@ordewell/core 0.8.1 → 0.9.0

package/dist/index.js

@@ -57,6 +57,7 @@ __export(index_exports, {
   DAEMON_SUBPROTOCOL: () => DAEMON_SUBPROTOCOL,
   DAEMON_TOKEN_SUBPROTOCOL_PREFIX: () => DAEMON_TOKEN_SUBPROTOCOL_PREFIX,
   DEFAULT_MAX_PARALLEL: () => DEFAULT_MAX_PARALLEL,
+  DEFAULT_PLANNER_ALLOWLIST: () => DEFAULT_PLANNER_ALLOWLIST,
   DEFAULT_RUNNERS: () => DEFAULT_RUNNERS,
   DENY_ALL: () => DENY_ALL,
   EMPTY_CONVERSATION: () => EMPTY_CONVERSATION,
@@ -193,6 +194,7 @@ __export(index_exports, {
   coerceAssignments: () => coerceAssignments,
   collectDirectDependencyOutputs: () => collectDirectDependencyOutputs,
   collectProviderCredentials: () => collectProviderCredentials,
+  commandAllowedBy: () => commandAllowedBy,
   composeAugmentedPrompt: () => composeAugmentedPrompt,
   composeContinuationPrompt: () => composeContinuationPrompt,
   configuredProviders: () => configuredProviders,
@@ -219,6 +221,7 @@ __export(index_exports, {
   discoverGeminiModels: () => discoverGeminiModels,
   drainNext: () => drainNext,
   effectiveAllowlist: () => effectiveAllowlist,
+  effectiveApprovalMode: () => effectiveApprovalMode,
   emptyWarnings: () => emptyWarnings,
   enabledRunners: () => enabledRunners,
   ensureDir: () => ensureDir,
@@ -301,6 +304,8 @@ __export(index_exports, {
   outputLines: () => outputLines,
   outputPreview: () => outputPreview,
   ownerOnlyConfigFile: () => ownerOnlyConfigFile,
+  parseAllowlist: () => parseAllowlist,
+  parseApprovalModeSetting: () => parseApprovalModeSetting,
   parseAutonomyLevel: () => parseAutonomyLevel,
   parseMaxParallel: () => parseMaxParallel,
   parsePartialPlan: () => parsePartialPlan,
@@ -358,6 +363,7 @@ __export(index_exports, {
   savePrdMarkdown: () => savePrdMarkdown,
   saveSession: () => saveSession,
   saveState: () => saveState,
+  scopeAllowed: () => scopeAllowed,
   serializePlan: () => serializePlan,
   serializeTask: () => serializeTask,
   serializeTaskStatus: () => serializeTaskStatus,
@@ -395,6 +401,7 @@ __export(index_exports, {
   toTaskLogEvent: () => toTaskLogEvent,
   tokenSubprotocols: () => tokenSubprotocols,
   tokensMatch: () => tokensMatch,
+  toolAllowed: () => toolAllowed,
   toolHeadline: () => toolHeadline,
   trimToolOutput: () => trimToolOutput,
   truncateCheckpointSummary: () => truncateCheckpointSummary,
@@ -1149,7 +1156,7 @@ function ansiCQuoteEnd(s, start) {
 function backtickBody(body, dialect) {
   return dialect.escape === "\\" ? body.replace(/\\([$`\\])/g, "$1") : body;
 }
-function skipHereDocuments(s, start, docs, nested, dialect) {
+function skipHereDocuments(s, start, docs, nested2, dialect) {
   let pos = start;
   for (const doc of docs) {
     const bodyStart = pos;
@@ -1176,19 +1183,19 @@ function skipHereDocuments(s, start, docs, nested, dialect) {
       if (body[i] === "$" && body[i + 1] === "(") {
         const close = matchParen(body, i + 1, dialect);
         if (close < 0) return close;
-        nested.push(body.slice(i + 2, close));
+        nested2.push(body.slice(i + 2, close));
         i = close;
       } else if (body[i] === "`") {
         const close = matchBacktick(body, i, dialect);
         if (close < 0) return -1;
-        nested.push(backtickBody(body.slice(i + 1, close), dialect));
+        nested2.push(backtickBody(body.slice(i + 1, close), dialect));
         i = close;
       }
     }
   }
   return pos;
 }
-function lex(command, nested, dialect) {
+function lex(command, nested2, dialect) {
   const segments = [];
   let unsafeRedirect;
   let processSubstitution = false;
@@ -1202,6 +1209,7 @@ function lex(command, nested, dialect) {
   let bareSegment = false;
   let tokens = [];
   let expandable = false;
+  let globbed = false;
   let current = "";
   let started = false;
   let piped = false;
@@ -1265,7 +1273,7 @@ function lex(command, nested, dialect) {
         followable = false;
         bareSegment = true;
       }
-      segments.push({ ...seg, expandable, stdinRedirected, inputs, joinedBy });
+      segments.push({ ...seg, expandable, globbed, stdinRedirected, inputs, joinedBy });
     } else if (!last || segments.length > 0 || joinedBy !== void 0) {
       followable = false;
       bareSegment = true;
@@ -1273,6 +1281,7 @@ function lex(command, nested, dialect) {
     tokens = [];
     inputs = [];
     expandable = false;
+    globbed = false;
     stdinRedirected = false;
     piped = nextPiped;
     joinedBy = next;
@@ -1311,7 +1320,7 @@ function lex(command, nested, dialect) {
         unbalanced = true;
         break;
       }
-      nested.push(command.slice(i + 2, close));
+      nested2.push(command.slice(i + 2, close));
       current += command.slice(i, close + 1);
       started = true;
       expandable = true;
@@ -1324,7 +1333,7 @@ function lex(command, nested, dialect) {
         unbalanced = true;
         break;
       }
-      nested.push(backtickBody(command.slice(i + 1, close), dialect));
+      nested2.push(backtickBody(command.slice(i + 1, close), dialect));
       current += command.slice(i, close + 1);
       started = true;
       expandable = true;
@@ -1455,7 +1464,7 @@ function lex(command, nested, dialect) {
       endSegment(false, c === "&" && command[i + 1] === "&" ? "and" : "other");
       if (c === "\n") inComment = false;
       if (c === "\n" && hereDocs.length > 0) {
-        const end = skipHereDocuments(command, i + 1, hereDocs.splice(0), nested, dialect);
+        const end = skipHereDocuments(command, i + 1, hereDocs.splice(0), nested2, dialect);
         if (end === UNREADABLE) {
           unreadable = true;
           break;
@@ -1483,6 +1492,7 @@ function lex(command, nested, dialect) {
     else if (c === "{") braceOpen = true;
     else if (braceOpen && (c === "," || c === "." && command[i + 1] === ".")) braceList = true;
     else if (braceOpen && braceList && c === "}") expandable = true;
+    else if (c === "*" || c === "?" || c === "[") globbed = true;
     current += c;
     started = true;
     i++;
@@ -1518,8 +1528,10 @@ function toSegment(tokens, piped, dialect) {
     piped,
     stdinRedirected: false,
     expandable: false,
+    globbed: false,
     inputs: [],
     ...first !== void 0 && isComputedWord(first, dialect) ? { computedBinary: first } : {},
+    ...first !== void 0 && /[/\\]/.test(first) ? { binaryPath: first } : {},
     ...ambiguousCmdName !== void 0 ? { ambiguousCmdName } : {}
   };
 }
@@ -1808,7 +1820,7 @@ function unwrapXargs(seg, dialect) {
   if (replace && tokens[0].includes(replace)) {
     return { reason: `"xargs" substitutes its input into "${tokens[0]}", so the input decides which program runs. Name the program directly.` };
   }
-  return { seg: { ...toSegment(tokens, false, dialect), expandable: seg.expandable } };
+  return { seg: { ...toSegment(tokens, false, dialect), expandable: seg.expandable, globbed: seg.globbed } };
 }
 function unwrap(seg, dialect) {
   const wrappers = [];
@@ -1839,7 +1851,7 @@ function unwrap(seg, dialect) {
     wrappers.push(current.binary);
     const inner = toSegment(scan.tokens, current.piped, dialect);
     assignments.push(...inner.assignments);
-    current = { ...inner, assignments: [], expandable: current.expandable, stdinRedirected: current.stdinRedirected };
+    current = { ...inner, assignments: [], expandable: current.expandable, globbed: current.globbed, stdinRedirected: current.stdinRedirected };
   }
   return { seg: { ...current, assignments }, wrappers, runner };
 }
@@ -3690,6 +3702,340 @@ function awkProgramHazard(program) {
   return void 0;
 }
 
+// src/services/plannerAllowlist.ts
