@iaforged/context-code 1.0.63 → 1.0.67

package/dist/src/utils/permissions/filesystem.js

@@ -1,1411 +0,0 @@
-import { MACRO, feature } from '../../recovery/bunBundleShim.js';
-import { randomBytes } from 'crypto';
-import ignore from 'ignore';
-import memoize from 'lodash-es/memoize.js';
-import { homedir, tmpdir } from 'os';
-import { join, normalize, posix, sep } from 'path';
-import { hasAutoMemPathOverride, isAutoMemPath } from '../../memdir/paths.js';
-import { isAgentMemoryPath } from '../../tools/AgentTool/agentMemory.js';
-import { CLAUDE_FOLDER_PERMISSION_PATTERN, FILE_EDIT_TOOL_NAME, GLOBAL_CLAUDE_FOLDER_PERMISSION_PATTERN, } from '../../tools/FileEditTool/constants.js';
-import { getOriginalCwd, getSessionId } from '../../bootstrap/state.js';
-import { checkStatsigFeatureGate_CACHED_MAY_BE_STALE } from '../../services/analytics/growthbook.js';
-import { FILE_READ_TOOL_NAME } from '../../tools/FileReadTool/prompt.js';
-import { getCwd } from '../cwd.js';
-import { getClaudeConfigHomeDir } from '../envUtils.js';
-import { getFsImplementation, getPathsForPermissionCheck, } from '../fsOperations.js';
-import { containsPathTraversal, expandPath, getDirectoryForPath, sanitizePath, } from '../path.js';
-import { getPlanSlug, getPlansDirectory } from '../plans.js';
-import { getPlatform } from '../platform.js';
-import { getProjectDir } from '../sessionStorage.js';
-import { SETTING_SOURCES } from '../settings/constants.js';
-import { getSettingsFilePathForSource, getSettingsRootPathForSource, } from '../settings/settings.js';
-import { containsVulnerableUncPath } from '../shell/readOnlyCommandValidation.js';
-import { getToolResultsDir } from '../toolResultStorage.js';
-import { windowsPathToPosixPath } from '../windowsPaths.js';
-import { createReadRuleSuggestion } from './PermissionUpdate.js';
-import { getRuleByContentsForToolName } from './permissions.js';
-/**
- * Dangerous files that should be protected from auto-editing.
- * These files can be used for code execution or data exfiltration.
- */
-export const DANGEROUS_FILES = [
-    '.gitconfig',
-    '.gitmodules',
-    '.bashrc',
-    '.bash_profile',
-    '.zshrc',
-    '.zprofile',
-    '.profile',
-    '.ripgreprc',
-    '.mcp.json',
-    '.claude.json',
-];
-/**
- * Dangerous directories that should be protected from auto-editing.
- * These directories contain sensitive configuration or executable files.
- */
-export const DANGEROUS_DIRECTORIES = [
-    '.git',
-    '.vscode',
-    '.idea',
-    '.claude',
-];
-/**
- * Normalizes a path for case-insensitive comparison.
- * This prevents bypassing security checks using mixed-case paths on case-insensitive
- * filesystems (macOS/Windows) like `.cLauDe/Settings.locaL.json`.
- *
- * We always normalize to lowercase regardless of platform for consistent security.
- * @param path The path to normalize
- * @returns The lowercase path for safe comparison
- */
-export function normalizeCaseForComparison(path) {
-    return path.toLowerCase();
-}
-/**
- * If filePath is inside a .claude/skills/{name}/ directory (project or global),
- * return the skill name and a session-allow pattern scoped to just that skill.
- * Used to offer a narrower "allow edits to this skill only" option in the
- * permission dialog and SDK suggestions, so iterating on one skill doesn't
- * require granting session access to all of .claude/ (settings.json, hooks/, etc.).
- */
-export function getClaudeSkillScope(filePath) {
-    const absolutePath = expandPath(filePath);
-    const absolutePathLower = normalizeCaseForComparison(absolutePath);
-    const bases = [
-        {
-            dir: expandPath(join(getOriginalCwd(), '.claude', 'skills')),
-            prefix: '/.claude/skills/',
-        },
-        {
-            dir: expandPath(join(homedir(), '.claude', 'skills')),
-            prefix: '~/.claude/skills/',
-        },
-    ];
-    for (const { dir, prefix } of bases) {
-        const dirLower = normalizeCaseForComparison(dir);
-        // Try both path separators (Windows paths may not be normalized to /)
-        for (const s of [sep, '/']) {
-            if (absolutePathLower.startsWith(dirLower + s.toLowerCase())) {
-                // Match on lowercase, but slice the ORIGINAL path so the skill name
-                // preserves case (pattern matching downstream is case-sensitive)
-                const rest = absolutePath.slice(dir.length + s.length);
-                const slash = rest.indexOf('/');
-                const bslash = sep === '\\' ? rest.indexOf('\\') : -1;
-                const cut = slash === -1
-                    ? bslash
-                    : bslash === -1
-                        ? slash
-                        : Math.min(slash, bslash);
-                // Require a separator: file must be INSIDE the skill dir, not a
-                // file directly under skills/ (no skill scope for that)
-                if (cut <= 0)
-                    return null;
-                const skillName = rest.slice(0, cut);
-                // Reject traversal and empty. Use includes('..') not === '..' to
-                // match step 1.6's ruleContent.includes('..') guard: a skillName like
-                // 'v2..beta' would otherwise produce a suggestion step 1.7 emits but
-                // step 1.6 always rejects (dead suggestion, infinite re-prompt).
-                if (!skillName || skillName === '.' || skillName.includes('..')) {
-                    return null;
-                }
-                // Reject glob metacharacters. skillName is interpolated into a
-                // gitignore pattern consumed by ignore().add() in matchingRuleForInput
-                // at step 1.6. A directory literally named '*' (valid on POSIX) would
-                // produce '/.claude/skills/*/**' which matches ALL skills. Return null
-                // to fall through to generateSuggestions() instead.
-                if (/[*?[\]]/.test(skillName))
-                    return null;
-                return { skillName, pattern: prefix + skillName + '/**' };
-            }
-        }
-    }
-    return null;
-}
-// Always use / as the path separator per gitignore spec
-// https://git-scm.com/docs/gitignore
-const DIR_SEP = posix.sep;
-/**
- * Cross-platform relative path calculation that returns POSIX-style paths.
- * Handles Windows path conversion internally.
- * @param from The base path
- * @param to The target path
- * @returns A POSIX-style relative path
- */
-export function relativePath(from, to) {
-    if (getPlatform() === 'windows') {
-        // Convert Windows paths to POSIX for consistent comparison
-        const posixFrom = windowsPathToPosixPath(from);
-        const posixTo = windowsPathToPosixPath(to);
-        return posix.relative(posixFrom, posixTo);
-    }
-    // Use POSIX paths directly
-    return posix.relative(from, to);
-}
-/**
- * Converts a path to POSIX format for pattern matching.
- * Handles Windows path conversion internally.
