wayang-ai 0.9.5 → 0.9.6

package/dist/cli.js

@@ -5516,22 +5516,22 @@ function fitWorkerRows(rows, budget) {
   const fitted = [];
   let used = 0;
   for (const row of rows) {
-    const sep2 = fitted.length > 0 ? stringWidth(ROW_SEPARATOR) : 0;
+    const sep3 = fitted.length > 0 ? stringWidth(ROW_SEPARATOR) : 0;
     const full = workerRowText(row, true);
     const fullWidth = stringWidth(full);
-    if (used + sep2 + fullWidth <= budget) {
+    if (used + sep3 + fullWidth <= budget) {
       fitted.push(full);
-      used += sep2 + fullWidth;
+      used += sep3 + fullWidth;
       continue;
     }
     const compact = workerRowText(row, false);
     const compactWidth = stringWidth(compact);
-    if (used + sep2 + compactWidth <= budget) {
+    if (used + sep3 + compactWidth <= budget) {
       fitted.push(compact);
-      used += sep2 + compactWidth;
+      used += sep3 + compactWidth;
       continue;
     }
-    const remaining = budget - used - sep2;
+    const remaining = budget - used - sep3;
     if (remaining > 0) {
       fitted.push(fitWithSuffix(row.label, rowSuffix(row), remaining));
     }
@@ -5938,7 +5938,7 @@ function AppContent() {
 // package.json
 var package_default = {
   name: "wayang-ai",
-  version: "0.9.5",
+  version: "0.9.6",
   description: "Multi-agent orchestration platform",
   type: "module",
   license: "MIT",
@@ -9356,6 +9356,9 @@ function classifyRedirections(segments) {
   return result2;
 }
 
+// src/services/tools/permission-rules/bash-capability.ts
+import { resolve as resolvePath, sep as sep2 } from "path";
+
 // src/services/tools/permission-rules/bash-head.ts
 var DANGEROUS_HEAD_COMMANDS = /* @__PURE__ */ new Set([
   "sudo",
@@ -9840,6 +9843,11 @@ function isWriteSegment(segment) {
   }
   return false;
 }
+function isWriteCommandHead(command, words) {
+  if (BASH_WRITE_VERBS.has(command)) return true;
+  const flags2 = BASH_FLAGGED_WRITE_VERBS.get(command);
+  return flags2 !== void 0 && flags2.some((flag) => words.some((other) => isFlagWord(other, flag)));
+}
 var GIT_READ_ONLY_SUBCOMMANDS = /* @__PURE__ */ new Set([
   "status",
   "log",
@@ -9879,6 +9887,10 @@ function isReadOnlyGitCommand(words) {
   const flags2 = args.slice(i + 1).filter((word) => word.startsWith("-"));
   return flags2.length > 0 && flags2.every((flag) => listFlags.includes(flag));
 }
+function isDateSetFlag(word) {
+  if (word === "-s" || word.startsWith("--set")) return true;
+  return /^-[^-]*s/.test(word);
+}
 function classifySegment(segment) {
   if (isWriteSegment(segment)) return { mode: "write" };
   const head = headCommand(segment);
@@ -9887,6 +9899,11 @@ function classifySegment(segment) {
   if (head.command === "git") {
     return { mode: isReadOnlyGitCommand(head.words) ? "read" : "unknown" };
   }
+  if (head.command === "date") {
+    const sets = head.words.slice(1).some(isDateSetFlag);
+    if (sets) return { mode: "unknown", unverified: "date" };
+    return { mode: "read" };
+  }
   if (head.command === "sed") {
     const scripts = sedScriptsOf(head.words);
     if (scripts === void 0) return { mode: "unknown", unverified: "sed" };
@@ -9953,99 +9970,6 @@ function unanalyzedInnerCommand(segments) {
   return void 0;
 }
 
-// src/services/tools/permission-rules/bash-paths.ts
-function pathPieces(text, access) {
-  const candidates = [];
-  for (const piece of text.split("=")) {
-    if (!piece.startsWith("/") && !piece.startsWith("~")) continue;
-    if (isDiscardRedirectTarget(piece)) continue;
-    candidates.push({ path: piece, access });
-  }
-  return candidates;
-}
-function extractPathCandidates(segments) {
-  const candidates = [];
-  for (const segment of segments) {
-    const segmentLevel = segmentAccess(segment);
-    for (const token of segment.tokens) {
-      if (token.kind === "word") {
-        candidates.push(...pathPieces(token.word.text, segmentLevel));
-        continue;
-      }
-      const { redirect } = token;
-      if (redirect.kind === "fd-dup" || redirect.kind === "here-doc" || redirect.kind === "here-string") continue;
-      const target = redirect.target?.text;
-      if (target === void 0 || isDiscardRedirectTarget(target)) continue;
-      if (target.includes(CMDSUBST_PLACEHOLDER)) continue;
-      const access = redirect.kind === "output" ? "write" : segmentLevel;
-      for (const candidate of pathPieces(target, access)) {
-        candidates.push(
-          redirect.kind === "output" ? { ...candidate, reason: `output redirection to "${target}"` } : candidate
-        );
-      }
-    }
-  }
-  return candidates;
-}
