ask-agent 0.30.1 → 0.31.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cf67fcc30605c8d4752a97133a13a7fbe500c32a68c47640552bc30cf6dbea5b
-  data.tar.gz: 638931a8c1c2c5ae0ca5535e9e78e9252910106af9134366a455523925b6d895
+  metadata.gz: e039a90d18224ab29b454dd2094a81628ddf80cc39938419038378182ecbe472
+  data.tar.gz: 8d6d1a8005d2451469a998d36061adea945245beef774876b5b5bc1565f8fd5a
 SHA512:
-  metadata.gz: 01ca01b502aa5789eef910f50626085bb6675e86dedd435b189b0e928d592ac27c48c145ff5c159580c2a9854528160c86074031dccd971b033b75b6f42bf3fa
-  data.tar.gz: 6bf3ebc3428cf64c8a1ee7e958e45c349669e4eaba92a8bc5d90b522f0b9a47d4f3743570db235b8d9b4e526d3ea470eb1a81795acc6492fd67afda4b59d9b70
+  metadata.gz: 014b65f0247e65970d3d4fa7496744aa7d38f00f2684c53ff02f74ec5c547b6534c906b24dc6594387069e5034b1916e7f4e3a2986c6bf55e42412177ac7a678
+  data.tar.gz: 72f571ba1ffafca8f9e9f181d51891ce9ea315e4ca5ebc15e1bf27557e8c05faf9ed6f3136a0a88a124f6833f096b5bb7d6cc9d7db9b32bc1dc0a27eb6cff1a9

data/CHANGELOG.md

@@ -1,3 +1,24 @@
+## [0.31.0] — 2026-08-06
+
+### Added
+
+- **Permission rules — persisted allow/ask/deny patterns for tool calls.**
+  `Ask::Agent::Policies::PermissionRules` classifies every call before it
+  executes or prompts, so "approve once, remember the pattern" replaces
+  per-call prompting:
+  - DSL in declaration order (first match wins): `allow`, `ask`, `deny`
+    with a tool pattern (String, Symbol, Regexp, or `:all`) and an optional
+    argument pattern (Regexp, substring, or `nil` for any).
+  - Wire in via `Session.new(approval: { rules: rules })`. Rules take
+    precedence over a tool's own `approval_required` / `auto_approvable`
+    declarations: `:deny` blocks, `:allow` proceeds without the queue,
+    `:ask` queues regardless of auto-approvable.
+  - **Dangerous-rule guard**: an unrestricted `:allow` on a code-executing
+    tool (`bash`, `code`, `repl`, or `:all`) is downgraded to `:ask` unless
+    the ruleset is created with `auto_allow_dangerous: true` — "approve
+    once" can't become "approve anything". `dangerous_rules` reports which
+    rules were affected.
+
 ## [0.30.1] — 2026-08-06
 
 ### Fixed

data/lib/ask/agent/policies/approval_policy.rb

@@ -32,13 +32,18 @@ module Ask
         #   rule-based classification on top of the tool's own declaration.
         #   Strings match tool names exactly, Regexps match against the name,
         #   and :all requires approval for every tool call.
+        # @param rules [Ask::Agent::Policies::PermissionRules, nil] persisted
+        #   allow/ask/deny patterns. Rules classify first and take precedence
+        #   over tool declarations: :deny blocks, :allow proceeds without the
+        #   queue, :ask queues regardless of auto-approvable.
         # @param tools [Array<Object>, nil] the session's resolved tool
         #   instances, used to read class-level declarations
         #   (`approval_required`, `auto_approvable`). When nil, only the
         #   rule-based lists classify calls.
-        def initialize(queue:, require_approval: nil, tools: nil)
+        def initialize(queue:, require_approval: nil, rules: nil, tools: nil)
           @queue = queue
           @require_approval = require_approval
+          @rules = rules
           @tools = Array(tools)
         end
 
