ugly-app 0.1.650 → 0.1.652

package/dist/native/server/permissions/gate.js

@@ -0,0 +1,150 @@
+/**
+ * CapabilityGate — the single enforcement chokepoint the privileged
+ * daemon calls before performing any `window.ugly` operation. It
+ * composes the per-origin grants, the per-origin fs scope, the bundled-
+ * binary allowlist, and the audit log. Every call either returns the
+ * resolved/authorized value or throws `PermissionDenied` — and is
+ * recorded either way.
+ *
+ * Pure logic (no Electron / no fs): the Electron main wires the real
+ * `baseDir`, the live `GrantStore`, and an audit sink around it.
+ */
+import path from 'path';
+import { AuditLog } from './audit.js';
+import { originScopeDir, resolveScopedPath, ScopeViolation } from './scope.js';
+export class PermissionDenied extends Error {
+    origin;
+    capability;
+    resource;
+    constructor(origin, capability, resource, reason) {
+        super(`Permission denied for ${origin} (${capability} ${resource}): ${reason}`);
+        this.origin = origin;
+        this.capability = capability;
+        this.resource = resource;
+        this.name = 'PermissionDenied';
+    }
+}
+export class CapabilityGate {
+    store;
+    baseDir;
+    bundled;
+    audit;
+    constructor(cfg) {
+        this.store = cfg.store;
+        this.baseDir = cfg.baseDir;
+        this.bundled = new Set(cfg.bundledBinaries);
+        this.audit = cfg.audit ?? new AuditLog();
+    }
+    /** The on-disk scope root for an origin (its sandboxed app folder). */
+    scopeRoot(origin) {
+        return originScopeDir(this.baseDir, origin);
+    }
+    deny(origin, capability, resource, reason) {
+        this.audit.record({ origin, capability, resource, allowed: false, reason });
+        throw new PermissionDenied(origin, capability, resource, reason);
+    }
+    allow(origin, capability, resource) {
+        this.audit.record({ origin, capability, resource, allowed: true });
+    }
+    /**
+     * Authorize + resolve an `ugly.fs.*` path. 'scoped' confines to the
+     * origin's folder; 'full' (sudo) allows any absolute path; 'none'
+     * denies. Returns the absolute path to operate on.
+     */
+    resolveFsPath(origin, requestedPath) {
+        const fs = this.store.query(origin).fs;
+        if (fs === 'none') {
+            this.deny(origin, 'fs', requestedPath, 'no filesystem permission');
+        }
+        if (fs === 'full') {
+            const abs = path.resolve(requestedPath);
+            this.allow(origin, 'fs:full', abs);
+            return abs;
+        }
+        // scoped
+        try {
+            const abs = resolveScopedPath(this.scopeRoot(origin), requestedPath);
+            this.allow(origin, 'fs:scoped', abs);
+            return abs;
+        }
+        catch (e) {
+            const reason = e instanceof ScopeViolation ? 'path escapes scoped folder' : 'invalid path';
+            this.deny(origin, 'fs:scoped', requestedPath, reason);
+        }
+    }
+    /**
+     * Resolve + confine a process's working directory. A `process` grant
+     * alone is enough to run inside the origin's scope folder — this does
+     * NOT require a separate `fs` grant (that gates `ugly.fs.*`). A 'full'
+     * (sudo) origin may cwd anywhere; everyone else is confined to scope.
+     */
+    resolveProcessCwd(origin, cwd) {
+        const root = this.scopeRoot(origin);
+        if (!cwd)
+            return root;
+        if (this.store.query(origin).fs === 'full') {
+            const abs = path.resolve(cwd);
+            this.allow(origin, 'process:cwd', abs);
+            return abs;
+        }
+        try {
+            const abs = resolveScopedPath(root, cwd);
+            this.allow(origin, 'process:cwd', abs);
+            return abs;
+        }
+        catch {
+            this.deny(origin, 'process:cwd', cwd, 'cwd escapes scoped folder');
+        }
+    }
+    /** Does this origin hold the github capability (authorizes gh + git)? */
+    holdsGithub(origin) {
+        return this.store.query(origin).github;
+    }
+    /** Authorize an `ugly.process` spawn of `binary`. Throws if not allowed. */
+    checkProcess(origin, binary) {
+        if (!this.bundled.has(binary)) {
+            this.deny(origin, 'process', binary, 'not a bundled tool');
+        }
+        const g = this.store.query(origin);
+        // The github capability authorizes exactly the GitHub CLIs.
+        const githubTool = g.github && (binary === 'gh' || binary === 'git');
+        if (!githubTool && !g.process.includes(binary)) {
+            this.deny(origin, 'process', binary, 'tool not granted');
+        }
+        this.allow(origin, 'process', binary);
+    }
+    checkServe(origin, port = 0) {
+        if (!this.store.query(origin).serve) {
+            this.deny(origin, 'serve', String(port), 'serve not granted');
+        }
+        this.allow(origin, 'serve', String(port));
+    }
+    checkNet(origin, target = '') {
+        if (!this.store.query(origin).net) {
+            this.deny(origin, 'net', target, 'net not granted');
+        }
+        this.allow(origin, 'net', target);
+    }
+    checkWorkers(origin, opts = {}) {
+        const g = this.store.query(origin);
+        if (!g.workers)
+            this.deny(origin, 'workers', '', 'workers not granted');
+        if (opts.boot && !g.workersBoot) {
+            this.deny(origin, 'workers:boot', '', 'boot-start not granted');
+        }
+        this.allow(origin, opts.boot ? 'workers:boot' : 'workers', '');
+    }
+    checkSecrets(origin, key = '') {
+        if (!this.store.query(origin).secrets) {
+            this.deny(origin, 'secrets', key, 'secrets not granted');
+        }
+        this.allow(origin, 'secrets', key);
+    }
+    checkBrowse(origin, target = '') {
+        if (!this.store.query(origin).browse) {
+            this.deny(origin, 'browse', target, 'browse not granted');
+        }
+        this.allow(origin, 'browse', target);
+    }
+}
+//# sourceMappingURL=gate.js.map

