wispy-cli 2.7.13 → 2.7.15

package/core/harness.mjs

@@ -19,6 +19,99 @@ import os from "node:os";
 
 import { EVENT_TYPES } from "./audit.mjs";
 
+// ── Tool allow/deny patterns ───────────────────────────────────────────────────
+
+/**
+ * Claude Code compatible tool name aliases.
+ * Maps user-facing alias to internal tool name.
+ */
+export const TOOL_ALIASES = {
+  "Bash":      "run_command",
+  "Edit":      "file_edit",
+  "Write":     "write_file",
+  "Read":      "read_file",
+  "Grep":      "file_search",
+  "LS":        "list_directory",
+  "WebSearch": "web_search",
+};
+
+/**
+ * Parse a tool pattern string like:
+ *   "Bash(git:*)"  → { tool: "run_command", argPattern: "git *" }
+ *   "Edit"         → { tool: "file_edit", argPattern: "*" }
+ *   "Read(*.ts)"   → { tool: "read_file", argPattern: "*.ts" }
+ *   "run_command"  → { tool: "run_command", argPattern: "*" }
+ *
+ * @param {string} pattern
+ * @returns {{ tool: string, argPattern: string }}
+ */
+export function parseToolPattern(pattern) {
+  const m = pattern.match(/^([^(]+)(?:\(([^)]*)\))?$/);
+  if (!m) return null;
+
+  const rawName = m[1].trim();
+  const argSpec = m[2] ?? "*";
+
+  // Resolve alias
+  const toolName = TOOL_ALIASES[rawName] ?? rawName;
+
+  // Normalize "git:*" style to "git *" for command matching
+  const argPattern = argSpec.replace(/:/g, " ").trim() || "*";
+
+  return { tool: toolName, argPattern };
+}
+
+/**
+ * Parse a space-separated list of tool patterns.
+ * @param {string} patternsStr - e.g. "Bash(git:*) read_file Edit"
+ * @returns {Array<{ tool: string, argPattern: string }>}
+ */
+export function parseToolPatternList(patternsStr) {
+  if (!patternsStr) return [];
+  // Split on whitespace but respect parentheses
+  const patterns = [];
+  let current = "";
+  let depth = 0;
+  for (const ch of patternsStr) {
+    if (ch === "(") { depth++; current += ch; }
+    else if (ch === ")") { depth--; current += ch; }
+    else if ((ch === " " || ch === ",") && depth === 0) {
+      if (current.trim()) patterns.push(current.trim());
+      current = "";
+    } else {
+      current += ch;
+    }
+  }
+  if (current.trim()) patterns.push(current.trim());
+  return patterns.map(parseToolPattern).filter(Boolean);
+}
+
+/**
+ * Check whether a tool call matches a pattern.
+ * @param {string} toolName
+ * @param {object} args
+ * @param {{ tool: string, argPattern: string }} pattern
+ */
+export function matchesPattern(toolName, args, pattern) {
+  // Tool name must match
+  if (pattern.tool !== toolName && pattern.tool !== "*") return false;
+  // If no arg pattern, it's a match
+  if (pattern.argPattern === "*") return true;
+  // Get the relevant arg string
+  const argStr = _getArgString(toolName, args);
+  return _globMatch(argStr, pattern.argPattern);
+}
+
+/**
+ * Simple glob matching (supports * wildcard).
+ */
+function _globMatch(str, pattern) {
+  if (pattern === "*") return true;
+  // Convert glob to regex
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}`, "i").test(str);
+}
+
 // ── Approval gate constants ────────────────────────────────────────────────────
 