- * @param path The path to convert
- * @returns A POSIX-style path
- */
-export function toPosixPath(path) {
-    if (getPlatform() === 'windows') {
-        return windowsPathToPosixPath(path);
-    }
-    return path;
-}
-function getSettingsPaths() {
-    return SETTING_SOURCES.map(source => getSettingsFilePathForSource(source)).filter(path => path !== undefined);
-}
-export function isClaudeSettingsPath(filePath) {
-    // SECURITY: Normalize path structure first to prevent bypass via redundant ./
-    // sequences like `./.claude/./settings.json` which would evade the endsWith() check
-    const expandedPath = expandPath(filePath);
-    // Normalize for case-insensitive comparison to prevent bypassing security
-    // with paths like .cLauDe/Settings.locaL.json
-    const normalizedPath = normalizeCaseForComparison(expandedPath);
-    // Use platform separator so endsWith checks work on both Unix (/) and Windows (\)
-    if (normalizedPath.endsWith(`${sep}.claude${sep}settings.json`) ||
-        normalizedPath.endsWith(`${sep}.claude${sep}settings.local.json`)) {
-        // Include .claude/settings.json even for other projects
-        return true;
-    }
-    // Check for current project's settings files (including managed settings and CLI args)
-    // Both paths are now absolute and normalized for consistent comparison
-    return getSettingsPaths().some(settingsPath => normalizeCaseForComparison(settingsPath) === normalizedPath);
-}
-// Always ask when Context Code tries to edit its own config files
-function isClaudeConfigFilePath(filePath) {
-    if (isClaudeSettingsPath(filePath)) {
-        return true;
-    }
-    // Check if file is within .claude/commands or .claude/agents directories
-    // using proper path segment validation (not string matching with includes())
-    // pathInWorkingPath now handles case-insensitive comparison to prevent bypasses
-    const commandsDir = join(getOriginalCwd(), '.claude', 'commands');
-    const agentsDir = join(getOriginalCwd(), '.claude', 'agents');
-    const skillsDir = join(getOriginalCwd(), '.claude', 'skills');
-    return (pathInWorkingPath(filePath, commandsDir) ||
-        pathInWorkingPath(filePath, agentsDir) ||
-        pathInWorkingPath(filePath, skillsDir));
-}
-// Check if file is the plan file for the current session
-function isSessionPlanFile(absolutePath) {
-    // Check if path is a plan file for this session (main or agent-specific)
-    // Main plan file: {plansDir}/{planSlug}.md
-    // Agent plan file: {plansDir}/{planSlug}-agent-{agentId}.md
-    const expectedPrefix = join(getPlansDirectory(), getPlanSlug());
-    // SECURITY: Normalize to prevent path traversal bypasses via .. segments
-    const normalizedPath = normalize(absolutePath);
-    return (normalizedPath.startsWith(expectedPrefix) && normalizedPath.endsWith('.md'));
-}
-/**
- * Returns the session memory directory path for the current session with trailing separator.
- * Path format: {projectDir}/{sessionId}/session-memory/
- */
-export function getSessionMemoryDir() {
-    return join(getProjectDir(getCwd()), getSessionId(), 'session-memory') + sep;
-}
-/**
- * Returns the session memory file path for the current session.
- * Path format: {projectDir}/{sessionId}/session-memory/summary.md
- */
-export function getSessionMemoryPath() {
-    return join(getSessionMemoryDir(), 'summary.md');
-}
-// Check if file is within the session memory directory
-function isSessionMemoryPath(absolutePath) {
-    // SECURITY: Normalize to prevent path traversal bypasses via .. segments
-    const normalizedPath = normalize(absolutePath);
-    return normalizedPath.startsWith(getSessionMemoryDir());
-}
-/**
- * Check if file is within the current project's directory.
- * Path format: ~/.claude/projects/{sanitized-cwd}/...
- */
-function isProjectDirPath(absolutePath) {
-    const projectDir = getProjectDir(getCwd());
-    // SECURITY: Normalize to prevent path traversal bypasses via .. segments
-    const normalizedPath = normalize(absolutePath);
-    return (normalizedPath === projectDir || normalizedPath.startsWith(projectDir + sep));
-}
-/**
- * Checks if the scratchpad directory feature is enabled.
- * The scratchpad is a per-session directory for Claude to write temporary files.
- * Controlled by the tengu_scratch Statsig gate.
- */
-export function isScratchpadEnabled() {
-    return checkStatsigFeatureGate_CACHED_MAY_BE_STALE('tengu_scratch');
-}
-/**
- * Returns the user-specific Claude temp directory name.
- * On Unix: 'claude-{uid}' to prevent multi-user permission conflicts
- * On Windows: 'claude' (tmpdir() is already per-user)
- */
-export function getClaudeTempDirName() {
-    if (getPlatform() === 'windows') {
-        return 'claude';
-    }
-    // Use UID to create per-user directories, preventing permission conflicts
-    // when multiple users share the same /tmp directory
-    const uid = process.getuid?.() ?? 0;
-    return `claude-${uid}`;
-}
-/**
- * Returns the Claude temp directory path with symlinks resolved.
- * Uses TMPDIR env var if set, otherwise:
- * - On Unix: /tmp/claude-{uid}/ (resolved to /private/tmp/claude-{uid}/ on macOS)
- * - On Windows: {tmpdir}/claude/ (e.g., C:\Users\{user}\AppData\Local\Temp\claude\)
- * This is a per-user temporary directory used by Context Code for all temp files.
- *
- * NOTE: We resolve symlinks to ensure this path matches the resolved paths used
- * in permission checks. On macOS, /tmp is a symlink to /private/tmp, so without
- * resolution, paths like /tmp/claude-{uid}/... wouldn't match /private/tmp/claude-{uid}/...
- */
-// Memoized: called per-tool from permission checks (yoloClassifier, sandbox-adapter)
-// and per-turn from BashTool prompt. Inputs (CLAUDE_CODE_TMPDIR env + platform) are
-// fixed at startup, and the realpath of the system tmp dir does not change mid-session.
-export const getClaudeTempDir = memoize(function getClaudeTempDir() {
-    const baseTmpDir = process.env.CLAUDE_CODE_TMPDIR ||
-        (getPlatform() === 'windows' ? tmpdir() : '/tmp');
-    // Resolve symlinks in the base temp directory (e.g., /tmp -> /private/tmp on macOS)
-    // This ensures the path matches resolved paths in permission checks
-    const fs = getFsImplementation();
-    let resolvedBaseTmpDir = baseTmpDir;
-    try {
-        resolvedBaseTmpDir = fs.realpathSync(baseTmpDir);
-    }
-    catch {
-        // If resolution fails, use the original path
-    }
-    return join(resolvedBaseTmpDir, getClaudeTempDirName()) + sep;
-});
-/**
- * Root for bundled-skill file extraction (see bundledSkills.ts).
- *
- * SECURITY: The per-process random nonce is the load-bearing defense here.
- * Every other path component (uid, VERSION, skill name, file keys) is public
- * knowledge, so without it a local attacker can pre-create the tree on a
- * shared /tmp — sticky bit prevents deletion, not creation — and either
- * symlink an intermediate directory (O_NOFOLLOW only checks the final
- * component) or own a parent dir and swap file contents post-write for prompt
- * injection via the read allowlist. diskOutput.ts gets the same property from
- * the session-ID UUID in its path.
- *
- * Memoized so the extraction writes and the permission check agree on the
- * path for the life of the process. Version-scoped so stale extractions from
- * other binaries don't fall under the allowlist.
- */
-export const getBundledSkillsRoot = memoize(function getBundledSkillsRoot() {
-    const nonce = randomBytes(16).toString('hex');
-    return join(getClaudeTempDir(), 'bundled-skills', MACRO.VERSION, nonce);
-});
-/**
- * Returns the project temp directory path with trailing separator.
- * Path format: /tmp/claude-{uid}/{sanitized-cwd}/
- */
-export function getProjectTempDir() {
-    return join(getClaudeTempDir(), sanitizePath(getOriginalCwd())) + sep;
-}
-/**
- * Returns the scratchpad directory path for the current session.
- * Path format: /tmp/claude-{uid}/{sanitized-cwd}/{sessionId}/scratchpad/
- */
-export function getScratchpadDir() {
-    return join(getProjectTempDir(), getSessionId(), 'scratchpad');
-}
-/**
- * Ensures the scratchpad directory exists for the current session.
- * Creates the directory with secure permissions (0o700) if it doesn't exist.
- * Returns the path to the scratchpad directory.
