ask-agent 0.40.29 → 0.40.30

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b55a3e7db1b87fa2e915014f6e8a787b24fe60df99602b14b95da3bb06fdf3a5
-  data.tar.gz: 57017799b4dfb6ab2f842212ba9eed1321bcd61c3872b92a5347a85e98f5ace7
+  metadata.gz: 6cbbcaccaadc0c18309984778974b4bcd63266acfd5329b855bfe8549ceed08b
+  data.tar.gz: e57d10ac194c5fcd6811842955527da4aa1a029a8c1855cb386851230e1335b7
 SHA512:
-  metadata.gz: ef7705c41d359caed21b9424f09ec1aaf6164b3f0d773b78fdbfe0173a7f56dc1bff0af819d6aedb237fb45bdf990246282c2bfa4e1a64864df2d639f6c6d8e3
-  data.tar.gz: '08aed23b7e951f35182a683d52ae2c67d534fb2ccf97d2c1a6fc99ec505e49ce88be55225b9250eae6a1fb8d18e6aaaeb17994cb0ddf11b207a9a34fa14231c9'
+  metadata.gz: c82139550f7fceacc363517c898f904a63900ba886db8f41532818721892a7a4e6e7e06b8cba78757831bed9846849238a3561032ba9e868f98e370310d8b8b3
+  data.tar.gz: 0eb17641350c57e697802700645edb9cdd271c2313b90a625a97ddf756f1fc4ca3dde68643aa7c5336de3bcdbee445e712673fe8b9bac709bc8199ae819f47b7

data/CHANGELOG.md

@@ -4,6 +4,20 @@
 
 - **`Session#run(runtime_event_sink:)` forwards ask-runtime tool lifecycle events** through the agent loop and recursive turns to `ToolExecutor#execute_batch`.
 
+### Changed
+
+- **Permission machinery extracted to the `ask-permissions` gem.**
+  `Ask::Agent::ApprovalQueue`, `Ask::Agent::Policies::ApprovalPolicy`,
+  `Ask::Agent::Policies::PermissionRules`, and
+  `Ask::Agent::Policies::Permissions` are removed from ask-agent; the same
+  classes now ship as `Ask::Permissions::ApprovalQueue`,
+  `Ask::Permissions::ApprovalPolicy`, `Ask::Permissions::PermissionRules`,
+  and `Ask::Permissions::Permissions` behind `require "ask/permissions"`.
+  Session keeps its agent-specific wiring — the `approval:` option still
+  builds the queue, wires on_approve/on_reject/on_submit callbacks, and
+  prepends the policy hook; the plan queue is unchanged apart from the
+  constant. Requires the new runtime dependency `ask-permissions >= 0.1.0`.
+
 ### Fixed
 
 - **`SessionAdapter.resume` surfaces every ask-session miss as

data/lib/ask/agent/exit_plan_mode.rb

@@ -20,7 +20,7 @@ module Ask
 
       param :plan, type: :string, desc: "The plan you propose to execute", required: true
 
-      # @param plan_queue [Ask::Agent::ApprovalQueue] queue carrying plan
+      # @param plan_queue [Ask::Permissions::ApprovalQueue] queue carrying plan
       #   approvals; the session wires approve/reject callbacks
       # @param on_submit [Proc, nil] called with the plan text when the plan
       #   is submitted (used to emit PlanProposed)

data/lib/ask/agent/session.rb

@@ -166,7 +166,7 @@ module Ask
         else
           %w[read glob grep web_search]
         end
-        @plan_queue = ApprovalQueue.new(
+        @plan_queue = Ask::Permissions::ApprovalQueue.new(
           on_approve: ->(action) { approve_plan(action) },
           on_reject: ->(action) { reject_plan(action) },
           # Same race closure as the tool approval queue: register the
@@ -270,9 +270,9 @@ module Ask
       # created without approval support. Use it to inspect pending actions
       # and approve/reject them.
       #
-      # @return [Ask::Agent::ApprovalQueue, nil]
+      # @return [Ask::Permissions::ApprovalQueue, nil]
       attr_reader :approval_queue
-      # @return [Ask::Agent::ApprovalQueue, nil] queue carrying plan
+      # @return [Ask::Permissions::ApprovalQueue, nil] queue carrying plan
       #   approvals (only when plan mode is enabled)
       attr_reader :plan_queue
       # @return [Ask::Agent::TodoList, nil] session task list (only when
@@ -904,12 +904,12 @@ end
 
