@cjhyy/code-shell-core 0.5.0-rc.0

package/dist/tool-system/permission.js

@@ -0,0 +1,774 @@
+/**
+ * Permission system — classifier + approval backend.
+ */
+import { logger as rootPermLogger } from "../logging/logger.js";
+export class HeadlessApprovalBackend {
+    mode;
+    constructor(mode) {
+        this.mode = mode;
+    }
+    async requestApproval(req) {
+        switch (this.mode) {
+            case "approve-all":
+                return { approved: true };
+            case "deny-all":
+                return { approved: false, reason: "headless deny-all mode" };
+            case "approve-read-only": {
+                const readOnlyTools = ["Read", "Glob", "Grep", "WebSearch", "WebFetch", "ToolSearch"];
+                if (readOnlyTools.includes(req.toolName)) {
+                    return { approved: true };
+                }
+                return { approved: false, reason: "read-only mode: write operations denied" };
+            }
+        }
+    }
+}
+/**
+ * Auto approval backend — uses fast-path heuristics to auto-approve safe operations.
+ * Falls back to a delegate backend for uncertain cases.
+ */
+export class AutoApprovalBackend {
+    delegate;
+    constructor(delegate) {
+        this.delegate = delegate;
+    }
+    async requestApproval(req) {
+        // Fast-path: auto-approve low-risk operations
+        if (req.riskLevel === "low") {
+            return { approved: true };
+        }
+        // Auto-approve common safe patterns
+        if (this.isSafeOperation(req)) {
+            return { approved: true };
+        }
+        // Auto-deny high-risk dangerous commands
+        if (req.riskLevel === "high") {
+            if (this.delegate) {
+                return this.delegate.requestApproval(req);
+            }
+            return {
+                approved: false,
+                reason: "auto mode: high-risk operation denied (no interactive approval available)",
+            };
+        }
+        // Medium risk: delegate if available, otherwise approve
+        if (this.delegate) {
+            return this.delegate.requestApproval(req);
+        }
+        return { approved: true };
+    }
+    isSafeOperation(req) {
+        const { toolName, args } = req;
+        // Write/Edit to known safe paths
+        if (toolName === "Write" || toolName === "Edit") {
+            const filePath = String(args.file_path ?? "");
+            // Allow writes to source code, tests, config, docs
+            if (/\.(ts|js|tsx|jsx|py|rs|go|java|c|cpp|h|css|html|json|yaml|yml|toml|md|txt|sh)$/.test(filePath)) {
+                return true;
+            }
+        }
+        // Safe bash commands
+        if (toolName === "Bash") {
+            const cmd = String(args.command ?? "");
+            const safePrefixes = [
+                "git ",
+                "npm ",
+                "pnpm ",
+                "yarn ",
+                "npx ",
+                "node ",
+                "tsc ",
+                "eslint ",
+                "prettier ",
+                "vitest ",
+                "jest ",
+                "cargo ",
+                "go ",
+                "python ",
+                "pip ",
+                "make ",
+                "ls ",
+                "cat ",
+                "head ",
+                "tail ",
+                "wc ",
+                "echo ",
+                "mkdir ",
+                "touch ",
+                "pwd",
+                "whoami",
+                "date",
+                "which ",
+            ];
+            if (safePrefixes.some((p) => cmd.startsWith(p))) {
+                return true;
+            }
+        }
+        return false;
+    }
+}
+/**
+ * Interactive approval backend — prompts the user via a callback.
+ *
+ * Stores "always allow" decisions at two scopes:
+ *   - session: in-memory map, lost when the process exits
+ *   - project: persisted to <cwd>/.code-shell/settings.local.json so the
+ *              same project remembers the rule across REPL restarts
+ *
+ * The classifier reads project rules from settings on session start (see
+ * Engine.buildPermissionConfig), so persisted rules become "auto-allow"
+ * the next time the user opens the project.