- * @throws If scratchpad feature is not enabled
- */
-export async function ensureScratchpadDir() {
-    if (!isScratchpadEnabled()) {
-        throw new Error('Scratchpad directory feature is not enabled');
-    }
-    const fs = getFsImplementation();
-    const scratchpadDir = getScratchpadDir();
-    // Create directory recursively with secure permissions (owner-only access)
-    // FsOperations.mkdir handles recursive: true internally and is a no-op if dir exists
-    await fs.mkdir(scratchpadDir, { mode: 0o700 });
-    return scratchpadDir;
-}
-// Check if file is within the scratchpad directory
-function isScratchpadPath(absolutePath) {
-    if (!isScratchpadEnabled()) {
-        return false;
-    }
-    const scratchpadDir = getScratchpadDir();
-    // SECURITY: Normalize the path to resolve .. segments before checking
-    // This prevents path traversal bypasses like:
-    //   echo "malicious" > /tmp/claude-0/proj/session/scratchpad/../../../etc/passwd
-    // Without normalization, the path would pass the startsWith check but write to /etc/passwd
-    const normalizedPath = normalize(absolutePath);
-    return (normalizedPath === scratchpadDir ||
-        normalizedPath.startsWith(scratchpadDir + sep));
-}
-/**
- * Check if a file path is dangerous to auto-edit without explicit permission.
- * This includes:
- * - Files in .git directories or .gitconfig files (to prevent git-based data exfiltration and code execution)
- * - Files in .vscode directories (to prevent VS Code settings manipulation and potential code execution)
- * - Files in .idea directories (to prevent JetBrains IDE settings manipulation)
- * - Shell configuration files (to prevent shell startup script manipulation)
- * - UNC paths (to prevent network file access and WebDAV attacks)
- */
-function isDangerousFilePathToAutoEdit(path) {
-    const absolutePath = expandPath(path);
-    const pathSegments = absolutePath.split(sep);
-    const fileName = pathSegments.at(-1);
-    // Check for UNC paths (defense-in-depth to catch any patterns that might not be caught by containsVulnerableUncPath)
-    // Block anything starting with \\ or // as these are potentially UNC paths that could access network resources
-    if (path.startsWith('\\\\') || path.startsWith('//')) {
-        return true;
-    }
-    // Check if path is within dangerous directories (case-insensitive to prevent bypasses)
-    for (let i = 0; i < pathSegments.length; i++) {
-        const segment = pathSegments[i];
-        const normalizedSegment = normalizeCaseForComparison(segment);
-        for (const dir of DANGEROUS_DIRECTORIES) {
-            if (normalizedSegment !== normalizeCaseForComparison(dir)) {
-                continue;
-            }
-            // Special case: .claude/worktrees/ is a structural path (where Claude stores
-            // git worktrees), not a user-created dangerous directory. Skip the .claude
-            // segment when it's followed by 'worktrees'. Any nested .claude directories
-            // within the worktree (not followed by 'worktrees') are still blocked.
-            if (dir === '.claude') {
-                const nextSegment = pathSegments[i + 1];
-                if (nextSegment &&
-                    normalizeCaseForComparison(nextSegment) === 'worktrees') {
-                    break; // Skip this .claude, continue checking other segments
-                }
-            }
-            return true;
-        }
-    }
-    // Check for dangerous configuration files (case-insensitive)
-    if (fileName) {
-        const normalizedFileName = normalizeCaseForComparison(fileName);
-        if (DANGEROUS_FILES.some(dangerousFile => normalizeCaseForComparison(dangerousFile) === normalizedFileName)) {
-            return true;
-        }
-    }
-    return false;
-}
-/**
- * Detects suspicious Windows path patterns that could bypass security checks.
- * These patterns include:
- * - NTFS Alternate Data Streams (e.g., file.txt::$DATA or file.txt:stream)
- * - 8.3 short names (e.g., GIT~1, CLAUDE~1, SETTIN~1.JSON)
- * - Long path prefixes (e.g., \\?\C:\..., \\.\C:\..., //?/C:/..., //./C:/...)
- * - Trailing dots and spaces (e.g., .git., .claude , .bashrc...)
- * - DOS device names (e.g., .git.CON, settings.json.PRN, .bashrc.AUX)
- * - Three or more consecutive dots (e.g., .../file.txt, path/.../file, file...txt)
- *
- * When detected, these paths should always require manual approval to prevent
- * bypassing security checks through path canonicalization vulnerabilities.
- *
- * ## Why Check on All Platforms?
- *
- * While these patterns are primarily Windows-specific, NTFS filesystems can be
- * mounted on Linux and macOS (e.g., using ntfs-3g). On these systems, the same
- * bypass techniques would work - an attacker could use short names or long path
- * prefixes to bypass security checks. Therefore, we check for these patterns on
- * all platforms to ensure comprehensive protection. (Note: the ADS colon check
- * is Windows/WSL-only, since colon syntax is only interpreted by the Windows
- * kernel; on Linux/macOS, NTFS ADS is accessed via xattrs, not colon syntax.)
- *
- * ## Why Detection Instead of Normalization?
- *
- * An alternative approach would be to normalize these paths using Windows APIs
- * (e.g., GetLongPathNameW). However, this approach has significant challenges:
- *
- * 1. **Filesystem dependency**: Short path normalization is relative to files that
- *    currently exist on the filesystem. This creates issues when writing to new
- *    files since they don't exist yet and cannot be normalized.
- *
- * 2. **Race conditions**: The filesystem state can change between normalization
- *    and actual file access, creating TOCTOU (Time-Of-Check-Time-Of-Use) vulnerabilities.
- *
- * 3. **Complexity**: Proper normalization requires Windows-specific APIs, handling
- *    multiple edge cases, and dealing with various path formats (UNC, device paths, etc.).
- *
- * 4. **Reliability**: Pattern detection is more predictable and doesn't depend on
- *    external system state.
- *
- * If you are considering adding normalization for these paths, please reach out to
- * AppSec first to discuss the security implications and implementation approach.
- *
- * @param path The path to check for suspicious patterns
- * @returns true if suspicious Windows path patterns are detected
- */
-function hasSuspiciousWindowsPathPattern(path) {
-    // Check for NTFS Alternate Data Streams
-    // Look for ':' after position 2 to skip drive letters (e.g., C:\)
-    // Examples: file.txt::$DATA, .bashrc:hidden, settings.json:stream
-    // Note: ADS colon syntax is only interpreted by the Windows kernel. On WSL,
-    // DrvFs mounts route file operations through the Windows kernel, so colon
-    // syntax is still interpreted as ADS separators. On Linux/macOS (non-WSL),
-    // even when NTFS is mounted, ADS is accessed via xattrs (ntfs-3g) not colon
-    // syntax, and colons are valid filename characters.
-    if (getPlatform() === 'windows' || getPlatform() === 'wsl') {
-        const colonIndex = path.indexOf(':', 2);
-        if (colonIndex !== -1) {
-            return true;
-        }
-    }
-    // Check for 8.3 short names
-    // Look for '~' followed by a digit
-    // Examples: GIT~1, CLAUDE~1, SETTIN~1.JSON, BASHRC~1
-    if (/~\d/.test(path)) {
-        return true;
-    }
-    // Check for long path prefixes (both backslash and forward slash variants)
-    // Examples: \\?\C:\Users\..., \\.\C:\..., //?/C:/..., //./C:/...
-    if (path.startsWith('\\\\?\\') ||
-        path.startsWith('\\\\.\\') ||
-        path.startsWith('//?/') ||
-        path.startsWith('//./')) {
-        return true;
-    }
-    // Check for trailing dots and spaces that Windows strips during path resolution
-    // Examples: .git., .claude , .bashrc..., settings.json.
