vgxness 1.20.5 → 1.20.7

package/dist/interfaces/cli/commands/run-permission-dispatcher.js

@@ -0,0 +1,460 @@
+import { AgentRegistryService } from '../../../agents/agent-registry-service.js';
+import { evaluatePermission } from '../../../permissions/policy-evaluator.js';
+import { RunService } from '../../../runs/run-service.js';
+import { RunSnapshotExportService } from '../../../runs/run-snapshot-export-service.js';
+import { grantEvaluationPayload } from '../../../runs/task-scoped-command-grant-service.js';
+import { csvFlag, finalRunStatusFlag, jsonFlag, optionalRunStatusFlag, optionalStringFlag, optionalTaskGrantStatusFlag, permissionCategoryFlag, requiredFlag, requiredPositiveIntegerFlag, retryPolicyFlag, runOutcomeFlag, taskGrantCategoryFlag, taskGrantExpirationFlag, } from '../cli-flags.js';
+import { usageFailure } from '../cli-help.js';
+import { isJsonObject, jsonResult, resultFailure, writeJsonFile } from '../cli-helpers.js';
+function listCliApprovals(service, runId) {
+    const details = [];
+    if (runId === undefined) {
+        const runs = service.listRuns({});
+        if (!runs.ok)
+            return runs;
+        details.push(...runs.value.map((run) => service.getRun(run.id)));
+    }
+    else {
+        details.push(service.getRun(runId));
+    }
+    const values = [];
+    for (const detail of details) {
+        if (!detail.ok)
+            return detail;
+        for (const approval of detail.value.approvals) {
+            const decisionEvent = detail.value.events.find((event) => event.id === approval.decisionEventId);
+            values.push({
+                id: approval.id,
+                runId: approval.runId,
+                status: approval.status,
+                requestedAt: approval.requestedAt,
+                resolvedAt: approval.resolvedAt ?? null,
+                resolvedBy: approval.resolvedBy ?? null,
+                resolutionReason: approval.resolutionReason ?? null,
+                decisionEventId: approval.decisionEventId,
+                operation: decisionEvent === undefined || !isJsonObject(decisionEvent.payload)
+                    ? null
+                    : {
+                        category: decisionEvent.payload.category ?? null,
+                        name: decisionEvent.payload.operation ?? null,
+                        requestedOperation: decisionEvent.payload.requestedOperation ?? null,
+                        agent: decisionEvent.payload.agent ?? null,
+                    },
+            });
+        }
+    }
+    return { ok: true, value: values };
+}
+function runRunInsightCommand(command, parsed, service) {
+    const id = requiredFlag(parsed.flags, 'id');
+    if (!id.ok)
+        return resultFailure(id);
+    if (command === 'resume-inspect')
+        return jsonResult(service.getRunOperatorResumePlan(id.value));
+    const insights = service.getRunInsights(id.value);
+    if (!insights.ok)
+        return resultFailure(insights);
+    if (command === 'timeline')
+        return jsonResult({ ok: true, value: insights.value.timeline });
+    if (command === 'debug')
+        return jsonResult({ ok: true, value: insights.value.debug });
+    return jsonResult({ ok: true, value: insights.value.resumePlan });
+}
+function permissionRequestFromFlags(parsed, database, environment) {
+    const category = permissionCategoryFlag(parsed.flags, 'category');
+    const operation = requiredFlag(parsed.flags, 'operation');
+    if (!category.ok)
+        return category;
+    if (!operation.ok)
+        return operation;
+    const request = {
+        category: category.value,
+        operation: operation.value,
+        workspaceRoot: optionalStringFlag(parsed.flags, 'workspace') ?? environment.cwd,
+    };
+    const targetPath = optionalStringFlag(parsed.flags, 'path');
+    if (targetPath !== undefined)
+        request.targetPath = targetPath;
+    const providerToolName = optionalStringFlag(parsed.flags, 'provider-tool');
+    if (providerToolName !== undefined)
+        request.providerToolName = providerToolName;
+    if (parsed.flags.destructive === true)
+        request.destructive = true;
+    if (parsed.flags.external === true)
+        request.external = true;
+    if (parsed.flags.privileged === true)
+        request.privileged = true;
+    if (parsed.flags.ambiguous === true)
+        request.ambiguous = true;
+    const agentId = optionalStringFlag(parsed.flags, 'agent-id');
+    if (agentId !== undefined) {
+        const agent = new AgentRegistryService(database).getAgent(agentId);
