termux-dev 1.5.0 → 1.8.0

package/dist/permissions/guard.js

@@ -1,52 +1,262 @@
-import * as p from '@clack/prompts';
 import pc from 'picocolors';
 import path from 'path';
+import os from 'os';
+import fsSync from 'fs';
+import { askPermissionDecision } from '../cli/permission.js';
+// ───────────────────────── path helpers ─────────────────────────
+function isInside(base, target) {
+    const rel = path.relative(base, target);
+    return rel === '' || (rel !== '..' && !rel.startsWith('..' + path.sep) && !path.isAbsolute(rel));
+}
+/** Resolves a path against cwd, following symlinks of the nearest existing ancestor. */
+function realResolve(target) {
+    const abs = path.resolve(process.cwd(), target);
+    let existing = abs;
+    const rest = [];
+    while (!fsSync.existsSync(existing)) {
+        const parent = path.dirname(existing);
+        if (parent === existing)
+            break;
+        rest.unshift(path.basename(existing));
+        existing = parent;
+    }
+    try {
+        return path.join(fsSync.realpathSync(existing), ...rest);
+    }
+    catch {
+        return abs;
+    }
+}
+function realCwd() {
+    try {
+        return fsSync.realpathSync(process.cwd());
+    }
+    catch {
+        return process.cwd();
+    }
+}
 /**
- * Robust path escape check: returns true if target path resolves outside current working directory
+ * Returns true if the path resolves outside the current working directory
+ * (symlinks are followed, so a link inside the project cannot be used to escape it).
  */
-function isPathOutsideCwd(targetPath) {
-    if (!targetPath)
+export function isPathOutsideCwd(targetPath) {
+    if (!targetPath || typeof targetPath !== 'string')
         return false;
     try {
-        const cwd = process.cwd();
-        const resolved = path.resolve(cwd, targetPath);
-        const relative = path.relative(cwd, resolved);
-        return relative.startsWith('..') || path.isAbsolute(relative);
+        return !isInside(realCwd(), realResolve(targetPath));
     }
     catch {
         return true;
     }
 }
+// Credential stores that live in the home directory. Reading or writing these is
+// always confirmed, even in YOLO mode.
+const HOME_SENSITIVE_DIRS = ['.ssh', '.aws', '.gnupg', '.devx', '.kube', '.docker', '.azure', path.join('.config', 'gcloud'), path.join('.config', 'gh')];
+const HOME_SENSITIVE_FILES = ['.devxrc.json', '.netrc', '.npmrc', '.pypirc', '.git-credentials', '.pgpass', '.bash_history', '.zsh_history'];
+export function isCredentialStore(targetPath) {
+    if (!targetPath || typeof targetPath !== 'string')
+        return false;
+    try {
+        const abs = realResolve(targetPath);
+        let home = os.homedir();
+        try {
+            home = fsSync.realpathSync(home);
+        }
+        catch { }
+        return (HOME_SENSITIVE_DIRS.some(d => isInside(path.join(home, d), abs)) ||
+            HOME_SENSITIVE_FILES.some(f => abs === path.join(home, f)));
+    }
+    catch {
+        return false;
+    }
+}
+const SECRET_BASENAME = /^(id_(rsa|dsa|ecdsa|ed25519)|\.env(\..+)?|\.netrc|\.npmrc|credentials)$/i;
+const ENV_TEMPLATE = /^\.env(\..+)?\.(example|sample|template|dist|defaults?)$/i;
+const SECRET_EXT = new Set(['.pem', '.key', '.p12', '.pfx', '.keystore', '.jks']);
+/** Private keys and dotenv files, wherever they are. */
+export function isSecretFile(targetPath) {
+    if (!targetPath || typeof targetPath !== 'string')
+        return false;
+    const base = path.basename(targetPath);
+    if (ENV_TEMPLATE.test(base))
+        return false;
+    return SECRET_BASENAME.test(base) || SECRET_EXT.has(path.extname(base).toLowerCase());
+}
+/** Classifies a path argument of a shell command relative to the project directory. */
+function classifyTarget(raw) {
+    let t = raw.trim().replace(/^["']|["']$/g, '');
+    if (!t)
+        return 'unknown';
+    const home = os.homedir();
+    t = t.replace(/^~(?=\/|\\|$)/, home).replace(/^\$\{?HOME\}?(?=\/|$)/, home);
+    if (process.env.PREFIX) {
+        t = t.replace(/^\$\{?PREFIX\}?(?=\/|$)/, process.env.PREFIX);
+    }
+    if (/[$`]/.test(t))
+        return 'unknown'; // unexpanded variable: may be empty or anything
+    // For globs, the directory the glob expands in is what matters.