 // Tools that require approval depending on security mode
@@ -491,6 +584,55 @@ export class Harness extends EventEmitter {
       file_edit: "diff",
       git: "preview",
     };
+
+    // Tool allow/deny patterns (from config)
+    this._allowedPatterns = config.allowedTools ? parseToolPatternList(config.allowedTools) : null; // null = allow all
+    this._disallowedPatterns = config.disallowedTools ? parseToolPatternList(config.disallowedTools) : [];
+  }
+
+  /**
+   * Set allowed tools (replaces current filter).
+   * @param {string|Array} patterns - Space-separated string or array of pattern strings
+   */
+  setAllowedTools(patterns) {
+    if (!patterns) { this._allowedPatterns = null; return; }
+    const str = Array.isArray(patterns) ? patterns.join(" ") : patterns;
+    this._allowedPatterns = parseToolPatternList(str);
+  }
+
+  /**
+   * Set disallowed tools.
+   * @param {string|Array} patterns
+   */
+  setDisallowedTools(patterns) {
+    if (!patterns) { this._disallowedPatterns = []; return; }
+    const str = Array.isArray(patterns) ? patterns.join(" ") : patterns;
+    this._disallowedPatterns = parseToolPatternList(str);
+  }
+
+  /**
+   * Check if a tool call is allowed by the current allow/deny filters.
+   * @param {string} toolName
+   * @param {object} args
+   * @returns {{ allowed: boolean, reason?: string }}
+   */
+  checkToolFilter(toolName, args) {
+    // Check disallowed patterns first (deny takes precedence)
+    for (const pattern of this._disallowedPatterns) {
+      if (matchesPattern(toolName, args, pattern)) {
+        return { allowed: false, reason: `Tool '${toolName}' is in the disallowed list.` };
+      }
+    }
+
+    // Check allowed patterns (if set)
+    if (this._allowedPatterns !== null && this._allowedPatterns.length > 0) {
+      const allowed = this._allowedPatterns.some(p => matchesPattern(toolName, args, p));
+      if (!allowed) {
+        return { allowed: false, reason: `Tool '${toolName}' is not in the allowed list.` };
+      }
+    }
+
+    return { allowed: true };
   }
 
   /**
@@ -510,6 +652,26 @@ export class Harness extends EventEmitter {
 
     const callStart = Date.now();
 
+    // ── 0. Tool allow/deny filter ────────────────────────────────────────────
+    const filterResult = this.checkToolFilter(toolName, args);
+    if (!filterResult.allowed) {
+      receipt.approved = false;
+      receipt.success = false;
+      receipt.error = filterResult.reason ?? `Tool '${toolName}' is not available.`;
+      receipt.duration = 0;
+      this.emit("tool:denied", { toolName, args, receipt, context, reason: "tool-filter" });
+      // Return a clear error that the LLM can understand
+      return new HarnessResult({
+        result: {
+          success: false,
+          error: filterResult.reason ?? `Tool '${toolName}' is not available in this session.`,
+          tool_not_available: true,
+        },
+        receipt,
+        denied: true,
+      });
+    }
+
     // ── 1. Permission check ──────────────────────────────────────────────────
     const permResult = await this.permissions.check(toolName, args, context);
     receipt.permissionLevel = permResult.level ?? "auto";

