@iaforged/context-code 1.0.63 → 1.0.65

package/dist/src/utils/permissions/permissionSetup.js

@@ -1,1164 +0,0 @@
-import { feature } from '../../recovery/bunBundleShim.js';
-import { createRequire } from 'module';
-const require = createRequire(import.meta.url);
-import { relative } from 'path';
-import { getOriginalCwd, handleAutoModeTransition, handlePlanModeTransition, setHasExitedPlanMode, setNeedsAutoModeExitAttachment, } from '../../bootstrap/state.js';
-import { getCwd } from '../cwd.js';
-import { isEnvTruthy } from '../envUtils.js';
-import { SETTING_SOURCES } from '../settings/constants.js';
-import { getSettings_DEPRECATED, getSettingsFilePathForSource, getUseAutoModeDuringPlan, hasAutoModeOptIn, } from '../settings/settings.js';
-import { permissionModeFromString, } from './PermissionMode.js';
-import { applyPermissionRulesToPermissionContext } from './permissions.js';
-import { loadAllPermissionRulesFromDisk } from './permissionsLoader.js';
-/* eslint-disable @typescript-eslint/no-require-imports */
-const autoModeStateModule = feature('TRANSCRIPT_CLASSIFIER')
-    ? require('./autoModeState.js')
-    : null;
-import { resolve } from 'path';
-import { checkSecurityRestrictionGate, checkStatsigFeatureGate_CACHED_MAY_BE_STALE, getDynamicConfig_BLOCKS_ON_INIT, getFeatureValue_CACHED_MAY_BE_STALE, } from '../../services/analytics/growthbook.js';
-import { addDirHelpMessage, validateDirectoryForWorkspace, } from '../../commands/add-dir/validation.js';
-import { logEvent, } from '../../services/analytics/index.js';
-import { AGENT_TOOL_NAME } from '../../tools/AgentTool/constants.js';
-import { BASH_TOOL_NAME } from '../../tools/BashTool/toolName.js';
-/* eslint-enable @typescript-eslint/no-require-imports */
-import { POWERSHELL_TOOL_NAME } from '../../tools/PowerShellTool/toolName.js';
-import { getToolsForDefaultPreset, parseToolPreset } from '../../tools.js';
-import { getFsImplementation, safeResolvePath, } from '../../utils/fsOperations.js';
-import { modelSupportsAutoMode } from '../betas.js';
-import { logForDebugging } from '../debug.js';
-import { gracefulShutdown } from '../gracefulShutdown.js';
-import { getMainLoopModel } from '../model/model.js';
-import { CROSS_PLATFORM_CODE_EXEC, DANGEROUS_BASH_PATTERNS, } from './dangerousPatterns.js';
-import { applyPermissionUpdate, } from './PermissionUpdate.js';
-import { normalizeLegacyToolName, permissionRuleValueFromString, permissionRuleValueToString, } from './permissionRuleParser.js';
-/**
- * Checks if a Bash permission rule is dangerous for auto mode.
- * A rule is dangerous if it would auto-allow commands that execute arbitrary code,
- * bypassing the classifier's safety evaluation.
- *
- * Dangerous patterns:
- * 1. Tool-level allow (Bash with no ruleContent) - allows ALL commands
- * 2. Prefix rules for script interpreters (python:*, node:*, etc.)
- * 3. Wildcard rules matching interpreters (python*, node*, etc.)
- */
-export function isDangerousBashPermission(toolName, ruleContent) {
-    // Only check Bash rules
-    if (toolName !== BASH_TOOL_NAME) {
-        return false;
-    }
-    // Tool-level allow (Bash with no content, or Bash(*)) - allows ALL commands
-    if (ruleContent === undefined || ruleContent === '') {
-        return true;
-    }
-    const content = ruleContent.trim().toLowerCase();
-    // Standalone wildcard (*) matches everything
-    if (content === '*') {
-        return true;
-    }
-    // Check for dangerous patterns with prefix syntax (e.g., "python:*")
-    // or wildcard syntax (e.g., "python*")
-    for (const pattern of DANGEROUS_BASH_PATTERNS) {
-        const lowerPattern = pattern.toLowerCase();
-        // Exact match to the pattern itself (e.g., "python" as a rule)
-        if (content === lowerPattern) {
-            return true;
-        }
-        // Prefix syntax: "python:*" allows any python command
-        if (content === `${lowerPattern}:*`) {
-            return true;
-        }
-        // Wildcard at end: "python*" matches python, python3, etc.
-        if (content === `${lowerPattern}*`) {
-            return true;
-        }
-        // Wildcard with space: "python *" would match "python script.py"
-        if (content === `${lowerPattern} *`) {
-            return true;
-        }
-        // Check for patterns like "python -*" which would match "python -c 'code'"
-        if (content.startsWith(`${lowerPattern} -`) && content.endsWith('*')) {
-            return true;
-        }
-    }
-    return false;
-}
-/**
- * Checks if a PowerShell permission rule is dangerous for auto mode.
- * A rule is dangerous if it would auto-allow commands that execute arbitrary
- * code (nested shells, Invoke-Expression, Start-Process, etc.), bypassing the
- * classifier's safety evaluation.
- *
- * PowerShell is case-insensitive, so rule content is lowercased before matching.
- */
-export function isDangerousPowerShellPermission(toolName, ruleContent) {
-    if (toolName !== POWERSHELL_TOOL_NAME) {
-        return false;
-    }
-    // Tool-level allow (PowerShell with no content, or PowerShell(*)) - allows ALL commands
-    if (ruleContent === undefined || ruleContent === '') {
-        return true;
-    }
-    const content = ruleContent.trim().toLowerCase();
-    // Standalone wildcard (*) matches everything
-    if (content === '*') {
-        return true;
-    }
-    // PS-specific cmdlet names. CROSS_PLATFORM_CODE_EXEC is shared with bash.
-    const patterns = [
-        ...CROSS_PLATFORM_CODE_EXEC,
-        // Nested PS + shells launchable from PS
-        'pwsh',
-        'powershell',
-        'cmd',
-        'wsl',
-        // String/scriptblock evaluators
-        'iex',
-        'invoke-expression',
-        'icm',
-        'invoke-command',
-        // Process spawners
-        'start-process',
-        'saps',
-        'start',
-        'start-job',
-        'sajb',
-        'start-threadjob', // bundled PS 6.1+; takes -ScriptBlock like Start-Job
-        // Event/session code exec
-        'register-objectevent',
-        'register-engineevent',
-        'register-wmievent',
-        'register-scheduledjob',
-        'new-pssession',
-        'nsn', // alias
-        'enter-pssession',
-        'etsn', // alias
-        // .NET escape hatches
-        'add-type', // Add-Type -TypeDefinition '<C#>' → P/Invoke
-        'new-object', // New-Object -ComObject WScript.Shell → .Run()
-    ];
-    for (const pattern of patterns) {
-        // patterns stored lowercase; content lowercased above
-        if (content === pattern)
-            return true;
-        if (content === `${pattern}:*`)
-            return true;
-        if (content === `${pattern}*`)
-            return true;
-        if (content === `${pattern} *`)
-            return true;
-        if (content.startsWith(`${pattern} -`) && content.endsWith('*'))
-            return true;
-        // .exe — goes on the FIRST word. `python` → `python.exe`.