+    const globIdx = t.search(/[*?[]/);
+    let dirPart = t;
+    if (globIdx !== -1) {
+        const slash = t.lastIndexOf('/', globIdx);
+        dirPart = slash >= 0 ? t.slice(0, slash + 1) || '/' : '.';
+    }
+    const abs = path.resolve(process.cwd(), dirPart);
+    if (abs === path.parse(abs).root || abs === home)
+        return 'root';
+    const cwd = process.cwd();
+    if (abs === cwd)
+        return 'cwd';
+    if (isInside(cwd, abs))
+        return 'inside';
+    const tmp = os.tmpdir();
+    if (abs !== tmp && isInside(tmp, abs))
+        return 'inside';
+    return 'outside';
+}
+const RISKY_FOR_RECURSIVE_DELETE = new Set(['root', 'outside', 'cwd', 'unknown']);
+const RISKY_FOR_RECURSIVE_CHANGE = new Set(['root', 'outside', 'unknown']);
+function tokenize(segment) {
+    const tokens = [];
+    const re = /"((?:\\.|[^"\\])*)"|'([^']*)'|(\S+)/g;
+    let m;
+    while ((m = re.exec(segment)) !== null) {
+        tokens.push(m[1] ?? m[2] ?? m[3]);
+    }
+    return tokens;
+}
+const hasRecursiveFlag = (flags) => flags.some(f => f === '--recursive' || /^-[a-zA-Z]*[rR][a-zA-Z]*$/.test(f));
+const ALWAYS_DANGEROUS_COMMANDS = new Set([
+    'sudo', 'su', 'doas', 'pkexec',
+    'mke2fs', 'fdisk', 'sfdisk', 'cfdisk', 'parted', 'wipefs', 'diskpart',
+    'shutdown', 'reboot', 'halt', 'poweroff',
+]);
+function analyzeSegment(tokens) {
+    for (let i = 0; i < tokens.length; i++) {
+        const name = path.basename(tokens[i]).toLowerCase().replace(/\.exe$/, '');
+        const args = tokens.slice(i + 1);
+        const flags = args.filter(a => a.startsWith('-') && a !== '-' && a !== '--');
+        const operands = args.filter(a => !a.startsWith('-'));
+        if (ALWAYS_DANGEROUS_COMMANDS.has(name) || name === 'mkfs' || name.startsWith('mkfs.'))
+            return true;
+        switch (name) {
+            case 'rm':
+            case 'unlink':
+            case 'shred': {
+                if (flags.includes('--no-preserve-root'))
+                    return true;
+                const recursive = hasRecursiveFlag(flags);
+                for (const target of operands) {
+                    const kind = classifyTarget(target);
+                    if (kind === 'root')
+                        return true;
+                    if (recursive && RISKY_FOR_RECURSIVE_DELETE.has(kind))
+                        return true;
+                    if (isCredentialStore(target.replace(/^~(?=\/|$)/, os.homedir())))
+                        return true;
+                }
+                break;
+            }
+            case 'find': {
+                const hasDelete = args.includes('-delete');
+                const execsRm = args.some((a, idx) => ['-exec', '-execdir', '-ok'].includes(a) && /^(rm|shred|unlink)$/.test(path.basename(args[idx + 1] || '')));
+                if (!hasDelete && !execsRm)
+                    break;
+                const firstPredicate = args.findIndex(a => a.startsWith('-') || a === '(' || a === '!');
+                const roots = firstPredicate === -1 ? args : args.slice(0, firstPredicate);
+                const predicates = firstPredicate === -1 ? [] : args.slice(firstPredicate).filter(a => a !== '-delete');
+                const effectiveRoots = roots.length ? roots : ['.'];
+                for (const root of effectiveRoots) {
+                    const kind = classifyTarget(root);
+                    if (RISKY_FOR_RECURSIVE_CHANGE.has(kind))
+                        return true;
+                    // `find . -delete` with no filter wipes the whole project.
