@merchantduo/code 0.2.0-beta.3 → 0.2.0-beta.4

package/README.md

@@ -10,13 +10,13 @@ MerchantDuo is a Pi coding agent for Magento 2.4 teams. It starts from the store
 - Provides guided local/Warden store provisioning.
 - Keeps remote writes and Magento operations behind explicit execution boundaries.
 
-At session start, MerchantDuo produces a Magento snapshot from the selected environment. Frontend and admin URLs are discovered but remain unverified until an explicit test. The compact status line shows MerchantDuo and Magento versions, environment lifecycle, write access, an explicit theme scope when one is selected, and the frontend URL when available.
+At session start, MerchantDuo produces a Magento snapshot from the selected environment. Frontend and admin URLs are discovered but remain unverified until an explicit test. The compact status line shows MerchantDuo and Magento versions, environment lifecycle, session permission mode, an explicit theme scope when one is selected, and the frontend URL when available.
 
 ## Commands and tools
 
 Extension slash commands are namespaced with `duo-` to avoid collisions with other Pi extensions.
 
-- [Command reference](docs/commands.md) covers `/duo-switch-theme`, lifecycle, and navigation commands.
+- [Command reference](docs/commands.md) covers session theme and permission switching, lifecycle, and navigation commands.
 - [Tool reference](docs/tools.md) covers workspace, environment, Magento workflow, magerun2, testing, PHP-console, and optional knowledge tools, including parameters and confirmation boundaries.
 
 ## Environments
@@ -46,10 +46,9 @@ environments:
     type: ssh
     host: shop-stage
     root: /var/www/html
-    writable: false
 ```
 
-Local uses the checkout directly. Warden routes project and Magento execution through its configured service. SSH is read-only by default; configure its user, port, and key using an OpenSSH host alias:
+Local uses the checkout directly. Warden routes project and Magento execution through its configured service. Local and Warden sessions start in `normal`; SSH starts in `read-only`. Use `/duo-switch-permissions <read-only|normal|yolo>` to change only the current session, or `merchantduo --yolo` to start in `yolo`. Configure SSH user, port, and key through an OpenSSH host alias:
 
 ```sshconfig
 Host shop-stage

package/dist/app/permission-mode.d.ts

@@ -0,0 +1,5 @@
+import type { Environment } from "#environments/model";
+export declare const permissionModes: readonly ["read-only", "normal", "yolo"];
+export type PermissionMode = (typeof permissionModes)[number];
+/** Resolve one non-persistent session policy. Invalid launch input is rejected, never relaxed. */
+export declare function resolvePermissionMode(environment: Environment, override?: string): PermissionMode;

package/dist/app/permission-mode.js

@@ -0,0 +1,10 @@
+export const permissionModes = ["read-only", "normal", "yolo"];
+/** Resolve one non-persistent session policy. Invalid launch input is rejected, never relaxed. */
+export function resolvePermissionMode(environment, override) {
+    if (override !== undefined) {
+        if (!permissionModes.includes(override))
+            throw new Error(`Invalid MERCHANTDUO_PERMISSION_MODE: ${override}. Expected read-only, normal, or yolo.`);
+        return override;
+    }
+    return environment.type === "ssh" ? "read-only" : "normal";
+}

package/dist/app/runtime.d.ts

@@ -1,6 +1,7 @@
 import { type MerchantConfig } from "#config/index";
 import { EnvironmentBackend } from "#environments/backend";
 import type { Environment } from "#environments/model";
+import { type PermissionMode } from "#app/permission-mode";
 import type { EnvironmentStatus } from "#environments/model";
 import { type MagentoInspector, type MagentoSnapshot } from "#magento/index";
 import { ChangeTracker } from "#workflows/change-tracker";
@@ -15,6 +16,7 @@ export type SessionState = {
     };
     backend: EnvironmentBackend;
     environmentStatus: EnvironmentStatus;
+    permissionMode: PermissionMode;
     magento: MagentoSnapshot;
     testing?: TestingSnapshot;
     magerun2?: Magerun2Capability;
@@ -29,7 +31,7 @@ export declare class MerchantDuoRuntime {
     resetInjection(): void;
     injectionKey(skillId: string, theme: string): string;
     changeTheme(cwd: string, activeTheme: string): Promise<SessionState>;
-    writable(state: SessionState): boolean;
+    setPermissionMode(mode: PermissionMode): SessionState;
     setTesting(snapshot: TestingSnapshot): void;
     setMagerun2(capability: Magerun2Capability): void;
     setEnvironmentStatus(status: EnvironmentStatus): SessionState;

