@namzu/cli 0.5.1 → 0.6.0

package/dist/permissions/__tests__/mode.test.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The mode, and its precedence against the config file.
+ *
+ * The rule being protected is one sentence: a mode governs only the calls no
+ * rule decided, so it can never reopen what a rule closed. The tests that
+ * matter are the ones that would catch a future change making
+ * `--permission-mode auto` able to run something the operator wrote `deny` for.
+ */
+export {};
+//# sourceMappingURL=mode.test.d.ts.map

package/dist/permissions/__tests__/mode.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mode.test.d.ts","sourceRoot":"","sources":["../../../src/permissions/__tests__/mode.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/permissions/__tests__/mode.test.js

@@ -0,0 +1,115 @@
+/**
+ * The mode, and its precedence against the config file.
+ *
+ * The rule being protected is one sentence: a mode governs only the calls no
+ * rule decided, so it can never reopen what a rule closed. The tests that
+ * matter are the ones that would catch a future change making
+ * `--permission-mode auto` able to run something the operator wrote `deny` for.
+ */
+import { VerificationGate, configureLogger, getRootLogger } from '@namzu/sdk';
+import { describe, expect, it } from 'vitest';
+import { makeResumeHandler } from '../../tui/agent.js';
+import { PERMISSION_MODES, isPermissionMode, resolvePermissionMode } from '../mode.js';
+import { compilePermissions } from '../rules.js';
+configureLogger({ level: 'silent' });
+describe('resolving the mode from flag, alias and terminal', () => {
+    it('takes an explicit flag over everything else', () => {
+        expect(resolvePermissionMode({ flag: 'strict', interactive: true })).toEqual({ mode: 'strict' });
+        expect(resolvePermissionMode({ flag: 'prompt', skipPermissions: true, interactive: false })).toEqual({ mode: 'prompt' });
+    });
+    it('refuses a mode it does not know, and names the ones it does', () => {
+        const result = resolvePermissionMode({ flag: 'yolo', interactive: false });
+        expect('error' in result && result.error).toContain('prompt, auto, strict');
+    });
+    it('maps the bypass aliases to auto', () => {
+        expect(resolvePermissionMode({ skipPermissions: true, interactive: true })).toEqual({
+            mode: 'auto',
+        });
+    });
+    it('asks when there is someone to ask, and does not when there is not', () => {
+        // `prompt` without a terminal would silently become `auto` anyway;
+        // resolving it as `auto` makes the resolved mode honest in a log.
+        expect(resolvePermissionMode({ interactive: true })).toEqual({ mode: 'prompt' });
+        expect(resolvePermissionMode({ interactive: false })).toEqual({ mode: 'auto' });
+    });
+    it('exposes exactly the modes it accepts', () => {
+        expect(PERMISSION_MODES.every(isPermissionMode)).toBe(true);
+        expect(isPermissionMode('trusted')).toBe(false);
+    });
+});
+describe('a mode decides only what no rule decided', () => {
+    function gate(config) {
+        const { rules } = compilePermissions(config);
+        return new VerificationGate({
+            enabled: true,
+            rules: [...rules],
+            allowReadOnlyTools: false,
+            denyDangerousPatterns: false,
+            logDecisions: false,
+        }, getRootLogger());
+    }
+    it('a denied call never reaches the mode at all', async () => {
+        // THE precedence test. `deny` is settled by the gate, so no mode — not
+        // even the one spelled --yolo — is ever consulted about it. If this ever
+        // fails, a flag has become able to lift a prohibition someone wrote down.
+        const decision = gate({ bash: 'deny' }).evaluate({
+            toolName: 'bash',
+            toolInput: { command: 'rm -rf /tmp/x' },
+            toolDef: undefined,
+        });
+        expect(decision.decision).toBe('deny');
+    });
+    it('an allowed call never reaches the mode either', () => {
+        const decision = gate({ bash: { 'git status*': 'allow' } }).evaluate({
+            toolName: 'bash',
+            toolInput: { command: 'git status' },
+            toolDef: undefined,
+        });
+        expect(decision.decision).toBe('allow');
+    });
+});
+describe('what each mode does with an undecided call', () => {
+    const destructive = [
+        { id: '1', name: 'write', input: { path: 'a.txt' }, isDestructive: true },
+    ];
+    it('auto approves it', async () => {
+        const handler = makeResumeHandler({ all: false }, undefined, 'auto');
+        const decision = await handler({ type: 'tool_review', toolCalls: destructive });
+        expect(decision).toEqual({ action: 'approve_tools' });
+    });
+    it('strict refuses it, and says asking again will not help', async () => {
+        // The mode that did not exist: an unattended run could only be `auto`, so
+        // a CI job either trusted the agent with everything or could not use it.
