomationCommand(ctx, args0, deps = {}) {
+    const args = [...args0];
+    const op = args.shift() ?? 'list';
+    if (op === 'install-runner' || op === 'uninstall-runner') {
+        const yes = takeFlag(args, '--yes');
+        assertNoUnknownOptions(args);
+        if (!yes)
+            throw Object.assign(new Error('AUTOMATION_CONFIRM_REQUIRED'), { code: 'AUTOMATION_CONFIRM_REQUIRED' });
+        const platform = deps.platform ?? process.platform;
+        if (platform !== 'win32')
+            throw Object.assign(new Error('WINDOWS_REQUIRED'), { code: 'WINDOWS_REQUIRED' });
+        const cliRoot = deps.cliRoot ?? resolve(dirname(process.execPath), '..');
+        const username = deps.username ?? ([process.env.USERDOMAIN, process.env.USERNAME].filter(Boolean).join('\\\\') || process.env.USERNAME || '');
+        if (op === 'install-runner') {
+            const install = deps.installRunnerFn ?? installWindowsAutomationRunner;
+            const result = await install({ platform, cliRoot, definitionDir: join(ctx.paths.dataRoot, 'automations', 'runner'), username });
+            writeValue(ctx, result, 'Automation runner installed\\n');
+            return 0;
+        }
+        const uninstall = deps.uninstallRunnerFn ?? uninstallWindowsAutomationRunner;
+        const result = await uninstall({ platform });
+        writeValue(ctx, result, 'Automation runner removed\\n');
+        return 0;
+    }
+    if (op === 'health') {
+        assertNoUnknownOptions(args);
+        const probe = deps.probeRunnerFn ?? probeWindowsAutomationRunner;
+        const result = await probe({ platform: deps.platform ?? process.platform });
+        writeValue(ctx, result);
+        return 0;
+    }
+    const mod = await importTalosModule(ctx.repoRoot, 'automation-store.mjs');
+    const store = mod.createAutomationStore({ cartella: join(ctx.paths.dataRoot, 'automations') });
+    const policyStore = createAutomationPolicyStore(join(ctx.paths.dataRoot, 'automation-policies'));
+    const historyStore = createAutomationHistoryStore(join(ctx.paths.dataRoot, 'automation-history'));
+    const facade = createAutomationFacade({ projectRoot: ctx.projectRoot, dataRoot: ctx.paths.dataRoot, repoRoot: ctx.repoRoot }, { loadAutomationStore: async () => store, policyStore, historyStore, probeHealth: deps.probeRunnerFn ?? probeWindowsAutomationRunner });
+    if (op === 'list') {
+        assertNoUnknownOptions(args);
+        writeValue(ctx, await facade.list());
+        return 0;
+    }
+    if (op === 'add') {
+        const taskId = need(args.shift(), 'AUTOMATION_TASK');
+        const interval = int(takeOption(args, '--interval') ?? '5', 'AUTOMATION_INTERVAL', 5);
+        const limit = int(takeOption(args, '--limit') ?? '3', 'AUTOMATION_LIMIT');
+        const name = takeOption(args, '--name');
+        assertNoUnknownOptions(args);
+        const row = await store.crea({ taskId, nome: name, intervalloMinuti: interval, limiteAlGiorno: limit });
+        writeValue(ctx, row);
+        return 0;
+    }
+    if (op === 'serve') {
+        const once = takeFlag(args, '--once');
+        assertNoUnknownOptions(args);
+        const model = ctx.invocation.model ?? 'openai:gpt-5-mini';
+        const rc = await ctx.createRuntimeContext({ projectRoot: ctx.projectRoot, paths: ctx.paths, repoRoot: ctx.repoRoot, model, environmentKeys: 'use' });
+        const origin = stateKeyOrigin(ctx.io, ctx.invocation.outputFormat, keyOriginForEntry(rc.runtime, model, { refuseMissing: false }));
+        await rc.registry.ripristina?.();
+        const tick = async () => runAutomationTick({ rows: await store.elenca(), policyFor: (id) => policyStore.get(id), savePolicy: (id, p) => policyStore.put(id, p), appendHistory: (id, h) => historyStore.append(id, h), recordExecution: (id) => store.registraEsecuzione(id), registry: rc.registry });
