@machina.ai/cell-cli 1.6.1-rc2 → 1.8.2-rc1

package/dist/src/config/policy.js

@@ -0,0 +1,150 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { PolicyDecision, ApprovalMode, 
+// Read-only tools
+GlobTool, GrepTool, LSTool, ReadFileTool, ReadManyFilesTool, RipGrepTool, 
+// Write tools
+EditTool, MemoryTool, ShellTool, WriteFileTool, WebFetchTool, WebSearchTool, } from '@google/gemini-cli-core';
+// READ_ONLY_TOOLS is a list of built-in tools that do not modify the user's
+// files or system state.
+const READ_ONLY_TOOLS = new Set([
+    GlobTool.Name,
+    GrepTool.Name,
+    RipGrepTool.Name,
+    LSTool.Name,
+    ReadFileTool.Name,
+    ReadManyFilesTool.Name,
+    WebSearchTool.Name,
+]);
+// WRITE_TOOLS is a list of built-in tools that can modify the user's files or
+// system state. These tools have a shouldConfirmExecute method.
+// We are keeping this here for visibility and to maintain backwards compatibility
+// with the existing tool permissions system. Eventually we'll remove this and
+// any tool that isn't read only will require a confirmation unless altered by
+// config and policy.
+const WRITE_TOOLS = new Set([
+    EditTool.Name,
+    MemoryTool.Name,
+    ShellTool.Name,
+    WriteFileTool.Name,
+    WebFetchTool.Name,
+]);
+export function createPolicyEngineConfig(settings, approvalMode) {
+    const rules = [];
+    // Priority system for policy rules:
+    // - Higher priority numbers win over lower priority numbers
+    // - When multiple rules match, the highest priority rule is applied
+    // - Rules are evaluated in order of priority (highest first)
+    //
+    // Priority levels used in this configuration:
+    //   0: Default allow-all (YOLO mode only)
+    //   10: Write tools default to ASK_USER
+    //   50: Auto-accept read-only tools
+    //   85: MCP servers allowed list
+    //   90: MCP servers with trust=true
+    //   100: Explicitly allowed individual tools
+    //   195: Explicitly excluded MCP servers
+    //   200: Explicitly excluded individual tools (highest priority)
+    // MCP servers that are explicitly allowed in settings.mcp.allowed
+    // Priority: 85 (lower than trusted servers)
+    if (settings.mcp?.allowed) {
+        for (const serverName of settings.mcp.allowed) {
+            rules.push({
+                toolName: `${serverName}__*`,
+                decision: PolicyDecision.ALLOW,
+                priority: 85,
+            });
+        }
+    }
+    // MCP servers that are trusted in the settings.
+    // Priority: 90 (higher than general allowed servers but lower than explicit tool allows)
+    if (settings.mcpServers) {
+        for (const [serverName, serverConfig] of Object.entries(settings.mcpServers)) {
+            if (serverConfig.trust) {
+                // Trust all tools from this MCP server
+                // Using pattern matching for MCP tool names which are formatted as "serverName__toolName"
+                rules.push({
+                    toolName: `${serverName}__*`,
+                    decision: PolicyDecision.ALLOW,
+                    priority: 90,
+                });
+            }
+        }
+    }
+    // Tools that are explicitly allowed in the settings.
+    // Priority: 100
+    if (settings.tools?.allowed) {
+        for (const tool of settings.tools.allowed) {
+            rules.push({
+                toolName: tool,
+                decision: PolicyDecision.ALLOW,
+                priority: 100,
+            });
+        }
+    }
+    // Tools that are explicitly excluded in the settings.
+    // Priority: 200
+    if (settings.tools?.exclude) {
+        for (const tool of settings.tools.exclude) {
+            rules.push({
+                toolName: tool,
+                decision: PolicyDecision.DENY,
+                priority: 200,
+            });
+        }
+    }
+    // MCP servers that are explicitly excluded in settings.mcp.excluded
+    // Priority: 195 (high priority to block servers)
+    if (settings.mcp?.excluded) {
+        for (const serverName of settings.mcp.excluded) {
+            rules.push({
+                toolName: `${serverName}__*`,
+                decision: PolicyDecision.DENY,
+                priority: 195,
+            });
+        }
+    }
+    // If auto-accept is enabled, allow all read-only tools.
