@adeildo/pi-ask-permission 4.1.0 → 5.1.0

package/CONTRIBUTING.md

@@ -19,7 +19,7 @@ src/
   core/         # policy and judging, no pi and no TUI
     config/     # schema, decode, store, patterns
     judge/      # pipeline, compose, request, policy, backends
-  ui/           # TUI: dialog, selector, settings, judge entry
+  ui/           # the permission question for the questions dialog, the host selector, the judge entry
   util/         # decoders and primitives
 ```
 

package/README.md

@@ -3,19 +3,16 @@
 <p align="center">
   <a href="https://github.com/felipeadeildo/pi-harness/actions/workflows/ci.yml"><img src="https://github.com/felipeadeildo/pi-harness/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
   <a href="https://www.npmjs.com/package/@adeildo/pi-ask-permission"><img src="https://img.shields.io/npm/v/@adeildo/pi-ask-permission" alt="npm"></a>
-  <a href="https://www.npmjs.com/package/@adeildo/pi-ask-permission"><img src="https://img.shields.io/npm/dm/@adeildo/pi-ask-permission" alt="downloads"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="license"></a>
-  <a href="https://www.npmjs.com/package/@adeildo/pi-ask-permission"><img src="https://img.shields.io/badge/provenance-signed-success" alt="provenance"></a>
-  <a href="https://pi.dev/packages/@adeildo/pi-ask-permission"><img src="https://img.shields.io/badge/pi--package-6E56CF" alt="pi package"></a>
   <a href="https://pi.dev"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fraw.githubusercontent.com%2Ffelipeadeildo%2Fpi-harness%2Fmain%2Fpackage.json&query=%24.devDependencies%5B%22%40earendil-works%2Fpi-coding-agent%22%5D&label=pi%20SDK&color=6E56CF" alt="pi SDK"></a>
 </p>
 
 Pi runs every tool call without asking. This extension asks first.
 
-Answer `yes`, `always yes`, or `deny`, and add a note if you want. The note reaches the model with the result, so denying `npm install` with `use pnpm instead` corrects the agent without stopping it.
+Answer `yes`, `always yes` or `no`, and leave a note if you want. The note reaches the model with the result, so denying `npm install` with "use pnpm instead" corrects the agent without stopping it. A judge model can answer the routine calls for you, so you only see the ones it doubts.
 
 <p align="center">
-  <img src="https://raw.githubusercontent.com/felipeadeildo/pi-harness/main/packages/ask-permission/assets/preview.png" alt="The permission dialog for npm install, with the judge card above it and a note typed on the deny row: use pnpm instead." width="860">
+  <img src="https://raw.githubusercontent.com/felipeadeildo/pi-harness/main/packages/ask-permission/assets/preview.png" alt="The permission dialog for npm install, with the reason it asks, the three answers, and a note on no: use pnpm instead." width="860">
 </p>
 
 ## Install
@@ -24,56 +21,63 @@ Answer `yes`, `always yes`, or `deny`, and add a note if you want. The note reac
 pi install npm:@adeildo/pi-ask-permission
 ```
 
-Then start pi as usual. There is nothing to configure. It also comes in [`@adeildo/pi-harness`](../harness), with the rest of the pieces.
+There is nothing to configure, and the dialog comes with it. It also comes in [`@adeildo/pi-harness`](../harness), with the rest of the pieces.
 
-`pi-ask-permission` on npm is this same extension under an older name, and it reads the same config, grants and sessions. To switch:
+`pi-ask-permission` on npm is this same extension under an older name, and it reads the same settings, grants and sessions. To switch, run `pi remove npm:pi-ask-permission` and install this one.
 