package/dist/native/server/permissions/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../../../src/native/server/permissions/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE/E,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAE9B;IACA;IACA;IAHX,YACW,MAAc,EACd,UAAkB,EAClB,QAAgB,EACzB,MAAc;QAEd,KAAK,CAAC,yBAAyB,MAAM,KAAK,UAAU,IAAI,QAAQ,MAAM,MAAM,EAAE,CAAC,CAAC;QALvE,WAAM,GAAN,MAAM,CAAQ;QACd,eAAU,GAAV,UAAU,CAAQ;QAClB,aAAQ,GAAR,QAAQ,CAAQ;QAIzB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAWD,MAAM,OAAO,cAAc;IACR,KAAK,CAAa;IAClB,OAAO,CAAS;IAChB,OAAO,CAAsB;IACrC,KAAK,CAAW;IAEzB,YAAY,GAAe;QACzB,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,IAAI,QAAQ,EAAE,CAAC;IAC3C,CAAC;IAED,uEAAuE;IACvE,SAAS,CAAC,MAAc;QACtB,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAEO,IAAI,CACV,MAAc,EACd,UAAkB,EAClB,QAAgB,EAChB,MAAc;QAEd,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5E,MAAM,IAAI,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACnE,CAAC;IAEO,KAAK,CAAC,MAAc,EAAE,UAAkB,EAAE,QAAgB;QAChE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,MAAc,EAAE,aAAqB;QACjD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAClB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,0BAA0B,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACxC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;YACnC,OAAO,GAAG,CAAC;QACb,CAAC;QACD,SAAS;QACT,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;YACrE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;YACrC,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,MAAM,GACV,CAAC,YAAY,cAAc,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,cAAc,CAAC;YAC9E,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,MAAc,EAAE,GAAY;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;YAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;YACvC,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;YACvC,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,2BAA2B,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,WAAW,CAAC,MAAc;QACxB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACzC,CAAC;IAED,4EAA4E;IAC5E,YAAY,CAAC,MAAc,EAAE,MAAc;QACzC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnC,4DAA4D;QAC5D,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,CAAC;QACrE,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,UAAU,CAAC,MAAc,EAAE,IAAI,GAAG,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,QAAQ,CAAC,MAAc,EAAE,MAAM,GAAG,EAAE;QAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,YAAY,CAAC,MAAc,EAAE,OAA2B,EAAE;QACxD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,wBAAwB,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,YAAY,CAAC,MAAc,EAAE,GAAG,GAAG,EAAE;QACnC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IAED,WAAW,CAAC,MAAc,EAAE,MAAM,GAAG,EAAE;QACrC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;CACF"}

