@iaforged/context-code 1.0.62 → 1.0.65

package/dist/src/utils/permissions/permissions.js

@@ -1,1065 +0,0 @@
-import { feature } from '../../recovery/bunBundleShim.js';
-import { createRequire } from 'module';
-const require = createRequire(import.meta.url);
-import { APIUserAbortError } from '@anthropic-ai/sdk';
-import { getToolNameForPermissionCheck, mcpInfoFromString, } from '../../services/mcp/mcpStringUtils.js';
-import { AGENT_TOOL_NAME } from '../../tools/AgentTool/constants.js';
-import { shouldUseSandbox } from '../../tools/BashTool/shouldUseSandbox.js';
-import { BASH_TOOL_NAME } from '../../tools/BashTool/toolName.js';
-import { POWERSHELL_TOOL_NAME } from '../../tools/PowerShellTool/toolName.js';
-import { REPL_TOOL_NAME } from '../../tools/REPLTool/constants.js';
-import { extractOutputRedirections } from '../bash/commands.js';
-import { logForDebugging } from '../debug.js';
-import { AbortError, toError } from '../errors.js';
-import { logError } from '../log.js';
-import { SandboxManager } from '../sandbox/sandbox-adapter.js';
-import { getSettingSourceDisplayNameLowercase, SETTING_SOURCES, } from '../settings/constants.js';
-import { plural } from '../stringUtils.js';
-import { permissionModeTitle } from './PermissionMode.js';
-import { applyPermissionUpdate, applyPermissionUpdates, persistPermissionUpdates, } from './PermissionUpdate.js';
-import { permissionRuleValueFromString, permissionRuleValueToString, } from './permissionRuleParser.js';
-import { deletePermissionRuleFromSettings, shouldAllowManagedPermissionRulesOnly, } from './permissionsLoader.js';
-/* eslint-disable @typescript-eslint/no-require-imports */
-const classifierDecisionModule = feature('TRANSCRIPT_CLASSIFIER')
-    ? require('./classifierDecision.js')
-    : null;
-const autoModeStateModule = feature('TRANSCRIPT_CLASSIFIER')
-    ? require('./autoModeState.js')
-    : null;
-import { addToTurnClassifierDuration, getTotalCacheCreationInputTokens, getTotalCacheReadInputTokens, getTotalInputTokens, getTotalOutputTokens, } from '../../bootstrap/state.js';
-import { getFeatureValue_CACHED_WITH_REFRESH } from '../../services/analytics/growthbook.js';
-import { logEvent, } from '../../services/analytics/index.js';
-import { sanitizeToolNameForAnalytics } from '../../services/analytics/metadata.js';
-import { clearClassifierChecking, setClassifierChecking, } from '../classifierApprovals.js';
-import { isInProtectedNamespace } from '../envUtils.js';
-import { executePermissionRequestHooks } from '../hooks.js';
-import { AUTO_REJECT_MESSAGE, buildClassifierUnavailableMessage, buildYoloRejectionMessage, DONT_ASK_REJECT_MESSAGE, } from '../messages.js';
-import { calculateCostFromTokens } from '../modelCost.js';
-/* eslint-enable @typescript-eslint/no-require-imports */
-import { jsonStringify } from '../slowOperations.js';
-import { createDenialTrackingState, DENIAL_LIMITS, recordDenial, recordSuccess, shouldFallbackToPrompting, } from './denialTracking.js';
-import { classifyYoloAction, formatActionForClassifier, } from './yoloClassifier.js';
-const CLASSIFIER_FAIL_CLOSED_REFRESH_MS = 30 * 60 * 1000; // 30 minutes
-const PERMISSION_RULE_SOURCES = [
-    ...SETTING_SOURCES,
-    'cliArg',
-    'command',
-    'session',
-];
-export function permissionRuleSourceDisplayString(source) {
-    return getSettingSourceDisplayNameLowercase(source);
-}
-export function getAllowRules(context) {
-    return PERMISSION_RULE_SOURCES.flatMap(source => (context.alwaysAllowRules[source] || []).map(ruleString => ({
-        source,
-        ruleBehavior: 'allow',
-        ruleValue: permissionRuleValueFromString(ruleString),
-    })));
-}
-/**
- * Creates a permission request message that explain the permission request
- */
-export function createPermissionRequestMessage(toolName, decisionReason) {
-    // Handle different decision reason types
-    if (decisionReason) {
-        if ((feature('BASH_CLASSIFIER') || feature('TRANSCRIPT_CLASSIFIER')) &&
-            decisionReason.type === 'classifier') {
-            return `Classifier '${decisionReason.classifier}' requires approval for this ${toolName} command: ${decisionReason.reason}`;
-        }
-        switch (decisionReason.type) {
-            case 'hook': {
-                const hookMessage = decisionReason.reason
-                    ? `Hook '${decisionReason.hookName}' blocked this action: ${decisionReason.reason}`
-                    : `Hook '${decisionReason.hookName}' requires approval for this ${toolName} command`;
-                return hookMessage;
-            }
-            case 'rule': {
-                const ruleString = permissionRuleValueToString(decisionReason.rule.ruleValue);
-                const sourceString = permissionRuleSourceDisplayString(decisionReason.rule.source);
-                return `Permission rule '${ruleString}' from ${sourceString} requires approval for this ${toolName} command`;
-            }
-            case 'subcommandResults': {
-                const needsApproval = [];
-                for (const [cmd, result] of decisionReason.reasons) {
-                    if (result.behavior === 'ask' || result.behavior === 'passthrough') {
-                        // Strip output redirections for display to avoid showing filenames as commands
-                        // Only do this for Bash tool to avoid affecting other tools
-                        if (toolName === 'Bash') {
-                            const { commandWithoutRedirections, redirections } = extractOutputRedirections(cmd);
-                            // Only use stripped version if there were actual redirections
-                            const displayCmd = redirections.length > 0 ? commandWithoutRedirections : cmd;
-                            needsApproval.push(displayCmd);
-                        }
-                        else {
-                            needsApproval.push(cmd);
-                        }
-                    }
-                }
-                if (needsApproval.length > 0) {
-                    const n = needsApproval.length;
-                    return `This ${toolName} command contains multiple operations. The following ${plural(n, 'part')} ${plural(n, 'requires', 'require')} approval: ${needsApproval.join(', ')}`;
