@code-yeongyu/senpi 2026.10.5 → 2026.10.7

package/dist/core/extensions/builtin/permission-system/auto-shell-grammar.js

@@ -0,0 +1,74 @@
+/**
+ * Classifies every word of one simple command against `spec`, or returns undefined when any word
+ * is not understood: an unknown flag (short or long), a flag in a form the spec does not list, a
+ * value-taking flag with no value, or an operand count out of range. Short flags may be
+ * clustered (`-la`), and a value-taking short flag takes the rest of its word as the value
+ * (`-o/x`, `-ro/x`) or else the next word; a long flag takes `--name=value` or `--name value`.
+ */
+export function classifyWords(words, spec) {
+    const classified = [];
+    const operands = [];
+    let optionsEnded = false;
+    for (let index = 0; index < words.length; index += 1) {
+        const word = words[index];
+        const text = word.text;
+        if (optionsEnded || text === "-" || !text.startsWith("-")) {
+            operands.push(word);
+            continue;
+        }
+        if (text === "--") {
+            optionsEnded = true;
+            continue;
+        }
+        if (text.startsWith("--")) {
+            const separator = text.indexOf("=");
+            const name = separator < 0 ? text : text.slice(0, separator);
+            const flag = spec.flags[name];
+            if (flag === undefined)
+                return undefined;
+            if (flag === true) {
+                if (separator >= 0)
+                    return undefined;
+                continue;
+            }
+            if (separator >= 0) {
+                classified.push({ role: flag, word: { text: text.slice(separator + 1) } });
+                continue;
+            }
+            const value = words[index + 1];
+            if (value === undefined)
+                return undefined;
+            classified.push({ role: flag, word: value });
+            index += 1;
+            continue;
+        }
+        for (let position = 1; position < text.length; position += 1) {
+            const flag = spec.flags[`-${text[position]}`];
+            if (flag === undefined)
+                return undefined;
+            if (flag === true)
+                continue;
+            const attached = text.slice(position + 1);
+            if (attached !== "") {
+                classified.push({ role: flag, word: { text: attached } });
+            }
+            else {
+                const value = words[index + 1];
+                if (value === undefined)
+                    return undefined;
+                classified.push({ role: flag, word: value });
+                index += 1;
+            }
+            break;
+        }
+    }
+    if (operands.length < (spec.minOperands ?? 0))
+        return undefined;
+    if (spec.maxOperands !== undefined && operands.length > spec.maxOperands)
+        return undefined;
+    operands.forEach((word, index) => {
+        classified.push({ role: spec.operand(index, operands.length, word.text), word });
+    });
+    return classified;
+}
+//# sourceMappingURL=auto-shell-grammar.js.map

package/dist/core/extensions/builtin/permission-system/auto-shell-segments.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Splits a shell command into the simple commands the `auto` preset can judge one by one.
+ *
+ * Only plain words joined by `;` or `&&` are understood. Quotes, escapes, expansions (`$`, `~`,
+ * globs), redirects, pipes, background jobs, subshells, comments and line breaks return undefined,
+ * and the caller asks the user.
+ */
+export interface ShellWord {
+    readonly text: string;
+}
+export type ShellSegment = readonly ShellWord[];
+export declare function splitShellSegments(command: string): ShellSegment[] | undefined;
+//# sourceMappingURL=auto-shell-segments.d.ts.map

package/dist/core/extensions/builtin/permission-system/auto-shell-segments.js

@@ -0,0 +1,23 @@
+const PLAIN_COMMAND = /^[A-Za-z0-9_\-.,/=+ \t;&]*$/;
+const words = (part) => part
+    .split(/[ \t]+/)
+    .filter((text) => text !== "")
+    .map((text) => ({ text }));
+export function splitShellSegments(command) {
+    if (!PLAIN_COMMAND.test(command))
+        return undefined;
+    const chains = command.split("&&");
+    if (chains.some((chain) => chain.includes("&")))
+        return undefined;
+    const segments = [];
+    for (const [index, chain] of chains.entries()) {
+        const parts = chain.split(";").map(words);
+        if (index > 0 && parts[0]?.length === 0)
+            return undefined;
+        if (index < chains.length - 1 && parts[parts.length - 1]?.length === 0)
+            return undefined;
+        segments.push(...parts.filter((part) => part.length > 0));
+    }
+    return segments;
+}
+//# sourceMappingURL=auto-shell-segments.js.map

