@pugi/cli 0.1.0-beta.3 → 0.1.0-beta.31

package/dist/core/permissions/gate.js

@@ -0,0 +1,187 @@
+/**
+ * Permission gate — Leak L6 canonical 4-mode enforcement.
+ *
+ * Single dispatch entry point. Every tool call goes through `gate()`
+ * before the executor runs the tool body; the executor surfaces the
+ * `PermissionDenied` error as a model-readable sentinel so the model
+ * can either reformulate the request or wait for the operator to
+ * change the mode.
+ *
+ * Routing matrix (mode × class):
+ *
+ *                 |  read  | write  | dispatch
+ *   plan          |  allow |  deny  |  deny
+ *   ask           |  ask   |  ask   |  ask
+ *   allow         |  allow |  allow |  allow
+ *   bypass        |  allow |  allow |  allow   (plus: hooks bypassed)
+ *
+ * In ask mode the gate consults a session-scoped `always-allow` cache
+ * keyed by tool name (set when the operator picks "always-allow-tool"
+ * in the prompt). The cache is in-memory only — restarting the session
+ * resets it, by design (every-session-fresh ask consent).
+ *
+ * Bypass mode does NOT take a different code path in this module — the
+ * `hooksBypassed` flag in the decision payload signals the executor /
+ * hook layer to skip policy hooks. The classification logic is the
+ * same as `allow` because the gate doesn't own hook execution; the
+ * caller decides what to do with the bypass signal.
+ */
+import { getToolClass } from './tool-class.js';
+export const ASK_OPTIONS = Object.freeze([
+    'allow-once',
+    'always-this-tool',
+    'deny-once',
+    'always-deny-this-tool',
+]);
+export function createAskAlwaysCache() {
+    return {
+        alwaysAllowed: new Set(),
+        alwaysDenied: new Set(),
+    };
+}
+/**
+ * Apply the operator's answer to an `ask` decision. Caller invokes this
+ * after the operator picks an option so the cache stays in sync.
+ * Returns the effective decision: `allow-once` / `always-this-tool`
+ * become `allow`; `deny-once` / `always-deny-this-tool` become `deny`.
+ *
+ * `always-*` answers persist to the cache and short-circuit the next
+ * gate call for the same tool name within the same session.
+ */
+export function applyAskAnswer(cache, toolName, answer) {
+    switch (answer) {
+        case 'allow-once':
+            return { decision: 'allow', reason: `Allowed once for ${toolName}` };
+        case 'always-this-tool':
+            cache.alwaysAllowed.add(toolName);
+            cache.alwaysDenied.delete(toolName);
+            return { decision: 'allow', reason: `Allowed for ${toolName} this session` };
+        case 'deny-once':
+            return { decision: 'deny', reason: `Denied once for ${toolName}` };
+        case 'always-deny-this-tool':
+            cache.alwaysDenied.add(toolName);
+            cache.alwaysAllowed.delete(toolName);
+            return { decision: 'deny', reason: `Denied for ${toolName} this session` };
+    }
+}
+/**
+ * Permission-denied sentinel. Distinguishable from other tool errors
+ * (parse errors, IO failures) so the caller can route the message back
+ * to the model with the canonical recovery hint.
+ */
+export class PermissionDenied extends Error {
+    name = 'PermissionDenied';
+    mode;
+    toolName;
+    toolClass;
+    /**
+     * Human-friendly reason surfaced in logs / hook payloads. Distinct
+     * from `message` so the spec layer can pattern-match the canonical
+     * `PERMISSION_DENIED:` sentinel verbatim while operators see the
+     * full explanation in console output.
+     */
+    reason;
+    constructor(toolName, toolClass, mode, reason) {
+        // The base Error.message is the canonical sentinel so default
+        // toString() / re-throw paths preserve the format the model and
+        // the spec layer pattern-match against.
+        super(`PERMISSION_DENIED: ${toolName} blocked in ${mode} mode. Operator can switch with /permissions <mode>.`);
