@phuetz/code-buddy 1.6.0 → 2.0.0

package/dist/security/text-deobfuscation.js

@@ -0,0 +1,256 @@
+/**
+ * Text de-obfuscation for static security scanners.
+ *
+ * Prompt-injection / jailbreak content that is INJECTED into an LLM context
+ * (skills, imported guidance) is read by the model even when a human-invisible
+ * trick hides it from a raw regex: zero-width characters, soft hyphens,
+ * hyphenated word-wraps across lines, HTML comment/tag wrappers, homoglyphs,
+ * bidi/format controls, percent-encoding, and a single layer of Base64.
+ *
+ * NOTE: the strategy gate (`src/agent/self-improvement/strategy-gate.ts`) keeps
+ * its own equivalent `normalizeDirectiveText` — that module is reserved by the
+ * self-improvement lane, so this is an intentional independent copy in the
+ * security layer rather than a cross-lane import. Keep the two in sync.
+ */
+export const SCAN_WINDOW_SIZE = 256 * 1024;
+export const SCAN_WINDOW_OVERLAP = 4 * 1024;
+/**
+ * Slice text into overlapping scan windows so that large files cannot evade
+ * regex scanning by stuffing content past the first 256 KB.
+ * Overlap guarantees that patterns spanning window boundaries are not cut.
+ */
+export function sliceScanWindows(text, windowSize = SCAN_WINDOW_SIZE, overlap = SCAN_WINDOW_OVERLAP) {
+    if (text.length <= windowSize) {
+        return [text];
+    }
+    const windows = [];
+    const step = Math.max(1, windowSize - overlap);
+    for (let offset = 0; offset < text.length; offset += step) {
+        windows.push(text.slice(offset, offset + windowSize));
+        if (offset + windowSize >= text.length)
+            break;
+    }
+    return windows;
+}
+const MAX_PERCENT_BLOB = 8 * 1024;
+const MAX_BASE64_BLOB = 8 * 1024;
+const MAX_BASE64_BLOBS = 32;
+const MIN_BASE64_CHARS = 16;
+/**
+ * Greek / leftover Cyrillic / IPA letters that look like Latin after a human
+ * or an LLM reads them, but NFKC/NFKD will not fold. Accented Latin is handled
+ * separately via NFKD + stripping combining marks (ă → a).
+ */
+const HOMOGLYPH_MAP = {
+    α: 'a', Α: 'A', ά: 'a', Ά: 'A',
+    ε: 'e', Ε: 'E', έ: 'e', Έ: 'E',
+    ι: 'i', Ι: 'I', ί: 'i', Ί: 'I', ϊ: 'i', ΐ: 'i',
+    ο: 'o', Ο: 'O', ό: 'o', Ό: 'O',
+    ρ: 'p', Ρ: 'P',
+    τ: 't', Τ: 'T',
+    υ: 'y', Υ: 'Y', ύ: 'y', ϋ: 'y',
+    χ: 'x', Χ: 'X',
+    κ: 'k', Κ: 'K',
+    η: 'n',
+    ν: 'v',
+    ω: 'w',
+    μ: 'u',
+    ϲ: 'c', Ϲ: 'C', ς: 's', σ: 's', Σ: 'S',
+    β: 'b', Β: 'B',
+    ɑ: 'a', ɡ: 'g',
+    // Cyrillic confusables (also applied in deobfuscateText; repeated here so
+    // deobfuscateForScan is self-contained before that pass).
+    о: 'o', О: 'O', а: 'a', А: 'A', е: 'e', Е: 'E',
+    р: 'p', Р: 'P', с: 'c', С: 'C', і: 'i', І: 'I',
+    у: 'y', У: 'Y', х: 'x', Х: 'X', ѕ: 's', ј: 'j',
+};
+function applyHomoglyphs(text) {
+    let out = '';
+    for (const ch of text) {
+        out += HOMOGLYPH_MAP[ch] ?? ch;
+    }
+    return out;
+}
+export function deobfuscateText(text) {
+    return text
+        // Remove zero-width characters and soft hyphens
+        .replace(/[\u200B-\u200D\uFEFF\u00AD\u2060]/g, '')
+        // Rejoin hyphenated words across lines: e.g. "jail-\nbreak" -> "jailbreak"
+        .replace(/(?<=\w)-[\r\n]+\s*(?=\w)/g, '')
+        // Remove HTML comments
+        .replace(/<!--[\s\S]*?-->/g, ' ')
+        // Remove HTML tags