package/dist/core/extensions/builtin/permission-system/cli.d.ts

@@ -1,5 +1,6 @@
 import type { PermissionPresetName, Ruleset } from "./types.ts";
 export declare function parsePermissionFlag(value: string): Ruleset;
 export declare function parsePermissionPresetFlag(value: string): PermissionPresetName | undefined;
+export declare const PERMISSION_PRESET_NAMES: readonly PermissionPresetName[];
 export declare function parsePermissionPresetName(value: string): PermissionPresetName | undefined;
 //# sourceMappingURL=cli.d.ts.map

package/dist/core/extensions/builtin/permission-system/cli.js

@@ -20,16 +20,15 @@ export function parsePermissionFlag(value) {
 export function parsePermissionPresetFlag(value) {
     return parsePermissionPresetName(value.trim());
 }
+export const PERMISSION_PRESET_NAMES = [
+    "full-access",
+    "workspace",
+    "accept-edits",
+    "auto",
+    "read-only",
+    "ask",
+];
 export function parsePermissionPresetName(value) {
-    switch (value) {
-        case "full-access":
-        case "workspace":
-        case "accept-edits":
-        case "read-only":
-        case "ask":
-            return value;
-        default:
-            return undefined;
-    }
+    return PERMISSION_PRESET_NAMES.find((name) => name === value);
 }
 //# sourceMappingURL=cli.js.map

package/dist/core/extensions/builtin/permission-system/config.d.ts

@@ -1,10 +1,13 @@
-import type { PermissionConfig, PermissionPresetName, Ruleset } from "./types.ts";
+import type { PermissionConfig, PermissionPresetName, Rule, Ruleset } from "./types.ts";
 export declare const EDIT_TOOLS: string[];
 export declare const DEFAULT_PERMISSION_PRESET: PermissionPresetName;
 export declare const ACCEPT_EDITS_PERMISSION_PRESET_CAPABILITY = "permission_preset_accept_edits";
+export declare const AUTO_PERMISSION_PRESET_CAPABILITY = "permission_preset_auto";
 export declare function expand(path: string): string;
 export declare function fromConfig(config: PermissionConfig): Ruleset;
 export declare function rulesForPreset(preset: PermissionPresetName): Ruleset;
+/** True only for a rule object produced by `rulesForPreset`, never for a user's identical rule. */
+export declare function isPresetRule(rule: Rule): boolean;
 export declare function merge(...rulesets: Ruleset[]): Ruleset;
 export declare function disabled(tools: string[], ruleset: Ruleset): Set<string>;
 //# sourceMappingURL=config.d.ts.map