+                    if (kind === 'cwd' && predicates.length === 0)
+                        return true;
+                }
+                break;
+            }
+            case 'chmod':
+            case 'chown':
+            case 'chgrp': {
+                if (!hasRecursiveFlag(flags))
+                    break;
+                // The first operand is the mode / owner, the rest are paths.
+                for (const target of operands.slice(1)) {
+                    if (RISKY_FOR_RECURSIVE_CHANGE.has(classifyTarget(target)))
+                        return true;
+                }
+                break;
+            }
+            case 'dd': {
+                if (args.some(a => a.startsWith('if=') || a.startsWith('of=/dev/')))
+                    return true;
+                break;
+            }
+            case 'format': {
+                if (args.some(a => /^[a-z]:$/i.test(a)))
+                    return true;
+                break;
+            }
+            case 'git': {
+                if (args.includes('push') && args.some(a => /^(-f|--force|--force-with-lease(=.*)?|--mirror|--delete)$/.test(a) || /^\+\S+/.test(a)))
+                    return true;
+                if (args.includes('reset') && args.includes('--hard'))
+                    return true;
+                if (args.includes('clean') && args.some(a => a === '--force' || /^-[a-zA-Z]*f/.test(a)))
+                    return true;
+                break;
+            }
+        }
+    }
+    return false;
+}
 /**
- * Checks for destructive or dangerous shell commands
+ * A shell command that names a credentials store or a secrets file (`cat ~/.devxrc.json`,
+ * `grep key ~/.ssh/config`, `head .env`). Such a command is asked about even in YOLO mode:
+ * its output would reach the model and the chat. Templates such as `.env.example` are fine.
  */
-function isDangerousBashCommand(commandStr) {
-    if (!commandStr)
+export function shellTouchesSecrets(commandStr) {
+    if (!commandStr || typeof commandStr !== 'string')
         return false;
-    // Normalize whitespace: collapse multiple spaces/tabs into single space
-    const norm = commandStr.toLowerCase().replace(/\s+/g, ' ').trim();
-    // Pattern matching rm with combined flags (-rf, -fr, -r -f, etc.) targeting root, home, termux prefix, glob, or current/parent dir
-    const isDangerousRm = /rm\s+-(?:[a-z]*r[a-z]*f|[a-z]*f[a-z]*r)\s+(?:\/|\/\*|~|~\/|\*|\.|\.\/|\.\.\/?.*|\$home|\$prefix|\/data\/data\/com\.termux)/i.test(norm) ||
-        /rm\s+-[a-z]*r[a-z]*\s+-[a-z]*f[a-z]*\s+(?:\/|\/\*|~|~\/|\*|\.|\.\/|\.\.\/?.*|\$home|\$prefix|\/data\/data\/com\.termux)/i.test(norm) ||
-        /rm\s+-[a-z]*f[a-z]*\s+-[a-z]*r[a-z]*\s+(?:\/|\/\*|~|~\/|\*|\.|\.\/|\.\.\/?.*|\$home|\$prefix|\/data\/data\/com\.termux)/i.test(norm);
-    return (isDangerousRm ||
-        norm.includes('rm -rf /') ||
-        norm.includes('rm -rf ~') ||
-        norm.includes('rm -rf *') ||
-        norm.includes('rm -rf .') ||
-        norm.includes('rm -rf ./') ||
-        norm.includes('rm -rf ..') ||
-        norm.includes('rm -fr .') ||
-        norm.includes('rm -fr ./') ||
-        norm.includes('rm -rf $prefix') ||
-        norm.includes('rm -rf $home') ||
-        norm.includes('rm -rf /data/data/com.termux') ||
-        norm.includes('mkfs') ||
-        norm.includes('dd if=') ||
-        norm.includes(':(){ :|:& };:') ||
-        norm.includes('chmod -r 777 /') ||
-        norm.includes('> /dev/sda') ||
-        norm.includes('format c:'));
+    const home = os.homedir();
+    const tokens = commandStr.split(/[\s;|&<>()`]+/).filter(Boolean);
+    return tokens.some((raw) => {
+        const t = raw.replace(/^["']+|["']+$/g, '').replace(/^~(?=\/|$)/, home).replace(/^\$\{?HOME\}?(?=\/|$)/, home);
+        if (!t || t.startsWith('-') || /[$*?]/.test(t))
+            return false;
+        // `cd ~ && cat .devxrc.json`: the folder is not in the token, so the file name alone counts.
