@ashx-j/lunr-dev 0.2.13-dev.1.1

package/dist/core/permissions.d.ts

@@ -0,0 +1,110 @@
+/**
+ * lunR: permission modes (Manual / YOLO / Plan / Auto).
+ *
+ * Per-session only — never persisted per session, but the default mode new
+ * sessions start with is configurable in /settings (`defaultPermissionMode`,
+ * default "manual").
+ *
+ * - manual: every mutating tool call (bash, edit, write) requires approval.
+ * - yolo:   auto-approve tools; the agent may still ask questions.
+ * - plan:   read-only; mutating tools are hard-blocked (planModeBlockReason).
+ * - auto:   fully autonomous; a system-prompt addendum steers the model to
+ *           self-decide, and rollback is force-enabled for the session.
+ *
+ * The gate is wired into `agent-session.ts` `_installAgentToolHooks` before
+ * the synchronous `_toolCallGates` loop. beforeToolCall is already async, so
+ * awaiting the approval dialog is fine.
+ *
+ * State (mode + session-scoped approvals) is keyed by session id so
+ * concurrent gateway chats do not share permission decisions.
+ */
+/** Shift+Tab cycle order. */
+export declare const PERMISSION_MODES: readonly ["manual", "yolo", "plan", "auto"];
+export type PermissionMode = (typeof PERMISSION_MODES)[number];
+export declare function nextPermissionMode(current: PermissionMode): PermissionMode;
+/** True when the (default or session) permission mode is plan. */
+export declare function isPlanModeActive(sessionId?: string): boolean;
+/**
+ * Destination mode when leaving plan via approve / `/plan off` / `/plan <text>`.
+ * Explicit Shift+Tab or `/mode` picks do not use this — they already chose a mode.
+ */
+export declare function restorePermissionModeAfterPlan(previous: PermissionMode | undefined, defaultMode: PermissionMode): PermissionMode;
+export interface ApprovalRequest {
+    toolName: string;
+    /** "bash" (detail = command), "edit"/"write" (detail = path),
+     *  "edit-outside"/"write-outside" when path escapes cwd,
+     *  "subagent-full" for full-access children, or "swarm" for swarms. */
+    action: string;
+    detail: string;
+    /** "swarm" when this is the agent-swarm approval prompt, "plan" for the
+     *  present_plan plan-approval prompt — the UI renders a dedicated dialog
+     *  for each instead of the generic tool dialog. */
+    kind?: "swarm" | "plan";
+}
+export type ApprovalDecision = "once" | "session" | "reject";
+/** Handlers may return a bare decision string, a reject carrying user feedback
+ *  that becomes the block reason the model sees, or an approve carrying optional
+ *  feedback (plan approval with comments). */
+export type ApprovalResponse = ApprovalDecision | {
+    decision: "reject";
+    feedback: string;
+} | {
+    decision: "approve";
+    feedback?: string;
+};
+export declare const NO_HANDLER_REASON = "Mutating tool blocked in manual mode: no approval channel available.";
+export declare const SWARM_REJECT_REASON = "Agent swarm rejected by user.";
+export declare const NO_SWARM_HANDLER_REASON = "Agent swarm blocked: no approval channel available.";
+export declare function createPermissionContext(sessionId: string, mode?: PermissionMode): void;
+export declare function deletePermissionContext(sessionId: string): void;
+export declare function getPermissionMode(sessionId?: string): PermissionMode;
+export declare function setPermissionMode(mode: PermissionMode, sessionId?: string): void;
+export declare function resetPermissions(defaultMode?: PermissionMode, sessionId?: string): void;
+export declare function registerApprovalHandler(fn: ((req: ApprovalRequest) => Promise<ApprovalResponse>) | undefined): void;
+/** Model-facing result texts for the present_plan tool. */
+export declare const PLAN_APPROVED_TEXT = "Plan approved \u2014 implement it now.";
+export declare const PLAN_DECLINED_TEXT = "Plan declined \u2014 revise the plan and call present_plan again.";
+export declare const PLAN_PASS_THROUGH_TEXT = "Plan presented. The user will review and reply.";
+/** lunr: map an approval response to the model-facing present_plan result text. */
+export declare function planApprovalResultText(resp: ApprovalResponse): string;
+/**
+ * lunr: present_plan approval request. Unlike the mutating-tool and swarm gates
+ * this fails OPEN when no approval handler is registered (or none is reachable,
+ * e.g. a gateway turn without a chat context): headless sessions have no one to
+ * show the dialog to, so the plan is presented and the user replies in chat
+ * instead of deadlocking the turn. Everything else keeps fail-closed.
+ */
+export declare function requestPlanApproval(summary: string): Promise<string>;
+export declare function clearSessionApprovals(sessionId?: string): void;
+/** Test seam: remove every per-session context and restore the default. */
+export declare function resetAllPermissionContexts(): void;
+/** Appended to the system prompt while auto mode is active. */
+export declare const AUTO_MODE_ADDENDUM = "You are running fully autonomously. Do not ask the user questions or wait for confirmation; make reasonable decisions and complete the task end-to-end.";
+export declare const GLOBAL_AGENTS_FILE_WRITE_BLOCK_REASON = "The global AGENTS.md file is user-managed. The agent cannot change ~/.lunr/agent/AGENTS.md.";
+export declare const MEMORY_FILE_DIRECT_WRITE_BLOCK_REASON = "Memory is model-managed through the memory tools. Do not directly change ~/.lunr/simple-memory/memory.md.";
+export interface GateOptions {
+    /** True when the current turn started from an explicit /swarm prompt — the
+     *  user already asked for the swarm, so the swarm approval gate is skipped. */
+    explicitSwarmTurn?: boolean;
+    /** Assistant message that issued this tool call. Same-turn sibling SINGLE
+     *  `subagent` calls count toward the swarm threshold. */
+    assistantMessage?: {
+        content?: ReadonlyArray<{
+            type?: string;
+            name?: string;
+            arguments?: unknown;
+        }>;
+    };
+}
+/**
+ * Returns a block result when the tool call should be blocked, else undefined.
+ * Read-only tools always pass. YOLO and Auto always pass mutating tools. Plan
+ * mode hard-blocks mutating tools (no prompt). Manual mode gates every mutating
+ * tool; if an approval handler is registered it is asked, otherwise the call is
+ * blocked (fail-closed — no silent allow).