         policy_opts = approval.is_a?(Hash) ? approval : {}
 
-        queue = if approval.is_a?(Ask::Agent::ApprovalQueue)
+        queue = if approval.is_a?(Ask::Permissions::ApprovalQueue)
           approval
-        elsif policy_opts[:queue].is_a?(Ask::Agent::ApprovalQueue)
+        elsif policy_opts[:queue].is_a?(Ask::Permissions::ApprovalQueue)
           policy_opts[:queue]
         else
-          Ask::Agent::ApprovalQueue.new(
+          Ask::Permissions::ApprovalQueue.new(
             auto_approve: policy_opts[:auto_approve],
             on_approve: ->(action) { apply_approved_action(action) },
             on_reject: ->(action) { reject_pending_action(action) }
@@ -934,7 +934,7 @@ end
           })
         }
 
-        policy = Ask::Agent::Policies::ApprovalPolicy.new(
+        policy = Ask::Permissions::ApprovalPolicy.new(
           queue: queue,
           require_approval: policy_opts[:require_approval],
           rules: policy_opts[:rules],

data/lib/ask/agent/version.rb

@@ -2,6 +2,6 @@
 
 module Ask
   module Agent
-    VERSION = "0.40.29"
+    VERSION = "0.40.30"
   end
 end

data/lib/ask/agent.rb

@@ -9,6 +9,7 @@ require "ask-llm-providers"
 require "ask-tools"
 require "ask-state-providers"
 require "ask-runtime"
+require "ask/permissions"
 
 module Ask
   module Agent
@@ -29,15 +30,12 @@ module Ask
     # swap them freely (see Ask::Agent::Hooks for the seam).
     #
     # A policy is NOT core machinery. Core mechanisms live on Session — the
-    # approval queue, the :pending result status, and the `approval: true`
-    # option are core; Policies::ApprovalPolicy is the reference
-    # classification policy wired on top of them.
+    # :pending result status and the `approval: true` option are core;
+    # Ask::Permissions::ApprovalPolicy (from the ask-permissions gem) is the
+    # reference classification policy wired on top of them.
     module Policies
-      autoload :Permissions, "ask/agent/policies/permissions"
       autoload :RateLimiter, "ask/agent/policies/rate_limiter"
       autoload :AuditLog, "ask/agent/policies/audit_log"
-      autoload :ApprovalPolicy, "ask/agent/policies/approval_policy"
-      autoload :PermissionRules, "ask/agent/policies/permission_rules"
     end
 
     autoload :ToolCallRepair, "ask/agent/tool_call_repair"
@@ -223,7 +221,6 @@ require_relative "agent/evaluator"
 require_relative "agent/tool_executor"
 require_relative "agent/compactor"
 require_relative "agent/hooks"
-require_relative "agent/approval_queue"
 require_relative "agent/configuration"
 require_relative "agent/meta_agent"
 require_relative "agent/persistence/base"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ask-agent
 version: !ruby/object:Gem::Version
-  version: 0.40.29
+  version: 0.40.30
 platform: ruby
 authors:
 - Kaka Ruto
@@ -135,6 +135,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 0.1.2
+- !ruby/object:Gem::Dependency
+  name: ask-permissions
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.1.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.1.0
 - !ruby/object:Gem::Dependency
   name: minitest
   requirement: !ruby/object:Gem::Requirement
@@ -192,7 +206,6 @@ files:
 - exe/askr
 - lib/ask-agent.rb
 - lib/ask/agent.rb
-- lib/ask/agent/approval_queue.rb
 - lib/ask/agent/artifact_store.rb
 - lib/ask/agent/chat.rb
 - lib/ask/agent/checkpoint_store.rb
@@ -221,11 +234,8 @@ files:
 - lib/ask/agent/output_read.rb
 - lib/ask/agent/persistence/base.rb
 - lib/ask/agent/persistence/in_memory.rb
-- lib/ask/agent/policies/approval_policy.rb
 - lib/ask/agent/policies/audit_log.rb
 - lib/ask/agent/policies/audit_log/active_record_writer.rb
-- lib/ask/agent/policies/permission_rules.rb
-- lib/ask/agent/policies/permissions.rb
 - lib/ask/agent/policies/rate_limiter.rb
 - lib/ask/agent/reflector.rb
 - lib/ask/agent/scheduler.rb