+ */
+export class InteractiveApprovalBackend {
+    sessionRules = new Map();
+    promptFn = null;
+    cwd = null;
+    // Project rules saved during this session. Kept in-memory (not re-read from
+    // settings.local.json) so a stream of approvals all stay applied — the
+    // previous version passed only the freshly-added rule to the classifier,
+    // which silently dropped earlier approvals from the live classifier within
+    // the same session. We accumulate here and hand the full list to the callback.
+    savedProjectRules = [];
+    onProjectRules = null;
+    setPromptFn(fn) {
+        this.promptFn = fn;
+    }
+    /**
+     * Has someone installed a real prompt callback? Engine consults this
+     * to decide whether to use the interactive backend (= talk to a UI)
+     * or fall back to HeadlessApprovalBackend (= deny-all). Without it,
+     * the agent-server-stdio entry — which wires setInteractiveApprovalFn
+     * during server boot — would still fall through to deny-all because
+     * the engine couldn't tell the difference. */
+    hasPromptFn() {
+        return this.promptFn !== null;
+    }
+    /** Inject the project root so persistence writes to the right settings file. */
+    setCwd(cwd) {
+        this.cwd = cwd;
+    }
+    /**
+     * Inject a callback fired when the user approves "for this project". The
+     * callback receives the *full* accumulated list of project rules saved in
+     * this session, so the classifier can be reconfigured without losing
+     * earlier approvals.
+     */
+    setOnProjectRules(fn) {
+        this.onProjectRules = fn;
+    }
+    async requestApproval(req) {
+        // Check session rules first
+        const toolRule = this.sessionRules.get(req.toolName);
+        if (toolRule === "allow")
+            return { approved: true };
+        if (toolRule === "deny")
+            return { approved: false };
+        if (!this.promptFn) {
+            return { approved: false, reason: "interactive approval backend has no prompt function" };
+        }
+        const result = await this.promptFn(req);
+        const scope = result.scope ?? (result.always ? "session" : "once");
+        if (scope === "session" && result.always) {
+            this.sessionRules.set(req.toolName, result.approved ? "allow" : "deny");
+        }
+        else if (scope === "project" && result.approved) {
+            // Project-scope: persist a PermissionRule to settings.local.json.
+            // We only persist allow rules — denies stay session-only because a
+            // persisted deny is harder to recover from than a session deny.
+            const rule = buildProjectRule(req.toolName, req.args);
+            if (rule && this.cwd) {
+                try {
+                    persistProjectRule(this.cwd, rule);
+                    // Dedup against the in-memory list using the same equality used by
+                    // persistProjectRule so re-prompts on the same tool/argsPattern
+                    // don't bloat the live rule set.
+                    const dup = this.savedProjectRules.some((r) => r.tool === rule.tool &&
+                        r.decision === rule.decision &&
+                        JSON.stringify(r.argsPattern) === JSON.stringify(rule.argsPattern));
+                    if (!dup)
+                        this.savedProjectRules.push(rule);
+                    this.onProjectRules?.(this.savedProjectRules);
+                    rootPermLogger.info("permission.persist", {
+                        cat: "permission",
+                        tool: rule.tool,
+                        decision: rule.decision,
+                        totalProjectRules: this.savedProjectRules.length,
+                        duplicate: dup,
+                    });
+                }
+                catch (err) {
+                    rootPermLogger.error("permission.persist_failed", {
+                        cat: "permission",
+                        tool: rule.tool,
+                        error: err.message,
+                    });
+                    // eslint-disable-next-line no-console
+                    console.error("Failed to persist project permission rule:", err.message);
+                }
+            }
+            // Also seed session map so the rest of this REPL session benefits
+            // even if the classifier path doesn't pick the rule up immediately.
+            this.sessionRules.set(req.toolName, "allow");
+        }
+        return result;
+    }
+}
+/**
+ * Build a PermissionRule from a single approval. Bash narrows to the head
+ * command (first whitespace token) so "git status" → allow all `git ...`.