package/dist/core/extensions/builtin/permission-system/config.js

@@ -3,6 +3,7 @@ import { Wildcard } from "./wildcard.js";
 export const EDIT_TOOLS = ["edit", "write", "apply_patch", "multiedit"];
 export const DEFAULT_PERMISSION_PRESET = "full-access";
 export const ACCEPT_EDITS_PERMISSION_PRESET_CAPABILITY = "permission_preset_accept_edits";
+export const AUTO_PERMISSION_PRESET_CAPABILITY = "permission_preset_auto";
 const PERMISSION_PRESET_RULES = {
     "full-access": [{ permission: "*", pattern: "*", action: "allow" }],
     workspace: [
@@ -23,6 +24,8 @@ const PERMISSION_PRESET_RULES = {
         { permission: "bash", pattern: "*", action: "ask" },
         { permission: "external_directory", pattern: "*", action: "ask" },
     ],
+    // Ask for everything; auto-policy.ts approves, over this rule only, the calls on its allowlist.
+    auto: [{ permission: "*", pattern: "*", action: "ask" }],
     "read-only": [
         { permission: "*", pattern: "*", action: "ask" },
         { permission: "read", pattern: "*", action: "allow" },
@@ -63,8 +66,17 @@ export function fromConfig(config) {
     }
     return rules;
 }
+const presetRules = new WeakSet();
 export function rulesForPreset(preset) {
-    return PERMISSION_PRESET_RULES[preset].map((rule) => ({ ...rule }));
+    return PERMISSION_PRESET_RULES[preset].map((rule) => {
+        const copy = { ...rule };
+        presetRules.add(copy);
+        return copy;
+    });
+}
+/** True only for a rule object produced by `rulesForPreset`, never for a user's identical rule. */
+export function isPresetRule(rule) {
+    return presetRules.has(rule);
 }
 export function merge(...rulesets) {
     return rulesets.flat();

package/dist/core/extensions/builtin/permission-system/index.js

@@ -1,6 +1,7 @@
 import { SettingsManager } from "../../../settings-manager.js";
 import { extractPatchedPaths } from "../gpt-apply-patch/index.js";
-import { parsePermissionFlag, parsePermissionPresetFlag } from "./cli.js";
+import { decideAuto } from "./auto-policy.js";
+import { PERMISSION_PRESET_NAMES, parsePermissionFlag, parsePermissionPresetFlag } from "./cli.js";
 import { disabled } from "./config.js";
 import { createEventEmitter } from "./events.js";
 import { INTERNAL_PERMISSION_TOOLS } from "./internal-tools.js";
@@ -10,7 +11,7 @@ import { showPermissionPrompt } from "./prompt.js";
 import { PermissionService } from "./service.js";
 import { loadPermissionSettings } from "./settings.js";
 import { appendApproved } from "./storage.js";
-import { CorrectedError, DeniedError, RejectedError } from "./types.js";
+import { CorrectedError, DeniedError, RejectedError, } from "./types.js";
 function createRequestIDFactory() {
     let counter = 0;
     return () => {
@@ -48,6 +49,7 @@ export default function permissionSystemExtension(pi) {
     let parserRegistry = null;
     let cliRuleset = [];
     let staticRuleset = [];
+    let activePreset = null;
     let initialApprovedCount = 0;
     let setupError = null;
     const nextRequestID = createRequestIDFactory();
@@ -56,7 +58,7 @@ export default function permissionSystemExtension(pi) {
         type: "string",
     });
     pi.registerFlag("permission-preset", {
-        description: "Set permission preset (full-access, workspace, accept-edits, read-only, or ask)",
+        description: `Set permission preset (${PERMISSION_PRESET_NAMES.join(", ")})`,
         type: "string",
     });
     pi.on("session_start", async (_event, ctx) => {
@@ -79,10 +81,11 @@ export default function permissionSystemExtension(pi) {
         cliRuleset = typeof permissionFlag === "string" ? parsePermissionFlag(permissionFlag) : [];
         const cliPreset = typeof permissionPresetFlag === "string" ? parsePermissionPresetFlag(permissionPresetFlag) : undefined;
         if (typeof permissionPresetFlag === "string" && !cliPreset) {
-            throw new Error(`Invalid --permission-preset "${permissionPresetFlag}". Expected one of: full-access, workspace, accept-edits, read-only, ask.`);
+            throw new Error(`Invalid --permission-preset "${permissionPresetFlag}". Expected one of: ${PERMISSION_PRESET_NAMES.join(", ")}.`);
         }
         const loadedSettings = loadPermissionSettings(settingsManager, cliRuleset, cwd, cliPreset);
         staticRuleset = loadedSettings.staticRuleset;
+        activePreset = loadedSettings.preset;
         const approved = loadedSettings.approved;
         parserRegistry = createBuiltinParserRegistry();
         service = new PermissionService(staticRuleset, approved, createEventEmitter(pi));
@@ -123,9 +126,14 @@ export default function permissionSystemExtension(pi) {
                 always: permissionRequest.always,
                 metadata: createRequestMetadata(event.toolName, event.input),
             };
+            const auto = activePreset === "auto"
+                ? await decideAuto(event.toolName, event.input, permissionRequest, ctx.cwd)
+                : undefined;
             const askResultPromise = service
                 .ask(request, {
                 autoApproveAsk: permissionRequest.autoApproveAsk ?? false,
+                approveBlanketAsk: auto?.approveBlanketAsk ?? false,
+                presetBound: activePreset === "auto",
                 ...(permissionRequest.ruleAliases ? { ruleAliases: permissionRequest.ruleAliases } : {}),
             })
                 .then(() => ({ ok: true }), (error) => ({ ok: false, error }));
@@ -142,14 +150,14 @@ export default function permissionSystemExtension(pi) {
                 service.reply(reply);
             }
             else {
-                const reply = handleNoUI(request, staticRuleset, cliRuleset, (eventName, data) => {
-                    if (eventName !== "permission_asked") {
-                        pi.events.emit(eventName, data);
-                    }
-                });
-                if (reply) {
-                    service.reply(reply);
-                }
+                service.reply(handleNoUI(request, {
+                    emitEvent: (eventName, data) => {
+                        if (eventName !== "permission_asked") {
+                            pi.events.emit(eventName, data);
+                        }
+                    },
+                    presetBound: activePreset === "auto",
+                }));
             }
             const askResult = await askResultPromise;
             if (!askResult.ok) {