-        // `npm run` → `npm.exe run` (npm.exe is the real Windows binary name).
-        // A rule like `PowerShell(npm.exe run:*)` needs to match `npm run`.
-        const sp = pattern.indexOf(' ');
-        const exe = sp === -1
-            ? `${pattern}.exe`
-            : `${pattern.slice(0, sp)}.exe${pattern.slice(sp)}`;
-        if (content === exe)
-            return true;
-        if (content === `${exe}:*`)
-            return true;
-        if (content === `${exe}*`)
-            return true;
-        if (content === `${exe} *`)
-            return true;
-        if (content.startsWith(`${exe} -`) && content.endsWith('*'))
-            return true;
-    }
-    return false;
-}
-/**
- * Checks if an Agent (sub-agent) permission rule is dangerous for auto mode.
- * Any Agent allow rule would auto-approve sub-agent spawns before the auto mode classifier
- * can evaluate the sub-agent's prompt, defeating delegation attack prevention.
- */
-export function isDangerousTaskPermission(toolName, _ruleContent) {
-    return normalizeLegacyToolName(toolName) === AGENT_TOOL_NAME;
-}
-function formatPermissionSource(source) {
-    if (SETTING_SOURCES.includes(source)) {
-        const filePath = getSettingsFilePathForSource(source);
-        if (filePath) {
-            const relativePath = relative(getCwd(), filePath);
-            return relativePath.length < filePath.length ? relativePath : filePath;
-        }
-    }
-    return source;
-}
-/**
- * Checks if a permission rule is dangerous for auto mode.
- * A rule is dangerous if it would auto-allow actions before the auto mode classifier
- * can evaluate them, bypassing safety checks.
- */
-function isDangerousClassifierPermission(toolName, ruleContent) {
-    if (process.env.USER_TYPE === 'ant') {
-        // Tmux send-keys executes arbitrary shell, bypassing the classifier same as Bash(*)
-        if (toolName === 'Tmux')
-            return true;
-    }
-    return (isDangerousBashPermission(toolName, ruleContent) ||
-        isDangerousPowerShellPermission(toolName, ruleContent) ||
-        isDangerousTaskPermission(toolName, ruleContent));
-}
-/**
- * Finds all dangerous permissions from rules loaded from disk and CLI arguments.
- * Returns structured info about each dangerous permission found.
- *
- * Checks Bash permissions (wildcard/interpreter patterns), PowerShell permissions
- * (wildcard/iex/Start-Process patterns), and Agent permissions (any allow rule
- * bypasses the classifier's sub-agent evaluation).
- */
-export function findDangerousClassifierPermissions(rules, cliAllowedTools) {
-    const dangerous = [];
-    // Check rules loaded from settings
-    for (const rule of rules) {
-        if (rule.ruleBehavior === 'allow' &&
-            isDangerousClassifierPermission(rule.ruleValue.toolName, rule.ruleValue.ruleContent)) {
-            const ruleString = rule.ruleValue.ruleContent
-                ? `${rule.ruleValue.toolName}(${rule.ruleValue.ruleContent})`
-                : `${rule.ruleValue.toolName}(*)`;
-            dangerous.push({
-                ruleValue: rule.ruleValue,
-                source: rule.source,
-                ruleDisplay: ruleString,
-                sourceDisplay: formatPermissionSource(rule.source),
-            });
-        }
-    }
-    // Check CLI --allowed-tools arguments
-    for (const toolSpec of cliAllowedTools) {
-        // Parse tool spec: "Bash" or "Bash(pattern)" or "Agent" or "Agent(subagent_type)"
-        const match = toolSpec.match(/^([^(]+)(?:\(([^)]*)\))?$/);
-        if (match) {
-            const toolName = match[1].trim();
-            const ruleContent = match[2]?.trim();
-            if (isDangerousClassifierPermission(toolName, ruleContent)) {
-                dangerous.push({
-                    ruleValue: { toolName, ruleContent },
-                    source: 'cliArg',
-                    ruleDisplay: ruleContent ? toolSpec : `${toolName}(*)`,
-                    sourceDisplay: '--allowed-tools',
-                });
-            }
-        }
-    }
-    return dangerous;
-}
-/**
- * Checks if a Bash allow rule is overly broad (equivalent to YOLO mode).
- * Returns true for tool-level Bash allow rules with no content restriction,
- * which auto-allow every bash command.
- *
- * Matches: Bash, Bash(*), Bash() — all parse to { toolName: 'Bash' } with no ruleContent.
- */
-export function isOverlyBroadBashAllowRule(ruleValue) {
-    return (ruleValue.toolName === BASH_TOOL_NAME && ruleValue.ruleContent === undefined);
-}
-/**
- * PowerShell equivalent of isOverlyBroadBashAllowRule.
- *
- * Matches: PowerShell, PowerShell(*), PowerShell() — all parse to
- * { toolName: 'PowerShell' } with no ruleContent.
- */
-export function isOverlyBroadPowerShellAllowRule(ruleValue) {
-    return (ruleValue.toolName === POWERSHELL_TOOL_NAME &&
-        ruleValue.ruleContent === undefined);
-}
-/**
- * Finds all overly broad Bash allow rules from settings and CLI arguments.
- * An overly broad rule allows ALL bash commands (e.g., Bash or Bash(*)),
- * which is effectively equivalent to YOLO/bypass-permissions mode.
- */
-export function findOverlyBroadBashPermissions(rules, cliAllowedTools) {
-    const overlyBroad = [];
-    for (const rule of rules) {
-        if (rule.ruleBehavior === 'allow' &&
-            isOverlyBroadBashAllowRule(rule.ruleValue)) {
-            overlyBroad.push({
-                ruleValue: rule.ruleValue,
-                source: rule.source,
-                ruleDisplay: `${BASH_TOOL_NAME}(*)`,
-                sourceDisplay: formatPermissionSource(rule.source),
-            });
-        }
-    }
-    for (const toolSpec of cliAllowedTools) {
-        const parsed = permissionRuleValueFromString(toolSpec);
-        if (isOverlyBroadBashAllowRule(parsed)) {
-            overlyBroad.push({
-                ruleValue: parsed,
-                source: 'cliArg',
-                ruleDisplay: `${BASH_TOOL_NAME}(*)`,
-                sourceDisplay: '--allowed-tools',
-            });
-        }
-    }
-    return overlyBroad;
-}
-/**
- * PowerShell equivalent of findOverlyBroadBashPermissions.