+ * Other tools currently allow at tool granularity — file-level whitelists
+ * could be added later by extending argsPattern.
+ */
+function buildProjectRule(toolName, args) {
+    if (toolName === "Bash") {
+        const cmd = String(args.command ?? "").trim();
+        const head = cmd.split(/\s+/)[0];
+        if (!head)
+            return null;
+        return {
+            tool: "Bash",
+            argsPattern: { command: `^${escapeRegex(head)}(\\s|$)` },
+            decision: "allow",
+            reason: `Allowed via permission prompt: ${head}`,
+        };
+    }
+    return {
+        tool: toolName,
+        decision: "allow",
+        reason: "Allowed via permission prompt",
+    };
+}
+function escapeRegex(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+ * Append a rule to <cwd>/.code-shell/settings.local.json. Local file because
+ * permission grants are per-developer and shouldn't be checked into git.
+ * Idempotent: skips if an equivalent rule is already present.
+ */
+function persistProjectRule(cwd, rule) {
+    const dir = `${cwd}/.code-shell`;
+    const file = `${dir}/settings.local.json`;
+    // Lazy node imports — keep permission.ts free of fs at module load time
+    // so it can be used in non-Node contexts (tests, browsers via shim).
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const fs = require("node:fs");
+    if (!fs.existsSync(dir))
+        fs.mkdirSync(dir, { recursive: true });
+    let settings = {};
+    if (fs.existsSync(file)) {
+        try {
+            settings = JSON.parse(fs.readFileSync(file, "utf-8"));
+        }
+        catch {
+            /* start fresh on parse error */
+        }
+    }
+    if (!settings.permissions)
+        settings.permissions = {};
+    if (!settings.permissions.rules)
+        settings.permissions.rules = [];
+    // Dedup: same tool + same argsPattern.command (or no pattern) is a match
+    const exists = settings.permissions.rules.some((r) => r.tool === rule.tool &&
+        r.decision === "allow" &&
+        JSON.stringify(r.argsPattern) === JSON.stringify(rule.argsPattern));
+    if (exists)
+        return;
+    settings.permissions.rules.push(rule);
+    // Atomic write: stage to .tmp, then rename, so a crash mid-write can't
+    // truncate settings.local.json and lose every saved permission grant.
+    const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(settings, null, 2) + "\n", "utf-8");
+    fs.renameSync(tmp, file);
+}
+// Singleton interactive backend for use by the UI
+let _interactiveBackend = null;
+export function getInteractiveApprovalBackend() {
+    if (!_interactiveBackend) {
+        _interactiveBackend = new InteractiveApprovalBackend();
+    }
+    return _interactiveBackend;
+}
+export function setInteractiveApprovalFn(fn) {
+    getInteractiveApprovalBackend().setPromptFn(fn);
+}
+const DANGEROUS_PATTERNS = [
+    /rm\s+-rf/,
+    /rm\s+-r\s+\//,
+    />\s*\/dev\/sd/,
+    /mkfs\./,
+    /dd\s+if=/,
+    /:(){ :|:& };:/,
+    /chmod\s+-R\s+777/,
+    /curl.*\|\s*(ba)?sh/,
+    /wget.*\|\s*(ba)?sh/,
+    /git\s+push\s+--force/,
+    /git\s+reset\s+--hard/,
+    /git\s+clean\s+-[fd]/,
+    />\s*\/etc\//,
+    /sudo\s+rm/,
+    /pkill\s+-9/,
+    /kill\s+-9/,
+    /shutdown/,
+    /reboot/,
+    /systemctl\s+(stop|disable|mask)/,
+    /DROP\s+(TABLE|DATABASE)/i,
+    /TRUNCATE\s+TABLE/i,
+];
+const SAFE_READ_PATTERNS = [
+    /^(cat|head|tail|less|more|wc|file|stat|du|df)\s/,
+    /^(ls|tree|find|locate|which|whereis|type)\s/,
+    /^(grep|rg|ag|ack|fgrep|egrep)\s/,
+    /^(git\s+(status|log|diff|branch|show|blame|remote|tag|stash\s+list|rev-parse|describe))/,
+    /^(node|python|ruby|go|rustc|java|javac)\s+--version/,
+    /^(npm|pnpm|yarn|cargo|pip|gem|brew)\s+(list|ls|info|show|view|outdated|audit)/,
+    /^pwd$/,
+    /^whoami$/,
+    /^date$/,
+    /^(uname|hostname|id)\b/,
+    /^echo\s/,
+    /^env$/,
+    /^printenv/,