+        const handler = makeResumeHandler({ all: false }, undefined, 'strict');
+        const decision = (await handler({
+            type: 'tool_review',
+            toolCalls: destructive,
+        }));
+        expect(decision.action).toBe('reject_tools');
+        expect(decision.feedback).toContain('Asking again will not change it');
+    });
+    it('prompt asks the human, and honours the answer', async () => {
+        let asked = false;
+        const handler = makeResumeHandler({ all: false }, async () => {
+            asked = true;
+            return { kind: 'reject', feedback: 'not that one' };
+        }, 'prompt');
+        const decision = (await handler({
+            type: 'tool_review',
+            toolCalls: destructive,
+        }));
+        expect(asked).toBe(true);
+        expect(decision.action).toBe('reject_tools');
+        expect(decision.feedback).toBe('not that one');
+    });
+    it('read-only batches run under every mode, including strict', async () => {
+        // `strict` refuses what needs asking, and a read never needed asking.
+        // Refusing reads would make the mode unusable rather than strict.
+        const readOnly = [{ id: '1', name: 'read', input: {}, isDestructive: false }];
+        const handler = makeResumeHandler({ all: false }, undefined, 'strict');
+        expect(await handler({ type: 'tool_review', toolCalls: readOnly })).toEqual({
+            action: 'approve_tools',
+        });
+    });
+});
+//# sourceMappingURL=mode.test.js.map

package/dist/permissions/__tests__/mode.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mode.test.js","sourceRoot":"","sources":["../../../src/permissions/__tests__/mode.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC7E,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AACtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD,eAAe,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;AAEpC,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;IACjE,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QAChG,MAAM,CACL,qBAAqB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CACpF,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACtE,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;QAE1E,MAAM,CAAC,OAAO,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,qBAAqB,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YACnF,IAAI,EAAE,MAAM;SACZ,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC5E,mEAAmE;QACnE,kEAAkE;QAClE,MAAM,CAAC,qBAAqB,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QAChF,MAAM,CAAC,qBAAqB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IAChF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3D,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACzD,SAAS,IAAI,CAAC,MAAgD;QAC7D,MAAM,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;QAC5C,OAAO,IAAI,gBAAgB,CAC1B;YACC,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC;YACjB,kBAAkB,EAAE,KAAK;YACzB,qBAAqB,EAAE,KAAK;YAC5B,YAAY,EAAE,KAAK;SACnB,EACD,aAAa,EAAE,CACf,CAAA;IACF,CAAC;IAED,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC5D,uEAAuE;QACvE,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC;YAChD,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE;YACvC,OAAO,EAAE,SAAS;SAClB,CAAC,CAAA;QAEF,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC;YACpE,QAAQ,EAAE,MAAM;YAChB,SAAS,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE;YACpC,OAAO,EAAE,SAAS;SAClB,CAAC,CAAA;QAEF,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAC3D,MAAM,WAAW,GAAG;QACnB,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;KAChE,CAAA;IAEV,EAAE,CAAC,kBAAkB,EAAE,KAAK,IAAI,EAAE;QACjC,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;QAEpE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAW,CAAC,CAAA;QAExF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACvE,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;QAEtE,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC;YAC/B,IAAI,EAAE,aAAa;YACnB,SAAS,EAAE,WAAW;SACb,CAAC,CAAyC,CAAA;QAEpD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAC5C,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC9D,IAAI,KAAK,GAAG,KAAK,CAAA;QACjB,MAAM,OAAO,GAAG,iBAAiB,CAChC,EAAE,GAAG,EAAE,KAAK,EAAE,EACd,KAAK,IAAI,EAAE;YACV,KAAK,GAAG,IAAI,CAAA;YACZ,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAA;QACpD,CAAC,EACD,QAAQ,CACR,CAAA;QAED,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC;YAC/B,IAAI,EAAE,aAAa;YACnB,SAAS,EAAE,WAAW;SACb,CAAC,CAAyC,CAAA;QAEpD,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAC5C,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACzE,sEAAsE;QACtE,kEAAkE;QAClE,MAAM,QAAQ,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAU,CAAA;QACtF,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;QAEtE,MAAM,CAAC,MAAM,OAAO,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,EAAW,CAAC,CAAC,CAAC,OAAO,CAAC;YACpF,MAAM,EAAE,eAAe;SACvB,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/permissions/__tests__/rules.test.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The rule compiler.