- */
-export function findOverlyBroadPowerShellPermissions(rules, cliAllowedTools) {
-    const overlyBroad = [];
-    for (const rule of rules) {
-        if (rule.ruleBehavior === 'allow' &&
-            isOverlyBroadPowerShellAllowRule(rule.ruleValue)) {
-            overlyBroad.push({
-                ruleValue: rule.ruleValue,
-                source: rule.source,
-                ruleDisplay: `${POWERSHELL_TOOL_NAME}(*)`,
-                sourceDisplay: formatPermissionSource(rule.source),
-            });
-        }
-    }
-    for (const toolSpec of cliAllowedTools) {
-        const parsed = permissionRuleValueFromString(toolSpec);
-        if (isOverlyBroadPowerShellAllowRule(parsed)) {
-            overlyBroad.push({
-                ruleValue: parsed,
-                source: 'cliArg',
-                ruleDisplay: `${POWERSHELL_TOOL_NAME}(*)`,
-                sourceDisplay: '--allowed-tools',
-            });
-        }
-    }
-    return overlyBroad;
-}
-/**
- * Type guard to check if a PermissionRuleSource is a valid PermissionUpdateDestination.
- * Sources like 'flagSettings', 'policySettings', and 'command' are not valid destinations.
- */
-function isPermissionUpdateDestination(source) {
-    return [
-        'userSettings',
-        'projectSettings',
-        'localSettings',
-        'session',
-        'cliArg',
-    ].includes(source);
-}
-/**
- * Removes dangerous permissions from the in-memory context, and optionally
- * persists the removal to settings files on disk.
- */
-export function removeDangerousPermissions(context, dangerousPermissions) {
-    // Group dangerous rules by their source (destination for updates)
-    const rulesBySource = new Map();
-    for (const perm of dangerousPermissions) {
-        // Skip sources that can't be persisted (flagSettings, policySettings, command)
-        if (!isPermissionUpdateDestination(perm.source)) {
-            continue;
-        }
-        const destination = perm.source;
-        const existing = rulesBySource.get(destination) || [];
-        existing.push(perm.ruleValue);
-        rulesBySource.set(destination, existing);
-    }
-    let updatedContext = context;
-    for (const [destination, rules] of rulesBySource) {
-        updatedContext = applyPermissionUpdate(updatedContext, {
-            type: 'removeRules',
-            rules,
-            behavior: 'allow',
-            destination,
-        });
-    }
-    return updatedContext;
-}
-/**
- * Prepares a ToolPermissionContext for auto mode by stripping
- * dangerous permissions that would bypass the classifier.
- * Returns the cleaned context (with mode unchanged — caller sets the mode).
- */
-export function stripDangerousPermissionsForAutoMode(context) {
-    const rules = [];
-    for (const [source, ruleStrings] of Object.entries(context.alwaysAllowRules)) {
-        if (!ruleStrings) {
-            continue;
-        }
-        for (const ruleString of ruleStrings) {
-            const ruleValue = permissionRuleValueFromString(ruleString);
-            rules.push({
-                source: source,
-                ruleBehavior: 'allow',
-                ruleValue,
-            });
-        }
-    }
-    const dangerousPermissions = findDangerousClassifierPermissions(rules, []);
-    if (dangerousPermissions.length === 0) {
-        return {
-            ...context,
-            strippedDangerousRules: context.strippedDangerousRules ?? {},
-        };
-    }
-    for (const permission of dangerousPermissions) {
-        logForDebugging(`Ignoring dangerous permission ${permission.ruleDisplay} from ${permission.sourceDisplay} (bypasses classifier)`);
-    }
-    // Mirror removeDangerousPermissions' source filter so stash == what was actually removed.
-    const stripped = {};
-    for (const perm of dangerousPermissions) {
-        if (!isPermissionUpdateDestination(perm.source))
-            continue;
-        (stripped[perm.source] ??= []).push(permissionRuleValueToString(perm.ruleValue));
-    }
-    return {
-        ...removeDangerousPermissions(context, dangerousPermissions),
-        strippedDangerousRules: stripped,
-    };
-}
-/**
- * Restores dangerous allow rules previously stashed by
- * stripDangerousPermissionsForAutoMode. Called when leaving auto mode so that
- * the user's Bash(python:*), Agent(*), etc. rules work again in default mode.
- * Clears the stash so a second exit is a no-op.
- */
-export function restoreDangerousPermissions(context) {
-    const stash = context.strippedDangerousRules;
-    if (!stash) {
-        return context;
-    }
-    let result = context;
-    for (const [source, ruleStrings] of Object.entries(stash)) {
-        if (!ruleStrings || ruleStrings.length === 0)
-            continue;
-        result = applyPermissionUpdate(result, {
-            type: 'addRules',
-            rules: ruleStrings.map(permissionRuleValueFromString),
-            behavior: 'allow',
-            destination: source,
-        });
-    }
-    return { ...result, strippedDangerousRules: undefined };
-}
-/**
- * Handles all state transitions when switching permission modes.
- * Centralises side-effects so that every activation path (CLI Shift+Tab,
- * SDK control messages, etc.) behaves identically.
- *
- * Currently handles:
- * - Plan mode enter/exit attachments (via handlePlanModeTransition)
- * - Auto mode activation: setAutoModeActive, stripDangerousPermissionsForAutoMode
- *
- * Returns the (possibly modified) context. Caller is responsible for setting
- * the mode on the returned context.
- *
- * @param fromMode The current permission mode
- * @param toMode The target permission mode
- * @param context The current tool permission context
- */
-export function transitionPermissionMode(fromMode, toMode, context) {
-    // plan→plan (SDK set_permission_mode) would wrongly hit the leave branch below
-    if (fromMode === toMode)
-        return context;
-    handlePlanModeTransition(fromMode, toMode);
-    handleAutoModeTransition(fromMode, toMode);
-    if (fromMode === 'plan' && toMode !== 'plan') {
-        setHasExitedPlanMode(true);
-    }
-    if (feature('TRANSCRIPT_CLASSIFIER')) {
-        if (toMode === 'plan' && fromMode !== 'plan') {
-            return prepareContextForPlanMode(context);
-        }
-        // Plan with auto active counts as using the classifier (for the leaving side).