-                }
-                return `This ${toolName} command contains multiple operations that require approval`;
-            }
-            case 'permissionPromptTool':
-                return `Tool '${decisionReason.permissionPromptToolName}' requires approval for this ${toolName} command`;
-            case 'sandboxOverride':
-                return 'Run outside of the sandbox';
-            case 'workingDir':
-                return decisionReason.reason;
-            case 'safetyCheck':
-            case 'other':
-                return decisionReason.reason;
-            case 'mode': {
-                const modeTitle = permissionModeTitle(decisionReason.mode);
-                return `Current permission mode (${modeTitle}) requires approval for this ${toolName} command`;
-            }
-            case 'asyncAgent':
-                return decisionReason.reason;
-        }
-    }
-    // Default message without listing allowed commands
-    const message = `Claude requested permissions to use ${toolName}, but you haven't granted it yet.`;
-    return message;
-}
-export function getDenyRules(context) {
-    return PERMISSION_RULE_SOURCES.flatMap(source => (context.alwaysDenyRules[source] || []).map(ruleString => ({
-        source,
-        ruleBehavior: 'deny',
-        ruleValue: permissionRuleValueFromString(ruleString),
-    })));
-}
-export function getAskRules(context) {
-    return PERMISSION_RULE_SOURCES.flatMap(source => (context.alwaysAskRules[source] || []).map(ruleString => ({
-        source,
-        ruleBehavior: 'ask',
-        ruleValue: permissionRuleValueFromString(ruleString),
-    })));
-}
-/**
- * Check if the entire tool matches a rule
- * For example, this matches "Bash" but not "Bash(prefix:*)" for BashTool
- * This also matches MCP tools with a server name, e.g. the rule "mcp__server1"
- */
-function toolMatchesRule(tool, rule) {
-    // Rule must not have content to match the entire tool
-    if (rule.ruleValue.ruleContent !== undefined) {
-        return false;
-    }
-    // MCP tools are matched by their fully qualified mcp__server__tool name. In
-    // skip-prefix mode (CLAUDE_AGENT_SDK_MCP_NO_PREFIX), MCP tools have unprefixed
-    // display names (e.g., "Write") that collide with builtin names; rules targeting
-    // builtins should not match their MCP replacements.
-    const nameForRuleMatch = getToolNameForPermissionCheck(tool);
-    // Direct tool name match
-    if (rule.ruleValue.toolName === nameForRuleMatch) {
-        return true;
-    }
-    // MCP server-level permission: rule "mcp__server1" matches tool "mcp__server1__tool1"
-    // Also supports wildcard: rule "mcp__server1__*" matches all tools from server1
-    const ruleInfo = mcpInfoFromString(rule.ruleValue.toolName);
-    const toolInfo = mcpInfoFromString(nameForRuleMatch);
-    return (ruleInfo !== null &&
-        toolInfo !== null &&
-        (ruleInfo.toolName === undefined || ruleInfo.toolName === '*') &&
-        ruleInfo.serverName === toolInfo.serverName);
-}
-/**
- * Check if the entire tool is listed in the always allow rules
- * For example, this finds "Bash" but not "Bash(prefix:*)" for BashTool
- */
-export function toolAlwaysAllowedRule(context, tool) {
-    return (getAllowRules(context).find(rule => toolMatchesRule(tool, rule)) || null);
-}
-/**
- * Check if the tool is listed in the always deny rules
- */
-export function getDenyRuleForTool(context, tool) {
-    return getDenyRules(context).find(rule => toolMatchesRule(tool, rule)) || null;
-}
-/**
- * Check if the tool is listed in the always ask rules
- */
-export function getAskRuleForTool(context, tool) {
-    return getAskRules(context).find(rule => toolMatchesRule(tool, rule)) || null;
-}
-/**
- * Check if a specific agent is denied via Agent(agentType) syntax.
- * For example, Agent(Explore) would deny the Explore agent.
- */
-export function getDenyRuleForAgent(context, agentToolName, agentType) {
-    return (getDenyRules(context).find(rule => rule.ruleValue.toolName === agentToolName &&
-        rule.ruleValue.ruleContent === agentType) || null);
-}
-/**
- * Filter agents to exclude those that are denied via Agent(agentType) syntax.
- */
-export function filterDeniedAgents(agents, context, agentToolName) {
-    // Parse deny rules once and collect Agent(x) contents into a Set.
-    // Previously this called getDenyRuleForAgent per agent, which re-parsed
-    // every deny rule for every agent (O(agents×rules) parse calls).
-    const deniedAgentTypes = new Set();
-    for (const rule of getDenyRules(context)) {
-        if (rule.ruleValue.toolName === agentToolName &&
-            rule.ruleValue.ruleContent !== undefined) {
-            deniedAgentTypes.add(rule.ruleValue.ruleContent);
-        }
-    }
-    return agents.filter(agent => !deniedAgentTypes.has(agent.agentType));
-}
-/**
- * Map of rule contents to the associated rule for a given tool.
- * e.g. the string key is "prefix:*" from "Bash(prefix:*)" for BashTool
- */
-export function getRuleByContentsForTool(context, tool, behavior) {
-    return getRuleByContentsForToolName(context, getToolNameForPermissionCheck(tool), behavior);
-}
-// Used to break circular dependency where a Tool calls this function
-export function getRuleByContentsForToolName(context, toolName, behavior) {
-    const ruleByContents = new Map();
-    let rules = [];
-    switch (behavior) {
-        case 'allow':
-            rules = getAllowRules(context);
-            break;
-        case 'deny':
-            rules = getDenyRules(context);
-            break;
-        case 'ask':
-            rules = getAskRules(context);
-            break;
-    }
-    for (const rule of rules) {
-        if (rule.ruleValue.toolName === toolName &&
-            rule.ruleValue.ruleContent !== undefined &&
-            rule.ruleBehavior === behavior) {
-            ruleByContents.set(rule.ruleValue.ruleContent, rule);
-        }
-    }
-    return ruleByContents;
-}
-/**
- * Runs PermissionRequest hooks for headless/async agents that cannot show
- * permission prompts. This gives hooks an opportunity to allow or deny
- * tool use before the fallback auto-deny kicks in.