+        return isCredentialStore(t) || isSecretFile(t) || HOME_SENSITIVE_FILES.includes(path.basename(t));
+    });
+}
+const SHELL_INTERPRETER = '(?:\\S*\\/)?(?:ba|z|da|k|c|fi|a)?sh';
+/**
+ * Detects destructive or remote-code-execution shell commands. This is a safety
+ * net for YOLO mode, not a sandbox: it works on tokens (so `rm --recursive --force ~`
+ * and `find ~ -delete` are caught), but a determined obfuscation can still slip through.
+ */
+export function isDangerousBashCommand(commandStr) {
+    if (!commandStr || typeof commandStr !== 'string')
+        return false;
+    const norm = commandStr.replace(/\s+/g, ' ').trim();
+    const lower = norm.toLowerCase();
+    // Whole-command patterns (these need the pipes / redirections intact).
+    const patterns = [
+        /:\s*\(\s*\)\s*\{/, // fork bomb
+        new RegExp(`\\|\\s*(?:sudo\\s+(?:-\\S+\\s+)*)?${SHELL_INTERPRETER}\\b`), // anything piped into a shell
+        /\b(?:curl|wget|fetch)\b[^|]*\|\s*(?:sudo\s+)?(?:python[0-9.]*|node|perl|ruby|php)\b/, // download | interpreter
+        /<\(\s*(?:curl|wget)\b/, // sh <(curl ...)
+        /\$\(\s*(?:curl|wget)\b/, // sh -c "$(curl ...)"
+        />\s*\/dev\/(?:sd|hd|vd|nvme|mmcblk|disk|rdisk)/, // overwrite a block device
+        />>?\s*["']?(?:~|\$\{?home\}?|\/home\/[^/\s]+|\/root|\/users\/[^/\s]+)\/\.(?:ssh|bashrc|zshrc|profile|bash_profile|zprofile|gnupg|aws|netrc)/, // plant keys / shell hooks
+        /\b(?:rd|rmdir)\s+(?:\/[a-z]\s+)*\/s\b/, // Windows recursive delete
+        /\bdel\b[^&|]*\s\/s\b/,
+    ];
+    if (patterns.some(re => re.test(lower)))
+        return true;
+    // Per-command analysis on tokens.
+    const segments = commandStr.split(/\$\(|`|&&|\|\||[;|&()\n\r]/);
+    return segments.some(segment => analyzeSegment(tokenize(segment)));
 }
 /**
  * Checks if a command contains chaining, redirection, or subshell operators.
@@ -66,113 +276,171 @@ function hasComplexChainingOrRedirection(commandStr) {
         commandStr.includes('\n') ||
         commandStr.includes('\r'));
 }
+// ───────────────────────── guard ─────────────────────────
+const SHELL_TOOLS = new Set(['bash', 'exec', 'run_command', 'execute_command']);
+const READ_TOOLS = new Set(['read_file', 'view_file', 'read', 'list_dir', 'list_files', 'ls', 'search', 'grep_search', 'grep', 'diagnose_code']);
+const WRITE_TOOLS = new Set(['write_file', 'edit_file', 'make_dir', 'mkdir', 'create_file', 'write_to_file', 'patch']);
+function pathArg(args) {
+    const v = args?.path ?? args?.dir ?? args?.targetFile ?? args?.filePath ?? args?.file;
+    return typeof v === 'string' ? v : undefined;
+}
+export function newPermissionMemory() {
+    return { bash: new Set(), tools: new Set() };
+}
+/**
+ * What an "Allow for the session / Always" answer would remember for a request: a plain single
+ * command by its program and subcommand (`npm test`, `git status`, `ls`), or an MCP tool by its
+ * name. Dangerous commands, commands that read secrets, chains and redirections are never
+ * remembered: those are asked every time.