+ */
+export declare function gateToolCall(toolName: string, input: Record<string, unknown>, cwd: string, sessionId?: string, options?: GateOptions): Promise<{
+    block: true;
+    reason: string;
+} | undefined>;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/core/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/core/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAOH,6BAA6B;AAC7B,eAAO,MAAM,gBAAgB,6CAA8C,CAAC;AAC5E,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,cAAc,CAG1E;AAED,kEAAkE;AAClE,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC7C,QAAQ,EAAE,cAAc,GAAG,SAAS,EACpC,WAAW,EAAE,cAAc,GACzB,cAAc,CAGhB;AAED,MAAM,WAAW,eAAe;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB;;2EAEuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf;;uDAEmD;IACnD,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAC7D;;8CAE8C;AAC9C,MAAM,MAAM,gBAAgB,GACzB,gBAAgB,GAChB;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,QAAQ,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAgC9C,eAAO,MAAM,iBAAiB,yEAAyE,CAAC;AACxG,eAAO,MAAM,mBAAmB,kCAAkC,CAAC;AACnE,eAAO,MAAM,uBAAuB,wDAAwD,CAAC;AAwB7F,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,cAAoC,GAAG,IAAI,CAE3G;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAE/D;AAED,wBAAgB,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,cAAc,CAEpE;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAEhF;AAED,wBAAgB,gBAAgB,CAAC,WAAW,GAAE,cAAyB,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAMjG;AAED,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,SAAS,GAAG,IAAI,CAEnH;AAED,2DAA2D;AAC3D,eAAO,MAAM,kBAAkB,2CAAsC,CAAC;AACtE,eAAO,MAAM,kBAAkB,sEAAiE,CAAC;AACjG,eAAO,MAAM,sBAAsB,oDAAoD,CAAC;AAExF,mFAAmF;AACnF,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CASrE;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAW1E;AAED,wBAAgB,qBAAqB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAE9D;AAED,2EAA2E;AAC3E,wBAAgB,0BAA0B,IAAI,IAAI,CAIjD;AAED,+DAA+D;AAC/D,eAAO,MAAM,kBAAkB,4JAC2H,CAAC;AAgB3J,eAAO,MAAM,qCAAqC,gGAC4C,CAAC;AAC/F,eAAO,MAAM,qCAAqC,8GAC0D,CAAC;AAkE7G,MAAM,WAAW,WAAW;IAC3B;mFAC+E;IAC/E,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;6DACyD;IACzD,gBAAgB,CAAC,EAAE;QAClB,OAAO,CAAC,EAAE,aAAa,CAAC;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;KAC/E,CAAC;CACF;AAgHD;;;;;;GAMG;AACH,wBAAsB,YAAY,CACjC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,GAAG,EAAE,MAAM,EACX,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAqFtD","sourcesContent":["/**\n * lunR: permission modes (Manual / YOLO / Plan / Auto).\n *\n * Per-session only — never persisted per session, but the default mode new\n * sessions start with is configurable in /settings (`defaultPermissionMode`,\n * default \"manual\").\n *\n * - manual: every mutating tool call (bash, edit, write) requires approval.\n * - yolo:   auto-approve tools; the agent may still ask questions.\n * - plan:   read-only; mutating tools are hard-blocked (planModeBlockReason).\n * - auto:   fully autonomous; a system-prompt addendum steers the model to\n *           self-decide, and rollback is force-enabled for the session.\n *\n * The gate is wired into `agent-session.ts` `_installAgentToolHooks` before\n * the synchronous `_toolCallGates` loop. beforeToolCall is already async, so\n * awaiting the approval dialog is fine.\n *\n * State (mode + session-scoped approvals) is keyed by session id so\n * concurrent gateway chats do not share permission decisions.\n */\n\nimport { dirname, join, resolve } from \"node:path\";\nimport { getAgentDir } from \"../config.ts\";\nimport { isCodeRewriteMutating, planModeBlockReason } from \"./plan-mode.ts\";\nimport { effectiveSwarmCountForTurn, SWARM_APPROVAL_THRESHOLD } from \"./swarm.ts\";\n\n/** Shift+Tab cycle order. */\nexport const PERMISSION_MODES = [\"manual\", \"yolo\", \"plan\", \"auto\"] as const;\nexport type PermissionMode = (typeof PERMISSION_MODES)[number];\n\nexport function nextPermissionMode(current: PermissionMode): PermissionMode {\n\tconst i = PERMISSION_MODES.indexOf(current);\n\treturn PERMISSION_MODES[(i + 1) % PERMISSION_MODES.length];\n}\n\n/** True when the (default or session) permission mode is plan. */\nexport function isPlanModeActive(sessionId?: string): boolean {\n\treturn getPermissionMode(sessionId) === \"plan\";\n}\n\n/**\n * Destination mode when leaving plan via approve / `/plan off` / `/plan <text>`.\n * Explicit Shift+Tab or `/mode` picks do not use this — they already chose a mode.\n */\nexport function restorePermissionModeAfterPlan(\n\tprevious: PermissionMode | undefined,\n\tdefaultMode: PermissionMode,\n): PermissionMode {\n\tif (previous && previous !== \"plan\") return previous;\n\treturn defaultMode === \"plan\" ? \"yolo\" : defaultMode;\n}\n\nexport interface ApprovalRequest {\n\ttoolName: string;\n\t/** \"bash\" (detail = command), \"edit\"/\"write\" (detail = path),\n\t *  \"edit-outside\"/\"write-outside\" when path escapes cwd,\n\t *  \"subagent-full\" for full-access children, or \"swarm\" for swarms. */\n\taction: string;\n\tdetail: string;\n\t/** \"swarm\" when this is the agent-swarm approval prompt, \"plan\" for the\n\t *  present_plan plan-approval prompt — the UI renders a dedicated dialog\n\t *  for each instead of the generic tool dialog. */\n\tkind?: \"swarm\" | \"plan\";\n}\n\nexport type ApprovalDecision = \"once\" | \"session\" | \"reject\";\n/** Handlers may return a bare decision string, a reject carrying user feedback\n *  that becomes the block reason the model sees, or an approve carrying optional\n *  feedback (plan approval with comments). */\nexport type ApprovalResponse =\n\t| ApprovalDecision\n\t| { decision: \"reject\"; feedback: string }\n\t| { decision: \"approve\"; feedback?: string };\n\n/** Read-only tools that never need approval. */\nconst READ_ONLY_TOOLS = new Set([\n\t\"read\",\n\t\"grep\",\n\t\"find\",\n\t\"ls\",\n\t\"web_search\",\n\t\"web_fetch\",\n\t\"fetch_content\",\n\t\"get_search_content\",\n\t\"sourcegraph\",\n\t\"repo_map\",\n\t\"symbol_outline\",\n\t\"read_block\",\n\t\"code_overview\",\n\t\"ast_search\",\n\t\"lsp_diagnostics\",\n\t\"lsp_hover\",\n\t\"lsp_definition\",\n\t\"lsp_references\",\n\t\"lsp_symbols\",\n\t\"lsp_code_actions\",\n\t\"lsp_completions\",\n\t\"memory_load\",\n]);\n\n/** Tools that mutate state and must be gated in manual mode. */\nconst MUTATING_TOOLS = new Set([\"bash\", \"edit\", \"write\", \"memory_add\", \"memory_remove\", \"cron\"]);\n\nconst REJECT_REASON = \"Rejected by user (permission mode: manual).