+    // Priority: 50
+    if (settings.tools?.autoAccept) {
+        for (const tool of READ_ONLY_TOOLS) {
+            rules.push({
+                toolName: tool,
+                decision: PolicyDecision.ALLOW,
+                priority: 50,
+            });
+        }
+    }
+    // Only add write tool rules if not in YOLO mode
+    // In YOLO mode, the wildcard ALLOW rule handles everything
+    if (approvalMode !== ApprovalMode.YOLO) {
+        for (const tool of WRITE_TOOLS) {
+            rules.push({
+                toolName: tool,
+                decision: PolicyDecision.ASK_USER,
+                priority: 10,
+            });
+        }
+    }
+    if (approvalMode === ApprovalMode.YOLO) {
+        rules.push({
+            decision: PolicyDecision.ALLOW,
+            priority: 0, // Lowest priority - catches everything not explicitly configured
+        });
+    }
+    else if (approvalMode === ApprovalMode.AUTO_EDIT) {
+        rules.push({
+            toolName: EditTool.Name,
+            decision: PolicyDecision.ALLOW,
+            priority: 15, // Higher than write tools (10) to override ASK_USER
+        });
+    }
+    return {
+        rules,
+        defaultDecision: PolicyDecision.ASK_USER,
+    };
+}
+//# sourceMappingURL=policy.js.map

package/dist/src/config/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/config/policy.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAEL,cAAc,EAEd,YAAY;AACZ,kBAAkB;AAClB,QAAQ,EACR,QAAQ,EACR,MAAM,EACN,YAAY,EACZ,iBAAiB,EACjB,WAAW;AACX,cAAc;AACd,QAAQ,EACR,UAAU,EACV,SAAS,EACT,aAAa,EACb,YAAY,EACZ,aAAa,GACd,MAAM,yBAAyB,CAAC;AAGjC,4EAA4E;AAC5E,yBAAyB;AACzB,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,QAAQ,CAAC,IAAI;IACb,QAAQ,CAAC,IAAI;IACb,WAAW,CAAC,IAAI;IAChB,MAAM,CAAC,IAAI;IACX,YAAY,CAAC,IAAI;IACjB,iBAAiB,CAAC,IAAI;IACtB,aAAa,CAAC,IAAI;CACnB,CAAC,CAAC;AAEH,8EAA8E;AAC9E,gEAAgE;AAChE,kFAAkF;AAClF,8EAA8E;AAC9E,8EAA8E;AAC9E,qBAAqB;AACrB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,QAAQ,CAAC,IAAI;IACb,UAAU,CAAC,IAAI;IACf,SAAS,CAAC,IAAI;IACd,aAAa,CAAC,IAAI;IAClB,YAAY,CAAC,IAAI;CAClB,CAAC,CAAC;AAEH,MAAM,UAAU,wBAAwB,CACtC,QAAkB,EAClB,YAA0B;IAE1B,MAAM,KAAK,GAAiB,EAAE,CAAC;IAE/B,oCAAoC;IACpC,4DAA4D;IAC5D,oEAAoE;IACpE,6DAA6D;IAC7D,EAAE;IACF,8CAA8C;IAC9C,0CAA0C;IAC1C,wCAAwC;IACxC,oCAAoC;IACpC,iCAAiC;IACjC,oCAAoC;IACpC,6CAA6C;IAC7C,yCAAyC;IACzC,iEAAiE;IAEjE,kEAAkE;IAClE,4CAA4C;IAC5C,IAAI,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;QAC1B,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,GAAG,UAAU,KAAK;gBAC5B,QAAQ,EAAE,cAAc,CAAC,KAAK;gBAC9B,QAAQ,EAAE,EAAE;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,yFAAyF;IACzF,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CACrD,QAAQ,CAAC,UAAU,CACpB,EAAE,CAAC;YACF,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;gBACvB,uCAAuC;gBACvC,0FAA0F;gBAC1F,KAAK,CAAC,IAAI,CAAC;oBACT,QAAQ,EAAE,GAAG,UAAU,KAAK;oBAC5B,QAAQ,EAAE,cAAc,CAAC,KAAK;oBAC9B,QAAQ,EAAE,EAAE;iBACb,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,gBAAgB;IAChB,IAAI,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;QAC5B,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,cAAc,CAAC,KAAK;gBAC9B,QAAQ,EAAE,GAAG;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,gBAAgB;IAChB,IAAI,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;QAC5B,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,cAAc,CAAC,IAAI;gBAC7B,QAAQ,EAAE,GAAG;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,iDAAiD;IACjD,IAAI,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;QAC3B,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC/C,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,GAAG,UAAU,KAAK;gBAC5B,QAAQ,EAAE,cAAc,CAAC,IAAI;gBAC7B,QAAQ,EAAE,GAAG;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,eAAe;IACf,IAAI,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,cAAc,CAAC,KAAK;gBAC9B,QAAQ,EAAE,EAAE;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,2DAA2D;IAC3D,IAAI,YAAY,KAAK,YAAY,CAAC,IAAI,EAAE,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,cAAc,CAAC,QAAQ;gBACjC,QAAQ,EAAE,EAAE;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,YAAY,KAAK,YAAY,CAAC,IAAI,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,cAAc,CAAC,KAAK;YAC9B,QAAQ,EAAE,CAAC,EAAE,iEAAiE;SAC/E,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,YAAY,KAAK,YAAY,CAAC,SAAS,EAAE,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,QAAQ,EAAE,cAAc,CAAC,KAAK;YAC9B,QAAQ,EAAE,EAAE,EAAE,oDAAoD;SACnE,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,KAAK;QACL,eAAe,EAAE,cAAc,CAAC,QAAQ;KACzC,CAAC;AACJ,CAAC"}

package/dist/src/config/policy.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export {};

package/dist/src/config/policy.test.js

@@ -0,0 +1,336 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect } from 'vitest';
+import { createPolicyEngineConfig } from './policy.js';
+import { ApprovalMode, PolicyDecision } from '@google/gemini-cli-core';
+describe('createPolicyEngineConfig', () => {
+    it('should return ASK_USER for all tools by default', () => {
+        const settings = {};
+        const config = createPolicyEngineConfig(settings, ApprovalMode.DEFAULT);
