vigthoria-cli 1.13.18 → 1.13.22

package/dist/utils/operator-client.js

@@ -0,0 +1,159 @@
+import { scanOutboundContext } from './secret-policy.js';
+export class OperatorClientError extends Error {
+    category;
+    constructor(message, category) {
+        super(message);
+        this.category = category;
+        this.name = 'OperatorClientError';
+    }
+}
+export class OperatorClient {
+    dependencies;
+    constructor(dependencies) {
+        this.dependencies = dependencies;
+    }
+    formatResponse(data = {}) {
+        if (typeof data.answer === 'string' && data.answer.trim())
+            return data.answer.trim();
+        if (typeof data.result === 'string' && data.result.trim())
+            return data.result.trim();
+        const lines = [];
+        if (data.summary)
+            lines.push(String(data.summary).trim());
+        if (Array.isArray(data.completed_agents) && data.completed_agents.length > 0) {
+            lines.push(`Completed agents: ${data.completed_agents.join(', ')}`);
+        }
+        if (data.details) {
+            const detail = JSON.stringify(data.details, null, 2);
+            if (detail && detail !== '{}')
+                lines.push(detail.length > 12_000 ? `${detail.slice(0, 12_000)}\n\n[Operator output truncated]` : detail);
+        }
+        return lines.filter(Boolean).join('\n\n').trim() || 'Operator workflow completed.';
+    }
+    async run(input) {
+        const errors = [];
+        for (const baseUrl of this.dependencies.getBaseUrls()) {
+            const controller = new AbortController();
+            const timeoutId = input.timeoutMs > 0 ? setTimeout(() => controller.abort(), input.timeoutMs) : null;
+            try {
+                const context = input.executionContext;
+                const body = scanOutboundContext({
+                    prompt: input.message,
+                    task: input.message,
+                    raw_prompt: context.rawPrompt || null,
+                    model: input.requestedModel,
+                    preferred_model: input.resolvedModel,
+                    context_id: context.contextId,
+                    trace_id: context.traceId,
+                    mcp_context_id: context.mcpContextId || null,
+                    context: {
+                        workspace: { path: input.workspaceAlias },
+                        workspace_path: input.workspaceAlias,
+                        workspace_summary: input.workspaceSummary,
+                        model: input.resolvedModel,
+                        history: context.history || [],
+                        executionSurface: context.executionSurface || 'cli',
+                        clientSurface: context.clientSurface || 'cli',
+                        contextId: context.contextId,
+                        traceId: context.traceId,
+                        mcpContextId: context.mcpContextId || null,
+                        mcp_context_id: context.mcpContextId || null,
+                        rawPrompt: context.rawPrompt || null,
+                        requestStartedAt: context.requestStartedAt,
+                        vigthoriaBrain: context.vigthoriaBrain || null,
+                        vigthoria_brain: context.vigthoriaBrain || null,
+                    },
+                    workflow_type: context.workflowType || 'full',
+                    options: { stream: true, save_to_vigflow: context.savePlanToVigFlow === true },
+                }).value;
+                const token = this.dependencies.getAuthToken();
+                const response = await this.dependencies.fetch(`${baseUrl}/api/operator/stream`, {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json', Accept: 'text/event-stream',
+                        ...(context.mcpContextId ? { 'X-MCP-Context-Id': String(context.mcpContextId) } : {}),
+                        ...(token ? { Authorization: `Bearer ${token}`, Cookie: `vigthoria-auth-token=${token}` } : {}),
+                    },
+                    body: JSON.stringify(body), signal: controller.signal,
+                });
+                if (!response.ok) {
+                    const detail = await response.text().catch(() => '');
+                    throw new Error(`Operator stream ${response.status}: ${this.dependencies.sanitizeError(detail).slice(0, 200)}`);
+                }
+                const contentType = response.headers.get('content-type')?.toLowerCase() || '';
+                const isEventStream = contentType.includes('text/event-stream');
+                if (!isEventStream || !response.body || typeof response.body.getReader !== 'function') {