+        .replace(/<[^>]+>/g, ' ')
+        // Normalize unicode canonical composition
+        .normalize('NFKC')
+        // Map common Cyrillic confusable homoglyphs to Latin equivalents
+        .replace(/\u043e/gi, 'o')
+        .replace(/\u0430/gi, 'a')
+        .replace(/\u0435/gi, 'e')
+        .replace(/\u0440/gi, 'p')
+        .replace(/\u0441/gi, 'c')
+        .replace(/\u0456/gi, 'i')
+        .replace(/\u0443/gi, 'y')
+        .replace(/\u0445/gi, 'x')
+        .replace(/\s+/g, ' ')
+        .trim();
+}
+/**
+ * Text de-obfuscation variant for the safe scanning layer:
+ * Preserves line breaks (`\n`) and only rejoins hyphenated word-wraps across lines,
+ * preventing cross-paragraph pattern matching (such as `curl` ... `| bash`).
+ */
+function deobfuscateSafeText(text) {
+    return text
+        // Remove zero-width characters and soft hyphens
+        .replace(/[\u200B-\u200D\uFEFF\u00AD\u2060]/g, '')
+        // Rejoin hyphenated words across lines: e.g. "jail-\nbreak" -> "jailbreak"
+        .replace(/(?<=\w)-[\r\n]+\s*(?=\w)/g, '')
+        // Remove HTML comments (preserve newline if multi-line so lines don't merge)
+        .replace(/<!--[\s\S]*?-->/g, (match) => (match.includes('\n') ? '\n' : ' '))
+        // Remove HTML tags
+        .replace(/<[^>]+>/g, ' ')
+        // Normalize unicode canonical composition
+        .normalize('NFKC')
+        // Map common Cyrillic confusable homoglyphs to Latin equivalents
+        .replace(/\u043e/gi, 'o')
+        .replace(/\u0430/gi, 'a')
+        .replace(/\u0435/gi, 'e')
+        .replace(/\u0440/gi, 'p')
+        .replace(/\u0441/gi, 'c')
+        .replace(/\u0456/gi, 'i')
+        .replace(/\u0443/gi, 'y')
+        .replace(/\u0445/gi, 'x')
+        // Preserve newlines while normalizing line endings and collapsing horizontal whitespace
+        .replace(/\r\n/g, '\n')
+        .replace(/\r/g, '\n')
+        .replace(/[^\S\n]+/g, ' ')
+        .replace(/ *\n */g, '\n')
+        .trim();
+}
+/**
+ * Safe layer of text de-obfuscation:
+ * Strips format/bidi controls (\p{Cf}), applies homoglyph mappings,
+ * unicode normalizations (NFKC/NFKD + diacritic strip), zero-width characters,
+ * hyphenated line-wraps, and HTML comments/tags.
+ * Safe for all pattern capabilities without risk of false positives from
+ * decoding Base64 or URL-percent blobs.
+ */
+function foldSafeForScan(text) {
+    const stripped = text.replace(/\p{Cf}/gu, '');
+    const pre = applyHomoglyphs(stripped);
+    const folded = pre
+        .normalize('NFKC')
+        .normalize('NFKD')
+        .replace(/\p{Mn}/gu, '');
+    const mapped = applyHomoglyphs(folded);
+    return deobfuscateSafeText(mapped);
+}
+/**
+ * Safe layer of text de-obfuscation across windows:
+ * Strips format/bidi controls (\p{Cf}), applies homoglyph mappings,
+ * unicode normalizations (NFKC/NFKD + diacritic strip), zero-width characters,
+ * hyphenated line-wraps, and HTML comments/tags.
+ * Safe for all pattern capabilities without risk of false positives from
+ * decoding Base64 or URL-percent blobs.
+ */
+export function deobfuscateSafeForScanWindows(text) {
+    return sliceScanWindows(text).map((win) => foldSafeForScan(win));
+}
+export function deobfuscateSafeForScan(text) {
+    if (text.length <= SCAN_WINDOW_SIZE) {
+        return foldSafeForScan(text);
+    }