+        this.mode = mode;
+        this.toolName = toolName;
+        this.toolClass = toolClass;
+        this.reason = reason;
+    }
+    /**
+     * Render the sentinel message the executor surfaces to the model.
+     * The string format is stable so a parent agent / E2E spec can
+     * pattern-match `PERMISSION_DENIED: <tool> blocked in <mode> mode.`
+     * verbatim. Equivalent to `this.message`; kept as a method so
+     * downstream callers can use whichever spelling reads better at the
+     * site.
+     */
+    toModelMessage() {
+        return this.message;
+    }
+}
+/**
+ * Core dispatch gate. Pure function — no IO, no side effects beyond
+ * mutating the caller-supplied `alwaysCache`. Safe to call from any
+ * layer (engine adapter, agent-as-tool bridge, doctor command).
+ *
+ * Argument bag mirrors the executor entry shape:
+ *   - `toolName` is the registered tool key (e.g. `read`, `write`,
+ *     `mcp__github__list_issues`).
+ *   - `args` is the raw arg payload. Currently unused in the routing
+ *     decision — the matrix only cares about class. Plumbed in
+ *     because future "always-allow-this-pattern" rules (e.g.
+ *     `git status` auto-allow) will consume it without changing the
+ *     callsite contract.
+ *   - `ctx` carries mode + session-scoped state.
+ */
+export function gate(toolName, 
+// Reserved for future pattern-based rules (always-allow `git status`).
+// Suppress unused-argument lint — the contract is stable on purpose.
+_args, ctx) {
+    const toolClass = getToolClass(toolName);
+    const cache = ctx.alwaysCache;
+    // Ask-mode session memory: an explicit "always-deny" beats any other
+    // routing because the operator has actively refused this tool.
+    if (cache?.alwaysDenied.has(toolName)) {
+        return {
+            decision: 'deny',
+            reason: `Tool ${toolName} denied for the session via /permissions ask`,
+        };
+    }
+    // "Always-allow" in ask mode skips the prompt for subsequent calls.
+    // Plan mode IGNORES the always-allow cache because plan mode's
+    // contract is structural (read-only), not consent-based.
+    if (cache?.alwaysAllowed.has(toolName) && ctx.permissionMode === 'ask') {
+        return {
+            decision: 'allow',
+            reason: `Tool ${toolName} always-allowed for this session`,
+        };
+    }
+    switch (ctx.permissionMode) {
+        case 'plan': {
+            if (toolClass === 'read') {
+                return { decision: 'allow', reason: `Plan mode: read tools allowed (${toolName})` };
+            }
+            return {
+                decision: 'deny',
+                reason: `Plan mode: ${toolClass} tools blocked. Switch with /permissions allow.`,
+            };
+        }
+        case 'ask': {
+            return {
+                decision: 'ask',
+                reason: `Ask mode: prompt before ${toolName}`,
+                question: buildAskQuestion(toolName, toolClass, ctx.target),
+                options: ASK_OPTIONS,
+                toolClass,
+            };
+        }
+        case 'allow': {
+            return {
+                decision: 'allow',
+                reason: `Allow mode: ${toolName} executed`,
+            };
+        }
+        case 'bypass': {
+            return {
+                decision: 'allow',
+                reason: `Bypass mode: ${toolName} executed (policy hooks skipped)`,
+                hooksBypassed: true,
+            };
+        }
+    }
+}
+/**
+ * Build the operator-facing question string for an ask-mode prompt.
+ * Kept in one place so the wording stays consistent across the REPL
+ * Ink modal and the simpler stdin fallback.
+ */
+function buildAskQuestion(toolName, toolClass, target) {
+    const suffix = target ? ` on ${target}` : '';
+    return `Allow ${toolName} (${toolClass})${suffix}?`;
+}
+//# sourceMappingURL=gate.js.map

