vaan-ai 0.1.0

package/dist/src/observability/request.js

@@ -0,0 +1,20 @@
+// A request is one complete agent flow: what the user asked, through to the
+// answer. Everything the runtime does carries this id, which is the only thing
+// that makes a trace reconstructable after the fact.
+import { randomUUID } from "node:crypto";
+export function newRequest(input, model, workspace) {
+    return {
+        id: randomUUID(),
+        input,
+        model,
+        workspace,
+        startedAt: Date.now(),
+        at: new Date().toISOString(),
+    };
+}
+/** Enough of an id to say out loud, and to disambiguate in `vaan trace`. */
+export const shortId = (id) => id.slice(0, 8);
+export const elapsedMs = (ctx) => Date.now() - ctx.startedAt;
+/** Accepts a full uuid or any unambiguous prefix, which is what people type. */
+export const idMatches = (id, query) => id === query || id.startsWith(query.toLowerCase());
+//# sourceMappingURL=request.js.map

package/dist/src/observability/request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../../../src/observability/request.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,+EAA+E;AAC/E,qDAAqD;AAErD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAazC,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,KAAa,EAAE,SAAiB;IACxE,OAAO;QACL,EAAE,EAAE,UAAU,EAAE;QAChB,KAAK;QACL,KAAK;QACL,SAAS;QACT,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC7B,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAE9D,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAmB,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC;AAErF,gFAAgF;AAChF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,EAAU,EAAE,KAAa,EAAW,EAAE,CAC9D,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC"}

package/dist/src/observability/trace.js

@@ -0,0 +1,149 @@
+// The recorder, and the reader behind `vaan trace`.
+//
+// One JSON file per request in .vaan/traces. A file rather than a shared log
+// because requests can overlap — a scheduled run while you're typing — and
+// interleaved appends from two writers is how a log file becomes unparseable.
+//
+// Nothing here throws. A trace that can't be written is a missing trace, not a
+// failed request; observability that can take the agent down with it is worse
+// than no observability.
+import { mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { describeEvent, redactEvent } from "./events.js";
+import { elapsedMs, idMatches } from "./request.js";
+/** Traces past this many are pruned oldest-first, so .vaan never grows forever. */
+const KEEP = 200;
+export function openTrace(opts) {
+    const collected = [];
+    const { request } = opts;
+    let closed = false;
+    const record = (event) => {
+        collected.push({
+            ...redactEvent(event),
+            at: new Date().toISOString(),
+            ms: elapsedMs(request),
+        });
+    };
+    record({
+        kind: "request",
+        input: request.input,
+        model: request.model,
+        workspace: request.workspace,
+    });
+    return {
+        id: request.id,
+        request,
+        record,
+        events: () => [...collected],
+        finish(ok, summary) {
+            if (!closed) {
+                closed = true;
+                record({ kind: "result", ok, summary });
+            }
+            const stored = {
+                id: request.id,
+                at: request.at,
+                input: collected[0]?.kind === "request" ? collected[0].input : request.input,
+                model: request.model,
+                workspace: request.workspace,
+                durationMs: elapsedMs(request),
+                ok,
+                summary,
+                events: collected,
+            };
+            if (opts.persist !== false)
+                write(opts.home, stored);
+            return stored;
+        },
+    };
+}
+/** A trace that records nothing, for tests and for `--no-trace`. */
+export const noTrace = (request) => ({
+    id: request.id,
+    request,
+    record() { },
+    events: () => [],
+    finish: (ok, summary) => ({
+        id: request.id,
+        at: request.at,
+        input: request.input,
+        model: request.model,
+        workspace: request.workspace,
+        durationMs: elapsedMs(request),
+        ok,
+        summary,
+        events: [],
+    }),
+});
+const dirOf = (home) => join(home, "traces");
+function write(home, trace) {
+    try {
+        const dir = dirOf(home);
+        mkdirSync(dir, { recursive: true });
+        // Timestamp first so a lexical sort is a chronological sort, which is what
+        // both the pruner and the listing rely on.
+        const stamp = trace.at.replace(/[:.]/g, "-");
+        writeFileSync(join(dir, `${stamp}__${trace.id}.json`), JSON.stringify(trace, null, 2), "utf8");
+        prune(dir);
+    }
+    catch {
+        // A trace is a record of work, not the work.
+    }
+}
+function prune(dir) {
+    try {
+        const files = readdirSync(dir)
+            .filter((name) => name.endsWith(".json"))
+            .sort();
+        for (const name of files.slice(0, Math.max(0, files.length - KEEP))) {
+            rmSync(join(dir, name), { force: true });
+        }
+    }
+    catch {
+        // Nothing to prune, or nothing we may prune.
+    }
+}
+/** Newest first. Reads only what `vaan trace` prints, not every event. */
+export function listTraces(home, limit = 20) {
+    try {
+        return readdirSync(dirOf(home))
+            .filter((name) => name.endsWith(".json"))
+            .sort()
+            .reverse()
+            .slice(0, limit)
+            .map((name) => parse(join(dirOf(home), name)))
+            .filter((trace) => trace !== undefined);
+    }
+    catch {
+        return [];
+    }
+}
+/** Look one up by full id or by any prefix, which is what people type. */
+export function readTrace(home, query) {
+    try {
+        const match = readdirSync(dirOf(home))
+            .filter((name) => name.endsWith(".json"))
+            .sort()
+            .reverse()
+            .find((name) => idMatches(name.split("__")[1]?.replace(/\.json$/, "") ?? "", query));
+        return match ? parse(join(dirOf(home), match)) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function parse(path) {
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        return isTrace(parsed) ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+const isTrace = (value) => typeof value === "object" &&
+    value !== null &&
+    typeof value.id === "string" &&
+    Array.isArray(value.events);
+export { describeEvent };
+//# sourceMappingURL=trace.js.map