\";\nexport const NO_HANDLER_REASON = \"Mutating tool blocked in manual mode: no approval channel available.\";\nexport const SWARM_REJECT_REASON = \"Agent swarm rejected by user.\";\nexport const NO_SWARM_HANDLER_REASON = \"Agent swarm blocked: no approval channel available.\";\n/** Session-approval keys for child launches. */\nconst SWARM_ACTION = \"swarm\";\nconst FULL_CHILD_ACTION = \"subagent-full\";\n\ninterface PermissionContext {\n\tmode: PermissionMode;\n\tapprovals: Set<string>;\n}\n\nconst contexts = new Map<string, PermissionContext>();\nlet defaultContext: PermissionContext = { mode: \"manual\", approvals: new Set() };\nlet approvalHandler: ((req: ApprovalRequest) => Promise<ApprovalResponse>) | undefined;\n/** One swarm prompt covers every sibling SINGLE `subagent` on the same assistant message. */\nconst turnSwarmDecisions = new WeakMap<\n\tobject,\n\t{ decision: ApprovalDecision; feedback?: string; fullChildrenApproved: boolean }\n>();\n\nfunction getContext(sessionId?: string): PermissionContext {\n\tif (!sessionId) return defaultContext;\n\treturn contexts.get(sessionId) ?? defaultContext;\n}\n\nexport function createPermissionContext(sessionId: string, mode: PermissionMode = defaultContext.mode): void {\n\tcontexts.set(sessionId, { mode, approvals: new Set() });\n}\n\nexport function deletePermissionContext(sessionId: string): void {\n\tcontexts.delete(sessionId);\n}\n\nexport function getPermissionMode(sessionId?: string): PermissionMode {\n\treturn getContext(sessionId).mode;\n}\n\nexport function setPermissionMode(mode: PermissionMode, sessionId?: string): void {\n\tgetContext(sessionId).mode = mode;\n}\n\nexport function resetPermissions(defaultMode: PermissionMode = \"manual\", sessionId?: string): void {\n\tif (sessionId) {\n\t\tcontexts.set(sessionId, { mode: defaultMode, approvals: new Set() });\n\t} else {\n\t\tdefaultContext = { mode: defaultMode, approvals: new Set() };\n\t}\n}\n\nexport function registerApprovalHandler(fn: ((req: ApprovalRequest) => Promise<ApprovalResponse>) | undefined): void {\n\tapprovalHandler = fn;\n}\n\n/** Model-facing result texts for the present_plan tool. */\nexport const PLAN_APPROVED_TEXT = \"Plan approved — implement it now.\";\nexport const PLAN_DECLINED_TEXT = \"Plan declined — revise the plan and call present_plan again.\";\nexport const PLAN_PASS_THROUGH_TEXT = \"Plan presented. The user will review and reply.\";\n\n/** lunr: map an approval response to the model-facing present_plan result text. */\nexport function planApprovalResultText(resp: ApprovalResponse): string {\n\tconst decision = typeof resp === \"string\" ? resp : resp.decision;\n\tconst feedback = typeof resp === \"string\" ? undefined : resp.feedback?.trim();\n\tif (decision === \"reject\") {\n\t\treturn feedback\n\t\t\t? `Plan declined: ${feedback} — revise the plan and call present_plan again.`\n\t\t\t: PLAN_DECLINED_TEXT;\n\t}\n\treturn feedback ? `Plan approved with feedback: ${feedback} — implement it now.` : PLAN_APPROVED_TEXT;\n}\n\n/**\n * lunr: present_plan approval request. Unlike the mutating-tool and swarm gates\n * this fails OPEN when no approval handler is registered (or none is reachable,\n * e.g. a gateway turn without a chat context): headless sessions have no one to\n * show the dialog to, so the plan is presented and the user replies in chat\n * instead of deadlocking the turn. Everything else keeps fail-closed.\n */\nexport async function requestPlanApproval(summary: string): Promise<string> {\n\tif (!approvalHandler) return PLAN_PASS_THROUGH_TEXT;\n\tlet resp: ApprovalResponse;\n\ttry {\n\t\tresp = await approvalHandler({ toolName: \"present_plan\", action: \"plan\", detail: summary, kind: \"plan\" });\n\t} catch (err) {\n\t\tconst message = err instanceof Error ? err.message : \"approval request failed\";\n\t\tif (message === NO_HANDLER_REASON) return PLAN_PASS_THROUGH_TEXT;\n\t\treturn `Plan declined: ${message} — revise the plan and call present_plan again.`;\n\t}\n\treturn planApprovalResultText(resp);\n}\n\nexport function clearSessionApprovals(sessionId?: string): void {\n\tgetContext(sessionId).approvals.clear();\n}\n\n/** Test seam: remove every per-session context and restore the default. */\nexport function resetAllPermissionContexts(): void {\n\tcontexts.clear();\n\tdefaultContext = { mode: \"manual\", approvals: new Set() };\n\tapprovalHandler = undefined;\n}\n\n/** Appended to the system prompt while auto mode is active. */\nexport const AUTO_MODE_ADDENDUM =\n\t\"You are running fully autonomously. Do not ask the user questions or wait for confirmation; make reasonable decisions and complete the task end-to-end.\";\n\nfunction isPathOutsideCwd(absPath: string, cwd: string): boolean {\n\tconst norm = (p: string) => p.replace(/\\\\/g, \"/\").replace(/\\/$/, \"\");\n\tconst np = norm(absPath);\n\tconst nc = norm(cwd);\n\tif (np === nc) return false;\n\treturn !np.startsWith(`${nc}/`);\n}\n\nfunction resolvePath(cwd: string, p: unknown): string {\n\tif (typeof p !== \"string\") return \"\";\n\tif (!p) return \"\";\n\treturn resolve(cwd, p);\n}\n\nexport const GLOBAL_AGENTS_FILE_WRITE_BLOCK_REASON =\n\t\"The global AGENTS.md file is user-managed. The agent cannot change ~/.lunr/agent/AGENTS.md.\";\nexport const MEMORY_FILE_DIRECT_WRITE_BLOCK_REASON =\n\t\"Memory is model-managed through the memory tools. Do not directly change ~/.lunr/simple-memory/memory.md.