+                    const payload = await response.json();
+                    const contextId = payload.context_id || response.headers.get('x-context-id') || context.contextId || null;
+                    const mcpContextId = payload.mcp_context_id || response.headers.get('x-mcp-context-id') || context.mcpContextId || null;
+                    return { content: this.formatResponse(payload), workflowId: payload.workflow_id || null, contextId, backendUrl: baseUrl,
+                        savedWorkflow: payload.saved_workflow || null, metadata: { source: 'operator', mode: 'operator', contextId, mcpContextId } };
+                }
+                const reader = response.body.getReader();
+                const decoder = new TextDecoder();
+                let buffer = '';
+                let workflowId = null;
+                let contextId = response.headers.get('x-context-id') || context.contextId || null;
+                let mcpContextId = response.headers.get('x-mcp-context-id') || context.mcpContextId || null;
+                let result = null;
+                let savedWorkflow = null;
+                while (true) {
+                    const { done, value } = await reader.read();
+                    if (done)
+                        break;
+                    buffer += decoder.decode(value, { stream: true });
+                    const chunks = buffer.split('\n\n');
+                    buffer = chunks.pop() || '';
+                    for (const chunk of chunks) {
+                        let eventName = 'message';
+                        const dataLines = [];
+                        for (const line of chunk.split('\n')) {
+                            if (line.startsWith('event:'))
+                                eventName = line.slice(6).trim();
+                            else if (line.startsWith('data:'))
+                                dataLines.push(line.slice(5).trim());
+                        }
+                        if (dataLines.length === 0)
+                            continue;
+                        let payload;
+                        try {
+                            payload = JSON.parse(dataLines.join('\n'));
+                        }
+                        catch {
+                            payload = { raw: dataLines.join('\n') };
+                        }
+                        if (payload.workflow_id && !workflowId)
+                            workflowId = payload.workflow_id;
+                        if (!contextId && typeof payload.context_id === 'string' && payload.context_id.trim())
+                            contextId = payload.context_id.trim();
+                        if (!mcpContextId && typeof payload.mcp_context_id === 'string' && payload.mcp_context_id.trim())
+                            mcpContextId = payload.mcp_context_id.trim();
+                        if (!savedWorkflow && payload.saved_workflow && typeof payload.saved_workflow === 'object')
+                            savedWorkflow = payload.saved_workflow;
+                        try {
+                            input.onStreamEvent?.({ type: eventName, ...payload, context_id: payload.context_id || contextId, mcp_context_id: payload.mcp_context_id || mcpContextId });
+                        }
+                        catch { }
+                        if (eventName === 'result')
+                            result = payload;
+                        if (eventName === 'error')
+                            throw new Error(payload.error || payload.message || 'Operator workflow failed');
+                    }
+                }
+                return { content: this.formatResponse(result || {}), workflowId, contextId, backendUrl: baseUrl, savedWorkflow,
+                    metadata: { source: 'operator', mode: 'operator', contextId, mcpContextId, savedWorkflowId: savedWorkflow?.id || null } };
+            }
+            catch (error) {
+                if (error?.name === 'AbortError' || error?.code === 'ABORT_ERR') {
+                    throw new OperatorClientError(`Operator workflow timed out after ${Math.round(input.timeoutMs / 60_000)} minute(s). You can increase the timeout with VIGTHORIA_OPERATOR_TIMEOUT_MS.`, 'timeout');
+                }
+                errors.push(`${baseUrl}: ${error?.message || String(error)}`);
+            }
+            finally {
+                if (timeoutId)
+                    clearTimeout(timeoutId);
+            }
+        }
+        throw new OperatorClientError(`Operator workflow failed on all endpoints: ${errors.join(' | ')}`, 'model_backend');
+    }
+}