-```bash
-pi remove npm:pi-ask-permission
-pi install npm:@adeildo/pi-ask-permission
-```
-
-## First run
+## The dialog
 
 Ask the agent to do something that writes, like `run the tests`. The dialog opens before the command runs:
 
-```
-╭─ permission · bash ──────────────────────────────────╮
-│ pnpm test                                            │
-│                                                      │
-│ ❯ 1  yes                                             │
-│   2  always yes                                      │
-│   3  deny                                            │
-│                                                      │
-│ ↑↓ or 1-3 pick   enter confirm   tab note   esc deny │
-╰──────────────────────────────────────────────────────╯
+<!-- docs:ask-permission/ask -->
+
+```text
+╭─ permission ─────────────────────────────────────────────────────────────────────────────────────╮
+│                                                                                                  │
+│ ▎ bash wants to run:                                                                             │
+│ ▎   npm install                                                                                  │
+│ ▎                                                                                                │
+│ ▎ ▲ the judge leaned deny but was only 61% confident                                             │
+│                                                                                                  │
+│   1  yes, run it                    │ Block it. A note on this answer becomes the reason the     │
+│   2  always yes                     │ model reads.                                               │
+│ ❯ 3  no ›                           │                                                            │
+│                                     │ › use pnpm instead                                         │
+│                                                                                                  │
+│ ↑↓ move   enter choose   tab note   esc cancel                                                   │
+╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
 ```
 
-`enter` approves. `esc` denies. `tab` opens a note on the highlighted row.
+<!-- /docs -->
 
-Reads inside the project never ask. `read`, `grep`, `find`, `ls`, and bash commands that only read, like `cat`, `git log`, or `rg`, run on their own. An `edit` or `write` shows the diff it would make.
+`enter` picks the highlighted answer and `esc` cancels, which denies. `tab` writes a note on the highlighted answer, and the note on `no` is the reason the model reads. A command longer than three lines shows its first three and how many are left.
 
-## Everyday use
+Reads inside the project never ask: `read`, `grep`, `find`, `ls`, and bash commands that only read, like `cat`, `git log` or `rg`. An `edit` or `write` shows the diff it would make.
 
-### Stop answering the same question
+This is the dialog of [`@adeildo/pi-ask-questions`](../ask-questions), which comes with this package, so the permission ask and the model's questions share the same keys and notes. If you switch that feature off in `pi config`, and in RPC hosts that cannot draw a terminal component, Pi asks through its own selector, with the same answers and no panel.
 
-Pick `always yes`, then choose how much to remember and for how long:
+## Stop answering the same question
 
+Pick `always yes` and it asks what to remember, then for how long:
+
+<!-- docs:ask-permission/remember -->
+
+```text
+╭─ remember ───────────────────────────────────────────────────────────────────────────────────────╮
+│                                                                                                  │
+│ ▎ Always say yes to which calls, from bash?                                                      │
+│                                                                                                  │
+│ ❯ 1  pnpm test                     │ Only this exact call.                                       │
+│   2  pnpm                          │                                                             │
+│                                    │                                                             │
+│                                                                                                  │
+│ ↑↓ move   enter choose   tab note   esc cancel                                                   │
+╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
 ```
-╭─ permission · bash ──────────────────────────────────╮
-│ pnpm test                                            │
-│                                                      │
-│ always yes for...                                    │
-│   pnpm                                               │
-│ ❯ pnpm test                                          │
-│                                                      │
-│ scope: this session   (tab to change)                │
-│                                                      │
-│ ↑↓ depth   tab scope   enter confirm   esc back      │
-╰──────────────────────────────────────────────────────╯
-```
 
-We recommend the narrowest level, which is preselected. `pnpm` would also approve `pnpm publish`.
+<!-- /docs -->
+
+The first option is the narrowest, and that is the one to prefer: `pnpm` would also approve `pnpm publish`.
 
 | Scope        | Lasts                                    | Stored in                                                  |
 | ------------ | ---------------------------------------- | ---------------------------------------------------------- |
@@ -81,36 +85,81 @@ We recommend the narrowest level, which is preselected. `pnpm` would also approv
 | this project | every session in this project            | `.pi/extensions/pi-ask-permission/always-yes.json`         |
 | everywhere   | every session                            | `~/.pi/agent/extensions/pi-ask-permission/always-yes.json` |
 