+    return deobfuscateSafeForScanWindows(text).join('\n');
+}
+function foldForScan(text) {
+    const stripped = text.replace(/\p{Cf}/gu, '');
+    const percentDecoded = decodePercentOnce(stripped);
+    // Homoglyphs BEFORE NFKC: lunate sigma ϲ compatibility-maps to σ (then
+    // "s"), but attackers use it as a Latin "c" lookalike.
+    const pre = applyHomoglyphs(percentDecoded);
+    const folded = pre
+        .normalize('NFKC')
+        .normalize('NFKD')
+        .replace(/\p{Mn}/gu, '');
+    const mapped = applyHomoglyphs(folded);
+    return deobfuscateText(mapped);
+}
+/**
+ * Scanner-facing de-obfuscation across windows: one bounded pass that also folds
+ * bidi/format controls, a single percent-decode, NFKC + diacritic strip, a homoglyph
+ * table, and a single layer of strict Base64 (≥16 chars). Used by `scanSkillFirewall`
+ * for prompt-injection capabilities.
+ */
+export function deobfuscateForScanWindows(text) {
+    return sliceScanWindows(text).map((win) => {
+        const folded = foldForScan(win);
+        const fromB64 = decodeBase64Blobs(win)
+            .map((plain) => foldForScan(plain))
+            .filter((plain) => plain.length > 0);
+        if (fromB64.length === 0)
+            return folded;
+        return `${folded}\n${fromB64.join('\n')}`;
+    });
+}
+export function deobfuscateForScan(text) {
+    if (text.length <= SCAN_WINDOW_SIZE) {
+        const folded = foldForScan(text);
+        const fromB64 = decodeBase64Blobs(text)
+            .map((plain) => foldForScan(plain))
+            .filter((plain) => plain.length > 0);
+        if (fromB64.length === 0)
+            return folded;
+        return `${folded}\n${fromB64.join('\n')}`;
+    }
+    return deobfuscateForScanWindows(text).join('\n');
+}
+function decodePercentOnce(text) {
+    return text.replace(/(?:%[0-9A-Fa-f]{2})+/g, (blob) => {
+        if (blob.length > MAX_PERCENT_BLOB)
+            return blob;
+        try {
+            return decodeURIComponent(blob);
+        }
+        catch {
+            try {
+                return blob.replace(/%([0-9A-Fa-f]{2})/g, (_, hex) => String.fromCharCode(Number.parseInt(hex, 16)));
+            }
+            catch {
+                return blob;
+            }
+        }
+    });
+}
+/**
+ * Strict standard Base64 (A–Z a–z 0–9 + /) with optional padding. One level
+ * only: callers must not re-feed the result into this function.
+ */
+function decodeBase64Blobs(text) {
+    const out = [];
+    const re = /(?<![A-Za-z0-9+/])[A-Za-z0-9+/]{16,}={0,2}(?![A-Za-z0-9+/=])/g;
+    let match;
+    while ((match = re.exec(text)) !== null && out.length < MAX_BASE64_BLOBS) {
+        const blob = match[0];
+        if (blob.length > MAX_BASE64_BLOB)
+            continue;
+        const body = blob.replace(/=+$/u, '');
+        if (body.length % 4 === 1)
+            continue;
+        const padded = body + '='.repeat((4 - (body.length % 4)) % 4);
+        let decoded;
+        try {
+            decoded = Buffer.from(padded, 'base64').toString('utf8');
+        }
+        catch {
+            continue;
+        }
+        if (decoded.length < MIN_BASE64_CHARS / 4)
+            continue;
+        if (!/^[\t\n\r\x20-\x7E]+$/.test(decoded))
+            continue;
+        out.push(decoded);
+    }
+    return out;
+}
+//# sourceMappingURL=text-deobfuscation.js.map