package/core/project-settings.mjs

@@ -0,0 +1,122 @@
+/**
+ * core/project-settings.mjs — Per-project configuration for Wispy
+ *
+ * Supports .wispy/settings.json in the project root (or any parent dir).
+ * Settings precedence (highest to lowest):
+ *   1. CLI flags
+ *   2. Project settings (.wispy/settings.json)
+ *   3. User profile settings (wispy -p <name>)
+ *   4. User config (~/.wispy/config.json)
+ *   5. Defaults
+ *
+ * Example .wispy/settings.json:
+ * {
+ *   "model": "gpt-4o",
+ *   "personality": "pragmatic",
+ *   "effort": "high",
+ *   "appendSystemPrompt": "This is a TypeScript project using Next.js 15.",
+ *   "features": { "browser_integration": true },
+ *   "tools": {
+ *     "allow": ["run_command", "read_file", "write_file", "file_edit"],
+ *     "deny": ["delete_file"]
+ *   },
+ *   "agents": {
+ *     "styler": { "description": "CSS specialist", "prompt": "You are a CSS/Tailwind expert." }
+ *   }
+ * }
+ */
+
+import path from "node:path";
+import { readFile } from "node:fs/promises";
+
+const SETTINGS_FILENAME = "settings.json";
+const SETTINGS_DIR = ".wispy";
+
+/**
+ * Walk up from startDir looking for .wispy/settings.json.
+ * Returns parsed settings object (with _projectRoot added) or null.
+ *
+ * @param {string} startDir - Directory to start searching from (default: cwd)
+ * @returns {Promise<object|null>}
+ */
+export async function findProjectSettings(startDir = process.cwd()) {
+  let dir = path.resolve(startDir);
+  const root = path.parse(dir).root;
+
+  while (true) {
+    const settingsPath = path.join(dir, SETTINGS_DIR, SETTINGS_FILENAME);
+    try {
+      const raw = await readFile(settingsPath, "utf8");
+      const settings = JSON.parse(raw);
+      if (settings && typeof settings === "object") {
+        settings._projectRoot = dir;
+        settings._settingsPath = settingsPath;
+        return settings;
+      }
+    } catch { /* not found or parse error, keep walking */ }
+
+    const parent = path.dirname(dir);
+    if (parent === dir || dir === root) break;
+    dir = parent;
+  }
+  return null;
+}
+
+/**
+ * Deep-merge settings with correct precedence.
+ * CLI flags > project settings > profile settings > base config > defaults.
+ *
+ * For object values (like "features", "tools", "agents"), performs shallow merge.
+ * For scalar values, higher-precedence wins.
+ *
+ * @param {object} base    - Base user config (~/.wispy/config.json)
+ * @param {object|null} project  - Project settings (.wispy/settings.json)
+ * @param {object|null} profile  - Named profile from config.profiles
+ * @param {object} cli     - CLI flag overrides
+ * @returns {object} Merged settings
+ */
+export function mergeSettings(base = {}, project = null, profile = null, cli = {}) {
+  // Start with base config (strip profiles map to avoid leakage)
+  const { profiles: _profiles, ...baseClean } = base;
+  let merged = { ...baseClean };
+
+  // Apply profile on top (profile keys override base)
+  if (profile && typeof profile === "object") {
+    const { profiles: _pp, ...profileClean } = profile;
+    for (const [key, value] of Object.entries(profileClean)) {
+      if (value !== undefined) merged[key] = value;
+    }
+  }
+
+  // Apply project settings on top (project overrides profile + base)
+  if (project && typeof project === "object") {
+    for (const [key, value] of Object.entries(project)) {
+      if (key.startsWith("_")) continue; // skip internal metadata keys
+      if (value !== undefined && value !== null) {
+        // Deep merge objects (features, tools, agents)
+        if (
+          typeof value === "object" &&
+          !Array.isArray(value) &&
+          typeof merged[key] === "object" &&
+          !Array.isArray(merged[key]) &&
+          merged[key] !== null
+        ) {
+          merged[key] = { ...merged[key], ...value };
+        } else {
+          merged[key] = value;
+        }
+      }
+    }
+  }
+
+  // Apply CLI flags last (highest precedence)
+  if (cli && typeof cli === "object") {
+    for (const [key, value] of Object.entries(cli)) {
+      if (value !== undefined && value !== null) {
+        merged[key] = value;
+      }
+    }
+  }
+
+  return merged;
+}

package/core/session.mjs

@@ -23,7 +23,7 @@ import { readFile, writeFile, mkdir, readdir, stat } from "node:fs/promises";
 import { SESSIONS_DIR } from "./config.mjs";
 
 export class Session {
-  constructor({ id, workstream = "default", channel = null, chatId = null, messages = [], createdAt = null }) {
+  constructor({ id, workstream = "default", channel = null, chatId = null, messages = [], createdAt = null, name = null, model = null, cwd = null }) {
     this.id = id;
     this.workstream = workstream;
     this.channel = channel;
@@ -31,14 +31,20 @@ export class Session {
     this.messages = messages;
     this.createdAt = createdAt ?? new Date().toISOString();
     this.updatedAt = new Date().toISOString();
+    this.name = name ?? null;         // user-given display name
+    this.model = model ?? null;       // model used in this session
+    this.cwd = cwd ?? process.cwd(); // working directory when session was created
   }
 
   toJSON() {
     return {
       id: this.id,
+      name: this.name,
       workstream: this.workstream,
       channel: this.channel,
       chatId: this.chatId,
+      model: this.model,
+      cwd: this.cwd,
       messages: this.messages,
       createdAt: this.createdAt,
       updatedAt: this.updatedAt,
@@ -55,9 +61,9 @@ export class SessionManager {
   /**
    * Create a new session
    */
-  create({ workstream = "default", channel = null, chatId = null } = {}) {
+  create({ workstream = "default", channel = null, chatId = null, name = null, model = null, cwd = null } = {}) {
     const id = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 6)}`;
-    const session = new Session({ id, workstream, channel, chatId });
+    const session = new Session({ id, workstream, channel, chatId, name, model, cwd });
     this._sessions.set(id, session);
     if (channel && chatId) {
       this._keyMap.set(`${channel}:${chatId}`, id);
@@ -136,6 +142,7 @@ export class SessionManager {
 
         results.push({
           id: data.id,
+          name: data.name ?? null,
           workstream: data.workstream ?? "default",
           channel: data.channel ?? null,
           chatId: data.chatId ?? null,
@@ -184,6 +191,8 @@ export class SessionManager {
       workstream: opts.workstream ?? source.workstream,
       channel: opts.channel ?? null,
       chatId: opts.chatId ?? null,
+      name: opts.name ?? null,
+      model: opts.model ?? source.model ?? null,
     });
 