- *
- * Returns a PermissionDecision if a hook made a decision, or null if no
- * hook provided a decision (caller should proceed to auto-deny).
- */
-async function runPermissionRequestHooksForHeadlessAgent(tool, input, toolUseID, context, permissionMode, suggestions) {
-    try {
-        for await (const hookResult of executePermissionRequestHooks(tool.name, toolUseID, input, context, permissionMode, suggestions, context.abortController.signal)) {
-            if (!hookResult.permissionRequestResult) {
-                continue;
-            }
-            const decision = hookResult.permissionRequestResult;
-            if (decision.behavior === 'allow') {
-                const finalInput = decision.updatedInput ?? input;
-                // Persist permission updates if provided
-                if (decision.updatedPermissions?.length) {
-                    persistPermissionUpdates(decision.updatedPermissions);
-                    context.setAppState(prev => ({
-                        ...prev,
-                        toolPermissionContext: applyPermissionUpdates(prev.toolPermissionContext, decision.updatedPermissions),
-                    }));
-                }
-                return {
-                    behavior: 'allow',
-                    updatedInput: finalInput,
-                    decisionReason: {
-                        type: 'hook',
-                        hookName: 'PermissionRequest',
-                    },
-                };
-            }
-            if (decision.behavior === 'deny') {
-                if (decision.interrupt) {
-                    logForDebugging(`Hook interrupt: tool=${tool.name} hookMessage=${decision.message}`);
-                    context.abortController.abort();
-                }
-                return {
-                    behavior: 'deny',
-                    message: decision.message || 'Permission denied by hook',
-                    decisionReason: {
-                        type: 'hook',
-                        hookName: 'PermissionRequest',
-                        reason: decision.message,
-                    },
-                };
-            }
-        }
-    }
-    catch (error) {
-        // If hooks fail, fall through to auto-deny rather than crashing
-        logError(new Error('PermissionRequest hook failed for headless agent', {
-            cause: toError(error),
-        }));
-    }
-    return null;
-}
-export const hasPermissionsToUseTool = async (tool, input, context, assistantMessage, toolUseID) => {
-    const result = await hasPermissionsToUseToolInner(tool, input, context);
-    // Reset consecutive denials on any allowed tool use in auto mode.
-    // This ensures that a successful tool use (even one auto-allowed by rules)
-    // breaks the consecutive denial streak.
-    if (result.behavior === 'allow') {
-        const appState = context.getAppState();
-        if (feature('TRANSCRIPT_CLASSIFIER')) {
-            const currentDenialState = context.localDenialTracking ?? appState.denialTracking;
-            if (appState.toolPermissionContext.mode === 'auto' &&
-                currentDenialState &&
-                currentDenialState.consecutiveDenials > 0) {
-                const newDenialState = recordSuccess(currentDenialState);
-                persistDenialState(context, newDenialState);
-            }
-        }
-        return result;
-    }
-    // Apply dontAsk mode transformation: convert 'ask' to 'deny'
-    // This is done at the end so it can't be bypassed by early returns
-    if (result.behavior === 'ask') {
-        const appState = context.getAppState();
-        if (appState.toolPermissionContext.mode === 'dontAsk') {
-            return {
-                behavior: 'deny',
-                decisionReason: {
-                    type: 'mode',
-                    mode: 'dontAsk',
-                },
-                message: DONT_ASK_REJECT_MESSAGE(tool.name),
-            };
-        }
-        // Apply auto mode: use AI classifier instead of prompting user
-        // Check this BEFORE shouldAvoidPermissionPrompts so classifiers work in headless mode
-        if (feature('TRANSCRIPT_CLASSIFIER') &&
-            (appState.toolPermissionContext.mode === 'auto' ||
-                (appState.toolPermissionContext.mode === 'plan' &&
-                    (autoModeStateModule?.isAutoModeActive() ?? false)))) {
-            // Non-classifier-approvable safetyCheck decisions stay immune to ALL
-            // auto-approve paths: the acceptEdits fast-path, the safe-tool allowlist,
-            // and the classifier. Step 1g only guards bypassPermissions; this guards
-            // auto. classifierApprovable safetyChecks (sensitive-file paths) fall
-            // through to the classifier — the fast-paths below naturally don't fire
-            // because the tool's own checkPermissions still returns 'ask'.
-            if (result.decisionReason?.type === 'safetyCheck' &&
-                !result.decisionReason.classifierApprovable) {
-                if (appState.toolPermissionContext.shouldAvoidPermissionPrompts) {
-                    return {
-                        behavior: 'deny',
-                        message: result.message,
-                        decisionReason: {
-                            type: 'asyncAgent',
-                            reason: 'Safety check requires interactive approval and permission prompts are not available in this context',
-                        },
-                    };
-                }
-                return result;
-            }
-            if (tool.requiresUserInteraction?.() && result.behavior === 'ask') {
-                return result;
-            }
-            // Use local denial tracking for async subagents (whose setAppState
-            // is a no-op), otherwise read from appState as before.
-            const denialState = context.localDenialTracking ??
-                appState.denialTracking ??
-                createDenialTrackingState();
-            // PowerShell requires explicit user permission in auto mode unless
-            // POWERSHELL_AUTO_MODE (ant-only build flag) is on. When disabled, this
-            // guard keeps PS out of the classifier and skips the acceptEdits
-            // fast-path below. When enabled, PS flows through to the classifier like
-            // Bash — the classifier prompt gets POWERSHELL_DENY_GUIDANCE appended so
-            // it recognizes `iex (iwr ...)` as download-and-execute, etc.