\";\n\nfunction protectedFileWriteReason(toolName: string, input: Record<string, unknown>, cwd: string): string | undefined {\n\tif (toolName !== \"edit\" && toolName !== \"write\" && toolName !== \"code_rewrite\") return undefined;\n\tconst target = resolvePath(cwd, input.path);\n\tif (!target) return undefined;\n\tconst normalize = (path: string) => {\n\t\tconst normalized = resolve(path).replace(/\\\\/g, \"/\").replace(/\\/$/, \"\");\n\t\treturn process.platform === \"win32\" ? normalized.toLowerCase() : normalized;\n\t};\n\tconst agentsPaths = [join(getAgentDir(), \"AGENTS.md\"), join(getAgentDir(), \"AGENTS.MD\")];\n\tif (agentsPaths.some((candidate) => normalize(target) === normalize(candidate))) {\n\t\treturn GLOBAL_AGENTS_FILE_WRITE_BLOCK_REASON;\n\t}\n\tif (normalize(target) === normalize(join(dirname(getAgentDir()), \"simple-memory\", \"memory.md\"))) {\n\t\treturn MEMORY_FILE_DIRECT_WRITE_BLOCK_REASON;\n\t}\n\treturn undefined;\n}\n\nfunction isMutatingTool(toolName: string): boolean {\n\treturn MUTATING_TOOLS.has(toolName);\n}\n\ninterface RequestedChildLaunch {\n\tdescription: string;\n\tpermissions: \"full\" | \"read-only\";\n}\n\nfunction collectRequestedChildLaunches(value: unknown, launches: RequestedChildLaunch[]): void {\n\tif (!value || typeof value !== \"object\" || Array.isArray(value)) return;\n\tconst input = value as Record<string, unknown>;\n\tif (typeof input.task === \"string\" && input.task.trim()) {\n\t\tlaunches.push({\n\t\t\tdescription:\n\t\t\t\ttypeof input.description === \"string\" && input.description.trim()\n\t\t\t\t\t? input.description.trim()\n\t\t\t\t\t: input.task.trim(),\n\t\t\tpermissions: input.permissions === \"read-only\" ? \"read-only\" : \"full\",\n\t\t});\n\t\treturn;\n\t}\n\tfor (const key of [\"tasks\", \"chain\", \"parallel\"] as const) {\n\t\tconst children = input[key];\n\t\tif (Array.isArray(children)) {\n\t\t\tfor (const child of children) collectRequestedChildLaunches(child, launches);\n\t\t} else if (key === \"parallel\") {\n\t\t\tcollectRequestedChildLaunches(children, launches);\n\t\t}\n\t}\n}\n\nfunction getRequestedChildLaunches(input: Record<string, unknown>): RequestedChildLaunch[] {\n\tconst launches: RequestedChildLaunch[] = [];\n\tcollectRequestedChildLaunches(input, launches);\n\treturn launches;\n}\n\nfunction requiresManualApproval(toolName: string, input: Record<string, unknown>): boolean {\n\tif (isMutatingTool(toolName)) return true;\n\tif (toolName === \"subagent\") {\n\t\treturn getRequestedChildLaunches(input).some((launch) => launch.permissions === \"full\");\n\t}\n\treturn toolName === \"code_rewrite\" && isCodeRewriteMutating(input);\n}\n\nexport interface GateOptions {\n\t/** True when the current turn started from an explicit /swarm prompt — the\n\t *  user already asked for the swarm, so the swarm approval gate is skipped. */\n\texplicitSwarmTurn?: boolean;\n\t/** Assistant message that issued this tool call. Same-turn sibling SINGLE\n\t *  `subagent` calls count toward the swarm threshold. */\n\tassistantMessage?: {\n\t\tcontent?: ReadonlyArray<{ type?: string; name?: string; arguments?: unknown }>;\n\t};\n}\n\nfunction firstTaskText(value: unknown): string {\n\tif (typeof value === \"string\" && value.trim()) return sanitizeDetail(value);\n\treturn \"\";\n}\n\n/** First task text of a parallel fan-out or sibling SINGLE, used as the dialog summary. */\nfunction swarmTaskSummary(input: Record<string, unknown>, assistantMessage?: GateOptions[\"assistantMessage\"]): string {\n\tif (Array.isArray(input.tasks)) {\n\t\tfor (const task of input.tasks) {\n\t\t\tconst text = task && typeof task === \"object\" ? firstTaskText((task as { task?: unknown }).task) : \"\";\n\t\t\tif (text) return text;\n\t\t}\n\t}\n\tconst own = firstTaskText(input.task);\n\tif (own) return own;\n\tfor (const block of assistantMessage?.content ?? []) {\n\t\tif (block.type !== \"toolCall\" || block.name !== \"subagent\") continue;\n\t\tconst args =\n\t\t\tblock.arguments && typeof block.arguments === \"object\" && !Array.isArray(block.arguments)\n\t\t\t\t? (block.arguments as Record<string, unknown>)\n\t\t\t\t: undefined;\n\t\tconst text = firstTaskText(args?.task);\n\t\tif (text) return text;\n\t}\n\treturn \"\";\n}\n\n/**\n * Agent-swarm gate. An auto-activated swarm (more than SWARM_APPROVAL_THRESHOLD\n * parallel subagents in one `tasks`/`chain.parallel` call, or that many same-turn\n * SINGLE `subagent` calls) requires user approval in manual AND yolo modes; auto\n * mode runs it unconditionally and explicit /swarm turns are pre-approved.\n * Fail-closed without an approval handler, same as the mutating-tool gate.\n */\nasync function gateSwarmCall(\n\tinput: Record<string, unknown>,\n\tctx: PermissionContext,\n\toptions?: GateOptions,\n): Promise<{ block: true; reason: string } | { fullChildrenApproved: boolean } | undefined> {\n\tif (ctx.mode === \"auto\") return undefined;\n\tif (options?.explicitSwarmTurn) return undefined;\n\tconst count = effectiveSwarmCountForTurn(input, options?.assistantMessage);\n\tif (count <= SWARM_APPROVAL_THRESHOLD) return undefined;\n\tif (ctx.approvals.has(SWARM_ACTION)) return { fullChildrenApproved: false };\n\n\tconst turnKey = options?.assistantMessage;\n\tconst cached = turnKey ? turnSwarmDecisions.get(turnKey) : undefined;\n\tif (cached) {\n\t\tif (cached.decision === \"reject\") {\n\t\t\treturn {\n\t\t\t\tblock: true,\n\t\t\t\treason: cached.feedback ? `${SWARM_REJECT_REASON} ${cached.feedback}` : SWARM_REJECT_REASON,\n\t\t\t};\n\t\t}\n\t\treturn { fullChildrenApproved: cached.fullChildrenApproved };\n\t}\n\n\tif (!approvalHandler) {\n\t\treturn { block: true, reason: NO_SWARM_HANDLER_REASON };\n\t}\n\n\tconst summary = swarmTaskSummary(input, options?.assistantMessage);\n\tconst siblingLaunches = (options?.assistantMessage?.content ?? []).flatMap((block) => {\n\t\tif (block.type !== \"toolCall\" || block.name !