     // Copy message history (deep copy)
@@ -196,6 +205,21 @@ export class SessionManager {
     return forked;
   }
 
+  /**
+   * Set (or update) the display name of a session.
+   * Persists immediately to disk.
+   *
+   * @param {string} id - Session ID
+   * @param {string} name - Display name
+   */
+  async setName(id, name) {
+    const session = this._sessions.get(id);
+    if (!session) throw new Error(`Session not found: ${id}`);
+    session.name = name;
+    session.updatedAt = new Date().toISOString();
+    await this.save(id);
+  }
+
   /**
    * Add a message to a session.
    */

package/lib/wispy-repl.mjs

@@ -893,6 +893,21 @@ ${bold("Permissions & Audit (v1.1):")}
     return true;
   }
 
+  // ── Image attachment ─────────────────────────────────────────────────────────
+
+  if (cmd === "/image") {
+    const imagePath = parts.slice(1).join(" ");
+    if (!imagePath) {
+      console.log(yellow("Usage: /image <path>  — attach image to next message"));
+      return true;
+    }
+    // Store pending image on engine for next message
+    if (!engine._pendingImages) engine._pendingImages = [];
+    engine._pendingImages.push(imagePath);
+    console.log(green(`📎 Image queued: ${imagePath} — send your message to include it`));
+    return true;
+  }
+
   if (cmd === "/recall") {
     const query = parts.slice(1).join(" ");
     if (!query) { console.log(yellow("Usage: /recall <query>")); return true; }
@@ -1262,6 +1277,10 @@ async function runRepl(engine) {
 
     conversation.push({ role: "user", content: input });
 
+    // Consume pending image attachments (from /image command)
+    const pendingImages = engine._pendingImages ?? [];
+    engine._pendingImages = [];
+
     process.stdout.write(cyan("🌿 "));
     try {
       // Build messages from conversation history (keep system prompt + history)
@@ -1273,6 +1292,7 @@ async function runRepl(engine) {
         systemPrompt: await engine._buildSystemPrompt(input),
         noSave: true,
         dryRun: engine.dryRunMode ?? false,
+        images: pendingImages,
         onSkillLearned: (skill) => {
           console.log(cyan(`\n💡 Learned new skill: '${skill.name}' — use /${skill.name} next time`));
         },
@@ -1307,14 +1327,87 @@ async function runRepl(engine) {
   });
 }
 
+// ---------------------------------------------------------------------------
+// REPL with pre-populated history (for resume/fork)
+// ---------------------------------------------------------------------------
+
+async function runReplWithHistory(engine, existingConversation) {
+  const wsLabel = ACTIVE_WORKSTREAM === "default" ? "" : ` ${dim("·")} ${cyan(ACTIVE_WORKSTREAM)}`;
+  console.log(`
+  ${bold("🌿 Wispy")}${wsLabel} ${dim(`· ${engine.model}`)}
+  ${dim(`${engine.provider} · /help for commands · Ctrl+C to exit`)}
+`);
+
+  const conversation = [...existingConversation];
+
+  const rl = createInterface({
+    input: process.stdin,
+    output: process.stdout,
+    prompt: green("› "),
+    historySize: 100,
+    completer: makeCompleter(engine),
+  });
+
+  function updatePrompt() {
+    const ws = ACTIVE_WORKSTREAM !== "default" ? `${cyan(ACTIVE_WORKSTREAM)} ` : "";
+    const dry = engine.dryRunMode ? yellow("(dry) ") : "";
+    rl.setPrompt(ws + dry + green("› "));
+  }
+  updatePrompt();
+  rl.prompt();
+
+  rl.on("line", async (line) => {
+    const input = line.trim();
+    if (!input) { rl.prompt(); return; }
+
+    if (input.startsWith("/")) {
+      const handled = await handleSlashCommand(input, engine, conversation);
+      if (handled) { updatePrompt(); rl.prompt(); return; }
+    }
+
+    conversation.push({ role: "user", content: input });
+
+    // Check for pending image attachment from /image command
+    const pendingImages = engine._pendingImages ?? [];
+    engine._pendingImages = [];
+
+    process.stdout.write(cyan("🌿 "));
+    try {
+      const systemPrompt = await engine._buildSystemPrompt(input);
+      const response = await engine.processMessage(null, input, {
+        onChunk: (chunk) => process.stdout.write(chunk),
+        systemPrompt,
+        noSave: true,
+        images: pendingImages,
+      });
+      console.log("\n");
+      conversation.push({ role: "assistant", content: response.content });
+      if (conversation.length > 50) conversation.splice(0, conversation.length - 50);
+      await saveConversation(conversation);
+      console.log(dim(`  ${engine.providers.formatCost()}`));
+    } catch (err) {
+      console.log(red(`\n\n❌ Error: ${err.message.slice(0, 200)}`));
+    }
+
+    rl.prompt();
+  });
+
+  rl.on("close", () => {
+    console.log(dim(`\n🌿 Bye! (${engine.providers.formatCost()})`));
+    try { engine.destroy(); } catch {}
+    process.exit(0);
+  });
+}
+
 // ---------------------------------------------------------------------------
 // One-shot mode
 // ---------------------------------------------------------------------------
 