+ */
+export function rememberKeyFor(toolName, args) {
+    const t = (toolName || '').toLowerCase();
+    if (t.startsWith('mcp__'))
+        return { kind: 'tool', key: toolName };
+    if (!SHELL_TOOLS.has(t))
+        return null;
+    const cmd = String(args?.command || args?.cmd || '').trim();
+    if (!cmd || isDangerousBashCommand(cmd) || shellTouchesSecrets(cmd) || hasComplexChainingOrRedirection(cmd))
+        return null;
+    const tokens = tokenize(cmd);
+    if (tokens.length === 0)
+        return null;
+    const program = path.basename(tokens[0]).toLowerCase();
+    if (!/^[a-z0-9._+-]+$/.test(program))
+        return null;
+    const sub = tokens[1];
+    // The subcommand is a plain word (`test`, `status`); a flag, a path or a value makes the program alone the key.
+    const withSub = sub && /^[a-z][a-z0-9:_-]{0,19}$/.test(sub) && tokens.length <= 3 ? `${program} ${sub.toLowerCase()}` : program;
+    return { kind: 'bash', key: withSub };
+}
 export class CLIConsoleGuard {
     autoApprove;
     bashAllowlist;
-    constructor(autoApprove = false, bashAllowlist = []) {
+    options;
+    memory;
+    constructor(autoApprove = false, bashAllowlist = [], options = {}) {
         this.autoApprove = autoApprove;
         this.bashAllowlist = bashAllowlist;
+        this.options = options;
+        this.memory = options.memory ?? newPermissionMemory();
     }
     check(toolName, args) {
         const t = (toolName || '').toLowerCase();
         const cmd = (args?.command || args?.cmd || '').trim();
-        // Critical safety net: even in YOLO mode, warn and confirm destructive system commands
-        if (this.autoApprove) {
-            if (t === 'bash' && isDangerousBashCommand(cmd)) {
-                return true;
-            }
+        const target = pathArg(args);
+        // Critical safety net. These ask for confirmation even in YOLO mode.
+        if (SHELL_TOOLS.has(t) && (isDangerousBashCommand(cmd) || shellTouchesSecrets(cmd)))
+            return true;
+        if (target && (READ_TOOLS.has(t) || WRITE_TOOLS.has(t)) && isCredentialStore(target))
+            return true;
+        if (target && READ_TOOLS.has(t) && isSecretFile(target))
+            return true;
+        // Adding a server starts a program on this machine every time devx runs: always asked.
+        if (t === 'mcp_manage' && (args?.action === 'add' || args?.action === 'import_claude'))
+            return true;
+        if (this.autoApprove)
             return false;
-        }
-        // Check Bash Allowlist: only allow if command is NOT dangerous AND does not use chaining/redirection
-        if ((t === 'bash' || t === 'exec' || t === 'run_command') && cmd) {
-            if (!isDangerousBashCommand(cmd) && !hasComplexChainingOrRedirection(cmd)) {
-                const isAllowed = this.bashAllowlist.some(pattern => {
-                    const p = pattern.trim().toLowerCase();
-                    const lowerCmd = cmd.toLowerCase();
-                    return lowerCmd === p || lowerCmd.startsWith(p + ' ');
+        // Bash allowlist: only for single, clean commands without chaining / redirection.
+        if (SHELL_TOOLS.has(t) && cmd) {
+            if (!hasComplexChainingOrRedirection(cmd)) {
+                const lowerCmd = cmd.toLowerCase();
+                const isAllowed = [...this.bashAllowlist, ...this.memory.bash].some(pattern => {
+                    const pat = pattern.trim().toLowerCase();
+                    return lowerCmd === pat || lowerCmd.startsWith(pat + ' ');
                 });
-                if (isAllowed) {
-                    return false; // Automatically allowed!