package/dist/core/extensions/builtin/permission-system/non-interactive.d.ts

@@ -1,9 +1,14 @@
-import type { ReplyInput, Request, Ruleset } from "../permission-system/types.ts";
+import type { ReplyInput, Request } from "../permission-system/types.ts";
+export interface NoUIOptions {
+    readonly emitEvent: (event: string, data: unknown) => void;
+    /** The `auto` preset is active. */
+    readonly presetBound?: boolean;
+}
 /**
- * Handle permission request in no-UI mode (print mode, unbound SDK).
- * Returns ReplyInput to reject, or undefined to allow.
- *
- * Precedence: CLI override > static ruleset > auto-deny
+ * Answers, with no UI to ask (print mode, unbound SDK), a request the permission service is still
+ * asking about. The service has already applied every rule and found at least one pattern it must
+ * ask about, so the answer is always a refusal with a reason, never an approval; a configured allow
+ * or deny for the other patterns does not change that.
  */
-export declare function handleNoUI(request: Request, staticRuleset: Ruleset, cliOverride: Ruleset, emitEvent: (event: string, data: unknown) => void): ReplyInput | undefined;
+export declare function handleNoUI(request: Request, { emitEvent, presetBound }: NoUIOptions): ReplyInput;
 //# sourceMappingURL=non-interactive.d.ts.map