+        if (!agent.ok)
+            return agent;
+        request.agent = agent.value;
+    }
+    return { ok: true, value: request };
+}
+function rejectExecutableGrantFlags(parsed) {
+    if (parsed.flags.executable !== undefined || parsed.flags.argv !== undefined)
+        return {
+            ok: false,
+            error: { code: 'validation_failed', message: 'Task grants accept --command-id only; arbitrary executable/argv inputs are not supported' },
+        };
+    return { ok: true, value: undefined };
+}
+function taskGrantExternalRoots(parsed) {
+    const roots = [...csvFlag(parsed.flags, 'external-roots')];
+    const root = optionalStringFlag(parsed.flags, 'external-root');
+    if (root !== undefined)
+        roots.unshift(root);
+    return roots.length > 0
+        ? { ok: true, value: roots }
+        : { ok: false, error: { code: 'validation_failed', message: 'Missing required --external-root or --external-roots' } };
+}
+function runTaskGrantCommand(command, parsed, service) {
+    const grantService = service.taskScopedCommandGrantService();
+    const executableFlags = rejectExecutableGrantFlags(parsed);
+    if (!executableFlags.ok)
+        return resultFailure(executableFlags);
+    if (command === 'task-grant-create') {
+        const runId = requiredFlag(parsed.flags, 'run-id');
+        const agentId = requiredFlag(parsed.flags, 'agent-id');
+        const taskFingerprint = requiredFlag(parsed.flags, 'task-fingerprint');
+        const category = taskGrantCategoryFlag(parsed.flags, 'category');
+        const commandId = requiredFlag(parsed.flags, 'command-id');
+        const maxUses = requiredPositiveIntegerFlag(parsed.flags, 'max-uses');
+        const expiresAt = taskGrantExpirationFlag(parsed.flags);
+        const createdById = requiredFlag(parsed.flags, 'created-by-id');
+        const creationReason = requiredFlag(parsed.flags, 'creation-reason');
+        const approvedScopeSummary = requiredFlag(parsed.flags, 'approved-scope-summary');
+        const externalRoots = taskGrantExternalRoots(parsed);
+        if (!runId.ok)
+            return resultFailure(runId);
+        if (!agentId.ok)
+            return resultFailure(agentId);
+        if (!taskFingerprint.ok)
+            return resultFailure(taskFingerprint);
+        if (!category.ok)
+            return resultFailure(category);
+        if (!commandId.ok)
+            return resultFailure(commandId);
+        if (!maxUses.ok)
+            return resultFailure(maxUses);
+        if (!expiresAt.ok)
+            return resultFailure(expiresAt);
+        if (!createdById.ok)
+            return resultFailure(createdById);
+        if (!creationReason.ok)
+            return resultFailure(creationReason);
+        if (!approvedScopeSummary.ok)
+            return resultFailure(approvedScopeSummary);
+        if (!externalRoots.ok)
+            return resultFailure(externalRoots);
+        const createdByName = optionalStringFlag(parsed.flags, 'created-by-name');
+        const cwdPatterns = csvFlag(parsed.flags, 'cwd-patterns');
+        return jsonResult(grantService.create({
+            runId: runId.value,
+            agentId: agentId.value,
+            taskFingerprint: taskFingerprint.value,
+            categories: [category.value],
+            externalRoots: externalRoots.value,
+            ...(cwdPatterns.length === 0 ? {} : { cwdPatterns }),
+            commandPolicy: { kind: 'allowlisted-command-ids', ids: [commandId.value] },
+            expiresAt: expiresAt.value,
+            maxUses: maxUses.value,
+            createdBy: { type: 'human', id: createdById.value, ...(createdByName === undefined ? {} : { displayName: createdByName }) },
+            audit: { creationReason: creationReason.value, approvedScopeSummary: approvedScopeSummary.value },
+        }));
+    }
+    if (command === 'task-grant-list') {
+        const runId = requiredFlag(parsed.flags, 'run-id');
+        const status = optionalTaskGrantStatusFlag(parsed.flags, 'status');
+        const limit = parsed.flags.limit === undefined ? { ok: true, value: undefined } : requiredPositiveIntegerFlag(parsed.flags, 'limit');
+        if (!runId.ok)
+            return resultFailure(runId);
+        if (!status.ok)
+            return resultFailure(status);
+        if (!limit.ok)
+            return resultFailure(limit);
+        const agentId = optionalStringFlag(parsed.flags, 'agent-id');
+        return jsonResult(grantService.list({