-            // Note: this runs inside the behavior === 'ask' branch, so allow rules
-            // that fire earlier (step 2b toolAlwaysAllowedRule, PS prefix allow)
-            // return before reaching here. Allow-rule protection is handled by
-            // permissionSetup.ts: isOverlyBroadPowerShellAllowRule strips PowerShell(*)
-            // and isDangerousPowerShellPermission strips iex/pwsh/Start-Process
-            // prefix rules for ant users and auto mode entry.
-            if (tool.name === POWERSHELL_TOOL_NAME &&
-                !feature('POWERSHELL_AUTO_MODE')) {
-                if (appState.toolPermissionContext.shouldAvoidPermissionPrompts) {
-                    return {
-                        behavior: 'deny',
-                        message: 'PowerShell tool requires interactive approval',
-                        decisionReason: {
-                            type: 'asyncAgent',
-                            reason: 'PowerShell tool requires interactive approval and permission prompts are not available in this context',
-                        },
-                    };
-                }
-                logForDebugging(`Skipping auto mode classifier for ${tool.name}: tool requires explicit user permission`);
-                return result;
-            }
-            // Before running the auto mode classifier, check if acceptEdits mode would
-            // allow this action. This avoids expensive classifier API calls for safe
-            // operations like file edits in the working directory.
-            // Skip for Agent and REPL — their checkPermissions returns 'allow' for
-            // acceptEdits mode, which would silently bypass the classifier. REPL
-            // code can contain VM escapes between inner tool calls; the classifier
-            // must see the glue JavaScript, not just the inner tool calls.
-            if (result.behavior === 'ask' &&
-                tool.name !== AGENT_TOOL_NAME &&
-                tool.name !== REPL_TOOL_NAME) {
-                try {
-                    const parsedInput = tool.inputSchema.parse(input);
-                    const acceptEditsResult = await tool.checkPermissions(parsedInput, {
-                        ...context,
-                        getAppState: () => {
-                            const state = context.getAppState();
-                            return {
-                                ...state,
-                                toolPermissionContext: {
-                                    ...state.toolPermissionContext,
-                                    mode: 'acceptEdits',
-                                },
-                            };
-                        },
-                    });
-                    if (acceptEditsResult.behavior === 'allow') {
-                        const newDenialState = recordSuccess(denialState);
-                        persistDenialState(context, newDenialState);
-                        logForDebugging(`Skipping auto mode classifier for ${tool.name}: would be allowed in acceptEdits mode`);
-                        logEvent('tengu_auto_mode_decision', {
-                            decision: 'allowed',
-                            toolName: sanitizeToolNameForAnalytics(tool.name),
-                            inProtectedNamespace: isInProtectedNamespace(),
-                            // msg_id of the agent completion that produced this tool_use —
-                            // the action at the bottom of the classifier transcript. Joins
-                            // the decision back to the main agent's API response.
-                            agentMsgId: assistantMessage.message
-                                .id,
-                            confidence: 'high',
-                            fastPath: 'acceptEdits',
-                        });
-                        return {
-                            behavior: 'allow',
-                            updatedInput: acceptEditsResult.updatedInput ?? input,
-                            decisionReason: {
-                                type: 'mode',
-                                mode: 'auto',
-                            },
-                        };
-                    }
-                }
-                catch (e) {
-                    if (e instanceof AbortError || e instanceof APIUserAbortError) {
-                        throw e;
-                    }
-                    // If the acceptEdits check fails, fall through to the classifier
-                }
-            }
-            // Allowlisted tools are safe and don't need YOLO classification.
-            // This uses the safe-tool allowlist to skip unnecessary classifier API calls.
-            if (classifierDecisionModule.isAutoModeAllowlistedTool(tool.name)) {
-                const newDenialState = recordSuccess(denialState);
-                persistDenialState(context, newDenialState);
-                logForDebugging(`Skipping auto mode classifier for ${tool.name}: tool is on the safe allowlist`);
-                logEvent('tengu_auto_mode_decision', {
-                    decision: 'allowed',
-                    toolName: sanitizeToolNameForAnalytics(tool.name),
-                    inProtectedNamespace: isInProtectedNamespace(),
-                    agentMsgId: assistantMessage.message
-                        .id,
-                    confidence: 'high',
-                    fastPath: 'allowlist',
-                });
-                return {
-                    behavior: 'allow',
-                    updatedInput: input,
-                    decisionReason: {
-                        type: 'mode',
-                        mode: 'auto',
-                    },
-                };
-            }
-            // Run the auto mode classifier
-            const action = formatActionForClassifier(tool.name, input);
-            setClassifierChecking(toolUseID);
-            let classifierResult;
-            try {
-                classifierResult = await classifyYoloAction(context.messages, action, context.options.tools, appState.toolPermissionContext, context.abortController.signal);
-            }
-            finally {
-                clearClassifierChecking(toolUseID);
-            }
-            // Notify ants when classifier error dumped prompts (will be in /share)
-            if (process.env.USER_TYPE === 'ant' &&
-                classifierResult.errorDumpPath &&
-                context.addNotification) {
-                context.addNotification({
-                    key: 'auto-mode-error-dump',
-                    text: `Auto mode classifier error — prompts dumped to ${classifierResult.errorDumpPath} (included in /share)`,
-                    priority: 'immediate',
-                    color: 'error',
-                });
-            }
-            // Log classifier decision for metrics (including overhead telemetry)
-            const yoloDecision = classifierResult.unavailable
-                ? 'unavailable'
-                : classifierResult.shouldBlock
-                    ? 'blocked'
-                    : 'allowed';
-            // Compute classifier cost in USD for overhead analysis
-            const classifierCostUSD = classifierResult.usage && classifierResult.model
-                ? calculateCostFromTokens(classifierResult.model, classifierResult.usage)
-                : undefined;
-            logEvent('tengu_auto_mode_decision', {
-                decision: yoloDecision,
-                toolName: sanitizeToolNameForAnalytics(tool.name),
-                inProtectedNamespace: isInProtectedNamespace(),
-                // msg_id of the agent completion that produced this tool_use —
-                // the action at the bottom of the classifier transcript.