package/dist/src/observability/trace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace.js","sourceRoot":"","sources":["../../../src/observability/trace.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,yBAAyB;AAEzB,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAuC,MAAM,aAAa,CAAC;AAC9F,OAAO,EAAE,SAAS,EAAE,SAAS,EAAuB,MAAM,cAAc,CAAC;AAEzE,mFAAmF;AACnF,MAAM,IAAI,GAAG,GAAG,CAAC;AA+BjB,MAAM,UAAU,SAAS,CAAC,IAAkB;IAC1C,MAAM,SAAS,GAAoB,EAAE,CAAC;IACtC,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzB,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,MAAM,MAAM,GAAG,CAAC,KAAiB,EAAQ,EAAE;QACzC,SAAS,CAAC,IAAI,CAAC;YACb,GAAG,WAAW,CAAC,KAAK,CAAC;YACrB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,EAAE,EAAE,SAAS,CAAC,OAAO,CAAC;SACN,CAAC,CAAC;IACtB,CAAC,CAAC;IAEF,MAAM,CAAC;QACL,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IAEH,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,OAAO;QACP,MAAM;QACN,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC;QAC5B,MAAM,CAAC,EAAE,EAAE,OAAO;YAChB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,GAAG,IAAI,CAAC;gBACd,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,MAAM,GAAgB;gBAC1B,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK;gBAC5E,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,SAAS,CAAC,OAAO,CAAC;gBAC9B,EAAE;gBACF,OAAO;gBACP,MAAM,EAAE,SAAS;aAClB,CAAC;YACF,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACrD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,OAAuB,EAAS,EAAE,CAAC,CAAC;IAC1D,EAAE,EAAE,OAAO,CAAC,EAAE;IACd,OAAO;IACP,MAAM,KAAI,CAAC;IACX,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE;IAChB,MAAM,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QACxB,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,SAAS,CAAC,OAAO,CAAC;QAC9B,EAAE;QACF,OAAO;QACP,MAAM,EAAE,EAAE;KACX,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,KAAK,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAE7D,SAAS,KAAK,CAAC,IAAY,EAAE,KAAkB;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACxB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,2EAA2E;QAC3E,2CAA2C;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC7C,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,KAAK,KAAK,CAAC,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/F,KAAK,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,GAAW;IACxB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC;aAC3B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;aACxC,IAAI,EAAE,CAAC;QACV,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,KAAK,GAAG,EAAE;IACjD,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aAC5B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;aACxC,IAAI,EAAE;aACN,OAAO,EAAE;aACT,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;aACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;aAC7C,MAAM,CAAC,CAAC,KAAK,EAAwB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,KAAa;IACnD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aACnC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;aACxC,IAAI,EAAE;aACN,OAAO,EAAE;aACT,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;QACvF,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,KAAc,EAAwB,EAAE,CACvD,OAAO,KAAK,KAAK,QAAQ;IACzB,KAAK,KAAK,IAAI;IACd,OAAQ,KAAqB,CAAC,EAAE,KAAK,QAAQ;IAC7C,KAAK,CAAC,OAAO,CAAE,KAAqB,CAAC,MAAM,CAAC,CAAC;AAE/C,OAAO,EAAE,aAAa,EAAE,CAAC"}