+        expect(config.defaultDecision).toBe(PolicyDecision.ASK_USER);
+        expect(config.rules).toEqual([
+            { toolName: 'replace', decision: 'ask_user', priority: 10 },
+            { toolName: 'save_memory', decision: 'ask_user', priority: 10 },
+            { toolName: 'run_shell_command', decision: 'ask_user', priority: 10 },
+            { toolName: 'write_file', decision: 'ask_user', priority: 10 },
+            { toolName: 'web_fetch', decision: 'ask_user', priority: 10 },
+        ]);
+    });
+    it('should allow tools in tools.allowed', () => {
+        const settings = {
+            tools: { allowed: ['run_shell_command'] },
+        };
+        const config = createPolicyEngineConfig(settings, ApprovalMode.DEFAULT);
+        const rule = config.rules?.find((r) => r.toolName === 'run_shell_command' &&
+            r.decision === PolicyDecision.ALLOW);
+        expect(rule).toBeDefined();
+        expect(rule?.priority).toBe(100);
+    });
+    it('should deny tools in tools.exclude', () => {
+        const settings = {
+            tools: { exclude: ['run_shell_command'] },
+        };
+        const config = createPolicyEngineConfig(settings, ApprovalMode.DEFAULT);
+        const rule = config.rules?.find((r) => r.toolName === 'run_shell_command' &&
+            r.decision === PolicyDecision.DENY);
+        expect(rule).toBeDefined();
+        expect(rule?.priority).toBe(200);
+    });
+    it('should allow tools from allowed MCP servers', () => {
+        const settings = {
+            mcp: { allowed: ['my-server'] },
+        };
+        const config = createPolicyEngineConfig(settings, ApprovalMode.DEFAULT);
+        const rule = config.rules?.find((r) => r.toolName === 'my-server__*' && r.decision === PolicyDecision.ALLOW);
+        expect(rule).toBeDefined();
+        expect(rule?.priority).toBe(85);
+    });
+    it('should deny tools from excluded MCP servers', () => {
+        const settings = {
+            mcp: { excluded: ['my-server'] },
+        };
+        const config = createPolicyEngineConfig(settings, ApprovalMode.DEFAULT);
+        const rule = config.rules?.find((r) => r.toolName === 'my-server__*' && r.decision === PolicyDecision.DENY);
+        expect(rule).toBeDefined();
+        expect(rule?.priority).toBe(195);
+    });
+    it('should allow tools from trusted MCP servers', () => {
+        const settings = {
+            mcpServers: {
+                'trusted-server': {
+                    command: 'node',
+                    args: ['server.js'],
+                    trust: true,
+                },
+                'untrusted-server': {
+                    command: 'node',
+                    args: ['server.js'],
+                    trust: false,
+                },
+            },
+        };
+        const config = createPolicyEngineConfig(settings, ApprovalMode.DEFAULT);
+        const trustedRule = config.rules?.find((r) => r.toolName === 'trusted-server__*' &&
+            r.decision === PolicyDecision.ALLOW);
+        expect(trustedRule).toBeDefined();
+        expect(trustedRule?.priority).toBe(90);
+        // Untrusted server should not have an allow rule
+        const untrustedRule = config.rules?.find((r) => r.toolName === 'untrusted-server__*' &&
+            r.decision === PolicyDecision.ALLOW);
+        expect(untrustedRule).toBeUndefined();
+    });
+    it('should handle multiple MCP server configurations together', () => {
+        const settings = {
+            mcp: {
+                allowed: ['allowed-server'],
+                excluded: ['excluded-server'],
+            },
+            mcpServers: {
+                'trusted-server': {
+                    command: 'node',
+                    args: ['server.js'],
+                    trust: true,
+                },
+            },
+        };
+        const config = createPolicyEngineConfig(settings, ApprovalMode.DEFAULT);
+        // Check allowed server
+        const allowedRule = config.rules?.find((r) => r.toolName === 'allowed-server__*' &&
+            r.decision === PolicyDecision.ALLOW);
+        expect(allowedRule).toBeDefined();
+        expect(allowedRule?.priority).toBe(85);
+        // Check trusted server
+        const trustedRule = config.rules?.find((r) => r.toolName === 'trusted-server__*' &&
+            r.decision === PolicyDecision.ALLOW);
+        expect(trustedRule).toBeDefined();
+        expect(trustedRule?.priority).toBe(90);
+        // Check excluded server
+        const excludedRule = config.rules?.find((r) => r.toolName === 'excluded-server__*' &&
+            r.decision === PolicyDecision.DENY);
+        expect(excludedRule).toBeDefined();
+        expect(excludedRule?.priority).toBe(195);
+    });
+    it('should allow read-only tools if autoAccept is true', () => {
+        const settings = {
+            tools: { autoAccept: true },
+        };
+        const config = createPolicyEngineConfig(settings, ApprovalMode.DEFAULT);
+        const rule = config.rules?.find((r) => r.toolName === 'glob' && r.decision === PolicyDecision.ALLOW);