package/dist/app/runtime.js

@@ -1,6 +1,6 @@
 import { loadConfig, selectEnvironment, setProjectTheme, } from "#config/index";
 import { EnvironmentBackend } from "#environments/backend";
-import { environmentWritable } from "#environments/model";
+import { resolvePermissionMode } from "#app/permission-mode";
 import { DefaultMagentoInspector, } from "#magento/index";
 import { ChangeTracker } from "#workflows/change-tracker";
 export class MerchantDuoRuntime {
@@ -26,6 +26,7 @@ export class MerchantDuoRuntime {
             selected,
             backend,
             environmentStatus,
+            permissionMode: resolvePermissionMode(selected.environment, process.env.MERCHANTDUO_PERMISSION_MODE),
             magento: environmentStatus === "running" ? await this.inspector.inspect(backend) : stoppedMagentoSnapshot(),
         };
         return this.#state;
@@ -47,8 +48,11 @@ export class MerchantDuoRuntime {
         this.resetInjection();
         return state;
     }
-    writable(state) {
-        return environmentWritable(state.selected.environment);
+    setPermissionMode(mode) {
+        if (!this.#state)
+            throw new Error("Session has not started");
+        this.#state.permissionMode = mode;
+        return this.#state;
     }
     setTesting(snapshot) {
         if (!this.#state)

package/dist/app/status.js

@@ -1,15 +1,9 @@
 export function refreshStatus(ctx, state) {
-    const environment = state.selected.environment;
-    const writePolicy = environment.type === "ssh"
-        ? environment.writable
-            ? "✎+?"
-            : "RO"
-        : "✎";
     const parts = [
         `MerchantDuo ${process.env.MERCHANTDUO_PACKAGE_VERSION ?? "?"}`,
         `M${state.magento.version ?? "?"}`,
         `${state.selected.name} (${state.environmentStatus})`,
-        writePolicy,
+        state.permissionMode === "read-only" ? "r-o" : state.permissionMode,
         ...(state.config.activeTheme === "all" ? [] : [state.config.activeTheme]),
         ...(state.testing?.frontendUrl ? [state.testing.frontendUrl] : []),
     ];

package/dist/app/system-prompt.js

@@ -13,6 +13,8 @@ After every change, inspect the changed module and files and choose the smallest
 
 For cache clean/flush, maintenance enable/disable, static content deployment, compilation, setup upgrade, indexing, tests, or deployment: when the user directly requests execution, invoke \`magento_workflow\` with \`execute: true\` immediately. Use only this workflow tool for operational Magento commands. Do not ask the user for a separate conversational confirmation: the harness dialog is the sole authoritative confirmation. When execution was not requested, explain the operation and offer a preview.
 
+Session permission mode is shown in the startup context and can be changed only with \`/duo-switch-permissions read-only|normal|yolo\`. Read-only blocks direct write/edit but an approved shell or explicit operation may still mutate. Normal retains ordinary local/Warden direct workspace behavior and SSH confirmations. Yolo removes MerchantDuo dialogs only; it never removes the explicit \`execute: true\` boundary, stopped-environment block, SSH lifecycle restriction, Mage2Gen SSH restriction, remote workflow restriction, PHP-console boundary, or credential and URL protections.
+
 For a supported cache, deploy, indexing, or test operation, prefer \`magento_workflow\`. For a different n98-magerun2 subcommand, use \`magerun2\` with an exact \`args: string[]\` vector, never a shell command or interpolation. When the user did not directly request execution, return its preview without \`execute: true\`; an executed generic magerun2 call requires \`execute: true\` and uses the same sole harness confirmation. Never send \`dev:console\` through \`magerun2\`: use the typed \`magento_php_repl\` tool instead.
 
 Environment lifecycle is explicit. Warden has known direct controls. SSH is always reported running and must never be started, stopped, or restarted. A local environment is agent-directed: when the user requests a start or stop, inspect the actual project lifecycle first, then call \`environment_start\` or \`environment_stop\` with the exact smallest command. Never guess a generic Docker, Compose, npm, or service command, and never affect unrelated host services. Use \`environment_set_status\` after a status inspection that does not itself start or stop the stack. Never inspect app/etc/env.php or credentials.`;

package/dist/cli/arguments.d.ts

@@ -5,6 +5,7 @@ export type CliArguments = {
     source?: string;
     database?: string;
     yes: boolean;
+    yolo: boolean;
     piArguments: string[];
 };
 export declare function parseArguments(args: string[]): CliArguments;