package/dist/security/tool-permissions.js

@@ -15,6 +15,7 @@ import fs from 'fs-extra';
 import path from 'path';
 import os from 'os';
 import { logger } from '../utils/logger.js';
+import { writeJsonAtomicSync } from '../utils/atomic-write.js';
 // ============================================================================
 // Types
 // ============================================================================
@@ -152,9 +153,7 @@ export class ToolPermissionManager {
      */
     saveConfig() {
         try {
-            const dir = path.dirname(this.configPath);
-            fs.ensureDirSync(dir);
-            fs.writeFileSync(this.configPath, JSON.stringify(this.config, null, 2));
+            writeJsonAtomicSync(this.configPath, this.config, { mode: 0o600 });
         }
         catch (error) {
             logger.warn(`Failed to save tool permissions config: ${error instanceof Error ? error.message : String(error)}`);

package/dist/security/tool-policy/approval-scope.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Exact approval scopes for non-shell tools.
+ *
+ * A session grant must describe the action, not merely the tool name. Keeping
+ * the arguments inside a digest avoids leaking secrets into UI state or logs
+ * while still making changes to any argument, cwd, or tool invalidate it.
+ */
+/** Build a stable, non-reversible key for one exact tool action. */
+export declare function buildToolApprovalKey(toolName: string, args: Record<string, unknown>, cwd: string): string;
+/** Redacted and bounded arguments suitable for an approval dialog. */
+export declare function toolArgsApprovalPreview(args: Record<string, unknown>): string;

package/dist/security/tool-policy/approval-scope.js

@@ -0,0 +1,67 @@
+/**
+ * Exact approval scopes for non-shell tools.
+ *
+ * A session grant must describe the action, not merely the tool name. Keeping
+ * the arguments inside a digest avoids leaking secrets into UI state or logs
+ * while still making changes to any argument, cwd, or tool invalidate it.
+ */
+import { createHash } from 'node:crypto';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+const APPROVAL_SCOPE_VERSION = 'tool-action-v1';
+const SECRET_KEY_PATTERN = /(?:api[_-]?key|secret|token|password|passwd|credential|authorization|cookie|private[_-]?key)/i;
+const MAX_PREVIEW_STRING = 500;
+function canonicalize(value) {
+    if (Array.isArray(value)) {
+        return value.map(canonicalize);
+    }
+    if (value && typeof value === 'object') {
+        const record = value;
+        return Object.fromEntries(Object.keys(record)
+            .sort((left, right) => left.localeCompare(right))
+            .map((key) => [key, canonicalize(record[key])]));
+    }
+    return value;
+}
+function canonicalWorkingDirectory(cwd) {
+    const resolved = path.resolve(cwd);
+    try {
+        return fs.realpathSync(resolved);
+    }
+    catch {
+        return resolved;
+    }
+}
+/** Build a stable, non-reversible key for one exact tool action. */
+export function buildToolApprovalKey(toolName, args, cwd) {
+    const payload = JSON.stringify({
+        version: APPROVAL_SCOPE_VERSION,
+        toolName,
+        cwd: canonicalWorkingDirectory(cwd),
+        args: canonicalize(args),
+    });
+    return `tool-action:${createHash('sha256').update(payload).digest('hex')}`;
+}
+function redactPreviewValue(value, key) {
+    if (key && SECRET_KEY_PATTERN.test(key)) {
+        return '[REDACTED]';
+    }
+    if (typeof value === 'string') {
+        return value.length > MAX_PREVIEW_STRING
+            ? `${value.slice(0, MAX_PREVIEW_STRING)}…[${value.length} chars]`
+            : value;
+    }
+    if (Array.isArray(value)) {
+        return value.map((entry) => redactPreviewValue(entry));
+    }
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value)
+            .map(([entryKey, entryValue]) => [entryKey, redactPreviewValue(entryValue, entryKey)]));
+    }
+    return value;
+}
+/** Redacted and bounded arguments suitable for an approval dialog. */
+export function toolArgsApprovalPreview(args) {
+    return JSON.stringify(redactPreviewValue(args), null, 2);
+}
+//# sourceMappingURL=approval-scope.js.map