package/dist/native/server/permissions/grants.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Per-origin grant store + the incremental request decision logic.
+ *
+ * `evaluate()` is pure: it diffs a request against what the origin holds
+ * and reports the delta + whether a prompt / elevated confirm is needed,
+ * WITHOUT mutating. The Electron layer shows the prompt for the delta,
+ * then calls `grant()` to commit (or auto-commits for trusted origins).
+ * This keeps "decide" separate from "persist" and makes both testable.
+ */
+import { type CapabilityRequest, type OriginGrant, type PermissionDecision } from './types.js';
+export declare class GrantStore {
+    private readonly grants;
+    private readonly trusted;
+    constructor(trustedOrigins?: readonly string[]);
+    isTrusted(origin: string): boolean;
+    /** Capabilities the origin currently holds (EMPTY_GRANT if none). */
+    query(origin: string): OriginGrant;
+    /**
+     * Decide what a request needs — the delta beyond what's held, and
+     * whether it must prompt / elevate. Pure: does not mutate.
+     */
+    evaluate(origin: string, req: CapabilityRequest): PermissionDecision;
+    /**
+     * Commit a (delta) grant onto the origin's held set. Idempotent and
+     * monotonic — merges, never downgrades. Returns the new held grant.
+     */
+    grant(origin: string, req: CapabilityRequest): OriginGrant;
+    /** Revoke everything for an origin (Subsystem B exposes a settings UI). */
+    revoke(origin: string): void;
+    /** Serializable copy of all held grants (for persistence). */
+    snapshot(): Record<string, OriginGrant>;
+    /** Replace all held grants from a snapshot (load on startup). */
+    restore(snapshot: Record<string, OriginGrant>): void;
+}
+export type GrantSnapshot = Record<string, OriginGrant>;
+//# sourceMappingURL=grants.d.ts.map

package/dist/native/server/permissions/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../../../src/native/server/permissions/grants.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,KAAK,iBAAiB,EAEtB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACxB,MAAM,YAAY,CAAC;AAapB,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;IACzD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;gBAElC,cAAc,GAAE,SAAS,MAAM,EAAO;IAIlD,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAIlC,qEAAqE;IACrE,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW;IAIlC;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,kBAAkB;IAyCpE;;;OAGG;IACH,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,WAAW;IAmB1D,2EAA2E;IAC3E,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAI5B,8DAA8D;IAC9D,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC;IAMvC,iEAAiE;IACjE,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,IAAI;CAMrD;AAED,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC"}