package/dist/cli/arguments.js

@@ -7,6 +7,7 @@ export function parseArguments(args) {
     let source;
     let database;
     let yes = false;
+    let yolo = false;
     for (let index = 0; index < input.length; index += 1) {
         const value = input[index];
         if (value === "--env" || value === "--config" || value === "--source" || value === "--database") {
@@ -26,9 +27,14 @@ export function parseArguments(args) {
         else if (value === "--yes") {
             yes = true;
         }
+        else if (value === "--yolo") {
+            yolo = true;
+        }
         else {
             piArguments.push(value);
         }
     }
-    return { command, environment, configPath, source, database, yes, piArguments };
+    if (command && yolo)
+        throw new Error("--yolo is only available when starting an agent session");
+    return { command, environment, configPath, source, database, yes, yolo, piArguments };
 }

package/dist/cli/commands/agent.d.ts

@@ -1 +1,3 @@
-export declare function launchAgent(piArguments: string[], selectedEnvironment: string, configPath?: string): Promise<number>;
+import type { PermissionMode } from "#app/permission-mode";
+export declare function launchAgent(piArguments: string[], selectedEnvironment: string, configPath?: string, permissionMode?: PermissionMode): Promise<number>;
+export declare function agentEnvironment(base: NodeJS.ProcessEnv, piDirectory: string, selectedEnvironment: string, configPath: string | undefined, version: string, permissionMode?: PermissionMode): NodeJS.ProcessEnv;

package/dist/cli/commands/agent.js

@@ -4,7 +4,7 @@ import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { merchantHome } from "#config/paths";
 import { packagePath } from "#shared/package-paths";
-export async function launchAgent(piArguments, selectedEnvironment, configPath) {
+export async function launchAgent(piArguments, selectedEnvironment, configPath, permissionMode) {
     const state = merchantHome();
     await mkdir(state, { recursive: true, mode: 0o700 });
     await mkdir(resolve(state, "pi"), { recursive: true, mode: 0o700 });
@@ -19,15 +19,12 @@ export async function launchAgent(piArguments, selectedEnvironment, configPath)
             ...piArguments,
         ], {
             stdio: "inherit",
-            env: {
-                ...process.env,
-                PI_CODING_AGENT_DIR: resolve(state, "pi"),
-                MERCHANTDUO_SELECTED_ENV: selectedEnvironment,
-                MERCHANTDUO_CONFIG_PATH: configPath ?? "",
-                MERCHANTDUO_PACKAGE_VERSION: packageJson.version,
-            },
+            env: agentEnvironment(process.env, resolve(state, "pi"), selectedEnvironment, configPath, packageJson.version, permissionMode),
         });
         child.on("error", reject);
         child.on("exit", (code) => resolveExit(code ?? 1));
     });
 }
+export function agentEnvironment(base, piDirectory, selectedEnvironment, configPath, version, permissionMode) {
+    return { ...base, PI_CODING_AGENT_DIR: piDirectory, MERCHANTDUO_SELECTED_ENV: selectedEnvironment, MERCHANTDUO_CONFIG_PATH: configPath ?? "", MERCHANTDUO_PACKAGE_VERSION: version, ...(permissionMode ? { MERCHANTDUO_PERMISSION_MODE: permissionMode } : {}) };
+}

package/dist/cli/commands/doctor.js

@@ -1,12 +1,12 @@
 import { EnvironmentBackend } from "#environments/backend";
-import { environmentWritable } from "#environments/model";
+import { resolvePermissionMode } from "#app/permission-mode";
 import { DefaultMagentoInspector } from "#magento/inspector";
 export async function doctor(cwd, name, environment, config) {
     const magento = await new DefaultMagentoInspector().inspect(new EnvironmentBackend(environment, cwd));
     console.log(JSON.stringify({
         environment: name,
         type: environment.type,
-        writable: environmentWritable(environment),
+        defaultPermissionMode: resolvePermissionMode(environment),
         magento,
         activeTheme: config.activeTheme,
         knowledge: { connected: false },