package/dist/security/tool-policy/policy-manager.d.ts

@@ -65,6 +65,15 @@ export declare class PolicyManager extends EventEmitter {
      * Get all available profiles
      */
     getAvailableProfiles(): PolicyProfile[];
+    /**
+     * Set a PERSISTENT per-tool override (survives restarts; resolver priority
+     * just below session overrides). This is the Hermes-style per-tool gate.
+     */
+    setToolOverride(toolName: string, action: PolicyAction): void;
+    /** Remove a persistent per-tool override (back to profile/group rules). */
+    clearToolOverride(toolName: string): void;
+    /** All persistent per-tool overrides. */
+    getToolOverrides(): Record<string, PolicyAction>;
     /**
      * Set session override for a tool
      */

package/dist/security/tool-policy/policy-manager.js

@@ -25,6 +25,7 @@ import { DEFAULT_POLICY_CONFIG } from './types.js';
 import { PolicyResolver } from './policy-resolver.js';
 import { getProfile, getProfileNames } from './profiles.js';
 import { getToolGroups, registerToolGroups } from './tool-groups.js';
+import { writeJsonAtomicSync } from '../../utils/atomic-write.js';
 // ============================================================================
 // Policy Manager
 // ============================================================================
@@ -63,6 +64,9 @@ export class PolicyManager extends EventEmitter {
         const context = {
             args,
             sessionOverrides: this.sessionOverrides,
+            // Persistent per-tool overrides (set from the Capacités GUI / CLI) —
+            // the resolver already honours these right below session overrides.
+            globalOverrides: new Map(Object.entries(this.config.toolOverrides)),
         };
         const decision = this.resolver.resolve(toolName, context);
         // Cache the decision
@@ -137,6 +141,28 @@ export class PolicyManager extends EventEmitter {
     // ============================================================================
     // Session Overrides
     // ============================================================================
+    /**
+     * Set a PERSISTENT per-tool override (survives restarts; resolver priority
+     * just below session overrides). This is the Hermes-style per-tool gate.
+     */
+    setToolOverride(toolName, action) {
+        this.config.toolOverrides[toolName] = action;
+        this.resolver.updateConfig(this.config);
+        this.clearCache();
+        this.emit('policy:rule-added', { rule: { group: toolName, action }, source: 'global' });
+        this.saveConfig();
+    }
+    /** Remove a persistent per-tool override (back to profile/group rules). */
+    clearToolOverride(toolName) {
+        delete this.config.toolOverrides[toolName];
+        this.resolver.updateConfig(this.config);
+        this.clearCache();
+        this.saveConfig();
+    }
+    /** All persistent per-tool overrides. */
+    getToolOverrides() {
+        return { ...this.config.toolOverrides };
+    }
     /**
      * Set session override for a tool
      */
@@ -311,6 +337,7 @@ export class PolicyManager extends EventEmitter {
                     globalRules: loaded.globalRules || [],
                     agentRules: loaded.agentRules || {},
                     providerRules: loaded.providerRules || {},
+                    toolOverrides: loaded.toolOverrides || {},
                 };
             }
         }
@@ -328,7 +355,7 @@ export class PolicyManager extends EventEmitter {
             if (!fs.existsSync(dir)) {
                 fs.mkdirSync(dir, { recursive: true });
             }
-            fs.writeFileSync(this.configPath, JSON.stringify(this.config, null, 2));
+            writeJsonAtomicSync(this.configPath, this.config, { mode: 0o600 });
             this.emit('policy:config-saved', { config: this.config });
         }
         catch (error) {

package/dist/security/tool-policy/profiles.js

@@ -19,6 +19,12 @@ const MINIMAL_PROFILE = {
     description: 'Read-only mode. No file modifications or command execution.',
     customizable: true,
     rules: [
+        {
+            group: 'group:safe',
+            action: 'allow',
+            reason: 'Audited read-only and bounded tools are safe',
+            priority: 20,
+        },
         // Allow read operations
         {
             group: 'group:fs:read',
@@ -132,6 +138,12 @@ const CODING_PROFILE = {
     description: 'Standard development. File edits allowed, commands require confirmation.',
     customizable: true,
     rules: [
+        {
+            group: 'group:safe',
+            action: 'allow',
+            reason: 'Audited read-only and bounded tools are allowed',
+            priority: 20,
+        },
         // Allow all file read
         {
             group: 'group:fs:read',
@@ -255,6 +267,12 @@ const MESSAGING_PROFILE = {
     description: 'Communication focus. Web access allowed, limited file operations.',
     customizable: true,
     rules: [
+        {
+            group: 'group:safe',
+            action: 'allow',
+            reason: 'Audited read-only and bounded tools are allowed',
+            priority: 20,
+        },
         // Allow file read
         {
             group: 'group:fs:read',
@@ -371,6 +389,12 @@ const FULL_PROFILE = {
     description: 'Full access. All operations allowed, dangerous ones require confirmation.',
     customizable: true,
     rules: [
+        {
+            group: 'group:safe',
+            action: 'allow',
+            reason: 'Audited read-only and bounded tools are allowed',
+            priority: 20,
+        },
         // Allow all file operations
         {
             group: 'group:fs',