package/dist/native/server/permissions/grants.js

@@ -0,0 +1,116 @@
+/**
+ * Per-origin grant store + the incremental request decision logic.
+ *
+ * `evaluate()` is pure: it diffs a request against what the origin holds
+ * and reports the delta + whether a prompt / elevated confirm is needed,
+ * WITHOUT mutating. The Electron layer shows the prompt for the delta,
+ * then calls `grant()` to commit (or auto-commits for trusted origins).
+ * This keeps "decide" separate from "persist" and makes both testable.
+ */
+import { EMPTY_GRANT, } from './types.js';
+function normalizeWorkers(w) {
+    if (w === undefined)
+        return { workers: false, boot: false };
+    if (typeof w === 'boolean')
+        return { workers: w, boot: false };
+    return { workers: true, boot: w.boot === true };
+}
+/** fs rank so 'full' supersedes 'scoped' supersedes 'none'. */
+const FS_RANK = { none: 0, scoped: 1, full: 2 };
+export class GrantStore {
+    grants = new Map();
+    trusted;
+    constructor(trustedOrigins = []) {
+        this.trusted = new Set(trustedOrigins);
+    }
+    isTrusted(origin) {
+        return this.trusted.has(origin);
+    }
+    /** Capabilities the origin currently holds (EMPTY_GRANT if none). */
+    query(origin) {
+        return this.grants.get(origin) ?? EMPTY_GRANT;
+    }
+    /**
+     * Decide what a request needs — the delta beyond what's held, and
+     * whether it must prompt / elevate. Pure: does not mutate.
+     */
+    evaluate(origin, req) {
+        const held = this.query(origin);
+        const delta = {};
+        // fs: only a STRICT increase in level is new (scoped→full is new;
+        // full→scoped is already covered).
+        if (req.fs && FS_RANK[req.fs] > FS_RANK[held.fs]) {
+            delta.fs = req.fs;
+        }
+        // process: binaries not already granted.
+        if (req.process && req.process.length > 0) {
+            const have = new Set(held.process);
+            const missing = [...new Set(req.process)].filter((p) => !have.has(p));
+            if (missing.length > 0)
+                delta.process = missing.sort();
+        }
+        if (req.serve && !held.serve)
+            delta.serve = true;
+        if (req.net && !held.net)
+            delta.net = true;
+        if (req.secrets && !held.secrets)
+            delta.secrets = true;
+        if (req.browse && !held.browse)
+            delta.browse = true;
+        if (req.github && !held.github)
+            delta.github = true;
+        const wantW = normalizeWorkers(req.workers);
+        if ((wantW.workers && !held.workers) || (wantW.boot && !held.workersBoot)) {
+            delta.workers = wantW.boot ? { boot: true } : true;
+        }
+        const isEmpty = Object.keys(delta).length === 0;
+        const elevated = delta.fs === 'full' ||
+            (typeof delta.workers === 'object' && delta.workers.boot === true);
+        return {
+            alreadyHeld: isEmpty,
+            delta,
+            requiresPrompt: !isEmpty && !this.isTrusted(origin),
+            requiresElevatedConfirm: !isEmpty && elevated,
+        };
+    }
+    /**
+     * Commit a (delta) grant onto the origin's held set. Idempotent and
+     * monotonic — merges, never downgrades. Returns the new held grant.
+     */
+    grant(origin, req) {
+        const held = this.query(origin);
+        const wantW = normalizeWorkers(req.workers);
+        const next = {
+            fs: req.fs && FS_RANK[req.fs] > FS_RANK[held.fs] ? req.fs : held.fs,
+            process: [...new Set([...held.process, ...(req.process ?? [])])].sort(),
+            serve: held.serve || req.serve === true,
+            workers: held.workers || wantW.workers,
+            workersBoot: held.workersBoot || wantW.boot,
+            net: held.net || req.net === true,
+            secrets: held.secrets || req.secrets === true,
+            browse: held.browse || req.browse === true,
+            github: held.github || req.github === true,
+        };
+        this.grants.set(origin, next);
+        return next;
+    }
+    /** Revoke everything for an origin (Subsystem B exposes a settings UI). */
+    revoke(origin) {
+        this.grants.delete(origin);
+    }
+    /** Serializable copy of all held grants (for persistence). */
+    snapshot() {
+        const out = {};
+        for (const [origin, g] of this.grants)
+            out[origin] = { ...g, process: [...g.process] };
+        return out;
+    }
+    /** Replace all held grants from a snapshot (load on startup). */
+    restore(snapshot) {
+        this.grants.clear();
+        for (const [origin, g] of Object.entries(snapshot)) {
+            this.grants.set(origin, { ...g, process: [...g.process].sort() });
+        }
+    }
+}
+//# sourceMappingURL=grants.js.map