package/dist/src/paths.js

@@ -0,0 +1,24 @@
+// Every path Vaan writes to, in one place.
+//
+// `.vaan/` sits at the root of the workspace rather than in the home directory,
+// because the interesting state is per-project: this project's memory, this
+// project's traces, this project's skills. Nothing here is shared between
+// workspaces, which is also why nothing here needs a lock.
+import { join } from "node:path";
+export const HOME_DIR = ".vaan";
+/** `<workspace>/.vaan` — the root of everything below. */
+export const home = (workspace) => join(workspace, HOME_DIR);
+export const configDir = (workspace) => join(home(workspace), "config");
+export const memoryDir = (workspace) => join(home(workspace), "memory");
+export const tracesDir = (workspace) => join(home(workspace), "traces");
+export const stateDir = (workspace) => join(home(workspace), "state");
+export const skillsDir = (workspace) => join(home(workspace), "skills");
+export const configFile = (workspace) => join(configDir(workspace), "config.json");
+export const databaseFile = (workspace) => join(memoryDir(workspace), "state.db");
+export const memoryMirror = (workspace) => join(memoryDir(workspace), "MEMORY.md");
+export const inboxFile = (workspace) => join(stateDir(workspace), "inbox.json");
+/** Relative to the workspace, which is what `read_file` wants. */
+export const skillsRelative = join(HOME_DIR, "skills");
+export const SOUL_FILE = "SOUL.md";
+export const GUARDRAILS_FILE = "GUARDRAILS.md";
+//# sourceMappingURL=paths.js.map

package/dist/src/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/paths.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,0EAA0E;AAC1E,2DAA2D;AAE3D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,QAAQ,GAAG,OAAO,CAAC;AAEhC,0DAA0D;AAC1D,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,SAAiB,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,SAAiB,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,SAAiB,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,SAAiB,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,SAAiB,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;AACtF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,SAAiB,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;AAExF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,CAAC;AACnG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,SAAiB,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC;AAClG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,SAAiB,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,CAAC;AACnG,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,SAAiB,EAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC,CAAC;AAEhG,kEAAkE;AAClE,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAEvD,MAAM,CAAC,MAAM,SAAS,GAAG,SAAS,CAAC;AACnC,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC"}

package/dist/src/permissions/approval.js

@@ -0,0 +1,80 @@
+// The gate. Every tool that touches anything comes through here first.
+//
+// The one invariant worth stating plainly: the model cannot approve its own
+// actions. The approver is a function the CLI supplies when the session is
+// built, closed over a readline handle attached to the real terminal. It is
+// never passed to a tool, never named in a prompt, and never reachable from
+// anything the model emits. A tool can ask the gate; only a human can answer.
+export class PermissionDenied extends Error {
+    request;
+    reason;
+    constructor(request, reason) {
+        super(`Not permitted: ${request.capability} on ${request.target} — ${reason}`);
+        this.request = request;
+        this.reason = reason;
+        this.name = "PermissionDenied";
+    }
+}
+/** `--yes`, and the eval runner. Never wired to anything the model controls. */
+export const approveAll = async () => true;
+/** Non-interactive sessions: nobody is there to ask, so the answer is no. */
+export const denyAll = async () => false;
+/** Capabilities whose target fully describes the action, so a yes can be reused. */
+const MEMOABLE = new Set(["execute", "destructive", "network"]);
+export function createGate(opts) {
+    // Approving `npm test` once and then being asked again for the identical
+    // command is the fastest way to teach someone to hold down `y`. Commands and
+    // hosts are memoised by exact target. File writes deliberately are not: the
+    // path is the same on every write, and the content is what changed.
+    const granted = new Set();
+    const memoise = opts.memoise !== false;
+    async function decide(request) {
+        const verdict = opts.policy.check(request);
+        const key = `${request.capability} ${request.target}`;
+        let allowed;
+        let how;
+        if (verdict.decision === "deny") {
+            allowed = false;
+            how = verdict.fixed ? "denied by fixed policy" : "denied by policy";
+        }
+        else if (verdict.decision === "allow") {
+            allowed = true;
+            how = "allowed by policy";
+        }
+        else if (memoise && MEMOABLE.has(request.capability) && granted.has(key)) {
+            allowed = true;
+            how = "approved earlier this session";
+        }
+        else {
+            allowed = await opts.approve(request, verdict.reason);
+            how = allowed ? "approved by user" : "declined by user";
+            if (allowed && memoise && MEMOABLE.has(request.capability))
+                granted.add(key);
+        }
+        opts.trace?.()?.record({
+            kind: "permission",
+            tool: request.tool,
+            capability: request.capability,
+            target: request.target,
+            decision: allowed ? "allow" : "deny",
+            reason: `${verdict.reason} — ${how}`,
+        });
+        return allowed;
+    }
+    return {
+        allowed: decide,
+        async require(request) {
+            if (!(await decide(request))) {
+                throw new PermissionDenied(request, opts.policy.check(request).reason);
+            }
+        },
+    };
+}
+/** A gate that permits everything, for unit tests of things that aren't the gate. */
+export const openGate = {
+    async require() { },
+    async allowed() {
+        return true;
+    },
+};
+//# sourceMappingURL=approval.js.map