data/lib/ask/agent/approval_queue.rb

@@ -1,249 +0,0 @@
-# frozen_string_literal: true
-
-module Ask
-  module Agent
-    # A queue of tool actions awaiting human approval.
-    #
-    # When an agent calls a tool that requires approval, the action is queued
-    # instead of executed — the agent gets a pending result and continues.
-    # The user approves or rejects actions later, in bulk or one-by-one.
-    #
-    #   queue = Ask::Agent::ApprovalQueue.new
-    #   id = queue.submit(tool_call_id: "call_1", tool_name: "send_email",
-    #                     args: { "to" => "x@y.com" }, auto_approvable: false)
-    #   queue.pending_actions   # => [{id: 1, tool_name: "send_email", ...}]
-    #   queue.approve(1)        # applies action 1 via the on_approve callback
-    #   queue.reject(1)
-    #
-    # Auto-approval is a dual signal: the action must be marked
-    # +auto_approvable+ (by the tool) AND the queue must have a matching
-    # auto-approval rule enabled by the user. Otherwise the action queues for
-    # human review.
-    #
-    # Actions are applied in id order and the drainer never applies past a
-    # non-auto-approvable (manual) gate — nothing is silently approved.
-    class ApprovalQueue
-      # One queued action.
-      #
-      # @!attribute [r] id
-      #   @return [Integer] sequential id assigned by the queue
-      # @!attribute [r] tool_call_id
-      #   @return [String] the original tool call id from the LLM
-      # @!attribute [r] tool_name
-      #   @return [String] tool name
-      # @!attribute [r] args
-      #   @return [Hash] arguments to pass to the tool when applied
-      # @!attribute [r] auto_approvable
-      #   @return [Boolean] per-action verdict (tool's declaration)
-      # @!attribute [r] status
-      #   @return [Symbol] :pending, :applying, :approved, :rejected
-      # @!attribute [r] submitted_at
-      #   @return [Time]
-      # @!attribute [r] message
-      #   @return [String, nil] human-readable description of the action
-      Action = Data.define(:id, :tool_call_id, :tool_name, :args,
-                           :auto_approvable, :status, :submitted_at, :message)
-
-      # Create a new approval queue.
-      #
-      # @param on_approve [Proc, nil] called with an {Action} when it is
-      #   approved and applied. The session wires this to execute the real
-      #   tool call.
-      # @param on_reject [Proc, nil] called with an {Action} when it is
-      #   rejected. The session wires this to notify the conversation.
-      # @param auto_approve [Hash{String => Boolean}, nil] user-enabled
-      #   auto-approval rules keyed by tool name. An action is auto-applied
-      #   only when its tool is listed here with +true+ AND the action itself
-      #   is marked auto_approvable.
-      # @!attribute [rw] on_approve
-      #   Called with an {Action} when it is approved and applied. The
-      #   session wires this to execute the real tool call; can be replaced
-      #   after construction (e.g. by queue subclasses that also emit events).
-      # @!attribute [rw] on_reject
-      #   Called with an {Action} when it is rejected.
-      # @!attribute [rw] on_submit
-      #   Called with the new {Action} when it is submitted — BEFORE the
-      #   auto-approval drain runs, so subscribers can register the pending
-      #   call before it is applied. The session wires this to register the
-      #   pending tool call, closing the race where an approval lands while
-      #   the executor is still in flight.
-      attr_accessor :on_approve, :on_reject, :on_submit
-
-      def initialize(on_approve: nil, on_reject: nil, auto_approve: nil, on_submit: nil)
-        @on_approve = on_approve
-        @on_reject = on_reject
-        @on_submit = on_submit
-        @auto_approve = auto_approve || {}
-        @actions = {}
-        @next_id = 1
-        @mutex = Mutex.new
-        @draining = false
-      end
-
-      # Queue a tool action for approval.
-      #
-      # @param tool_call_id [String] original tool call id from the LLM
-      # @param tool_name [String] tool name
-      # @param args [Hash] arguments for the tool
-      # @param auto_approvable [Boolean] whether the tool permits auto-approval
-      # @param message [String, nil] human-readable description
-      # @return [Integer] the action id
-      def submit(tool_call_id:, tool_name:, args: {}, auto_approvable: false, message: nil)
-        action = @mutex.synchronize do
-          action = Action.new(
-            id: @next_id,
-            tool_call_id: tool_call_id,
-            tool_name: tool_name,
-            args: args || {},