-        // isAutoModeActive() is the authoritative signal — prePlanMode/strippedDangerousRules
-        // are unreliable proxies because auto can be deactivated mid-plan (non-opt-in
-        // entry, transitionPlanAutoMode) while those fields remain set/unset.
-        const fromUsesClassifier = fromMode === 'auto' ||
-            (fromMode === 'plan' &&
-                (autoModeStateModule?.isAutoModeActive() ?? false));
-        const toUsesClassifier = toMode === 'auto'; // plan entry handled above
-        if (toUsesClassifier && !fromUsesClassifier) {
-            if (!isAutoModeGateEnabled()) {
-                throw new Error('Cannot transition to auto mode: gate is not enabled');
-            }
-            autoModeStateModule?.setAutoModeActive(true);
-            context = stripDangerousPermissionsForAutoMode(context);
-        }
-        else if (fromUsesClassifier && !toUsesClassifier) {
-            autoModeStateModule?.setAutoModeActive(false);
-            setNeedsAutoModeExitAttachment(true);
-            context = restoreDangerousPermissions(context);
-        }
-    }
-    // Only spread if there's something to clear (preserves ref equality)
-    if (fromMode === 'plan' && toMode !== 'plan' && context.prePlanMode) {
-        return { ...context, prePlanMode: undefined };
-    }
-    return context;
-}
-/**
- * Parse base tools specification from CLI
- * Handles both preset names (default, none) and custom tool lists
- */
-export function parseBaseToolsFromCLI(baseTools) {
-    // Join all array elements and check if it's a single preset name
-    const joinedInput = baseTools.join(' ').trim();
-    const preset = parseToolPreset(joinedInput);
-    if (preset) {
-        return getToolsForDefaultPreset();
-    }
-    // Parse as a custom tool list using the same parsing logic as allowedTools/disallowedTools
-    const parsedTools = parseToolListFromCLI(baseTools);
-    return parsedTools;
-}
-/**
- * Check if processPwd is a symlink that resolves to originalCwd
- */
-function isSymlinkTo({ processPwd, originalCwd, }) {
-    // Use safeResolvePath to check if processPwd is a symlink and get its resolved path
-    const { resolvedPath: resolvedProcessPwd, isSymlink: isProcessPwdSymlink } = safeResolvePath(getFsImplementation(), processPwd);
-    return isProcessPwdSymlink
-        ? resolvedProcessPwd === resolve(originalCwd)
-        : false;
-}
-/**
- * Safely convert CLI flags to a PermissionMode
- */
-export function initialPermissionModeFromCLI({ permissionModeCli, dangerouslySkipPermissions, }) {
-    const settings = getSettings_DEPRECATED() || {};
-    // Check GrowthBook gate first - highest precedence
-    const growthBookDisableBypassPermissionsMode = checkStatsigFeatureGate_CACHED_MAY_BE_STALE('tengu_disable_bypass_permissions_mode');
-    // Then check settings - lower precedence
-    const settingsDisableBypassPermissionsMode = settings.permissions?.disableBypassPermissionsMode === 'disable';
-    // Statsig gate takes precedence over settings
-    const disableBypassPermissionsMode = growthBookDisableBypassPermissionsMode ||
-        settingsDisableBypassPermissionsMode;
-    // Sync circuit-breaker check (cached GB read). Prevents the
-    // AutoModeOptInDialog from showing in showSetupScreens() when auto can't
-    // actually be entered. autoModeFlagCli still carries intent through to
-    // verifyAutoModeGateAccess, which notifies the user why.
-    const autoModeCircuitBrokenSync = feature('TRANSCRIPT_CLASSIFIER')
-        ? getAutoModeEnabledStateIfCached() === 'disabled'
-        : false;
-    // Modes in order of priority
-    const orderedModes = [];
-    let notification;
-    if (dangerouslySkipPermissions) {
-        orderedModes.push('bypassPermissions');
-    }
-    if (permissionModeCli) {
-        const parsedMode = permissionModeFromString(permissionModeCli);
-        if (feature('TRANSCRIPT_CLASSIFIER') && parsedMode === 'auto') {
-            if (autoModeCircuitBrokenSync) {
-                logForDebugging('auto mode circuit breaker active (cached) — falling back to default', { level: 'warn' });
-            }
-            else {
-                orderedModes.push('auto');
-            }
-        }
-        else {
-            orderedModes.push(parsedMode);
-        }
-    }
-    if (settings.permissions?.defaultMode) {
-        const settingsMode = settings.permissions.defaultMode;
-        // CCR only supports acceptEdits and plan — ignore other defaultModes from
-        // settings (e.g. bypassPermissions would otherwise silently grant full
-        // access in a remote environment).
-        if (isEnvTruthy(process.env.CLAUDE_CODE_REMOTE) &&
-            !['acceptEdits', 'plan', 'default'].includes(settingsMode)) {
-            logForDebugging(`settings defaultMode "${settingsMode}" is not supported in CLAUDE_CODE_REMOTE — only acceptEdits and plan are allowed`, { level: 'warn' });
-            logEvent('tengu_ccr_unsupported_default_mode_ignored', {
-                mode: settingsMode,
-            });
-        }
-        // auto from settings requires the same gate check as from CLI
-        else if (feature('TRANSCRIPT_CLASSIFIER') && settingsMode === 'auto') {
-            if (autoModeCircuitBrokenSync) {
-                logForDebugging('auto mode circuit breaker active (cached) — falling back to default', { level: 'warn' });
-            }
-            else {
-                orderedModes.push('auto');
-            }
-        }
-        else {
-            orderedModes.push(settingsMode);
-        }
-    }
-    let result;
-    for (const mode of orderedModes) {
-        if (mode === 'bypassPermissions' && disableBypassPermissionsMode) {
-            if (growthBookDisableBypassPermissionsMode) {
-                logForDebugging('bypassPermissions mode is disabled by Statsig gate', {
-                    level: 'warn',
-                });
-                notification =
-                    'Bypass permissions mode was disabled by your organization policy';
-            }
-            else {
-                logForDebugging('bypassPermissions mode is disabled by settings', {
-                    level: 'warn',
-                });
-                notification = 'Bypass permissions mode was disabled by settings';
-            }
-            continue; // Skip this mode if it's disabled
-        }
-        result = { mode, notification }; // Use the first valid mode
-        break;
-    }
-    if (!result) {
-        result = { mode: 'default', notification };
-    }
-    if (!result) {
-        result = { mode: 'default', notification };
-    }
-    if (feature('TRANSCRIPT_CLASSIFIER') && result.mode === 'auto') {
-        autoModeStateModule?.setAutoModeActive(true);
-    }
-    return result;
-}
-export function parseToolListFromCLI(tools) {
-    if (tools.length === 0) {
-        return [];
-    }
-    const result = [];
-    // Process each string in the array
-    for (const toolString of tools) {
-        if (!toolString)
-            continue;
-        let current = '';
-        let isInParens = false;
-        // Parse each character in the string
-        for (const char of toolString) {
-            switch (char) {
-                case '(':
-                    isInParens = true;
-                    current += char;
-                    break;
-                case ')':
-                    isInParens = false;
-                    current += char;
-                    break;
-                case ',':
-                    if (isInParens) {
-                        current += char;
-                    }
-                    else {
-                        // Comma separator - push current tool and start new one
-                        if (current.trim()) {
-                            result.push(current.trim());
-                        }
-                        current = '';
-                    }
-                    break;
-                case ' ':
-                    if (isInParens) {
-                        current += char;
-                    }
-                    else if (current.trim()) {
-                        // Space separator - push current tool and start new one
-                        result.push(current.trim());
-                        current = '';
-                    }
-                    break;
-                default:
-                    current += char;
-            }
-        }
-        // Push any remaining tool
-        if (current.trim()) {
-            result.push(current.trim());
-        }
-    }
-    return result;
-}
-export async function initializeToolPermissionContext({ allowedToolsCli, disallowedToolsCli, baseToolsCli, permissionMode, allowDangerouslySkipPermissions, addDirs, }) {
-    // Parse comma-separated allowed and disallowed tools if provided
-    // Normalize legacy tool names (e.g., 'Task' → 'Agent') so that in-memory
-    // rule removal in stripDangerousPermissionsForAutoMode matches correctly.