+ *
+ * The load-bearing case is the LAST one: a tool nobody wrote a rule for must
+ * still be asked about. A declarative permission model that quietly widened the
+ * default would be a security downgrade wearing a feature's clothes, and it
+ * would look exactly like this change from the outside.
+ */
+export {};
+//# sourceMappingURL=rules.test.d.ts.map

package/dist/permissions/__tests__/rules.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.test.d.ts","sourceRoot":"","sources":["../../../src/permissions/__tests__/rules.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/permissions/__tests__/rules.test.js

@@ -0,0 +1,196 @@
+/**
+ * The rule compiler.
+ *
+ * The load-bearing case is the LAST one: a tool nobody wrote a rule for must
+ * still be asked about. A declarative permission model that quietly widened the
+ * default would be a security downgrade wearing a feature's clothes, and it
+ * would look exactly like this change from the outside.
+ */
+import { VerificationGate, configureLogger, getRootLogger } from '@namzu/sdk';
+import { describe, expect, it } from 'vitest';
+import { bySpecificity, compilePermissions, matchesPattern, patternToRegExpSource, } from '../rules.js';
+describe('pattern matching', () => {
+    it('matches a literal command exactly', () => {
+        expect(matchesPattern('git status', 'git status')).toBe(true);
+        expect(matchesPattern('git statuses', 'git status')).toBe(false);
+    });
+    it('lets * stand for any run of characters and ? for one', () => {
+        expect(matchesPattern('git push --force', 'git push*')).toBe(true);
+        expect(matchesPattern('cat a.ts', 'cat ?.ts')).toBe(true);
+        expect(matchesPattern('cat ab.ts', 'cat ?.ts')).toBe(false);
+    });
+    it('matches the bare command for a trailing " *"', () => {
+        // `git push *` is the obvious way to write "any git push". Without this
+        // the rule silently misses the exact invocation it was written for.
+        expect(matchesPattern('git push', 'git push *')).toBe(true);
+        expect(matchesPattern('git push origin main', 'git push *')).toBe(true);
+    });
+    it('treats a backslash path as its forward-slash self, both sides', () => {
+        // One rule has to work on every platform; an operator should not have to
+        // write the same path twice.
+        expect(matchesPattern('src\\index.ts', 'src/*.ts')).toBe(true);
+        expect(matchesPattern('src/index.ts', 'src\\*.ts')).toBe(true);
+    });
+    it('does not let a pattern character smuggle in a regex', () => {
+        // `.` is a literal dot, not "any character", or a rule meant to allow
+        // `a.ts` would also allow `axts`.
+        expect(matchesPattern('axts', 'a.ts')).toBe(false);
+        expect(matchesPattern('a.ts', 'a.ts')).toBe(true);
+        expect(patternToRegExpSource('a+b')).toBe('^a\\+b$');
+    });
+    it('anchors, so a pattern is not a substring search', () => {
+        expect(matchesPattern('sudo git status', 'git status')).toBe(false);
+    });
+});
+describe('specificity ordering', () => {
+    // The kernel evaluates first-match-wins, so order decides meaning: a bare
+    // `*` sorted first would make every rule after it dead config.
+    it('puts a bare star last', () => {
+        expect(['*', 'git push*', 'git status'].sort(bySpecificity)).toEqual([
+            'git status',
+            'git push*',
+            '*',
+        ]);
+    });
+    it('puts a longer literal prefix first', () => {
+        expect(['git*', 'git push*'].sort(bySpecificity)).toEqual(['git push*', 'git*']);
+    });
+    it('is stable for two patterns of equal specificity', () => {
+        expect(['b*', 'a*'].sort(bySpecificity)).toEqual(['a*', 'b*']);
+    });
+});
+describe('compiling a permissions table', () => {
+    it('turns a bare allow and deny into by-name rules', () => {
+        const { rules } = compilePermissions({ read: 'allow', bash: 'deny' });
+        expect(rules).toEqual([
+            { type: 'allow_by_name', toolNames: ['read'] },
+            { type: 'deny_by_name', toolNames: ['bash'] },
+        ]);
+    });
+    it('emits pattern rules most-specific-first', () => {
+        const { rules } = compilePermissions({ bash: { '*': 'deny', 'git status*': 'allow' } });
+        expect(rules.map((r) => ('decision' in r ? r.decision : r.type))).toEqual(['allow', 'deny']);
+    });
+    it('emits nothing for ask, because the gate already asks by default', () => {
+        // If "ask" emitted a rule it would have to mean something different from
+        // the absence of a rule, and it does not.