-function commandAccess(candidates) {
-  let access = "unknown";
-  for (const candidate of candidates) {
-    if (candidate.access === "write") return "write";
-    if (candidate.access === "read") access = "read";
-  }
-  return access;
-}
-
-// src/services/tools/permission-rules/cd-chain.ts
-var NON_LITERAL_TARGET_CHARS = /[$`*?[\]{}]/;
-function literalCdTarget(segment) {
-  if (segment.tokens.length !== 2) return void 0;
-  const [command, argument] = segment.tokens;
-  if (command.kind !== "word" || argument.kind !== "word") return void 0;
-  if (command.word.text !== "cd") return void 0;
-  if (command.word.substitutions.length > 0) return void 0;
-  const target = argument.word.text;
-  if (target === "" || target === "-") return void 0;
-  if (argument.word.substitutions.length > 0) return void 0;
-  if (target.includes(CMDSUBST_PLACEHOLDER)) return void 0;
-  if (NON_LITERAL_TARGET_CHARS.test(target)) return void 0;
-  return target;
-}
-function cdAskReason(scope, argument, abs, verdict) {
-  if (verdict.sensitive === true && verdict.matchedEntry !== void 0) {
-    return `cd target "${argument}" is the sensitive location ${verdict.matchedEntry} (${abs}) \u2014 controller approval is required`;
-  }
-  if (verdict.matchedRule === "read-within-home") {
-    return `cd target "${argument}" is inside the home directory (${abs}) \u2014 controller approval is required`;
-  }
-  return `cd target "${argument}" resolves outside the allowed scope (${abs}) \u2014 controller approval is required`;
-}
-function applyCdChain(scope, segments) {
-  let cwd = scope.workspace;
-  let i = 0;
-  while (i + 1 < segments.length && segments[i].operator === "&&") {
-    const argument = literalCdTarget(segments[i]);
-    if (argument === void 0) break;
-    const expanded = expandHome(argument);
-    if (expanded.unresolvable) break;
-    const abs = normalizePath(expanded.path, { base: cwd });
-    const verdict = decidePath(scope, abs, "read");
-    if (verdict.decision === "deny") {
-      return { segments: segments.slice(i), decision: toToolDecision(verdict, "read") };
-    }
-    const narrowed = narrowHomeRead(verdict, { path: abs, access: "read" });
-    if (narrowed.decision === "ask") {
-      return {
-        segments: segments.slice(i),
-        decision: { ...narrowed, reason: cdAskReason(scope, argument, abs, narrowed) }
-      };
-    }
-    cwd = abs;
-    i += 1;
-  }
-  return { segments: segments.slice(i) };
-}
-
 // src/services/tools/permission-rules/substitutions.ts
 var MAX_CMDSUBST_DEPTH = 5;
 function collectSubstitutions(segments) {
@@ -10223,6 +10147,355 @@ function unanalyzedScriptFile(segments) {
   return void 0;
 }
 
+// src/services/tools/permission-rules/bash-capability.ts
+var INTERPRETER_COMMANDS = /* @__PURE__ */ new Set([
+  "bash",
+  "sh",
+  "dash",
+  "zsh",
+  "ksh",
+  "busybox",
+  "python",
+  "python3",
+  "node",
+  "perl",
+  "ruby",
+  "awk",
+  "php",
+  "lua"
+]);
+var NETWORK_COMMANDS = /* @__PURE__ */ new Set(["curl", "wget", "nc", "scp"]);
+var WRITE_CAPABILITY_COMMANDS = /* @__PURE__ */ new Set(["rsync"]);
+var INERT_COMMANDS = /* @__PURE__ */ new Set([
+  "sleep",
+  "true",
+  "false",
+  ":",
+  "pwd",
+  "whoami",
+  "id",
+  "date",
+  "test",
+  "[",
+  "exit",
+  "which",
+  "command",
+  "echo",
+  "printf"
+]);
+var LAUNCHER_COMMANDS = /* @__PURE__ */ new Set([
+  "script",
+  "su",
+  "setsid",
+  "watch",
+  "timeout",
+  "ssh"
+]);
+var DYNAMIC_COMMANDS = /* @__PURE__ */ new Set(["source", "."]);
+var ASSIGNMENT_PATTERN2 = /^[A-Za-z_][A-Za-z0-9_]*=/;
+var NUMERIC_PATTERN = /^\d+$/;
+var DYNAMIC_WORD_PATTERN2 = /[$`]/;
+function wordTexts(segment) {
+  const words = [];
+  for (const token of segment.tokens) {
+    if (token.kind === "word") words.push(token.word.text);
+  }
+  return words;
+}
+function stripAssignment(word) {
+  const match = word.match(/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/);
+  return match === null ? word : match[1];
+}
+function relativeOperands(words) {
+  const operands = [];
+  for (const word of words.slice(1)) {
+    if (word.startsWith("-")) continue;
+    if (word.includes(CMDSUBST_PLACEHOLDER)) continue;
+    const value = stripAssignment(word);
+    if (value === "" || value.startsWith("/") || value.startsWith("~")) continue;
+    operands.push(value);
+  }
+  return operands;
+}
+function hasOutputRedirect(segment) {
+  for (const token of segment.tokens) {
+    if (token.kind !== "redirect") continue;
+    const { redirect } = token;
+    if (redirect.kind !== "output") continue;