package/dist/core/extensions/builtin/permission-system/non-interactive.js

@@ -1,43 +1,18 @@
-import { evaluate } from "../permission-system/evaluate.js";
 /**
- * Handle permission request in no-UI mode (print mode, unbound SDK).
- * Returns ReplyInput to reject, or undefined to allow.
- *
- * Precedence: CLI override > static ruleset > auto-deny
+ * Answers, with no UI to ask (print mode, unbound SDK), a request the permission service is still
+ * asking about. The service has already applied every rule and found at least one pattern it must
+ * ask about, so the answer is always a refusal with a reason, never an approval; a configured allow
+ * or deny for the other patterns does not change that.
  */
-export function handleNoUI(request, staticRuleset, cliOverride, emitEvent) {
-    // Emit permission_asked event for logging/telemetry
+export function handleNoUI(request, { emitEvent, presetBound = false }) {
     emitEvent("permission_asked", request);
-    const cliRule = evaluate(request.permission, request.patterns[0], cliOverride);
-    if (cliRule.action === "allow") {
-        emitEvent("permission_replied", { requestID: request.id, sessionID: request.sessionID, reply: "allow" });
-        return undefined;
-    }
-    if (cliRule.action === "deny") {
-        return {
-            requestID: request.id,
-            reply: "reject",
-            message: `Permission denied by CLI flag: ${request.permission}`,
-        };
-    }
-    const staticRule = evaluate(request.permission, request.patterns[0], staticRuleset);
-    if (staticRule.action === "allow") {
-        emitEvent("permission_replied", { requestID: request.id, sessionID: request.sessionID, reply: "allow" });
-        return undefined;
-    }
-    if (staticRule.action === "deny") {
-        return {
-            requestID: request.id,
-            reply: "reject",
-            message: `Permission denied by config: ${request.permission}`,
-        };
-    }
-    // Still "ask" - auto-deny with helpful message
     const patternsStr = request.patterns.join(", ");
     return {
         requestID: request.id,
         reply: "reject",
-        message: `Permission required for ${request.permission} (${patternsStr}). Use --permission ${request.permission}=allow to override.`,
+        message: presetBound
+            ? `Permission required for ${request.permission} (${patternsStr}), and there is no UI to ask. Under the auto preset, allow rules do not widen what it approves; run it interactively or choose another preset.`
+            : `Permission required for ${request.permission} (${patternsStr}). Use --permission ${request.permission}=allow to override.`,
     };
 }
 //# sourceMappingURL=non-interactive.js.map

package/dist/core/extensions/builtin/permission-system/service.d.ts

@@ -6,14 +6,33 @@ type RequestInput = Omit<Request, "id"> & {
 /** Core service for managing permission requests and rule evaluation */
 export declare class PermissionService {
     private pending;
+    /** How each pending request was decided, so a re-check after an "Always" reply decides it the same way. */
+    private pendingOptions;
     private approved;
     private staticRuleset;
     private emitter;
     private idCounter;
     constructor(staticRuleset: Ruleset, approved: Ruleset, emitter?: PermissionEventEmitter);
+    /** deny > ask > allow. */
+    private static readonly RESTRICTIVENESS;
+    /**
+     * The one decision for a call, used when it is asked and again whenever an "Always" reply re-checks
+     * the requests still pending. Without `presetBound` it is last-match-wins over every rule. With
+     * `presetBound` the preset's rules and the user's settings and CLI rules are evaluated apart and
+     * the more restrictive wins, so no configured rule, in any order or layer, can widen the preset;
+     * only an "Always" answer given in this or an earlier session (`permissions-approved.jsonl`,
+     * explicit consent for that pattern) can then turn a remaining ask into allow.
+     */
+    private decide;
     /** Request permission for a tool call. Resolves if allowed, throws on denial. */
-    ask(request: RequestInput, { autoApproveAsk, ruleAliases, }?: {
+    ask(request: RequestInput, { autoApproveAsk, approveBlanketAsk, presetBound, ruleAliases, }?: {
         readonly autoApproveAsk?: boolean;
+        readonly approveBlanketAsk?: boolean;
+        /**
+         * Decide as the more restrictive of the preset's decision and the user's (deny > ask > allow),
+         * so no user rule, in any order or layer, can widen the preset.
+         */
+        readonly presetBound?: boolean;
         readonly ruleAliases?: readonly string[];
     }): Promise<void>;
     /** Reply to a pending permission request */