+        expect(rule).toBeDefined();
+        expect(rule?.priority).toBe(50);
+    });
+    it('should allow all tools in YOLO mode', () => {
+        const settings = {};
+        const config = createPolicyEngineConfig(settings, ApprovalMode.YOLO);
+        const rule = config.rules?.find((r) => r.decision === PolicyDecision.ALLOW && r.priority === 0);
+        expect(rule).toBeDefined();
+    });
+    it('should allow edit tool in AUTO_EDIT mode', () => {
+        const settings = {};
+        const config = createPolicyEngineConfig(settings, ApprovalMode.AUTO_EDIT);
+        const rule = config.rules?.find((r) => r.toolName === 'replace' && r.decision === PolicyDecision.ALLOW);
+        expect(rule).toBeDefined();
+        expect(rule?.priority).toBe(15);
+    });
+    it('should prioritize exclude over allow', () => {
+        const settings = {
+            tools: { allowed: ['run_shell_command'], exclude: ['run_shell_command'] },
+        };
+        const config = createPolicyEngineConfig(settings, ApprovalMode.DEFAULT);
+        const denyRule = config.rules?.find((r) => r.toolName === 'run_shell_command' &&
+            r.decision === PolicyDecision.DENY);
+        const allowRule = config.rules?.find((r) => r.toolName === 'run_shell_command' &&
+            r.decision === PolicyDecision.ALLOW);
+        expect(denyRule).toBeDefined();
+        expect(allowRule).toBeDefined();
+        expect(denyRule.priority).toBeGreaterThan(allowRule.priority);
+    });
+    it('should prioritize specific tool allows over MCP server excludes', () => {
+        const settings = {
+            mcp: { excluded: ['my-server'] },
+            tools: { allowed: ['my-server__specific-tool'] },
+        };
+        const config = createPolicyEngineConfig(settings, ApprovalMode.DEFAULT);
+        const serverDenyRule = config.rules?.find((r) => r.toolName === 'my-server__*' && r.decision === PolicyDecision.DENY);
+        const toolAllowRule = config.rules?.find((r) => r.toolName === 'my-server__specific-tool' &&
+            r.decision === PolicyDecision.ALLOW);
+        expect(serverDenyRule).toBeDefined();
+        expect(serverDenyRule?.priority).toBe(195);
+        expect(toolAllowRule).toBeDefined();
+        expect(toolAllowRule?.priority).toBe(100);
+        // Tool allow (100) has lower priority than server deny (195),
+        // so server deny wins - this might be counterintuitive
+    });
+    it('should prioritize specific tool excludes over MCP server allows', () => {
+        const settings = {
+            mcp: { allowed: ['my-server'] },
+            mcpServers: {
+                'my-server': {
+                    command: 'node',
+                    args: ['server.js'],
+                    trust: true,
+                },
+            },
+            tools: { exclude: ['my-server__dangerous-tool'] },
+        };
+        const config = createPolicyEngineConfig(settings, ApprovalMode.DEFAULT);
+        const serverAllowRule = config.rules?.find((r) => r.toolName === 'my-server__*' && r.decision === PolicyDecision.ALLOW);
+        const toolDenyRule = config.rules?.find((r) => r.toolName === 'my-server__dangerous-tool' &&
+            r.decision === PolicyDecision.DENY);
+        expect(serverAllowRule).toBeDefined();
+        expect(toolDenyRule).toBeDefined();
+        expect(toolDenyRule.priority).toBeGreaterThan(serverAllowRule.priority);
+    });
+    it('should handle complex priority scenarios correctly', () => {
+        const settings = {
+            tools: {
+                autoAccept: true, // Priority 50 for read-only tools
+                allowed: ['my-server__tool1', 'other-tool'], // Priority 100
+                exclude: ['my-server__tool2', 'glob'], // Priority 200
+            },
+            mcp: {
+                allowed: ['allowed-server'], // Priority 85
+                excluded: ['excluded-server'], // Priority 195
+            },
+            mcpServers: {
+                'trusted-server': {
+                    command: 'node',
+                    args: ['server.js'],
+                    trust: true, // Priority 90
+                },
+            },
+        };
+        const config = createPolicyEngineConfig(settings, ApprovalMode.DEFAULT);
+        // Verify glob is denied even though autoAccept would allow it
+        const globDenyRule = config.rules?.find((r) => r.toolName === 'glob' && r.decision === PolicyDecision.DENY);
+        const globAllowRule = config.rules?.find((r) => r.toolName === 'glob' && r.decision === PolicyDecision.ALLOW);
+        expect(globDenyRule).toBeDefined();
+        expect(globAllowRule).toBeDefined();
+        expect(globDenyRule.priority).toBe(200);
+        expect(globAllowRule.priority).toBe(50);
+        // Verify all priority levels are correct
+        const priorities = config.rules
+            ?.map((r) => ({
+            tool: r.toolName,
+            decision: r.decision,
+            priority: r.priority,
+        }))
+            .sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