+    if (isDiscardRedirectTarget(redirect.target?.text)) continue;
+    return true;
+  }
+  return false;
+}
+function relativeInputTargets(segment) {
+  const targets = [];
+  for (const token of segment.tokens) {
+    if (token.kind !== "redirect") continue;
+    const { redirect } = token;
+    if (redirect.kind !== "input") continue;
+    const target = redirect.target?.text;
+    if (target === void 0 || isDiscardRedirectTarget(target)) continue;
+    if (target.includes(CMDSUBST_PLACEHOLDER)) continue;
+    if (target.startsWith("/") || target.startsWith("~")) continue;
+    targets.push(target);
+  }
+  return targets;
+}
+function insideWorkspace(scope, abs) {
+  const workspace = resolvePath(scope.workspace);
+  return abs === workspace || abs.startsWith(`${workspace}${sep2}`);
+}
+function capabilityFromWords(words) {
+  let start = 0;
+  while (start < words.length && ASSIGNMENT_PATTERN2.test(words[start])) start += 1;
+  const command = words[start];
+  if (command === void 0) return "unknown";
+  return capabilityOfHead(command, words.slice(start));
+}
+function launcherCapability(command, words) {
+  const args = words.slice(1);
+  for (let i = 0; i < args.length; i += 1) {
+    const word = args[i];
+    if ((command === "script" || command === "su") && word === "-c") {
+      const script = args[i + 1];
+      return script === void 0 ? "exec" : capabilityFromWords(script.split(/\s+/).filter(Boolean));
+    }
+    if (word.startsWith("-")) continue;
+    if (NUMERIC_PATTERN.test(word)) continue;
+    if (command === "ssh") {
+      const remote = args.slice(i + 1).filter((w) => !w.startsWith("-"));
+      return remote.length === 0 ? "network" : capabilityFromWords(remote);
+    }
+    return capabilityFromWords(args.slice(i));
+  }
+  return "exec";
+}
+function capabilityOfHead(command, words) {
+  if (DYNAMIC_WORD_PATTERN2.test(command) || command.includes(CMDSUBST_PLACEHOLDER)) return "dynamic";
+  if (DYNAMIC_COMMANDS.has(command)) return "dynamic";
+  if (command === "git" && words.slice(1).includes("-c")) return "unknown";
+  if (command === "env" && words.includes("-S")) return "exec";
+  if (LAUNCHER_COMMANDS.has(command)) return launcherCapability(command, words);
+  if (INTERPRETER_COMMANDS.has(command)) return "exec";
+  if (NETWORK_COMMANDS.has(command)) return "network";
+  if (WRITE_CAPABILITY_COMMANDS.has(command)) return "write";
+  return "unknown";
+}
+function isJudgedShellScript(head) {
+  if (!SHELL_COMMANDS.has(head.command)) return false;
+  return head.words.slice(1).some(
+    (word) => word === "-c" || word.startsWith("--command") || word.startsWith("-") && !word.startsWith("--") && word.includes("c")
+  );
+}
+function isInertSegment(segment, head) {
+  if (!INERT_COMMANDS.has(head.command)) return false;
+  const args = head.words.slice(1);
+  if (head.command === "date" && args.some(isDateSetFlag)) return false;
+  if (head.command === "command" && args[0] !== "-v" && args[0] !== "-V") return false;
+  for (const token of segment.tokens) {
+    if (token.kind === "redirect") return false;
+  }
+  for (const word of head.words) {
+    if (word.includes(CMDSUBST_PLACEHOLDER) || /[$`]/.test(word)) return false;
+    const value = stripAssignment(word);
+    if (value.startsWith("/") || value.startsWith("~")) return false;
+  }
+  return true;
+}
+function segmentCapability(segment) {
+  if (hasOutputRedirect(segment)) return "write";
+  const head = headCommand(segment);
+  if (head !== void 0 && isJudgedShellScript(head)) return "read";
+  if (head !== void 0 && isWriteCommandHead(head.command, head.words)) return "write";
+  if (head !== void 0 && isInertSegment(segment, head)) return "inert";
+  if (isReadOnlySegment(segment)) return "read";
+  if (head === void 0) {
+    const words = wordTexts(segment);
+    let i = 0;
+    while (i < words.length && ASSIGNMENT_PATTERN2.test(words[i])) i += 1;
+    const first = words[i];
+    if (first === void 0) return "unknown";
+    if (first === "env" && words.includes("-S")) return "exec";
+    if (DYNAMIC_WORD_PATTERN2.test(first) || first.includes(CMDSUBST_PLACEHOLDER)) return "dynamic";
+    return "unknown";
+  }
+  return capabilityOfHead(head.command, head.words);
+}
+function headWord(segment) {
+  const head = headCommand(segment);
+  if (head !== void 0) return head.command;
+  const words = wordTexts(segment);
+  return words.find((word) => !ASSIGNMENT_PATTERN2.test(word)) ?? words[0] ?? "\u2026";
+}
+function ask(matchedRule, reason) {
+  return { decision: "ask", matchedRule, reason };
+}