== \"subagent\") return [];\n\t\tconst args =\n\t\t\tblock.arguments && typeof block.arguments === \"object\" && !Array.isArray(block.arguments)\n\t\t\t\t? (block.arguments as Record<string, unknown>)\n\t\t\t\t: undefined;\n\t\treturn args ? getRequestedChildLaunches(args) : [];\n\t});\n\tconst launches = siblingLaunches.length > 0 ? siblingLaunches : getRequestedChildLaunches(input);\n\tconst fullChildrenApproved = launches.some((launch) => launch.permissions === \"full\");\n\tconst launchSummary = launches\n\t\t.map((launch) => `${launch.description}\\npermissions: ${launch.permissions}`)\n\t\t.join(\"\\n\");\n\tlet resp: ApprovalResponse;\n\ttry {\n\t\tresp = await approvalHandler({\n\t\t\ttoolName: \"subagent\",\n\t\t\taction: SWARM_ACTION,\n\t\t\tdetail: `agent swarm (${count} subagents)${launchSummary || summary ? `\\n${launchSummary || summary}` : \"\"}`,\n\t\t\tkind: \"swarm\",\n\t\t});\n\t} catch (err) {\n\t\tconst message = err instanceof Error ? err.message : NO_SWARM_HANDLER_REASON;\n\t\treturn { block: true, reason: message };\n\t}\n\n\tconst rawDecision = typeof resp === \"string\" ? resp : resp.decision;\n\tconst decision: ApprovalDecision = rawDecision === \"approve\" ? \"once\" : rawDecision;\n\tconst feedback = typeof resp === \"string\" ? undefined : resp.feedback?.trim();\n\tif (turnKey) {\n\t\tturnSwarmDecisions.set(turnKey, { decision, ...(feedback ? { feedback } : {}), fullChildrenApproved });\n\t}\n\tif (decision === \"session\") {\n\t\tctx.approvals.add(SWARM_ACTION);\n\t\tif (fullChildrenApproved) ctx.approvals.add(FULL_CHILD_ACTION);\n\t\treturn { fullChildrenApproved };\n\t}\n\tif (decision === \"reject\") {\n\t\treturn { block: true, reason: feedback ? `${SWARM_REJECT_REASON} ${feedback}` : SWARM_REJECT_REASON };\n\t}\n\treturn { fullChildrenApproved };\n}\n\nfunction sanitizeDetail(value: unknown): string {\n\tconst text = String(value ?? \"\").trim();\n\treturn text.length > 200 ? `${text.slice(0, 200)}…` : text;\n}\n\n/**\n * Returns a block result when the tool call should be blocked, else undefined.\n * Read-only tools always pass. YOLO and Auto always pass mutating tools. Plan\n * mode hard-blocks mutating tools (no prompt). Manual mode gates every mutating\n * tool; if an approval handler is registered it is asked, otherwise the call is\n * blocked (fail-closed — no silent allow).\n */\nexport async function gateToolCall(\n\ttoolName: string,\n\tinput: Record<string, unknown>,\n\tcwd: string,\n\tsessionId?: string,\n\toptions?: GateOptions,\n): Promise<{ block: true; reason: string } | undefined> {\n\tconst ctx = getContext(sessionId);\n\tconst protectedWriteReason = protectedFileWriteReason(toolName, input, cwd);\n\tif (protectedWriteReason) {\n\t\treturn { block: true, reason: protectedWriteReason };\n\t}\n\tif (READ_ONLY_TOOLS.has(toolName)) return undefined;\n\n\t// lunr: agent-swarm gate runs before the mode early-return — it applies in\n\t// yolo mode too (only auto mode bypasses it).\n\tlet swarmCoveredManualApproval = false;\n\tif (toolName === \"subagent\") {\n\t\tconst swarmResult = await gateSwarmCall(input, ctx, options);\n\t\tif (swarmResult && \"block\" in swarmResult) return swarmResult;\n\t\tswarmCoveredManualApproval = ctx.mode === \"manual\" && swarmResult?.fullChildrenApproved === true;\n\t}\n\n\tif (ctx.mode === \"plan\") {\n\t\tconst reason = planModeBlockReason(toolName, input);\n\t\treturn reason ? { block: true, reason } : undefined;\n\t}\n\n\tif (ctx.mode !== \"manual\") return undefined;\n\tif (!requiresManualApproval(toolName, input) || swarmCoveredManualApproval) return undefined;\n\n\tlet action: string;\n\tlet detail: string;\n\n\tif (toolName === \"bash\") {\n\t\taction = \"bash\";\n\t\tdetail = sanitizeDetail(input.command);\n\t} else if (toolName === \"edit\" || toolName === \"write\") {\n\t\tconst path = resolvePath(cwd, input.path);\n\t\tconst outside = path ? isPathOutsideCwd(path, cwd) : false;\n\t\taction = outside ? `${toolName}-outside` : toolName;\n\t\tdetail = path || String(input.path ?? \"\");\n\t} else if (toolName === \"memory_add\") {\n\t\taction = toolName;\n\t\tdetail = sanitizeDetail(input.content);\n\t} else if (toolName === \"memory_remove\") {\n\t\taction = toolName;\n\t\tdetail = sanitizeDetail(input.line);\n\t} else if (toolName === \"cron\") {\n\t\taction = \"cron\";\n\t\tdetail = sanitizeDetail(input.action);\n\t} else if (toolName === \"subagent\") {\n\t\taction = FULL_CHILD_ACTION;\n\t\tconst launches = getRequestedChildLaunches(input).filter((launch) => launch.permissions === \"full\");\n\t\tdetail = sanitizeDetail(\n\t\t\tlaunches.map((launch) => `${launch.description}\\npermissions: ${launch.permissions}`).join(\"\\n\"),\n\t\t);\n\t} else if (toolName === \"code_rewrite\") {\n\t\taction = \"code_rewrite\";\n\t\tdetail = sanitizeDetail(input.path ?? input.pattern);\n\t} else {\n\t\t// All other mutating tools fall back to the tool name with no extra detail.\n\t\taction = toolName;\n\t\tdetail = \"\";\n\t}\n\n\tif (ctx.approvals.has(action)) return undefined;\n\n\tif (!approvalHandler) {\n\t\treturn { block: true, reason: NO_HANDLER_REASON };\n\t}\n\n\tlet resp: ApprovalResponse;\n\ttry {\n\t\tresp = await approvalHandler({ toolName, action, detail });\n\t} catch (err) {\n\t\tconst message = err instanceof Error ? err.message : NO_HANDLER_REASON;\n\t\treturn { block: true, reason: message };\n\t}\n\n\tconst decision = typeof resp === \"string\" ? resp : resp.decision;\n\tif (decision === \"session\") {\n\t\tctx.approvals.add(action);\n\t\treturn undefined;\n\t}\n\tif (decision === \"reject\") {\n\t\tconst feedback = typeof resp === \"string\" ? undefined : resp.feedback?.trim();\n\t\treturn { block: true, reason: feedback ? `${REJECT_REASON} ${feedback}` : REJECT_REASON };\n\t}\n\t// \"once\" — allow this call only\n\treturn undefined;\n}\n"]}

package/dist/core/permissions.js

@@ -0,0 +1,438 @@
+/**
+ * lunR: permission modes (Manual / YOLO / Plan / Auto).