+        // Check that the highest priority items are the excludes
+        const highestPriorityExcludes = priorities?.filter((p) => p.priority === 200);
+        expect(highestPriorityExcludes?.every((p) => p.decision === PolicyDecision.DENY)).toBe(true);
+    });
+    it('should handle MCP servers with undefined trust property', () => {
+        const settings = {
+            mcpServers: {
+                'no-trust-property': {
+                    command: 'node',
+                    args: ['server.js'],
+                    // trust property is undefined/missing
+                },
+                'explicit-false': {
+                    command: 'node',
+                    args: ['server.js'],
+                    trust: false,
+                },
+            },
+        };
+        const config = createPolicyEngineConfig(settings, ApprovalMode.DEFAULT);
+        // Neither server should have an allow rule
+        const noTrustRule = config.rules?.find((r) => r.toolName === 'no-trust-property__*' &&
+            r.decision === PolicyDecision.ALLOW);
+        const explicitFalseRule = config.rules?.find((r) => r.toolName === 'explicit-false__*' &&
+            r.decision === PolicyDecision.ALLOW);
+        expect(noTrustRule).toBeUndefined();
+        expect(explicitFalseRule).toBeUndefined();
+    });
+    it('should not add write tool rules in YOLO mode', () => {
+        const settings = {
+            tools: { exclude: ['dangerous-tool'] },
+        };
+        const config = createPolicyEngineConfig(settings, ApprovalMode.YOLO);
+        // Should have the wildcard allow rule with priority 0
+        const wildcardRule = config.rules?.find((r) => !r.toolName && r.decision === PolicyDecision.ALLOW && r.priority === 0);
+        expect(wildcardRule).toBeDefined();
+        // Should NOT have any write tool rules (which would have priority 10)
+        const writeToolRules = config.rules?.filter((r) => [
+            'replace',
+            'save_memory',
+            'run_shell_command',
+            'write_file',
+            'web_fetch',
+        ].includes(r.toolName || '') && r.decision === PolicyDecision.ASK_USER);
+        expect(writeToolRules).toHaveLength(0);
+        // Should still have the exclude rule
+        const excludeRule = config.rules?.find((r) => r.toolName === 'dangerous-tool' && r.decision === PolicyDecision.DENY);
+        expect(excludeRule).toBeDefined();
+        expect(excludeRule?.priority).toBe(200);
+    });
+    it('should handle combination of trusted server and excluded server for same name', () => {
+        const settings = {
+            mcpServers: {
+                'conflicted-server': {
+                    command: 'node',
+                    args: ['server.js'],
+                    trust: true, // Priority 90
+                },
+            },
+            mcp: {
+                excluded: ['conflicted-server'], // Priority 195
+            },
+        };
+        const config = createPolicyEngineConfig(settings, ApprovalMode.DEFAULT);
+        // Both rules should exist
+        const trustRule = config.rules?.find((r) => r.toolName === 'conflicted-server__*' &&
+            r.decision === PolicyDecision.ALLOW);
+        const excludeRule = config.rules?.find((r) => r.toolName === 'conflicted-server__*' &&
+            r.decision === PolicyDecision.DENY);
+        expect(trustRule).toBeDefined();
+        expect(trustRule?.priority).toBe(90);
+        expect(excludeRule).toBeDefined();
+        expect(excludeRule?.priority).toBe(195);
+        // Exclude (195) should win over trust (90) when evaluated
+    });
+    it('should create all read-only tool rules when autoAccept is enabled', () => {
+        const settings = {
+            tools: { autoAccept: true },
+        };
+        const config = createPolicyEngineConfig(settings, ApprovalMode.DEFAULT);
+        // All read-only tools should have allow rules
+        const readOnlyTools = [
+            'glob',
+            'search_file_content',
+            'list_directory',
+            'read_file',
+            'read_many_files',
+        ];
+        for (const tool of readOnlyTools) {
+            const rule = config.rules?.find((r) => r.toolName === tool && r.decision === PolicyDecision.ALLOW);
+            expect(rule).toBeDefined();
+            expect(rule?.priority).toBe(50);
+        }
+    });
+    it('should handle all approval modes correctly', () => {
+        const settings = {};
+        // Test DEFAULT mode
+        const defaultConfig = createPolicyEngineConfig(settings, ApprovalMode.DEFAULT);
+        expect(defaultConfig.defaultDecision).toBe(PolicyDecision.ASK_USER);
+        expect(defaultConfig.rules?.find((r) => !r.toolName && r.decision === PolicyDecision.ALLOW)).toBeUndefined();
+        // Test YOLO mode
+        const yoloConfig = createPolicyEngineConfig(settings, ApprovalMode.YOLO);
+        expect(yoloConfig.defaultDecision).toBe(PolicyDecision.ASK_USER);
+        const yoloWildcard = yoloConfig.rules?.find((r) => !r.toolName && r.decision === PolicyDecision.ALLOW);
+        expect(yoloWildcard).toBeDefined();