+function evaluateCapabilityGate(scope, segments, cursor) {
+  let execAsk;
+  let networkAsk;
+  let unknownAsk;
+  for (const segment of segments) {
+    const capability = segmentCapability(segment);
+    if (capability === "inert") continue;
+    if (capability === "dynamic") {
+      const word = headWord(segment);
+      const reason = DYNAMIC_COMMANDS.has(word) ? `\`${word}\` runs a script inside the current shell \u2014 controller approval is required` : `the command word "${word}" is dynamically constructed \u2014 controller approval is required`;
+      return ask("dynamic-shell", reason);
+    }
+    if (capability === "write") {
+      const head = headCommand(segment);
+      const operands = relativeOperands(head !== void 0 ? head.words : wordTexts(segment));
+      for (const operand of operands) {
+        const abs = resolvePath(cursor, operand);
+        if (!insideWorkspace(scope, abs)) {
+          return ask(
+            "write-scope",
+            `write target "${operand}" resolves outside the workspace (${abs}) \u2014 controller approval is required`
+          );
+        }
+      }
+      continue;
+    }
+    if (capability === "read") {
+      const head = headCommand(segment);
+      const operands = head !== void 0 ? relativeOperands(head.words) : [];
+      for (const operand of [...operands, ...relativeInputTargets(segment)]) {
+        const abs = resolvePath(cursor, operand);
+        const verdict = decidePath(scope, abs, "read");
+        if (verdict.decision === "deny") return toToolDecision(verdict, "read");
+        const narrowed = narrowHomeRead(verdict, { path: abs, access: "read" });
+        if (narrowed.decision === "ask") {
+          return { ...narrowed, askPaths: [narrowed.resolvedPath ?? abs] };
+        }
+      }
+      continue;
+    }
+    if (capability === "exec") {
+      execAsk ??= ask(
+        "exec-capability",
+        `\`${headWord(segment)}\` runs a shell or interpreter \u2014 controller approval is required (exec capability)`
+      );
+    } else if (capability === "network") {
+      networkAsk ??= ask(
+        "network-capability",
+        `\`${headWord(segment)}\` reaches the network \u2014 controller approval is required (network capability)`
+      );
+    } else if (capability === "unknown") {
+      unknownAsk ??= ask(
+        "unknown-capability",
+        `\`${headWord(segment)}\` is not on the bash capability tables \u2014 controller approval is required (unknown capability)`
+      );
+    }
+  }
+  return execAsk ?? networkAsk ?? unknownAsk;
+}
+function redirectWriteScopeAsk(scope, targets, cursor) {
+  for (const target of targets) {
+    if (target.startsWith("/") || target.startsWith("~")) continue;
+    const abs = resolvePath(cursor, target);
+    if (!insideWorkspace(scope, abs)) {
+      return ask(
+        "write-scope",
+        `output redirection target "${target}" resolves outside the workspace (${abs}) \u2014 controller approval is required`
+      );
+    }
+  }
+  return void 0;
+}
+
+// src/services/tools/permission-rules/bash-paths.ts
+function pathPieces(text, access) {
+  const candidates = [];
+  for (const piece of text.split("=")) {
+    if (!piece.startsWith("/") && !piece.startsWith("~")) continue;
+    if (isDiscardRedirectTarget(piece)) continue;
+    candidates.push({ path: piece, access });
+  }
+  return candidates;
+}
+function extractPathCandidates(segments) {
+  const candidates = [];
+  for (const segment of segments) {
+    const segmentLevel = segmentAccess(segment);
+    for (const token of segment.tokens) {
+      if (token.kind === "word") {
+        candidates.push(...pathPieces(token.word.text, segmentLevel));
+        continue;
+      }
+      const { redirect } = token;
+      if (redirect.kind === "fd-dup" || redirect.kind === "here-doc" || redirect.kind === "here-string") continue;
+      const target = redirect.target?.text;
+      if (target === void 0 || isDiscardRedirectTarget(target)) continue;
+      if (target.includes(CMDSUBST_PLACEHOLDER)) continue;
+      const access = redirect.kind === "output" ? "write" : segmentLevel;
+      for (const candidate of pathPieces(target, access)) {
+        candidates.push(
+          redirect.kind === "output" ? { ...candidate, reason: `output redirection to "${target}"` } : candidate
+        );
+      }
+    }
+  }
+  return candidates;
+}
+function commandAccess(candidates) {
+  let access = "unknown";
+  for (const candidate of candidates) {
+    if (candidate.access === "write") return "write";
+    if (candidate.access === "read") access = "read";
+  }