package/dist/cli/commands/init.d.ts

@@ -6,4 +6,4 @@ export declare class TerminalInitInterview implements InitInterview {
 }
 export declare function hasWardenEnvironment(cwd: string): Promise<boolean>;
 export declare function initProject(cwd: string, interview?: InitInterview, output?: (message: string) => void): Promise<void>;
-export declare const remoteEnvironmentExample = "\nTo add a remote environment later, add this under environments:\n\n  stage:\n    type: ssh\n    host: shop-stage\n    root: /var/www/html\n    writable: false\n\nConfigure its user, port, and identity through ~/.ssh/config:\n\n  Host shop-stage\n    HostName stage.example.com\n    User deploy\n    Port 22\n    IdentityFile ~/.ssh/id_ed25519";
+export declare const remoteEnvironmentExample = "\nTo add a remote environment later, add this under environments:\n\n  stage:\n    type: ssh\n    host: shop-stage\n    root: /var/www/html\n\nSSH sessions start read-only. Use /duo-switch-permissions normal or yolo only for the current session. Configure its user, port, and identity through ~/.ssh/config:\n\n  Host shop-stage\n    HostName stage.example.com\n    User deploy\n    Port 22\n    IdentityFile ~/.ssh/id_ed25519";

package/dist/cli/commands/init.js

@@ -65,4 +65,4 @@ export async function initProject(cwd, interview = new TerminalInitInterview(),
     output(`Created ${path}`);
     output(remoteEnvironmentExample);
 }
-export const remoteEnvironmentExample = `\nTo add a remote environment later, add this under environments:\n\n  stage:\n    type: ssh\n    host: shop-stage\n    root: /var/www/html\n    writable: false\n\nConfigure its user, port, and identity through ~/.ssh/config:\n\n  Host shop-stage\n    HostName stage.example.com\n    User deploy\n    Port 22\n    IdentityFile ~/.ssh/id_ed25519`;
+export const remoteEnvironmentExample = `\nTo add a remote environment later, add this under environments:\n\n  stage:\n    type: ssh\n    host: shop-stage\n    root: /var/www/html\n\nSSH sessions start read-only. Use /duo-switch-permissions normal or yolo only for the current session. Configure its user, port, and identity through ~/.ssh/config:\n\n  Host shop-stage\n    HostName stage.example.com\n    User deploy\n    Port 22\n    IdentityFile ~/.ssh/id_ed25519`;

package/dist/cli/main.js

@@ -23,7 +23,7 @@ async function main() {
     }
     if (args.command === "doctor")
         return doctor(cwd, selected.name, selected.environment, loaded.config);
-    process.exitCode = await launchAgent(args.piArguments, selected.name, loaded.configPath);
+    process.exitCode = await launchAgent(args.piArguments, selected.name, loaded.configPath, args.yolo ? "yolo" : undefined);
 }
 main().catch((error) => {
     console.error(`merchantduo: ${error.message}`);

package/dist/config/schema.d.ts

@@ -93,7 +93,6 @@ export declare const ConfigSchema: z.ZodObject<{
         type: z.ZodLiteral<"ssh">;
         host: z.ZodString;
         root: z.ZodString;
-        writable: z.ZodDefault<z.ZodBoolean>;
         testing: z.ZodOptional<z.ZodObject<{
             frontendUrl: z.ZodOptional<z.ZodString>;
             adminUrl: z.ZodOptional<z.ZodString>;
@@ -111,7 +110,6 @@ export declare const ConfigSchema: z.ZodObject<{
         type: "ssh";
         root: string;
         host: string;
-        writable: boolean;
         testing?: {
             allowInsecureTls: boolean;
             frontendUrl?: string | undefined;
@@ -126,7 +124,6 @@ export declare const ConfigSchema: z.ZodObject<{
             adminUrl?: string | undefined;
             allowInsecureTls?: boolean | undefined;
         } | undefined;
-        writable?: boolean | undefined;
     }>]>>>;
 }, "strict", z.ZodTypeAny, {
     testing: {
@@ -158,7 +155,6 @@ export declare const ConfigSchema: z.ZodObject<{
         type: "ssh";
         root: string;
         host: string;
-        writable: boolean;
         testing?: {
             allowInsecureTls: boolean;
             frontendUrl?: string | undefined;
@@ -202,7 +198,6 @@ export declare const ConfigSchema: z.ZodObject<{
             adminUrl?: string | undefined;
             allowInsecureTls?: boolean | undefined;
         } | undefined;
-        writable?: boolean | undefined;
     }> | undefined;
 }>;
 export type MerchantConfig = Omit<z.infer<typeof ConfigSchema>, "environments"> & {

package/dist/config/schema.js

@@ -22,7 +22,6 @@ const ssh = z
     type: z.literal("ssh"),
     host: z.string().min(1),
     root: z.string(),
-    writable: z.boolean().default(false),
     testing: testing.optional(),
 })
     .strict();

package/dist/environments/model.d.ts

@@ -22,9 +22,7 @@ export type SshEnvironment = {
     type: "ssh";
     host: string;
     root: string;
-    writable: boolean;
     testing?: EnvironmentTesting;
 };
 export type Environment = LocalEnvironment | WardenEnvironment | SshEnvironment;
-export declare function environmentWritable(environment: Environment): boolean;
 export {};