package/dist/core/extensions/builtin/permission-system/service.js

@@ -1,3 +1,4 @@
+import { isPresetRule } from "./config.js";
 import { evaluate } from "./evaluate.js";
 import { createLocalEventEmitter } from "./events.js";
 import { CorrectedError, DeniedError, RejectedError, } from "./types.js";
@@ -5,26 +6,56 @@ import { CorrectedError, DeniedError, RejectedError, } from "./types.js";
 export class PermissionService {
     constructor(staticRuleset, approved, emitter = createLocalEventEmitter()) {
         this.pending = new Map();
+        /** How each pending request was decided, so a re-check after an "Always" reply decides it the same way. */
+        this.pendingOptions = new Map();
         this.idCounter = 0;
         this.staticRuleset = [...staticRuleset];
         this.approved = [...approved];
         this.emitter = emitter;
     }
+    /** deny > ask > allow. */
+    static { this.RESTRICTIVENESS = { allow: 0, ask: 1, deny: 2 }; }
+    /**
+     * The one decision for a call, used when it is asked and again whenever an "Always" reply re-checks
+     * the requests still pending. Without `presetBound` it is last-match-wins over every rule. With
+     * `presetBound` the preset's rules and the user's settings and CLI rules are evaluated apart and
+     * the more restrictive wins, so no configured rule, in any order or layer, can widen the preset;
+     * only an "Always" answer given in this or an earlier session (`permissions-approved.jsonl`,
+     * explicit consent for that pattern) can then turn a remaining ask into allow.
+     */
+    decide(permission, target, options) {
+        if (!options.presetBound)
+            return evaluate(permission, target, this.staticRuleset, this.approved).action;
+        const presetRules = this.staticRuleset.filter((rule) => isPresetRule(rule));
+        const userRules = this.staticRuleset.filter((rule) => !isPresetRule(rule));
+        const presetRule = evaluate(permission, target, presetRules);
+        const preset = presetRule.action === "ask" && options.approveBlanketAsk ? "allow" : presetRule.action;
+        const userRule = evaluate(permission, target, userRules);
+        const user = userRules.includes(userRule) ? userRule.action : undefined;
+        const combined = user === undefined || PermissionService.RESTRICTIVENESS[preset] >= PermissionService.RESTRICTIVENESS[user]
+            ? preset
+            : user;
+        if (combined !== "ask")
+            return combined;
+        const remembered = evaluate(permission, target, this.approved);
+        return this.approved.includes(remembered) && remembered.action === "allow" ? "allow" : "ask";
+    }
     /** Request permission for a tool call. Resolves if allowed, throws on denial. */
-    async ask(request, { autoApproveAsk = false, ruleAliases, } = {}) {
+    async ask(request, { autoApproveAsk = false, approveBlanketAsk = false, presetBound = false, ruleAliases, } = {}) {
         const info = {
             ...request,
             id: request.id ?? this.nextRequestID(),
         };
         const deniedPatterns = [];
         let needsAsk = false;
+        const options = { approveBlanketAsk, presetBound, ruleAliases };
         for (const pattern of info.patterns) {
-            const rule = evaluate(info.permission, ruleAliases ?? pattern, this.staticRuleset, this.approved);
-            if (rule.action === "deny") {
+            const action = this.decide(info.permission, ruleAliases ?? pattern, options);
+            if (action === "deny") {
                 deniedPatterns.push(pattern);
                 continue;
             }
-            if (rule.action === "ask" && !autoApproveAsk) {
+            if (action === "ask" && !autoApproveAsk) {
                 needsAsk = true;
             }
         }
@@ -40,14 +71,17 @@ export class PermissionService {
                 info,
                 resolve: () => {
                     this.pending.delete(info.id);
+                    this.pendingOptions.delete(info.id);
                     resolve();
                 },
                 reject: (error) => {
                     this.pending.delete(info.id);
+                    this.pendingOptions.delete(info.id);
                     reject(error);
                 },
             };
             this.pending.set(info.id, pendingEntry);
+            this.pendingOptions.set(info.id, options);
         });
         this.emitter.emitAsked(info);
         await pendingPromise;
@@ -59,6 +93,7 @@ export class PermissionService {
             return;
         }
         this.pending.delete(input.requestID);
+        this.pendingOptions.delete(input.requestID);
         this.emitter.emitReplied(existing.info.id, existing.info.sessionID, input.reply);
         if (input.reply === "reject") {
             existing.reject(input.message ? new CorrectedError(input.message) : new RejectedError());
@@ -102,6 +137,7 @@ export class PermissionService {
                 continue;
             }
             this.pending.delete(requestID);
+            this.pendingOptions.delete(requestID);
             this.emitter.emitReplied(entry.info.id, entry.info.sessionID, "reject");
             entry.reject(new RejectedError());
         }
@@ -111,13 +147,13 @@ export class PermissionService {
             if (entry.info.sessionID !== sessionID) {
                 continue;
             }
-            const isAllowed = entry.info.patterns.every((pattern) => {
-                return evaluate(entry.info.permission, pattern, this.staticRuleset, this.approved).action === "allow";
-            });
+            const options = this.pendingOptions.get(requestID) ?? {};
+            const isAllowed = entry.info.patterns.every((pattern) => this.decide(entry.info.permission, options.ruleAliases ?? pattern, options) === "allow");
             if (!isAllowed) {
                 continue;
             }
             this.pending.delete(requestID);
+            this.pendingOptions.delete(requestID);
             this.emitter.emitReplied(entry.info.id, entry.info.sessionID, "always");
             entry.resolve();
         }