+ *
+ * Per-session only — never persisted per session, but the default mode new
+ * sessions start with is configurable in /settings (`defaultPermissionMode`,
+ * default "manual").
+ *
+ * - manual: every mutating tool call (bash, edit, write) requires approval.
+ * - yolo:   auto-approve tools; the agent may still ask questions.
+ * - plan:   read-only; mutating tools are hard-blocked (planModeBlockReason).
+ * - auto:   fully autonomous; a system-prompt addendum steers the model to
+ *           self-decide, and rollback is force-enabled for the session.
+ *
+ * The gate is wired into `agent-session.ts` `_installAgentToolHooks` before
+ * the synchronous `_toolCallGates` loop. beforeToolCall is already async, so
+ * awaiting the approval dialog is fine.
+ *
+ * State (mode + session-scoped approvals) is keyed by session id so
+ * concurrent gateway chats do not share permission decisions.
+ */
+import { dirname, join, resolve } from "node:path";
+import { getAgentDir } from "../config.js";
+import { isCodeRewriteMutating, planModeBlockReason } from "./plan-mode.js";
+import { effectiveSwarmCountForTurn, SWARM_APPROVAL_THRESHOLD } from "./swarm.js";
+/** Shift+Tab cycle order. */
+export const PERMISSION_MODES = ["manual", "yolo", "plan", "auto"];
+export function nextPermissionMode(current) {
+    const i = PERMISSION_MODES.indexOf(current);
+    return PERMISSION_MODES[(i + 1) % PERMISSION_MODES.length];
+}
+/** True when the (default or session) permission mode is plan. */
+export function isPlanModeActive(sessionId) {
+    return getPermissionMode(sessionId) === "plan";
+}
+/**
+ * Destination mode when leaving plan via approve / `/plan off` / `/plan <text>`.
+ * Explicit Shift+Tab or `/mode` picks do not use this — they already chose a mode.
+ */
+export function restorePermissionModeAfterPlan(previous, defaultMode) {
+    if (previous && previous !== "plan")
+        return previous;
+    return defaultMode === "plan" ? "yolo" : defaultMode;
+}
+/** Read-only tools that never need approval. */
+const READ_ONLY_TOOLS = new Set([
+    "read",
+    "grep",
+    "find",
+    "ls",
+    "web_search",
+    "web_fetch",
+    "fetch_content",
+    "get_search_content",
+    "sourcegraph",
+    "repo_map",
+    "symbol_outline",
+    "read_block",
+    "code_overview",
+    "ast_search",
+    "lsp_diagnostics",
+    "lsp_hover",
+    "lsp_definition",
+    "lsp_references",
+    "lsp_symbols",
+    "lsp_code_actions",
+    "lsp_completions",
+    "memory_load",
+]);
+/** Tools that mutate state and must be gated in manual mode. */
+const MUTATING_TOOLS = new Set(["bash", "edit", "write", "memory_add", "memory_remove", "cron"]);
+const REJECT_REASON = "Rejected by user (permission mode: manual).";
+export const NO_HANDLER_REASON = "Mutating tool blocked in manual mode: no approval channel available.";
+export const SWARM_REJECT_REASON = "Agent swarm rejected by user.";
+export const NO_SWARM_HANDLER_REASON = "Agent swarm blocked: no approval channel available.";
+/** Session-approval keys for child launches. */
+const SWARM_ACTION = "swarm";
+const FULL_CHILD_ACTION = "subagent-full";
+const contexts = new Map();
+let defaultContext = { mode: "manual", approvals: new Set() };
+let approvalHandler;
+/** One swarm prompt covers every sibling SINGLE `subagent` on the same assistant message. */
+const turnSwarmDecisions = new WeakMap();
+function getContext(sessionId) {
+    if (!sessionId)
+        return defaultContext;
+    return contexts.get(sessionId) ?? defaultContext;
+}
+export function createPermissionContext(sessionId, mode = defaultContext.mode) {
+    contexts.set(sessionId, { mode, approvals: new Set() });
+}
+export function deletePermissionContext(sessionId) {
+    contexts.delete(sessionId);
+}
+export function getPermissionMode(sessionId) {
+    return getContext(sessionId).mode;
+}
+export function setPermissionMode(mode, sessionId) {
+    getContext(sessionId).mode = mode;
+}
+export function resetPermissions(defaultMode = "manual", sessionId) {
+    if (sessionId) {
+        contexts.set(sessionId, { mode: defaultMode, approvals: new Set() });
+    }
+    else {
+        defaultContext = { mode: defaultMode, approvals: new Set() };
+    }
+}
+export function registerApprovalHandler(fn) {
+    approvalHandler = fn;
+}
+/** Model-facing result texts for the present_plan tool. */
+export const PLAN_APPROVED_TEXT = "Plan approved — implement it now.";
+export const PLAN_DECLINED_TEXT = "Plan declined — revise the plan and call present_plan again.";
+export const PLAN_PASS_THROUGH_TEXT = "Plan presented. The user will review and reply.";
+/** lunr: map an approval response to the model-facing present_plan result text. */
+export function planApprovalResultText(resp) {
+    const decision = typeof resp === "string" ? resp : resp.decision;
+    const feedback = typeof resp === "string" ? undefined : resp.feedback?.trim();
+    if (decision === "reject") {
+        return feedback
+            ? `Plan declined: ${feedback} — revise the plan and call present_plan again.`
+            : PLAN_DECLINED_TEXT;
+    }
+    return feedback ? `Plan approved with feedback: ${feedback} — implement it now.` : PLAN_APPROVED_TEXT;
+}
+/**
+ * lunr: present_plan approval request. Unlike the mutating-tool and swarm gates
+ * this fails OPEN when no approval handler is registered (or none is reachable,
+ * e.g. a gateway turn without a chat context): headless sessions have no one to
+ * show the dialog to, so the plan is presented and the user replies in chat
+ * instead of deadlocking the turn. Everything else keeps fail-closed.