package/dist/environments/model.js

@@ -1,3 +1 @@
-export function environmentWritable(environment) {
-    return environment.type !== "ssh" || environment.writable;
-}
+export {};

package/dist/features/magerun2/service.js

@@ -19,7 +19,7 @@ export async function discoverMagerun2(environment, backend, cwd) {
             return { available: true, executable };
     }
     if (environment.type === "ssh")
-        return { available: false, diagnostic: environment.writable ? "Install n98-magerun2 on the remote host." : "Magerun2 is disabled for read-only SSH." };
+        return { available: false, diagnostic: "Install n98-magerun2 on the remote host." };
     try {
         return { available: true, executable: await installMagerun2(merchantHome(), cwd) };
     }

package/dist/integrations/pi/context.js

@@ -11,7 +11,7 @@ export default function context(pi) {
         if (state.environmentStatus === "stopped") {
             refreshStatus(ctx, state);
             sessionEvents.emit("merchantduo.context", state);
-            pi.appendEntry("merchantduo.context", { environment: state.selected.name, environmentStatus: state.environmentStatus });
+            pi.appendEntry("merchantduo.context", { environment: state.selected.name, environmentStatus: state.environmentStatus, permissionMode: state.permissionMode });
             return;
         }
         const magerun2 = await discoverMagerun2(state.selected.environment, state.backend, ctx.cwd);
@@ -27,7 +27,7 @@ export default function context(pi) {
         runtime.setTesting(await discoverTesting(state.selected.environment, state.backend, ctx.cwd, { ...state.config.testing, ...state.selected.environment.testing, allowInsecureTls: state.selected.environment.testing?.allowInsecureTls ?? state.config.testing.allowInsecureTls }, { http, browser }));
         refreshStatus(ctx, state);
         sessionEvents.emit("merchantduo.context", state);
-        pi.appendEntry("merchantduo.context", { environment: state.selected.name, environmentStatus: state.environmentStatus, testing: state.testing, magerun2: state.magerun2 });
+        pi.appendEntry("merchantduo.context", { environment: state.selected.name, environmentStatus: state.environmentStatus, permissionMode: state.permissionMode, testing: state.testing, magerun2: state.magerun2 });
     });
     pi.on("session_compact", () => runtime.resetInjection());
     pi.on("session_shutdown", () => sessionEvents.clear());
@@ -47,6 +47,6 @@ export default function context(pi) {
     pi.on("before_agent_start", async (event, ctx) => {
         const state = await runtime.boot(ctx.cwd);
         const testing = state.testing;
-        return { systemPrompt: `${event.systemPrompt}\n${merchantDuoSystemPrompt()}\nEnvironment: ${state.selected.name} is ${state.environmentStatus}. ${state.environmentStatus === "stopped" ? "Use environment_start only after the user directly asks to start it; do not use project tools until it is running." : "Testing URLs are discovered but unverified. Frontend: " + (testing?.frontendUrl ?? "unavailable") + "; Admin: " + (testing?.adminUrl ?? "unavailable") + ". HTTP, browser, navigation, and test artifacts are host-only; never use environment bash to locate or repair their host paths. Use explicit test tools only when relevant."}` };
+        return { systemPrompt: `${event.systemPrompt}\n${merchantDuoSystemPrompt()}\nEnvironment: ${state.selected.name} is ${state.environmentStatus}; permission mode=${state.permissionMode}. ${state.environmentStatus === "stopped" ? "Use environment_start only after the user directly asks to start it; do not use project tools until it is running." : "Testing URLs are discovered but unverified. Frontend: " + (testing?.frontendUrl ?? "unavailable") + "; Admin: " + (testing?.adminUrl ?? "unavailable") + ". HTTP, browser, navigation, and test artifacts are host-only; never use environment bash to locate or repair their host paths. Use explicit test tools only when relevant."}` };
     });
 }

package/dist/integrations/pi/magerun2.d.ts

@@ -1,4 +1,4 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 /** Generic magerun2 is intentionally separate from the typed PHP console. */
 export default function magerun2(pi: ExtensionAPI): void;
-export declare function magerun2Refusal(args: string[], readOnlySsh: boolean): string | undefined;
+export declare function magerun2Refusal(args: string[]): string | undefined;