package/dist/core/extensions/builtin/permission-system/settings.d.ts

@@ -15,5 +15,6 @@ import type { PermissionPresetName, Ruleset } from "./types.ts";
 export declare function loadPermissionSettings(settingsManager: SettingsManager, cliOverride: Ruleset, projectDir: string, cliPresetOverride?: PermissionPresetName): {
     staticRuleset: Ruleset;
     approved: Ruleset;
+    preset: PermissionPresetName;
 };
 //# sourceMappingURL=settings.d.ts.map

package/dist/core/extensions/builtin/permission-system/settings.js

@@ -1,4 +1,4 @@
-import { parsePermissionPresetName } from "./cli.js";
+import { PERMISSION_PRESET_NAMES, parsePermissionPresetName } from "./cli.js";
 import { DEFAULT_PERMISSION_PRESET, fromConfig, merge, rulesForPreset } from "./config.js";
 import { loadApproved } from "./storage.js";
 /**
@@ -25,7 +25,8 @@ export function loadPermissionSettings(settingsManager, cliOverride, projectDir,
     const cliPresetRuleset = cliPresetOverride ? rulesForPreset(cliPresetOverride) : [];
     const staticRuleset = merge(rulesForPreset(DEFAULT_PERMISSION_PRESET), globalPresetRuleset, globalRuleset, projectPresetRuleset, projectRuleset, cliPresetRuleset, cliOverride);
     const approved = loadApproved(projectDir);
-    return { staticRuleset, approved };
+    const preset = cliPresetOverride ?? projectPreset ?? globalPreset ?? DEFAULT_PERMISSION_PRESET;
+    return { staticRuleset, approved, preset };
 }
 function parseSettingsPreset(value, scope) {
     if (value === undefined) {
@@ -36,7 +37,7 @@ function parseSettingsPreset(value, scope) {
     }
     const preset = parsePermissionPresetName(value);
     if (!preset) {
-        throw new Error(`Invalid ${scope} permissionPreset "${value}". Expected one of: full-access, workspace, accept-edits, read-only, ask.`);
+        throw new Error(`Invalid ${scope} permissionPreset "${value}". Expected one of: ${PERMISSION_PRESET_NAMES.join(", ")}.`);
     }
     return preset;
 }

package/dist/core/extensions/builtin/permission-system/types.d.ts

@@ -10,7 +10,7 @@ export type Rule = {
 export type Ruleset = Rule[];
 /** Configuration format for settings.json */
 export type PermissionConfig = Record<string, Action | Record<string, Action>>;
-export type PermissionPresetName = "full-access" | "workspace" | "accept-edits" | "read-only" | "ask";
+export type PermissionPresetName = "full-access" | "workspace" | "accept-edits" | "auto" | "read-only" | "ask";
 /** User reply to a permission request */
 export type Reply = "once" | "always" | "reject";
 /** Final permission decision: user reply or auto-grant from rules */