+var MUTATING_VERB = /^(abort|ack|activate|add|apply|approve|archive|assign|attach|bind|call|cancel|clear|clone|close|commit|copy|cp|create|deactivate|delete|deploy|destroy|detach|disable|download|drain|drop|dump|edit|enable|evict|exec|execute|expire|export|failover|flush|grant|import|insert|install|invoke|kill|label|lock|login|logout|merge|migrate|modify|move|mv|patch|pause|promote|publish|pull|purge|push|put|reboot|redeploy|register|reject|release|remove|rename|reopen|replace|request|reset|resize|restart|restore|resume|revoke|rm|rollback|rotate|run|scale|scp|send|set|ssh|start|stop|submit|suspend|sync|rsync|tag|taint|terminate|transfer|truncate|undelete|uninstall|unlock|unregister|unset|untag|update|upgrade|upload|write)([-_:.].*)?$/i;
+function globRegExp(glob, flags = "") {
+  const escaped = glob.split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*");
+  return new RegExp(`^${escaped}$`, flags);
+}
+function ruleWord(pattern) {
+  if (!pattern.includes("*")) return { matches: (word) => word === pattern, wildcard: false };
+  const re = globRegExp(pattern);
+  return { matches: (word) => re.test(word), wildcard: true };
+}
+function exclusionWord(pattern) {
+  const re = /^-[A-Za-z]$/.test(pattern) ? new RegExp(`^-[A-Za-z]*${pattern[1]}`) : globRegExp(pattern, "i");
+  return { matches: (word) => re.test(word), wildcard: pattern.includes("*") };
+}
+function isScopePattern(entry) {
+  return /^(\/|~|https?:\/\/|mcp__|[A-Za-z]:[\\/])/.test(entry);
+}
+function parseAllowlist(entries) {
+  const list = { commands: [], commandExclusions: [], tools: [], toolExclusions: [], scopes: [], scopeExclusions: [] };
+  for (const raw of entries) {
+    const exclude = raw.trim().startsWith("!");
+    const entry = raw.trim().replace(/^!\s*/, "");
+    if (!entry) continue;
+    if (entry.startsWith("mcp:")) {
+      (exclude ? list.toolExclusions : list.tools).push(globRegExp(entry.slice(4).trim(), "i"));
+    } else if (isScopePattern(entry)) {
+      (exclude ? list.scopeExclusions : list.scopes).push(globRegExp(entry));
+    } else {
+      const [binary, ...words] = entry.split(/\s+/);
+      (exclude ? list.commandExclusions : list.commands).push({ text: raw.trim(), binary, words: words.map(exclude ? exclusionWord : ruleWord) });
+    }
+  }
+  return list;
+}
+function leadingWords(args) {
+  const lead = [];
+  for (const arg of args) {
+    if (arg.startsWith("-")) break;
+    lead.push(arg);
+  }
+  return lead;
+}
+function ruleCovers(rule, command) {
+  if (rule.binary !== command.binary) return false;
+  const lead = leadingWords(command.args);
+  if (lead.length < rule.words.length || rule.words.length < (command.scopeWords ?? 0)) return false;
+  return rule.words.every((word, i) => word.matches(lead[i]) && !(word.wildcard && MUTATING_VERB.test(lead[i])));
+}
+function exclusionCovers(rule, command) {
+  if (rule.binary !== "*" && rule.binary !== command.binary) return false;
+  let next = 0;
+  for (const arg of command.args) {
+    if (next < rule.words.length && rule.words[next].matches(arg)) next += 1;
+  }
+  return next === rule.words.length;
+}
+function commandAllowedBy(list, command) {
+  if (list.commandExclusions.some((rule) => exclusionCovers(rule, command))) return void 0;
+  return list.commands.find((rule) => ruleCovers(rule, command))?.text;
+}
+function toolAllowed(list, tool2) {
+  if (list.toolExclusions.some((re) => re.test(tool2))) return false;
+  return list.tools.some((re) => re.test(tool2));
+}
+function scopeAllowed(list, scope) {
+  if (list.scopeExclusions.some((re) => re.test(scope))) return false;
+  return list.scopes.some((re) => re.test(scope)) || list.commands.some((rule) => rule.text === scope);
+}
+function withArgument(binary, verbs) {
+  return verbs.flatMap((verb) => [`${binary} ${verb}`, `${binary} ${verb} *`]);
+}
+function nested(binary, verbs, depth) {
+  return verbs.flatMap((verb) => Array.from({ length: depth }, (_, i) => [binary, ...Array(i).fill("*"), verb].join(" ")));
+}
+var KUBE_VERB_READS = ["get", "describe", "logs", "top", "explain", "events"];
+var KUBE_READS = [
+  "api-resources",
+  "api-versions",
+  "version",
+  "cluster-info",
+  "auth can-i",
+  "auth whoami",
+  "config get-contexts",
+  "config current-context",
+  "config get-clusters",
+  "rollout status",
+  "rollout history"
+];
+var CONTAINER_VERB_READS = ["ps", "images", "inspect", "logs", "history", "top", "port"];
+var CONTAINER_READS = [
+  "version",
+  "info",
+  "image ls",
+  "image list",
+  "image inspect",
+  "image history",
+  "container ls",
+  "container list",
+  "container inspect",
+  "container logs",
+  "network ls",
+  "network inspect",
+  "volume ls",
+  "volume inspect",
+  "context ls",
+  "context list"
+];
+var DEFAULT_PLANNER_ALLOWLIST = [
+  // GitHub, GitLab, Jira
+  ...[
+    "issue list",
+    "issue view",
+    "issue status",
+    "pr list",
+    "pr view",
+    "pr diff",
+    "pr checks",
+    "pr status",
+    "run list",
+    "run view",
+    "workflow list",
+    "workflow view",
+    "repo view",
+    "repo list",
+    "search",
+    "label list",
+    "search *",
+    "status",
+    "cache list",
+    "project list",
+    "project view",
+    "project item-list",
+    "gist list",
+    "gist view",
+    "variable list",
+    "ruleset list",
+    "ruleset view",
+    "org list"
+  ].map((c) => `gh ${c}`),
+  ...[
+    "issue list",
+    "issue view",
+    "mr list",
+    "mr view",
+    "mr diff",
+    "ci list",
+    "ci status",
+    "repo view",
+    "release list",
+    "release view"
+  ].map((c) => `glab ${c}`),
+  ...["issue list", "issue view", "sprint list", "epic list", "project list"].map((c) => `jira ${c}`),
+  "!gh -w",
+  "!glab -w",
+  // Azure: `az` takes no positional arguments, so a group path is always groups then verb.
+  ...nested("az", ["list", "show"], 5),
+  "az version",
+  "az lock list",
+  "az tag list",
+  "az monitor log-analytics query",
+  "az monitor app-insights query",
+  "!az *keys*",
+  "!az *secret*",
+  "!az *credential*",
+  "!az *password*",
+  "!az *connection-string*",
+  "!az *appsettings*",
+  "!az *token*",
+  // Google Cloud. `run` is spelled out: a wildcard never stands for it.
+  ...nested("gcloud", ["list", "describe", "get-iam-policy"], 5),
+  "gcloud run * list",
+  "gcloud run * * list",
+  "gcloud run * describe",
+  "gcloud run * * describe",
+  "gcloud config list",
+  "gcloud config get",
+  "gcloud config get-value",
+  "gcloud auth list",
+  "gcloud logging read",
+  "gcloud info",
+  "gcloud version",
+  ...["ls", "du"].map((c) => `gsutil ${c}`),
+  ...["ls", "show", "head"].map((c) => `bq ${c}`),
+  "!gcloud *secret*",
+  "!gcloud *token*",
+  // AWS: always `aws <service> <operation>`.
+  "aws * describe-*",
+  "aws * list-*",
+  "aws s3 ls",
+  "aws sts get-caller-identity",
+  "aws configure list",
+  "aws logs filter-log-events",
+  "aws logs get-log-events",
+  "aws cloudwatch get-metric-data",
+  "aws cloudwatch get-metric-statistics",
+  "aws ce get-cost-and-usage",
+  "aws iam get-user",
+  "aws iam get-role",
+  "!aws secretsmanager",
+  "!aws *secret*",
+  // Other clouds and platforms
+  ...nested("doctl", ["list", "get"], 3),
+  "doctl account get",
+  "!doctl -u",
+  ...nested("hcloud", ["list", "describe"], 2),
+  ...nested("linode-cli", ["list", "view"], 2),
+  ...nested("oci", ["list"], 4),
+  ...[
+    "status",
+    "releases",
+    "apps list",
+    "machine list",
+    "machines list",
+    "secrets list",
+    "regions list",
+    "ips list",
+    "volumes list"
+  ].flatMap((c) => [`fly ${c}`, `flyctl ${c}`]),
+  ...["apps", "apps:info", "ps", "logs", "releases", "addons", "domains", "pipelines"].map((c) => `heroku ${c}`),
+  ...["ls", "list", "inspect", "logs", "env ls", "domains ls", "project ls", "whoami"].map((c) => `vercel ${c}`),
+  "netlify status",
+  "netlify sites:list",
+  "firebase projects:list",
+  "firebase apps:list",
+  "firebase hosting:channel:list",
+  "wrangler whoami",
+  "wrangler deployments list",
+  "wrangler d1 list",
+  "wrangler kv namespace list",
+  "supabase projects list",
+  "supabase functions list",
+  "railway status",
+  // Kubernetes and friends. A kubeconfig the command names can run a credential plugin; `--raw` reads any API path.