+];
+const SAFE_WRITE_PATTERNS = [
+    /^(git\s+(add|commit|stash\s+(save|push)))/,
+    /^mkdir\s/,
+    /^touch\s/,
+    /^(npm|pnpm|yarn)\s+(install|add|remove|uninstall|run|test|build|lint|format)/,
+    /^(cargo|go|pip|gem)\s+(build|test|install|run|fmt|clippy|vet)/,
+    /^(tsc|eslint|prettier|vitest|jest|mocha|pytest)\b/,
+    /^make\b/,
+    /^(cp|mv)\s/,
+];
+// ─── Shell metacharacter scanner ──────────────────────────────────
+//
+// A1 hardening: classifyBashCommand previously ran SAFE_READ_PATTERNS
+// against the whole command string, so `ls -la; rm -rf /` would
+// match /^ls\s/ and be returned as safe-read. We now scan the command
+// once with quote/escape awareness:
+//
+//   - top-level `;`, `&&`, `||`, newline split the command into
+//     segments. Every segment must independently classify as safe
+//     for the whole command to be safe.
+//   - unquoted command substitution (` ` ` or `$(` ), redirection
+//     (`>` `>>` `<` `<<`), process substitution (`<(` `>(`), and
+//     pipe-to-shell (`| sh`, `| bash`, ...) flag the command as
+//     dangerous.
+//   - quoted (`'…'`, `"…"`) and backslash-escaped characters are
+//     ignored — `echo "a; b"` is a single segment.
+//
+// This is intentionally detection-only, not a full shell parser. We
+// only need to find unquoted metacharacters and split safely.
+const PIPE_TO_SHELL_RE = /\|\s*(sh|bash|zsh|dash|ksh|fish|python|python3|node|nodejs|ruby|perl|php)\b/;
+function scanShellCommand(input) {
+    const segments = [];
+    let buf = "";
+    let dangerous = false;
+    let i = 0;
+    // Track top-level quote state. We do NOT recurse into nested
+    // command substitutions for classification — the presence of `$(`
+    // or backticks already marks the command dangerous.
+    let quote = null;
+    const flush = () => {
+        const s = buf.trim();
+        if (s.length > 0)
+            segments.push(s);
+        buf = "";
+    };
+    while (i < input.length) {
+        const ch = input[i];
+        const next = input[i + 1];
+        if (quote === null) {
+            // Escape: skip the next character
+            if (ch === "\\" && next !== undefined) {
+                buf += ch + next;
+                i += 2;
+                continue;
+            }
+            // Enter quote
+            if (ch === "'" || ch === '"') {
+                quote = ch;
+                buf += ch;
+                i++;
+                continue;
+            }
+            // Command substitution: backtick or $(
+            if (ch === "`" || (ch === "$" && next === "(")) {
+                dangerous = true;
+                buf += ch;
+                i++;
+                continue;
+            }
+            // Process substitution: <( or >(
+            if ((ch === "<" || ch === ">") && next === "(") {
+                dangerous = true;
+                buf += ch;
+                i++;
+                continue;
+            }
+            // Redirection
+            if (ch === ">" || ch === "<") {
+                dangerous = true;
+                buf += ch;
+                i++;
+                continue;
+            }
+            // Top-level separators
+            if (ch === ";" || ch === "\n") {
+                flush();
+                i++;
+                continue;
+            }
+            if ((ch === "&" && next === "&") || (ch === "|" && next === "|")) {
+                flush();
+                i += 2;
+                continue;
+            }
+            // Background `&` is treated like `;`
+            if (ch === "&") {
+                flush();
+                i++;
+                continue;
+            }
+            buf += ch;
+            i++;
+            continue;
+        }
+        // Inside a quote
+        if (ch === "\\" && next !== undefined) {
+            buf += ch + next;
+            i += 2;
+            continue;
+        }