-                agentMsgId: assistantMessage.message
-                    .id,
-                classifierModel: classifierResult.model,
-                consecutiveDenials: classifierResult.shouldBlock
-                    ? denialState.consecutiveDenials + 1
-                    : 0,
-                totalDenials: classifierResult.shouldBlock
-                    ? denialState.totalDenials + 1
-                    : denialState.totalDenials,
-                // Overhead telemetry: token usage and latency for the classifier API call
-                classifierInputTokens: classifierResult.usage?.inputTokens,
-                classifierOutputTokens: classifierResult.usage?.outputTokens,
-                classifierCacheReadInputTokens: classifierResult.usage?.cacheReadInputTokens,
-                classifierCacheCreationInputTokens: classifierResult.usage?.cacheCreationInputTokens,
-                classifierDurationMs: classifierResult.durationMs,
-                // Character lengths of the prompt components sent to the classifier
-                classifierSystemPromptLength: classifierResult.promptLengths?.systemPrompt,
-                classifierToolCallsLength: classifierResult.promptLengths?.toolCalls,
-                classifierUserPromptsLength: classifierResult.promptLengths?.userPrompts,
-                // Session totals at time of classifier call (for computing overhead %).
-                // These are main-transcript-only — sideQuery (used by the classifier)
-                // does NOT call addToTotalSessionCost, so classifier tokens are excluded.
-                sessionInputTokens: getTotalInputTokens(),
-                sessionOutputTokens: getTotalOutputTokens(),
-                sessionCacheReadInputTokens: getTotalCacheReadInputTokens(),
-                sessionCacheCreationInputTokens: getTotalCacheCreationInputTokens(),
-                classifierCostUSD,
-                classifierStage: classifierResult.stage,
-                classifierStage1InputTokens: classifierResult.stage1Usage?.inputTokens,
-                classifierStage1OutputTokens: classifierResult.stage1Usage?.outputTokens,
-                classifierStage1CacheReadInputTokens: classifierResult.stage1Usage?.cacheReadInputTokens,
-                classifierStage1CacheCreationInputTokens: classifierResult.stage1Usage?.cacheCreationInputTokens,
-                classifierStage1DurationMs: classifierResult.stage1DurationMs,
-                classifierStage1RequestId: classifierResult.stage1RequestId,
-                classifierStage1MsgId: classifierResult.stage1MsgId,
-                classifierStage1CostUSD: classifierResult.stage1Usage && classifierResult.model
-                    ? calculateCostFromTokens(classifierResult.model, classifierResult.stage1Usage)
-                    : undefined,
-                classifierStage2InputTokens: classifierResult.stage2Usage?.inputTokens,
-                classifierStage2OutputTokens: classifierResult.stage2Usage?.outputTokens,
-                classifierStage2CacheReadInputTokens: classifierResult.stage2Usage?.cacheReadInputTokens,
-                classifierStage2CacheCreationInputTokens: classifierResult.stage2Usage?.cacheCreationInputTokens,
-                classifierStage2DurationMs: classifierResult.stage2DurationMs,
-                classifierStage2RequestId: classifierResult.stage2RequestId,
-                classifierStage2MsgId: classifierResult.stage2MsgId,
-                classifierStage2CostUSD: classifierResult.stage2Usage && classifierResult.model
-                    ? calculateCostFromTokens(classifierResult.model, classifierResult.stage2Usage)
-                    : undefined,
-            });
-            if (classifierResult.durationMs !== undefined) {
-                addToTurnClassifierDuration(classifierResult.durationMs);
-            }
-            if (classifierResult.shouldBlock) {
-                // Transcript exceeded the classifier's context window — deterministic
-                // error, won't recover on retry. Skip iron_gate and fall back to
-                // normal prompting so the user can approve/deny manually.
-                if (classifierResult.transcriptTooLong) {
-                    if (appState.toolPermissionContext.shouldAvoidPermissionPrompts) {
-                        // Permanent condition (transcript only grows) — deny-retry-deny
-                        // wastes tokens without ever hitting the denial-limit abort.
-                        throw new AbortError('Agent aborted: auto mode classifier transcript exceeded context window in headless mode');
-                    }
-                    logForDebugging('Auto mode classifier transcript too long, falling back to normal permission handling', { level: 'warn' });
-                    return {
-                        ...result,
-                        decisionReason: {
-                            type: 'other',
-                            reason: 'Auto mode classifier transcript exceeded context window — falling back to manual approval',
-                        },
-                    };
-                }
-                // When classifier is unavailable (API error), behavior depends on
-                // the tengu_iron_gate_closed gate.
-                if (classifierResult.unavailable) {
-                    if (getFeatureValue_CACHED_WITH_REFRESH('tengu_iron_gate_closed', true, CLASSIFIER_FAIL_CLOSED_REFRESH_MS)) {
-                        logForDebugging('Auto mode classifier unavailable, denying with retry guidance (fail closed)', { level: 'warn' });
-                        return {
-                            behavior: 'deny',
-                            decisionReason: {
-                                type: 'classifier',
-                                classifier: 'auto-mode',
-                                reason: 'Classifier unavailable',
-                            },
-                            message: buildClassifierUnavailableMessage(tool.name, classifierResult.model),
-                        };
-                    }
-                    // Fail open: fall back to normal permission handling
-                    logForDebugging('Auto mode classifier unavailable, falling back to normal permission handling (fail open)', { level: 'warn' });
-                    return result;
-                }
-                // Update denial tracking and check limits
-                const newDenialState = recordDenial(denialState);
-                persistDenialState(context, newDenialState);
-                logForDebugging(`Auto mode classifier blocked action: ${classifierResult.reason}`, { level: 'warn' });
-                // If denial limit hit, fall back to prompting so the user
-                // can review. We check after the classifier so we can include
-                // its reason in the prompt.