+        const { rules } = compilePermissions({ edit: 'ask', bash: { 'rm *': 'ask' } });
+        expect(rules).toEqual([]);
+    });
+    it('reports a bad effect instead of dropping it in silence', () => {
+        // A permission someone believes is in force and which was quietly
+        // discarded is the worst outcome here — worse than refusing to start.
+        const { rules, diagnostics } = compilePermissions({
+            bash: { 'git push*': 'maybe' },
+        });
+        expect(rules).toEqual([]);
+        expect(diagnostics).toHaveLength(1);
+        expect(diagnostics[0]?.tool).toBe('bash');
+        expect(diagnostics[0]?.pattern).toBe('git push*');
+    });
+    it('keeps the other rules when one line is unreadable', () => {
+        const { rules, diagnostics } = compilePermissions({
+            read: 'allow',
+            bash: 7,
+            glob: 'allow',
+        });
+        expect(rules).toHaveLength(2);
+        expect(diagnostics).toHaveLength(1);
+    });
+    it('a tool nobody wrote a rule for produces no rule, so the gate asks', () => {
+        // THE case. The kernel's fallback for an unmatched call is `review`, so
+        // emitting nothing is what makes an unconfigured or newly bridged tool
+        // prompt. There is deliberately no way to spell "allow by omission":
+        // widening the default has to be something an operator typed.
+        const { rules } = compilePermissions({ read: 'allow' });
+        expect(rules.some((r) => 'toolNames' in r && r.toolNames.includes('some_new_tool'))).toBe(false);
+        expect(rules).toHaveLength(1);
+    });
+    it('is empty for absent config, which is the same as asking about everything', () => {
+        expect(compilePermissions(undefined)).toEqual({ rules: [], diagnostics: [] });
+    });
+});
+configureLogger({ level: 'silent' });
+describe('the rules actually decide a real call', () => {
+    // The compiler tests above assert the SHAPE of the emitted rules. Shape is
+    // not behaviour: the first version of this compiler emitted `target: 'args'`
+    // with an anchored pattern, which matches `JSON.stringify(input)` — so
+    // `^git push.*$` could never match `{"command":"git push origin main"}` and
+    // every pattern rule decided nothing at all. It looked correct in every
+    // shape assertion. These drive the kernel's own gate instead.
+    function decide(config, tool, input) {
+        const { rules } = compilePermissions(config);
+        const gate = new VerificationGate({
+            enabled: true,
+            rules: [...rules],
+            allowReadOnlyTools: false,
+            denyDangerousPatterns: false,
+            logDecisions: false,
+        }, getRootLogger());
+        return gate.evaluate({ toolName: tool, toolInput: input, toolDef: undefined });
+    }
+    it('allows the command an operator allowed', () => {
+        expect(decide({ bash: { 'git status*': 'allow' } }, 'bash', { command: 'git status' }).decision).toBe('allow');
+    });
+    it('denies the command an operator denied', () => {
+        const result = decide({ bash: { 'git push*': 'deny' } }, 'bash', {
+            command: 'git push origin main',
+        });
+        expect(result.decision).toBe('deny');
+    });
+    it('does not let one tool rule decide another tool call', () => {
+        // A rule written under `bash` must not decide an `edit` call whose
+        // arguments happen to contain the same text. The kernel's pattern rules
+        // carry no tool scope, so this is the CLI's job and it is easy to lose.
+        const result = decide({ bash: { 'git push*': 'deny' } }, 'edit', {
+            content: 'run git push to deploy',
+        });
+        expect(result.decision).toBe('review');
+    });
+    it('asks about a tool nobody wrote a rule for', () => {
+        // The load-bearing case, driven end to end rather than inferred.