-                }
+                if (isAllowed)
+                    return false;
             }
             return true; // Requires user confirmation
         }
-        // 2. Package installations require confirmation
-        if (t === 'install_package' || t === 'packages') {
+        if (t === 'install_package' || t === 'packages')
             return true;
-        }
-        // 3. File deletions require confirmation
-        if (t === 'delete_file' || t === 'remove_file') {
+        if (t === 'delete_file' || t === 'remove_file')
             return true;
-        }
-        // 4. File writes, edits, or directory creations outside project CWD require confirmation
-        if (t === 'write_file' || t === 'edit_file' || t === 'make_dir' || t === 'mkdir') {
-            const target = args?.path || args?.dir || args?.targetFile || args?.filePath;
-            if (isPathOutsideCwd(target)) {
-                return true;
-            }
-        }
-        // 5. MCP Tools: ask if autoApprove is false
-        if (t.startsWith('mcp__')) {
+        // The preview server listens on all interfaces and serves the project folder.
+        if (t === 'serve_preview' && args?.action !== 'stop' && args?.action !== 'status')
             return true;
-        }
+        // Anything that touches files outside the project needs approval (reads included).
+        if ((WRITE_TOOLS.has(t) || READ_TOOLS.has(t)) && isPathOutsideCwd(target))
+            return true;
+        if (t.startsWith('mcp__'))
+            return !this.memory.tools.has(toolName);
         return false;
     }
     async askUser(toolName, args) {
-        const t = (toolName || '').toLowerCase();
-        const cmd = args?.command || args?.cmd || '';
-        const isDangerous = t === 'bash' && isDangerousBashCommand(cmd);
         // In headless / non-interactive environment without TTY, deny confirmation-requiring actions immediately
         if (!process.stdin.isTTY) {
-            console.error(pc.red(`\n🛡️  [PERMISSION DENIED] Action '${toolName}' requires user confirmation in safe mode, but no interactive terminal is available. Pass --yolo (-y) to auto-approve actions in headless mode.`));
+            console.error(pc.red(`\n[PERMISSION DENIED] Action '${toolName}' requires user confirmation, but no interactive terminal is available. Pass --yolo (-y) to auto-approve regular actions in headless mode (dangerous commands and credential files still need a terminal).`));
             return false;
         }
-        if (isDangerous) {
-            p.log.error(pc.bold(pc.red('⚠️  [SECURITY WARNING] Agent requested a potentially dangerous system command!')));
-        }
-        else if (t.startsWith('mcp__')) {
-            const parts = toolName.split('__');
-            const serverName = parts[1] || 'mcp';
-            const mcpToolName = parts.slice(2).join('__');
-            p.log.warn(pc.bold(pc.yellow(`🛡️  [PERMISSION GUARD] Agent wants to call MCP Tool: ${pc.cyan(serverName)} / ${pc.green(mcpToolName)}`)));
-        }
-        else {
-            p.log.warn(pc.bold(pc.yellow(`🛡️  [PERMISSION GUARD] Agent wants to execute: ${pc.cyan(toolName)}`)));
-        }
-        // Pretty preview of key arguments
-        if (t === 'bash') {
-            console.log(`  ${pc.bold('Command:')} ${pc.green(cmd)}`);
-        }
-        else if (t === 'install_package') {
-            console.log(`  ${pc.bold('Packages:')} ${pc.green((args.packages || []).join(', '))}`);
-        }
-        else if (args?.path || args?.targetFile) {
-            const pth = args.path || args.targetFile;
-            const isOutside = isPathOutsideCwd(pth);
-            console.log(`  ${pc.bold('Target File:')} ${isOutside ? pc.red(pth + ' (OUTSIDE PROJECT)') : pc.green(pth)}`);
-        }
-        else {
-            console.log(`  ${pc.dim('Arguments:')} ${JSON.stringify(args, null, 2)}`);
-        }
-        // Pause raw mode for interactive prompt
-        const wasRaw = process.stdin.isTTY && process.stdin.isRaw;
-        if (wasRaw) {
-            process.stdin.setRawMode(false);
-        }
-        let allowed = false;
-        try {
-            allowed = await p.confirm({
-                message: isDangerous ? pc.red('Confirm executing this dangerous command?') : 'Allow execution?',
-                initialValue: !isDangerous
-            });
+        const request = buildPermissionRequest(toolName, args);
+        // Only requests that are safe to remember offer "Session" and "Always".