-                const denialLimitResult = handleDenialLimitExceeded(newDenialState, appState, classifierResult.reason, assistantMessage, tool, result, context);
-                if (denialLimitResult) {
-                    return denialLimitResult;
-                }
-                return {
-                    behavior: 'deny',
-                    decisionReason: {
-                        type: 'classifier',
-                        classifier: 'auto-mode',
-                        reason: classifierResult.reason,
-                    },
-                    message: buildYoloRejectionMessage(classifierResult.reason),
-                };
-            }
-            // Reset consecutive denials on success
-            const newDenialState = recordSuccess(denialState);
-            persistDenialState(context, newDenialState);
-            return {
-                behavior: 'allow',
-                updatedInput: input,
-                decisionReason: {
-                    type: 'classifier',
-                    classifier: 'auto-mode',
-                    reason: classifierResult.reason,
-                },
-            };
-        }
-        // When permission prompts should be avoided (e.g., background/headless agents),
-        // run PermissionRequest hooks first to give them a chance to allow/deny.
-        // Only auto-deny if no hook provides a decision.
-        if (appState.toolPermissionContext.shouldAvoidPermissionPrompts) {
-            const hookDecision = await runPermissionRequestHooksForHeadlessAgent(tool, input, toolUseID, context, appState.toolPermissionContext.mode, result.suggestions);
-            if (hookDecision) {
-                return hookDecision;
-            }
-            return {
-                behavior: 'deny',
-                decisionReason: {
-                    type: 'asyncAgent',
-                    reason: 'Permission prompts are not available in this context',
-                },
-                message: AUTO_REJECT_MESSAGE(tool.name),
-            };
-        }
-    }
-    return result;
-};
-/**
- * Persist denial tracking state. For async subagents with localDenialTracking,
- * mutate the local state in place (since setAppState is a no-op). Otherwise,
- * write to appState as usual.
- */
-function persistDenialState(context, newState) {
-    if (context.localDenialTracking) {
-        Object.assign(context.localDenialTracking, newState);
-    }
-    else {
-        context.setAppState(prev => {
-            // recordSuccess returns the same reference when state is
-            // unchanged. Returning prev here lets store.setState's Object.is check
-            // skip the listener loop entirely.
-            if (prev.denialTracking === newState)
-                return prev;
-            return { ...prev, denialTracking: newState };
-        });
-    }
-}
-/**
- * Check if a denial limit was exceeded and return an 'ask' result
- * so the user can review. Returns null if no limit was hit.
- */
-function handleDenialLimitExceeded(denialState, appState, classifierReason, assistantMessage, tool, result, context) {
-    if (!shouldFallbackToPrompting(denialState)) {
-        return null;
-    }
-    const hitTotalLimit = denialState.totalDenials >= DENIAL_LIMITS.maxTotal;
-    const isHeadless = appState.toolPermissionContext.shouldAvoidPermissionPrompts;
-    // Capture counts before persistDenialState, which may mutate denialState
-    // in-place via Object.assign for subagents with localDenialTracking.
-    const totalCount = denialState.totalDenials;
-    const consecutiveCount = denialState.consecutiveDenials;
-    const warning = hitTotalLimit
-        ? `${totalCount} actions were blocked this session. Please review the transcript before continuing.`
-        : `${consecutiveCount} consecutive actions were blocked. Please review the transcript before continuing.`;
-    logEvent('tengu_auto_mode_denial_limit_exceeded', {
-        limit: (hitTotalLimit
-            ? 'total'
-            : 'consecutive'),
-        mode: (isHeadless
-            ? 'headless'
-            : 'cli'),
-        messageID: assistantMessage.message
-            .id,
-        consecutiveDenials: consecutiveCount,
-        totalDenials: totalCount,
-        toolName: sanitizeToolNameForAnalytics(tool.name),
-    });
-    if (isHeadless) {
-        throw new AbortError('Agent aborted: too many classifier denials in headless mode');
-    }
-    logForDebugging(`Classifier denial limit exceeded, falling back to prompting: ${warning}`, { level: 'warn' });
-    if (hitTotalLimit) {
-        persistDenialState(context, {
-            ...denialState,
-            totalDenials: 0,
-            consecutiveDenials: 0,
-        });
-    }
-    // Preserve the original classifier value (e.g. 'dangerous-agent-action')
-    // so downstream analytics in interactiveHandler can log the correct
-    // user override event.
-    const originalClassifier = result.decisionReason?.type === 'classifier'
-        ? result.decisionReason.classifier
-        : 'auto-mode';
-    return {
-        ...result,
-        decisionReason: {
-            type: 'classifier',
-            classifier: originalClassifier,
-            reason: `${warning}\n\nLatest blocked action: ${classifierReason}`,
-        },
-    };
-}
-/**
- * Check only the rule-based steps of the permission pipeline — the subset
- * that bypassPermissions mode respects (everything that fires before step 2a).
- *
- * Returns a deny/ask decision if a rule blocks the tool, or null if no rule
- * objects. Unlike hasPermissionsToUseTool, this does NOT run the auto mode classifier,
- * mode-based transformations (dontAsk/auto/asyncAgent), PermissionRequest hooks,
- * or bypassPermissions / always-allowed checks.
- *
- * Caller must pre-check tool.requiresUserInteraction() — step 1e is not replicated.