-    const parsedAllowedToolsCli = parseToolListFromCLI(allowedToolsCli).map(rule => permissionRuleValueToString(permissionRuleValueFromString(rule)));
-    let parsedDisallowedToolsCli = parseToolListFromCLI(disallowedToolsCli);
-    // If base tools are specified, automatically deny all tools NOT in the base set
-    // We need to check if base tools were explicitly provided (not just empty default)
-    if (baseToolsCli && baseToolsCli.length > 0) {
-        const baseToolsResult = parseBaseToolsFromCLI(baseToolsCli);
-        // Normalize legacy tool names (e.g., 'Task' → 'Agent') so user-provided
-        // base tool lists using old names still match canonical names.
-        const baseToolsSet = new Set(baseToolsResult.map(normalizeLegacyToolName));
-        const allToolNames = getToolsForDefaultPreset();
-        const toolsToDisallow = allToolNames.filter(tool => !baseToolsSet.has(tool));
-        parsedDisallowedToolsCli = [...parsedDisallowedToolsCli, ...toolsToDisallow];
-    }
-    const warnings = [];
-    const additionalWorkingDirectories = new Map();
-    // process.env.PWD may be a symlink, while getOriginalCwd() uses the real path
-    const processPwd = process.env.PWD;
-    if (processPwd &&
-        processPwd !== getOriginalCwd() &&
-        isSymlinkTo({ originalCwd: getOriginalCwd(), processPwd })) {
-        additionalWorkingDirectories.set(processPwd, {
-            path: processPwd,
-            source: 'session',
-        });
-    }
-    // Check if bypassPermissions mode is available (not disabled by Statsig gate or settings)
-    // Use cached values to avoid blocking on startup
-    const growthBookDisableBypassPermissionsMode = checkStatsigFeatureGate_CACHED_MAY_BE_STALE('tengu_disable_bypass_permissions_mode');
-    const settings = getSettings_DEPRECATED() || {};
-    const settingsDisableBypassPermissionsMode = settings.permissions?.disableBypassPermissionsMode === 'disable';
-    const isBypassPermissionsModeAvailable = (permissionMode === 'bypassPermissions' ||
-        allowDangerouslySkipPermissions) &&
-        !growthBookDisableBypassPermissionsMode &&
-        !settingsDisableBypassPermissionsMode;
-    // Load all permission rules from disk
-    const rulesFromDisk = loadAllPermissionRulesFromDisk();
-    // Ant-only: Detect overly broad shell allow rules for all modes.
-    // Bash(*) or PowerShell(*) are equivalent to YOLO mode for that shell.
-    // Skip in CCR/BYOC where --allowed-tools is the intended pre-approval mechanism.
-    // Variable name kept for return-field compat; contains both shells.
-    let overlyBroadBashPermissions = [];
-    if (process.env.USER_TYPE === 'ant' &&
-        !isEnvTruthy(process.env.CLAUDE_CODE_REMOTE) &&
-        process.env.CLAUDE_CODE_ENTRYPOINT !== 'local-agent') {
-        overlyBroadBashPermissions = [
-            ...findOverlyBroadBashPermissions(rulesFromDisk, parsedAllowedToolsCli),
-            ...findOverlyBroadPowerShellPermissions(rulesFromDisk, parsedAllowedToolsCli),
-        ];
-    }
-    // Ant-only: Detect dangerous shell permissions for auto mode
-    // Dangerous permissions (like Bash(*), Bash(python:*), PowerShell(iex:*)) would auto-allow
-    // before the classifier can evaluate them, defeating the purpose of safer YOLO mode
-    let dangerousPermissions = [];
-    if (feature('TRANSCRIPT_CLASSIFIER') && permissionMode === 'auto') {
-        dangerousPermissions = findDangerousClassifierPermissions(rulesFromDisk, parsedAllowedToolsCli);
-    }
-    let toolPermissionContext = applyPermissionRulesToPermissionContext({
-        mode: permissionMode,
-        additionalWorkingDirectories,
-        alwaysAllowRules: { cliArg: parsedAllowedToolsCli },
-        alwaysDenyRules: { cliArg: parsedDisallowedToolsCli },
-        alwaysAskRules: {},
-        isBypassPermissionsModeAvailable,
-        ...(feature('TRANSCRIPT_CLASSIFIER')
-            ? { isAutoModeAvailable: isAutoModeGateEnabled() }
-            : {}),
-    }, rulesFromDisk);
-    // Add directories from settings and --add-dir
-    const allAdditionalDirectories = [
-        ...(settings.permissions?.additionalDirectories || []),
-        ...addDirs,
-    ];
-    // Parallelize fs validation; apply updates serially (cumulative context).
-    // validateDirectoryForWorkspace only reads permissionContext to check if the
-    // dir is already covered — behavioral difference from parallelizing is benign
-    // (two overlapping --add-dirs both succeed instead of one being flagged
-    // alreadyInWorkingDirectory, which was silently skipped anyway).