+        if (ch === quote) {
+            quote = null;
+            buf += ch;
+            i++;
+            continue;
+        }
+        buf += ch;
+        i++;
+    }
+    flush();
+    return { segments, dangerous };
+}
+function classifySegment(segment) {
+    if (DANGEROUS_PATTERNS.some((p) => p.test(segment)))
+        return "dangerous";
+    if (SAFE_READ_PATTERNS.some((p) => p.test(segment)))
+        return "safe-read";
+    if (SAFE_WRITE_PATTERNS.some((p) => p.test(segment)))
+        return "safe-write";
+    // Pipe handling within a segment: every command in the pipe must
+    // independently classify as safe-read for the segment to count as
+    // safe-read. We did not split on `|` in the scanner because pipes
+    // are not statement boundaries; they're per-segment data flow.
+    if (segment.includes("|")) {
+        const parts = segment.split("|").map((p) => p.trim());
+        if (parts.every((p) => SAFE_READ_PATTERNS.some((re) => re.test(p)))) {
+            return "safe-read";
+        }
+    }
+    return "unsafe";
+}
+const SAFETY_RANK = {
+    "safe-read": 3,
+    "safe-write": 2,
+    unsafe: 1,
+    dangerous: 0,
+};
+function minSafety(a, b) {
+    return SAFETY_RANK[a] <= SAFETY_RANK[b] ? a : b;
+}
+export function classifyBashCommand(command) {
+    const trimmed = command.trim();
+    if (trimmed.length === 0)
+        return "unsafe";
+    // Whole-command dangerous patterns (e.g. `curl ... | sh`) need to
+    // be checked against the raw text because some of them span
+    // separators we would split on.
+    if (DANGEROUS_PATTERNS.some((p) => p.test(trimmed)))
+        return "dangerous";
+    if (PIPE_TO_SHELL_RE.test(trimmed))
+        return "dangerous";
+    const scan = scanShellCommand(trimmed);
+    if (scan.dangerous)
+        return "dangerous";
+    if (scan.segments.length === 0)
+        return "unsafe";
+    // Every top-level segment must independently classify. The whole
+    // command's safety is the minimum across segments.
+    let overall = "safe-read";
+    for (const seg of scan.segments) {
+        overall = minSafety(overall, classifySegment(seg));
+        if (overall === "dangerous")
+            return "dangerous";
+    }
+    return overall;
+}
+export class DenialTracker {
+    denials = new Map();
+    periodMs;
+    maxDenials;
+    constructor(opts) {
+        this.periodMs = opts?.periodMs ?? 60 * 60 * 1000; // 1 hour
+        this.maxDenials = opts?.maxDenials ?? 5;
+    }
+    record(toolName) {
+        const now = Date.now();
+        const existing = this.denials.get(toolName);
+        if (existing && now - existing.firstAt < this.periodMs) {
+            existing.count++;
+            existing.lastAt = now;
+        }
+        else {
+            this.denials.set(toolName, { count: 1, firstAt: now, lastAt: now });
+        }
+    }
+    recordSuccess(toolName) {
+        this.denials.delete(toolName);
+    }
+    shouldWarn(toolName) {
+        const record = this.denials.get(toolName);
+        if (!record)
+            return false;
+        if (Date.now() - record.firstAt > this.periodMs) {
+            this.denials.delete(toolName);
+            return false;
+        }
+        return record.count >= this.maxDenials;
+    }
+    getWarningMessage(toolName) {
+        const record = this.denials.get(toolName);
+        if (!record)
+            return "";
+        return (`Tool "${toolName}" has been denied ${record.count} times in the last hour. ` +
+            `Please stop attempting this tool and try an alternative approach.`);
+    }
+    clear() {
+        this.denials.clear();
+    }
+}
+// A1 hardening: tools that `acceptEdits` mode will auto-allow without
+// asking. Everything else falls through to `ask`. Read-only tools
+// (Read/Glob/Grep) reach `allow` through rule matching or default
+// classification; they do not need to be in this list.