-            auto_approvable: auto_approvable,
-            status: :pending,
-            submitted_at: Time.now,
-            message: message
-          )
-          @next_id += 1
-          @actions[action.id] = action
-          action
-        end
-
-        # Notify BEFORE the drain: an auto-approvable action is applied
-        # (and possibly completed) inside drain, and listeners need to
-        # observe the submission first.
-        @on_submit&.call(action)
-
-        drain
-        action.id
-      end
-
-      # All actions still awaiting a decision, in id order.
-      #
-      # @return [Array<Action>]
-      def pending_actions
-        @mutex.synchronize do
-          @actions.values.select { |a| a.status == :pending }.sort_by(&:id)
-        end
-      end
-
-      # @param id [Integer]
-      # @return [Boolean] whether the action is still awaiting a decision
-      def pending?(id)
-        @mutex.synchronize do
-          a = @actions[id]
-          a && a.status == :pending
-        end
-      end
-
-      # @return [Boolean] true while at least one action awaits a decision
-      def any_pending?
-        pending_actions.any?
-      end
-
-      # Look up an action by id.
-      #
-      # @param id [Integer]
-      # @return [Action, nil]
-      def [](id)
-        @mutex.synchronize { @actions[id] }
-      end
-
-      # Approve specific actions (by id), applying them in id order.
-      #
-      # @param ids [Array<Integer>]
-      # @return [Array<Action>] the actions that were approved
-      def approve(*ids)
-        actions = ids.flatten.filter_map { |id| @mutex.synchronize { @actions[id] } }
-        actions.select! { |a| a.status == :pending }
-        actions.sort_by!(&:id)
-        actions.each { |a| apply(a) }
-        actions
-      end
-
-      # Reject specific actions (by id).
-      #
-      # @param ids [Array<Integer>]
-      # @return [Array<Action>] the actions that were rejected
-      def reject(*ids)
-        actions = ids.flatten.filter_map { |id| @mutex.synchronize { @actions[id] } }
-        actions.select! { |a| a.status == :pending }
-        actions.sort_by!(&:id)
-        actions.each { |a| reject_action(a) }
-        actions
-      end
-
-      # Approve all currently pending actions, in id order.
-      #
-      # @return [Array<Action>]
-      def approve_all
-        approve(*pending_actions.map(&:id))
-      end
-
-      # Reject all currently pending actions, in id order.
-      #
-      # @return [Array<Action>]
-      def reject_all
-        reject(*pending_actions.map(&:id))
-      end
-
-      private
-
-      # Apply eligible pending actions in id order, stopping at the first
-      # action that is NOT auto-eligible (a manual gate) — nothing is
-      # silently applied past a human review point. Single-flight guard so
-      # concurrent drains cannot double-apply.
-      def drain
-        return if @mutex.synchronize { @draining }
-        @mutex.synchronize { @draining = true }
-
-        begin
-          loop do
-            action = @mutex.synchronize do
-              @actions.values.select { |a| a.status == :pending }
-                .sort_by(&:id)
-                .first
-            end
-            break unless action
-
-            if auto_approvable?(action)
-              apply(action)
-            else
-              break # manual gate — stop, never skip ahead
-            end
-          end
-        ensure
-          @mutex.synchronize { @draining = false }
-        end
-      end
-
-      def auto_approvable?(action)
-        action.auto_approvable && @auto_approve[action.tool_name] == true
-      end
-
-      def apply(action)
-        claimed = @mutex.synchronize do
-          return false unless action.status == :pending
-          @actions[action.id] = action.with(status: :applying)
-        end
-        @on_approve&.call(claimed)
-        @mutex.synchronize do
-          @actions[action.id] = claimed.with(status: :approved)
-        end
-        true
-      rescue StandardError
-        # Failed apply: leave the action pending so the user can retry or
-        # reject it. Re-raise so the caller (approve/drain) surfaces it.
-        @mutex.synchronize do
-          @actions[action.id] = action.with(status: :pending) if @actions[action.id]&.status == :applying
-        end
-        raise
-      end
-
-      def reject_action(action)
-        return false unless @mutex.synchronize { action.status == :pending }
-        @on_reject&.call(action)
-        @mutex.synchronize do
-          @actions[action.id] = action.with(status: :rejected)
-        end
-        true
-      end
-    end
-  end
-end