+ */
+export async function requestPlanApproval(summary) {
+    if (!approvalHandler)
+        return PLAN_PASS_THROUGH_TEXT;
+    let resp;
+    try {
+        resp = await approvalHandler({ toolName: "present_plan", action: "plan", detail: summary, kind: "plan" });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : "approval request failed";
+        if (message === NO_HANDLER_REASON)
+            return PLAN_PASS_THROUGH_TEXT;
+        return `Plan declined: ${message} — revise the plan and call present_plan again.`;
+    }
+    return planApprovalResultText(resp);
+}
+export function clearSessionApprovals(sessionId) {
+    getContext(sessionId).approvals.clear();
+}
+/** Test seam: remove every per-session context and restore the default. */
+export function resetAllPermissionContexts() {
+    contexts.clear();
+    defaultContext = { mode: "manual", approvals: new Set() };
+    approvalHandler = undefined;
+}
+/** Appended to the system prompt while auto mode is active. */
+export const AUTO_MODE_ADDENDUM = "You are running fully autonomously. Do not ask the user questions or wait for confirmation; make reasonable decisions and complete the task end-to-end.";
+function isPathOutsideCwd(absPath, cwd) {
+    const norm = (p) => p.replace(/\\/g, "/").replace(/\/$/, "");
+    const np = norm(absPath);
+    const nc = norm(cwd);
+    if (np === nc)
+        return false;
+    return !np.startsWith(`${nc}/`);
+}
+function resolvePath(cwd, p) {
+    if (typeof p !== "string")
+        return "";
+    if (!p)
+        return "";
+    return resolve(cwd, p);
+}
+export const GLOBAL_AGENTS_FILE_WRITE_BLOCK_REASON = "The global AGENTS.md file is user-managed. The agent cannot change ~/.lunr/agent/AGENTS.md.";
+export const MEMORY_FILE_DIRECT_WRITE_BLOCK_REASON = "Memory is model-managed through the memory tools. Do not directly change ~/.lunr/simple-memory/memory.md.";
+function protectedFileWriteReason(toolName, input, cwd) {
+    if (toolName !== "edit" && toolName !== "write" && toolName !== "code_rewrite")
+        return undefined;
+    const target = resolvePath(cwd, input.path);
+    if (!target)
+        return undefined;
+    const normalize = (path) => {
+        const normalized = resolve(path).replace(/\\/g, "/").replace(/\/$/, "");
+        return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+    };
+    const agentsPaths = [join(getAgentDir(), "AGENTS.md"), join(getAgentDir(), "AGENTS.MD")];
+    if (agentsPaths.some((candidate) => normalize(target) === normalize(candidate))) {
+        return GLOBAL_AGENTS_FILE_WRITE_BLOCK_REASON;
+    }
+    if (normalize(target) === normalize(join(dirname(getAgentDir()), "simple-memory", "memory.md"))) {
+        return MEMORY_FILE_DIRECT_WRITE_BLOCK_REASON;
+    }
+    return undefined;
+}
+function isMutatingTool(toolName) {
+    return MUTATING_TOOLS.has(toolName);
+}
+function collectRequestedChildLaunches(value, launches) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return;
+    const input = value;
+    if (typeof input.task === "string" && input.task.trim()) {
+        launches.push({
+            description: typeof input.description === "string" && input.description.trim()
+                ? input.description.trim()
+                : input.task.trim(),
+            permissions: input.permissions === "read-only" ? "read-only" : "full",
+        });
+        return;
+    }
+    for (const key of ["tasks", "chain", "parallel"]) {
+        const children = input[key];
+        if (Array.isArray(children)) {
+            for (const child of children)
+                collectRequestedChildLaunches(child, launches);
+        }
+        else if (key === "parallel") {
+            collectRequestedChildLaunches(children, launches);
+        }
+    }
+}
+function getRequestedChildLaunches(input) {
+    const launches = [];
+    collectRequestedChildLaunches(input, launches);
+    return launches;
+}
+function requiresManualApproval(toolName, input) {
+    if (isMutatingTool(toolName))
+        return true;
+    if (toolName === "subagent") {
+        return getRequestedChildLaunches(input).some((launch) => launch.permissions === "full");
+    }
+    return toolName === "code_rewrite" && isCodeRewriteMutating(input);
+}
+function firstTaskText(value) {
+    if (typeof value === "string" && value.trim())
+        return sanitizeDetail(value);
+    return "";
+}
+/** First task text of a parallel fan-out or sibling SINGLE, used as the dialog summary. */
+function swarmTaskSummary(input, assistantMessage) {
+    if (Array.isArray(input.tasks)) {
+        for (const task of input.tasks) {
+            const text = task && typeof task === "object" ? firstTaskText(task.task) : "";
+            if (text)
+                return text;
+        }
+    }
+    const own = firstTaskText(input.task);
+    if (own)
+        return own;
+    for (const block of assistantMessage?.content ?? []) {
+        if (block.type !== "toolCall" || block.name !== "subagent")
+            continue;
+        const args = block.arguments && typeof block.arguments === "object" && !Array.isArray(block.arguments)
+            ? block.arguments
+            : undefined;
+        const text = firstTaskText(args?.task);
+        if (text)
+            return text;
+    }
+    return "";
+}
+/**
+ * Agent-swarm gate. An auto-activated swarm (more than SWARM_APPROVAL_THRESHOLD
+ * parallel subagents in one `tasks`/`chain.parallel` call, or that many same-turn
+ * SINGLE `subagent` calls) requires user approval in manual AND yolo modes; auto
+ * mode runs it unconditionally and explicit /swarm turns are pre-approved.
+ * Fail-closed without an approval handler, same as the mutating-tool gate.