-    // This can bypass string matching if ".git" is blocked but ".git." is used
-    if (/[.\s]+$/.test(path)) {
-        return true;
-    }
-    // Check for DOS device names that Windows treats as special devices
-    // Examples: .git.CON, settings.json.PRN, .bashrc.AUX
-    // Device names: CON, PRN, AUX, NUL, COM1-9, LPT1-9
-    if (/\.(CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])$/i.test(path)) {
-        return true;
-    }
-    // Check for three or more consecutive dots (...) when used as a path component
-    // This pattern can be used to bypass security checks or create confusion
-    // Examples: .../file.txt, path/.../file
-    // Only block when dots are preceded AND followed by path separators (/ or \)
-    // This allows legitimate uses like Next.js catch-all routes [...]name]
-    if (/(^|\/|\\)\.{3,}(\/|\\|$)/.test(path)) {
-        return true;
-    }
-    // Check for UNC paths (on all platforms for defense-in-depth)
-    // Examples: \\server\share, \\foo.com\file, //server/share, \\192.168.1.1\share
-    // UNC paths can access remote resources, leak credentials, and bypass working directory restrictions
-    if (containsVulnerableUncPath(path)) {
-        return true;
-    }
-    return false;
-}
-/**
- * Checks if a path is safe for auto-editing (acceptEdits mode).
- * Returns information about why the path is unsafe, or null if all checks pass.
- *
- * This function performs comprehensive safety checks including:
- * - Suspicious Windows path patterns (NTFS streams, 8.3 names, long path prefixes, etc.)
- * - Claude config files (.claude/settings.json, .claude/commands/, .claude/agents/)
- * - MCP CLI state files (managed internally by Context Code)
- * - Dangerous files (.bashrc, .gitconfig, .git/, .vscode/, .idea/, etc.)
- *
- * IMPORTANT: This function checks BOTH the original path AND resolved symlink paths
- * to prevent bypasses via symlinks pointing to protected files.
- *
- * @param path The path to check for safety
- * @returns Object with safe=false and message if unsafe, or { safe: true } if all checks pass
- */
-export function checkPathSafetyForAutoEdit(path, precomputedPathsToCheck) {
-    // Get all paths to check (original + symlink resolved paths)
-    const pathsToCheck = precomputedPathsToCheck ?? getPathsForPermissionCheck(path);
-    // Check for suspicious Windows path patterns on all paths
-    for (const pathToCheck of pathsToCheck) {
-        if (hasSuspiciousWindowsPathPattern(pathToCheck)) {
-            return {
-                safe: false,
-                message: `Claude requested permissions to write to ${path}, which contains a suspicious Windows path pattern that requires manual approval.`,
-                classifierApprovable: false,
-            };
-        }
-    }
-    // Check for Claude config files on all paths
-    for (const pathToCheck of pathsToCheck) {
-        if (isClaudeConfigFilePath(pathToCheck)) {
-            return {
-                safe: false,
-                message: `Claude requested permissions to write to ${path}, but you haven't granted it yet.`,
-                classifierApprovable: true,
-            };
-        }
-    }
-    // Check for dangerous files on all paths
-    for (const pathToCheck of pathsToCheck) {
-        if (isDangerousFilePathToAutoEdit(pathToCheck)) {
-            return {
-                safe: false,
-                message: `Claude requested permissions to edit ${path} which is a sensitive file.`,
-                classifierApprovable: true,
-            };
-        }
-    }
-    // All safety checks passed
-    return { safe: true };
-}
-export function allWorkingDirectories(context) {
-    return new Set([
-        getOriginalCwd(),
-        ...context.additionalWorkingDirectories.keys(),
-    ]);
-}
-// Working directories are session-stable; memoize their resolved forms to
-// avoid repeated existsSync/lstatSync/realpathSync syscalls on every
-// permission check. Keyed by path string — getPathsForPermissionCheck is
-// deterministic for existing directories within a session.
-// Exported for test/preload.ts cache clearing (shard-isolation).
-export const getResolvedWorkingDirPaths = memoize(getPathsForPermissionCheck);
-export function pathInAllowedWorkingPath(path, toolPermissionContext, precomputedPathsToCheck) {
-    // Check both the original path and the resolved symlink path
-    const pathsToCheck = precomputedPathsToCheck ?? getPathsForPermissionCheck(path);
-    // Resolve working directories the same way we resolve input paths so
-    // comparisons are symmetric. Without this, a resolved input path
-    // (e.g. /System/Volumes/Data/home/... on macOS) would not match an
-    // unresolved working directory (/home/...), causing false denials.
-    const workingPaths = Array.from(allWorkingDirectories(toolPermissionContext)).flatMap(wp => getResolvedWorkingDirPaths(wp));
-    // All paths must be within allowed working paths
-    // If any resolved path is outside, deny access
-    return pathsToCheck.every(pathToCheck => workingPaths.some(workingPath => pathInWorkingPath(pathToCheck, workingPath)));
-}
-export function pathInWorkingPath(path, workingPath) {
-    const absolutePath = expandPath(path);
-    const absoluteWorkingPath = expandPath(workingPath);
-    // On macOS, handle common symlink issues:
-    // - /var -> /private/var
-    // - /tmp -> /private/tmp
-    const normalizedPath = absolutePath
-        .replace(/^\/private\/var\//, '/var/')
-        .replace(/^\/private\/tmp(\/|$)/, '/tmp$1');
-    const normalizedWorkingPath = absoluteWorkingPath
-        .replace(/^\/private\/var\//, '/var/')
-        .replace(/^\/private\/tmp(\/|$)/, '/tmp$1');
-    // Normalize case for case-insensitive comparison to prevent bypassing security
-    // checks on case-insensitive filesystems (macOS/Windows) like .cLauDe/CoMmAnDs
-    const caseNormalizedPath = normalizeCaseForComparison(normalizedPath);
-    const caseNormalizedWorkingPath = normalizeCaseForComparison(normalizedWorkingPath);
-    // Use cross-platform relative path helper
-    const relative = relativePath(caseNormalizedWorkingPath, caseNormalizedPath);
-    // Same path
-    if (relative === '') {
-        return true;
-    }
-    if (containsPathTraversal(relative)) {
-        return false;
-    }
-    // Path is inside (relative path that doesn't go up)
-    return !posix.isAbsolute(relative);
-}
-function rootPathForSource(source) {
-    switch (source) {
-        case 'cliArg':
-        case 'command':
-        case 'session':
-            return expandPath(getOriginalCwd());
-        case 'userSettings':
-        case 'policySettings':
-        case 'projectSettings':
-        case 'localSettings':
-        case 'flagSettings':
-            return getSettingsRootPathForSource(source);
-    }
-}
-function prependDirSep(path) {
-    return posix.join(DIR_SEP, path);
-}
-function normalizePatternToPath({ patternRoot, pattern, rootPath, }) {
-    // If the pattern root + pattern combination starts with our reference root
-    const fullPattern = posix.join(patternRoot, pattern);
-    if (patternRoot === rootPath) {
-        // If the pattern root exactly matches our reference root no need to change
-        return prependDirSep(pattern);
-    }
-    else if (fullPattern.startsWith(`${rootPath}${DIR_SEP}`)) {
-        // Extract the relative part
-        const relativePart = fullPattern.slice(rootPath.length);
-        return prependDirSep(relativePart);
-    }
-    else {
-        // Handle patterns that are inside the reference root but not starting with it
-        const relativePath = posix.relative(rootPath, patternRoot);
-        if (!relativePath ||
-            relativePath.startsWith(`..${DIR_SEP}`) ||
-            relativePath === '..') {
-            // Pattern is outside the reference root, so it can be skipped
-            return null;
-        }
-        else {
-            const relativePattern = posix.join(relativePath, pattern);
-            return prependDirSep(relativePattern);
-        }
-    }
-}
-export function normalizePatternsToPath(patternsByRoot, root) {
-    // null root means the pattern can match anywhere
-    const result = new Set(patternsByRoot.get(null) ?? []);
-    for (const [patternRoot, patterns] of patternsByRoot.entries()) {
-        if (patternRoot === null) {
-            // already added
-            continue;
-        }
-        // Check each pattern to see if the full path starts with our reference root
-        for (const pattern of patterns) {
-            const normalizedPattern = normalizePatternToPath({
-                patternRoot,
-                pattern,
-                rootPath: root,
-            });
-            if (normalizedPattern) {
-                result.add(normalizedPattern);
-            }
-        }
-    }
-    return Array.from(result);
-}
-/**
- * Collects all deny rules for file read permissions and returns their ignore patterns
- * Each pattern must be resolved relative to its root (map key)
- * Null keys are used for patterns that don't have a root
- *
- * This is used to hide files that are blocked by Read deny rules.