data/lib/ask/agent/policies/approval_policy.rb

@@ -1,114 +0,0 @@
-# frozen_string_literal: true
-
-module Ask
-  module Agent
-    module Policies
-      # Approval policy hook: classifies tool calls as approval-required and
-      # routes them into an {Ask::Agent::ApprovalQueue}.
-      #
-      # Wire it as a +before_tool+ hook on a Session (or enable it with
-      # `Session.new(approval: true)`), and any tool whose class declares
-      # `approval_required true` — or whose name matches the policy's
-      # rule-based lists — is queued for human approval instead of executed.
-      # The agent receives a pending result and continues; the tool runs only
-      # after a human approves it.
-      #
-      # @example
-      #   queue = Ask::Agent::ApprovalQueue.new
-      #   policy = Ask::Agent::Policies::ApprovalPolicy.new(queue: queue)
-      #   session = Ask::Agent::Session.new(
-      #     model: "gpt-4o",
-      #     tools: [SendEmail],
-      #     hooks: { before_tool: [policy.method(:before_tool_call)] }
-      #   )
-      #
-      #   # Later, when the user decides:
-      #   session.approval_queue.approve_all
-      class ApprovalPolicy
-        # @param queue [Ask::Agent::ApprovalQueue] the queue actions go into.
-        #   The queue owns the user-enabled auto-approval rules; this policy
-        #   only reports each tool's own declaration.
-        # @param require_approval [Array<String, Regexp>, :all, nil] extra
-        #   rule-based classification on top of the tool's own declaration.
-        #   Strings match tool names exactly, Regexps match against the name,
-        #   and :all requires approval for every tool call.
-        # @param rules [Ask::Agent::Policies::PermissionRules, nil] persisted
-        #   allow/ask/deny patterns. Rules classify first and take precedence
-        #   over tool declarations: :deny blocks, :allow proceeds without the
-        #   queue, :ask queues regardless of auto-approvable.
-        # @param tools [Array<Object>, nil] the session's resolved tool
-        #   instances, used to read class-level declarations
-        #   (`approval_required`, `auto_approvable`). When nil, only the
-        #   rule-based lists classify calls.
-        def initialize(queue:, require_approval: nil, rules: nil, tools: nil)
-          @queue = queue
-          @require_approval = require_approval
-          @rules = rules
-          @tools = Array(tools)
-        end
-
-        # Hook entry point — matches the +before_tool+ hook signature.
-        #
-        # @param tool_call [Ask::Agent::ToolCallInfo]
-        # @param _context [Hash]
-        # @return [Hash] {action: :proceed} to run, {action: :pending,
-        #   action_id:, reason:} to queue for approval, or {action: :block,
-        #   reason:} to refuse
-        def before_tool_call(tool_call, _context)
-          case @rules&.classify(tool_call.name, tool_call.arguments)
-          when :deny
-            return { action: :block, reason: "Denied by permission rules: '#{tool_call.name}'" }
-          when :allow
-            return { action: :proceed }
-          when :ask
-            return queue_for_approval(tool_call, auto_approvable: false)
-          end
-
-          return { action: :proceed } unless approval_required?(tool_call.name)
-
-          queue_for_approval(tool_call, auto_approvable: tool_auto_approvable?(tool_call.name))
-        end
-
-        private
-
-        def queue_for_approval(tool_call, auto_approvable:)
-          action_id = @queue.submit(
-            tool_call_id: tool_call.id,
-            tool_name: tool_call.name,
-            args: tool_call.arguments,
-            auto_approvable: auto_approvable,
-            message: "Calling \"#{tool_call.name}\" requires approval"
-          )
-
-          { action: :pending, action_id: action_id, reason: "Tool '#{tool_call.name}' requires approval" }
-        end
-
-        def approval_required?(tool_name)
-          return true if @require_approval == :all
-
-          rule_matches?(@require_approval, tool_name) || tool_declares_approval?(tool_name)
-        end
-
-        def rule_matches?(rules, tool_name)
-          Array(rules).any? do |rule|
-            rule == tool_name || (rule.is_a?(Regexp) && rule.match?(tool_name))
-          end
-        end
-
-        def tool_declares_approval?(tool_name)
-          tool = tool_for(tool_name)
-          tool&.respond_to?(:approval_required?) && tool.approval_required?
-        end
-
-        def tool_auto_approvable?(tool_name)
-          tool = tool_for(tool_name)
-          tool&.respond_to?(:auto_approvable?) && tool.auto_approvable?
-        end
-
-        def tool_for(tool_name)
-          @tools.find { |t| t.respond_to?(:name) && t.name == tool_name }
-        end
-      end
-    end
-  end
-end

