@a2f0/agent-tool 0.1.27 → 0.1.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@a2f0/agent-tool",
-  "version": "0.1.27",
+  "version": "0.1.28",
   "packageManager": "bun@1.4.3",
   "type": "module",
   "description": "Portable cross-agent review, PR workflows, and shared skills",

package/src/permissions/catalog.ts

@@ -40,7 +40,7 @@ export const CATALOG: CatalogEntry[] = [
 // `bun x` runs only executables that `permissions.executables` classifies; project.ts adds those.
 // Package scripts are not classified, so `bun run` keeps the harness default.
 
-/** Direct spellings of classified actions. Asking here keeps a raw command from bypassing its agent-tool form. */
+/** Direct spellings of classified actions. Codex prompts for them, so a raw command cannot bypass its agent-tool form. */
 export const GUARDS: { command: string; class: PermissionClass }[] = [
   ...["bun add", "bun a", "npm install", "npm i", "npm add", "pnpm add", "yarn add", "bunx", "bun x", "npx"].map(command => ({ command, class: "intake" as const })),
   ...["gh pr merge", "npm publish", "bun publish"].map(command => ({ command, class: "release" as const })),
@@ -56,18 +56,25 @@ export function strictest(entry: CatalogEntry): PermissionClass {
 
 export interface ClaudePermissions { allow: string[]; ask: string[] }
 
-/** Claude Code matches `*` across spaces and splits compound commands before matching. */
+/**
+ * Claude Code matches `*` across spaces and splits compound commands before matching.
+ * Only allow rules are generated: Claude Code prompts for an explicit ask rule in every
+ * mode, bypassPermissions included, so a committed ask rule would override each user's
+ * chosen mode. Classes that ask stay unlisted, so Manual mode prompts for them and auto
+ * mode leaves them to the classifier. `ask` stays empty so that reinstalling removes the
+ * ask rules earlier versions recorded.
+ */
 export function claudePermissions(project: CatalogEntry[] = []): ClaudePermissions {
-  const rules: ClaudePermissions = { allow: [], ask: [] };
+  const allow: string[] = [];
   for (const invocation of INVOCATIONS) {
     for (const entry of [...CATALOG, ...project]) {
+      // An allow rule also matches the `--apply` form, so a command whose `--apply` form asks gets none.
+      if (CLASSES[strictest(entry)].decision !== "allow") continue;
       const base = `${invocation} ${entry.command}`;
-      rules[CLASSES[entry.class].decision].push(entry.command.startsWith("--") ? `Bash(${base})` : `Bash(${base} *)`);
-      if (entry.applyClass && CLASSES[entry.applyClass].decision !== CLASSES[entry.class].decision) rules[CLASSES[entry.applyClass].decision].push(`Bash(${base} *--apply*)`);
+      allow.push(entry.command.startsWith("--") ? `Bash(${base})` : `Bash(${base} *)`);
     }
   }
-  for (const guard of GUARDS) rules[CLASSES[guard.class].decision].push(`Bash(${guard.command} *)`);
-  return rules;
+  return { allow, ask: [] };
 }
 
 const quote = (value: string) => JSON.stringify(value);

package/src/permissions/install.ts

@@ -69,7 +69,9 @@ function mergedSettings(settings: Settings, previous: ClaudePermissions | undefi
   for (const key of ["allow", "ask"] as const) {
     const owned = new Set(previous?.[key] ?? []);
     const kept = ((permissions[key] as string[] | undefined) ?? []).filter(item => !owned.has(item) && !current[key].includes(item));
-    permissions[key] = [...kept, ...current[key]];
+    const merged = [...kept, ...current[key]];
+    if (merged.length) permissions[key] = merged;
+    else delete permissions[key];
   }
   return { ...settings, permissions };
 }