+        expect(decide({ read: 'allow' }, 'some_new_bridged_tool', { x: 1 }).decision).toBe('review');
+    });
+    it('prefers the specific rule over the catch-all, whatever the config order', () => {
+        const config = { bash: { '*': 'allow', 'git push*': 'deny' } };
+        expect(decide(config, 'bash', { command: 'git push --force' }).decision).toBe('deny');
+        expect(decide(config, 'bash', { command: 'ls' }).decision).toBe('allow');
+    });
+});
+describe('what a denial actually says to the model', () => {
+    // The decision was never the part that was broken. A model told only
+    // "denied" rewords the command and tries again; a model told WHICH rule
+    // stopped it, and whether a different input could ever pass, can stop and
+    // say so. These assert the sentence, not the verdict.
+    function reasonFor(config, tool, input) {
+        const { rules } = compilePermissions(config);
+        const gate = new VerificationGate({
+            enabled: true,
+            rules: [...rules],
+            allowReadOnlyTools: false,
+            denyDangerousPatterns: false,
+            logDecisions: false,
+        }, getRootLogger());
+        return gate.evaluate({ toolName: tool, toolInput: input, toolDef: undefined }).reason;
+    }
+    it('a by-name denial says the tool is refused, so a reworded input will not help', () => {
+        const reason = reasonFor({ bash: 'deny' }, 'bash', { command: 'ls' });
+        expect(reason).toContain('bash');
+        // The part that stops the retry loop.
+        expect(reason).toContain('a different input will not change it');
+    });
+    it('a pattern denial quotes the rule that matched', () => {
+        const reason = reasonFor({ bash: { 'git push*': 'deny' } }, 'bash', {
+            command: 'git push --force',
+        });
+        expect(reason).toContain('pattern rule');
+        // The model is shown the rule itself, not the name of its category, so
+        // it can tell which of its options are closed and which are not.
+        expect(reason).toContain('git push');
+    });
+    it('an unmatched call says nothing matched, rather than naming a rule', () => {
+        const reason = reasonFor({ read: 'allow' }, 'some_new_tool', {});
+        expect(reason).toBe('No matching rule found');
+    });
+});
+//# sourceMappingURL=rules.test.js.map

package/dist/permissions/__tests__/rules.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.test.js","sourceRoot":"","sources":["../../../src/permissions/__tests__/rules.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC7E,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EACN,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,qBAAqB,GACrB,MAAM,aAAa,CAAA;AAEpB,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7D,MAAM,CAAC,cAAc,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,cAAc,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClE,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzD,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACvD,wEAAwE;QACxE,oEAAoE;QACpE,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3D,MAAM,CAAC,cAAc,CAAC,sBAAsB,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACxE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACxE,yEAAyE;QACzE,6BAA6B;QAC7B,MAAM,CAAC,cAAc,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9D,MAAM,CAAC,cAAc,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC9D,sEAAsE;QACtE,kCAAkC;QAClC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClD,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjD,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,cAAc,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpE,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACrC,0EAA0E;IAC1E,+DAA+D;IAC/D,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,CAAC,GAAG,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;YACpE,YAAY;YACZ,WAAW;YACX,GAAG;SACH,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACzD,MAAM,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;QAErE,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;YACrB,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE;YAC9C,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE;SAC7C,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QAClD,MAAM,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;QAEvF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;IAC7F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QAC1E,yEAAyE;QACzE,0CAA0C;QAC1C,MAAM,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;QAE9E,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QACjE,kEAAkE;QAClE,sEAAsE;QACtE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,kBAAkB,CAAC;YACjD,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,EAAW;SACvC,CAAC,CAAA;QAEF,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACzB,MAAM,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QACnC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACzC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC5D,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,kBAAkB,CAAC;YACjD,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,CAAU;YAChB,IAAI,EAAE,OAAO;SACb,CAAC,CAAA;QAEF,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7B,MAAM,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC5E,wEAAwE;QACxE,uEAAuE;QACvE,qEAAqE;QACrE,8DAA8D;QAC9D,MAAM,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;QAEvD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAChG,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QACnF,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAA;IAC9E,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,eAAe,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;AAEpC,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACtD,2EAA2E;IAC3E,6EAA6E;IAC7E,uEAAuE;IACvE,4EAA4E;IAC5E,wEAAwE;IACxE,8DAA8D;IAC9D,SAAS,MAAM,CAAC,MAAgD,EAAE,IAAY,EAAE,KAAc;QAC7F,MAAM,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;QAC5C,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAChC;YACC,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC;YACjB,kBAAkB,EAAE,KAAK;YACzB,qBAAqB,EAAE,KAAK;YAC5B,YAAY,EAAE,KAAK;SACnB,EACD,aAAa,EAAE,CACf,CAAA;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAA;IAC/E,CAAC;IAED,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QACjD,MAAM,CACL,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,QAAQ,CACxF,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAChB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAChD,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE;YAChE,OAAO,EAAE,sBAAsB;SAC/B,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC9D,mEAAmE;QACnE,wEAAwE;QACxE,wEAAwE;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE;YAChE,OAAO,EAAE,wBAAwB;SACjC,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACpD,iEAAiE;QACjE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,uBAAuB,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC7F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QAClF,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,EAAW,CAAA;QACvE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACrF,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACzE,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACzD,qEAAqE;IACrE,wEAAwE;IACxE,0EAA0E;IAC1E,sDAAsD;IACtD,SAAS,SAAS,CACjB,MAAgD,EAChD,IAAY,EACZ,KAAc;QAEd,MAAM,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;QAC5C,MAAM,IAAI,GAAG,IAAI,gBAAgB,CAChC;YACC,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC;YACjB,kBAAkB,EAAE,KAAK;YACzB,qBAAqB,EAAE,KAAK;YAC5B,YAAY,EAAE,KAAK;SACnB,EACD,aAAa,EAAE,CACf,CAAA;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,CAAA;IACtF,CAAC;IAED,EAAE,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACvF,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QAErE,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QAChC,sCAAsC;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACxD,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE;YACnE,OAAO,EAAE,kBAAkB;SAC3B,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAA;QACxC,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC5E,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,EAAE,CAAC,CAAA;QAEhE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/permissions/mode.d.ts

@@ -0,0 +1,64 @@
+/**
+ * How a run resolves the calls no rule decided.
+ *
+ * The `[permissions]` table says what a tool may do. This says what happens to
+ * everything it did not cover. The two axes are separate on purpose: a rule is
+ * a durable statement an operator reviewed, and a mode is a property of ONE
+ * invocation — the difference between "we never force-push" and "this run is
+ * unattended".
+ *
+ * ## Precedence between a flag and the config file
+ *
+ * A mode only governs calls the gate routed to REVIEW. A rule that denied a
+ * call already stopped it, and a rule that allowed one never asked, so neither
+ * reaches the mode at all. **A mode can therefore never reopen what a rule
+ * closed, and `--permission-mode` cannot widen a `deny`.**
+ *
+ * That direction is deliberate. The config file is written once, read by
+ * whoever reviews the repository, and changed on purpose; a flag is typed in a
+ * hurry by someone who wants to get on with it. Letting the hurried thing
+ * overrule the considered one would make every `deny` in the file advisory, and
+ * a prohibition that a flag can lift is not a prohibition. The dangerous-pattern
+ * floor sits above both and no mode reaches it either.
+ */
+export type PermissionMode = 
+/** Ask a human. The default when a terminal is attached. */
+'prompt'
+/**
+ * Approve it. The default with no terminal, and what every headless run has
+ * always done — named here rather than left implicit.
+ */
+ | 'auto'
+/**
+ * Refuse it. Nothing runs unless a rule allowed it by name or pattern.
+ *
+ * The mode that did not exist before: an unattended run could previously
+ * only be `auto`, so a CI job either trusted the agent with everything or
+ * could not use it. This makes the allowlist the whole permission surface,
+ * which is the only form an unattended run can actually be reasoned about.
+ */
+ | 'strict';
+export declare const PERMISSION_MODES: readonly PermissionMode[];
+export declare function isPermissionMode(value: unknown): value is PermissionMode;
+/**
+ * The mode for a run, from the flag, the bypass alias, and whether anyone is
+ * there to answer.
+ *
+ * `--yolo` / `--dangerously-skip-permissions` map to `auto`. They were accepted
+ * and documented as doing nothing, which was true and unsatisfying; now they
+ * say the same thing the mode vocabulary says, and in the TUI they do what
+ * their name has always implied. Neither reaches a `deny` rule or the
+ * dangerous-pattern floor, so the name still overstates what it can do —
+ * deliberately, because it should read as more dangerous than it is rather than
+ * less.