@@ -46,12 +51,27 @@ module Ask
         #
         # @param tool_call [Ask::Agent::ToolCallInfo]
         # @param _context [Hash]
-        # @return [Hash] {action: :proceed} to run, or
-        #   {action: :pending, action_id:, reason:} to queue for approval
+        # @return [Hash] {action: :proceed} to run, {action: :pending,
+        #   action_id:, reason:} to queue for approval, or {action: :block,
+        #   reason:} to refuse
         def before_tool_call(tool_call, _context)
+          case @rules&.classify(tool_call.name, tool_call.arguments)
+          when :deny
+            return { action: :block, reason: "Denied by permission rules: '#{tool_call.name}'" }
+          when :allow
+            return { action: :proceed }
+          when :ask
+            return queue_for_approval(tool_call, auto_approvable: false)
+          end
+
           return { action: :proceed } unless approval_required?(tool_call.name)
 
-          auto_approvable = tool_auto_approvable?(tool_call.name)
+          queue_for_approval(tool_call, auto_approvable: tool_auto_approvable?(tool_call.name))
+        end
+
+        private
+
+        def queue_for_approval(tool_call, auto_approvable:)
           action_id = @queue.submit(
             tool_call_id: tool_call.id,
             tool_name: tool_call.name,
@@ -63,8 +83,6 @@ module Ask
           { action: :pending, action_id: action_id, reason: "Tool '#{tool_call.name}' requires approval" }
         end
 
-        private
-
         def approval_required?(tool_name)
           return true if @require_approval == :all
 

data/lib/ask/agent/policies/permission_rules.rb

@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Ask
+  module Agent
+    module Policies
+      # Persisted, matchable allow/ask/deny patterns for tool calls.
+      #
+      # Rules classify a tool call before it executes or prompts:
+      #
+      #   rules = Ask::Agent::Policies::PermissionRules.new do |r|
+      #     r.allow :bash, /^git (pull|push|status)/
+      #     r.ask   :bash, /^rm -rf/
+      #     r.deny  :write, %r{/\.env(\.local)?$}
+      #     r.ask   :destroy, :all
+      #   end
+      #
+      #   session = Ask::Agent::Session.new(
+      #     model: "gpt-4o",
+      #     approval: { rules: rules }
+      #   )
+      #
+      # Classification is first-match-wins, in declaration order: :allow runs
+      # the tool, :ask queues it for human approval, :deny blocks it. Rules
+      # take precedence over a tool's own `approval_required` / `auto_approvable`
+      # declarations — they are explicit user intent.
+      #
+      # Dangerous-rule guard: an :allow rule for a code-executing tool (bash,
+      # code, repl) whose argument pattern is unrestricted would let the model
+      # run anything without asking. Such rules are downgraded to :ask unless
+      # the ruleset was created with `auto_allow_dangerous: true` — "approve
+      # once, remember the pattern" must not become "approve everything".
+      class PermissionRules
+        # A single rule: tool pattern + optional argument pattern + decision.
+        Rule = Data.define(:tool_pattern, :argument_pattern, :decision) do
+          def matches?(tool_name, arguments)
+            tool_matches?(tool_name) && argument_matches?(arguments)
+          end
+
+          def tool_matches?(tool_name)
+            case tool_pattern
+            when :all then true
+            when Regexp then tool_pattern.match?(tool_name.to_s)
+            else tool_pattern.to_s == tool_name.to_s
+            end
+          end
+
+          def argument_matches?(arguments)
+            return true if argument_pattern.nil?
+
+            text = arguments.is_a?(Hash) ? JSON.generate(arguments) : arguments.to_s
+            case argument_pattern
+            when Regexp then argument_pattern.match?(text)
+            else text.include?(argument_pattern.to_s)
+            end
+          end
+
+          def universal?
+            argument_pattern.nil?
+          end
+        end
+
+        # Tools that execute arbitrary code — an unrestricted :allow rule on
+        # any of these is dangerous.
+        DANGEROUS_TOOLS = %i[bash code repl].freeze
+
+        # @param auto_allow_dangerous [Boolean] keep unrestricted :allow
+        #   rules on code-executing tools (default false — they downgrade to
+        #   :ask)
+        def initialize(auto_allow_dangerous: false, &block)
+          @auto_allow_dangerous = auto_allow_dangerous
+          @rules = []
+          instance_eval(&block) if block
+        end
+
+        # DSL — declare rules in priority order (first match wins).
+        def allow(tool_pattern, argument_pattern = nil)
+          add(:allow, tool_pattern, argument_pattern)
+        end
+
+        def ask(tool_pattern, argument_pattern = nil)
+          add(:ask, tool_pattern, argument_pattern)
+        end
+
+        def deny(tool_pattern, argument_pattern = nil)
+          add(:deny, tool_pattern, argument_pattern)
+        end
+
+        # @return [Array<Rule>] declared rules, in order
+        def rules = @rules.dup
+
+        # Classify a tool call.
+        #
+        # @param tool_name [String]
+        # @param arguments [Hash, String, nil] tool arguments (hash or JSON)
+        # @return [Symbol, nil] :allow, :ask, :deny — or nil when no rule
+        #   matches
+        def classify(tool_name, arguments = nil)
+          rule = @rules.find { |r| r.matches?(tool_name, arguments) }
+          return nil unless rule
+
+          if rule.decision == :allow && dangerous?(rule) && !@auto_allow_dangerous
+            :ask
+          else
+            rule.decision
+          end
+        end
+
+        # @return [Array<Rule>] rules that would allow unrestricted execution
+        #   of a code-executing tool
+        def dangerous_rules
+          @rules.select { |r| dangerous?(r) }
+        end
+
+        private
+
+        def add(decision, tool_pattern, argument_pattern)
+          @rules << Rule.new(tool_pattern, argument_pattern, decision)
+        end
+
+        def dangerous?(rule)
+          return false unless rule.decision == :allow && rule.universal?
+
+          rule.tool_pattern == :all || DANGEROUS_TOOLS.any? { |t| rule.tool_matches?(t) }
+        end
+      end
+    end
+  end
+end