package/dist/native/server/permissions/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../../../src/native/server/permissions/grants.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAEL,WAAW,GAGZ,MAAM,YAAY,CAAC;AAEpB,SAAS,gBAAgB,CACvB,CAA+B;IAE/B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC5D,IAAI,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;AAClD,CAAC;AAED,+DAA+D;AAC/D,MAAM,OAAO,GAAsC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAEnF,MAAM,OAAO,UAAU;IACJ,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IACxC,OAAO,CAAsB;IAE9C,YAAY,iBAAoC,EAAE;QAChD,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IACzC,CAAC;IAED,SAAS,CAAC,MAAc;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,MAAc;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC;IAChD,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,MAAc,EAAE,GAAsB;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,KAAK,GAAsB,EAAE,CAAC;QAEpC,kEAAkE;QAClE,mCAAmC;QACnC,IAAI,GAAG,CAAC,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACjD,KAAK,CAAC,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC;QACpB,CAAC;QAED,yCAAyC;QACzC,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACtE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QACzD,CAAC;QAED,IAAI,GAAG,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;QACjD,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG;YAAE,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC;QAC3C,IAAI,GAAG,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;QACvD,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;QACpD,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;QAEpD,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1E,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACrD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;QAChD,MAAM,QAAQ,GACZ,KAAK,CAAC,EAAE,KAAK,MAAM;YACnB,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAErE,OAAO;YACL,WAAW,EAAE,OAAO;YACpB,KAAK;YACL,cAAc,EAAE,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;YACnD,uBAAuB,EAAE,CAAC,OAAO,IAAI,QAAQ;SAC9C,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAc,EAAE,GAAsB;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAgB;YACxB,EAAE,EACA,GAAG,CAAC,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE;YACjE,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YACvE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI;YACvC,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO;YACtC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI;YAC3C,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI;YACjC,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI;YAC7C,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;YAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;SAC3C,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2EAA2E;IAC3E,MAAM,CAAC,MAAc;QACnB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,8DAA8D;IAC9D,QAAQ;QACN,MAAM,GAAG,GAAgC,EAAE,CAAC;QAC5C,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACvF,OAAO,GAAG,CAAC;IACb,CAAC;IAED,iEAAiE;IACjE,OAAO,CAAC,QAAqC;QAC3C,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;CACF"}

package/dist/native/server/permissions/scope.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Filesystem scope confinement for `ugly.fs.*`.
+ *
+ * A scoped origin may only touch paths inside its per-origin folder
+ * (`<base>/apps/<hash>/`). `resolveScopedPath` is the single chokepoint
+ * every scoped fs call passes through: it resolves the requested path
+ * (relative → against the scope root; absolute → as-is) and rejects
+ * anything that lands outside the root — `..` traversal, an absolute
+ * path elsewhere, or a NUL byte. This is pure path math; symlink
+ * escapes are caught by a second `realpath` check at the daemon (it
+ * needs fs), layered on top of this.
+ */
+export declare class ScopeViolation extends Error {
+    readonly requested: string;
+    readonly scopeRoot: string;
+    constructor(requested: string, scopeRoot: string);
+}
+/**
+ * Deterministic per-origin folder name. A normal origin
+ * (`https://app.example.com`) maps to a stable, filesystem-safe slug +
+ * short hash so two origins can't collide and the folder is recognizable.
+ */
+export declare function originScopeDir(baseDir: string, origin: string): string;
+/**
+ * Resolve `requested` against `scopeRoot` and confirm it stays inside.
+ * Throws `ScopeViolation` on any escape. Returns the absolute,
+ * normalized path on success.
+ */
+export declare function resolveScopedPath(scopeRoot: string, requested: string): string;
+/** True when the resolved path is inside the scope root (no throw). */
+export declare function isWithinScope(scopeRoot: string, requested: string): boolean;
+//# sourceMappingURL=scope.d.ts.map

package/dist/native/server/permissions/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../../../src/native/server/permissions/scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,qBAAa,cAAe,SAAQ,KAAK;IAErC,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM;gBADjB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM;CAS7B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAQtE;AAaD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAS9E;AAED,uEAAuE;AACvE,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAO3E"}