-    const validationResults = await Promise.all(allAdditionalDirectories.map(dir => validateDirectoryForWorkspace(dir, toolPermissionContext)));
-    for (const result of validationResults) {
-        if (result.resultType === 'success') {
-            toolPermissionContext = applyPermissionUpdate(toolPermissionContext, {
-                type: 'addDirectories',
-                directories: [result.absolutePath],
-                destination: 'cliArg',
-            });
-        }
-        else if (result.resultType !== 'alreadyInWorkingDirectory' &&
-            result.resultType !== 'pathNotFound') {
-            // Warn for actual config mistakes (e.g. specifying a file instead of a
-            // directory). But if the directory doesn't exist anymore (e.g. someone
-            // was working under /tmp and it got cleared), silently skip. They'll get
-            // prompted again if they try to access it later.
-            warnings.push(addDirHelpMessage(result));
-        }
-    }
-    return {
-        toolPermissionContext,
-        warnings,
-        dangerousPermissions,
-        overlyBroadBashPermissions,
-    };
-}
-export function getAutoModeUnavailableNotification(reason) {
-    let base;
-    switch (reason) {
-        case 'settings':
-            base = 'auto mode disabled by settings';
-            break;
-        case 'circuit-breaker':
-            base = 'auto mode is unavailable for your plan';
-            break;
-        case 'model':
-            base = 'auto mode unavailable for this model';
-            break;
-    }
-    return process.env.USER_TYPE === 'ant'
-        ? `${base} · #claude-code-feedback`
-        : base;
-}
-/**
- * Async check of auto mode availability.
- *
- * Returns a transform function (not a pre-computed context) that callers
- * apply inside setAppState(prev => ...) against the CURRENT context. This
- * prevents the async GrowthBook await from clobbering mid-turn mode changes
- * (e.g., user shift-tabs to acceptEdits while this check is in flight).
- *
- * The transform re-checks mode/prePlanMode against the fresh ctx to avoid
- * kicking the user out of a mode they've already left during the await.
- */
-export async function verifyAutoModeGateAccess(currentContext, 
-// Runtime AppState.fastMode — passed from callers with AppState access so
-// the disableFastMode circuit breaker reads current state, not stale
-// settings.fastMode (which is intentionally sticky across /model auto-
-// downgrades). Optional for callers without AppState (e.g. SDK init paths).
-fastMode) {
-    // Auto-mode config — runs in ALL builds (circuit breaker, carousel, kick-out)
-    // Fresh read of tengu_auto_mode_config.enabled — this async check runs once
-    // after GrowthBook initialization and is the authoritative source for
-    // isAutoModeAvailable. The sync startup path uses stale cache; this
-    // corrects it. Circuit breaker (enabled==='disabled') takes effect here.
-    const autoModeConfig = await getDynamicConfig_BLOCKS_ON_INIT('tengu_auto_mode_config', {});
-    const enabledState = parseAutoModeEnabledState(autoModeConfig?.enabled);
-    const disabledBySettings = isAutoModeDisabledBySettings();
-    // Treat settings-disable the same as GrowthBook 'disabled' for circuit-breaker
-    // semantics — blocks SDK/explicit re-entry via isAutoModeGateEnabled().
-    autoModeStateModule?.setAutoModeCircuitBroken(enabledState === 'disabled' || disabledBySettings);
-    // Carousel availability: not circuit-broken, not disabled-by-settings,
-    // model supports it, disableFastMode breaker not firing, and (enabled or opted-in)
-    const mainModel = getMainLoopModel();
-    // Temp circuit breaker: tengu_auto_mode_config.disableFastMode blocks auto
-    // mode when fast mode is on. Checks runtime AppState.fastMode (if provided)
-    // and, for ants, model name '-fast' substring (ant-internal fast models
-    // like capybara-v2-fast[1m] encode speed in the model ID itself).
-    // Remove once auto+fast mode interaction is validated.
-    const disableFastModeBreakerFires = !!autoModeConfig?.disableFastMode &&
-        (!!fastMode ||
-            (process.env.USER_TYPE === 'ant' &&
-                mainModel.toLowerCase().includes('-fast')));
-    const modelSupported = modelSupportsAutoMode(mainModel) && !disableFastModeBreakerFires;
-    let carouselAvailable = false;
-    if (enabledState !== 'disabled' && !disabledBySettings && modelSupported) {
-        carouselAvailable =
-            enabledState === 'enabled' || hasAutoModeOptInAnySource();
-    }
-    // canEnterAuto gates explicit entry (--permission-mode auto, defaultMode: auto)
-    // — explicit entry IS an opt-in, so we only block on circuit breaker + settings + model
-    const canEnterAuto = enabledState !== 'disabled' && !disabledBySettings && modelSupported;
-    logForDebugging(`[auto-mode] verifyAutoModeGateAccess: enabledState=${enabledState} disabledBySettings=${disabledBySettings} model=${mainModel} modelSupported=${modelSupported} disableFastModeBreakerFires=${disableFastModeBreakerFires} carouselAvailable=${carouselAvailable} canEnterAuto=${canEnterAuto}`);
-    // Capture CLI-flag intent now (doesn't depend on context).
-    const autoModeFlagCli = autoModeStateModule?.getAutoModeFlagCli() ?? false;
-    // Return a transform function that re-evaluates context-dependent conditions
-    // against the CURRENT context at setAppState time. The async GrowthBook
-    // results above (canEnterAuto, carouselAvailable, enabledState, reason) are
-    // closure-captured — those don't depend on context. But mode, prePlanMode,
-    // and isAutoModeAvailable checks MUST use the fresh ctx or a mid-await
-    // shift-tab gets reverted (or worse, the user stays in auto despite the
-    // circuit breaker if they entered auto DURING the await — which is possible
-    // because setAutoModeCircuitBroken above runs AFTER the await).
-    const setAvailable = (ctx, available) => {
-        if (ctx.isAutoModeAvailable !== available) {
-            logForDebugging(`[auto-mode] verifyAutoModeGateAccess setAvailable: ${ctx.isAutoModeAvailable} -> ${available}`);
-        }
-        return ctx.isAutoModeAvailable === available
-            ? ctx
-            : { ...ctx, isAutoModeAvailable: available };
-    };
-    if (canEnterAuto) {
-        return { updateContext: ctx => setAvailable(ctx, carouselAvailable) };
-    }
-    // Gate is off or circuit-broken — determine reason (context-independent).