-Run `/perm forget` to drop this session's, or `/perm forget project` for the project's.
+The `Always yes` section of the settings (`Alt+S`) shows how many rules each scope holds, and forgets them.
+
+## Let the agent work
+
+`Alt+M` switches modes, and the status bar shows the one you are in.
+
+| Mode     | Runs without asking                                                        |
+| -------- | -------------------------------------------------------------------------- |
+| `manual` | reads (`allow` and read-only bash) and always yes                          |
+| `edits`  | the same, plus file edits and writes                                       |
+| `judge`  | the same as `edits`, and the [judge](#let-a-model-decide) decides the rest |
+| `full`   | everything                                                                 |
 
-### Let the agent work
+The workspace comes before the mode. A call outside `workspace.roots` asks you in every mode, even `full`. `Alt+W` lets calls outside through for this session, and a second press puts the check back. The status bar shows `anywhere` in red while it is off. A resumed session keeps its mode and its `Alt+W` choice.
 
-Press `Alt+M` to switch modes. The status bar shows the one you are in.
+### A folder next door
+
+In a monorepo, a session in `apps/api` that reads `apps/web` leaves the workspace. The dialog says so and offers to open the repository for reads:
+
+<!-- docs:ask-permission/folder -->
+
+```text
+╭─ permission ─────────────────────────────────────────────────────────────────────────────────────╮
+│                                                                                                  │
+│ ▎ bash wants to run:                                                                             │
+│ ▎   cd ~/Projects/grace/apps/web && git status --short | head                                    │
+│ ▎                                                                                                │
+│ ▎ ▲ reads outside the workspace                                                                  │
+│                                                                                                  │
+│   1  yes, run it                            │ yes, and allow reads in /home/me/Projects/grace    │
+│   2  always yes                             │                                                    │
+│ ❯ 3  yes, and allow reads in /home/me/Proj… │ Run it, and let later calls read there without     │
+│   4  no                                     │ asking.                                            │
+│                                             │                                                    │
+│                                             │                                                    │
+│                                                                                                  │
+│ ↑↓ move   enter choose   tab note   esc cancel                                                   │
+╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
+```
 
-| Mode           | Runs without asking                  |
-| -------------- | ------------------------------------ |
-| `manual`       | nothing beyond reads and always yes  |
-| `accept edits` | file edits and writes in the project |
-| `auto`         | everything in the project            |
+<!-- /docs -->
 
-A call that leaves the project still asks, in every mode. The mode lasts for the session and never changes the settings file.
+Take it and the next reads there run without asking, for as long as you choose. A write outside gets `yes, and add … to the workspace` instead. A folder opened for reads never lets a write through, and the dialog never offers your home or a folder above it. The status bar counts the open folders, like `+1 folder`, and the `Folders` section of the settings closes them.
 
-### Correct the agent
+### Calls to an MCP server
 
-A note on `deny` tells the agent what to do instead. A note on `yes` adds context, like `and update the snapshot`. Both reach the model with the tool result.
+Pi registers each tool an MCP server offers as `mcp__<server>__<tool>`. The settings have a row per server, and each follows a policy:
 
-If you are typing in the editor when a call arrives, the dialog waits until you pause.
+| Policy        | Runs without asking                                                        |
+| ------------- | -------------------------------------------------------------------------- |
+| `ask me`      | Nothing, in any mode. Every call comes to you                              |
+| `trust hints` | A call the server declares read-only. The rest follows the mode you are in |
+| `allow`       | Every call                                                                 |
+| `deny`        | Nothing. Every call is blocked, whatever the mode says                     |
+
+`trust hints` is the default, and the hint is what the server claims about its own tool. Pi does not verify it, so a server you do not fully trust belongs on `ask me`. `deny` and `ask me` outrank the mode, `full` included. The dialog names the server, repeats what it declares, and says when a script issued the call.
 