- *
- * @param toolPermissionContext
- */
-export function getFileReadIgnorePatterns(toolPermissionContext) {
-    const patternsByRoot = getPatternsByRoot(toolPermissionContext, 'read', 'deny');
-    const result = new Map();
-    for (const [patternRoot, patternMap] of patternsByRoot.entries()) {
-        result.set(patternRoot, Array.from(patternMap.keys()));
-    }
-    return result;
-}
-function patternWithRoot(pattern, source) {
-    if (pattern.startsWith(`${DIR_SEP}${DIR_SEP}`)) {
-        // Patterns starting with // resolve relative to /
-        const patternWithoutDoubleSlash = pattern.slice(1);
-        // On Windows, check if this is a POSIX-style drive path like //c/Users/...
-        // Note: UNC paths (//server/share) will not match this regex and will be treated
-        // as root-relative patterns, which may need separate handling in the future
-        if (getPlatform() === 'windows' &&
-            patternWithoutDoubleSlash.match(/^\/[a-z]\//i)) {
-            // Convert POSIX path to Windows format
-            // The pattern is like /c/Users/... so we convert it to C:\Users\...
-            const driveLetter = patternWithoutDoubleSlash[1]?.toUpperCase() ?? 'C';
-            // Keep the pattern in POSIX format since relativePath returns POSIX paths
-            const pathAfterDrive = patternWithoutDoubleSlash.slice(2);
-            // Extract the drive root (C:\) and the rest of the pattern
-            const driveRoot = `${driveLetter}:\\`;
-            const relativeFromDrive = pathAfterDrive.startsWith('/')
-                ? pathAfterDrive.slice(1)
-                : pathAfterDrive;
-            return {
-                relativePattern: relativeFromDrive,
-                root: driveRoot,
-            };
-        }
-        return {
-            relativePattern: patternWithoutDoubleSlash,
-            root: DIR_SEP,
-        };
-    }
-    else if (pattern.startsWith(`~${DIR_SEP}`)) {
-        // Patterns starting with ~/ resolve relative to homedir
-        return {
-            relativePattern: pattern.slice(1),
-            root: homedir().normalize('NFC'),
-        };
-    }
-    else if (pattern.startsWith(DIR_SEP)) {
-        // Patterns starting with / resolve relative to the directory where settings are stored (without .claude/)
-        return {
-            relativePattern: pattern,
-            root: rootPathForSource(source),
-        };
-    }
-    // No root specified, put it with all the other patterns
-    // Normalize patterns that start with "./" to remove the prefix
-    // This ensures that patterns like "./.env" match files like ".env"
-    let normalizedPattern = pattern;
-    if (pattern.startsWith(`.${DIR_SEP}`)) {
-        normalizedPattern = pattern.slice(2);
-    }
-    return {
-        relativePattern: normalizedPattern,
-        root: null,
-    };
-}
-function getPatternsByRoot(toolPermissionContext, toolType, behavior) {
-    const toolName = (() => {
-        switch (toolType) {
-            case 'edit':
-                // Apply Edit tool rules to any tool editing files
-                return FILE_EDIT_TOOL_NAME;
-            case 'read':
-                // Apply Read tool rules to any tool reading files
-                return FILE_READ_TOOL_NAME;
-        }
-    })();
-    const rules = getRuleByContentsForToolName(toolPermissionContext, toolName, behavior);
-    // Resolve rules relative to path based on source
-    const patternsByRoot = new Map();
-    for (const [pattern, rule] of rules.entries()) {
-        const { relativePattern, root } = patternWithRoot(pattern, rule.source);
-        let patternsForRoot = patternsByRoot.get(root);
-        if (patternsForRoot === undefined) {
-            patternsForRoot = new Map();
-            patternsByRoot.set(root, patternsForRoot);
-        }
-        // Store the rule keyed by the root
-        patternsForRoot.set(relativePattern, rule);
-    }
-    return patternsByRoot;
-}
-export function matchingRuleForInput(path, toolPermissionContext, toolType, behavior) {
-    let fileAbsolutePath = expandPath(path);
-    // On Windows, convert to POSIX format to match against permission patterns
-    if (getPlatform() === 'windows' && fileAbsolutePath.includes('\\')) {
-        fileAbsolutePath = windowsPathToPosixPath(fileAbsolutePath);
-    }
-    const patternsByRoot = getPatternsByRoot(toolPermissionContext, toolType, behavior);
-    // Check each root for a matching pattern
-    for (const [root, patternMap] of patternsByRoot.entries()) {
-        // Transform patterns for the ignore library
-        const patterns = Array.from(patternMap.keys()).map(pattern => {
-            let adjustedPattern = pattern;
-            // Remove /** suffix - ignore library treats 'path' as matching both
-            // the path itself and everything inside it
-            if (adjustedPattern.endsWith('/**')) {
-                adjustedPattern = adjustedPattern.slice(0, -3);
-            }
-            return adjustedPattern;
-        });
-        const ig = ignore().add(patterns);
-        // Use cross-platform relative path helper for POSIX-style patterns
-        const relativePathStr = relativePath(root ?? getCwd(), fileAbsolutePath ?? getCwd());
-        if (relativePathStr.startsWith(`..${DIR_SEP}`)) {
-            // The path is outside the root, so ignore it
-            continue;
-        }
-        // Important: ig.test throws if you give it an empty string
-        if (!relativePathStr) {
-            continue;
-        }
-        const igResult = ig.test(relativePathStr);
-        if (igResult.ignored && igResult.rule) {
-            // Map the matched pattern back to the original rule
-            const originalPattern = igResult.rule.pattern;
-            // Check if this was a /** pattern we simplified
-            const withWildcard = originalPattern + '/**';
-            if (patternMap.has(withWildcard)) {
-                return patternMap.get(withWildcard) ?? null;
-            }
-            return patternMap.get(originalPattern) ?? null;
-        }
-    }
-    // No matching rule found
-    return null;
-}
-/**
- * Permission result for read permission for the specified tool & tool input
- */
-export function checkReadPermissionForTool(tool, input, toolPermissionContext) {
-    if (typeof tool.getPath !== 'function') {
-        return {
-            behavior: 'ask',
-            message: `Claude requested permissions to use ${tool.name}, but you haven't granted it yet.`,
-        };
-    }
-    const path = tool.getPath(input);
-    // Get paths to check (includes both original and resolved symlinks).
-    // Computed once here and threaded through checkWritePermissionForTool →
-    // checkPathSafetyForAutoEdit → pathInAllowedWorkingPath to avoid redundant
-    // existsSync/lstatSync/realpathSync syscalls on the same path (previously
-    // 6× = 30 syscalls per Read permission check).