+  ...withArgument("kubectl", KUBE_VERB_READS),
+  ...KUBE_READS.map((c) => `kubectl ${c}`),
+  ...[...KUBE_VERB_READS, ...KUBE_READS, "status", "whoami", "projects"].map((c) => `oc ${c}`),
+  ...["kubectl", "oc"].flatMap((bin) => ["*secret*", "-s", "dump", "--raw*", "-k", "--kustomize*"].map((w) => `!${bin} ${w}`)),
+  "!oc whoami -t",
+  "!oc *show-token*",
+  ...withArgument("helm", ["list", "ls", "status", "history", "search"]),
+  "helm version",
+  "!helm --kube*",
+  "eksctl get",
+  "kind get",
+  "k3d cluster list",
+  "minikube status",
+  "minikube profile list",
+  "!kind *kubeconfig*",
+  "argocd app list",
+  "argocd app get",
+  "argocd app history",
+  "istioctl analyze",
+  "istioctl proxy-status",
+  "istioctl version",
+  "!istioctl -c",
+  "nomad status",
+  "nomad job status",
+  "consul members",
+  "consul catalog services",
+  "vault status",
+  // Containers. Not `compose`, which reads the repository's compose file, remote includes and all.
+  ...["docker", "podman"].flatMap((bin) => [...withArgument(bin, CONTAINER_VERB_READS), ...CONTAINER_READS.map((c) => `${bin} ${c}`), `!${bin} -H`]),
+  // Infrastructure as code: only what reads no backend, whose address the repository's config sets.
+  ...["version", "workspace show"].flatMap((c) => [`terraform ${c}`, `tofu ${c}`]),
+  // Package metadata from what is installed: npm reads `node_modules`, pip its own environment.
+  ...withArgument("npm", ["ls", "list", "why", "explain"]),
+  ...["pip", "pip3"].flatMap((bin) => [...withArgument(bin, ["show"]), `${bin} list`, `${bin} freeze`, `!${bin} -i`, `!${bin} -f`]),
+  // A module query (`@latest`) fetches from whatever host the module path names.
+  ...withArgument("go", ["list", "env"]),
+  "go version",
+  "go mod graph",
+  "go mod why",
+  "!go -w",
+  "!go -u",
+  "!go -mod*",
+  "!go *-toolexec*",
+  "!go *-exec*",
+  "!go *-compiled*",
+  "!go *-export*",
+  "!go *@*",
+  // The local machine
+  "ps",
+  "lsof",
+  "uptime",
+  "free",
+  "nproc",
+  "hostname",
+  "id",
+  "journalctl",
+  "!journalctl --vacuum*",
+  "!journalctl --rotate",
+  "!journalctl --flush",
+  "!journalctl --sync",
+  "!journalctl --relinquish*",
+  "!journalctl --smart-relinquish*",
+  "!journalctl --setup-keys",
+  "!journalctl --update-catalog",
+  "!hostname *",
+  // Anything that would write a file, open a browser, or send the user's credentials to an address the command names.
+  ...[
+    "--output-file*",
+    "--out-file*",
+    "--outfile*",
+    "--output-document*",
+    "--output-directory*",
+    "--log-file*",
+    "--logfile*",
+    "--download*",
+    "--show-secrets*",
+    "--with-decryption*",
+    "--reveal*",
+    "--web",
+    "--server*",
+    "*-addr*",
+    "--endpoint*",
+    "--api-url*",
+    "--url*",
+    "--host*",
+    "--registry*",
+    "--index-url*",
+    "--extra-index-url*",
+    "--find-links*",
+    "--proxy*",
+    "--kubeconfig*",
+    "*apiserver*",
+    "*http://*",
+    "*https://*"
+  ].map((w) => `!* ${w}`),
+  // MCP tools that read: the verb leads the tool's own name.
+  ...["get*", "list*", "find*", "search*", "read*", "view*", "describe*", "show*"].map((v) => `mcp:${v}`),
+  ...["*secret*", "*token*", "*password*", "*credential*", "*key*", "*url*", "*fetch*", "*http*"].map((w) => `!mcp:${w}`)
+];
+
 // src/services/commandPolicy.ts
 var AUTO_COMMANDS = [
   "ls",
@@ -4123,18 +4469,20 @@ function patternArgs(seg) {
 }
 var SCOPE_LEAD_ARGS = 2;
 function scopeFor(seg) {
-  if (!MULTIPLEXERS.includes(seg.binary.toLowerCase())) return seg.binary;
+  const name = seg.binaryPath ?? seg.binary;
+  if (!MULTIPLEXERS.includes(seg.binary.toLowerCase())) return name;
   const lead = [];
   for (const arg of seg.args) {
     if (arg.startsWith("-")) break;
     lead.push(arg);
     if (lead.length === SCOPE_LEAD_ARGS) break;
   }
-  return [seg.binary, ...lead].join(" ");
+  return [name, ...lead].join(" ");
 }
 function isAuto(seg, opts) {
   if (seg.binary === "cd") return !opts.cdpathSet && !seg.cdSteered && literalCdTarget(seg) !== void 0;
   if (!AUTO_COMMANDS.includes(seg.binary)) return false;
+  if (seg.binaryPath !== void 0) return false;
   if (seg.expandable) return false;
   if (seg.binary !== "git") return true;
   const sub = subcommandOf(seg);
@@ -4321,7 +4669,18 @@ function classifyCommand(command, opts = {}) {
     return { tier: "ask", scope: trimmed };
   }
   const scope = [...new Set(nonAuto.map((u) => u.runner ? `${u.runner} ${scopeFor(u.seg)}` : scopeFor(u.seg)))].sort().join(" + ");
-  return { tier: "ask", scope };
+  const allowedBy = opts.allow ? allowlistRule(nonAuto, opts.allow) : void 0;
+  return { tier: "ask", scope, ...allowedBy ? { allowedBy } : {} };
+}
+function allowlistRule(parts, allow) {
+  const rules = [];
+  for (const { seg, runner } of parts) {
+    if (runner || seg.expandable || seg.globbed || seg.binaryPath !== void 0 || seg.assignments.length > 0) return void 0;
+    const rule = commandAllowedBy(allow, { binary: seg.binary, args: seg.args, scopeWords: scopeFor(seg).split(" ").length - 1 });
+    if (!rule) return void 0;
+    rules.push(rule);
+  }
+  return [...new Set(rules)].join(" + ");
 }
 
 // src/services/researchShell.ts
@@ -4637,7 +4996,8 @@ ${refs.output.trim()}`);
    * directory the next command names.
    */
   async bash(command, signal) {
-    const { tier, scope, reason } = classifyCommand(command, this.policyOptions());
+    const allow = this.approval.allowlist?.();
+    const { tier, scope, reason, allowedBy } = classifyCommand(command, { ...this.policyOptions(), ...allow ? { allow } : {} });
     if (tier === "refuse") {
       return { success: false, output: `Command refused: ${reason}`, truncated: false };
     }
@@ -4652,13 +5012,14 @@ ${refs.output.trim()}`);
         subject: asks ? command : outside[0].abs,
         scope: scopes[0],
         ...scopes.length > 1 ? { scopes } : {},
+        ...asks && allowedBy ? { allowedBy } : {},
         detail: outside.length > 0 ? `Planner research wants to run "${command}", which touches ${touched}, outside the workspace (${root}).` : `Planner research wants to run: ${command}`
       });
       if (!granted) {
         return {
           success: false,
           output: outside.length > 0 ? `Access denied: "${command}" touches ${touched}, outside the workspace root (${root}), and was not approved. Keep research inside the workspace, or ask the user to approve this location.` : `Command not approved: ${command}
-It is outside the auto-allowed read-only set (${scope}). Continue with the read-only research tools, or ask the user to approve it.`,
+It is outside the auto-allowed read-only set and the planner allowlist (${scope}). Continue without it. If it would change something outside the repository, add it to the plan as an ops task; if it only reads, ask the user to approve it or add it to the planner allowlist.`,
           truncated: false
         };
       }
@@ -4886,14 +5247,19 @@ async function runTool(name, args, fs17, fetcher, signal) {
 }
 
 // src/services/ApprovalPolicy.ts
-function scopeMatches(pattern, scope) {
-  if (pattern === scope) return true;
-  if (pattern.endsWith("*")) return scope.startsWith(pattern.slice(0, -1));
-  return false;
+function effectiveApprovalMode(setting, autonomous) {
+  if (setting !== "auto") return setting;
+  return autonomous ? "deny" : "ask";
+}
+function parseApprovalModeSetting(raw) {
+  const value = (raw ?? "").trim().toLowerCase();
+  if (value === "allowlist") return "deny";
+  return value === "ask" || value === "allow" || value === "deny" ? value : "auto";
 }
 var ApprovalPolicy = class {
-  mode;
-  preApproved;
+  modeOf;
+  entriesOf;
+  parsed = null;
   asker;
   onDecision;
   granted = /* @__PURE__ */ new Set();
@@ -4905,8 +5271,9 @@ var ApprovalPolicy = class {
   // generation it was started under and bails if reset has intervened.