-    let reason;
-    if (disabledBySettings) {
-        reason = 'settings';
-        logForDebugging('auto mode disabled: disableAutoMode in settings', {
-            level: 'warn',
-        });
-    }
-    else if (enabledState === 'disabled') {
-        reason = 'circuit-breaker';
-        logForDebugging('auto mode disabled: tengu_auto_mode_config.enabled === "disabled" (circuit breaker)', { level: 'warn' });
-    }
-    else {
-        reason = 'model';
-        logForDebugging(`auto mode disabled: model ${getMainLoopModel()} does not support auto mode`, { level: 'warn' });
-    }
-    const notification = getAutoModeUnavailableNotification(reason);
-    // Unified kick-out transform. Re-checks the FRESH ctx and only fires
-    // side effects (setAutoModeActive(false), setNeedsAutoModeExitAttachment)
-    // when the kick-out actually applies. This keeps autoModeActive in sync
-    // with toolPermissionContext.mode even if the user changed modes during
-    // the await: if they already left auto on their own, handleCycleMode
-    // already deactivated the classifier and we don't fire again; if they
-    // ENTERED auto during the await (possible before setAutoModeCircuitBroken
-    // landed), we kick them out here.
-    const kickOutOfAutoIfNeeded = (ctx) => {
-        const inAuto = ctx.mode === 'auto';
-        logForDebugging(`[auto-mode] kickOutOfAutoIfNeeded applying: ctx.mode=${ctx.mode} ctx.prePlanMode=${ctx.prePlanMode} reason=${reason}`);
-        // Plan mode with auto active: either from prePlanMode='auto' (entered
-        // from auto) or from opt-in (strippedDangerousRules present).
-        const inPlanWithAutoActive = ctx.mode === 'plan' &&
-            (ctx.prePlanMode === 'auto' || !!ctx.strippedDangerousRules);
-        if (!inAuto && !inPlanWithAutoActive) {
-            return setAvailable(ctx, false);
-        }
-        if (inAuto) {
-            autoModeStateModule?.setAutoModeActive(false);
-            setNeedsAutoModeExitAttachment(true);
-            return {
-                ...applyPermissionUpdate(restoreDangerousPermissions(ctx), {
-                    type: 'setMode',
-                    mode: 'default',
-                    destination: 'session',
-                }),
-                isAutoModeAvailable: false,
-            };
-        }
-        // Plan with auto active: deactivate auto, restore permissions, defuse
-        // prePlanMode so ExitPlanMode goes to default.
-        autoModeStateModule?.setAutoModeActive(false);
-        setNeedsAutoModeExitAttachment(true);
-        return {
-            ...restoreDangerousPermissions(ctx),
-            prePlanMode: ctx.prePlanMode === 'auto' ? 'default' : ctx.prePlanMode,
-            isAutoModeAvailable: false,
-        };
-    };
-    // Notification decisions use the stale context — that's OK: we're deciding
-    // WHETHER to notify based on what the user WAS doing when this check started.
-    // (Side effects and mode mutation are decided inside the transform above,
-    // against the fresh ctx.)
-    const wasInAuto = currentContext.mode === 'auto';
-    // Auto was used during plan: entered from auto or opt-in auto active
-    const autoActiveDuringPlan = currentContext.mode === 'plan' &&
-        (currentContext.prePlanMode === 'auto' ||
-            !!currentContext.strippedDangerousRules);
-    const wantedAuto = wasInAuto || autoActiveDuringPlan || autoModeFlagCli;
-    if (!wantedAuto) {
-        // User didn't want auto at call time — no notification. But still apply
-        // the full kick-out transform: if they shift-tabbed INTO auto during the
-        // await (before setAutoModeCircuitBroken landed), we need to evict them.
-        return { updateContext: kickOutOfAutoIfNeeded };
-    }
-    if (wasInAuto || autoActiveDuringPlan) {
-        // User was in auto or had auto active during plan — kick out + notify.
-        return { updateContext: kickOutOfAutoIfNeeded, notification };
-    }
-    // autoModeFlagCli only: defaultMode was auto but sync check rejected it.
-    // Suppress notification if isAutoModeAvailable is already false (already
-    // notified on a prior check; prevents repeat notifications on successive
-    // unsupported-model switches).
-    return {
-        updateContext: kickOutOfAutoIfNeeded,
-        notification: currentContext.isAutoModeAvailable ? notification : undefined,
-    };
-}
-/**
- * Core logic to check if bypassPermissions should be disabled based on Statsig gate
- */
-export function shouldDisableBypassPermissions() {
-    return checkSecurityRestrictionGate('tengu_disable_bypass_permissions_mode');
-}
-function isAutoModeDisabledBySettings() {
-    const settings = getSettings_DEPRECATED() || {};
-    return (settings.disableAutoMode ===
-        'disable' ||
-        settings.permissions
-            ?.disableAutoMode === 'disable');
-}
-/**
- * Checks if auto mode can be entered: circuit breaker is not active and settings
- * have not disabled it. Synchronous.
- */
-export function isAutoModeGateEnabled() {
-    if (autoModeStateModule?.isAutoModeCircuitBroken() ?? false)
-        return false;
-    if (isAutoModeDisabledBySettings())
-        return false;
-    if (!modelSupportsAutoMode(getMainLoopModel()))
-        return false;
-    return true;
-}
-/**
- * Returns the reason auto mode is currently unavailable, or null if available.
- * Synchronous — uses state populated by verifyAutoModeGateAccess.
- */
-export function getAutoModeUnavailableReason() {
-    if (isAutoModeDisabledBySettings())
-        return 'settings';
-    if (autoModeStateModule?.isAutoModeCircuitBroken() ?? false) {
-        return 'circuit-breaker';
-    }
-    if (!modelSupportsAutoMode(getMainLoopModel()))
-        return 'model';
-    return null;
-}
-const AUTO_MODE_ENABLED_DEFAULT = 'disabled';
-function parseAutoModeEnabledState(value) {
-    if (value === 'enabled' || value === 'disabled' || value === 'opt-in') {
-        return value;
-    }
-    return AUTO_MODE_ENABLED_DEFAULT;
-}
-/**
- * Reads the `enabled` field from tengu_auto_mode_config (cached, may be stale).
- * Defaults to 'disabled' if GrowthBook is unavailable or the field is unset.
- * Other surfaces (IDE, Desktop) should call this to decide whether to surface
- * auto mode in their mode pickers.
- */
-export function getAutoModeEnabledState() {
-    const config = getFeatureValue_CACHED_MAY_BE_STALE('tengu_auto_mode_config', {});
-    return parseAutoModeEnabledState(config?.enabled);
-}
-const NO_CACHED_AUTO_MODE_CONFIG = Symbol('no-cached-auto-mode-config');
-/**
- * Like getAutoModeEnabledState but returns undefined when no cached value
- * exists (cold start, before GrowthBook init). Used by the sync
- * circuit-breaker check in initialPermissionModeFromCLI, which must not
- * conflate "not yet fetched" with "fetched and disabled" — the former
- * defers to verifyAutoModeGateAccess, the latter blocks immediately.