package/dist/native/server/permissions/scope.js

@@ -0,0 +1,73 @@
+/**
+ * Filesystem scope confinement for `ugly.fs.*`.
+ *
+ * A scoped origin may only touch paths inside its per-origin folder
+ * (`<base>/apps/<hash>/`). `resolveScopedPath` is the single chokepoint
+ * every scoped fs call passes through: it resolves the requested path
+ * (relative → against the scope root; absolute → as-is) and rejects
+ * anything that lands outside the root — `..` traversal, an absolute
+ * path elsewhere, or a NUL byte. This is pure path math; symlink
+ * escapes are caught by a second `realpath` check at the daemon (it
+ * needs fs), layered on top of this.
+ */
+import path from 'path';
+export class ScopeViolation extends Error {
+    requested;
+    scopeRoot;
+    constructor(requested, scopeRoot) {
+        super(`Path escapes the app's scoped folder: ${JSON.stringify(requested)} is outside ${scopeRoot}`);
+        this.requested = requested;
+        this.scopeRoot = scopeRoot;
+        this.name = 'ScopeViolation';
+    }
+}
+/**
+ * Deterministic per-origin folder name. A normal origin
+ * (`https://app.example.com`) maps to a stable, filesystem-safe slug +
+ * short hash so two origins can't collide and the folder is recognizable.
+ */
+export function originScopeDir(baseDir, origin) {
+    const slug = origin
+        .replace(/^[a-z]+:\/\//i, '')
+        .replace(/[^a-zA-Z0-9.-]+/g, '_')
+        .replace(/^_+|_+$/g, '')
+        .slice(0, 40) || 'origin';
+    return path.join(baseDir, 'apps', `${slug}-${shortHash(origin)}`);
+}
+/** Small, dependency-free, stable string hash → 8 hex chars. */
+function shortHash(s) {
+    // FNV-1a 32-bit.
+    let h = 0x811c9dc5;
+    for (let i = 0; i < s.length; i++) {
+        h ^= s.charCodeAt(i);
+        h = Math.imul(h, 0x01000193);
+    }
+    return (h >>> 0).toString(16).padStart(8, '0');
+}
+/**
+ * Resolve `requested` against `scopeRoot` and confirm it stays inside.
+ * Throws `ScopeViolation` on any escape. Returns the absolute,
+ * normalized path on success.
+ */
+export function resolveScopedPath(scopeRoot, requested) {
+    if (requested.includes('\0'))
+        throw new ScopeViolation(requested, scopeRoot);
+    const root = path.resolve(scopeRoot);
+    // path.resolve collapses `..`; an absolute `requested` replaces root.
+    const resolved = path.resolve(root, requested);
+    if (resolved !== root && !resolved.startsWith(root + path.sep)) {
+        throw new ScopeViolation(requested, scopeRoot);
+    }
+    return resolved;
+}
+/** True when the resolved path is inside the scope root (no throw). */
+export function isWithinScope(scopeRoot, requested) {
+    try {
+        resolveScopedPath(scopeRoot, requested);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=scope.js.map