+  return access;
+}
+
+// src/services/tools/permission-rules/cd-chain.ts
+var NON_LITERAL_TARGET_CHARS = /[$`*?[\]{}]/;
+function literalCdTarget(segment) {
+  if (segment.tokens.length !== 2) return void 0;
+  const [command, argument] = segment.tokens;
+  if (command.kind !== "word" || argument.kind !== "word") return void 0;
+  if (command.word.text !== "cd") return void 0;
+  if (command.word.substitutions.length > 0) return void 0;
+  const target = argument.word.text;
+  if (target === "" || target === "-") return void 0;
+  if (argument.word.substitutions.length > 0) return void 0;
+  if (target.includes(CMDSUBST_PLACEHOLDER)) return void 0;
+  if (NON_LITERAL_TARGET_CHARS.test(target)) return void 0;
+  return target;
+}
+function cdAskReason(scope, argument, abs, verdict) {
+  if (verdict.sensitive === true && verdict.matchedEntry !== void 0) {
+    return `cd target "${argument}" is the sensitive location ${verdict.matchedEntry} (${abs}) \u2014 controller approval is required`;
+  }
+  if (verdict.matchedRule === "read-within-home") {
+    return `cd target "${argument}" is inside the home directory (${abs}) \u2014 controller approval is required`;
+  }
+  return `cd target "${argument}" resolves outside the allowed scope (${abs}) \u2014 controller approval is required`;
+}
+function applyCdChain(scope, segments) {
+  let cwd = scope.workspace;
+  let i = 0;
+  while (i + 1 < segments.length && segments[i].operator === "&&") {
+    const argument = literalCdTarget(segments[i]);
+    if (argument === void 0) break;
+    const expanded = expandHome(argument);
+    if (expanded.unresolvable) break;
+    const abs = normalizePath(expanded.path, { base: cwd });
+    const verdict = decidePath(scope, abs, "read");
+    if (verdict.decision === "deny") {
+      return { segments: segments.slice(i), decision: toToolDecision(verdict, "read") };
+    }
+    const narrowed = narrowHomeRead(verdict, { path: abs, access: "read" });
+    if (narrowed.decision === "ask") {
+      return {
+        segments: segments.slice(i),
+        decision: { ...narrowed, reason: cdAskReason(scope, argument, abs, narrowed) }
+      };
+    }
+    cwd = abs;
+    i += 1;
+  }
+  return { segments: segments.slice(i), cwd };
+}
+
 // src/services/tools/permission-rules/bash-access.ts
 function fallbackSensitiveHit(scope, expandedCommand) {
   for (const raw of expandedCommand.split(/[\s=]+/)) {
@@ -10274,14 +10547,14 @@ function evaluateBashCommand(scope, command, depth) {
     if (verdict.decision === "deny") return toToolDecision(verdict, candidate.access);
     const narrowed = narrowHomeRead(verdict, candidate);
     if (narrowed.decision === "ask") {
-      const ask = {
+      const ask2 = {
         ...narrowed,
         ...candidate.reason !== void 0 && { reason: candidate.reason }
       };
       const askingPath = narrowed.resolvedPath ?? candidate.path;
       if (!askPaths.includes(askingPath)) askPaths.push(askingPath);
-      if (ask.sensitive === true) sensitiveAsk ??= ask;
-      else firstAsk ??= ask;
+      if (ask2.sensitive === true) sensitiveAsk ??= ask2;
+      else firstAsk ??= ask2;
     } else firstAllow ??= narrowed;
   }
   const lineAccess = candidates.length > 0 ? commandAccess(candidates) : segments.length > 0 && segments.every((segment) => segmentAccess(segment) === "read") ? "read" : "unknown";
@@ -10316,11 +10589,12 @@ function evaluateBashCommand(scope, command, depth) {
     };
   }
   if (redirections.writeTargets.length > 0 && !firstAsk && !sensitiveAsk) {
-    return {
-      decision: "ask",
-      matchedRule: "dynamic-shell",
-      reason: `output redirection writes a file ("${redirections.writeTargets.join('", "')}")`
-    };
+    const scopeAsk = redirectWriteScopeAsk(
+      scope,
+      redirections.writeTargets,
+      cdChain.cwd ?? scope.workspace
+    );
+    if (scopeAsk) return { ...scopeAsk, access: lineAccess };
   }
   if (hasUnresolvableHome) {
     return {
@@ -10352,6 +10626,8 @@ function evaluateBashCommand(scope, command, depth) {
     };
   }
   if (firstAsk) return firstAsk;
+  const capabilityAsk = evaluateCapabilityGate(scope, segments, cdChain.cwd ?? scope.workspace);
+  if (capabilityAsk) return { ...capabilityAsk, access: lineAccess };
   if (firstAllow) return firstAllow;
   return { decision: "allow", matchedRule: "no-path", access: lineAccess };
 }
@@ -10916,8 +11192,8 @@ var ClaudeWorkerBase = class {
    * Provide the engine-backed ask_controller implementation. Once set, the
    * worker exposes it to Claude Code as an in-process SDK MCP tool.