package/dist/security/tool-policy/tool-groups.js

@@ -5,6 +5,9 @@
  * Each tool can belong to multiple groups (e.g., 'bash' belongs to both
  * 'group:runtime:shell' and 'group:dangerous').
  */
+import { TOOL_ALIASES } from '../../tools/registry/tool-alias-map.js';
+import { TOOL_METADATA } from '../../tools/metadata.js';
+const FLEET_SAFE_TOOL_NAMES = new Set(TOOL_METADATA.filter((metadata) => metadata.fleetSafe === true).map((metadata) => metadata.name));
 // ============================================================================
 // Tool to Groups Mapping
 // ============================================================================
@@ -39,6 +42,9 @@ export const TOOL_GROUPS = {
     execute: ['group:runtime', 'group:runtime:shell'],
     run_command: ['group:runtime', 'group:runtime:shell'],
     execute_code: ['group:runtime', 'group:runtime:shell', 'group:dangerous'],
+    // Computation-only orchestrator. Every nested effect is independently sent
+    // through ToolHandler and inherits that tool's real policy groups.
+    code_exec: ['group:safe'],
     // Runtime - Process
     spawn_process: ['group:runtime', 'group:runtime:process'],
     kill_process: ['group:runtime', 'group:runtime:process', 'group:dangerous'],
@@ -55,6 +61,7 @@ export const TOOL_GROUPS = {
     video_generate: ['group:fs', 'group:web'],
     video_analyze: ['group:fs', 'group:fs:read', 'group:web'],
     vision_analyze: ['group:fs', 'group:fs:read'],
+    object_detect: ['group:fs', 'group:fs:read'],
     // Web - Search
     web_search: ['group:web', 'group:web:search'],
     tavily_search: ['group:web', 'group:web:search'],
@@ -121,10 +128,11 @@ export const TOOL_GROUPS = {
     // System - Modify
     set_env: ['group:system', 'group:system:modify'],
     install_package: ['group:system', 'group:system:modify'],
+    extension_forge: ['group:system', 'group:system:modify', 'group:dangerous'],
     // Planning/Reasoning (no special groups - generally safe)
-    plan: [],
-    think: [],
-    reason: [],
+    plan: ['group:safe'],
+    think: ['group:safe'],
+    reason: ['group:safe'],
     todo_read: [],
     todo_write: [],
     spawn_parallel_agents: [],
@@ -159,6 +167,21 @@ export function getToolGroups(toolName) {
     if (groups) {
         return [...groups];
     }
+    // Canonical aliases must inherit the primary tool's policy groups. Without
+    // this, `shell_exec`, `file_write`, etc. fell back to the unknown-tool policy
+    // even though they dispatch to the exact same implementation.
+    const primaryName = TOOL_ALIASES[toolName];
+    if (primaryName && primaryName !== toolName) {
+        return getToolGroups(primaryName);
+    }
+    // fleetSafe is an opt-in, audited contract: no arbitrary execution, secret
+    // exfiltration, UI driving or unbounded effects. Treat it as the maintained
+    // common read-only group instead of forcing REST/batch callers to confirm
+    // harmless weather/status/search tools merely because a hand-written map
+    // forgot their name.
+    if (FLEET_SAFE_TOOL_NAMES.has(toolName)) {
+        return ['group:safe'];
+    }
     // Unknown tool - return empty array
     return [];
 }