+        if (once) {
+            const result = await tick();
+            writeValue(ctx, { ok: true, once: true, result, ...origin }, 'Automation tick complete\\n');
+            return 0;
+        }
+        let inFlight = null;
+        const startTick = () => { if (inFlight)
+            return; inFlight = tick().catch(() => undefined).finally(() => { inFlight = null; }); };
+        const timer = setInterval(startTick, 30_000);
+        writeValue(ctx, { ok: true, running: true, ...origin }, 'TALOS automation runner active; Ctrl+C to stop\\n');
+        await new Promise((resolve) => { const stop = () => { clearInterval(timer); process.off('SIGINT', stop); process.off('SIGTERM', stop); resolve(); }; process.once('SIGINT', stop); process.once('SIGTERM', stop); });
+        return 0;
+    }
+    const id = need(args.shift(), 'AUTOMATION_ID');
+    if (op === 'schedule') {
+        const at = need(takeOption(args, '--at'), 'AUTOMATION_TIME');
+        const timezone = need(takeOption(args, '--timezone'), 'AUTOMATION_TIMEZONE');
+        const missed = need(takeOption(args, '--missed'), 'AUTOMATION_MISSED_POLICY');
+        if (missed !== 'skip' && missed !== 'latest')
+            throw new Error('AUTOMATION_MISSED_POLICY_INVALID');
+        const grace = int(takeOption(args, '--grace-minutes') ?? '5', 'AUTOMATION_GRACE', 0);
+        const catchup = int(takeOption(args, '--catchup-minutes') ?? (missed === 'latest' ? '180' : '0'), 'AUTOMATION_CATCHUP', 0);
+        const base = int(takeOption(args, '--backoff-base-seconds') ?? '30', 'AUTOMATION_BACKOFF_BASE');
+        const max = int(takeOption(args, '--backoff-max-seconds') ?? '900', 'AUTOMATION_BACKOFF_MAX');
+        assertNoUnknownOptions(args);
+        if (max < base)
+            throw new Error('AUTOMATION_BACKOFF_INVALID');
+        const result = await facade.configureDaily(id, { at, timezone, missed, graceMinutes: grace, catchupWindowMinutes: catchup, baseSeconds: base, maxSeconds: max });
+        writeValue(ctx, result);
+        return 0;
+    }
+    if (op === 'dry-run') {
+        assertNoUnknownOptions(args);
+        writeValue(ctx, await facade.dryRun(id));
+        return 0;
+    }
+    if (op === 'history') {
+        assertNoUnknownOptions(args);
+        writeValue(ctx, await facade.history(id));
+        return 0;
+    }
+    if (op === 'enable' || op === 'disable') {
+        assertNoUnknownOptions(args);
+        writeValue(ctx, await facade.setEnabled(id, op === 'enable'));
+        return 0;
+    }
+    if (op === 'delete') {
+        assertNoUnknownOptions(args);
+        await store.elimina(id);
+        await Promise.all([policyStore.delete(id), historyStore.delete(id)]);
+        writeValue(ctx, { ok: true, id }, 'Deleted automation ' + id + '\\n');
+        return 0;
+    }
+    if (op === 'run') {
+        assertNoUnknownOptions(args);
+        const row = await store.leggi(id);
+        if (!row)
+            throw new Error('AUTOMATION_NOT_FOUND');
+        const model = ctx.invocation.model ?? 'openai:gpt-5-mini';
+        const rc = await ctx.createRuntimeContext({ projectRoot: ctx.projectRoot, paths: ctx.paths, repoRoot: ctx.repoRoot, model, environmentKeys: 'use' });
+        const origin = stateKeyOrigin(ctx.io, ctx.invocation.outputFormat, keyOriginForEntry(rc.runtime, model, { refuseMissing: false }));
+        await rc.registry.ripristina?.();
+        const attemptedAt = new Date().toISOString();
+        try {
+            let result;
+            if (typeof rc.registry.avvia === 'function')
+                result = await rc.registry.avvia(row.taskId, {}, { kind: 'talos-cli-automation-manual' });