   generation = 0;
   constructor(opts = {}) {
-    this.mode = opts.mode ?? "ask";
-    this.preApproved = opts.preApproved ?? [];
+    const { mode = "ask", preApproved = [] } = opts;
+    this.modeOf = typeof mode === "function" ? mode : () => mode;
+    this.entriesOf = typeof preApproved === "function" ? preApproved : () => preApproved;
     this.asker = opts.ask;
     this.onDecision = opts.onDecision;
   }
@@ -4917,19 +5284,19 @@ var ApprovalPolicy = class {
     };
     const scopes = approvalScopes(req);
     const key = scopes.join("\n");
-    if (scopes.some((s) => this.refused.has(s)) || this.refused.has(key)) return decide(false, "remembered");
-    const open = scopes.filter((s) => !this.granted.has(s) && !this.preApproved.some((p) => scopeMatches(p, s)));
+    const list = this.allowlist();
+    const preApproved = (scope, i) => scopeAllowed(list, scope) || i === 0 && (req.kind === "shell_command" && req.allowedBy !== void 0 || req.kind === "mcp_tool" && req.tool !== void 0 && toolAllowed(list, req.tool));
+    const open = scopes.filter((s, i) => !this.granted.has(s) && !preApproved(s, i));
     if (open.length === 0) {
       return decide(true, scopes.every((s) => this.granted.has(s)) ? "remembered" : "pre-approved");
     }
-    if (this.mode === "allow") {
+    if (scopes.some((s) => this.refused.has(s)) || this.refused.has(key)) return decide(false, "remembered");
+    const mode = this.modeOf();
+    if (mode === "allow") {
       open.forEach((s) => this.granted.add(s));
       return decide(true, "mode");
     }
-    if (this.mode === "deny") {
-      this.refused.add(key);
-      return decide(false, "mode");
-    }
+    if (mode === "deny") return decide(false, "mode");
     if (!this.asker) return decide(false, "no-channel");
     const openKey = open.join("\n");
     const existing = this.inFlight.get(openKey);
@@ -4947,6 +5314,13 @@ var ApprovalPolicy = class {
     }
     return decide(answer2, "asked");
   }
+  /** The standing approvals, parsed from the entries in force now. */
+  allowlist() {
+    const entries = this.entriesOf();
+    const key = entries.join("\n");
+    if (this.parsed?.key !== key) this.parsed = { key, list: parseAllowlist(entries) };
+    return this.parsed.list;
+  }
   /** Scopes the user has granted this session — for display and for persistence. */
   grantedScopes() {
     return [...this.granted];
@@ -5044,14 +5418,17 @@ var KNOWN_TOOLS = {
   local_shell: "bash",
   // OpenCode
   list: "list_dir",
-  fetch: "fetch"
+  fetch: "fetch",
+  // Ordewell's own research shell (ADR-0026), under every runner's name for it
+  runcommand: "bash"
 };
+var ORDEWELL_TOOL_PREFIX = /^(mcp__ordewell__|ordewell_)/i;
 var FILE_EDIT_TOOLS = /* @__PURE__ */ new Set(["edit", "write", "multiedit", "notebookedit", "applypatch", "patch", "add", "update", "delete", "filechange"]);
 function isFileEditTool(name) {
   return FILE_EDIT_TOOLS.has(name.trim().toLowerCase().replace(/[_-]/g, ""));
 }
 function mapAgentTool(name) {
-  const normalized = name.trim().toLowerCase().replace(/[_-]/g, "");
+  const normalized = name.trim().replace(ORDEWELL_TOOL_PREFIX, "").toLowerCase().replace(/[_-]/g, "");
   const direct = KNOWN_TOOLS[normalized] ?? KNOWN_TOOLS[name.trim().toLowerCase()];
   if (direct) {
     return { tool: direct, toolLabel: name };
@@ -6700,8 +7077,10 @@ var BaseConfig = class {
     return nonNegativeInt(process.env.ORDEWELL_CONFLICT_REPAIR_ATTEMPTS, 2);
   }
   get approvalMode() {
-    const raw = (process.env.ORDEWELL_APPROVAL_MODE || "").trim().toLowerCase();
-    return raw === "allow" || raw === "deny" ? raw : "ask";
+    return parseApprovalModeSetting(process.env.ORDEWELL_APPROVAL_MODE);
+  }
+  get approvalDefaults() {
+    return process.env.ORDEWELL_APPROVAL_DEFAULTS !== "false" && process.env.ORDEWELL_APPROVAL_DEFAULTS !== "0";
   }
   get approvalPreApproved() {
     return (process.env.ORDEWELL_APPROVAL_ALLOW || "").split(/[,\n]/).map((s) => s.trim()).filter(Boolean);
@@ -7544,7 +7923,7 @@ var GitWorktreeIsolation = class {
     return this.admin(workspaceRoot, async () => {
       const scan = await this.scanGroup(workspaceRoot);
       const paths = "paths" in scan ? scan.paths : [SELF_REPO];
-      const nested = "paths" in scan ? scan.nested : [];
+      const nested2 = "paths" in scan ? scan.nested : [];
       const run = { id: this.mintRunId(), workspaceRoot, repos: [], shared: [], sharedRepos: [], tasks: {} };
       for (const repoPath of paths) {
         const repo = await this.startRepo(run, repoPath);
@@ -7552,7 +7931,7 @@ var GitWorktreeIsolation = class {
         else run.sharedRepos.push(repoPath);
       }
       if (run.repos.length === 0) throw new Error(`No repository could be isolated: ${run.sharedRepos.join(", ")}`);
-      run.shared = paths.includes(SELF_REPO) ? nested : this.sharedPaths(workspaceRoot, run.repos.map((r) => r.path));
+      run.shared = paths.includes(SELF_REPO) ? nested2 : this.sharedPaths(workspaceRoot, run.repos.map((r) => r.path));
       return run;
     });
   }
@@ -9093,6 +9472,7 @@ function researchPhaseBlock(harnessMode) {
   const toolSpecific = harnessMode ? [
     "- Explore the repository with your own tools until you understand its architecture",
     "- You are planning, not implementing: do NOT edit, create, or delete any file, and do not run commands that change the workspace",
+    "- Run commands \u2014 git, gh, cloud CLIs, the project's own tooling \u2014 with the run_command tool, not a shell of your own. MCP tools the user configured (issue trackers, todo lists) are yours to read from too. Reads run at once; anything else is approved or refused by the user's settings. When something the plan needs to change is refused, add it to the plan as an ops task instead",
     "- If you delegate exploration to your own agents, WAIT for their results inside this reply. Do NOT launch them in the background or async and end your turn saying you will report back later: your turn ending is what hands the conversation back to the user, and anything you say after it never reaches them."
   ] : [
     "- Use list_dir with depth=2-3 for a tree overview",
@@ -12559,6 +12939,9 @@ var listRunnersInput = import_v4.z.object({});
 var listModelsInput = import_v4.z.object({
   runner: import_v4.z.string().min(1).describe("A runner id from list_runners.")
 });
+var runCommandInput = import_v4.z.object({
+  command: import_v4.z.string().min(1).describe("One shell command line, run from the workspace root.")
+});
 var loadSkillInput = import_v4.z.object({
   name: import_v4.z.string().min(1).describe("The name of an Ordewell planner skill to load.")
 });
@@ -12698,6 +13081,13 @@ var PLANNER_TOOLS = [
     (h) => h.taskOutput?.bind(h),
     PLANNER_READ_ONLY
   ),
+  tool(
+    "run_command",
+    "Run a shell command for research: git, gh, az, kubectl, the project's own tooling, anything you need to look at. Read-only commands run at once; others ask the user, once per command family; commands that write files are refused. Use it instead of a shell of your own.",
+    runCommandInput,
+    (h) => h.runCommand?.bind(h),
+    PLANNER_READ_ONLY
+  ),
   tool(
     "load_skill",
     "Load an Ordewell planner skill by name. Returns its instructions; only model-invocable planner skills can be loaded.",
@@ -15185,6 +15575,7 @@ var SETTINGS_ENV_REFUSED = [
   "ORDEWELL_AUTONOMOUS_MODE",
   "ORDEWELL_APPROVAL_MODE",
   "ORDEWELL_APPROVAL_ALLOW",
+  "ORDEWELL_APPROVAL_DEFAULTS",
   // Where settings are persisted.
   "ORDEWELL_SETTINGS_PATH",
   // Runtime options and dynamic loaders.