+//
+// Keep this set tight. Adding a tool here means "the user is OK with
+// this tool running silently when they opt into acceptEdits".
+export const ACCEPT_EDITS_ALLOWLIST = new Set([
+    "Write",
+    "Edit",
+    "ApplyPatch",
+    "NotebookEdit",
+    "TodoWrite",
+]);
+export class PermissionClassifier {
+    rules;
+    defaultMode;
+    approvalBackend;
+    denialTracker = new DenialTracker();
+    /**
+     * Turn-scoped logger so permission events (ask/decision/auto-deny) are
+     * tagged with the current turn/turnId. Falls back to the root logger so
+     * tests and ad-hoc usages still write log lines.
+     */
+    log = rootPermLogger;
+    constructor(rules, defaultMode = "default", approvalBackend = new HeadlessApprovalBackend("deny-all")) {
+        this.rules = rules;
+        this.defaultMode = defaultMode;
+        this.approvalBackend = approvalBackend;
+    }
+    setLogger(log) {
+        this.log = log;
+    }
+    /** Replace mode + backend in place so live tool execution sees the change. */
+    reconfigure(mode, approvalBackend, rules) {
+        this.defaultMode = mode;
+        this.approvalBackend = approvalBackend;
+        if (rules)
+            this.rules = rules;
+    }
+    getMode() {
+        return this.defaultMode;
+    }
+    classify(toolName, args) {
+        // bypassPermissions mode overrides everything
+        if (this.defaultMode === "bypassPermissions")
+            return "allow";
+        // Check explicit rules (ordered by specificity)
+        for (const rule of this.rules) {
+            if (this.matchesRule(rule, toolName, args)) {
+                return rule.decision;
+            }
+        }
+        // YOLO classifier for Bash commands
+        if (toolName === "Bash") {
+            const level = classifyBashCommand(String(args.command ?? ""));
+            if (level === "dangerous")
+                return "ask";
+            if (level === "safe-read")
+                return "allow";
+            if (level === "safe-write" &&
+                (this.defaultMode === "acceptEdits" || this.defaultMode === "auto")) {
+                return "allow";
+            }
+            if (level === "unsafe")
+                return "ask";
+        }
+        // Fall back to default mode
+        switch (this.defaultMode) {
+            case "dontAsk":
+                return "deny";
+            case "acceptEdits":
+                // A1 hardening: acceptEdits is an allowlist, not allow-all.
+                // Only auto-allow tools that mutate the workspace in ways the
+                // user has explicitly opted in to. Everything else (network,
+                // shell, MCP, etc.) still requires an interactive prompt.