data/lib/ask/agent/policies/permission_rules.rb

@@ -1,130 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-
-module Ask
-  module Agent
-    module Policies
-      # Persisted, matchable allow/ask/deny patterns for tool calls.
-      #
-      # Rules classify a tool call before it executes or prompts:
-      #
-      #   rules = Ask::Agent::Policies::PermissionRules.new do |r|
-      #     r.allow :bash, /^git (pull|push|status)/
-      #     r.ask   :bash, /^rm -rf/
-      #     r.deny  :write, %r{/\.env(\.local)?$}
-      #     r.ask   :destroy, :all
-      #   end
-      #
-      #   session = Ask::Agent::Session.new(
-      #     model: "gpt-4o",
-      #     approval: { rules: rules }
-      #   )
-      #
-      # Classification is first-match-wins, in declaration order: :allow runs
-      # the tool, :ask queues it for human approval, :deny blocks it. Rules
-      # take precedence over a tool's own `approval_required` / `auto_approvable`
-      # declarations — they are explicit user intent.
-      #
-      # Dangerous-rule guard: an :allow rule for a code-executing tool (bash,
-      # code, repl) whose argument pattern is unrestricted would let the model
-      # run anything without asking. Such rules are downgraded to :ask unless
-      # the ruleset was created with `auto_allow_dangerous: true` — "approve
-      # once, remember the pattern" must not become "approve everything".
-      class PermissionRules
-        # A single rule: tool pattern + optional argument pattern + decision.
-        Rule = Data.define(:tool_pattern, :argument_pattern, :decision) do
-          def matches?(tool_name, arguments)
-            tool_matches?(tool_name) && argument_matches?(arguments)
-          end
-
-          def tool_matches?(tool_name)
-            case tool_pattern
-            when :all then true
-            when Regexp then tool_pattern.match?(tool_name.to_s)
-            else tool_pattern.to_s == tool_name.to_s
-            end
-          end
-
-          def argument_matches?(arguments)
-            return true if argument_pattern.nil?
-
-            text = arguments.is_a?(Hash) ? JSON.generate(arguments) : arguments.to_s
-            case argument_pattern
-            when Regexp then argument_pattern.match?(text)
-            else text.include?(argument_pattern.to_s)
-            end
-          end
-
-          def universal?
-            argument_pattern.nil?
-          end
-        end
-
-        # Tools that execute arbitrary code — an unrestricted :allow rule on
-        # any of these is dangerous.
-        DANGEROUS_TOOLS = %i[bash code repl].freeze
-
-        # @param auto_allow_dangerous [Boolean] keep unrestricted :allow
-        #   rules on code-executing tools (default false — they downgrade to
-        #   :ask)
-        def initialize(auto_allow_dangerous: false, &block)
-          @auto_allow_dangerous = auto_allow_dangerous
-          @rules = []
-          instance_eval(&block) if block
-        end
-
-        # DSL — declare rules in priority order (first match wins).
-        def allow(tool_pattern, argument_pattern = nil)
-          add(:allow, tool_pattern, argument_pattern)
-        end
-
-        def ask(tool_pattern, argument_pattern = nil)
-          add(:ask, tool_pattern, argument_pattern)
-        end
-
-        def deny(tool_pattern, argument_pattern = nil)
-          add(:deny, tool_pattern, argument_pattern)
-        end
-
-        # @return [Array<Rule>] declared rules, in order
-        def rules = @rules.dup
-
-        # Classify a tool call.
-        #
-        # @param tool_name [String]
-        # @param arguments [Hash, String, nil] tool arguments (hash or JSON)
-        # @return [Symbol, nil] :allow, :ask, :deny — or nil when no rule
-        #   matches
-        def classify(tool_name, arguments = nil)
-          rule = @rules.find { |r| r.matches?(tool_name, arguments) }
-          return nil unless rule
-
-          if rule.decision == :allow && dangerous?(rule) && !@auto_allow_dangerous
-            :ask
-          else
-            rule.decision
-          end
-        end
-
-        # @return [Array<Rule>] rules that would allow unrestricted execution
-        #   of a code-executing tool
-        def dangerous_rules
-          @rules.select { |r| dangerous?(r) }
-        end
-
-        private
-
-        def add(decision, tool_pattern, argument_pattern)
-          @rules << Rule.new(tool_pattern, argument_pattern, decision)
-        end
-
-        def dangerous?(rule)
-          return false unless rule.decision == :allow && rule.universal?
-
-          rule.tool_pattern == :all || DANGEROUS_TOOLS.any? { |t| rule.tool_matches?(t) }
-        end
-      end
-    end
-  end
-end