@@ -15783,6 +16174,32 @@ function killTree(proc, deps = {}) {
 // src/services/harness/openCodeOrdewell.ts
 var NAMES = prefixedToolNames(`${ORDEWELL_MCP_SERVER_NAME}_`);
 var RULE = NAMES.toolName("*");
+var OPENCODE_PLANNER_PERMISSION = {
+  "*": "ask",
+  read: "allow",
+  glob: "allow",
+  grep: "allow",
+  list: "allow",
+  lsp: "allow",
+  skill: "allow",
+  todoread: "allow",
+  websearch: "allow",
+  codesearch: "allow",
+  webfetch: "ask",
+  external_directory: "ask",
+  edit: "deny",
+  write: "deny",
+  patch: "deny",
+  apply_patch: "deny",
+  multiedit: "deny",
+  bash: "deny",
+  task: "deny",
+  question: "deny",
+  todowrite: "deny",
+  shell: "deny",
+  subagent: "deny",
+  browser: "deny"
+};
 var OPENCODE_CONFIG_VARIABLE = "OPENCODE_CONFIG_CONTENT";
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -15820,7 +16237,7 @@ function withoutParentOrdewell(content) {
   const kept = withoutOrdewell(parsed);
   return JSON.stringify(kept) === JSON.stringify(parsed) ? content : JSON.stringify(kept);
 }
-function mergeOrdewellConfig(existing, mcp) {
+function mergeOrdewellConfig(existing, mcp, role) {
   let base = {};
   if (existing?.trim()) {
     let parsed;
@@ -15832,10 +16249,14 @@ function mergeOrdewellConfig(existing, mcp) {
     if (!isRecord2(parsed)) return null;
     base = withoutOrdewell(parsed);
   }
+  if (role === "planner") {
+    delete base.permission;
+    delete base.permissions;
+  }
   const policy = typeof base.permission === "string" ? { "*": base.permission } : base.permission;
   const ours = {
-    mcp: { [mcp.name]: { type: "remote", url: mcp.url, headers: mcp.headers, enabled: true } },
-    permission: { [RULE]: "allow" }
+    ...mcp ? { mcp: { [mcp.name]: { type: "remote", url: mcp.url, headers: mcp.headers, enabled: true } } } : {},
+    permission: { ...role === "planner" ? OPENCODE_PLANNER_PERMISSION : {}, ...mcp ? { [RULE]: "allow" } : {} }
   };
   return JSON.stringify(deepMerge({ ...base, ...policy === void 0 ? {} : { permission: policy } }, ours));
 }
@@ -16280,7 +16701,24 @@ var DISALLOWED_TOOLS = [
   "EnterPlanMode",
   "ExitPlanMode"
 ];
-var PLANNER_PERMISSION_MODE = "dontAsk";
+var PLANNER_PERMISSION_MODE = "default";
+var PATH_TOOLS = {
+  Read: { field: "file_path", directory: false },
+  Grep: { field: "path", directory: true },
+  Glob: { field: "path", directory: true },
+  LS: { field: "path", directory: true }
+};
+function plannerAsk(name, input, server) {
+  if (name.startsWith("mcp__")) {
+    const tool2 = name.split("__").slice(2).join("__");
+    return { kind: "mcp", scope: name, tool: tool2 || name, ...server ? { server } : {} };
+  }
+  if (name === "WebFetch" && typeof input.url === "string") return { kind: "fetch", url: input.url };
+  const pathTool = PATH_TOOLS[name];
+  const target = pathTool ? input[pathTool.field] : void 0;
+  if (pathTool && typeof target === "string") return { kind: "path", path: target, directory: pathTool.directory };
+  return { kind: "other" };
+}
 var TASK_DISALLOWED_TOOLS = ["AskUserQuestion"];
 var PROTOCOL_ARGS = [
   "-p",
@@ -16390,6 +16828,8 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
     const args = [
       ...PROTOCOL_ARGS,
       // The read-only guarantee, enforced at spawn rather than by prompt.
+      "--permission-prompt-tool",
+      "stdio",
       "--permission-mode",
       PLANNER_PERMISSION_MODE,
       "--disallowedTools",
@@ -16576,32 +17016,20 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
     const subagentId = msg.parent_tool_use_id ?? void 0;
     switch (msg.type) {
       // The control channel: Claude asks whether a tool may run when its mode
-      // cannot decide alone. A read-only planner answers "deny", every time —
-      // and must answer, because an unacknowledged request stalls the turn.
-      // A task's request is left open for someone to answer (ADR-0018, A1).
+      // cannot decide alone. The request is left open — a task's for someone
+      // to answer (ADR-0018, A1), a planner's for its envelope (ADR-0026) —
+      // and must be answered, because an unacknowledged request stalls the turn.
       case "control_request": {
         if (msg.request?.subtype !== "can_use_tool") return;
         const input = msg.request.input ?? {};
         const id = msg.request_id ?? "";
-        if (this.role === "planner") {
-          this.writeLine({
-            type: "control_response",
-            response: {
-              subtype: "success",
-              request_id: msg.request_id,
-              response: { behavior: "deny", message: "The Ordewell planner is read-only. Mutation belongs to the runners that execute the plan." }
-            }
-          });
-          emit({ type: "permission_request", id, name: msg.request.tool_name ?? "unknown", detail: JSON.stringify(input) });
-          return;
-        }
         const name = msg.request.tool_name ?? "unknown";
         if (this.givenOrdewell && CLAUDE_ORDEWELL.isOrdewellAsk(name)) {
           this.writeLine({ type: "control_response", response: { subtype: "success", request_id: id, response: { behavior: "allow", updatedInput: input } } });
           emit({ type: "permission_request", id, name, detail: JSON.stringify(input), input, decided: { decision: "allow" } });
           return;
         }
-        const suggestions = msg.request.permission_suggestions ?? [];
+        const suggestions = this.role === "task" ? msg.request.permission_suggestions ?? [] : [];
         this.openPermissions.set(id, { input, suggestions });
         emit({
           type: "permission_request",
@@ -16610,7 +17038,8 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
           detail: JSON.stringify(input),
           input,
           suggestions,
-          ...msg.request.tool_use_id ? { toolUseId: msg.request.tool_use_id } : {}
+          ...msg.request.tool_use_id ? { toolUseId: msg.request.tool_use_id } : {},
+          ...this.role === "planner" ? { ask: plannerAsk(name, input, msg.request.mcp_server?.name) } : {}
         });
         return;
       }
@@ -16902,6 +17331,20 @@ var CODEX_ORDEWELL = {
       `They are not in your tool list up front. Find them with the tool discovery you have (the \`exec\` tool's \`ALL_TOOLS\` list) and call them by their full names, ${quoted2(this.toolNames("task"))}.`,
       `Look for them before you finish; the task is reported complete through \`${TASK_COMPLETE_TOOL}\`.`
     ].join(" ");
+  },
+  /**
+   * The same discovery note for a planner, which also needs to know that its
+   * commands go through `run_command`: Codex's own shell is sandboxed without
+   * network, so `gh` or a cloud CLI fails there, and a model that tried its
+   * shell first concludes the command cannot run.
+   */
+  plannerInstructions() {
+    const tools = ordewellToolNames("planner");
+    return [
+      `You have ${COUNT_WORDS[tools.length] ?? tools.length} tools from the \`${ORDEWELL_MCP_SERVER_NAME}\` MCP server: ${quoted2(tools)}.`,
+      `They are not in your tool list up front. Find them with the tool discovery you have (the \`exec\` tool's \`ALL_TOOLS\` list) and call them by their full names, ${quoted2(this.toolNames("planner"))}.`,
+      `Run shell commands with \`${this.toolName("run_command")}\`, not your own shell: yours is sandboxed without network, so git remotes, gh and cloud CLIs fail there.`
+    ].join(" ");
   }
 };
 
@@ -17089,6 +17532,8 @@ var CodexAdapter = class extends StdioAgentAdapter {
   interruptedTurnIds = /* @__PURE__ */ new Set();
   /** A task's approval requests still waiting for an answer, by the request id as a string. */
   openPermissions = /* @__PURE__ */ new Map();
+  /** The tool each MCP server's latest call is for, which names the tool an approval asks about when its question does not. */
+  mcpCallsInProgress = /* @__PURE__ */ new Map();
   /**
    * The files each in-flight `fileChange` item touches. Its approval request
    * names only the item, and a person deciding needs to see the files.
@@ -17196,14 +17641,18 @@ ${this.exitMessage()}`);
     return {
       ...common,
       sandbox: "read-only",
-      approvalPolicy: "never",
+      // `on-request`, so a user's MCP tool reaches the planner's envelope as an approval
+      // (ADR-0026); under `never` Codex fails the call without asking. Commands and file
+      // changes it asks about are still declined: the sandbox holds, and commands go
+      // through Ordewell's `run_command`.
+      approvalPolicy: "on-request",
       ...threadConfig,
       // `developerInstructions` layers on top of Codex's own base prompt, the
       // way Claude Code's `--append-system-prompt` does. `baseInstructions`
       // replaces it — which takes Codex's description of its own tools with
       // it, and a planner that has forgotten it can read the workspace
       // answers from a web search instead.