package/dist/integrations/pi/magerun2.js

@@ -14,7 +14,7 @@ export default function magerun2(pi) {
         }),
         async execute(_id, params, signal, _update, ctx) {
             const state = await runtime.boot(ctx.cwd);
-            const refusal = magerun2Refusal(params.args, state.selected.environment.type === "ssh" && !state.selected.environment.writable);
+            const refusal = magerun2Refusal(params.args);
             if (refusal)
                 return text(refusal);
             const capability = state.magerun2;
@@ -28,10 +28,8 @@ export default function magerun2(pi) {
         },
     });
 }
-export function magerun2Refusal(args, readOnlySsh) {
+export function magerun2Refusal(args) {
     if (args.includes("dev:console"))
         return "Refused: dev:console belongs to magento_php_repl, which accepts a typed snippet and optional area.";
-    if (readOnlySsh)
-        return "Refused: generic magerun2 is unavailable for read-only SSH because arbitrary subcommands cannot be classified safely.";
     return undefined;
 }

package/dist/integrations/pi/permissions.d.ts

@@ -1,6 +1,8 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { type PermissionMode } from "#app/permission-mode";
 import type { Environment } from "#environments/model";
 export declare function requiresExecuteConfirmation(toolName: string, input: Record<string, unknown>): boolean;
-export declare function requiresSshConfirmation(environment: Environment, toolName: string): boolean;
-/** The sole MerchantDuo confirmation gate. Explicit test/navigation tools are intentionally excluded. */
+/** Return block/confirmation behavior; callers retain all hard capability constraints. */
+export declare function permissionDecision(mode: PermissionMode, environment: Environment, toolName: string, input: Record<string, unknown>): "allow" | "block" | "confirm";
+/** The sole MerchantDuo confirmation gate. YOLO removes dialogs, never hard constraints. */
 export default function permissions(pi: ExtensionAPI): void;