 ## Let a model decide
 
-The judge answers first, and only the calls it is unsure about reach you. It is off by default. We recommend this setup:
+In the `judge` mode a model answers every call that is not a read or an edit, and you only see the ones it is unsure about. A good way in:
 
 1. Run `/login typesafe` to use Jev, a fast model that answers with a confidence. Any model you set up in pi works too.
-2. Open `/perm`, turn on `Judge`, and turn on `Dry run`. The judge now shows its verdict as a card, and you still decide.
-3. Pick a policy. `Standard development` allows edits, tests, builds, and local git, and asks about installs, network, and anything destructive.
+2. Switch to `judge` with `Alt+M`, open the settings with `Alt+S`, and turn on `Dry run` in `Judge`. The judge now shows its verdict as a card, and you still decide.
+3. Pick a policy. `Standard development` allows edits, tests, builds and local git, and asks about installs, network and anything destructive.
 4. After a few sessions of agreeing with it, turn off `Dry run`.
 
-The policy is plain text, so you can start from a preset and edit it:
+A call runs when the judge approves it with at least the confidence of the rigor you picked, and its risk stays under the ceiling. Anything else asks you.
+
+| Rigor                  | Confidence | Risk ceiling |
+| ---------------------- | ---------- | ------------ |
+| `cautious`             | 85%        | 0.45         |
+| `balanced`, by default | 70%        | 0.50         |
+| `relaxed`              | 55%        | 0.60         |
+
+The policy is plain text, so start from a preset and edit it:
 
 ```text
 # May run without asking
@@ -125,146 +174,18 @@ The policy is plain text, so you can start from a preset and edit it:
 Ask me.
 ```
 
-If calls come back as `the judge could not decide`, run `/perm judge test`. It sends one request and reports the model, the latency, and the error.
-
-## Commands
-
-Type `/perm ` and the editor suggests the rest.
-
-| Command                | Does                                                        |
-| ---------------------- | ----------------------------------------------------------- |
-| `/perm`                | Open the settings                                           |
-| `/perm mode`           | Switch to the next mode (also `Alt+M`)                      |
-| `/perm mode auto`      | Switch to a mode (also `manual`, `accept-edits`)            |
-| `/perm status`         | Show the config, always yes, and file paths                 |
-| `/perm forget`         | Forget this session's always yes                            |
-| `/perm forget project` | Forget this project's always yes (also `everywhere`, `all`) |
-| `/perm judge on`       | Turn the judge on (also `off`)                              |
-| `/perm judge log`      | Show this session's judge decisions                         |
-| `/perm judge test`     | Send one real request and report what happened              |
-
-## Reference
-
-### Dialog keys
-
-| Key                    | Does                                                 |
-| ---------------------- | ---------------------------------------------------- |
-| `↑` `↓` or `1` `2` `3` | Move the highlight                                   |
-| `enter`                | Confirm the highlighted row                          |
-| `tab`                  | Open or close a note, or change the always yes scope |
-| `esc`                  | Close the note, or deny                              |
-| `ctrl+v`               | Paste a clipboard image as its file path             |
-
-A long paste collapses to `[paste #1 +48 lines]` and expands when you confirm.
+`Always ask me` lists patterns the judge never approves, like `git push*`. The judge also reads your last message to tell whether a call is a step of what you asked, but nothing in the message overrides the policy or `Always ask me`. If calls come back as `the judge could not decide`, run `Test the judge` in the `Judge` section: it sends one request and reports the model, the latency and the error.
 