+            runId: runId.value,
+            ...(agentId === undefined ? {} : { agentId }),
+            ...(status.value === undefined ? {} : { status: status.value }),
+            ...(limit.value === undefined ? {} : { limit: limit.value }),
+        }));
+    }
+    if (command === 'task-grant-get') {
+        const grantId = requiredFlag(parsed.flags, 'grant-id');
+        return grantId.ok ? jsonResult(grantService.get(grantId.value)) : resultFailure(grantId);
+    }
+    if (command === 'task-grant-revoke') {
+        const grantId = requiredFlag(parsed.flags, 'grant-id');
+        const actorId = requiredFlag(parsed.flags, 'actor-id');
+        const reason = requiredFlag(parsed.flags, 'reason');
+        const actorType = optionalStringFlag(parsed.flags, 'actor-type') ?? 'human';
+        if (!grantId.ok)
+            return resultFailure(grantId);
+        if (!actorId.ok)
+            return resultFailure(actorId);
+        if (!reason.ok)
+            return resultFailure(reason);
+        if (actorType !== 'human' && actorType !== 'system')
+            return resultFailure({ ok: false, error: { code: 'validation_failed', message: '--actor-type must be human or system' } });
+        const actorName = optionalStringFlag(parsed.flags, 'actor-name');
+        return jsonResult(grantService.revoke({
+            grantId: grantId.value,
+            actor: { type: actorType, id: actorId.value, ...(actorName === undefined ? {} : { displayName: actorName }) },
+            reason: reason.value,
+        }));
+    }
+    if (command === 'task-grant-preview') {
+        const runId = requiredFlag(parsed.flags, 'run-id');
+        const agentId = requiredFlag(parsed.flags, 'agent-id');
+        const taskFingerprint = requiredFlag(parsed.flags, 'task-fingerprint');
+        const category = taskGrantCategoryFlag(parsed.flags, 'category');
+        const commandId = requiredFlag(parsed.flags, 'command-id');
+        const workspaceRoot = requiredFlag(parsed.flags, 'workspace-root');
+        const cwd = requiredFlag(parsed.flags, 'cwd');
+        if (!runId.ok)
+            return resultFailure(runId);
+        if (!agentId.ok)
+            return resultFailure(agentId);
+        if (!taskFingerprint.ok)
+            return resultFailure(taskFingerprint);
+        if (!category.ok)
+            return resultFailure(category);
+        if (!commandId.ok)
+            return resultFailure(commandId);
+        if (!workspaceRoot.ok)
+            return resultFailure(workspaceRoot);
+        if (!cwd.ok)
+            return resultFailure(cwd);
+        const operation = optionalStringFlag(parsed.flags, 'operation') ?? `command-allowlist:${commandId.value}`;
+        const targetPaths = csvFlag(parsed.flags, 'target-paths');
+        const preview = grantService.previewMatch({
+            runId: runId.value,
+            agentId: agentId.value,
+            taskFingerprint: taskFingerprint.value,
+            category: category.value,
+            commandId: commandId.value,
+            operation,
+            workspaceRoot: workspaceRoot.value,
+            cwd: cwd.value,
+            ...(targetPaths.length === 0 ? {} : { targetPaths }),
+        });
+        return preview.ok ? jsonResult({ ok: true, value: grantEvaluationPayload(preview.value) }) : resultFailure(preview);
+    }
+    return usageFailure(`Unknown runs command: ${command}`);
+}
+export function runRunsCommand(command, parsed, database, environment) {
+    const service = new RunService(database);
+    if (command.startsWith('task-grant-'))
+        return runTaskGrantCommand(command, parsed, service);
+    if (command === 'timeline' || command === 'debug' || command === 'resume-plan' || command === 'resume-inspect')
+        return runRunInsightCommand(command, parsed, service);
+    if (command === 'create') {
+        const project = requiredFlag(parsed.flags, 'project');
+        const userIntent = requiredFlag(parsed.flags, 'intent');
+        const workflow = requiredFlag(parsed.flags, 'workflow');
+        const phase = requiredFlag(parsed.flags, 'phase');
+        const selectedAgentId = requiredFlag(parsed.flags, 'agent-id');
+        const providerAdapter = requiredFlag(parsed.flags, 'provider-adapter');
+        const model = requiredFlag(parsed.flags, 'model');
+        if (!project.ok)
+            return resultFailure(project);
+        if (!userIntent.ok)
+            return resultFailure(userIntent);
+        if (!workflow.ok)
+            return resultFailure(workflow);