package/dist/integrations/pi/permissions.js

@@ -1,37 +1,62 @@
+import { permissionModes } from "#app/permission-mode";
+import { refreshStatus } from "#app/status";
 import { runtime } from "#integrations/pi/session";
+const workspaceMutations = new Set(["write", "edit"]);
+const stoppedAllowed = new Set(["environment_status", "environment_start", "environment_stop", "environment_set_status"]);
 export function requiresExecuteConfirmation(toolName, input) {
     return ["environment_start", "environment_stop"].includes(toolName) || ((toolName === "mage2gen_generate_module" || toolName === "magento_workflow" || toolName === "magerun2") && input.execute === true);
 }
-export function requiresSshConfirmation(environment, toolName) {
-    return environment.type === "ssh" && environment.writable && ["write", "edit", "bash"].includes(toolName);
+/** Return block/confirmation behavior; callers retain all hard capability constraints. */
+export function permissionDecision(mode, environment, toolName, input) {
+    if (mode === "yolo")
+        return "allow";
+    if (mode === "read-only" && workspaceMutations.has(toolName))
+        return "block";
+    if (mode === "read-only" && (toolName === "bash" || toolName === "magento_php_repl" || requiresExecuteConfirmation(toolName, input)))
+        return "confirm";
+    if (requiresExecuteConfirmation(toolName, input))
+        return "confirm";
+    if (mode === "normal" && environment.type === "ssh" && (workspaceMutations.has(toolName) || toolName === "bash"))
+        return "confirm";
+    return "allow";
 }
-/** The sole MerchantDuo confirmation gate. Explicit test/navigation tools are intentionally excluded. */
+async function confirm(ctx, title, message) {
+    return ctx.hasUI && await ctx.ui.confirm(title, message);
+}
+/** The sole MerchantDuo confirmation gate. YOLO removes dialogs, never hard constraints. */
 export default function permissions(pi) {
+    pi.registerCommand("duo-switch-permissions", { description: "Set this session's permission mode: read-only, normal, or yolo.", handler: async (args, ctx) => {
+            const mode = args.trim();
+            if (!permissionModes.includes(mode)) {
+                ctx.ui.notify("Choose one of: read-only, normal, yolo", "error");
+                return;
+            }
+            await runtime.boot(ctx.cwd);
+            const state = runtime.setPermissionMode(mode);
+            refreshStatus(ctx, state);
+            ctx.ui.notify(`Session permission mode set to ${mode}. It will reset when this session ends.`, "info");
+        } });
     pi.on("tool_call", async (event, ctx) => {
         const state = await runtime.boot(ctx.cwd);
-        const input = event.input;
-        if (state.environmentStatus === "stopped" && !["environment_status", "environment_start", "environment_stop", "environment_set_status"].includes(event.toolName))
+        if (state.environmentStatus === "stopped" && !stoppedAllowed.has(event.toolName))
             return { block: true, reason: "MerchantDuo: selected environment is stopped. Start it first." };
-        if (requiresExecuteConfirmation(event.toolName, input)) {
-            const ok = ctx.hasUI && await ctx.ui.confirm("Confirm Magento action", `Execute ${event.toolName}?`);
-            return ok ? undefined : { block: true, reason: "Cancelled: confirmation required." };
-        }
-        if (state.selected.environment.type === "ssh" && ["write", "edit", "bash"].includes(event.toolName)) {
-            if (!state.selected.environment.writable)
-                return { block: true, reason: "MerchantDuo: this SSH environment is read-only." };
-            const ok = !requiresSshConfirmation(state.selected.environment, event.toolName) || (ctx.hasUI && await ctx.ui.confirm("SSH workspace action", `Run ${event.toolName} on ${state.selected.environment.host}?`));
-            return ok ? undefined : { block: true, reason: "Cancelled: SSH confirmation required." };
-        }
+        const decision = permissionDecision(state.permissionMode, state.selected.environment, event.toolName, event.input);
+        if (decision === "allow")
+            return;
+        if (decision === "block")
+            return { block: true, reason: "MerchantDuo: read-only mode blocks direct workspace writes and edits." };
+        const ok = await confirm(ctx, "Confirm Magento action", `Run ${event.toolName} in ${state.permissionMode} mode?`);
+        return ok ? undefined : { block: true, reason: "Cancelled: confirmation required." };
     });
     pi.on("user_bash", async (event, ctx) => {
         const state = await runtime.boot(ctx.cwd);
-        if (state.selected.environment.type !== "ssh")
-            return;
-        if (!state.selected.environment.writable)
-            return { result: { output: "MerchantDuo: this SSH environment is read-only.", exitCode: 1, cancelled: true, truncated: false } };
-        const ok = ctx.hasUI && await ctx.ui.confirm("SSH command", `Run command on ${state.selected.environment.host}?`);
-        if (!ok)
+        if (state.environmentStatus === "stopped")
+            return { result: { output: "MerchantDuo: selected environment is stopped. Start it first.", exitCode: 1, cancelled: true, truncated: false } };
+        const decision = state.permissionMode === "yolo" ? "allow" : state.permissionMode === "read-only" || state.selected.environment.type === "ssh" ? "confirm" : "allow";
+        if (decision === "confirm" && !(await confirm(ctx, "Confirm shell command", `Run command in ${state.permissionMode} mode?`)))
             return { result: { output: "Cancelled: confirmation required.", exitCode: 1, cancelled: true, truncated: false } };
+        if (decision === "allow" && state.selected.environment.type !== "ssh" && state.permissionMode !== "read-only")
+            return;
         const result = await state.backend.run(["sh", "-lc", event.command]);
         return { result: { output: `${result.stdout}${result.stderr}`, exitCode: result.exitCode, cancelled: false, truncated: result.truncated } };
     });

package/dist/integrations/pi/testing.js

@@ -56,8 +56,6 @@ export default function testing(pi) {
         } });
     pi.registerTool({ name: "magento_php_repl", label: "Magento PHP console", description: "Explicit one-shot magerun2 PHP snippet execution.", parameters: Type.Object({ snippet: Type.String({ minLength: 1 }), area: Type.Optional(Type.Union([Type.Literal("adminhtml"), Type.Literal("frontend"), Type.Literal("crontab"), Type.Literal("webapi_rest"), Type.Literal("graphql")])) }), async execute(_id, params, signal, _update, ctx) {
             const state = await runtime.boot(ctx.cwd);
-            if (state.selected.environment.type === "ssh" && !state.selected.environment.writable)
-                return text("PHP REPL is unavailable for read-only SSH.");
             const executable = state.magerun2?.executable;
             if (!executable)
                 return text(state.magerun2?.diagnostic ?? "PHP REPL unavailable.");

package/dist/integrations/pi/theme.d.ts

@@ -1,2 +1,4 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import type { SessionState } from "#app/runtime";
+export declare function themeChoices(state: SessionState): string[];
 export default function theme(pi: ExtensionAPI): void;