-### Configuration
-
-The settings live in the file every piece shares, `~/.pi/agent/extensions/pi-harness/settings.json`, under a `permission.` prefix. Every key has a row of the same name in `/perm`, and only what you change is written, so a new default reaches you.
-
-```json
-{
-	"permission": {
-		"allow": ["read", "grep", "find", "ls"],
-		"mode": "manual",
-		"readOnlyBash": true,
-		"workspace": { "roots": ["."], "outside": "ask" },
-		"judge": { "enabled": false, "model": "jev-latest" }
-	}
-}
-```
-
-The ids below leave out the `permission.` prefix.
-
-| Key                 | Does                                                                                                                                   |
-| ------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
-| `allow`             | Tools that never ask. `mcp_*` matches a family. It matches the tool name, so `bash` allows every command                               |
-| `mode`              | The mode a new session starts in                                                                                                       |
-| `readOnlyBash`      | Run bash commands that only read without asking                                                                                        |
-| `notes`             | `"result"` adds a note to the tool result. `"message"` sends it as its own message                                                     |
-| `noUI`              | `"allow"` or `"deny"` when nobody can answer, as in print mode or a subagent. Takes a per-tool map: `{ "*": "allow", "bash": "deny" }` |
-| `workspace.roots`   | Paths that count as the project. Relative, absolute, and `~` work                                                                      |
-| `workspace.outside` | A call outside the roots: `"ask"` you, `"deny"` it, or `"allow"` it like any other                                                     |
-| `typing.pause`      | Milliseconds of quiet before the dialog opens while you type                                                                           |
-| `typing.maxWait`    | The longest the dialog waits for you to stop typing. `null` waits forever                                                              |
-
-The `judge` block:
-
-| Key                 | Default        | Does                                                  |
-| ------------------- | -------------- | ----------------------------------------------------- |
-| `enabled`           | `false`        | Turn the judge on                                     |
-| `provider`          | `"jev"`        | `"jev"`, or `"pi"` for a model you set up in pi       |
-| `model`             | `"jev-latest"` | A Jev alias, or `provider/modelId` for a pi model     |
-| `tools`             | `["bash"]`     | Tools the judge decides. The rest ask you             |
-| `policy`            | Standard       | The rules the judge follows                           |
-| `canDeny`           | `true`         | A confident no blocks the call. Off, it asks you      |
-| `whenUnsure`        | `"ask"`        | `"ask"`, `"allow"`, or `"deny"`                       |
-| `whenItFails`       | `"ask"`        | The same, for a timeout, an error, or a missing key   |
-| `alwaysAsk`         | `[]`           | Patterns the judge never approves, like `"git push*"` |
-| `dryRun`            | `false`        | Show the verdict, and still ask you                   |
-| `noUI`              | `false`        | Also judge print, JSON, and subagent runs             |
-| `rememberApprovals` | `false`        | A judge approval becomes always yes for this session  |
-| `thresholds`        | `0.85` / `0.8` | Confidence needed to allow / deny                     |
-| `riskCeiling`       | `0.45`         | Highest risk the judge may approve                    |
-| `timeoutMs`         | `5000`         | How long to wait for an answer                        |
-
-A malformed value falls back and says what it dropped, so a typo never lets more through. Keys under an older name are read under the current one. `PI_CODING_AGENT_DIR` moves the file with the rest of the agent directory.
-
-If `~/.pi/agent/extensions/pi-ask-permission/config.json` exists, the next session reads it, writes what you set there into the shared settings, and renames it to `config.json.bak`.
-
-### How a call is decided
-
-The first step that answers wins.
-
-1. **Always yes** matches the tool and level: run it.
-2. **Workspace**: a call outside `workspace.roots` asks you, or is blocked with `outside: "deny"`. Nothing below can approve it.
-3. **Mode**: `auto` runs it, `accept edits` runs an edit.
-4. **Allow list**: the tool is in `allow`, run it.
-5. **Read-only bash**: the command only reads, run it.
-6. **Judge**: a confident yes runs it, a confident no blocks it.
-7. **No UI**: `noUI` decides.
-8. **Edit check**: an `edit` that cannot apply is blocked with pi's own error, so you never approve a failure.
-9. **You**, in the dialog.
-
-The judge answers three questions: a verdict, how reversible the call is, and whether it touches secrets. Code combines them into `risk = 0.6 × reversibility + 0.4 × sensitive` and approves only when the verdict is `allow`, confidence clears `thresholds.allow`, and risk is at most `riskCeiling`. The judge treats the tool call as data, so a command cannot talk its way past the policy or `alwaysAsk`.
-
-### Limits
-
-- Always yes matches text. `cd /repo && pnpm test` offers `cd`, `cd /repo`, and the whole line, not `pnpm test`.
-- A bash path the check cannot read counts as outside. `$HOME`, `$SECRET`, and `"$@"` ask for that reason.
-- The read-only check is a classifier, not a sandbox. It trusts the command name as written and does not resolve `PATH`. It refuses anything it cannot prove harmless, so a few safe commands still ask.
-- The judge is a model, and it can be wrong. It sees the tool call, so do not judge calls that carry secrets you would not send to its provider.
-- Pi's `codemode` tool runs a script that calls other tools. The dialog asks about the script, and every call the script makes goes through the same steps on its own.
-- If you want deterministic rules and no human in the loop, use a sandbox instead.
-
-### For other extensions
-
-Every decision goes out on `pi.events`:
-
-```ts
-pi.events.on("pi-ask-permission:decided", (decided) => {
-	// { toolCallId, toolName, summary, action: "allow" | "block", by, reason?, note? }
-});
-```
-
-`by` names the step above that decided, `you` for the dialog, or `no UI`. Dialog answers are also saved in the session as `pi-ask-permission:answer` entries.
-
-A custom tool can say what it touches, so the workspace and `accept edits` treat it like `edit`. Emit from `session_start`, after every extension has loaded:
-
-```ts
-pi.on("session_start", () => {
-	pi.events.emit("pi-ask-permission:tool", {
-		name: "apply_patch",
-		edits: true,
-		paths: (input) => input.files,
-	});
-});
-```
+## Limits
 