+        if (!phase.ok)
+            return resultFailure(phase);
+        if (!selectedAgentId.ok)
+            return resultFailure(selectedAgentId);
+        if (!providerAdapter.ok)
+            return resultFailure(providerAdapter);
+        if (!model.ok)
+            return resultFailure(model);
+        return jsonResult(service.createRun({
+            project: project.value,
+            userIntent: userIntent.value,
+            workflow: workflow.value,
+            phase: phase.value,
+            selectedAgentId: selectedAgentId.value,
+            providerAdapter: providerAdapter.value,
+            model: model.value,
+        }));
+    }
+    if (command === 'list') {
+        const status = optionalRunStatusFlag(parsed.flags, 'status');
+        if (!status.ok)
+            return resultFailure(status);
+        const filters = {};
+        const project = optionalStringFlag(parsed.flags, 'project');
+        if (project !== undefined)
+            filters.project = project;
+        if (status.value !== undefined)
+            filters.status = status.value;
+        return jsonResult(service.listRuns(filters));
+    }
+    if (command === 'get') {
+        const id = requiredFlag(parsed.flags, 'id');
+        return id.ok ? jsonResult(service.getRun(id.value)) : resultFailure(id);
+    }
+    if (command === 'export-snapshot') {
+        const project = requiredFlag(parsed.flags, 'project');
+        const runId = requiredFlag(parsed.flags, 'run-id');
+        if (!project.ok)
+            return resultFailure(project);
+        if (!runId.ok)
+            return resultFailure(runId);
+        const exported = new RunSnapshotExportService(service).exportSnapshot({ project: project.value, runId: runId.value });
+        if (!exported.ok)
+            return resultFailure(exported);
+        const file = optionalStringFlag(parsed.flags, 'file');
+        if (file !== undefined) {
+            const written = writeJsonFile(file, exported.value, environment);
+            if (!written.ok)
+                return resultFailure(written);
+        }
+        return jsonResult(exported);
+    }
+    if (command === 'checkpoint') {
+        const runId = requiredFlag(parsed.flags, 'run-id');
+        const label = requiredFlag(parsed.flags, 'label');
+        const state = jsonFlag(parsed.flags, 'state', {});
+        if (!runId.ok)
+            return resultFailure(runId);
+        if (!label.ok)
+            return resultFailure(label);
+        if (!state.ok)
+            return resultFailure(state);
+        return jsonResult(service.appendCheckpoint({ runId: runId.value, label: label.value, state: state.value }));
+    }
+    if (command === 'finish') {
+        const runId = requiredFlag(parsed.flags, 'run-id');
+        const status = finalRunStatusFlag(parsed.flags, 'status');
+        const outcome = runOutcomeFlag(parsed.flags, 'outcome');
+        if (!runId.ok)
+            return resultFailure(runId);
+        if (!status.ok)
+            return resultFailure(status);
+        if (!outcome.ok)
+            return resultFailure(outcome);
+        const reason = optionalStringFlag(parsed.flags, 'reason');
+        return jsonResult(service.updateFinalStatus({
+            runId: runId.value,
+            status: status.value,
+            outcome: outcome.value,
+            ...(reason !== undefined ? { outcomeReason: reason } : {}),
+        }));
+    }
+    if (command === 'permission-check') {
+        const request = permissionRequestFromFlags(parsed, database, environment);
+        if (!request.ok)
+            return resultFailure(request);
+        const runId = requiredFlag(parsed.flags, 'run-id');
+        if (!runId.ok)
+            return resultFailure(runId);
+        return jsonResult(service.evaluatePermissionForRun({ ...request.value, runId: runId.value }));
+    }
+    if (command === 'preflight') {
+        const request = permissionRequestFromFlags(parsed, database, environment);
+        if (!request.ok)
+            return resultFailure(request);
+        const runId = requiredFlag(parsed.flags, 'run-id');
+        if (!runId.ok)
+            return resultFailure(runId);
+        const run = service.getRun(runId.value);
+        const runMetadata = run.ok ? { phase: run.value.phase, agentId: run.value.selectedAgentId } : {};
+        return jsonResult(service.preflightOperation({ ...runMetadata, ...request.value, runId: runId.value }));
+    }
+    if (command === 'approvals') {