+ */
+export declare function resolvePermissionMode(opts: {
+    readonly flag?: string | null;
+    readonly skipPermissions?: boolean;
+    readonly interactive: boolean;
+}): {
+    mode: PermissionMode;
+} | {
+    error: string;
+};
+//# sourceMappingURL=mode.d.ts.map

package/dist/permissions/mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mode.d.ts","sourceRoot":"","sources":["../../src/permissions/mode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,cAAc;AACzB,4DAA4D;AAC1D,QAAQ;AACV;;;GAGG;GACD,MAAM;AACR;;;;;;;GAOG;GACD,QAAQ,CAAA;AAEX,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAAiC,CAAA;AAEvF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAExE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAA;IAClC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAC7B,GAAG;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAa/C"}

package/dist/permissions/mode.js

@@ -0,0 +1,32 @@
+export const PERMISSION_MODES = ['prompt', 'auto', 'strict'];
+export function isPermissionMode(value) {
+    return typeof value === 'string' && PERMISSION_MODES.includes(value);
+}
+/**
+ * The mode for a run, from the flag, the bypass alias, and whether anyone is
+ * there to answer.
+ *
+ * `--yolo` / `--dangerously-skip-permissions` map to `auto`. They were accepted
+ * and documented as doing nothing, which was true and unsatisfying; now they
+ * say the same thing the mode vocabulary says, and in the TUI they do what
+ * their name has always implied. Neither reaches a `deny` rule or the
+ * dangerous-pattern floor, so the name still overstates what it can do —
+ * deliberately, because it should read as more dangerous than it is rather than
+ * less.
+ */
+export function resolvePermissionMode(opts) {
+    if (opts.flag != null && opts.flag !== '') {
+        if (!isPermissionMode(opts.flag)) {
+            return {
+                error: `--permission-mode must be one of: ${PERMISSION_MODES.join(', ')} (got "${opts.flag}")`,
+            };
+        }
+        return { mode: opts.flag };
+    }
+    if (opts.skipPermissions)
+        return { mode: 'auto' };
+    // No terminal means nobody to ask, so `prompt` would silently become `auto`
+    // anyway. Saying so here keeps the resolved mode honest in a log.
+    return { mode: opts.interactive ? 'prompt' : 'auto' };
+}
+//# sourceMappingURL=mode.js.map

package/dist/permissions/mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mode.js","sourceRoot":"","sources":["../../src/permissions/mode.ts"],"names":[],"mappings":"AAyCA,MAAM,CAAC,MAAM,gBAAgB,GAA8B,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;AAEvF,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,gBAAsC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAC5F,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAIrC;IACA,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QAC3C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,OAAO;gBACN,KAAK,EAAE,qCAAqC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,IAAI;aAC9F,CAAA;QACF,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,CAAC;IACD,IAAI,IAAI,CAAC,eAAe;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IACjD,4EAA4E;IAC5E,kEAAkE;IAClE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;AACtD,CAAC"}

package/dist/permissions/rules.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Operator-authored tool permissions, compiled to the kernel's rule vocabulary.
+ *
+ * The kernel already has the engine — `VerificationRule[]` with an
+ * allow/deny/review decision, evaluated first-match-wins. What was missing was
+ * any way for a person to author those rules: the CLI passed `rules: []`, so a
+ * gate with seven rule types ran with none of them and every decision fell back
+ * to "ask a human". This turns a `[permissions]` table into that array.
+ *
+ * The whole surface is pure: config in, rules out. The gate stays the only
+ * thing that decides anything, which is what keeps this testable without a run.
+ */
+import type { VerificationRule } from '@namzu/sdk';
+/** What the operator wants to happen when a rule matches. */
+export type PermissionEffect = 'allow' | 'ask' | 'deny';
+export declare function isPermissionEffect(value: unknown): value is PermissionEffect;
+/**
+ * One tool's policy: a single effect for every call, or per-argument patterns.
+ *
+ * `bash = "ask"` and
+ * `bash = { "git status*" = "allow", "*" = "ask" }`
+ * are both meant to be readable by someone who has never seen this file before,
+ * which is the whole point of putting it in config rather than in code.