package/dist/native/server/permissions/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../../../src/native/server/permissions/scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,MAAM,OAAO,cAAe,SAAQ,KAAK;IAE5B;IACA;IAFX,YACW,SAAiB,EACjB,SAAiB;QAE1B,KAAK,CACH,yCAAyC,IAAI,CAAC,SAAS,CACrD,SAAS,CACV,eAAe,SAAS,EAAE,CAC5B,CAAC;QAPO,cAAS,GAAT,SAAS,CAAQ;QACjB,cAAS,GAAT,SAAS,CAAQ;QAO1B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,MAAc;IAC5D,MAAM,IAAI,GACR,MAAM;SACH,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;SAC5B,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC;SAChC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC;IAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,gEAAgE;AAChE,SAAS,SAAS,CAAC,CAAS;IAC1B,iBAAiB;IACjB,IAAI,CAAC,GAAG,UAAU,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,SAAiB;IACpE,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,sEAAsE;IACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/C,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,SAAiB;IAChE,IAAI,CAAC;QACH,iBAAiB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/native/server/permissions/types.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Permission model for the Ugly Browser's privileged capabilities.
+ *
+ * Every `window.ugly` call is gated against a per-origin grant. This
+ * module is pure decision logic — no Electron, no IO — so the security
+ * crux is unit-testable in isolation. The Electron main process wires
+ * the prompt UI + on-disk persistence around it (Subsystem B).
+ *
+ * Tiers (see the plan): a trusted-origin allowlist auto-grants; any
+ * other origin must be prompted and is confined to a per-origin scoped
+ * folder; `fs: 'full'` (sudo) and `workers.boot` (start-on-OS-boot) are
+ * separate, scarier confirmations layered on top.
+ */
+/** What a site asks for via `ugly.permissions.request(...)`. */
+export interface CapabilityRequest {
+    /** 'scoped' = per-origin folder only; 'full' = entire filesystem (sudo). */
+    fs?: 'scoped' | 'full';
+    /** Bundled binaries the site wants to run (e.g. ['python', 'ffmpeg']). */
+    process?: readonly string[];
+    /** Bind a localhost server. */
+    serve?: boolean;
+    /** Register a background worker, optionally start-on-boot. */
+    workers?: boolean | {
+        boot?: boolean;
+    };
+    /** Raw TCP/UDP sockets (outbound connect, and later listen). */
+    net?: boolean;
+    /** OS keychain access. */
+    secrets?: boolean;
+    /** Drive headless web pages: load arbitrary URLs, extract, navigate, automate. */
+    browse?: boolean;
+    /** Use Ugly Studio's single GitHub account via gh/git (Device-Flow auth). */
+    github?: boolean;
+}
+/** The resolved set of capabilities an origin currently holds. */
+export interface OriginGrant {
+    fs: 'none' | 'scoped' | 'full';
+    /** Granted binaries, sorted + de-duped. */
+    process: readonly string[];
+    serve: boolean;
+    workers: boolean;
+    workersBoot: boolean;
+    net: boolean;
+    secrets: boolean;
+    browse: boolean;
+    github: boolean;
+}
+export declare const EMPTY_GRANT: OriginGrant;
+/**
+ * The decision returned by evaluating a request against held grants.
+ * `delta` is what's NEW (the part to prompt for); when it's empty the
+ * request is satisfied silently (idempotent / just-in-time semantics).
+ */
+export interface PermissionDecision {
+    /** True when the held grant already covers the whole request. */
+    alreadyHeld: boolean;
+    /** Only the capabilities not already held — what a prompt would ask for. */
+    delta: CapabilityRequest;
+    /** A prompt is needed (non-empty delta AND origin not trusted). */
+    requiresPrompt: boolean;
+    /** The delta includes a sudo-class capability (full FS or boot worker). */
+    requiresElevatedConfirm: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/native/server/permissions/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/native/server/permissions/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,gEAAgE;AAChE,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,EAAE,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IACvB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,+BAA+B;IAC/B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8DAA8D;IAC9D,OAAO,CAAC,EAAE,OAAO,GAAG;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACvC,gEAAgE;IAChE,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,0BAA0B;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kFAAkF;IAClF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC/B,2CAA2C;IAC3C,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;IACrB,GAAG,EAAE,OAAO,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,eAAO,MAAM,WAAW,EAAE,WAUzB,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,iEAAiE;IACjE,WAAW,EAAE,OAAO,CAAC;IACrB,4EAA4E;IAC5E,KAAK,EAAE,iBAAiB,CAAC;IACzB,mEAAmE;IACnE,cAAc,EAAE,OAAO,CAAC;IACxB,2EAA2E;IAC3E,uBAAuB,EAAE,OAAO,CAAC;CAClC"}

package/dist/native/server/permissions/types.js

@@ -0,0 +1,25 @@
+/**
+ * Permission model for the Ugly Browser's privileged capabilities.
+ *
+ * Every `window.ugly` call is gated against a per-origin grant. This
+ * module is pure decision logic — no Electron, no IO — so the security
+ * crux is unit-testable in isolation. The Electron main process wires
+ * the prompt UI + on-disk persistence around it (Subsystem B).
+ *
+ * Tiers (see the plan): a trusted-origin allowlist auto-grants; any
+ * other origin must be prompted and is confined to a per-origin scoped
+ * folder; `fs: 'full'` (sudo) and `workers.boot` (start-on-OS-boot) are
+ * separate, scarier confirmations layered on top.
+ */
+export const EMPTY_GRANT = {
+    fs: 'none',
+    process: [],
+    serve: false,
+    workers: false,
+    workersBoot: false,
+    net: false,
+    secrets: false,
+    browse: false,
+    github: false,
+};
+//# sourceMappingURL=types.js.map