+ */
+async function gateSwarmCall(input, ctx, options) {
+    if (ctx.mode === "auto")
+        return undefined;
+    if (options?.explicitSwarmTurn)
+        return undefined;
+    const count = effectiveSwarmCountForTurn(input, options?.assistantMessage);
+    if (count <= SWARM_APPROVAL_THRESHOLD)
+        return undefined;
+    if (ctx.approvals.has(SWARM_ACTION))
+        return { fullChildrenApproved: false };
+    const turnKey = options?.assistantMessage;
+    const cached = turnKey ? turnSwarmDecisions.get(turnKey) : undefined;
+    if (cached) {
+        if (cached.decision === "reject") {
+            return {
+                block: true,
+                reason: cached.feedback ? `${SWARM_REJECT_REASON} ${cached.feedback}` : SWARM_REJECT_REASON,
+            };
+        }
+        return { fullChildrenApproved: cached.fullChildrenApproved };
+    }
+    if (!approvalHandler) {
+        return { block: true, reason: NO_SWARM_HANDLER_REASON };
+    }
+    const summary = swarmTaskSummary(input, options?.assistantMessage);
+    const siblingLaunches = (options?.assistantMessage?.content ?? []).flatMap((block) => {
+        if (block.type !== "toolCall" || block.name !== "subagent")
+            return [];
+        const args = block.arguments && typeof block.arguments === "object" && !Array.isArray(block.arguments)
+            ? block.arguments
+            : undefined;
+        return args ? getRequestedChildLaunches(args) : [];
+    });
+    const launches = siblingLaunches.length > 0 ? siblingLaunches : getRequestedChildLaunches(input);
+    const fullChildrenApproved = launches.some((launch) => launch.permissions === "full");
+    const launchSummary = launches
+        .map((launch) => `${launch.description}\npermissions: ${launch.permissions}`)
+        .join("\n");
+    let resp;
+    try {
+        resp = await approvalHandler({
+            toolName: "subagent",
+            action: SWARM_ACTION,
+            detail: `agent swarm (${count} subagents)${launchSummary || summary ? `\n${launchSummary || summary}` : ""}`,
+            kind: "swarm",
+        });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : NO_SWARM_HANDLER_REASON;
+        return { block: true, reason: message };
+    }
+    const rawDecision = typeof resp === "string" ? resp : resp.decision;
+    const decision = rawDecision === "approve" ? "once" : rawDecision;
+    const feedback = typeof resp === "string" ? undefined : resp.feedback?.trim();
+    if (turnKey) {
+        turnSwarmDecisions.set(turnKey, { decision, ...(feedback ? { feedback } : {}), fullChildrenApproved });
+    }
+    if (decision === "session") {
+        ctx.approvals.add(SWARM_ACTION);
+        if (fullChildrenApproved)
+            ctx.approvals.add(FULL_CHILD_ACTION);
+        return { fullChildrenApproved };
+    }
+    if (decision === "reject") {
+        return { block: true, reason: feedback ? `${SWARM_REJECT_REASON} ${feedback}` : SWARM_REJECT_REASON };
+    }
+    return { fullChildrenApproved };
+}
+function sanitizeDetail(value) {
+    const text = String(value ?? "").trim();
+    return text.length > 200 ? `${text.slice(0, 200)}…` : text;
+}
+/**
+ * Returns a block result when the tool call should be blocked, else undefined.
+ * Read-only tools always pass. YOLO and Auto always pass mutating tools. Plan
+ * mode hard-blocks mutating tools (no prompt). Manual mode gates every mutating
+ * tool; if an approval handler is registered it is asked, otherwise the call is
+ * blocked (fail-closed — no silent allow).
+ */
+export async function gateToolCall(toolName, input, cwd, sessionId, options) {
+    const ctx = getContext(sessionId);
+    const protectedWriteReason = protectedFileWriteReason(toolName, input, cwd);
+    if (protectedWriteReason) {
+        return { block: true, reason: protectedWriteReason };
+    }
+    if (READ_ONLY_TOOLS.has(toolName))
+        return undefined;
+    // lunr: agent-swarm gate runs before the mode early-return — it applies in
+    // yolo mode too (only auto mode bypasses it).
+    let swarmCoveredManualApproval = false;
+    if (toolName === "subagent") {
+        const swarmResult = await gateSwarmCall(input, ctx, options);
+        if (swarmResult && "block" in swarmResult)
+            return swarmResult;
+        swarmCoveredManualApproval = ctx.mode === "manual" && swarmResult?.fullChildrenApproved === true;
+    }
+    if (ctx.mode === "plan") {
+        const reason = planModeBlockReason(toolName, input);
+        return reason ? { block: true, reason } : undefined;
+    }
+    if (ctx.mode !== "manual")
+        return undefined;
+    if (!requiresManualApproval(toolName, input) || swarmCoveredManualApproval)
+        return undefined;
+    let action;
+    let detail;
+    if (toolName === "bash") {
+        action = "bash";
+        detail = sanitizeDetail(input.command);
+    }
+    else if (toolName === "edit" || toolName === "write") {
+        const path = resolvePath(cwd, input.path);
+        const outside = path ? isPathOutsideCwd(path, cwd) : false;
+        action = outside ? `${toolName}-outside` : toolName;
+        detail = path || String(input.path ?? "");
+    }
+    else if (toolName === "memory_add") {
+        action = toolName;
+        detail = sanitizeDetail(input.content);
+    }
+    else if (toolName === "memory_remove") {
+        action = toolName;
+        detail = sanitizeDetail(input.line);
+    }
+    else if (toolName === "cron") {
+        action = "cron";
+        detail = sanitizeDetail(input.action);
+    }
+    else if (toolName === "subagent") {
+        action = FULL_CHILD_ACTION;
+        const launches = getRequestedChildLaunches(input).filter((launch) => launch.permissions === "full");
+        detail = sanitizeDetail(launches.map((launch) => `${launch.description}\npermissions: ${launch.permissions}`).join("\n"));
+    }
+    else if (toolName === "code_rewrite") {
+        action = "code_rewrite";
+        detail = sanitizeDetail(input.path ?? input.pattern);
+    }
+    else {
+        // All other mutating tools fall back to the tool name with no extra detail.
+        action = toolName;
+        detail = "";
+    }
+    if (ctx.approvals.has(action))
+        return undefined;
+    if (!approvalHandler) {
+        return { block: true, reason: NO_HANDLER_REASON };
+    }
+    let resp;
+    try {
+        resp = await approvalHandler({ toolName, action, detail });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : NO_HANDLER_REASON;
+        return { block: true, reason: message };
+    }
+    const decision = typeof resp === "string" ? resp : resp.decision;
+    if (decision === "session") {
+        ctx.approvals.add(action);
+        return undefined;
+    }
+    if (decision === "reject") {
+        const feedback = typeof resp === "string" ? undefined : resp.feedback?.trim();
+        return { block: true, reason: feedback ? `${REJECT_REASON} ${feedback}` : REJECT_REASON };
+    }
+    // "once" — allow this call only
+    return undefined;
+}
+//# sourceMappingURL=permissions.js.map