    */
-  setInquirySupport(ask) {
-    this._askController = ask;
+  setInquirySupport(ask2) {
+    this._askController = ask2;
   }
   flushMessageQueue() {
     this._messageQueue.length = 0;
@@ -11126,11 +11402,11 @@ var ClaudeWorkerPermissionGate = class _ClaudeWorkerPermissionGate extends Claud
    * times out → deny). Shared by every `ask` verdict so the request flow stays
    * identical to the puppet worker's.
    */
-  async requestPermission(toolName, input2, ask, grantKeys = []) {
+  async requestPermission(toolName, input2, ask2, grantKeys = []) {
     if (!this._signalQueue || !this._runContext) return { behavior: "allow", updatedInput: input2 };
     const requestId = generateId("perm");
-    const description = this.describePermissionRequest(toolName, input2, ask);
-    const operation = ask.operation;
+    const description = this.describePermissionRequest(toolName, input2, ask2);
+    const operation = ask2.operation;
     this._signalQueue.enqueue({
       source: "worker",
       type: "permission_request",
@@ -11144,12 +11420,12 @@ var ClaudeWorkerPermissionGate = class _ClaudeWorkerPermissionGate extends Claud
         toolName,
         toolArgs: input2,
         description,
-        ...ask.matchedRule !== void 0 && { matchedRule: ask.matchedRule },
-        ...ask.matchedEntry !== void 0 && { matchedEntry: ask.matchedEntry },
-        ...ask.matchedSource !== void 0 && { matchedSource: ask.matchedSource },
-        ...ask.resolvedPath !== void 0 && { resolvedPath: ask.resolvedPath },
-        ...ask.sensitive !== void 0 && { sensitive: ask.sensitive },
-        ...ask.access !== void 0 && { access: ask.access },
+        ...ask2.matchedRule !== void 0 && { matchedRule: ask2.matchedRule },
+        ...ask2.matchedEntry !== void 0 && { matchedEntry: ask2.matchedEntry },
+        ...ask2.matchedSource !== void 0 && { matchedSource: ask2.matchedSource },
+        ...ask2.resolvedPath !== void 0 && { resolvedPath: ask2.resolvedPath },
+        ...ask2.sensitive !== void 0 && { sensitive: ask2.sensitive },
+        ...ask2.access !== void 0 && { access: ask2.access },
         operation
       },
       ...this._turnLineage
@@ -11164,12 +11440,12 @@ var ClaudeWorkerPermissionGate = class _ClaudeWorkerPermissionGate extends Claud
     recordPermissionAudit(this.logger, {
       decision: denied ? "denied" : "approved",
       operation,
-      access: auditAccessFor(ask.access),
-      resolvedPath: ask.resolvedPath,
+      access: auditAccessFor(ask2.access),
+      resolvedPath: ask2.resolvedPath,
       requestedPath: this.requestedPathOf(input2),
-      matchedEntry: ask.matchedEntry,
-      matchedSource: ask.matchedSource,
-      matchedRule: ask.matchedRule,
+      matchedEntry: ask2.matchedEntry,
+      matchedSource: ask2.matchedSource,
+      matchedRule: ask2.matchedRule,
       taskId: this._runContext.taskId,
       workerId: this._runContext.workerId,
       toolName,
@@ -11185,7 +11461,7 @@ var ClaudeWorkerPermissionGate = class _ClaudeWorkerPermissionGate extends Claud
     return result2;
   }
   /** Human-readable summary of a gated call for the approval prompt. */
-  describePermissionRequest(toolName, input2, ask) {
+  describePermissionRequest(toolName, input2, ask2) {
     let detail;
     if (toolName === "Bash") {
       detail = `Execute shell command: ${String(input2.command ?? "")}`;
@@ -11198,15 +11474,15 @@ var ClaudeWorkerPermissionGate = class _ClaudeWorkerPermissionGate extends Claud
     } else {
       detail = `${toolName}: ${JSON.stringify(input2)}`;
     }
-    const hit = ask.sensitive ? verdictDetailSuffix({
-      matchedRule: ask.matchedRule,
-      matchedEntry: ask.matchedEntry,
-      matchedSource: ask.matchedSource,
-      resolvedPath: ask.resolvedPath,
-      operation: ask.operation
+    const hit = ask2.sensitive ? verdictDetailSuffix({
+      matchedRule: ask2.matchedRule,
+      matchedEntry: ask2.matchedEntry,
+      matchedSource: ask2.matchedSource,
+      resolvedPath: ask2.resolvedPath,
+      operation: ask2.operation
     }) : "";
     const withHit = `${detail}${hit}`;
-    return ask.reason ? `${withHit} (${ask.reason})` : withHit;
+    return ask2.reason ? `${withHit} (${ask2.reason})` : withHit;
   }
 };
 
@@ -13120,9 +13396,9 @@ function mcpToolIdentity(name) {
   const lower = name.trim().toLowerCase();
   if (lower.startsWith("mcp__")) {