- */
-export function getAutoModeEnabledStateIfCached() {
-    const config = getFeatureValue_CACHED_MAY_BE_STALE('tengu_auto_mode_config', NO_CACHED_AUTO_MODE_CONFIG);
-    if (config === NO_CACHED_AUTO_MODE_CONFIG)
-        return undefined;
-    return parseAutoModeEnabledState(config?.enabled);
-}
-/**
- * Returns true if the user has opted in to auto mode via any trusted mechanism:
- * - CLI flag (--enable-auto-mode / --permission-mode auto) — session-scoped
- *   availability request; the startup dialog in showSetupScreens enforces
- *   persistent consent before the REPL renders.
- * - skipAutoPermissionPrompt setting (persistent; set by accepting the opt-in
- *   dialog or by IDE/Desktop settings toggle)
- */
-export function hasAutoModeOptInAnySource() {
-    if (autoModeStateModule?.getAutoModeFlagCli() ?? false)
-        return true;
-    return hasAutoModeOptIn();
-}
-/**
- * Checks if bypassPermissions mode is currently disabled by Statsig gate or settings.
- * This is a synchronous version that uses cached Statsig values.
- */
-export function isBypassPermissionsModeDisabled() {
-    const growthBookDisableBypassPermissionsMode = checkStatsigFeatureGate_CACHED_MAY_BE_STALE('tengu_disable_bypass_permissions_mode');
-    const settings = getSettings_DEPRECATED() || {};
-    const settingsDisableBypassPermissionsMode = settings.permissions?.disableBypassPermissionsMode === 'disable';
-    return (growthBookDisableBypassPermissionsMode ||
-        settingsDisableBypassPermissionsMode);
-}
-/**
- * Creates an updated context with bypassPermissions disabled
- */
-export function createDisabledBypassPermissionsContext(currentContext) {
-    let updatedContext = currentContext;
-    if (currentContext.mode === 'bypassPermissions') {
-        updatedContext = applyPermissionUpdate(currentContext, {
-            type: 'setMode',
-            mode: 'default',
-            destination: 'session',
-        });
-    }
-    return {
-        ...updatedContext,
-        isBypassPermissionsModeAvailable: false,
-    };
-}
-/**
- * Asynchronously checks if the bypassPermissions mode should be disabled based on Statsig gate
- * and returns an updated toolPermissionContext if needed
- */
-export async function checkAndDisableBypassPermissions(currentContext) {
-    // Only proceed if bypassPermissions mode is available
-    if (!currentContext.isBypassPermissionsModeAvailable) {
-        return;
-    }
-    const shouldDisable = await shouldDisableBypassPermissions();
-    if (!shouldDisable) {
-        return;
-    }
-    // Gate is enabled, need to disable bypassPermissions mode
-    logForDebugging('bypassPermissions mode is being disabled by Statsig gate (async check)', { level: 'warn' });
-    void gracefulShutdown(1, 'bypass_permissions_disabled');
-}
-export function isDefaultPermissionModeAuto() {
-    if (feature('TRANSCRIPT_CLASSIFIER')) {
-        const settings = getSettings_DEPRECATED() || {};
-        return settings.permissions?.defaultMode === 'auto';
-    }
-    return false;
-}
-/**
- * Whether plan mode should use auto mode semantics (classifier runs during
- * plan). True when the user has opted in to auto mode and the gate is enabled.
- * Evaluated at permission-check time so it's reactive to config changes.
- */
-export function shouldPlanUseAutoMode() {
-    if (feature('TRANSCRIPT_CLASSIFIER')) {
-        return (hasAutoModeOptIn() &&
-            isAutoModeGateEnabled() &&
-            getUseAutoModeDuringPlan());
-    }
-    return false;
-}
-/**
- * Centralized plan-mode entry. Stashes the current mode as prePlanMode so
- * ExitPlanMode can restore it. When the user has opted in to auto mode,
- * auto semantics stay active during plan mode.
- */
-export function prepareContextForPlanMode(context) {
-    const currentMode = context.mode;
-    if (currentMode === 'plan')
-        return context;
-    if (feature('TRANSCRIPT_CLASSIFIER')) {
-        const planAutoMode = shouldPlanUseAutoMode();
-        if (currentMode === 'auto') {
-            if (planAutoMode) {
-                return { ...context, prePlanMode: 'auto' };
-            }
-            autoModeStateModule?.setAutoModeActive(false);
-            setNeedsAutoModeExitAttachment(true);
-            return {
-                ...restoreDangerousPermissions(context),
-                prePlanMode: 'auto',
-            };
-        }
-        if (planAutoMode && currentMode !== 'bypassPermissions') {
-            autoModeStateModule?.setAutoModeActive(true);
-            return {
-                ...stripDangerousPermissionsForAutoMode(context),
-                prePlanMode: currentMode,
-            };
-        }
-    }
-    logForDebugging(`[prepareContextForPlanMode] plain plan entry, prePlanMode=${currentMode}`, { level: 'info' });
-    return { ...context, prePlanMode: currentMode };
-}
-/**
- * Reconciles auto-mode state during plan mode after a settings change.
- * Compares desired state (shouldPlanUseAutoMode) against actual state
- * (isAutoModeActive) and activates/deactivates auto accordingly. No-op when
- * not in plan mode. Called from applySettingsChange so that toggling
- * useAutoModeDuringPlan mid-plan takes effect immediately.
- */
-export function transitionPlanAutoMode(context) {
-    if (!feature('TRANSCRIPT_CLASSIFIER'))
-        return context;
-    if (context.mode !== 'plan')
-        return context;
-    // Mirror prepareContextForPlanMode's entry-time exclusion — never activate
-    // auto mid-plan when the user entered from a dangerous mode.
-    if (context.prePlanMode === 'bypassPermissions') {
-        return context;
-    }
-    const want = shouldPlanUseAutoMode();
-    const have = autoModeStateModule?.isAutoModeActive() ?? false;
-    if (want && have) {
-        // syncPermissionRulesFromDisk (called before us in applySettingsChange)
-        // re-adds dangerous rules from disk without touching strippedDangerousRules.
-        // Re-strip so the classifier isn't bypassed by prefix-rule allow matches.
-        return stripDangerousPermissionsForAutoMode(context);
-    }
-    if (!want && !have)
-        return context;
-    if (want) {
-        autoModeStateModule?.setAutoModeActive(true);
-        setNeedsAutoModeExitAttachment(false);
-        return stripDangerousPermissionsForAutoMode(context);
-    }
-    autoModeStateModule?.setAutoModeActive(false);
-    setNeedsAutoModeExitAttachment(true);
-    return restoreDangerousPermissions(context);
-}