+        expect(yoloWildcard?.priority).toBe(0);
+        // Test AUTO_EDIT mode
+        const autoEditConfig = createPolicyEngineConfig(settings, ApprovalMode.AUTO_EDIT);
+        expect(autoEditConfig.defaultDecision).toBe(PolicyDecision.ASK_USER);
+        const editRule = autoEditConfig.rules?.find((r) => r.toolName === 'replace' && r.decision === PolicyDecision.ALLOW);
+        expect(editRule).toBeDefined();
+        expect(editRule?.priority).toBe(15);
+    });
+});
+//# sourceMappingURL=policy.test.js.map

package/dist/src/config/policy.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.test.js","sourceRoot":"","sources":["../../../src/config/policy.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEvE,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QACxE,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;YAC3B,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC3D,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC/D,EAAE,QAAQ,EAAE,mBAAmB,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE;YACrE,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC9D,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE;SAC9D,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,QAAQ,GAAa;YACzB,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC,EAAE;SAC1C,CAAC;QACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QACxE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAC7B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,mBAAmB;YAClC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CACtC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,QAAQ,GAAa;YACzB,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC,EAAE;SAC1C,CAAC;QACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QACxE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAC7B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,mBAAmB;YAClC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,IAAI,CACrC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,QAAQ,GAAa;YACzB,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE;SAChC,CAAC;QACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QACxE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAC7B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,cAAc,IAAI,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CACvE,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,QAAQ,GAAa;YACzB,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE;SACjC,CAAC;QACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QACxE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAC7B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,cAAc,IAAI,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,IAAI,CACtE,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,QAAQ,GAAa;YACzB,UAAU,EAAE;gBACV,gBAAgB,EAAE;oBAChB,OAAO,EAAE,MAAM;oBACf,IAAI,EAAE,CAAC,WAAW,CAAC;oBACnB,KAAK,EAAE,IAAI;iBACZ;gBACD,kBAAkB,EAAE;oBAClB,OAAO,EAAE,MAAM;oBACf,IAAI,EAAE,CAAC,WAAW,CAAC;oBACnB,KAAK,EAAE,KAAK;iBACb;aACF;SACF,CAAC;QACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QAExE,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CACpC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,mBAAmB;YAClC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CACtC,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEvC,iDAAiD;QACjD,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,qBAAqB;YACpC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CACtC,CAAC;QACF,MAAM,CAAC,aAAa,CAAC,CAAC,aAAa,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,QAAQ,GAAa;YACzB,GAAG,EAAE;gBACH,OAAO,EAAE,CAAC,gBAAgB,CAAC;gBAC3B,QAAQ,EAAE,CAAC,iBAAiB,CAAC;aAC9B;YACD,UAAU,EAAE;gBACV,gBAAgB,EAAE;oBAChB,OAAO,EAAE,MAAM;oBACf,IAAI,EAAE,CAAC,WAAW,CAAC;oBACnB,KAAK,EAAE,IAAI;iBACZ;aACF;SACF,CAAC;QACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QAExE,uBAAuB;QACvB,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CACpC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,mBAAmB;YAClC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CACtC,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEvC,uBAAuB;QACvB,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CACpC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,mBAAmB;YAClC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CACtC,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEvC,wBAAwB;QACxB,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CACrC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,oBAAoB;YACnC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,IAAI,CACrC,CAAC;QACF,MAAM,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,QAAQ,GAAa;YACzB,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;SAC5B,CAAC;QACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QACxE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CACpE,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAC/D,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CACvE,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,QAAQ,GAAa;YACzB,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC,EAAE;SAC1E,CAAC;QACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CACjC