package/dist/native/server/permissions/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/native/server/permissions/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAoCH,MAAM,CAAC,MAAM,WAAW,GAAgB;IACtC,EAAE,EAAE,MAAM;IACV,OAAO,EAAE,EAAE;IACX,KAAK,EAAE,KAAK;IACZ,OAAO,EAAE,KAAK;IACd,WAAW,EAAE,KAAK;IAClB,GAAG,EAAE,KAAK;IACV,OAAO,EAAE,KAAK;IACd,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,KAAK;CACd,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ugly-app",
-  "version": "0.1.650",
+  "version": "0.1.652",
   "type": "module",
   "comment:files": "Allowlist what ships to npm. dist = runtime; src = sourcemap targets (dist/*.js.map reference ../../src/); templates = CLI scaffold. Everything else at repo root (.pgdata local Postgres, coverage, assets/icons sources, test/, test-results/) is excluded by omission. The !negations strip the scaffold's installed deps + cruft (templates/node_modules is 200MB+ and must never ship). package.json/README/LICENSE ship automatically.",
   "files": [
@@ -48,7 +48,8 @@
     "./vite": "./dist/vite/index.js",
     "./eslint": "./dist/eslint/index.js",
     "./native": "./dist/native/index.js",
-    "./native/conformance": "./dist/native/conformance/harness.js"
+    "./native/conformance": "./dist/native/conformance/harness.js",
+    "./native/server": "./dist/native/server/index.js"
   },
   "bin": {
     "ugly-app": "dist/cli/index.js"

package/src/cli/version.ts

@@ -1,2 +1,2 @@
 // Auto-generated by prebuild — do not edit manually
-export const CLI_VERSION = "0.1.650";
+export const CLI_VERSION = "0.1.652";

package/src/client/createSocket.ts

@@ -590,6 +590,69 @@ export function createSocket<R extends AppRegistryBase>(
       >;
     },
 
+    /**
+     * A STREAMED request over HTTP SSE (not the WS): used by `runAgent` so agent
+     * turns deliver `msg:delta` frames live without needing a `trackDocs` hub
+     * channel (apps don't register `agentStream`). POSTs to `/api/<name>` with
+     * `Accept: text/event-stream` (the framework's SSE-response mode), forwards
+     * each agent frame to `onFrame`, and resolves with the terminal `__result__`.
+     * Auth rides the same-origin `auth_token` cookie (`credentials: 'include'`).
+     */
+    async requestStream(
+      name: string,
+      input: unknown,
+      onFrame: (frame: unknown) => void,
+      opts?: { signal?: AbortSignal },
+    ): Promise<unknown> {
+      const res = await fetch(`/api/${name}`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', Accept: 'text/event-stream' },
+        credentials: 'include',
+        body: JSON.stringify({ input }),
+        ...(opts?.signal ? { signal: opts.signal } : {}),
+      });
+      if (!res.ok || !res.body) {
+        // No stream available — fall back to the buffered JSON result.
+        const json = (await res.json().catch(() => ({}))) as { result?: unknown; error?: string };
+        if (json.error) throw new Error(json.error);
+        return json.result;
+      }
+      const reader = res.body.getReader();
+      const decoder = new TextDecoder('utf-8');
+      let buffer = '';
+      let result: unknown;
+      let done = false;
+      while (!done) {
+        const { value, done: rdone } = await reader.read();
+        if (rdone) break;
+        buffer += decoder.decode(value, { stream: true });
+        let nl: number;
+        while ((nl = buffer.indexOf('\n')) !== -1) {
+          const line = buffer.slice(0, nl).replace(/\r$/, '');
+          buffer = buffer.slice(nl + 1);
+          if (!line.startsWith('data:')) continue;
+          const data = line.slice(5).trimStart();
+          if (!data) continue;
+          let frame: { type?: string; result?: unknown; error?: string };
+          try {
+            frame = JSON.parse(data) as typeof frame;
+          } catch {
+            continue;
+          }
+          if (frame.type === '__result__') {
+            result = frame.result;
+            done = true;
+            break;
+          }
+          if (frame.type === '__error__') {
+            throw new Error(frame.error ?? `request ${name} failed`);
+          }
+          onFrame(frame);
+        }
+      }
+      return result;
+    },
+
     getDoc<T extends DBObject>(collection: string, id: string): Promise<T | null> {
       return rpc('request', { name: 'storeGetDoc', input: { collection, id } }).then(
         (r) => (r as { item: T | null }).item,