-      developerInstructions: opts?.systemPrompt
+      developerInstructions: [opts?.systemPrompt, opts?.mcp ? CODEX_ORDEWELL.plannerInstructions() : ""].filter(Boolean).join("\n\n") || void 0
     };
   }
   /**
@@ -17307,7 +17756,7 @@ ${this.exitMessage()}`);
     if (!open || !this.process) return false;
     this.openPermissions.delete(id);
     this.rpc.respond(open.requestId, TASK_APPROVALS[open.method].answer(decision.decision, open.params));
-    const note = decision.decision === "deny" ? decision.note?.trim() : void 0;
+    const note = decision.decision === "deny" && this.role === "task" ? decision.note?.trim() : void 0;
     if (note && this.turn?.id) this.requestSteer(this.turn.id, note);
     return true;
   }
@@ -17593,10 +18042,12 @@ ${this.exitMessage()}`);
    */
   answerServerRequest(msg, emit) {
     const method = msg.method;
-    if (CODEX_ORDEWELL.isOrdewellAsk({ method, params: msg.params ?? {} })) {
+    const params = msg.params ?? {};
+    if (CODEX_ORDEWELL.isOrdewellAsk({ method, params })) {
       this.rpc.respond(msg.id, { action: "accept", content: {} });
       return;
     }
+    if (this.holdMcpToolApproval(msg, method, params, emit)) return;
     const result = DECLINE_RESULTS[method];
     if (result) {
       this.rpc.respond(msg.id, result);
@@ -17608,9 +18059,30 @@ ${this.exitMessage()}`);
       type: "permission_request",
       id: String(msg.id ?? ""),
       name: method.split("/").pop() ?? method,
-      detail: JSON.stringify(msg.params ?? {})
+      detail: JSON.stringify(msg.params ?? {}),
+      decided: { decision: "deny" }
     });
   }
+  /**
+   * A planner's approval for a tool of the user's own MCP server, held for the
+   * planner's envelope to answer (ADR-0026). Codex names the server; the tool
+   * is in its question, or else the call it last started on that server.
+   */
+  holdMcpToolApproval(msg, method, params, emit) {
+    if (method !== "mcpServer/elicitation/request") return false;
+    const meta = params._meta;
+    const server = params.serverName;
+    if (meta?.codex_approval_kind !== "mcp_tool_call" || typeof server !== "string") return false;
+    const asked = typeof params.message === "string" ? /run tool "([^"]+)"/.exec(params.message)?.[1] : void 0;
+    const tool2 = asked ?? this.mcpCallsInProgress.get(server);
+    if (!tool2) return false;
+    const id = String(msg.id);
+    const input = typeof meta.tool_params === "object" && meta.tool_params !== null ? meta.tool_params : {};
+    const scope = `mcp__${server}__${tool2}`;
+    this.openPermissions.set(id, { requestId: msg.id, method, params });
+    emit({ type: "permission_request", id, name: scope, detail: JSON.stringify(input), input, ask: { kind: "mcp", scope, tool: tool2, server } });
+    return true;
+  }
   /** A tool item entering `inProgress` — announce the call so the timeline moves. */
   emitItemStart(item, emit, subagentId) {
     if (!item?.id) return;
@@ -17622,6 +18094,7 @@ ${this.exitMessage()}`);
         emit({ type: "tool_call", id: item.id, name: "shell", args: { command: item.command, cwd: item.cwd }, ...subagentId ? { subagentId } : {} });
         return;
       case "mcpToolCall":
+        if (item.server && item.tool) this.mcpCallsInProgress.set(item.server, item.tool);
         emit({ type: "tool_call", id: item.id, name: shownToolName(item), args: item.arguments ?? {}, ...subagentId ? { subagentId } : {} });
         return;
       case "dynamicToolCall":
@@ -17794,6 +18267,55 @@ var import_crypto9 = require("crypto");
 // src/services/harness/openCodeTransport.ts
 var import_crypto8 = require("crypto");
 var STREAM_CONNECT_TIMEOUT_MS = 5e3;
+var OPENCODE_BUILTINS = /* @__PURE__ */ new Set([
+  "bash",
+  "edit",
+  "write",
+  "patch",
+  "apply_patch",
+  "multiedit",
+  "read",
+  "glob",
+  "grep",
+  "list",
+  "lsp",
+  "task",
+  "question",
+  "todowrite",
+  "todoread",
+  "skill",
+  "websearch",
+  "codesearch",
+  "webfetch",
+  "external_directory",
+  "doom_loop",
+  "invalid",
+  "batch",
+  "shell",
+  "subagent",
+  "browser",
+  "execute",
+  "search",
+  "opencode_read_mcp_resource",
+  "opencode_list_mcp_resources"
+]);
+function openCodePlannerAsk(permission, details, servers) {
+  const meta = details.metadata ?? {};
+  const pattern = details.patterns?.[0];
+  if (permission === "webfetch") {
+    const url = typeof meta.url === "string" ? meta.url : pattern;
+    return url ? { kind: "fetch", url } : { kind: "other" };
+  }
+  if (permission === "external_directory") {
+    if (typeof meta.filepath === "string") return { kind: "path", path: meta.filepath, directory: false };
+    const dir = typeof meta.parentDir === "string" ? meta.parentDir : pattern?.replace(/[\\/]\*$/, "");
+    return dir ? { kind: "path", path: dir, directory: true } : { kind: "other" };
+  }
+  if (OPENCODE_BUILTINS.has(permission)) return { kind: "other" };
+  const server = servers.filter((s) => permission.startsWith(`${s}_`)).sort((a, b) => b.length - a.length)[0];
+  if (!server) return { kind: "other" };
+  return { kind: "mcp", scope: permission, tool: permission.slice(server.length + 1), server };
+}
 function splitModelId(id) {
   const slash = id.indexOf("/");
   if (slash <= 0 || slash === id.length - 1) return null;
@@ -17887,7 +18409,6 @@ var PendingSteers = class {
   }
 };
 var ALLOW = { decision: "allow" };
-var DENY = { decision: "deny" };
 var OpenCodePermissions = class {
   constructor(reply2, ordewell) {
     this.reply = reply2;
@@ -17898,23 +18419,8 @@ var OpenCodePermissions = class {
   /** Requests waiting for an answer, by request id, with the session that asked. */
   open = /* @__PURE__ */ new Map();
   /**
-   * A planner's request (T1): refused, which is the same "absent answer is a
-   * denial" invariant ADR-0008 states for Ordewell's own tools. The refusal is
-   * announced so the timeline shows the planner reaching for something it may
-   * not have. The planner's own submission path, which the allow rule should
-   * already have settled, is the one request it may not be refused.
-   */
-  refuse(request, sessionId, seen, onEvent) {
-    if (!firstSight(request.id, seen)) return;
-    if (this.isOrdewellTool(request.name)) {
-      this.send(request.id, sessionId, ALLOW);
-      return;
-    }
-    onEvent(request);
-    this.send(request.id, sessionId, DENY);
-  }
-  /**
-   * A task's request. Under a mode whose manifest sets `approvals: auto` it is
+   * A task's request, or a planner's (with `autoApprove` false) for the
+   * planner's envelope to answer (ADR-0026). Under a mode whose manifest sets `approvals: auto` it is
    * answered at once with what `opencode run --auto` answers, so the same plan
    * follows the manifest (ADR-0001), and announced already
    * decided so the log still shows it. Any other mode leaves it open for an
@@ -18093,10 +18599,7 @@ async function streamEvents(connect, signal, onFrame, onConnected, onActivity) {
 // src/services/harness/OpenCodeV2.ts
 var ACTIVE_POLL_INTERVAL_MS = 1e3;
 var IDLE_POLLS_BEFORE_START = 3;
-var PLANNER_RULES = [
-  { action: "question", resource: "*", effect: "deny" },
-  { action: "edit", resource: "*", effect: "deny" }
-];
+var PLANNER_RULES = Object.entries(OPENCODE_PLANNER_PERMISSION).map(([action, effect]) => ({ action, resource: "*", effect }));
 var TASK_RULES = [{ action: "question", resource: "*", effect: "deny" }];
 function newTurnState() {
   return { ...streamTurn(), toolNames: /* @__PURE__ */ new Map(), stepModels: /* @__PURE__ */ new Map(), briefs: /* @__PURE__ */ new Map(), streamedMessages: /* @__PURE__ */ new Set() };
@@ -18143,6 +18646,7 @@ var OpenCodeV2 = class {
     return this.sessionId;
   }
   async start() {
+    await this.exposeOrdewellTools();
     const resume = this.opts.resumeSessionId;
     if (resume) {
       const existing = await this.host.json("GET", `/api/session/${resume}`).catch(() => null);
@@ -18164,6 +18668,19 @@ var OpenCodeV2 = class {
     this.sessionId = created.data.id;
     await this.applyInstructions();
   }
+  /**
+   * 2.x lists an MCP server's tools inside its code-mode `execute` tool, where
+   * a model told to call `task_complete` does not look for it. The server is
+   * replaced at runtime with `codemode: false`, which lists its tools as tools
+   * of their own: the config it started with is in the 1.x shape both versions
+   * read, and that shape drops the setting. If the route is gone, the tools
+   * are still reachable through `execute`.