package/dist/utils/post-write-validator.js

@@ -11,9 +11,10 @@
 import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
+import { safeChildProcessEnv } from './secret-policy.js';
 function commandExists(cmd, args = ['--version']) {
     try {
-        execFileSync(cmd, args, { stdio: 'pipe', timeout: 4000, windowsHide: true });
+        execFileSync(cmd, args, { stdio: 'pipe', timeout: 4000, windowsHide: true, env: safeChildProcessEnv() });
         return true;
     }
     catch {
@@ -25,22 +26,19 @@ function hasTsConfig(dir) {
 }
 /**
  * Resolve the best available tsc binary for the project.
- * Prefers local node_modules/.bin/tsc over npx to avoid network fetches.
+ * Prefers local node_modules/.bin/tsc, then an already installed global tsc.
+ * It deliberately has no npx fallback: npx may fetch and execute a package,
+ * which would violate offline mode and the process approval boundary.
  */
 function resolveTscBin(workspacePath) {
     const localTsc = path.join(workspacePath, 'node_modules', '.bin', 'tsc');
     if (fs.existsSync(localTsc))
         return { cmd: localTsc, args: ["--noEmit", "--skipLibCheck"] };
     try {
-        execFileSync("tsc", ["--version"], { stdio: "pipe", timeout: 4000, windowsHide: true });
+        execFileSync("tsc", ["--version"], { stdio: "pipe", timeout: 4000, windowsHide: true, env: safeChildProcessEnv() });
         return { cmd: "tsc", args: ["--noEmit", "--skipLibCheck"] };
     }
     catch { /* tsc not available */ }
-    try {
-        execFileSync("npx", ["--version"], { stdio: "pipe", timeout: 4000, windowsHide: true });
-        return { cmd: "npx", args: ["--yes", "tsc", "--noEmit", "--skipLibCheck"] };
-    }
-    catch { /* npx not available */ }
     return null;
 }
 function hasRealTestScript(dir) {
@@ -65,7 +63,7 @@ export async function runPostWriteValidation(workspacePath) {
     if (!workspacePath || !fs.existsSync(workspacePath))
         return [];
     const results = [];
-    const opts = { cwd: workspacePath, stdio: 'pipe', windowsHide: true };
+    const opts = { cwd: workspacePath, stdio: 'pipe', windowsHide: true, env: safeChildProcessEnv() };
     // 1. TypeScript type check
     const tscBin = hasTsConfig(workspacePath) ? resolveTscBin(workspacePath) : null;
     if (tscBin) {

package/dist/utils/preview-screenshot-adapter.d.ts

@@ -0,0 +1,13 @@
+export type PreviewScreenshotResult = {
+    captured: boolean;
+    error?: string;
+};
+export interface PreviewScreenshotPort {
+    capture(entryAbsolutePath: string, screenshotPath: string): Promise<PreviewScreenshotResult>;
+}
+export declare class OptionalPuppeteerScreenshotAdapter implements PreviewScreenshotPort {
+    private readonly loadPuppeteer;
+    private readonly environment;
+    constructor(loadPuppeteer?: () => Promise<unknown>, environment?: NodeJS.ProcessEnv);
+    capture(entryAbsolutePath: string, screenshotPath: string): Promise<PreviewScreenshotResult>;
+}

package/dist/utils/preview-screenshot-adapter.js

@@ -0,0 +1,36 @@
+import { pathToFileURL } from 'node:url';
+import { redactSensitiveText } from './secret-policy.js';
+export class OptionalPuppeteerScreenshotAdapter {
+    loadPuppeteer;
+    environment;
+    constructor(loadPuppeteer = () => import('puppeteer'), environment = process.env) {
+        this.loadPuppeteer = loadPuppeteer;
+        this.environment = environment;
+    }
+    async capture(entryAbsolutePath, screenshotPath) {
+        if (this.environment.VIGTHORIA_DISABLE_PREVIEW_SCREENSHOT === '1') {
+            return { captured: false, error: 'screenshot capture explicitly unavailable' };
+        }
+        try {
+            const loaded = await this.loadPuppeteer().catch(() => null);
+            const puppeteer = (loaded?.default || loaded);
+            if (!puppeteer || typeof puppeteer.launch !== 'function') {
+                return { captured: false, error: 'puppeteer optional adapter is not installed' };
+            }
+            const browser = await puppeteer.launch({ headless: true, args: ['--no-sandbox', '--disable-setuid-sandbox'] });
+            try {
+                const page = await browser.newPage();
+                await page.setViewport({ width: 1440, height: 960, deviceScaleFactor: 1 });
+                await page.goto(pathToFileURL(entryAbsolutePath).toString(), { waitUntil: 'networkidle0', timeout: 20_000 });
+                await page.screenshot({ path: screenshotPath, fullPage: true });
+            }
+            finally {
+                await browser.close();
+            }
+            return { captured: true };
+        }
+        catch (error) {
+            return { captured: false, error: redactSensitiveText(error instanceof Error ? error.message : String(error)) };
+        }
+    }
+}