+        const runId = requiredFlag(parsed.flags, 'run');
+        return runId.ok ? jsonResult(service.listApprovals(runId.value)) : resultFailure(runId);
+    }
+    if (command === 'retry-check') {
+        const approvalId = requiredFlag(parsed.flags, 'approval');
+        if (!approvalId.ok)
+            return resultFailure(approvalId);
+        const policy = retryPolicyFlag(parsed.flags);
+        if (!policy.ok)
+            return resultFailure(policy);
+        const approval = service.getApproval(approvalId.value);
+        if (!approval.ok)
+            return resultFailure(approval);
+        const retry = service.evaluateOperationRetry(policy.value === undefined ? { approvalId: approvalId.value } : { approvalId: approvalId.value, policy: policy.value });
+        if (!retry.ok)
+            return resultFailure(retry);
+        return jsonResult({
+            ok: true,
+            value: {
+                approvalId: approval.value.id,
+                runId: approval.value.runId,
+                decision: retry.value.allowed ? 'allowed' : 'blocked',
+                allowed: retry.value.allowed,
+                reasonCode: retry.value.reasonCode,
+                reason: retry.value.reason,
+                policy: retry.value.policy,
+                retryableStatuses: retry.value.retryableStatuses,
+                evaluatedAttemptCount: retry.value.evaluatedAttemptCount,
+                ...(retry.value.latestAttempt === undefined ? {} : { latestAttempt: retry.value.latestAttempt }),
+                ...(retry.value.activeAttempt === undefined ? {} : { activeAttempt: retry.value.activeAttempt }),
+                executorInvoked: false,
+                operationExecuted: false,
+            },
+        });
+    }
+    if (command === 'resume-gate') {
+        const approvalId = requiredFlag(parsed.flags, 'approval');
+        if (!approvalId.ok)
+            return resultFailure(approvalId);
+        const policy = retryPolicyFlag(parsed.flags);
+        if (!policy.ok)
+            return resultFailure(policy);
+        return jsonResult(service.getRunResumeOrchestrationPlan(policy.value === undefined ? { approvalId: approvalId.value } : { approvalId: approvalId.value, policy: policy.value }));
+    }
+    if (command === 'approve' || command === 'reject' || command === 'cancel-approval') {
+        const approvalId = requiredFlag(parsed.flags, 'approval');
+        const actor = requiredFlag(parsed.flags, 'actor');
+        if (!approvalId.ok)
+            return resultFailure(approvalId);
+        if (!actor.ok)
+            return resultFailure(actor);
+        const reason = optionalStringFlag(parsed.flags, 'reason');
+        const status = command === 'approve' ? 'approved' : command === 'reject' ? 'rejected' : 'cancelled';
+        return jsonResult(service.resolveApproval({ approvalId: approvalId.value, status, actor: actor.value, ...(reason !== undefined ? { reason } : {}) }));
+    }
+    return usageFailure(`Unknown runs command: ${command}`);
+}
+export function runApprovalsCommand(command, parsed, database) {
+    const service = new RunService(database);
+    if (command === 'list') {
+        const runId = optionalStringFlag(parsed.flags, 'run-id');
+        const approvals = listCliApprovals(service, runId);
+        return approvals.ok ? jsonResult({ ok: true, value: approvals.value }) : resultFailure(approvals);
+    }
+    if (command === 'approve' || command === 'reject') {
+        const id = requiredFlag(parsed.flags, 'id');
+        if (!id.ok)
+            return resultFailure(id);
+        const reason = optionalStringFlag(parsed.flags, 'reason');
+        const resolved = service.resolveApproval({
+            approvalId: id.value,
+            status: command === 'approve' ? 'approved' : 'rejected',
+            actor: 'cli',
+            ...(reason === undefined ? {} : { reason }),
+        });
+        return jsonResult(resolved);
+    }
+    return usageFailure(`Unknown approvals command: ${command}`);
+}
+export function runPermissionsCommand(command, parsed, database, environment) {
+    if (command !== 'check')
+        return usageFailure(`Unknown permissions command: ${command}`);
+    const request = permissionRequestFromFlags(parsed, database, environment);
+    return request.ok ? jsonResult({ ok: true, value: evaluatePermission(request.value) }) : resultFailure(request);
+}
+// Re-export helpers for external use
+export { listCliApprovals, permissionRequestFromFlags, runRunInsightCommand };