     const rest = lower.slice("mcp__".length);
-    const sep2 = rest.lastIndexOf("__");
-    if (sep2 <= 0 || sep2 + 2 >= rest.length) return void 0;
-    return { server: rest.slice(0, sep2), tool: rest.slice(sep2 + 2) };
+    const sep3 = rest.lastIndexOf("__");
+    if (sep3 <= 0 || sep3 + 2 >= rest.length) return void 0;
+    return { server: rest.slice(0, sep3), tool: rest.slice(sep3 + 2) };
   }
   const qualified = /^([a-z0-9_]+)[.-]([a-z0-9_]+)$/.exec(lower);
   return qualified ? { server: qualified[1], tool: qualified[2] } : void 0;
@@ -13225,7 +13501,7 @@ function bridgeToolArgs(snapshot) {
   }
   return { locations: snapshot.locations ?? [] };
 }
-function describeRequest(snapshot, classification, ask) {
+function describeRequest(snapshot, classification, ask2) {
   let detail;
   if (classification.type === "policy" && classification.command !== void 0) {
     detail = `Execute shell command: ${classification.command}`;
@@ -13234,15 +13510,15 @@ function describeRequest(snapshot, classification, ask) {
   } else {
     detail = `${bridgeToolName(snapshot)}: ${JSON.stringify(bridgeToolArgs(snapshot))}`;
   }
-  const hit = ask?.sensitive ? verdictDetailSuffix({
-    matchedRule: ask.matchedRule,
-    matchedEntry: ask.matchedEntry,
-    matchedSource: ask.matchedSource,
-    resolvedPath: ask.resolvedPath,
-    operation: ask.operation
+  const hit = ask2?.sensitive ? verdictDetailSuffix({
+    matchedRule: ask2.matchedRule,
+    matchedEntry: ask2.matchedEntry,
+    matchedSource: ask2.matchedSource,
+    resolvedPath: ask2.resolvedPath,
+    operation: ask2.operation
   }) : "";
   const withHit = `${detail}${hit}`;
-  return ask?.reason ? `${withHit} (${ask.reason})` : withHit;
+  return ask2?.reason ? `${withHit} (${ask2.reason})` : withHit;
 }
 function createAcpPermissionBridge(deps, pendingPermissions) {
   const permissionMs = deps.permissionMs ?? ACP_PERMISSION_TIMEOUT_MS;
@@ -13295,7 +13571,7 @@ function createAcpPermissionBridge(deps, pendingPermissions) {
     if (classification.type === "direct-allow") {
       return outcomeFor("allow");
     }
-    const ask = classification.type === "direct-ask" ? { reason: classification.reason, operation: classification.operation } : { operation: operationForTool(classification.toolName) };
+    const ask2 = classification.type === "direct-ask" ? { reason: classification.reason, operation: classification.operation } : { operation: operationForTool(classification.toolName) };
     if (classification.type === "policy") {
       const verdict = decideToolAccess(deps.scope, classification.toolName, classification.args);
       if (verdict.decision === "allow") {
@@ -13310,14 +13586,14 @@ function createAcpPermissionBridge(deps, pendingPermissions) {
         });
         return outcomeFor("allow");
       }
-      ask.reason = verdict.reason;
-      ask.matchedRule = verdict.matchedRule;
-      ask.matchedEntry = verdict.matchedEntry;
-      ask.matchedSource = verdict.matchedSource;
-      ask.resolvedPath = verdict.resolvedPath;
-      ask.sensitive = verdict.sensitive;
-      ask.access = verdict.access;
-      ask.askPaths = verdict.askPaths;
+      ask2.reason = verdict.reason;
+      ask2.matchedRule = verdict.matchedRule;
+      ask2.matchedEntry = verdict.matchedEntry;
+      ask2.matchedSource = verdict.matchedSource;
+      ask2.resolvedPath = verdict.resolvedPath;
+      ask2.sensitive = verdict.sensitive;
+      ask2.access = verdict.access;
+      ask2.askPaths = verdict.askPaths;
       if (verdict.decision === "deny") {
         audit({
           ...base,
@@ -13358,14 +13634,14 @@ function createAcpPermissionBridge(deps, pendingPermissions) {
           emoji: deps.runContext.emoji,
           toolName,
           toolArgs: bridgeToolArgs(snapshot),
-          description: describeRequest(snapshot, classification, ask),
-          ...ask.matchedRule !== void 0 && { matchedRule: ask.matchedRule },
-          ...ask.matchedEntry !== void 0 && { matchedEntry: ask.matchedEntry },
-          ...ask.matchedSource !== void 0 && { matchedSource: ask.matchedSource },
-          ...ask.resolvedPath !== void 0 && { resolvedPath: ask.resolvedPath },
-          ...ask.sensitive !== void 0 && { sensitive: ask.sensitive },
-          ...ask.access !== void 0 && { access: ask.access },
-          operation: ask.operation
+          description: describeRequest(snapshot, classification, ask2),