+ */
+export type ToolPermission = PermissionEffect | Readonly<Record<string, PermissionEffect>>;
+export type PermissionsConfig = Readonly<Record<string, ToolPermission>>;
+export interface CompileDiagnostic {
+    readonly tool: string;
+    readonly pattern?: string;
+    readonly message: string;
+}
+export interface CompiledPermissions {
+    readonly rules: readonly VerificationRule[];
+    /**
+     * What was wrong with the config, for the caller to print.
+     *
+     * Collected rather than thrown: one unreadable line should cost that line,
+     * not the other nine rules an operator wrote. But it must be SAID — a
+     * permission someone believes is in force and which was silently dropped is
+     * the worst outcome available here, worse than refusing to start.
+     */
+    readonly diagnostics: readonly CompileDiagnostic[];
+}
+/**
+ * Turn a glob-ish pattern into an anchored regex source.
+ *
+ * `*` matches any run of characters, `?` exactly one; everything else is
+ * literal. Backslashes become forward slashes on both sides so one rule works
+ * on every platform — an operator writing `src/*` should not have to write it
+ * twice.
+ *
+ * A pattern ending in `<space>*` also matches the bare command: `git push *`
+ * covers `git push`. Without that, the obvious rule silently misses the exact
+ * invocation it was written to catch, which is the failure this whole file
+ * exists to stop.
+ */
+export declare function patternToRegExpSource(pattern: string): string;
+/**
+ * A pattern that matches this tool, and only this tool, doing this thing.
+ *
+ * The kernel's `custom_pattern` has no tool scope: `target: 'args'` tests
+ * `JSON.stringify(input)` for ANY tool, so a rule written under `bash` would
+ * also decide an `edit` call whose arguments happened to match. `target:
+ * 'both'` tests `` `${toolName} ${JSON.stringify(input)}` ``, so the tool name
+ * can be pinned by writing it into the pattern — which is what this does.
+ *
+ * The argument half is deliberately unanchored on both sides, because the
+ * operator writes `git push*` while the gate sees
+ * `bash {"command":"git push origin main"}`. An anchored argument pattern would
+ * match nothing at all — a rule that reads like a prohibition and silently
+ * permits everything, which is worse than having no rule.
+ *
+ * The looseness is real and worth naming: a pattern can match text in any
+ * argument field, not only the one the operator had in mind. Narrowing that
+ * needs a rule type that names the argument, which is the kernel's to add.
+ */
+export declare function toolScopedPattern(tool: string, pattern: string): string;
+/** Whether `input` satisfies `pattern`, with the matching above. */
+export declare function matchesPattern(input: string, pattern: string): boolean;
+/**
+ * Order patterns so the most specific is tried first.
+ *
+ * The kernel evaluates first-match-wins, so `bash = { "*" = "ask", "git push*"
+ * = "deny" }` would otherwise resolve to `ask` and the deny would be dead —
+ * config that reads like a prohibition and is not one. Sorting here means an
+ * operator does not have to know the evaluation order to write what they mean.
+ *
+ * "Specific" is: a bare `*` is always last, then longer literal prefixes before
+ * shorter ones, then alphabetical so the result is stable to read and to test.
+ */
+export declare function bySpecificity(a: string, b: string): number;
+/**
+ * Compile a `[permissions]` table into kernel rules.
+ *
+ * `ask` emits nothing. That is not an omission: the gate's fallback for an
+ * unmatched call is already `review`, so the rule that says "ask" and the
+ * absence of any rule have to mean the same thing or the config would be
+ * lying about one of them. It also keeps the emitted array small enough for a
+ * person to read in a log.
+ *
+ * A tool nobody wrote a rule for is therefore asked about, and there is no way
+ * to spell "allow everything by omission" — the only way to widen is to say so.
+ */
+export declare function compilePermissions(config: PermissionsConfig | undefined): CompiledPermissions;
+//# sourceMappingURL=rules.d.ts.map

package/dist/permissions/rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../src/permissions/rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,6DAA6D;AAC7D,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAA;AAIvD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAE5E;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAA;AAE1F,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAA;AAExE,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,KAAK,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAC3C;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,iBAAiB,EAAE,CAAA;CAClD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAQ7D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAIvE;AAMD,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAKtE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAU1D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,GAAG,SAAS,GAAG,mBAAmB,CAgD7F"}