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,mBAAmB;YAClC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,IAAI,CACrC,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAClC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,mBAAmB;YAClC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CACtC,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/B,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,CAAC,QAAS,CAAC,QAAQ,CAAC,CAAC,eAAe,CAAC,SAAU,CAAC,QAAS,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,QAAQ,GAAa;YACzB,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE;YAChC,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,0BAA0B,CAAC,EAAE;SACjD,CAAC;QACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QAExE,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CACvC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,cAAc,IAAI,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,IAAI,CACtE,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,0BAA0B;YACzC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CACtC,CAAC;QAEF,MAAM,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE1C,8DAA8D;QAC9D,uDAAuD;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,QAAQ,GAAa;YACzB,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE;YAC/B,UAAU,EAAE;gBACV,WAAW,EAAE;oBACX,OAAO,EAAE,MAAM;oBACf,IAAI,EAAE,CAAC,WAAW,CAAC;oBACnB,KAAK,EAAE,IAAI;iBACZ;aACF;YACD,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,2BAA2B,CAAC,EAAE;SAClD,CAAC;QACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QAExE,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CACxC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,cAAc,IAAI,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CACvE,CAAC;QACF,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CACrC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,2BAA2B;YAC1C,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,IAAI,CACrC,CAAC;QAEF,MAAM,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;QACtC,MAAM,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,CAAC,YAAa,CAAC,QAAQ,CAAC,CAAC,eAAe,CAAC,eAAgB,CAAC,QAAS,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,QAAQ,GAAa;YACzB,KAAK,EAAE;gBACL,UAAU,EAAE,IAAI,EAAE,kCAAkC;gBACpD,OAAO,EAAE,CAAC,kBAAkB,EAAE,YAAY,CAAC,EAAE,eAAe;gBAC5D,OAAO,EAAE,CAAC,kBAAkB,EAAE,MAAM,CAAC,EAAE,eAAe;aACvD;YACD,GAAG,EAAE;gBACH,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE,cAAc;gBAC3C,QAAQ,EAAE,CAAC,iBAAiB,CAAC,EAAE,eAAe;aAC/C;YACD,UAAU,EAAE;gBACV,gBAAgB,EAAE;oBAChB,OAAO,EAAE,MAAM;oBACf,IAAI,EAAE,CAAC,WAAW,CAAC;oBACnB,KAAK,EAAE,IAAI,EAAE,cAAc;iBAC5B;aACF;SACF,CAAC;QACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QAExE,8DAA8D;QAC9D,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,IAAI,CACnE,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CACpE,CAAC;QACF,MAAM,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,CAAC,YAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,CAAC,aAAc,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEzC,yCAAyC;QACzC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK;YAC7B,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACZ,IAAI,EAAE,CAAC,CAAC,QAAQ;YAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;SACrB,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;QAEzD,yDAAyD;QACzD,MAAM,uBAAuB,GAAG,UAAU,EAAE,MAAM,CAChD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,CAC1B,CAAC;QACF,MAAM,CACJ,uBAAuB,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,IAAI,CAAC,CAC1E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,QAAQ,GAAa;YACzB,UAAU,EAAE;gBACV,mBAAmB,EAAE;oBACnB,OAAO,EAAE,MAAM;oBACf,IAAI,EAAE,CAAC,WAAW,CAAC;oBACnB,sCAAsC;iBACvC;gBACD,gBAAgB,EAAE;oBAChB,OAAO,EAAE,MAAM;oBACf,IAAI,EAAE,CAAC,WAAW,CAAC;oBACnB,KAAK,EAAE,KAAK;iBACb;aACF;SACF,CAAC;QACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QAExE,2CAA2C;QAC3C,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CACpC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,sBAAsB;YACrC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CACtC,CAAC;QACF,MAAM,iBAAiB,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAC1C,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,mBAAmB;YAClC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CACtC,CAAC;QAEF,MAAM,CAAC,WAAW,CAAC,CAAC,aAAa,EAAE,CAAC;QACpC,MAAM,CAAC,iBAAiB,CAAC,CAAC,aAAa,EAAE,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,QAAQ,GAAa;YACzB,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE;SACvC,CAAC;QACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;QAErE,sDAAsD;QACtD,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CACrC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CACzE,CAAC;QACF,MAAM,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QAEnC,sEAAsE;QACtE,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,EAAE,MAAM,CACzC,CAAC,CAAC,EAAE,EAAE,CACJ;YACE,SAAS;YACT,aAAa;YACb,mBAAmB;YACnB,YAAY;YACZ,WAAW;SACZ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,QAAQ,CACzE,CAAC;QACF,MAAM,CAAC,cAAc,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAEvC,qCAAqC;QACrC,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