package/dist/integrations/pi/theme.js

@@ -1,6 +1,25 @@
 import { refreshStatus } from "#app/status";
 import { runtime } from "#integrations/pi/session";
-export default function theme(pi) { pi.registerCommand("duo-switch-theme", { description: "Select all, any, or a detected Magento theme.", handler: async (args, ctx) => { const state = await runtime.boot(ctx.cwd); const value = args.trim(); const choices = ["all", "any", ...state.magento.themes.map((theme) => theme.code)]; if (!choices.includes(value)) {
-        ctx.ui.notify(`Choose one of: ${choices.join(", ")}`, "error");
-        return;
-    } const changed = await runtime.changeTheme(ctx.cwd, value); refreshStatus(ctx, changed); ctx.ui.notify(`Theme scope set to ${value}.`, "info"); } }); }
+export function themeChoices(state) {
+    return ["all", "any", ...state.magento.themes.map((theme) => theme.code)];
+}
+export default function theme(pi) {
+    pi.registerCommand("duo-switch-theme", {
+        description: "Choose a detected Magento theme, all, or any.",
+        handler: async (args, ctx) => {
+            const state = await runtime.boot(ctx.cwd);
+            const choices = themeChoices(state);
+            const typed = args.trim();
+            const value = typed || (ctx.hasUI ? await ctx.ui.select("Select Magento theme scope", choices) : undefined);
+            if (!value)
+                return;
+            if (!choices.includes(value)) {
+                ctx.ui.notify(`Choose one of: ${choices.join(", ")}`, "error");
+                return;
+            }
+            const changed = await runtime.changeTheme(ctx.cwd, value);
+            refreshStatus(ctx, changed);
+            ctx.ui.notify(`Theme scope set to ${value}.`, "info");
+        },
+    });
+}

package/dist/integrations/pi/workflows.js

@@ -6,7 +6,7 @@ export default function workflows(pi) {
     pi.registerTool({ name: "magento_workflow", label: "Magento workflow", description: "Preview or explicitly execute a supported Magento operational action.", parameters: Type.Object({ action: Type.String(), execute: Type.Optional(Type.Boolean()) }), async execute(_id, params, _signal, _update, ctx) {
             const state = await runtime.boot(ctx.cwd);
             if (params.action === "status")
-                return text(JSON.stringify({ snapshot: state.magento, testing: state.testing, magerun2: state.magerun2, pendingFiles: runtime.changes.files(), workflows: builtInWorkflows.map(({ id, description }) => ({ id, description })) }, null, 2));
+                return text(JSON.stringify({ snapshot: state.magento, permissionMode: state.permissionMode, testing: state.testing, magerun2: state.magerun2, pendingFiles: runtime.changes.files(), workflows: builtInWorkflows.map(({ id, description }) => ({ id, description })) }, null, 2));
             if (params.action === "syntax-check")
                 return text((await syntaxCheck(state.backend, runtime.changes.files())).join("\n") || "No supported changed files require syntax checks.");
             const workflow = builtInWorkflows.find(({ id }) => id === params.action);

package/dist/magento/prompt.d.ts

@@ -1,2 +1,3 @@
 import type { MagentoSnapshot } from "#magento/model";
-export declare function snapshotPrompt(envName: string, writable: boolean, status: string, snapshot: MagentoSnapshot): string;
+import type { PermissionMode } from "#app/permission-mode";
+export declare function snapshotPrompt(envName: string, permissionMode: PermissionMode, status: string, snapshot: MagentoSnapshot): string;

package/dist/magento/prompt.js

@@ -1,3 +1,3 @@
-export function snapshotPrompt(envName, writable, status, snapshot) {
-    return `[MerchantDuo: environment=${envName}; write policy=${writable ? "writable" : "read-only"}; Magento=${snapshot.edition ?? "unknown"} ${snapshot.version ?? "unknown"}; PHP=${snapshot.phpVersion ?? "unknown"}; mode=${snapshot.mode ?? "unknown"}; knowledge=${status}; pending actions are controlled by magento_workflow. Do not inspect app/etc/env.php or credentials.${snapshot.warnings.length ? ` Warnings: ${snapshot.warnings.join("; ")}` : ""}]`;
+export function snapshotPrompt(envName, permissionMode, status, snapshot) {
+    return `[MerchantDuo: environment=${envName}; permission mode=${permissionMode}; Magento=${snapshot.edition ?? "unknown"} ${snapshot.version ?? "unknown"}; PHP=${snapshot.phpVersion ?? "unknown"}; mode=${snapshot.mode ?? "unknown"}; knowledge=${status}; pending actions are controlled by magento_workflow. Do not inspect app/etc/env.php or credentials.${snapshot.warnings.length ? ` Warnings: ${snapshot.warnings.join("; ")}` : ""}]`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@merchantduo/code",
-  "version": "0.2.0-beta.3",
+  "version": "0.2.0-beta.4",
   "private": false,
   "description": "Magento-native Pi-based Coding Agent",
   "type": "module",