+            else
+                result = await rc.runtime.start({ projectRoot: ctx.projectRoot, prompt: 'Run TALOS task ' + row.taskId, model, permissionMode: 'dontAsk' });
+            if (result?.erroreAvvio)
+                throw Object.assign(new Error(result.erroreAvvio), { code: result.code });
+            const sessionId = typeof result === 'string' ? result : result?.sessionId;
+            if (!sessionId)
+                throw Object.assign(new Error('AUTOMATION_SESSION_ID_MISSING'), { code: 'AUTOMATION_SESSION_ID_MISSING' });
+            await store.registraEsecuzione(id);
+            await historyStore.append(id, { attemptedAt, scheduledAt: null, slotKey: null, outcome: 'dispatch-started', sessionId, errorCode: null, errorMessage: null, nextRetryAt: null });
+            writeValue(ctx, { ok: true, id, sessionId, ...origin }, sessionId + '\\n');
+            return 0;
+        }
+        catch (error) {
+            await historyStore.append(id, { attemptedAt, scheduledAt: null, slotKey: null, outcome: 'dispatch-failed', sessionId: null, errorCode: typeof error?.code === 'string' ? error.code : 'AUTOMATION_DISPATCH_FAILED', errorMessage: error instanceof Error ? error.message : String(error), nextRetryAt: null });
+            throw error;
+        }
+    }
+    throw new Error('Unsupported automation operation: ' + op);
+}

package/dist/commands/checkpoint-cli.js

@@ -0,0 +1,45 @@
+import { join } from 'node:path';
+import { hasActiveRuns } from "../runtime/active-run.js";
+import { checkpointFilesText } from "../tui/overlays/checkpoint-picker.js";
+import { checkpointChanges, createCheckpointStore } from "../workspace/checkpoint-store.js";
+import { redoCheckpoint, undoCheckpoint } from "../workspace/restore.js";
+import { assertNoUnknownOptions, writeValue } from "./context.js";
+function usage() { throw Object.assign(new Error('Usage: talos checkpoint <list|show|undo|redo> [checkpoint-id]'), { code: 'CLI_USAGE_ERROR' }); }
+function summary(record) { return { id: record.id, operation: record.operation, sessionId: record.sessionId, commandId: record.commandId, state: record.state, createdAt: record.createdAt, finalizedAt: record.finalizedAt, reversible: record.reversible, nonReversibleReason: record.nonReversibleReason, coverage: record.pre.coverage, exclusions: record.pre.exclusions, writeEvidenceCount: record.writeEvidence.length, files: checkpointChanges(record) }; }
+/* R5b D3 (Q-R5-13): the files each checkpoint changed, under its line (gate finding 10: the list named no file). */
+export function checkpointFilesLine(record) { return checkpointFilesText(checkpointChanges(record)); }
+function humanSummary(record) { return `${record.id}  ${record.state}  ${record.operation}  ${record.createdAt}${record.reversible ? '' : `  non-reversible:${record.nonReversibleReason ?? 'unknown'}`}\n  ${checkpointFilesLine(record)}\n`; }
+export async function runCheckpointCommand(ctx, argv) {
+    const args = [...argv];
+    assertNoUnknownOptions(args);
+    const action = args.shift();
+    if (!action)
+        usage();
+    const store = createCheckpointStore({ rootDir: ctx.paths.checkpointsRoot ?? join(ctx.paths.dataRoot, 'checkpoints'), projectRoot: ctx.projectRoot });
+    if (action === 'list') {
+        if (args.length)
+            usage();
+        const rows = await store.list();
+        writeValue(ctx, rows.map(summary), rows.length ? rows.map(humanSummary).join('') : 'No checkpoints.\n');
+        return 0;
+    }
+    if (action === 'show') {
+        const id = args.shift();
+        if (!id || args.length)
+            usage();
+        const record = await store.show(id);