package/dist/src/permissions/approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval.js","sourceRoot":"","sources":["../../../src/permissions/approval.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,4EAA4E;AAC5E,4EAA4E;AAC5E,8EAA8E;AAM9E,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAE9B;IACA;IAFX,YACW,OAA0B,EAC1B,MAAc;QAEvB,KAAK,CAAC,kBAAkB,OAAO,CAAC,UAAU,OAAO,OAAO,CAAC,MAAM,MAAM,MAAM,EAAE,CAAC,CAAC;QAHtE,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAQ;QAGvB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAKD,gFAAgF;AAChF,MAAM,CAAC,MAAM,UAAU,GAAa,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC;AAErD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,OAAO,GAAa,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC;AAsBnD,oFAAoF;AACpF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;AAEhE,MAAM,UAAU,UAAU,CAAC,IAAiB;IAC1C,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,oEAAoE;IACpE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC;IAEvC,KAAK,UAAU,MAAM,CAAC,OAA0B;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QAEtD,IAAI,OAAgB,CAAC;QACrB,IAAI,GAAW,CAAC;QAChB,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAChC,OAAO,GAAG,KAAK,CAAC;YAChB,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,kBAAkB,CAAC;QACtE,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACxC,OAAO,GAAG,IAAI,CAAC;YACf,GAAG,GAAG,mBAAmB,CAAC;QAC5B,CAAC;aAAM,IAAI,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3E,OAAO,GAAG,IAAI,CAAC;YACf,GAAG,GAAG,+BAA+B,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACtD,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC;YACxD,IAAI,OAAO,IAAI,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/E,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC;YACrB,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YACpC,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,MAAM,GAAG,EAAE;SACrC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO;QACL,OAAO,EAAE,MAAM;QACf,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,QAAQ,GAAS;IAC5B,KAAK,CAAC,OAAO,KAAI,CAAC;IAClB,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC"}

package/dist/src/permissions/policy.js

@@ -0,0 +1,75 @@
+// The policy: the user's rules, plus the mapping from a concrete action to the
+// capability it needs.
+//
+// Classification is the part that matters. A rule that says "ask before writing
+// outside the workspace" is worth nothing if a path that walks out through a
+// symlink is classified as an ordinary workspace write, so paths are resolved
+// to real paths before anything else looks at them.
+import { realpathSync } from "node:fs";
+import { dirname, isAbsolute, resolve, sep } from "node:path";
+import { ALL_APPROVALS, defaultRules, evaluate, isSensitiveFile, } from "./rules.js";
+export function createPolicy(opts) {
+    const workspace = realpathish(opts.workspace);
+    const rules = opts.rules ?? defaultRules(opts.approvals ?? ALL_APPROVALS);
+    return {
+        workspace,
+        rules,
+        check: (request) => evaluate(rules, request),
+        forPath(tool, path, intent) {
+            const target = isAbsolute(path) ? path : resolve(workspace, path);
+            const real = realpathOfNearest(target);
+            const capability = isSensitiveFile(real)
+                ? "credentials"
+                : within(workspace, real)
+                    ? intent
+                    : "outside";
+            return { tool, capability, target: real };
+        },
+        forUrl(tool, url) {
+            return { tool, capability: "network", target: url };
+        },
+    };
+}
+const within = (root, path) => path === root || path.startsWith(root + sep);
+function realpathish(path) {
+    try {
+        return realpathSync(resolve(path));
+    }
+    catch {
+        return resolve(path);
+    }
+}
+/**
+ * The real path of `target`, or of the deepest ancestor that exists with the
+ * missing tail re-attached.
+ *
+ * A path component that doesn't exist yet can't be a symlink, so the deepest
+ * real ancestor decides where the finished path will land. Without this, "write
+ * a new file" would classify by its own spelling rather than by where its
+ * parent directory actually points.
+ */
+export function realpathOfNearest(target) {
+    const full = resolve(target);
+    let current = full;
+    for (;;) {
+        try {
+            const real = realpathSync(current);
+            return current === full ? real : real + full.slice(current.length);
+        }
+        catch {
+            const parent = dirname(current);
+            if (parent === current)
+                return full;
+            current = parent;
+        }
+    }
+}
+/** What `vaan doctor` and `/status` print. */
+export function describeRules(rules) {
+    return rules.map((rule) => {
+        const scope = rule.match ? ` ${rule.match}` : "";
+        return `${rule.capability}${scope}`.padEnd(24) + rule.decision;
+    });
+}
+export { defaultRules };
+//# sourceMappingURL=policy.js.map