+   */
+  async exposeOrdewellTools() {
+    const mcp = this.opts.mcp;
+    if (!mcp) return;
+    await this.host.request("PUT", `/api/experimental/mcp/${mcp.name}`, { config: { type: "remote", url: mcp.url, headers: mcp.headers, codemode: false } }).catch(() => void 0);
+  }
   /** Allow the Ordewell server's tools, so a call never waits on a person (ADR-0022, S3). */
   ordewellRules() {
     return this.opts.mcp ? OPENCODE_ORDEWELL.sessionRules() : [];
@@ -18424,12 +18941,14 @@ var OpenCodeV2 = class {
       ...ask.source?.id ? { toolUseId: ask.source.id } : {}
     };
   }
-  /** A planner's request is refused; a task's is answered at once or left open for a card. */
+  /** A planner's request is held for its envelope (ADR-0026); a task's is answered at once or left open for a card. */
   onPermissionAsked(ask, session, state, onEvent) {
     const request = this.permissionRequest(ask);
     if (!request) return;
-    if (this.role !== "task") this.permissions.refuse(request, session, state.seen, onEvent);
-    else this.permissions.ask(request, session, this.opts.kind === "task" && autoApproves(this.opts), state.seen, onEvent);
+    if (this.role !== "task") {
+      const target = openCodePlannerAsk(request.name, { patterns: ask.resources }, this.host.mcpServers?.() ?? []);
+      this.permissions.ask({ ...request, ask: target }, session, false, state.seen, onEvent);
+    } else this.permissions.ask(request, session, this.opts.kind === "task" && autoApproves(this.opts), state.seen, onEvent);
   }
 };
 
@@ -18447,7 +18966,9 @@ var DISABLED_TOOLS = {
   edit: false,
   write: false,
   apply_patch: false,
-  todowrite: false
+  todowrite: false,
+  bash: false,
+  task: false
 };
 var TASK_DISABLED_TOOLS = { question: false };
 function describeError(err) {
@@ -18518,6 +19039,8 @@ var OpenCodeAdapter = class {
   taskTurn = null;
   /** An abort was posted during the current task turn, so the idle that follows ends it as interrupted. */
   interruptRequested = false;
+  /** The user's MCP servers, as `/mcp` last listed them: what tells a planner's MCP tool request from a built-in's (ADR-0026). */
+  mcpServers = [];
   permissions = new OpenCodePermissions(
     (id, sessionId, decision) => this.replyPermission(id, sessionId, permissionReply(decision, "reply")),
     () => this.ordewell
@@ -18550,7 +19073,8 @@ var OpenCodeAdapter = class {
       command: "opencode",
       args: ["serve", "--hostname", "127.0.0.1", "--port", "0"],
       env: (workspaceEnv) => {
-        const ordewellConfig = opts.mcp ? OPENCODE_ORDEWELL.configContent(workspaceEnv[OPENCODE_CONFIG_VARIABLE] ?? process.env[OPENCODE_CONFIG_VARIABLE], opts.mcp) : null;
+        const existing = workspaceEnv[OPENCODE_CONFIG_VARIABLE] ?? process.env[OPENCODE_CONFIG_VARIABLE];
+        const ordewellConfig = opts.kind === "planner" ? OPENCODE_ORDEWELL.configContent(existing, opts.mcp ?? null, "planner") ?? OPENCODE_ORDEWELL.configContent(void 0, opts.mcp ?? null, "planner") : opts.mcp ? OPENCODE_ORDEWELL.configContent(existing, opts.mcp, "task") : null;
         if (opts.mcp && ordewellConfig === null) {
           console.error("[opencode] OPENCODE_CONFIG_CONTENT is not a JSON object, so the Ordewell tools were not injected.");
         }
@@ -18608,7 +19132,8 @@ var OpenCodeAdapter = class {
         openEvents: (signal) => this.deps.fetch(`${this.baseUrl}/api/event`, { signal, headers: this.headers() }),
         processEnded: this.processEnded,
         isExited: () => this.exited,
-        exitMessage: () => this.exitMessage()
+        exitMessage: () => this.exitMessage(),
+        mcpServers: () => this.mcpServers
       }, { ...opts, mcp: this.ordewell ?? void 0 }, this.role());
       await this.v2.start();
       this.sessionId = this.v2.nativeSessionId();
@@ -19074,7 +19599,15 @@ var OpenCodeAdapter = class {
     const sessionId = ask.sessionID ?? this.sessionId ?? "";
     const name = permissionName(ask);
     if (!this.task) {
-      this.permissions.refuse({ type: "permission_request", id, name, detail: permissionDetail(ask) }, sessionId, seen, onEvent);
+      this.permissions.ask({
+        type: "permission_request",
+        id,
+        name,
+        detail: permissionDetail(ask),
+        input: ask.metadata ?? {},
+        ...ask.tool?.callID ? { toolUseId: ask.tool.callID } : {},
+        ask: openCodePlannerAsk(name, ask, this.mcpServers)
+      }, sessionId, false, seen, onEvent);
       return;
     }
     const request = {
@@ -19131,10 +19664,21 @@ var OpenCodeAdapter = class {
     if (!ordewell || !this.baseUrl) return false;
     return awaitAttach(async () => {
       if (this.exited) return "failed";
-      const servers = await this.json("GET", "/mcp").catch(() => null);
+      const servers = this.v2 ? await this.v2McpStatus() : await this.json("GET", "/mcp").catch(() => null);
+      if (servers) this.mcpServers = Object.keys(servers).filter((name) => name !== ordewell.name);
       return OPENCODE_ORDEWELL.attachState(servers?.[ordewell.name]?.status);
     }, MCP_ATTACH_TIMEOUT_MS3, MCP_STATUS_POLL_MS2);
   }
+  /** 2.x lists its servers as `{ name, status: { status } }`, and only once it has started connecting them. */
+  async v2McpStatus() {
+    const listed2 = await this.json("GET", "/api/mcp").catch(() => null);
+    if (!Array.isArray(listed2?.data)) return null;
+    const servers = {};
+    for (const { name, status } of listed2.data) {
+      if (typeof name === "string") servers[name] = typeof status?.status === "string" ? { status: status.status } : {};
+    }
+    return servers;
+  }
   dispose() {
     if (this.disposed) return;
     this.disposed = true;
@@ -21721,6 +22265,10 @@ function plannerToolHandler(host) {
       }
       return { text: skill.content };
     },
+    async runCommand({ command }, { signal }) {
+      const outcome = await host.runCommand(command, signal);
+      return { text: outcome.output || (outcome.success ? "(no output)" : "The command failed with no output."), ...outcome.success ? {} : { isError: true } };
+    },
     async listRunners() {
       const catalog = await host.liveCatalog();
       return answer({
@@ -21970,6 +22518,47 @@ var TurnStream = class {
   }
 };
 
+// src/services/harness/plannerPermissions.ts
+var READ_ONLY_DENIAL = "The Ordewell planner is read-only: it changes no files. Use run_command for commands; changes belong to the plan's tasks.";
+var OPS_HINT = "Continue without it. If it would change something outside the repository, add it to the plan as an ops task; if it only reads, ask the user to approve it or add it to the planner allowlist.";
+var ALLOW2 = { decision: "allow" };
+var SUBJECT_MAX_CHARS = 400;
+function deny(note) {
+  return { decision: "deny", note };
+}
+async function decidePlannerPermission(ask, input, gate) {
+  if (!ask || ask.kind === "other") return deny(READ_ONLY_DENIAL);
+  if (!gate) return deny("Nobody can approve this here. Continue without it.");
+  switch (ask.kind) {
+    case "mcp": {
+      const args = JSON.stringify(input);
+      const subject = `${ask.server ?? "MCP"} \xB7 ${ask.tool} ${args.length > SUBJECT_MAX_CHARS ? `${args.slice(0, SUBJECT_MAX_CHARS)}\u2026` : args}`;
+      const granted = await gate.approval.request({
+        kind: "mcp_tool",
+        subject,
+        scope: ask.scope,
+        tool: ask.tool,
+        detail: `The planner wants to use "${ask.tool}"${ask.server ? ` from ${ask.server}` : ""}. It may change things outside the repository.`
+      });
+      return granted ? ALLOW2 : deny(`Not approved: ${ask.scope}. ${OPS_HINT}`);
+    }
+    case "fetch":
+      if (!gate.fetcher) return deny("This fetch cannot be approved here.");
+      return await gate.fetcher.confirm(ask.url) ? ALLOW2 : deny(`Fetch denied (blocked host or not approved): ${ask.url}. ${OPS_HINT}`);
+    case "path": {
+      const { abs, inside } = resolveWithin(gate.workspaceRoot, ask.path);
+      if (inside) return ALLOW2;
+      const granted = await gate.approval.request({
+        kind: "external_path",
+        subject: abs,
+        scope: grantScopeFor(abs, ask.directory ? "directory" : "file"),
+        detail: `Planner research wants to read ${abs}, outside the workspace (${gate.workspaceRoot}).`
+      });
+      return granted ? ALLOW2 : deny(`Access denied: "${abs}" is outside the workspace and was not approved.`);
+    }
+  }
+}
+
 // src/services/harness/CliAgentAiService.ts
 var MAX_AGENT_WAITS = 2;
 function waitForAgentsPrompt(running) {
@@ -22013,6 +22602,7 @@ var CliAgentAiService = class {
    * every session boundary — nothing from one goal may reach the next.