-    const pathsToCheck = getPathsForPermissionCheck(path);
-    // 1. Defense-in-depth: Block UNC paths early (before other checks)
-    // This catches paths starting with \\ or // that could access network resources
-    // This may catch some UNC patterns not detected by containsVulnerableUncPath
-    for (const pathToCheck of pathsToCheck) {
-        if (pathToCheck.startsWith('\\\\') || pathToCheck.startsWith('//')) {
-            return {
-                behavior: 'ask',
-                message: `Claude requested permissions to read from ${path}, which appears to be a UNC path that could access network resources.`,
-                decisionReason: {
-                    type: 'other',
-                    reason: 'UNC path detected (defense-in-depth check)',
-                },
-            };
-        }
-    }
-    // 2. Check for suspicious Windows path patterns (defense in depth)
-    for (const pathToCheck of pathsToCheck) {
-        if (hasSuspiciousWindowsPathPattern(pathToCheck)) {
-            return {
-                behavior: 'ask',
-                message: `Claude requested permissions to read from ${path}, which contains a suspicious Windows path pattern that requires manual approval.`,
-                decisionReason: {
-                    type: 'other',
-                    reason: 'Path contains suspicious Windows-specific patterns (alternate data streams, short names, long path prefixes, or three or more consecutive dots) that require manual verification',
-                },
-            };
-        }
-    }
-    // 3. Check for READ-SPECIFIC deny rules first - check both the original path and resolved symlink path
-    // SECURITY: This must come before any allow checks (including "edit access implies read access")
-    // to prevent bypassing explicit read deny rules
-    for (const pathToCheck of pathsToCheck) {
-        const denyRule = matchingRuleForInput(pathToCheck, toolPermissionContext, 'read', 'deny');
-        if (denyRule) {
-            return {
-                behavior: 'deny',
-                message: `Permission to read ${path} has been denied.`,
-                decisionReason: {
-                    type: 'rule',
-                    rule: denyRule,
-                },
-            };
-        }
-    }
-    // 4. Check for READ-SPECIFIC ask rules - check both the original path and resolved symlink path
-    // SECURITY: This must come before implicit allow checks to ensure explicit ask rules are honored
-    for (const pathToCheck of pathsToCheck) {
-        const askRule = matchingRuleForInput(pathToCheck, toolPermissionContext, 'read', 'ask');
-        if (askRule) {
-            return {
-                behavior: 'ask',
-                message: `Claude requested permissions to read from ${path}, but you haven't granted it yet.`,
-                decisionReason: {
-                    type: 'rule',
-                    rule: askRule,
-                },
-            };
-        }
-    }
-    // 5. Edit access implies read access (but only if no read-specific deny/ask rules exist)
-    // We check this after read-specific rules so that explicit read restrictions take precedence
-    const editResult = checkWritePermissionForTool(tool, input, toolPermissionContext, pathsToCheck);
-    if (editResult.behavior === 'allow') {
-        return editResult;
-    }
-    // 6. Allow reads in working directories
-    const isInWorkingDir = pathInAllowedWorkingPath(path, toolPermissionContext, pathsToCheck);
-    if (isInWorkingDir) {
-        return {
-            behavior: 'allow',
-            updatedInput: input,
-            decisionReason: {
-                type: 'mode',
-                mode: 'default',
-            },
-        };
-    }
-    // 7. Allow reads from internal harness paths (session-memory, plans, tool-results)
-    const absolutePath = expandPath(path);
-    const internalReadResult = checkReadableInternalPath(absolutePath, input);
-    if (internalReadResult.behavior !== 'passthrough') {
-        return internalReadResult;
-    }
-    // 8. Check for allow rules
-    const allowRule = matchingRuleForInput(path, toolPermissionContext, 'read', 'allow');
-    if (allowRule) {
-        return {
-            behavior: 'allow',
-            updatedInput: input,
-            decisionReason: {
-                type: 'rule',
-                rule: allowRule,
-            },
-        };
-    }
-    // 12. Default to asking for permission
-    // At this point, isInWorkingDir is false (from step #6), so path is outside working directories
-    return {
-        behavior: 'ask',
-        message: `Claude requested permissions to read from ${path}, but you haven't granted it yet.`,
-        suggestions: generateSuggestions(path, 'read', toolPermissionContext, pathsToCheck),
-        decisionReason: {
-            type: 'workingDir',
-            reason: 'Path is outside allowed working directories',
-        },
-    };
-}
-/**
- * Permission result for write permission for the specified tool & tool input.
- *
- * @param precomputedPathsToCheck - Optional cached result of
- *   `getPathsForPermissionCheck(tool.getPath(input))`. Callers MUST derive this
- *   from the same `tool` and `input` in the same synchronous frame — `path` is
- *   re-derived internally for error messages and internal-path checks, so a
- *   stale value would silently check deny rules for the wrong path.
- */
-export function checkWritePermissionForTool(tool, input, toolPermissionContext, precomputedPathsToCheck) {
-    if (typeof tool.getPath !== 'function') {
-        return {
-            behavior: 'ask',
-            message: `Claude requested permissions to use ${tool.name}, but you haven't granted it yet.`,
-        };
-    }
-    const path = tool.getPath(input);
-    // 1. Check for deny rules - check both the original path and resolved symlink path
-    const pathsToCheck = precomputedPathsToCheck ?? getPathsForPermissionCheck(path);
-    for (const pathToCheck of pathsToCheck) {
-        const denyRule = matchingRuleForInput(pathToCheck, toolPermissionContext, 'edit', 'deny');
-        if (denyRule) {
-            return {
-                behavior: 'deny',
-                message: `Permission to edit ${path} has been denied.`,
-                decisionReason: {
-                    type: 'rule',
-                    rule: denyRule,
-                },
-            };
-        }
-    }
-    // 1.5. Allow writes to internal editable paths (plan files, scratchpad)
-    // This MUST come before isDangerousFilePathToAutoEdit check since .claude is a dangerous directory
-    const absolutePathForEdit = expandPath(path);
-    const internalEditResult = checkEditableInternalPath(absolutePathForEdit, input);
-    if (internalEditResult.behavior !== 'passthrough') {
-        return internalEditResult;
-    }
-    // 1.6. Check for .claude/** allow rules BEFORE safety checks
-    // This allows session-level permissions to bypass the safety blocks for .claude/
-    // We only allow this for session-level rules to prevent users from accidentally
-    // permanently granting broad access to their .claude/ folder.
-    //
-    // matchingRuleForInput returns the first match across all sources. If the user
-    // also has a broader Edit(.claude) rule in userSettings (e.g. from sandbox
-    // write-allow conversion), that rule would be found first and its source check
-    // below would fail. Scope the search to session-only rules so the dialog's
-    // "allow Claude to edit its own settings for this session" option actually works.
-    const claudeFolderAllowRule = matchingRuleForInput(path, {
-        ...toolPermissionContext,
-        alwaysAllowRules: {
-            session: toolPermissionContext.alwaysAllowRules.session ?? [],
-        },
-    }, 'edit', 'allow');
-    if (claudeFolderAllowRule) {
-        // Check if this rule is scoped under .claude/ (project or global).
-        // Accepts both the broad patterns ('/.claude/**', '~/.claude/**') and
-        // narrowed ones like '/.claude/skills/my-skill/**' so users can grant
-        // session access to a single skill without also exposing settings.json
-        // or hooks/. The rule already matched the path via matchingRuleForInput;
-        // this is an additional scope check. Reject '..' to prevent a rule like
-        // '/.claude/../**' from leaking this bypass outside .claude/.
-        const ruleContent = claudeFolderAllowRule.ruleValue.ruleContent;
-        if (ruleContent &&
-            (ruleContent.startsWith(CLAUDE_FOLDER_PERMISSION_PATTERN.slice(0, -2)) ||
-                ruleContent.startsWith(GLOBAL_CLAUDE_FOLDER_PERMISSION_PATTERN.slice(0, -2))) &&
-            !ruleContent.includes('..') &&
-            ruleContent.endsWith('/**')) {
-            return {
-                behavior: 'allow',
-                updatedInput: input,
-                decisionReason: {
-                    type: 'rule',
-                    rule: claudeFolderAllowRule,
-                },
-            };
-        }
-    }
-    // 1.7. Check comprehensive safety validations (Windows patterns, Claude config, dangerous files)
-    // This MUST come before checking allow rules to prevent users from accidentally granting
-    // permission to edit protected files
-    const safetyCheck = checkPathSafetyForAutoEdit(path, pathsToCheck);
-    if (!safetyCheck.safe) {
-        // SDK suggestion: if under .claude/skills/{name}/, emit the narrowed
-        // session-scoped addRules that step 1.6 will honor on the next call.