package/dist/utils/process-policy.d.ts

@@ -0,0 +1,23 @@
+export declare class ProcessPolicyError extends Error {
+    readonly code: string;
+    constructor(message: string, code?: string);
+}
+export interface ParsedProcess {
+    executable: string;
+    args: string[];
+}
+export interface ApprovalScope {
+    key: string;
+    tool: string;
+    workspace: string;
+    destination: string;
+}
+export declare function assertProcessNetworkAllowed(executable: string, args: readonly string[]): void;
+/** Parse quoting only. No shell expansion, substitution, redirection, or operators. */
+export declare function parseArgumentVector(command: string): string[];
+export declare function parseSupportedProcess(command: string): ParsedProcess;
+export declare function parseGitArguments(value: string): string[];
+export declare function hardenGitArguments(args: readonly string[]): string[];
+export declare function safeGitEnvironment(source?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function resolveAutoApproval(explicitAutoApprove: unknown, _jsonMode: unknown): boolean;
+export declare function buildApprovalScope(tool: string, args: Record<string, string>, workspacePath: string): ApprovalScope;

package/dist/utils/process-policy.js

@@ -0,0 +1,284 @@
+import { createHash } from 'node:crypto';
+import * as path from 'node:path';
+import { assertContainedAbsolutePath } from './workspace-boundary.js';
+import { isOfflineNetworkMode } from './network-policy.js';
+import { safeChildProcessEnv } from './secret-policy.js';
+export class ProcessPolicyError extends Error {
+    code;
+    constructor(message, code = 'PROCESS_POLICY_VIOLATION') {
+        super(message);
+        this.code = code;
+        this.name = 'ProcessPolicyError';
+    }
+}
+const SUPPORTED_EXECUTABLES = new Map([
+    ['node', process.execPath],
+    ['npm', process.platform === 'win32' ? 'npm.cmd' : 'npm'],
+    ['npm.cmd', 'npm.cmd'],
+    ['pnpm', process.platform === 'win32' ? 'pnpm.cmd' : 'pnpm'],
+    ['pnpm.cmd', 'pnpm.cmd'],
+    ['yarn', process.platform === 'win32' ? 'yarn.cmd' : 'yarn'],
+    ['yarn.cmd', 'yarn.cmd'],
+    ['bun', process.platform === 'win32' ? 'bun.exe' : 'bun'],
+    ['bun.exe', 'bun.exe'],
+    ['tsc', process.platform === 'win32' ? 'tsc.cmd' : 'tsc'],
+    ['tsc.cmd', 'tsc.cmd'],
+    ['eslint', process.platform === 'win32' ? 'eslint.cmd' : 'eslint'],
+    ['eslint.cmd', 'eslint.cmd'],
+    ['prettier', process.platform === 'win32' ? 'prettier.cmd' : 'prettier'],
+    ['prettier.cmd', 'prettier.cmd'],
+    ['python', 'python'],
+    ['python.exe', 'python.exe'],
+    ['python3', 'python3'],
+    ['pytest', process.platform === 'win32' ? 'pytest.exe' : 'pytest'],
+    ['pytest.exe', 'pytest.exe'],
+    ['go', process.platform === 'win32' ? 'go.exe' : 'go'],
+    ['go.exe', 'go.exe'],
+    ['cargo', process.platform === 'win32' ? 'cargo.exe' : 'cargo'],
+    ['cargo.exe', 'cargo.exe'],
+    ['rustc', process.platform === 'win32' ? 'rustc.exe' : 'rustc'],
+    ['rustc.exe', 'rustc.exe'],
+    ['make', process.platform === 'win32' ? 'make.exe' : 'make'],
+    ['make.exe', 'make.exe'],
+    ['cmake', process.platform === 'win32' ? 'cmake.exe' : 'cmake'],
+    ['cmake.exe', 'cmake.exe'],
+    ['rg', process.platform === 'win32' ? 'rg.exe' : 'rg'],
+    ['rg.exe', 'rg.exe'],
+]);
+const ALLOWED_GIT_SUBCOMMANDS = new Set([
+    'add', 'blame', 'branch', 'checkout', 'commit', 'describe', 'diff', 'diff-tree',
+    'for-each-ref', 'grep', 'log', 'ls-files', 'ls-tree', 'merge-base', 'mv',
+    'name-rev', 'reset', 'restore', 'rev-list', 'rev-parse', 'rm', 'show',
+    'show-ref', 'status', 'switch', 'tag', 'update-index',
+]);
+const NETWORK_PACKAGE_ACTIONS = {
+    npm: new Set(['add', 'ci', 'exec', 'i', 'install', 'publish', 'update', 'view']),
+    'npm.cmd': new Set(['add', 'ci', 'exec', 'i', 'install', 'publish', 'update', 'view']),
+    pnpm: new Set(['add', 'dlx', 'fetch', 'i', 'install', 'publish', 'update']),
+    'pnpm.cmd': new Set(['add', 'dlx', 'fetch', 'i', 'install', 'publish', 'update']),
+    yarn: new Set(['add', 'dlx', 'install', 'publish', 'upgrade']),
+    'yarn.cmd': new Set(['add', 'dlx', 'install', 'publish', 'upgrade']),
+    bun: new Set(['add', 'install', 'publish', 'update', 'x']),
+    'bun.exe': new Set(['add', 'install', 'publish', 'update', 'x']),
+    cargo: new Set(['fetch', 'install', 'publish', 'update']),
+    'cargo.exe': new Set(['fetch', 'install', 'publish', 'update']),
+    go: new Set(['get', 'install']),
+    'go.exe': new Set(['get', 'install']),
+};