+        const remember = request.danger ? null : rememberKeyFor(toolName, args);
+        const offer = remember ? { session: true, always: true } : {};
+        // Risky requests start on "Deny": a stray Enter must not approve them.
+        const defaultAnswer = request.danger ? 'deny' : 'allow';
+        const answer = this.options.decide
+            ? await this.options.decide(request, offer, !!request.danger)
+            : await askPermissionDecision(request, defaultAnswer, undefined, offer);
+        if (answer === 'deny')
+            return false;
+        if (remember && (answer === 'session' || answer === 'always')) {
+            (remember.kind === 'bash' ? this.memory.bash : this.memory.tools).add(remember.key);
+            if (answer === 'always')
+                this.options.onAlways?.(remember);
         }
-        finally {
-            // Restore raw mode
-            if (wasRaw && process.stdin.isTTY) {
-                process.stdin.setRawMode(true);
-                process.stdin.resume();
-            }
+        return true;
+    }
+}
+/** Describes what the agent wants to do, for the approval card. */
+export function buildPermissionRequest(toolName, args) {
+    const t = (toolName || '').toLowerCase();
+    const cmd = String(args?.command || args?.cmd || '');
+    const target = pathArg(args);
+    const notes = [];
+    const sensitive = !!target && (isCredentialStore(target) || (READ_TOOLS.has(t) && isSecretFile(target)));
+    if (sensitive)
+        notes.push('this is a credentials / secrets file');
+    else if (target && isPathOutsideCwd(target))
+        notes.push('outside the project folder');
+    if (SHELL_TOOLS.has(t)) {
+        const danger = isDangerousBashCommand(cmd) || shellTouchesSecrets(cmd);
+        if (isDangerousBashCommand(cmd))
+            notes.push('looks destructive or runs downloaded code');
+        else if (shellTouchesSecrets(cmd))
+            notes.push('reads a credentials / secrets file: its content would reach the model');
+        return { title: t === 'bash' ? 'bash' : toolName, danger, lines: cmd.split('\n'), notes };
+    }
+    if (t === 'mcp_manage') {
+        if (args?.action === 'import_claude') {
+            return { title: 'mcp · import from Claude Code', lines: ['servers of ~/.claude.json -> ~/.devx/mcp.json'], notes: ['they start as programs on your machine'] };
         }
-        return allowed === true;
+        const full = args?.url ? String(args.url) : [String(args?.command ?? ''), ...(Array.isArray(args?.args) ? args.args.map(String) : [])].join(' ');
+        const envNames = args?.env && typeof args.env === 'object' ? Object.keys(args.env) : [];
+        return {
+            title: `mcp · add server ${String(args?.name ?? '')}`,
+            lines: [full, ...(envNames.length ? [`env: ${envNames.join(', ')}`] : [])],
+            notes: ['saved to ~/.devx/mcp.json and started now and at every start of devx'],
+        };
+    }
+    if (t.startsWith('mcp__')) {
+        const parts = toolName.split('__');
+        const server = parts[1] || 'mcp';
+        const tool = parts.slice(2).join('__');
+        const lines = args && Object.keys(args).length > 0 ? JSON.stringify(args, null, 2).split('\n') : ['(no arguments)'];
+        return { title: `mcp · ${server} / ${tool}`, lines, notes };
+    }
+    if (t === 'install_package' || t === 'packages') {
+        const manager = args?.manager ? `${args.manager}: ` : '';
+        return { title: 'install_package', lines: [`${manager}${String(args?.package ?? '')}${args?.dev ? '  (dev dependency)' : ''}`], notes };
+    }
+    if (t === 'serve_preview') {
+        notes.push('serves the project folder to your local network');
+        return { title: 'serve_preview', lines: [`${args?.action ?? 'start'}${args?.port ? ` on port ${args.port}` : ''}`], notes };
+    }
+    if (target) {
+        return { title: toolName, danger: sensitive, lines: [target], notes };
     }
+    const lines = args && Object.keys(args).length > 0 ? JSON.stringify(args, null, 2).split('\n') : ['(no arguments)'];
+    return { title: toolName, lines, notes };
 }