-async function runOneShot(engine, message) {
+async function runOneShot(engine, message, opts = {}) {
   try {
     const response = await engine.processMessage(null, message, {
       onChunk: (chunk) => process.stdout.write(chunk),
+      images: opts.images ?? [],
     });
     console.log("");
     console.log(dim(engine.providers.formatCost()));
@@ -1429,9 +1522,54 @@ if (serverStatus.started && !serverStatus.noBinary) {
 if (args[0] === "overview" || args[0] === "dashboard") { await showOverview(); process.exit(0); }
 if (args[0] === "search" && args[1]) { await searchAcrossWorkstreams(args.slice(1).join(" ")); process.exit(0); }
 
+// Handle session resume/fork from env (set by wispy resume/fork/sessions commands)
+const sessionAction = process.env.WISPY_SESSION_ACTION;
+const sessionActionId = process.env.WISPY_SESSION_ID;
+if (sessionAction && sessionActionId) {
+  delete process.env.WISPY_SESSION_ACTION;
+  delete process.env.WISPY_SESSION_ID;
+
+  if (sessionAction === "resume") {
+    // Load session and start REPL with existing conversation
+    const { SessionManager } = await import("../core/session.mjs");
+    const mgr = new SessionManager();
+    const session = await mgr.load(sessionActionId);
+    if (!session) {
+      console.error(red(`  Session not found: ${sessionActionId}`));
+      process.exit(1);
+    }
+    const conversation = session.messages.filter(m => m.role !== "system");
+    console.log(green(`  ▶ Resuming session ${sessionActionId} (${conversation.length} messages)`));
+    console.log(dim(`  First message: "${(conversation.find(m => m.role === "user")?.content ?? "").slice(0, 60)}"`));
+    console.log("");
+    // Override loadConversation by starting REPL with pre-populated history
+    await runReplWithHistory(engine, conversation);
+  } else if (sessionAction === "fork") {
+    // Fork already done — just start REPL with forked session
+    const { SessionManager } = await import("../core/session.mjs");
+    const mgr = new SessionManager();
+    const session = await mgr.load(sessionActionId);
+    if (!session) {
+      console.error(red(`  Forked session not found: ${sessionActionId}`));
+      process.exit(1);
+    }
+    const conversation = session.messages.filter(m => m.role !== "system");
+    console.log(green(`  ⑂ Forked session ${sessionActionId} (${conversation.length} messages)`));
+    console.log("");
+    await runReplWithHistory(engine, conversation);
+  }
+}
+
+// Parse image flags from env (set by wispy.mjs -i flag parsing)
+const globalImages = (() => {
+  try {
+    return process.env.WISPY_IMAGES ? JSON.parse(process.env.WISPY_IMAGES) : [];
+  } catch { return []; }
+})();
+
 if (args.length > 0 && args[0] !== "--help" && args[0] !== "-h") {
-  // One-shot mode
-  await runOneShot(engine, args.join(" "));
+  // One-shot mode — with optional image attachments
+  await runOneShot(engine, args.join(" "), { images: globalImages });
 } else if (args[0] === "--help" || args[0] === "-h") {
   console.log(`
 ${bold("🌿 Wispy")} — AI workspace assistant

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wispy-cli",
-  "version": "2.7.13",
+  "version": "2.7.15",
   "description": "🌿 Wispy — AI workspace assistant with trustworthy execution (harness, receipts, approvals, diffs)",
   "license": "MIT",
   "author": "Minseo & Poropo",