+const ALWAYS_NETWORK_EXECUTABLES = new Set([
+    'curl', 'curl.exe', 'scp', 'scp.exe', 'ssh', 'ssh.exe', 'wget', 'wget.exe',
+]);
+export function assertProcessNetworkAllowed(executable, args) {
+    if (!isOfflineNetworkMode())
+        return;
+    const base = path.basename(executable).toLowerCase();
+    if (ALWAYS_NETWORK_EXECUTABLES.has(base)) {
+        throw new ProcessPolicyError(`Offline mode prohibits network process: ${base}`, 'OFFLINE_NETWORK_PROCESS');
+    }
+    const action = String(args[0] || '').toLowerCase();
+    if (NETWORK_PACKAGE_ACTIONS[base]?.has(action)) {
+        throw new ProcessPolicyError(`Offline mode prohibits network-capable process: ${base} ${action}`, 'OFFLINE_NETWORK_PROCESS');
+    }
+}
+/** Parse quoting only. No shell expansion, substitution, redirection, or operators. */
+export function parseArgumentVector(command) {
+    const input = String(command || '').trim();
+    if (!input || /[\0\r\n]/.test(input)) {
+        throw new ProcessPolicyError('Command is empty or contains control characters', 'INVALID_COMMAND');
+    }
+    if (input.includes('`') || input.includes('$(')) {
+        throw new ProcessPolicyError('Command substitution is not supported', 'SHELL_SYNTAX_REJECTED');
+    }
+    const tokens = [];
+    let token = '';
+    let quote = null;
+    let escaping = false;
+    let tokenStarted = false;
+    for (const character of input) {
+        if (escaping) {
+            token += character;
+            tokenStarted = true;
+            escaping = false;
+            continue;
+        }
+        if (character === '\\' && quote !== "'") {
+            escaping = true;
+            tokenStarted = true;
+            continue;
+        }
+        if (quote) {
+            if (character === quote)
+                quote = null;
+            else
+                token += character;
+            tokenStarted = true;
+            continue;
+        }
+        if (character === "'" || character === '"') {
+            quote = character;
+            tokenStarted = true;
+            continue;
+        }
+        if (/\s/.test(character)) {
+            if (tokenStarted)
+                tokens.push(token);
+            token = '';
+            tokenStarted = false;
+            continue;
+        }
+        if (';&|<>'.includes(character)) {
+            throw new ProcessPolicyError('Shell operators and redirections are not supported', 'SHELL_SYNTAX_REJECTED');
+        }
+        token += character;
+        tokenStarted = true;
+    }
+    if (escaping || quote) {
+        throw new ProcessPolicyError('Command contains an unfinished escape or quote', 'INVALID_COMMAND');
+    }
+    if (tokenStarted)
+        tokens.push(token);
+    if (tokens.length === 0)
+        throw new ProcessPolicyError('Command has no executable', 'INVALID_COMMAND');
+    return tokens;
+}
+function rejectUnsafeProcessArguments(executable, args) {
+    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(executable)) {
+        throw new ProcessPolicyError('Environment assignment prefixes are not supported', 'UNSUPPORTED_EXECUTABLE');
+    }
+    for (const arg of args) {
+        const slashArg = arg.replace(/\\/g, '/');
+        if (path.isAbsolute(arg)
+            || /^[a-zA-Z]:\//.test(slashArg)
+            || slashArg.startsWith('//')
+            || /(?:^|[=/])\.\.(?:\/|$)/.test(slashArg)
+            || /(?:^|=)(?:\/|[a-zA-Z]:\/)/.test(slashArg)
+            || /^file:/i.test(arg)) {
+            throw new ProcessPolicyError(`Process argument escapes the workspace contract: ${arg}`, 'UNSAFE_PROCESS_ARGUMENT');
+        }
+    }
+    const base = path.basename(executable).toLowerCase();
+    if (base === 'node' && args.some((arg) => ['-e', '--eval', '-p', '--print', '-r', '--require', '--import'].includes(arg))) {
+        throw new ProcessPolicyError('Node evaluation and preload flags are not supported', 'UNSAFE_PROCESS_ARGUMENT');
+    }
+    if ((base === 'python' || base === 'python.exe' || base === 'python3') && args.some((arg) => arg === '-c')) {
+        throw new ProcessPolicyError('Python command evaluation is not supported', 'UNSAFE_PROCESS_ARGUMENT');
+    }
+    if ((base === 'npm' || base === 'npm.cmd') && ['exec', 'publish'].includes(String(args[0] || '').toLowerCase())) {
+        throw new ProcessPolicyError(`npm ${args[0]} is not supported`, 'UNSAFE_PROCESS_ARGUMENT');
+    }
+}
+export function parseSupportedProcess(command) {
+    const tokens = parseArgumentVector(command);
+    const requested = path.basename(tokens[0]).toLowerCase();