package/dist/src/permissions/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/permissions/policy.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,uBAAuB;AACvB,EAAE;AACF,gFAAgF;AAChF,6EAA6E;AAC7E,8EAA8E;AAC9E,oDAAoD;AAEpD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EACL,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,eAAe,GAMhB,MAAM,YAAY,CAAC;AAoBpB,MAAM,UAAU,YAAY,CAAC,IAAmB;IAC9C,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC,CAAC;IAE1E,OAAO;QACL,SAAS;QACT,KAAK;QACL,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QAE5C,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM;YACxB,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAClE,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,UAAU,GAAe,eAAe,CAAC,IAAI,CAAC;gBAClD,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC;oBACvB,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,SAAS,CAAC;YAChB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC5C,CAAC;QAED,MAAM,CAAC,IAAI,EAAE,GAAG;YACd,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACtD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,IAAY,EAAW,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;AAErG,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,SAAS,CAAC;QACR,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACnC,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,MAAM,KAAK,OAAO;gBAAE,OAAO,IAAI,CAAC;YACpC,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;IACH,CAAC;AACH,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,GAAG,IAAI,CAAC,UAAU,GAAG,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/dist/src/permissions/rules.js

@@ -0,0 +1,200 @@
+// What an action *is*, and what the rules say about it.
+//
+// Two layers, and the difference is the whole point. `FLOOR` is not
+// configurable: no config file, no onboarding checkbox and no instruction in
+// SOUL.md can turn it off. Everything above it is the user's policy, which the
+// onboarding writes and the user can edit.
+//
+// GUARDRAILS.md asks the model to behave. This decides whether it may.
+/**
+ * Never allowed, whatever the config says.
+ *
+ * These are the cases where a mistake isn't recoverable by saying no next time:
+ * key material that has already been read is already leaked, and a filesystem
+ * that has already been formatted is already gone.
+ */
+export const FLOOR = [
+    {
+        capability: "credentials",
+        decision: "deny",
+        reason: "credential material is never read by the agent",
+    },
+    { capability: "system", decision: "deny", match: "**", reason: "system changes are out of reach" },
+    { capability: "outside", decision: "deny", match: "/etc/**", reason: "system configuration" },
+    { capability: "outside", decision: "deny", match: "/dev/**", reason: "device files" },
+    { capability: "outside", decision: "deny", match: "/proc/**", reason: "kernel interface" },
+];
+/** Files that are never read or written, wherever they sit. */
+export const SENSITIVE_FILES = [
+    /(^|[\\/])\.env(\.|$)/i,
+    /(^|[\\/])\.git[\\/]config$/i,
+    /(^|[\\/])\.npmrc$/i,
+    /(^|[\\/])\.netrc$/i,
+    /(^|[\\/])\.pypirc$/i,
+    /(^|[\\/])id_(rsa|dsa|ecdsa|ed25519)$/i,
+    /(^|[\\/])\.ssh[\\/]/i,
+    /(^|[\\/])\.aws[\\/]/i,
+    /(^|[\\/])\.gnupg[\\/]/i,
+    /(^|[\\/])\.kube[\\/]config$/i,
+    /(^|[\\/])credentials(\.json)?$/i,
+    /(^|[\\/])service-account.*\.json$/i,
+];
+export const isSensitiveFile = (path) => SENSITIVE_FILES.some((pattern) => pattern.test(path));
+export const ALL_APPROVALS = {
+    destructive: true,
+    network: true,
+    credentials: true,
+    outside: true,
+    system: true,
+};
+/**
+ * The starting policy. Reading inside the workspace is free; changing anything
+ * is not. A flag the user cleared downgrades `ask` to `allow` — that is what
+ * the checkbox means — but it can never reach past `FLOOR`.
+ */
+export function defaultRules(flags = ALL_APPROVALS) {
+    const gated = (on) => (on ? "ask" : "allow");
+    return [
+        { capability: "read", decision: "allow", reason: "reading inside the workspace" },
+        { capability: "write", decision: "ask", reason: "changing a file in the workspace" },
+        { capability: "execute", decision: "ask", reason: "running a command in the sandbox" },
+        { capability: "destructive", decision: gated(flags.destructive), reason: "destructive command" },
+        { capability: "network", decision: gated(flags.network), reason: "external network action" },
+        {
+            capability: "credentials",
+            decision: flags.credentials ? "deny" : "ask",
+            reason: "credential access",
+        },
+        {
+            capability: "outside",
+            decision: flags.outside ? "ask" : "allow",
+            reason: "path outside the workspace",
+        },
+        { capability: "system", decision: flags.system ? "deny" : "ask", reason: "system change" },
+    ];
+}
+/**
+ * Glob matching, `*` within a segment and `**` across them. Small on purpose:
+ * a security decision should not depend on a pattern language nobody can hold
+ * in their head.
+ */
+export function matchesGlob(pattern, target) {
+    const normalised = target.replace(/\\/g, "/");
+    const source = pattern.replace(/\\/g, "/");
+    let regex = "";
+    // Scanned rather than built from chained replaces. The chained version got
+    // `**` wrong in a way nothing would have noticed: it compiled to a pattern
+    // that matched nothing, which silently disabled the FLOOR rule denying system