data/lib/ask/agent/policies/permissions.rb

@@ -1,86 +0,0 @@
-# frozen_string_literal: true
-
-module Ask
-  module Agent
-    module Policies
-      class Permissions
-        DEFAULT_TOOLS = %i[write edit bash destroy].freeze
-
-        ACCESS_MODES = {
-          full_access:       { blocked_tools: [] }.freeze,
-          ask_before_changes: { blocked_tools: DEFAULT_TOOLS }.freeze,
-          read_only:         { blocked_tools: %i[write edit bash destroy] }.freeze
-        }.freeze
-
-        def initialize(mode: nil, blocked_tools: nil, timeout: nil)
-          @mode = mode
-          @timeout = timeout
-          @pending = {}
-          @mutex = Mutex.new
-
-          @blocked_tools = if mode
-            config = ACCESS_MODES[mode]
-            raise ArgumentError, "Unknown access mode: #{mode.inspect}. Valid: #{ACCESS_MODES.keys.join(', ')}" unless config
-            config[:blocked_tools].dup
-          elsif blocked_tools
-            Array(blocked_tools).map(&:to_sym)
-          else
-            DEFAULT_TOOLS.dup
-          end
-        end
-
-        def before_tool_call(tool_call, _context)
-          return { action: :proceed } unless @blocked_tools.include?(tool_call.name.to_sym)
-
-          if approved?(tool_call)
-            { action: :proceed }
-          else
-            request_approval(tool_call)
-          end
-        end
-
-        def approve(tool_call_id)
-          @mutex.synchronize do
-            entry = @pending[tool_call_id]
-            return false unless entry
-            entry[:approved] = true
-          end
-        end
-
-        def pending_approvals
-          @mutex.synchronize { @pending.values.reject { |e| e[:approved] } }
-        end
-
-        private
-
-        def approved?(tool_call)
-          @mutex.synchronize do
-            key = tool_call.id
-            entry = @pending[key]
-            return false unless entry
-
-            if @timeout && (Time.now - entry[:created_at]) > @timeout
-              @pending.delete(key)
-              return false
-            end
-
-            entry[:approved]
-          end
-        end
-
-        def request_approval(tool_call)
-          @mutex.synchronize do
-            @pending[tool_call.id] = {
-              tool_call: tool_call,
-              approved: false,
-              created_at: Time.now
-            }
-          end
-
-          warn "[Permissions] Tool '#{tool_call.name}' requires approval. Call approve('#{tool_call.id}') to allow."
-          { action: :block, reason: "Tool '#{tool_call.name}' requires approval" }
-        end
-      end
-    end
-  end
-end