+    const executable = SUPPORTED_EXECUTABLES.get(requested);
+    if (!executable) {
+        throw new ProcessPolicyError(`Unsupported executable: ${tokens[0]}`, 'UNSUPPORTED_EXECUTABLE');
+    }
+    const args = tokens.slice(1);
+    rejectUnsafeProcessArguments(requested, args);
+    assertProcessNetworkAllowed(requested, args);
+    return { executable, args };
+}
+export function parseGitArguments(value) {
+    const args = parseArgumentVector(value);
+    if (args[0]?.toLowerCase() === 'git')
+        args.shift();
+    if (args.length === 0)
+        throw new ProcessPolicyError('Git subcommand is required', 'INVALID_GIT_ARGUMENTS');
+    const forbidden = /^(?:-c|--config-env|--exec-path|--git-dir|--work-tree|--namespace|--upload-pack|--receive-pack|--extcmd|--helper)(?:=|$)/i;
+    if (args.some((arg) => forbidden.test(arg))) {
+        throw new ProcessPolicyError('Git configuration, helper, and alternate-worktree injection flags are not supported', 'UNSAFE_GIT_ARGUMENT');
+    }
+    if (['difftool', 'mergetool', 'credential', 'daemon', 'shell'].includes(args[0].toLowerCase()) || args.some((arg) => /^ext::/i.test(arg))) {
+        throw new ProcessPolicyError('Git helper-execution subcommands and ext transports are not supported', 'UNSAFE_GIT_ARGUMENT');
+    }
+    if (!ALLOWED_GIT_SUBCOMMANDS.has(args[0].toLowerCase())) {
+        throw new ProcessPolicyError(`Unsupported Git subcommand: ${args[0]}`, 'UNSUPPORTED_GIT_SUBCOMMAND');
+    }
+    rejectUnsafeProcessArguments('git', args);
+    return args;
+}
+export function hardenGitArguments(args) {
+    const nullDevice = process.platform === 'win32' ? 'NUL' : '/dev/null';
+    const hardened = [
+        '-c', `core.hooksPath=${nullDevice}`,
+        '-c', 'core.fsmonitor=false',
+        '-c', 'diff.external=',
+        ...args,
+    ];
+    const subcommandIndex = 6;
+    const subcommand = String(hardened[subcommandIndex] || '').toLowerCase();
+    if (['diff', 'log', 'show'].includes(subcommand)) {
+        hardened.splice(subcommandIndex + 1, 0, '--no-ext-diff', '--no-textconv');
+    }
+    return hardened;
+}
+export function safeGitEnvironment(source = process.env) {
+    const nullDevice = process.platform === 'win32' ? 'NUL' : '/dev/null';
+    return {
+        ...safeChildProcessEnv(source),
+        GIT_CONFIG_NOSYSTEM: '1',
+        GIT_CONFIG_GLOBAL: nullDevice,
+        GIT_PAGER: 'cat',
+        PAGER: 'cat',
+        GIT_TERMINAL_PROMPT: '0',
+    };
+}
+export function resolveAutoApproval(explicitAutoApprove, _jsonMode) {
+    return explicitAutoApprove === true;
+}
+function canonicalArgs(tool, args) {
+    const normalized = {};
+    for (const key of Object.keys(args).sort())
+        normalized[key] = String(args[key]).trim();
+    if (tool === 'bash' && args.command) {
+        const process = parseSupportedProcess(args.command);
+        normalized.command = [process.executable, ...process.args];
+    }
+    if (tool === 'git' && args.args)
+        normalized.args = parseGitArguments(args.args);
+    return normalized;
+}
+function approvalDestination(tool, args, workspace) {
+    for (const key of ['path', 'cwd', 'working_dir']) {
+        if (!args[key])
+            continue;
+        try {
+            return assertContainedAbsolutePath(workspace, path.isAbsolute(args[key]) ? args[key] : path.join(workspace, args[key]), {
+                allowMissing: true,
+                allowRoot: true,
+            });
+        }
+        catch {
+            return `rejected:${key}`;
+        }
+    }
+    if (args.url) {
+        try {
+            return new URL(args.url).origin;
+        }
+        catch {
+            return 'invalid-url';
+        }
+    }
+    if (tool === 'ssh_exec')
+        return `ssh:${String(args.host || '').toLowerCase()}`;
+    if (tool === 'repo')
+        return `repo:${args.action || ''}:${args.project || ''}:${args.username || ''}`;
+    if (tool === 'git') {
+        const gitArgs = parseGitArguments(args.args || '');
+        return `git:${gitArgs[0]}:${gitArgs.find((arg, index) => index > 0 && !arg.startsWith('-')) || ''}`;
+    }
+    return workspace;
+}
+export function buildApprovalScope(tool, args, workspacePath) {
+    const workspace = path.resolve(workspacePath);
+    const destination = approvalDestination(tool, args, workspace);
+    const payload = JSON.stringify({ tool, args: canonicalArgs(tool, args), workspace, destination });
+    return {
+        key: createHash('sha256').update(payload).digest('hex'),
+        tool,
+        workspace,
+        destination,
+    };
+}