package/dist/core/permissions/index.js

@@ -0,0 +1,18 @@
+/**
+ * Permission gate (Leak L6) public surface.
+ *
+ * Re-exports the canonical 4-mode types, the tool-class classifier,
+ * the dispatch gate, and the workspace + global session-state helpers
+ * so callers import from one place:
+ *
+ *   import { gate, resolveMode, PermissionDenied } from '<...>/permissions/index.js';
+ *
+ * Keeps the internal file split (mode / tool-class / gate / state)
+ * invisible to consumers — those files are an implementation detail
+ * the engine adapter does not need to know about.
+ */
+export { DEFAULT_PERMISSION_MODE, PERMISSION_MODE_GLOSS, PERMISSION_MODES, isPermissionMode, parsePermissionMode, toLegacyMode, } from './mode.js';
+export { getToolClass, listBuiltInToolClasses, } from './tool-class.js';
+export { ASK_OPTIONS, PermissionDenied, applyAskAnswer, createAskAlwaysCache, gate, } from './gate.js';
+export { getCurrentMode, getGlobalDefaultMode, getPreviousMode, globalConfigPath, resolveMode, sessionStatePath, setCurrentMode, setGlobalDefaultMode, setPreviousMode, } from './state.js';
+//# sourceMappingURL=index.js.map

package/dist/core/permissions/mode.js

@@ -0,0 +1,102 @@
+/**
+ * Permission modes — canonical 4-mode taxonomy (Leak L6).
+ *
+ * Pugi historically shipped a 6-mode taxonomy in `@pugi/sdk`
+ * (`plan | ask | acceptEdits | auto | dontAsk | bypassPermissions`)
+ * which the legacy `core/permission.ts` engine maps tools onto. Claude
+ * Code, Codex, and the openclaude / openwork leaks all converge on a
+ * smaller, sharper 4-mode set:
+ *
+ *   - `plan`    — read-only proposal mode. Write/dispatch tools refused
+ *                 with a deterministic sentinel; the model is expected
+ *                 to surface a plan, not execute it.
+ *   - `ask`     — every tool execution prompts the operator. Default
+ *                 mode for new operators; the safe ground state.
+ *   - `allow`   — every tool executes without per-call prompts, BUT
+ *                 the policy hook layer (skill-steering, denial audit,
+ *                 destructive deny-list) still fires.
+ *   - `bypass`  — same as allow but ALSO skips policy hooks. Power-user
+ *                 mode for trusted scripted runs; surface a banner on
+ *                 entry so an operator who flips here by accident sees
+ *                 they have disengaged the audit layer.
+ *
+ * This module owns the union type, the canonical default, and the
+ * mode-resolution helper. The runtime gate (`gate.ts`) consumes it; the
+ * legacy 6-mode SDK enum remains the system-of-record for bash-class
+ * decisions inside `core/permission.ts` — the canonical 4-mode layer
+ * sits in front and short-circuits the dispatch decision before bash
+ * classification ever runs.
+ */
+/**
+ * Closed list — useful for input validation and slash-command help.
+ */
+export const PERMISSION_MODES = Object.freeze([
+    'plan',
+    'ask',
+    'allow',
+    'bypass',
+]);
+/**
+ * Default mode applied when no `--mode` flag, no per-workspace session
+ * state, and no `defaultPermissionMode` in `~/.pugi/config.json`. We
+ * default cautious (`ask`) — an operator who has not configured anything
+ * is treated as a new operator who deserves visibility into every tool
+ * call.
+ */
+export const DEFAULT_PERMISSION_MODE = 'ask';
+/**
+ * Type guard for arbitrary string input (CLI flag, session.json
+ * deserialization). Returns false for casing variants — caller is
+ * expected to lowercase before testing.
+ */
+export function isPermissionMode(value) {
+    return typeof value === 'string' && PERMISSION_MODES.includes(value);
+}
+/**
+ * Parse + validate a mode string. Returns null for invalid input so the
+ * caller can surface a typed error (`unknown mode: <value>`) instead of
+ * throwing from a parse helper.
+ */
+export function parsePermissionMode(value) {
+    const lower = value.trim().toLowerCase();
+    return isPermissionMode(lower) ? lower : null;
+}
+/**
+ * Map the canonical 4-mode taxonomy to the legacy 6-mode SDK enum used
+ * by `core/permission.ts::evaluateBashPermission` and friends. The map
+ * is intentionally surjective on a narrower target — the canonical
+ * layer is the new public contract, the legacy layer is plumbing.
+ *
+ *   plan   -> 'plan'              (read-only)
+ *   ask    -> 'ask'               (prompt every action)
+ *   allow  -> 'auto'              (allow non-destructive; deny destructive)
+ *   bypass -> 'bypassPermissions' (allow everything except destructive override)
+ *
+ * Callers that need the legacy enum (existing bash classifier, settings
+ * persistence) should funnel through this helper so the mapping is in
+ * one place.
+ */
+export function toLegacyMode(mode) {
+    switch (mode) {
+        case 'plan':
+            return 'plan';
+        case 'ask':
+            return 'ask';
+        case 'allow':
+            return 'auto';
+        case 'bypass':
+            return 'bypassPermissions';
+    }
+}
+/**
+ * One-line human-readable summary surfaced by the `/permissions` table
+ * and `pugi --help` text. Kept inline so the strings stay localizable
+ * via a single edit point.
+ */
+export const PERMISSION_MODE_GLOSS = Object.freeze({
+    plan: 'Read-only — propose, never execute. Write + dispatch tools refused.',
+    ask: 'Prompt before every tool call. Default for new operators.',
+    allow: 'Execute tools without prompts. Policy hooks still fire.',
+    bypass: 'Execute tools without prompts AND skip policy hooks. Power-user only.',
+});
+//# sourceMappingURL=mode.js.map