-A tool that says nothing has no paths and is not an edit. Built-in tools cannot be redescribed.
+- Always yes matches text. `cd /repo && pnpm test` offers `cd`, `cd /repo` and the whole line, not `pnpm test`.
+- The read-only check is a classifier, not a sandbox. It refuses anything it cannot prove harmless, so a few safe commands still ask.
+- The judge is a model and can be wrong. It sees the tool call and your last message, so do not judge calls that carry secrets you would not send to its provider.
+- For deterministic rules and no human in the loop, use a sandbox.
 
-### Compatibility
+## More
 
-Tested against the pi SDK pinned in `devDependencies`, which the `pi SDK` badge shows. CI checks each new pi release. The peer range is `*` because pi, not npm, picks the SDK that loads the extension.
+The [reference](docs/reference.md) has every setting, the exact order in which a call is decided, the full list of limits, and the events other extensions can listen to. The settings screen (`Alt+S`) covers the same keys without opening the file.
 
 ## Contributing
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@adeildo/pi-ask-permission",
-	"version": "4.1.0",
+	"version": "5.1.0",
 	"description": "A permission dialog for the Pi coding agent. Approve, always approve, or deny a tool call, and attach a note the model reads with the result.",
 	"keywords": [
 		"approval",
@@ -49,7 +49,8 @@
 		"prepublishOnly": "cd ../.. && bun run verify"
 	},
 	"dependencies": {
-		"@adeildo/pi-kit": "4.1.0",
+		"@adeildo/pi-ask-questions": "5.1.0",
+		"@adeildo/pi-kit": "5.1.0",
 		"shell-quote": "^1.10.0"
 	},
 	"peerDependencies": {

package/src/core/answer.ts

@@ -1,8 +1,16 @@
 import type { Scope } from "#core/always-yes.ts";
+import type { Access } from "#core/folders.ts";
+import type { FolderChoices } from "#core/workspace.ts";
+
+/** A call that left the workspace, with the folders the dialog can open for it. */
+export interface FolderOffer extends FolderChoices {
+	access: Access;
+}
 