+        writeValue(ctx, record, `${humanSummary(record)}Coverage: ${JSON.stringify(record.pre.coverage)}\nExclusions: ${record.pre.exclusions.join(' | ') || 'none'}\n`);
+        return 0;
+    }
+    if (action === 'undo' || action === 'redo') {
+        const id = args.shift();
+        if (args.length)
+            usage();
+        if (await hasActiveRuns(ctx.paths))
+            throw Object.assign(new Error('CHECKPOINT_ACTIVE_RUN_CONFLICT'), { code: 'CHECKPOINT_ACTIVE_RUN_CONFLICT' });
+        const record = action === 'undo' ? await undoCheckpoint({ store, ...(id ? { id } : {}) }) : await redoCheckpoint({ store, ...(id ? { id } : {}) });
+        writeValue(ctx, record, `${action} ${record.id}: ${record.state}\n`);
+        return 0;
+    }
+    usage();
+}

package/dist/commands/config-cli.js

@@ -0,0 +1,107 @@
+import { loadEffectiveConfig, migrateConfigScope, readConfigScope, rollbackConfigMigration } from "../config/load.js";
+import { configGet, configOrigins, configSet, configUnset } from "../config/commands.js";
+import { formatPermissionSimulation, simulatePermission } from "../security/permission-explanation.js";
+import { assertNoUnknownOptions, parseJsonValue, takeOption, writeValue } from "./context.js";
+function scope(args) { const s = takeOption(args, '--scope') ?? 'user'; if (!['user', 'project', 'project-user'].includes(s))
+    throw new Error('CONFIG_SCOPE_INVALID'); return s; }
+function keymapPath(path) { return path === 'ui.keymap' || path.startsWith('ui.keymap.'); }
+function valueContainsKeymap(path, value) { return keymapPath(path) || (path === 'ui' && !!value && typeof value === 'object' && !Array.isArray(value) && Object.hasOwn(value, 'keymap')); }
+const PERMISSION_TOOLS = new Set(['Read', 'Write', 'Edit', 'Bash', 'WebFetch', 'Mcp', 'Hook', 'Plugin', 'TalosService']);
+function permissionDryRunAction(args) {
+    const toolRaw = takeOption(args, '--tool');
+    if (!toolRaw || !PERMISSION_TOOLS.has(toolRaw))
+        throw new Error('PERMISSION_DRY_RUN_TOOL_INVALID');
+    const tool = toolRaw;
+    const command = takeOption(args, '--command'), resource = takeOption(args, '--resource'), serverId = takeOption(args, '--server-id'), operation = takeOption(args, '--operation');
+    assertNoUnknownOptions(args);
+    if (args.length)
+        throw new Error(`Unexpected argument: ${args[0]}`);
+    if (tool === 'Bash' && !command)
+        throw new Error('PERMISSION_DRY_RUN_COMMAND_REQUIRED');
+    if (['Read', 'Write', 'Edit'].includes(tool) && !resource)
+        throw new Error('PERMISSION_DRY_RUN_RESOURCE_REQUIRED');
+    if (tool === 'Mcp' && !serverId)
+        throw new Error('PERMISSION_DRY_RUN_SERVER_REQUIRED');
+    if (tool !== 'Bash' && !resource && !serverId && !operation)
+        throw new Error('PERMISSION_DRY_RUN_TARGET_REQUIRED');
+    return { tool, ...(command ? { command } : {}), ...(resource ? { resource } : {}), ...(serverId ? { serverId } : {}), ...(operation ? { operation } : {}) };
+}
+export async function runConfigCommand(ctx, args0) {
+    const args = [...args0];
+    const op = args.shift() ?? 'list';
+    if (op === 'permissions') {
+        const sub = args.shift();
+        if (sub !== 'dry-run')
+            throw new Error('CONFIG_PERMISSIONS_OPERATION_INVALID');
+        const action = permissionDryRunAction(args);
+        const effective = await loadEffectiveConfig({ paths: ctx.paths, projectRoot: ctx.projectRoot });
+        const rules = (effective.value.permissions ?? { allow: [], ask: [], deny: [] });
+        const result = simulatePermission({ rules, action, projectRoot: ctx.projectRoot });
+        writeValue(ctx, result, formatPermissionSimulation(result));
+        return 0;
+    }
+    if (op === 'list') {