+          ...ask2.matchedRule !== void 0 && { matchedRule: ask2.matchedRule },
+          ...ask2.matchedEntry !== void 0 && { matchedEntry: ask2.matchedEntry },
+          ...ask2.matchedSource !== void 0 && { matchedSource: ask2.matchedSource },
+          ...ask2.resolvedPath !== void 0 && { resolvedPath: ask2.resolvedPath },
+          ...ask2.sensitive !== void 0 && { sensitive: ask2.sensitive },
+          ...ask2.access !== void 0 && { access: ask2.access },
+          operation: ask2.operation
         },
         ...deps.turnLineage ?? {}
       });
@@ -13376,11 +13652,11 @@ function createAcpPermissionBridge(deps, pendingPermissions) {
       audit({
         ...base,
         decision: result3.approved ? "approved" : "denied",
-        access: ask.access !== void 0 ? auditAccessFor(ask.access) : "unknown",
-        resolvedPath: ask.resolvedPath,
-        matchedRule: ask.matchedRule,
-        matchedEntry: ask.matchedEntry,
-        matchedSource: ask.matchedSource,
+        access: ask2.access !== void 0 ? auditAccessFor(ask2.access) : "unknown",
+        resolvedPath: ask2.resolvedPath,
+        matchedRule: ask2.matchedRule,
+        matchedEntry: ask2.matchedEntry,
+        matchedSource: ask2.matchedSource,
         ...!result3.approved && { source: denialSource(result3.reason) }
       });
       if (result3.approved) {
@@ -13389,7 +13665,7 @@ function createAcpPermissionBridge(deps, pendingPermissions) {
         }
         return outcomeFor("allow");
       }
-      emitWaitDenial(result3.reason, toolName, denialTarget, ask.matchedRule);
+      emitWaitDenial(result3.reason, toolName, denialTarget, ask2.matchedRule);
       return outcomeFor("reject");
     }
     const requestId = generateId("perm");
@@ -13405,8 +13681,8 @@ function createAcpPermissionBridge(deps, pendingPermissions) {
         emoji: deps.runContext.emoji,
         toolName,
         toolArgs: bridgeToolArgs(snapshot),
-        description: describeRequest(snapshot, classification, ask),
-        operation: ask.operation
+        description: describeRequest(snapshot, classification, ask2),
+        operation: ask2.operation
       },
       ...deps.turnLineage ?? {}
     });
@@ -13420,7 +13696,7 @@ function createAcpPermissionBridge(deps, pendingPermissions) {
       access: "unknown",
       ...!result2.approved && { source: denialSource(result2.reason) }
     });
-    if (!result2.approved) emitWaitDenial(result2.reason, toolName, denialTarget, ask.matchedRule);
+    if (!result2.approved) emitWaitDenial(result2.reason, toolName, denialTarget, ask2.matchedRule);
     return result2.approved ? outcomeFor("allow") : outcomeFor("reject");
   };
 }
@@ -14001,8 +14277,8 @@ var BaseAcpWorker = class {
    * MCP bridge serves it over a Unix socket (member presence is what the
    * engine's `wireWorker` probe detects, as with ClaudeCodeWorker).
    */
-  setInquirySupport(ask) {
-    this._askController = ask;
+  setInquirySupport(ask2) {
+    this._askController = ask2;
   }
   getState() {
     return this.state;
@@ -15064,15 +15340,15 @@ ${joinControllerMessages(initialQueued)}`;
   }
   /** ask_controller: same blocking engine channel as ClaudeCodeWorker, with an audit entry. */
   async mcpAsk(question, context) {
-    const ask = this._askController;
-    if (!ask || !this._mcpHost?.mcpAvailable) {
+    const ask2 = this._askController;
+    if (!ask2 || !this._mcpHost?.mcpAvailable) {
       return "[UNAVAILABLE] The controller inquiry channel is not available for this worker.";
     }
     const q = capText(question, MAX_QUESTION_CHARS);
     const c = context === void 0 ? void 0 : capText(context, MAX_CONTEXT_CHARS);
     let answer;
     try {
-      answer = await ask(q, c);
+      answer = await ask2(q, c);
     } catch (err) {
       answer = `[UNAVAILABLE] ${err instanceof Error ? err.message : String(err)}`;
     }

package/dist/mcp-bridge-entry.js

@@ -6,7 +6,7 @@ import { connect } from "net";
 // package.json
 var package_default = {
   name: "wayang-ai",
-  version: "0.9.5",
+  version: "0.9.6",
   description: "Multi-agent orchestration platform",
   type: "module",
   license: "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wayang-ai",
-  "version": "0.9.5",
+  "version": "0.9.6",
   "description": "Multi-agent orchestration platform",
   "type": "module",
   "license": "MIT",