 export interface DialogAnswer {
 	decision: "allow" | "deny";
 	note?: string;
 	remember?: string;
 	scope?: Scope;
+	open?: { path: string; access: Access; scope: Scope };
 }

package/src/core/config/decode.ts

@@ -22,6 +22,7 @@ import {
 	DEFAULT_TYPING,
 	DEFAULT_WORKSPACE,
 	defaultConfig,
+	isMcpPolicy,
 	type NoUIMode,
 	type PermissionConfig,
 	type TypingConfig,
@@ -29,7 +30,8 @@ import {
 } from "#core/config/schema.ts";
 import { defaultJudge } from "#core/judge/config.ts";
 import { judgeConfig } from "#core/judge/decode.ts";
-import { DEFAULT_MODE } from "#core/mode.ts";
+import { MCP_POLICIES, type McpPolicy } from "#core/mcp.ts";
+import { DEFAULT_MODE, parseMode, PERMISSION_MODES, type PermissionMode } from "#core/mode.ts";
 
 export type NoUIConfig = NoUIMode | Record<string, NoUIMode>;
 
@@ -48,6 +50,32 @@ export const noUI: Decoder<NoUIConfig> = {
 	},
 };
 
+export const mode: Decoder<PermissionMode> = {
+	decode(input, path) {
+		const value = typeof input === "string" ? parseMode(input) : undefined;
+		if (value !== undefined) return pass(value);
+		return fail(problem(path, `expected one of ${PERMISSION_MODES.join(", ")}`));
+	},
+};
+
+/** The policy per MCP server, keyed by server name. */
+export const mcpPolicies: Decoder<Record<string, McpPolicy>> = {
+	decode(input, path) {
+		if (!isObject(input)) return fail(problem(path, "expected a map of server to policy"));
+
+		const problems: Problem[] = [];
+		const value: Record<string, McpPolicy> = {};
+		for (const [server, entry] of Object.entries(input)) {
+			if (isMcpPolicy(entry)) value[server] = entry;
+			else
+				problems.push(
+					problem(fieldPath(path, server), `expected one of ${MCP_POLICIES.join(", ")}`),
+				);
+		}
+		return pass(value, problems);
+	},
+};
+
 const typing: Decoder<TypingConfig> = object({
 	pause: withDefault(duration, DEFAULT_TYPING.pause),
 	maxWait: withDefault(nullable(duration), DEFAULT_TYPING.maxWait),
@@ -62,7 +90,7 @@ const config: Decoder<PermissionConfig> = object({
 	allow: withDefaultOf(stringList("tool names"), () => [...DEFAULT_CONFIG.allow]),
 	noUI: withDefaultOf(noUI, () => DEFAULT_CONFIG.noUI),
 	notes: withDefault(literal("result", "message"), DEFAULT_CONFIG.notes),
-	mode: withDefault(literal("manual", "accept-edits", "auto"), DEFAULT_MODE),
+	mode: withDefault(mode, DEFAULT_MODE),
 	readOnlyBash: withDefault(boolean, DEFAULT_CONFIG.readOnlyBash),
 	workspace: withDefaultOf(workspace, () => ({
 		...DEFAULT_WORKSPACE,
@@ -70,6 +98,7 @@ const config: Decoder<PermissionConfig> = object({
 	})),
 	typing: withDefaultOf(typing, () => ({ ...DEFAULT_TYPING })),
 	judge: withDefaultOf(judgeConfig, defaultJudge),
+	mcp: withDefaultOf(object({ servers: withDefault(mcpPolicies, {}) }), () => ({ servers: {} })),
 });
 
 export function decodeConfig(input: unknown, warnings: string[] = []): PermissionConfig {
@@ -82,7 +111,6 @@ export function decodeConfig(input: unknown, warnings: string[] = []): Permissio
 const RENAMED: [section: "judge" | undefined, from: string, to: string][] = [
 	[undefined, "followup", "notes"],
 	[undefined, "headless", "noUI"],
-	["judge", "backend", "provider"],
 	["judge", "autoDeny", "canDeny"],
 	["judge", "onUncertain", "whenUnsure"],
 	["judge", "onError", "whenItFails"],
@@ -91,7 +119,6 @@ const RENAMED: [section: "judge" | undefined, from: string, to: string][] = [
 	["judge", "grant", "rememberApprovals"],
 ];
 