CACpC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,gBAAgB,IAAI,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,IAAI,CACxE,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,MAAM,QAAQ,GAAa;YACzB,UAAU,EAAE;gBACV,mBAAmB,EAAE;oBACnB,OAAO,EAAE,MAAM;oBACf,IAAI,EAAE,CAAC,WAAW,CAAC;oBACnB,KAAK,EAAE,IAAI,EAAE,cAAc;iBAC5B;aACF;YACD,GAAG,EAAE;gBACH,QAAQ,EAAE,CAAC,mBAAmB,CAAC,EAAE,eAAe;aACjD;SACF,CAAC;QACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QAExE,0BAA0B;QAC1B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAClC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,sBAAsB;YACrC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CACtC,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CACpC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,KAAK,sBAAsB;YACrC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,IAAI,CACrC,CAAC;QAEF,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAExC,0DAA0D;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,QAAQ,GAAa;YACzB,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;SAC5B,CAAC;QACF,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QAExE,8CAA8C;QAC9C,MAAM,aAAa,GAAG;YACpB,MAAM;YACN,qBAAqB;YACrB,gBAAgB;YAChB,WAAW;YACX,iBAAiB;SAClB,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CAClE,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,oBAAoB;QACpB,MAAM,aAAa,GAAG,wBAAwB,CAC5C,QAAQ,EACR,YAAY,CAAC,OAAO,CACrB,CAAC;QACF,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACpE,MAAM,CACJ,aAAa,CAAC,KAAK,EAAE,IAAI,CACvB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CAC1D,CACF,CAAC,aAAa,EAAE,CAAC;QAElB,iBAAiB;QACjB,MAAM,UAAU,GAAG,wBAAwB,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;QACzE,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CAC1D,CAAC;QACF,MAAM,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEvC,sBAAsB;QACtB,MAAM,cAAc,GAAG,wBAAwB,CAC7C,QAAQ,EACR,YAAY,CAAC,SAAS,CACvB,CAAC;QACF,MAAM,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,KAAK,CACvE,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/B,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/config/settings.js

@@ -48,10 +48,12 @@ const MIGRATION_MAP = {
     coreTools: 'tools.core',
     contextFileName: 'context.fileName',
     customThemes: 'ui.customThemes',
+    customWittyPhrases: 'ui.customWittyPhrases',
     debugKeystrokeLogging: 'general.debugKeystrokeLogging',
     disableAutoUpdate: 'general.disableAutoUpdate',
     disableUpdateNag: 'general.disableUpdateNag',
     dnsResolutionOrder: 'advanced.dnsResolutionOrder',
+    enableMessageBusIntegration: 'tools.enableMessageBusIntegration',
     enablePromptCompletion: 'general.enablePromptCompletion',
     enforcedAuthType: 'security.auth.enforcedType',
     excludeTools: 'tools.exclude',
@@ -64,6 +66,7 @@ const MIGRATION_MAP = {
     folderTrust: 'security.folderTrust.enabled',
     hasSeenIdeIntegrationNudge: 'ide.hasSeenNudge',
     hideWindowTitle: 'ui.hideWindowTitle',
+    showStatusInTitle: 'ui.showStatusInTitle',
     hideTips: 'ui.hideTips',
     hideBanner: 'ui.hideBanner',
     hideFooter: 'ui.hideFooter',
@@ -186,7 +189,20 @@ function migrateSettingsToV2(flatSettings) {
     }
     // Carry over any unrecognized keys
     for (const remainingKey of flatKeys) {
-        v2Settings[remainingKey] = flatSettings[remainingKey];
+        const existingValue = v2Settings[remainingKey];
+        const newValue = flatSettings[remainingKey];
+        if (typeof existingValue === 'object' &&
+            existingValue !== null &&
+            !Array.isArray(existingValue) &&
+            typeof newValue === 'object' &&
+            newValue !== null &&
+            !Array.isArray(newValue)) {
+            const pathAwareGetStrategy = (path) => getMergeStrategyForPath([remainingKey, ...path]);
+            v2Settings[remainingKey] = customDeepMerge(pathAwareGetStrategy, {}, newValue, existingValue);
+        }
+        else {
+            v2Settings[remainingKey] = newValue;
+        }
     }
     return v2Settings;
 }
@@ -345,7 +361,7 @@ export function setUpCloudShellEnvironment(envFilePath) {
 }
 export function loadEnvironment(settings) {
     const envFilePath = findEnvFile(process.cwd());
-    if (!isWorkspaceTrusted(settings)) {
+    if (!isWorkspaceTrusted(settings).isTrusted) {
         return;
     }
     // Cloud Shell environment variable handling
@@ -538,7 +554,7 @@ export function loadSettings(workspaceDir = process.cwd()) {
     }
     // For the initial trust check, we can only use user and system settings.
     const initialTrustCheckSettings = customDeepMerge(getMergeStrategyForPath, {}, systemSettings, userSettings);
-    const isTrusted = isWorkspaceTrusted(initialTrustCheckSettings) ?? true;
+    const isTrusted = isWorkspaceTrusted(initialTrustCheckSettings).isTrusted ?? true;
     // Create a temporary merged settings object to pass to loadEnvironment.
     const tempMergedSettings = mergeSettings(systemSettings, systemDefaultSettings, userSettings, workspaceSettings, isTrusted);
     // loadEnviroment depends on settings so we have to create a temp version of