package/dist/security/tool-policy/types.d.ts

@@ -13,7 +13,7 @@
  * Hierarchical tool groups for categorization.
  * Uses colon-separated hierarchy (e.g., 'group:fs:write' inherits from 'group:fs')
  */
-export type ToolGroup = 'group:fs' | 'group:fs:read' | 'group:fs:write' | 'group:fs:delete' | 'group:runtime' | 'group:runtime:shell' | 'group:runtime:process' | 'group:web' | 'group:web:fetch' | 'group:web:search' | 'group:git' | 'group:git:read' | 'group:git:write' | 'group:docker' | 'group:kubernetes' | 'group:system' | 'group:system:info' | 'group:system:modify' | 'group:dangerous' | 'group:mcp' | 'group:plugin';
+export type ToolGroup = 'group:fs' | 'group:fs:read' | 'group:fs:write' | 'group:fs:delete' | 'group:runtime' | 'group:runtime:shell' | 'group:runtime:process' | 'group:web' | 'group:web:fetch' | 'group:web:search' | 'group:git' | 'group:git:read' | 'group:git:write' | 'group:docker' | 'group:kubernetes' | 'group:system' | 'group:system:info' | 'group:system:modify' | 'group:safe' | 'group:dangerous' | 'group:mcp' | 'group:plugin';
 /**
  * All tool groups for iteration
  */
@@ -133,6 +133,8 @@ export interface PolicyConfig {
     auditLog: boolean;
     /** Default action for unknown tools */
     defaultAction: PolicyAction;
+    /** Persistent per-tool overrides (Hermes-style per-tool gating from the GUI) */
+    toolOverrides: Record<string, PolicyAction>;
 }
 /**
  * Default policy configuration

package/dist/security/tool-policy/types.js

@@ -31,6 +31,7 @@ export const ALL_TOOL_GROUPS = [
     'group:system',
     'group:system:info',
     'group:system:modify',
+    'group:safe',
     'group:dangerous',
     'group:mcp',
     'group:plugin',
@@ -63,6 +64,7 @@ export const DEFAULT_POLICY_CONFIG = {
     agentRules: {},
     providerRules: {},
     auditLog: false,
+    toolOverrides: {},
     defaultAction: 'confirm',
 };
 //# sourceMappingURL=types.js.map

package/dist/security/trust-folders.js

@@ -11,6 +11,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
 import { logger } from '../utils/logger.js';
+import { writeJsonAtomicSync } from '../utils/atomic-write.js';
 const CONFIG_DIR = path.join(os.homedir(), '.codebuddy');
 const TRUST_FILE = path.join(CONFIG_DIR, 'trusted-folders.json');
 /**
@@ -191,10 +192,10 @@ export class TrustFolderManager {
             if (!fs.existsSync(CONFIG_DIR)) {
                 fs.mkdirSync(CONFIG_DIR, { recursive: true });
             }
-            fs.writeFileSync(TRUST_FILE, JSON.stringify({
+            writeJsonAtomicSync(TRUST_FILE, {
                 folders: [...this.trustedFolders],
                 enforcement: this.enforcementEnabled,
-            }, null, 2));
+            }, { mode: 0o600 });
         }
         catch (error) {
             logger.debug('Failed to save trusted folders', { error });

package/dist/security/write-policy.d.ts

@@ -25,6 +25,8 @@ export interface GateResult {
     requiresPatch: boolean;
     reason?: string;
 }
+/** Detect shell commands that write the workspace instead of using apply_patch. */
+export declare function isShellWriteCommand(command: string): boolean;
 export declare const WRITE_TOOL_NAMES: Set<string>;
 export declare class WritePolicy {
     private static _instance;
@@ -49,9 +51,15 @@ export declare class WritePolicy {
      * Returns true if the tool name is subject to write-policy gating.
      */
     isWriteTool(toolName: string): boolean;
+    /**
+     * Strict mode also blocks bash/shell redirects so agents cannot bypass
+     * apply_patch with `echo x > file`.
+     */
+    gateShell(command: string): Promise<GateResult>;
     /**
      * Subscribe to gate decisions (for RunStore integration).
      */
     onGate(listener: (op: WriteOperation, result: GateResult) => void): void;
     private notifyListeners;
+    private recordDecision;
 }