-        // Everything else (.claude/settings.json, .git/, .vscode/, .idea/) falls
-        // back to generateSuggestions — its setMode suggestion doesn't bypass
-        // this check, but preserving it avoids a surprising empty array.
-        const skillScope = getClaudeSkillScope(path);
-        const safetySuggestions = skillScope
-            ? [
-                {
-                    type: 'addRules',
-                    rules: [
-                        {
-                            toolName: FILE_EDIT_TOOL_NAME,
-                            ruleContent: skillScope.pattern,
-                        },
-                    ],
-                    behavior: 'allow',
-                    destination: 'session',
-                },
-            ]
-            : generateSuggestions(path, 'write', toolPermissionContext, pathsToCheck);
-        return {
-            behavior: 'ask',
-            message: safetyCheck.message,
-            suggestions: safetySuggestions,
-            decisionReason: {
-                type: 'safetyCheck',
-                reason: safetyCheck.message,
-                classifierApprovable: safetyCheck.classifierApprovable,
-            },
-        };
-    }
-    // 2. Check for ask rules - check both the original path and resolved symlink path
-    for (const pathToCheck of pathsToCheck) {
-        const askRule = matchingRuleForInput(pathToCheck, toolPermissionContext, 'edit', 'ask');
-        if (askRule) {
-            return {
-                behavior: 'ask',
-                message: `Claude requested permissions to write to ${path}, but you haven't granted it yet.`,
-                decisionReason: {
-                    type: 'rule',
-                    rule: askRule,
-                },
-            };
-        }
-    }
-    // 3. If in acceptEdits or sandboxBashMode mode, allow all writes in original cwd
-    const isInWorkingDir = pathInAllowedWorkingPath(path, toolPermissionContext, pathsToCheck);
-    if (toolPermissionContext.mode === 'acceptEdits' && isInWorkingDir) {
-        return {
-            behavior: 'allow',
-            updatedInput: input,
-            decisionReason: {
-                type: 'mode',
-                mode: toolPermissionContext.mode,
-            },
-        };
-    }
-    // 4. Check for allow rules
-    const allowRule = matchingRuleForInput(path, toolPermissionContext, 'edit', 'allow');
-    if (allowRule) {
-        return {
-            behavior: 'allow',
-            updatedInput: input,
-            decisionReason: {
-                type: 'rule',
-                rule: allowRule,
-            },
-        };
-    }
-    // 5. Default to asking for permission
-    return {
-        behavior: 'ask',
-        message: `Claude requested permissions to write to ${path}, but you haven't granted it yet.`,
-        suggestions: generateSuggestions(path, 'write', toolPermissionContext, pathsToCheck),
-        decisionReason: !isInWorkingDir
-            ? {
-                type: 'workingDir',
-                reason: 'Path is outside allowed working directories',
-            }
-            : undefined,
-    };
-}
-export function generateSuggestions(filePath, operationType, toolPermissionContext, precomputedPathsToCheck) {
-    const isOutsideWorkingDir = !pathInAllowedWorkingPath(filePath, toolPermissionContext, precomputedPathsToCheck);
-    if (operationType === 'read' && isOutsideWorkingDir) {
-        // For read operations outside working directories, add Read rules
-        // IMPORTANT: Include both the symlink path and resolved path so subsequent checks pass
-        const dirPath = getDirectoryForPath(filePath);
-        const dirsToAdd = getPathsForPermissionCheck(dirPath);
-        const suggestions = dirsToAdd
-            .map(dir => createReadRuleSuggestion(dir, 'session'))
-            .filter((s) => s !== undefined);
-        return suggestions;
-    }
-    // Only suggest setMode:acceptEdits when it would be an upgrade. In auto
-    // mode the classifier already auto-approves edits; in bypassPermissions
-    // everything is allowed; in acceptEdits it's a no-op. Suggesting it
-    // anyway and having the SDK host apply it on "Always allow" silently
-    // downgrades auto → acceptEdits, which then prompts for MCP/Bash.
-    const shouldSuggestAcceptEdits = toolPermissionContext.mode === 'default' ||
-        toolPermissionContext.mode === 'plan';
-    if (operationType === 'write' || operationType === 'create') {
-        const updates = shouldSuggestAcceptEdits
-            ? [{ type: 'setMode', mode: 'acceptEdits', destination: 'session' }]
-            : [];
-        if (isOutsideWorkingDir) {
-            // For write operations outside working directories, also add the directory
-            // IMPORTANT: Include both the symlink path and resolved path so subsequent checks pass
-            const dirPath = getDirectoryForPath(filePath);
-            const dirsToAdd = getPathsForPermissionCheck(dirPath);
-            updates.push({
-                type: 'addDirectories',
-                directories: dirsToAdd,
-                destination: 'session',
-            });
-        }
-        return updates;
-    }
-    // For read operations inside working directories, just change mode
-    return shouldSuggestAcceptEdits
-        ? [{ type: 'setMode', mode: 'acceptEdits', destination: 'session' }]
-        : [];
-}
-/**
- * Check if a path is an internal path that can be edited without permission.
- * Returns a PermissionResult - either 'allow' if matched, or 'passthrough' to continue checking.
- */
-export function checkEditableInternalPath(absolutePath, input) {
-    // SECURITY: Normalize path to prevent traversal bypasses via .. segments
-    // This is defense-in-depth; individual helper functions also normalize
-    const normalizedPath = normalize(absolutePath);
-    // Plan files for current session
-    if (isSessionPlanFile(normalizedPath)) {
-        return {
-            behavior: 'allow',
-            updatedInput: input,
-            decisionReason: {
-                type: 'other',
-                reason: 'Plan files for current session are allowed for writing',
-            },
-        };
-    }
-    // Scratchpad directory for current session
-    if (isScratchpadPath(normalizedPath)) {
-        return {
-            behavior: 'allow',
-            updatedInput: input,
-            decisionReason: {
-                type: 'other',
-                reason: 'Scratchpad files for current session are allowed for writing',
-            },
-        };
-    }
-    // Template job's own directory. Env key hardcoded (vs importing JOB_ENV_KEY
-    // from jobs/state) so tree-shaking eliminates the string from external
-    // builds — spawn.test.ts asserts the string matches. Hijack guard: the env
-    // var value must itself resolve under ~/.claude/jobs/. Symlink guard: every
-    // resolved form of the target (lexical + symlink chain) must fall under some
-    // resolved form of the job dir, so a symlink inside the job dir pointing at
-    // e.g. ~/.ssh/authorized_keys does not get a free write. Resolving both
-    // sides handles the macOS /tmp → /private/tmp case where the config dir
-    // lives under a symlinked root.
-    if (feature('TEMPLATES')) {
-        const jobDir = process.env.CLAUDE_JOB_DIR;
-        if (jobDir) {
-            const jobsRoot = join(getClaudeConfigHomeDir(), 'jobs');
-            const jobDirForms = getPathsForPermissionCheck(jobDir).map(normalize);
-            const jobsRootForms = getPathsForPermissionCheck(jobsRoot).map(normalize);
-            // Hijack guard: every resolved form of the job dir must sit under
-            // some resolved form of the jobs root. Resolving both sides handles
-            // the case where ~/.claude is a symlink (e.g. to /data/claude-config).