- */
-export async function checkRuleBasedPermissions(tool, input, context) {
-    const appState = context.getAppState();
-    // 1a. Entire tool is denied by rule
-    const denyRule = getDenyRuleForTool(appState.toolPermissionContext, tool);
-    if (denyRule) {
-        return {
-            behavior: 'deny',
-            decisionReason: {
-                type: 'rule',
-                rule: denyRule,
-            },
-            message: `Permission to use ${tool.name} has been denied.`,
-        };
-    }
-    // 1b. Entire tool has an ask rule
-    const askRule = getAskRuleForTool(appState.toolPermissionContext, tool);
-    if (askRule) {
-        const canSandboxAutoAllow = tool.name === BASH_TOOL_NAME &&
-            SandboxManager.isSandboxingEnabled() &&
-            SandboxManager.isAutoAllowBashIfSandboxedEnabled() &&
-            shouldUseSandbox(input);
-        if (!canSandboxAutoAllow) {
-            return {
-                behavior: 'ask',
-                decisionReason: {
-                    type: 'rule',
-                    rule: askRule,
-                },
-                message: createPermissionRequestMessage(tool.name),
-            };
-        }
-        // Fall through to let tool.checkPermissions handle command-specific rules
-    }
-    // 1c. Tool-specific permission check (e.g. bash subcommand rules)
-    let toolPermissionResult = {
-        behavior: 'passthrough',
-        message: createPermissionRequestMessage(tool.name),
-    };
-    try {
-        const parsedInput = tool.inputSchema.parse(input);
-        toolPermissionResult = await tool.checkPermissions(parsedInput, context);
-    }
-    catch (e) {
-        if (e instanceof AbortError || e instanceof APIUserAbortError) {
-            throw e;
-        }
-        logError(e);
-    }
-    // 1d. Tool implementation denied (catches bash subcommand denies wrapped
-    // in subcommandResults — no need to inspect decisionReason.type)
-    if (toolPermissionResult?.behavior === 'deny') {
-        return toolPermissionResult;
-    }
-    // 1f. Content-specific ask rules from tool.checkPermissions
-    // (e.g. Bash(npm publish:*) → {ask, type:'rule', ruleBehavior:'ask'})
-    if (toolPermissionResult?.behavior === 'ask' &&
-        toolPermissionResult.decisionReason?.type === 'rule' &&
-        toolPermissionResult.decisionReason.rule.ruleBehavior === 'ask') {
-        return toolPermissionResult;
-    }
-    // 1g. Safety checks (e.g. .git/, .claude/, .vscode/, shell configs) are
-    // bypass-immune — they must prompt even when a PreToolUse hook returned
-    // allow. checkPathSafetyForAutoEdit returns {type:'safetyCheck'} for these.
-    if (toolPermissionResult?.behavior === 'ask' &&
-        toolPermissionResult.decisionReason?.type === 'safetyCheck') {
-        return toolPermissionResult;
-    }
-    // No rule-based objection
-    return null;
-}
-async function hasPermissionsToUseToolInner(tool, input, context) {
-    if (context.abortController.signal.aborted) {
-        throw new AbortError();
-    }
-    let appState = context.getAppState();
-    // 1. Check if the tool is denied
-    // 1a. Entire tool is denied
-    const denyRule = getDenyRuleForTool(appState.toolPermissionContext, tool);
-    if (denyRule) {
-        return {
-            behavior: 'deny',
-            decisionReason: {
-                type: 'rule',
-                rule: denyRule,
-            },
-            message: `Permission to use ${tool.name} has been denied.`,
-        };
-    }
-    // 1b. Check if the entire tool should always ask for permission
-    const askRule = getAskRuleForTool(appState.toolPermissionContext, tool);
-    if (askRule) {
-        // When autoAllowBashIfSandboxed is on, sandboxed commands skip the ask rule and
-        // auto-allow via Bash's checkPermissions. Commands that won't be sandboxed (excluded
-        // commands, dangerouslyDisableSandbox) still need to respect the ask rule.
-        const canSandboxAutoAllow = tool.name === BASH_TOOL_NAME &&
-            SandboxManager.isSandboxingEnabled() &&
-            SandboxManager.isAutoAllowBashIfSandboxedEnabled() &&
-            shouldUseSandbox(input);
-        if (!canSandboxAutoAllow) {
-            return {
-                behavior: 'ask',
-                decisionReason: {
-                    type: 'rule',
-                    rule: askRule,
-                },
-                message: createPermissionRequestMessage(tool.name),
-            };
-        }
-        // Fall through to let Bash's checkPermissions handle command-specific rules
-    }
-    // 1c. Ask the tool implementation for a permission result
-    // Overridden unless tool input schema is not valid
-    let toolPermissionResult = {
-        behavior: 'passthrough',
-        message: createPermissionRequestMessage(tool.name),
-    };
-    try {
-        const parsedInput = tool.inputSchema.parse(input);
-        toolPermissionResult = await tool.checkPermissions(parsedInput, context);
-    }
-    catch (e) {
-        // Rethrow abort errors so they propagate properly
-        if (e instanceof AbortError || e instanceof APIUserAbortError) {
-            throw e;
-        }
-        logError(e);
-    }
-    // 1d. Tool implementation denied permission
-    if (toolPermissionResult?.behavior === 'deny') {
-        return toolPermissionResult;
-    }
-    // 1e. Tool requires user interaction even in bypass mode
-    if (tool.requiresUserInteraction?.() &&
-        toolPermissionResult?.behavior === 'ask') {
-        return toolPermissionResult;
-    }
-    // 1f. Content-specific ask rules from tool.checkPermissions take precedence
-    // over bypassPermissions mode. When a user explicitly configures a
-    // content-specific ask rule (e.g. Bash(npm publish:*)), the tool's
-    // checkPermissions returns {behavior:'ask', decisionReason:{type:'rule',
-    // rule:{ruleBehavior:'ask'}}}. This must be respected even in bypass mode,
-    // just as deny rules are respected at step 1d.
-    if (toolPermissionResult?.behavior === 'ask' &&
-        toolPermissionResult.decisionReason?.type === 'rule' &&
-        toolPermissionResult.decisionReason.rule.ruleBehavior === 'ask') {
-        return toolPermissionResult;
-    }
-    // 1g. Safety checks (e.g. .git/, .claude/, .vscode/, shell configs) are
-    // bypass-immune — they must prompt even in bypassPermissions mode.
-    // checkPathSafetyForAutoEdit returns {type:'safetyCheck'} for these paths.