data/lib/ask/agent/session.rb

@@ -555,6 +555,7 @@ module Ask
         policy = Ask::Agent::Policies::ApprovalPolicy.new(
           queue: queue,
           require_approval: policy_opts[:require_approval],
+          rules: policy_opts[:rules],
           tools: @tools
         )
 

data/lib/ask/agent/version.rb

@@ -2,6 +2,6 @@
 
 module Ask
   module Agent
-    VERSION = "0.30.1"
+    VERSION = "0.31.0"
   end
 end

data/lib/ask/agent.rb

@@ -35,6 +35,7 @@ module Ask
       autoload :RateLimiter, "ask/agent/policies/rate_limiter"
       autoload :AuditLog, "ask/agent/policies/audit_log"
       autoload :ApprovalPolicy, "ask/agent/policies/approval_policy"
+      autoload :PermissionRules, "ask/agent/policies/permission_rules"
     end
 
     autoload :ToolCallRepair, "ask/agent/tool_call_repair"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ask-agent
 version: !ruby/object:Gem::Version
-  version: 0.30.1
+  version: 0.31.0
 platform: ruby
 authors:
 - Kaka Ruto
@@ -189,6 +189,7 @@ files:
 - lib/ask/agent/policies/approval_policy.rb
 - lib/ask/agent/policies/audit_log.rb
 - lib/ask/agent/policies/audit_log/active_record_writer.rb
+- lib/ask/agent/policies/permission_rules.rb
 - lib/ask/agent/policies/permissions.rb
 - lib/ask/agent/policies/rate_limiter.rb
 - lib/ask/agent/reflector.rb