+    // changes. A security decision shouldn't rest on replace ordering.
+    for (let index = 0; index < source.length; index++) {
+        const char = source[index];
+        if (char === "*") {
+            if (source[index + 1] === "*") {
+                // `**/` crosses zero or more directories; a bare `**` matches the rest
+                // of the path, separators included.
+                if (source[index + 2] === "/") {
+                    regex += "(?:.*/)?";
+                    index += 2;
+                }
+                else {
+                    regex += ".*";
+                    index += 1;
+                }
+            }
+            else {
+                regex += "[^/]*";
+            }
+            continue;
+        }
+        if (char === "?") {
+            regex += "[^/]";
+            continue;
+        }
+        regex += char.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    }
+    return new RegExp(`^${regex}$`).test(normalised);
+}
+/** First matching rule wins, floor first. An unmatched capability is denied. */
+export function evaluate(rules, request) {
+    for (const rule of FLOOR) {
+        if (applies(rule, request)) {
+            return { decision: rule.decision, reason: rule.reason ?? "not permitted", fixed: true };
+        }
+    }
+    for (const rule of rules) {
+        if (applies(rule, request)) {
+            return { decision: rule.decision, reason: rule.reason ?? rule.capability, fixed: false };
+        }
+    }
+    return { decision: "deny", reason: `no rule covers ${request.capability}`, fixed: false };
+}
+const applies = (rule, request) => rule.capability === request.capability &&
+    (rule.match === undefined || matchesGlob(rule.match, request.target));
+/** Refused outright: no approval prompt, because there is no good answer to it. */
+const FORBIDDEN = [
+    { pattern: /\bmkfs(\.\w+)?\b/, why: "formats a filesystem" },
+    { pattern: /\bdd\b[^\n]*\bof=\s*\/dev\//, why: "writes directly to a device" },
+    { pattern: /\b(shutdown|reboot|halt|poweroff)\b/, why: "changes machine state" },
+    { pattern: /\brm\s+(-[a-zA-Z]*\s+)*\/(\s|$)/, why: "deletes the filesystem root" },
+    { pattern: /\b(chmod|chown)\s+-R\b[^\n]*\s\/(\s|$)/, why: "rewrites the filesystem root" },
+    { pattern: /\b(curl|wget)\b[^\n]*\|\s*(ba|z|k)?sh\b/, why: "pipes a download into a shell" },
+];
+const DESTRUCTIVE = [
+    { pattern: /\brm\s+-[a-zA-Z]*[rf]/, why: "recursive or forced delete" },
+    { pattern: /\bgit\s+push\b[^\n]*--force/, why: "force push" },
+    { pattern: /\bgit\s+(reset\s+--hard|clean\s+-[a-zA-Z]*[fd])/, why: "discards working-tree changes" },
+    { pattern: /\bgit\s+branch\s+-D\b/, why: "deletes a branch" },
+    { pattern: /\bnpm\s+(publish|unpublish)\b/, why: "publishes a package" },
+    { pattern: /\b(drop|truncate)\s+(table|database)\b/i, why: "drops data" },
+    { pattern: /\bdocker\s+(rm|rmi|system\s+prune)\b/, why: "removes containers or images" },
+    { pattern: /\bkill(all)?\s+-9\b/, why: "force-kills processes" },
+];
+const NETWORKED = [
+    { pattern: /\b(curl|wget|nc|ssh|scp|rsync|ftp)\b/, why: "reaches the network" },
+    { pattern: /\b(npm|pnpm|yarn|bun)\s+(i|install|add|ci|update)\b/, why: "downloads packages" },
+    { pattern: /\b(pip3?|uv|poetry)\s+(install|add|sync)\b/, why: "downloads packages" },
+    {
+        pattern: /\b(go\s+get|cargo\s+(add|install)|gem\s+install|apt-get|apk\s+add|brew\s+install)\b/,
+        why: "downloads packages",
+    },
+    { pattern: /\bgit\s+(push|pull|fetch|clone)\b/, why: "talks to a remote" },
+];
+const PRIVILEGED = [
+    { pattern: /\b(sudo|doas|su)\b/, why: "asks for elevated privileges" },
+    { pattern: /\b(systemctl|launchctl|service)\b/, why: "changes system services" },
+    { pattern: /\b(useradd|userdel|visudo)\b/, why: "changes system users" },
+];
+const CREDENTIAL_READS = [
+    { pattern: /\b(printenv|env)\b(?!\s*\w+=)/, why: "dumps the environment" },
+    { pattern: /\bcat\b[^\n]*\.(env|npmrc|netrc|pypirc)\b/, why: "reads a credential file" },
+    { pattern: /\b(security|keychain|gpg|pass)\s/, why: "reads a credential store" },
+    { pattern: /\baws\s+configure\b/, why: "reads cloud credentials" },
+];
+/**
+ * Read a command line and say what it is. Deliberately over-broad: a false
+ * "this looks destructive" costs one keystroke, a false "this looks harmless"
+ * costs a working tree.
+ */
+export function classifyCommand(command) {
+    const hits = (patterns) => patterns.filter((entry) => entry.pattern.test(command)).map((entry) => entry.why);
+    const forbidden = hits(FORBIDDEN);
+    if (forbidden.length > 0) {
+        return { capability: "destructive", reasons: forbidden, forbidden: true };
+    }
+    const credentials = hits(CREDENTIAL_READS);
+    if (credentials.length > 0) {
+        return { capability: "credentials", reasons: credentials, forbidden: false };
+    }
+    const privileged = hits(PRIVILEGED);
+    if (privileged.length > 0)
+        return { capability: "system", reasons: privileged, forbidden: false };
+    const destructive = hits(DESTRUCTIVE);
+    if (destructive.length > 0) {
+        return { capability: "destructive", reasons: destructive, forbidden: false };
+    }
+    const networked = hits(NETWORKED);
+    if (networked.length > 0)
+        return { capability: "network", reasons: networked, forbidden: false };
+    return { capability: "execute", reasons: [], forbidden: false };
+}
+//# sourceMappingURL=rules.js.map