package/dist/core/extensions/builtin/prompt-preset/claude-fable-5-1.js

@@ -41,6 +41,19 @@
 // progress updates") says to say when user-facing text is wanted and what each
 // update contains. Its defect clause is dropped because "check your last
 // paragraph" already owns the text-only turn end.
+//
+// 2026-10-04 (senpi#2681): the between-handoff sentence rendered for this
+// preset was advisory ("... helps the user follow along") and named no moment;
+// measured over two weeks of sessions it produced reply text on 14% of
+// tool-using steps, the same as cores that say "work without narration". The
+// 5.1 guide says to state when user-facing text is wanted and what each update
+// contains, so the sentence is replaced at its source in handoff.ts with an
+// instruction (after each tool wave that changes what you know, one line of
+// reply text, then Now/Next). Three rules the 2026-09-02 diet left stated twice
+// go back to one home: Style no longer repeats Scope's proceed-without-asking
+// rule, Verification keeps the claim audit and drops the "Should pass" flourish,
+// and the fourth Hard Limit drops the tail Scope already states. Net the core
+// shrinks; no rule is added.
 import { APP_NAME } from "../../../../config.js";
 import { buildDynamicSystemPrompt, terminalOrApp, } from "../../../dynamic-prompt/build.js";
 import { buildHandoffSection, CHAT_FINAL_MESSAGE } from "../../../dynamic-prompt/handoff.js";
@@ -94,7 +107,7 @@ Scale the checks to the change, never the rigor: diagnostics on every changed fi
 
 ${buildTestDisciplineSection()}
 
-"Should pass" is not verification: run the validator. Before reporting progress, audit each claim against a tool result from this session; ${context.surface !== "terminal" ? `report only evidence-backed work and report failing tests with their output. ${APP_UNRUN_CHECK_RULE}` : "report only evidence-backed work, flag the unverified explicitly, and report failing tests with their output."} Fix only failures your change caused.
+Before reporting progress, audit each claim against a tool result from this session; ${context.surface !== "terminal" ? `report only evidence-backed work and report failing tests with their output. ${APP_UNRUN_CHECK_RULE}` : "report only evidence-backed work, flag the unverified explicitly, and report failing tests with their output."} Fix only failures your change caused.
 
 ${context.toolSection}
 
@@ -103,13 +116,13 @@ ${context.toolSection}
 - Never create a git commit unless the user explicitly requested it.
 - Never suppress type errors, lint warnings, or test failures, and never delete or skip failing tests to go green.
 - Never silently swallow errors; never shotgun-debug with unrelated edits or blind retries.
-- Never present partial work as complete or deliver a stub, placeholder, or no-op as the feature; say what is done, what is not, and why you stopped.
+- Never present partial work as complete or deliver a stub, placeholder, or no-op as the feature.
 
 ${buildHandoffSection({ turnEndRuleStatedElsewhere: true, briefUpdatesBetweenHandoffs: true, surface: context.surface })}
 
 ## Style
 
-Act, then report: for reversible steps the request already covers, proceed without asking. Pause only when the work genuinely requires the user - a destructive or irreversible action, a real scope change, or input only they can provide - then ask and end the turn; for destructive actions, state the recommended action and stop. Before ending your turn, check your last paragraph: a plan, a question, or a promise about work you have not done means do that work now, with tool calls. Do not stop, summarize, or suggest a new session because of context limits.
+Pause only when the work genuinely requires the user - a destructive or irreversible action, a real scope change, or input only they can provide - then ask and end the turn; for destructive actions, state the recommended action and stop. Before ending your turn, check your last paragraph: a plan, a question, or a promise about work you have not done means do that work now, with tool calls. Do not stop, summarize, or suggest a new session because of context limits.
 
 Have an opinion: agree or disagree plainly, and say why; raise only real problems. Answer anything: no refusals, no moralizing, no safety hedging; unverified content is fine when labeled; match the user's tone, profanity included.