-// A rename keeps the value and says nothing. The migration writes the new names.
 function migrate(input: unknown, warnings: string[]): unknown {
 	if (!isObject(input)) return input;
 
@@ -107,8 +134,15 @@ function migrate(input: unknown, warnings: string[]): unknown {
 	}
 
 	if (next.mode === "yolo") {
-		next.mode = "auto";
-		warnings.push('mode "yolo" is now "auto", with workspace.outside "allow" for the same reach');
+		next.mode = "full";
+		warnings.push('mode "yolo" is now "full", with workspace.outside "allow" for the same reach');
+	}
+	// A judge switched on in 3.x becomes the judge mode.
+	if (isObject(next.judge) && "enabled" in next.judge) {
+		if (next.judge.enabled === true && (next.mode === undefined || next.mode === "manual")) {
+			next.mode = "judge";
+		}
+		delete next.judge.enabled;
 	}
 	if ("yolo" in next) {
 		delete next.yolo;

package/src/core/config/patterns.ts

@@ -21,12 +21,6 @@ export function isAllowed(config: PermissionConfig, toolName: string): boolean {
 	return config.allow.some((pattern) => matchesPattern(pattern, toolName));
 }
 
-export function isJudged(config: PermissionConfig, toolName: string): boolean {
-	return (
-		config.judge.enabled && config.judge.tools.some((pattern) => matchesPattern(pattern, toolName))
-	);
-}
-
 export function noUIMode(config: PermissionConfig, toolName: string): NoUIMode {
 	if (typeof config.noUI === "string") return config.noUI;
 

package/src/core/config/schema.ts

@@ -1,4 +1,5 @@
 import { DEFAULT_JUDGE, defaultJudge, type JudgeConfig } from "#core/judge/config.ts";
+import { MCP_POLICIES, type McpPolicy } from "#core/mcp.ts";
 import { DEFAULT_MODE, type PermissionMode } from "#core/mode.ts";
 
 export type NoUIMode = "allow" | "deny";
@@ -17,6 +18,11 @@ export interface TypingConfig {
 	maxWait: number | null;
 }
 
+export interface McpConfig {
+	/** The policy per server, by server name. A server not listed follows the default. */
+	servers: Record<string, McpPolicy>;
+}
+
 export interface PermissionConfig {
 	allow: string[];
 	noUI: NoUIMode | Record<string, NoUIMode>;
@@ -26,6 +32,7 @@ export interface PermissionConfig {
 	workspace: WorkspaceConfig;
 	typing: TypingConfig;
 	judge: JudgeConfig;
+	mcp: McpConfig;
 }
 
 export const DEFAULT_TYPING: TypingConfig = {
@@ -47,6 +54,7 @@ export const DEFAULT_CONFIG: PermissionConfig = {
 	workspace: DEFAULT_WORKSPACE,
 	typing: DEFAULT_TYPING,
 	judge: DEFAULT_JUDGE,
+	mcp: { servers: {} },
 };
 
 export function defaultConfig(): PermissionConfig {
@@ -56,9 +64,14 @@ export function defaultConfig(): PermissionConfig {
 		workspace: { ...DEFAULT_WORKSPACE, roots: [...DEFAULT_WORKSPACE.roots] },
 		typing: { ...DEFAULT_CONFIG.typing },
 		judge: defaultJudge(),
+		mcp: { servers: {} },
 	};
 }
 
+export function isMcpPolicy(value: unknown): value is McpPolicy {
+	return MCP_POLICIES.some((policy) => policy === value);
+}
+
 export function isNoUIMode(value: unknown): value is NoUIMode {
 	return value === "allow" || value === "deny";
 }