-    if (toolPermissionResult?.behavior === 'ask' &&
-        toolPermissionResult.decisionReason?.type === 'safetyCheck') {
-        return toolPermissionResult;
-    }
-    // 2a. Check if mode allows the tool to run
-    // IMPORTANT: Call getAppState() to get the latest value
-    appState = context.getAppState();
-    // Check if permissions should be bypassed:
-    // - Direct bypassPermissions mode
-    // - Plan mode when the user originally started with bypass mode (isBypassPermissionsModeAvailable)
-    const shouldBypassPermissions = appState.toolPermissionContext.mode === 'bypassPermissions' ||
-        (appState.toolPermissionContext.mode === 'plan' &&
-            appState.toolPermissionContext.isBypassPermissionsModeAvailable);
-    if (shouldBypassPermissions) {
-        return {
-            behavior: 'allow',
-            updatedInput: getUpdatedInputOrFallback(toolPermissionResult, input),
-            decisionReason: {
-                type: 'mode',
-                mode: appState.toolPermissionContext.mode,
-            },
-        };
-    }
-    // 2b. Entire tool is allowed
-    const alwaysAllowedRule = toolAlwaysAllowedRule(appState.toolPermissionContext, tool);
-    if (alwaysAllowedRule) {
-        return {
-            behavior: 'allow',
-            updatedInput: getUpdatedInputOrFallback(toolPermissionResult, input),
-            decisionReason: {
-                type: 'rule',
-                rule: alwaysAllowedRule,
-            },
-        };
-    }
-    // 3. Convert "passthrough" to "ask"
-    const result = toolPermissionResult.behavior === 'passthrough'
-        ? {
-            ...toolPermissionResult,
-            behavior: 'ask',
-            message: createPermissionRequestMessage(tool.name, toolPermissionResult.decisionReason),
-        }
-        : toolPermissionResult;
-    if (result.behavior === 'ask' && result.suggestions) {
-        logForDebugging(`Permission suggestions for ${tool.name}: ${jsonStringify(result.suggestions, null, 2)}`);
-    }
-    return result;
-}
-/**
- * Delete a permission rule from the appropriate destination
- */
-export async function deletePermissionRule({ rule, initialContext, setToolPermissionContext, }) {
-    if (rule.source === 'policySettings' ||
-        rule.source === 'flagSettings' ||
-        rule.source === 'command') {
-        throw new Error('Cannot delete permission rules from read-only settings');
-    }
-    const updatedContext = applyPermissionUpdate(initialContext, {
-        type: 'removeRules',
-        rules: [rule.ruleValue],
-        behavior: rule.ruleBehavior,
-        destination: rule.source,
-    });
-    // Per-destination logic to delete the rule from settings
-    const destination = rule.source;
-    switch (destination) {
-        case 'localSettings':
-        case 'userSettings':
-        case 'projectSettings': {
-            // Note: Typescript doesn't know that rule conforms to `PermissionRuleFromEditableSettings` even when we switch on `rule.source`
-            deletePermissionRuleFromSettings(rule);
-            break;
-        }
-        case 'cliArg':
-        case 'session': {
-            // No action needed for in-memory sources - not persisted to disk
-            break;
-        }
-    }
-    // Update React state with updated context
-    setToolPermissionContext(updatedContext);
-}
-/**
- * Helper to convert PermissionRule array to PermissionUpdate array
- */
-function convertRulesToUpdates(rules, updateType) {
-    // Group rules by source and behavior
-    const grouped = new Map();
-    for (const rule of rules) {
-        const key = `${rule.source}:${rule.ruleBehavior}`;
-        if (!grouped.has(key)) {
-            grouped.set(key, []);
-        }
-        grouped.get(key).push(rule.ruleValue);
-    }
-    // Convert to PermissionUpdate array
-    const updates = [];
-    for (const [key, ruleValues] of grouped) {
-        const [source, behavior] = key.split(':');
-        updates.push({
-            type: updateType,
-            rules: ruleValues,
-            behavior: behavior,
-            destination: source,
-        });
-    }
-    return updates;
-}
-/**
- * Apply permission rules to context (additive - for initial setup)
- */
-export function applyPermissionRulesToPermissionContext(toolPermissionContext, rules) {
-    const updates = convertRulesToUpdates(rules, 'addRules');
-    return applyPermissionUpdates(toolPermissionContext, updates);
-}
-/**
- * Sync permission rules from disk (replacement - for settings changes)
- */
-export function syncPermissionRulesFromDisk(toolPermissionContext, rules) {
-    let context = toolPermissionContext;
-    // When allowManagedPermissionRulesOnly is enabled, clear all non-policy sources
-    if (shouldAllowManagedPermissionRulesOnly()) {
-        const sourcesToClear = [
-            'userSettings',
-            'projectSettings',
-            'localSettings',
-            'cliArg',
-            'session',
-        ];
-        const behaviors = ['allow', 'deny', 'ask'];
-        for (const source of sourcesToClear) {
-            for (const behavior of behaviors) {
-                context = applyPermissionUpdate(context, {
-                    type: 'replaceRules',
-                    rules: [],
-                    behavior,
-                    destination: source,
-                });
-            }
-        }
-    }
-    // Clear all disk-based source:behavior combos before applying new rules.
-    // Without this, removing a rule from settings (e.g. deleting a deny entry)
-    // would leave the old rule in the context because convertRulesToUpdates
-    // only generates replaceRules for source:behavior pairs that have rules —
-    // an empty group produces no update, so stale rules persist.
-    const diskSources = [
-        'userSettings',
-        'projectSettings',
-        'localSettings',
-    ];
-    for (const diskSource of diskSources) {
-        for (const behavior of ['allow', 'deny', 'ask']) {
-            context = applyPermissionUpdate(context, {
-                type: 'replaceRules',
-                rules: [],
-                behavior,
-                destination: diskSource,
-            });
-        }
-    }
-    const updates = convertRulesToUpdates(rules, 'replaceRules');
-    return applyPermissionUpdates(context, updates);
-}
-/**
- * Extract updatedInput from a permission result, falling back to the original input.
- * Handles the case where some PermissionResult variants don't have updatedInput.
- */
-function getUpdatedInputOrFallback(permissionResult, fallback) {
-    return (('updatedInput' in permissionResult
-        ? permissionResult.updatedInput
-        : undefined) ?? fallback);
-}