+        const e = await loadEffectiveConfig({ paths: ctx.paths, projectRoot: ctx.projectRoot });
+        writeValue(ctx, e.value);
+        return 0;
+    }
+    if (op === 'origins') {
+        const e = await loadEffectiveConfig({ paths: ctx.paths, projectRoot: ctx.projectRoot });
+        writeValue(ctx, configOrigins(e));
+        return 0;
+    }
+    if (op === 'get') {
+        const path = args.shift();
+        if (!path)
+            throw new Error('CONFIG_PATH_REQUIRED');
+        assertNoUnknownOptions(args);
+        const e = await loadEffectiveConfig({ paths: ctx.paths, projectRoot: ctx.projectRoot });
+        writeValue(ctx, configGet(e.value, path));
+        return 0;
+    }
+    if (op === 'set') {
+        const path = args.shift(), raw = args.shift();
+        if (!path || raw === undefined)
+            throw new Error('CONFIG_SET_REQUIRES_PATH_VALUE');
+        const sc = scope(args);
+        assertNoUnknownOptions(args);
+        const value = parseJsonValue(raw);
+        if (sc === 'project' && valueContainsKeymap(path, value))
+            throw new Error('CONFIG_KEYMAP_SCOPE_INVALID');
+        await configSet({ paths: ctx.paths, projectRoot: ctx.projectRoot, scope: sc, path, value });
+        writeValue(ctx, { ok: true, scope: sc, path }, `Set ${path} (${sc})\n`);
+        return 0;
+    }
+    if (op === 'unset') {
+        const path = args.shift();
+        if (!path)
+            throw new Error('CONFIG_PATH_REQUIRED');
+        const sc = scope(args);
+        assertNoUnknownOptions(args);
+        if (sc === 'project' && keymapPath(path))
+            throw new Error('CONFIG_KEYMAP_SCOPE_INVALID');
+        await configUnset({ paths: ctx.paths, projectRoot: ctx.projectRoot, scope: sc, path });
+        writeValue(ctx, { ok: true, scope: sc, path }, `Unset ${path} (${sc})\n`);
+        return 0;
+    }
+    if (op === 'show') {
+        const user = await readConfigScope({ paths: ctx.paths, projectRoot: ctx.projectRoot, scope: 'user' });
+        writeValue(ctx, user);
+        return 0;
+    }
+    if (op === 'migrate') {
+        const sc = scope(args);
+        assertNoUnknownOptions(args);
+        const result = await migrateConfigScope({ paths: ctx.paths, projectRoot: ctx.projectRoot, scope: sc });
+        writeValue(ctx, result, `Migrated config ${sc}: ${result.fromVersion} -> ${result.toVersion}${result.changed ? '' : ' (already current)'}\n`);
+        return 0;
+    }
+    if (op === 'rollback') {
+        const sc = scope(args);
+        assertNoUnknownOptions(args);
+        const result = await rollbackConfigMigration({ paths: ctx.paths, projectRoot: ctx.projectRoot, scope: sc });
+        writeValue(ctx, result, `Rolled back config ${sc}\n`);
+        return 0;
+    }
+    throw new Error(`Unsupported config operation: ${op}`);
+}

package/dist/commands/context.js

@@ -0,0 +1,17 @@
+export function writeValue(ctx, value, human) { if (ctx.invocation.outputFormat === 'json')
+    ctx.io.writeOut(`${JSON.stringify(value)}\n`);
+else
+    ctx.io.writeOut(human ?? `${JSON.stringify(value, null, 2)}\n`); }
+export function parseJsonValue(raw) { try {
+    return JSON.parse(raw);
+}
+catch {
+    throw new Error('CONFIG_VALUE_MUST_BE_JSON');
+} }
+export function takeOption(args, name) { const i = args.indexOf(name); if (i < 0)
+    return undefined; if (i === args.length - 1)
+    throw new Error(`${name} requires a value`); const value = args[i + 1]; args.splice(i, 2); return value; }
+export function takeFlag(args, name) { const i = args.indexOf(name); if (i < 0)
+    return false; args.splice(i, 1); return true; }
+export function assertNoUnknownOptions(args) { const bad = args.find(x => x.startsWith('-')); if (bad)
+    throw new Error(`Unknown option: ${bad}`); }