    */
   lastNativeSessionId = null;
+  /** `gate` is what the agent's own tool requests are decided against; absent, only Ordewell's tools are allowed (ADR-0026). */
   conversation = null;
   mcpServer;
   /** The planner token the running process was spawned with; revoked with the process (ADR-0022, A3). */
@@ -22081,7 +22671,8 @@ var CliAgentAiService = class {
     };
     const tools = req.plannerTools;
     await this.startAdapter(startOptions, tools);
-    this.conversation = { startOptions, tools };
+    const gate = req.approval ? { approval: req.approval, fetcher: req.fetcher, workspaceRoot: startOptions.cwd } : void 0;
+    this.conversation = { startOptions, tools, gate };
     const opening = this.openingMessage(req);
     return this.runConversation(opening, req.onProgress, req.signal);
   }
@@ -22171,6 +22762,8 @@ var CliAgentAiService = class {
       segmentId = (0, import_uuid6.v4)();
     };
     const streamedThinking = /* @__PURE__ */ new Set();
+    const deniedCalls = /* @__PURE__ */ new Set();
+    const gate = this.conversation?.gate;
     const subagentUsage = /* @__PURE__ */ new Map();
     let error;
     let stepIndex = 0;
@@ -22225,7 +22818,7 @@ var CliAgentAiService = class {
           return;
         }
         case "tool_result":
-          settle(event.id, event.output, event.success, event.success ? "success" : "failure", event.subagentId);
+          settle(event.id, event.output, event.success, event.success ? "success" : deniedCalls.has(event.id) ? "denied" : "failure", event.subagentId);
           return;
         case "usage": {
           const { subagentId } = event.record;
@@ -22253,18 +22846,28 @@ var CliAgentAiService = class {
           backgroundAgents++;
           return;
         case "permission_request": {
-          const mapped = mapAgentTool(event.name);
-          const args = JSON.stringify({ detail: event.detail });
-          if (!pendingCalls.has(event.id)) {
-            pendingCalls.set(event.id, { tool: mapped.tool, toolLabel: mapped.toolLabel, args });
-            onProgress({ type: "tool_call", tool: mapped.tool, toolLabel: mapped.toolLabel, toolArgs: args, toolCallId: event.id });
+          const announceDenial = (output) => {
+            const mapped = mapAgentTool(event.name);
+            const args = JSON.stringify({ detail: event.detail });
+            if (!pendingCalls.has(event.id)) {
+              pendingCalls.set(event.id, { tool: mapped.tool, toolLabel: mapped.toolLabel, args });
+              onProgress({ type: "tool_call", tool: mapped.tool, toolLabel: mapped.toolLabel, toolArgs: args, toolCallId: event.id });
+            }
+            settle(event.id, output, false, "denied");
+          };
+          if (!event.decided && adapter.answerPermission) {
+            const { id, toolUseId } = event;
+            void decidePlannerPermission(event.ask, event.input ?? {}, gate).catch(() => ({ decision: "deny" })).then((decision) => {
+              if (decision.decision === "deny") {
+                if (toolUseId) deniedCalls.add(toolUseId);
+                else announceDenial(`Access denied: "${event.name}" was refused. ${decision.note ?? ""}`.trim());
+              }
+              adapter.answerPermission?.(id, decision);
+            });
+            return;
           }
-          settle(
-            event.id,
-            `Access denied: the planner runs read-only, so "${event.name}" was refused. Mutation belongs to the runners that execute the plan.`,
-            false,
-            "denied"
-          );
+          if (event.decided?.decision !== "deny") return;
+          announceDenial(`Access denied: the planner runs read-only, so "${event.name}" was refused. Mutation belongs to the runners that execute the plan.`);
           return;
         }
         case "error":
@@ -23634,7 +24237,7 @@ var HttpWebFetcher = class {
   }
   async fetch(url) {
     if (!await this.confirm(url)) {
-      return { success: false, output: `Fetch denied (blocked host or not approved): ${url}`, truncated: false };
+      return { success: false, output: `Fetch denied (blocked host or not approved): ${url}. Continue without it, or ask the user to approve this origin or add it to the planner allowlist.`, truncated: false };
     }
     return this.get(url, "Fetch");
   }
@@ -24736,8 +25339,9 @@ function createSession(deps) {
     checkpointQuestion: (taskId) => orchestrator.getCheckpointQuestion(taskId)
   });
   const approvalPolicy = new ApprovalPolicy({
-    mode: deps.config.approvalMode,
-    preApproved: deps.config.approvalPreApproved,
+    // Read per request, so a change of autonomy level or allowlist applies to the next call.
+    mode: () => effectiveApprovalMode(deps.config.approvalMode, deps.config.autonomousMode),
+    preApproved: () => [...deps.config.approvalDefaults ? DEFAULT_PLANNER_ALLOWLIST : [], ...deps.config.approvalPreApproved],
     ask: (req) => approvals.ask(req),
     // The interactive path (`asked`) already broadcasts approval_request +
     // approval_settled; only the silent sources need a signal, or a
@@ -24840,7 +25444,8 @@ var Session = class {
     read: (signature, answer2) => this.conversation.read(signature, answer2),
     liveOutput: (taskId, opts) => this.orchestrator.getLiveOutput(taskId, opts),
     lastAttempt: (taskId) => lastAttemptDigest(this.taskLogLocation, taskId),
-    taskSkills: () => this.workspaceSkills()
+    taskSkills: () => this.workspaceSkills(),
+    runCommand: (command, signal) => this.fsAdapter.bash(command, signal)
   });
   constructor(parts) {
     this.config = parts.config;
@@ -25297,6 +25902,7 @@ var Session = class {
       contextWindow: this.modelResolver.contextWindowFor?.(this.config.orchestratorModel),
       fs: this.fsAdapter,
       fetcher: this.fetcher,
+      approval: this.approvalPolicy,
       plannerTools: { sessionId: this.sessionId, handler: this.plannerTools },
       skills: this.workspaceSkills().listSkills()
     };
@@ -26201,8 +26807,8 @@ function taskRowView(task, context = {}) {
 function findNamed(tasks, id) {
   for (const task of tasks) {
     if (task.id === id) return task;
-    const nested = findNamed(task.subtasks ?? [], id);
-    if (nested) return nested;
+    const nested2 = findNamed(task.subtasks ?? [], id);
+    if (nested2) return nested2;
   }
   return void 0;
 }
@@ -27471,6 +28077,7 @@ var PlannerModelMemory = class {
   DAEMON_SUBPROTOCOL,
   DAEMON_TOKEN_SUBPROTOCOL_PREFIX,
   DEFAULT_MAX_PARALLEL,
+  DEFAULT_PLANNER_ALLOWLIST,
   DEFAULT_RUNNERS,
   DENY_ALL,
   EMPTY_CONVERSATION,
@@ -27607,6 +28214,7 @@ var PlannerModelMemory = class {
   coerceAssignments,
   collectDirectDependencyOutputs,
   collectProviderCredentials,
+  commandAllowedBy,
   composeAugmentedPrompt,
   composeContinuationPrompt,
   configuredProviders,
@@ -27633,6 +28241,7 @@ var PlannerModelMemory = class {
   discoverGeminiModels,
   drainNext,
   effectiveAllowlist,
+  effectiveApprovalMode,
   emptyWarnings,
   enabledRunners,
   ensureDir,
@@ -27715,6 +28324,8 @@ var PlannerModelMemory = class {
   outputLines,
   outputPreview,
   ownerOnlyConfigFile,
+  parseAllowlist,
+  parseApprovalModeSetting,
   parseAutonomyLevel,
   parseMaxParallel,
   parsePartialPlan,
@@ -27772,6 +28383,7 @@ var PlannerModelMemory = class {
   savePrdMarkdown,
   saveSession,
   saveState,
+  scopeAllowed,
   serializePlan,
   serializeTask,
   serializeTaskStatus,
@@ -27809,6 +28421,7 @@ var PlannerModelMemory = class {
   toTaskLogEvent,
   tokenSubprotocols,
   tokensMatch,
+  toolAllowed,
   toolHeadline,
   trimToolOutput,
   truncateCheckpointSummary,