-            const isUnderJobsRoot = jobDirForms.every(jd => jobsRootForms.some(jr => jd.startsWith(jr + sep)));
-            if (isUnderJobsRoot) {
-                const targetForms = getPathsForPermissionCheck(absolutePath);
-                const allInsideJobDir = targetForms.every(p => {
-                    const np = normalize(p);
-                    return jobDirForms.some(jd => np === jd || np.startsWith(jd + sep));
-                });
-                if (allInsideJobDir) {
-                    return {
-                        behavior: 'allow',
-                        updatedInput: input,
-                        decisionReason: {
-                            type: 'other',
-                            reason: 'Job directory files for current job are allowed for writing',
-                        },
-                    };
-                }
-            }
-        }
-    }
-    // Agent memory directory (for self-improving agents)
-    if (isAgentMemoryPath(normalizedPath)) {
-        return {
-            behavior: 'allow',
-            updatedInput: input,
-            decisionReason: {
-                type: 'other',
-                reason: 'Agent memory files are allowed for writing',
-            },
-        };
-    }
-    // Memdir directory (persistent memory for cross-session learning)
-    // This pre-safety-check carve-out exists because the default path is under
-    // ~/.claude/, which is in DANGEROUS_DIRECTORIES. The CLAUDE_COWORK_MEMORY_PATH_OVERRIDE
-    // override is an arbitrary caller-designated directory with no such conflict,
-    // so it gets NO special permission treatment here — writes go through normal
-    // permission flow (step 5 → ask). SDK callers who want silent memory should
-    // pass an allow rule for the override path.
-    if (!hasAutoMemPathOverride() && isAutoMemPath(normalizedPath)) {
-        return {
-            behavior: 'allow',
-            updatedInput: input,
-            decisionReason: {
-                type: 'other',
-                reason: 'auto memory files are allowed for writing',
-            },
-        };
-    }
-    // .claude/launch.json — desktop preview config (dev server command + port).
-    // The desktop's preview_start MCP tool instructs Claude to create/update
-    // this file as part of the preview workflow. Without this carve-out the
-    // .claude/ DANGEROUS_DIRECTORIES check prompts for it, which in SDK mode
-    // cascades: user clicks "Always allow" → setMode:acceptEdits suggestion
-    // applied → silent downgrade from auto mode. Matches the project-level
-    // .claude/ only (not ~/.claude/) since launch.json is per-project.
-    if (normalizeCaseForComparison(normalizedPath) ===
-        normalizeCaseForComparison(join(getOriginalCwd(), '.claude', 'launch.json'))) {
-        return {
-            behavior: 'allow',
-            updatedInput: input,
-            decisionReason: {
-                type: 'other',
-                reason: 'Preview launch config is allowed for writing',
-            },
-        };
-    }
-    return { behavior: 'passthrough', message: '' };
-}
-/**
- * Check if a path is an internal path that can be read without permission.
- * Returns a PermissionResult - either 'allow' if matched, or 'passthrough' to continue checking.
- */
-export function checkReadableInternalPath(absolutePath, input) {
-    // SECURITY: Normalize path to prevent traversal bypasses via .. segments
-    // This is defense-in-depth; individual helper functions also normalize
-    const normalizedPath = normalize(absolutePath);
-    // Session memory directory
-    if (isSessionMemoryPath(normalizedPath)) {
-        return {
-            behavior: 'allow',
-            updatedInput: input,
-            decisionReason: {
-                type: 'other',
-                reason: 'Session memory files are allowed for reading',
-            },
-        };
-    }
-    // Project directory (for reading past session memories)
-    // Path format: ~/.claude/projects/{sanitized-cwd}/...
-    if (isProjectDirPath(normalizedPath)) {
-        return {
-            behavior: 'allow',
-            updatedInput: input,
-            decisionReason: {
-                type: 'other',
-                reason: 'Project directory files are allowed for reading',
-            },
-        };
-    }
-    // Plan files for current session
-    if (isSessionPlanFile(normalizedPath)) {
-        return {
-            behavior: 'allow',
-            updatedInput: input,
-            decisionReason: {
-                type: 'other',
-                reason: 'Plan files for current session are allowed for reading',
-            },
-        };
-    }
-    // Tool results directory (persisted large outputs)
-    // Use path separator suffix to prevent path traversal (e.g., tool-results-evil/)
-    const toolResultsDir = getToolResultsDir();
-    const toolResultsDirWithSep = toolResultsDir.endsWith(sep)
-        ? toolResultsDir
-        : toolResultsDir + sep;
-    if (normalizedPath === toolResultsDir ||
-        normalizedPath.startsWith(toolResultsDirWithSep)) {
-        return {
-            behavior: 'allow',
-            updatedInput: input,
-            decisionReason: {
-                type: 'other',
-                reason: 'Tool result files are allowed for reading',
-            },
-        };
-    }
-    // Scratchpad directory for current session
-    if (isScratchpadPath(normalizedPath)) {
-        return {
-            behavior: 'allow',
-            updatedInput: input,
-            decisionReason: {
-                type: 'other',
-                reason: 'Scratchpad files for current session are allowed for reading',
-            },
-        };
-    }
-    // Project temp directory (/tmp/claude/{sanitized-cwd}/)
-    // Intentionally allows reading files from all sessions in this project, not just the current session.
-    // This enables cross-session file access within the same project's temp space.
-    const projectTempDir = getProjectTempDir();
-    if (normalizedPath.startsWith(projectTempDir)) {
-        return {
-            behavior: 'allow',
-            updatedInput: input,
-            decisionReason: {
-                type: 'other',
-                reason: 'Project temp directory files are allowed for reading',
-            },
-        };
-    }
-    // Agent memory directory (for self-improving agents)
-    if (isAgentMemoryPath(normalizedPath)) {
-        return {
-            behavior: 'allow',
-            updatedInput: input,
-            decisionReason: {
-                type: 'other',
-                reason: 'Agent memory files are allowed for reading',
-            },
-        };
-    }
-    // Memdir directory (persistent memory for cross-session learning)
-    if (isAutoMemPath(normalizedPath)) {
-        return {
-            behavior: 'allow',
-            updatedInput: input,
-            decisionReason: {
-                type: 'other',
-                reason: 'auto memory files are allowed for reading',
-            },
-        };
-    }
-    // Tasks directory (~/.claude/tasks/) for swarm task coordination
-    const tasksDir = join(getClaudeConfigHomeDir(), 'tasks') + sep;
-    if (normalizedPath === tasksDir.slice(0, -1) ||
-        normalizedPath.startsWith(tasksDir)) {
-        return {
-            behavior: 'allow',
-            updatedInput: input,
-            decisionReason: {
-                type: 'other',
-                reason: 'Task files are allowed for reading',
-            },
-        };
-    }
-    // Teams directory (~/.claude/teams/) for swarm coordination
-    const teamsReadDir = join(getClaudeConfigHomeDir(), 'teams') + sep;
-    if (normalizedPath === teamsReadDir.slice(0, -1) ||
-        normalizedPath.startsWith(teamsReadDir)) {
-        return {
-            behavior: 'allow',
-            updatedInput: input,
-            decisionReason: {
-                type: 'other',
-                reason: 'Team files are allowed for reading',
-            },
-        };
-    }
-    // Bundled skill reference files extracted on first invocation.
-    // SECURITY: See getBundledSkillsRoot() — the per-process nonce in the path
-    // is the load-bearing defense; uid/VERSION alone are public knowledge and
-    // squattable. We always write-before-read on invocation, so content under
-    // this subtree is harness-controlled.
-    const bundledSkillsRoot = getBundledSkillsRoot() + sep;
-    if (normalizedPath.startsWith(bundledSkillsRoot)) {
-        return {
-            behavior: 'allow',
-            updatedInput: input,
-            decisionReason: {
-                type: 'other',
-                reason: 'Bundled skill reference files are allowed for reading',
-            },
-        };
-    }
-    return { behavior: 'passthrough', message: '' };
-}