package/dist/src/permissions/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../../src/permissions/rules.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,EAAE;AACF,oEAAoE;AACpE,6EAA6E;AAC7E,+EAA+E;AAC/E,2CAA2C;AAC3C,EAAE;AACF,uEAAuE;AAkCvE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,KAAK,GAAW;IAC3B;QACE,UAAU,EAAE,aAAa;QACzB,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,gDAAgD;KACzD;IACD,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,iCAAiC,EAAE;IAClG,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,EAAE;IAC7F,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE;IACrF,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,EAAE;CAC3F,CAAC;AAEF,+DAA+D;AAC/D,MAAM,CAAC,MAAM,eAAe,GAAa;IACvC,uBAAuB;IACvB,6BAA6B;IAC7B,oBAAoB;IACpB,oBAAoB;IACpB,qBAAqB;IACrB,uCAAuC;IACvC,sBAAsB;IACtB,sBAAsB;IACtB,wBAAwB;IACxB,8BAA8B;IAC9B,iCAAiC;IACjC,oCAAoC;CACrC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAY,EAAW,EAAE,CACvD,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAWxD,MAAM,CAAC,MAAM,aAAa,GAAkB;IAC1C,WAAW,EAAE,IAAI;IACjB,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,IAAI;IACjB,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,IAAI;CACb,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,QAAuB,aAAa;IAC/D,MAAM,KAAK,GAAG,CAAC,EAAW,EAAY,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAChE,OAAO;QACL,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,8BAA8B,EAAE;QACjF,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE;QACpF,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE;QACtF,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE;QAChG,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE;QAC5F;YACE,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;YAC5C,MAAM,EAAE,mBAAmB;SAC5B;QACD;YACE,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO;YACzC,MAAM,EAAE,4BAA4B;SACrC;QACD,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE;KAC3F,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,MAAc;IACzD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,KAAK,GAAG,EAAE,CAAC;IAEf,2EAA2E;IAC3E,2EAA2E;IAC3E,8EAA8E;IAC9E,mEAAmE;IACnE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAW,CAAC;QACrC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC9B,uEAAuE;gBACvE,oCAAoC;gBACpC,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBAC9B,KAAK,IAAI,UAAU,CAAC;oBACpB,KAAK,IAAI,CAAC,CAAC;gBACb,CAAC;qBAAM,CAAC;oBACN,KAAK,IAAI,IAAI,CAAC;oBACd,KAAK,IAAI,CAAC,CAAC;gBACb,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,KAAK,IAAI,OAAO,CAAC;YACnB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,KAAK,IAAI,MAAM,CAAC;YAChB,SAAS;QACX,CAAC;QACD,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACnD,CAAC;AASD,gFAAgF;AAChF,MAAM,UAAU,QAAQ,CAAC,KAAa,EAAE,OAA0B;IAChE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC1F,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC3F,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,OAAO,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC5F,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,IAAU,EAAE,OAA0B,EAAW,EAAE,CAClE,IAAI,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;IACtC,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;AAUxE,mFAAmF;AACnF,MAAM,SAAS,GAAc;IAC3B,EAAE,OAAO,EAAE,kBAAkB,EAAE,GAAG,EAAE,sBAAsB,EAAE;IAC5D,EAAE,OAAO,EAAE,6BAA6B,EAAE,GAAG,EAAE,6BAA6B,EAAE;IAC9E,EAAE,OAAO,EAAE,qCAAqC,EAAE,GAAG,EAAE,uBAAuB,EAAE;IAChF,EAAE,OAAO,EAAE,iCAAiC,EAAE,GAAG,EAAE,6BAA6B,EAAE;IAClF,EAAE,OAAO,EAAE,wCAAwC,EAAE,GAAG,EAAE,8BAA8B,EAAE;IAC1F,EAAE,OAAO,EAAE,yCAAyC,EAAE,GAAG,EAAE,+BAA+B,EAAE;CAC7F,CAAC;AAEF,MAAM,WAAW,GAAc;IAC7B,EAAE,OAAO,EAAE,uBAAuB,EAAE,GAAG,EAAE,4BAA4B,EAAE;IACvE,EAAE,OAAO,EAAE,6BAA6B,EAAE,GAAG,EAAE,YAAY,EAAE;IAC7D,EAAE,OAAO,EAAE,iDAAiD,EAAE,GAAG,EAAE,+BAA+B,EAAE;IACpG,EAAE,OAAO,EAAE,uBAAuB,EAAE,GAAG,EAAE,kBAAkB,EAAE;IAC7D,EAAE,OAAO,EAAE,+BAA+B,EAAE,GAAG,EAAE,qBAAqB,EAAE;IACxE,EAAE,OAAO,EAAE,yCAAyC,EAAE,GAAG,EAAE,YAAY,EAAE;IACzE,EAAE,OAAO,EAAE,sCAAsC,EAAE,GAAG,EAAE,8BAA8B,EAAE;IACxF,EAAE,OAAO,EAAE,qBAAqB,EAAE,GAAG,EAAE,uBAAuB,EAAE;CACjE,CAAC;AAEF,MAAM,SAAS,GAAc;IAC3B,EAAE,OAAO,EAAE,sCAAsC,EAAE,GAAG,EAAE,qBAAqB,EAAE;IAC/E,EAAE,OAAO,EAAE,qDAAqD,EAAE,GAAG,EAAE,oBAAoB,EAAE;IAC7F,EAAE,OAAO,EAAE,4CAA4C,EAAE,GAAG,EAAE,oBAAoB,EAAE;IACpF;QACE,OAAO,EAAE,qFAAqF;QAC9F,GAAG,EAAE,oBAAoB;KAC1B;IACD,EAAE,OAAO,EAAE,mCAAmC,EAAE,GAAG,EAAE,mBAAmB,EAAE;CAC3E,CAAC;AAEF,MAAM,UAAU,GAAc;IAC5B,EAAE,OAAO,EAAE,oBAAoB,EAAE,GAAG,EAAE,8BAA8B,EAAE;IACtE,EAAE,OAAO,EAAE,mCAAmC,EAAE,GAAG,EAAE,yBAAyB,EAAE;IAChF,EAAE,OAAO,EAAE,8BAA8B,EAAE,GAAG,EAAE,sBAAsB,EAAE;CACzE,CAAC;AAEF,MAAM,gBAAgB,GAAc;IAClC,EAAE,OAAO,EAAE,+BAA+B,EAAE,GAAG,EAAE,uBAAuB,EAAE;IAC1E,EAAE,OAAO,EAAE,2CAA2C,EAAE,GAAG,EAAE,yBAAyB,EAAE;IACxF,EAAE,OAAO,EAAE,kCAAkC,EAAE,GAAG,EAAE,0BAA0B,EAAE;IAChF,EAAE,OAAO,EAAE,qBAAqB,EAAE,GAAG,EAAE,yBAAyB,EAAE;CACnE,CAAC;AAWF;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,IAAI,GAAG,CAAC,QAAmB,EAAY,EAAE,CAC7C,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEpF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC5E,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC3C,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC/E,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IACpC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAElG,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC/E,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAEjG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAClE,CAAC"}