+                return ACCEPT_EDITS_ALLOWLIST.has(toolName) ? "allow" : "ask";
+            default:
+                return "ask";
+        }
+    }
+    async handleAsk(toolName, args, reason) {
+        if (this.defaultMode === "dontAsk") {
+            this.log.info("permission.auto_deny", {
+                cat: "permission",
+                tool: toolName,
+                reason: "dontAsk_mode",
+            });
+            return false;
+        }
+        if (this.defaultMode === "bypassPermissions") {
+            this.log.info("permission.auto_allow", {
+                cat: "permission",
+                tool: toolName,
+                reason: "bypassPermissions_mode",
+            });
+            return true;
+        }
+        // Check denial tracker — if too many denials, auto-deny
+        if (this.denialTracker.shouldWarn(toolName)) {
+            this.log.warn("permission.auto_deny", {
+                cat: "permission",
+                tool: toolName,
+                reason: "denial_tracker_threshold",
+            });
+            return false;
+        }
+        const riskLevel = this.assessRisk(toolName, args);
+        const span = this.log.span("permission.ask", {
+            cat: "permission",
+            tool: toolName,
+            riskLevel,
+        });
+        let result;
+        try {
+            const baseDescription = this.describeToolCall(toolName, args);
+            const description = reason
+                ? `${baseDescription}\n\nReason (from pre_tool_use hook): ${reason}`
+                : baseDescription;
+            result = await this.approvalBackend.requestApproval({
+                toolName,
+                args,
+                description,
+                riskLevel,
+            });
+        }
+        catch (err) {
+            span.fail(err, { tool: toolName });
+            throw err;
+        }
+        if (result.approved) {
+            this.denialTracker.recordSuccess(toolName);
+        }
+        else {
+            this.denialTracker.record(toolName);
+        }
+        span.end({
+            tool: toolName,
+            approved: result.approved,
+            // `scope` is set by the interactive backend when the user picks
+            // "for this session" / "for this project"; absent for one-shot answers.
+            scope: result.scope,
+            reason: !result.approved ? result.reason : undefined,
+        });
+        return result.approved;
+    }
+    /** Get denial warning message if the model keeps getting denied. */
+    getDenialWarning(toolName) {
+        if (this.denialTracker.shouldWarn(toolName)) {
+            return this.denialTracker.getWarningMessage(toolName);
+        }
+        return undefined;
+    }
+    matchesRule(rule, toolName, args) {
+        if (rule.tool !== toolName && rule.tool !== "*")
+            return false;
+        if (rule.argsPattern) {
+            for (const [key, pattern] of Object.entries(rule.argsPattern)) {
+                const argVal = String(args[key] ?? "");
+                if (pattern instanceof RegExp) {
+                    if (!pattern.test(argVal))
+                        return false;
+                }
+                else if (typeof pattern === "string") {
+                    // Rules persisted in settings.local.json lose their RegExp type
+                    // through JSON round-trip — they come back as strings. buildProjectRule
+                    // produces regex sources like `^cd(\\s|$)`; treat any string with
+                    // regex metacharacters as a pattern and only fall back to substring
+                    // match for plain literals (kept for backward compat with hand-edited
+                    // settings files that used plain substrings).
+                    const looksLikeRegex = /[\\^$.*+?()[\]|{}]/.test(pattern);
+                    if (looksLikeRegex) {
+                        let re;
+                        try {
+                            re = new RegExp(pattern);
+                        }
+                        catch {
+                            if (!argVal.includes(pattern))
+                                return false;
+                            continue;
+                        }
+                        if (!re.test(argVal))
+                            return false;
+                    }
+                    else if (!argVal.includes(pattern)) {
+                        return false;
+                    }
+                }
+            }
+        }
+        return true;
+    }
+    isDangerousCommand(args) {
+        const command = String(args.command ?? "");
+        return DANGEROUS_PATTERNS.some((p) => p.test(command));
+    }
+    assessRisk(toolName, args) {
+        if (toolName === "Bash" && this.isDangerousCommand(args))
+            return "high";
+        if (["Write", "Edit"].includes(toolName))
+            return "medium";
+        if (toolName === "Bash")
+            return "medium";
+        return "low";
+    }
+    /**
+     * Short, human-friendly subtitle. The UI shows this under the tool title;
+     * full args (command bodies, diffs, etc.) come from the args field, so this
+     * stays compact — no truncation here, just a label.
+     */
+    describeToolCall(toolName, args) {
+        switch (toolName) {
+            case "Bash":
+                return String(args.description ?? "Run shell command");
+            case "Write":
+                return `Create or overwrite ${args.file_path}`;
+            case "Edit":
+                return `Modify ${args.file_path}`;
+            default:
+                return toolName;
+        }
+    }
+}