package/dist/utils/project-memory.d.ts

@@ -5,7 +5,7 @@
  * compact facts that can be retrieved for follow-up prompts without replaying
  * full chat history or noisy tool traces.
  */
-import { ChatMessage } from './api.js';
+import type { ChatMessage } from './api.js';
 export type ProjectMemoryType = 'fact' | 'decision' | 'task' | 'file' | 'preference' | 'validation' | 'issue';
 export interface ProjectMemoryItem {
     id: string;
@@ -18,11 +18,15 @@ export interface ProjectMemoryItem {
     weight: number;
 }
 export interface ProjectMemoryBrain {
-    version: 1;
+    version: 2;
     workspaceName: string;
     updatedAt: string;
+    privacyMode: 'local-only';
     items: ProjectMemoryItem[];
 }
+interface ProjectMemoryOptions {
+    enabled?: boolean;
+}
 interface RememberOptions {
     source?: string;
     mode?: string;
@@ -33,9 +37,12 @@ export declare class ProjectMemoryService {
     private workspacePath;
     private memoryDir;
     private brainPath;
-    constructor(workspacePath?: string);
+    private brainStore;
+    private enabled;
+    constructor(workspacePath?: string, options?: ProjectMemoryOptions);
     getMemoryDir(): string;
     loadBrain(): ProjectMemoryBrain;
+    private emptyBrain;
     saveBrain(brain: ProjectMemoryBrain): void;
     remember(type: ProjectMemoryType, text: string, options?: RememberOptions): void;
     rememberConversation(messages: ChatMessage[], options?: RememberOptions): void;
@@ -46,11 +53,14 @@ export declare class ProjectMemoryService {
         itemCount: number;
         updatedAt: string;
         typeCounts: Record<string, number>;
+        enabled: boolean;
+        privacyMode: 'local-only';
     };
     private createItem;
     private inferUserMemoryType;
     private dedupeAndTrim;
     private writeMarkdownViews;
+    private atomicWrite;
     private headingForType;
 }
 export {};