package/dist/core/permissions/state.js

@@ -0,0 +1,215 @@
+/**
+ * Per-workspace permission-mode session state — Leak L6.
+ *
+ * State lives in `.pugi/session.json` under the workspace root. The
+ * file is read on first `getCurrentMode()` call (cached for the
+ * process lifetime) and written atomically via tmp+rename on
+ * `setCurrentMode()` so a kill mid-write does not corrupt the JSON.
+ *
+ * Resolution order for the effective mode on a fresh process:
+ *   1. CLI flag (`pugi --mode plan`) — passed via `resolveMode` arg;
+ *      not read from disk here.
+ *   2. Workspace session state — `<root>/.pugi/session.json` field
+ *      `permissionMode`.
+ *   3. Global config — `~/.pugi/config.json` field
+ *      `defaultPermissionMode`.
+ *   4. Hard default `ask`.
+ *
+ * This module owns layers 2 + 3. The CLI arg parser owns layer 1; both
+ * funnel into `resolveMode()` which performs the merge.
+ */
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { homedir } from 'node:os';
+import { z } from 'zod';
+import { DEFAULT_PERMISSION_MODE, isPermissionMode, parsePermissionMode, } from './mode.js';
+const permissionModeEnum = z.enum(['plan', 'ask', 'allow', 'bypass']);
+const sessionStateSchema = z
+    .object({
+    permissionMode: permissionModeEnum.optional(),
+    /**
+     * Leak L7: snapshot of the mode that was active immediately BEFORE
+     * the operator typed `/plan` (or `/plan <prompt>`). `/plan --back`
+     * pops this snapshot and restores it. Cleared after a successful
+     * pop so a second `/plan --back` does not double-revert.
+     */
+    previousPermissionMode: permissionModeEnum.optional(),
+})
+    .partial()
+    .passthrough();
+const globalConfigSchema = z
+    .object({
+    defaultPermissionMode: permissionModeEnum.optional(),
+})
+    .partial()
+    .passthrough();
+const SESSION_FILE = '.pugi/session.json';
+/**
+ * Return the path to the workspace session-state file.
+ */
+export function sessionStatePath(workspaceRoot) {
+    return resolve(workspaceRoot, SESSION_FILE);
+}
+/**
+ * Return the path to the user-global config file. Uses HOME env when
+ * present (test fixtures, CI) so we never accidentally hit the real
+ * user-global file in spec runs.
+ */
+export function globalConfigPath(homeDir = homedir()) {
+    return resolve(homeDir, '.pugi/config.json');
+}
+/**
+ * Read the workspace's saved permission mode. Returns null when the
+ * file is absent OR the field is unset; the caller layers in CLI + env
+ * + global config defaults to produce the effective mode.
+ *
+ * Never throws on JSON parse / schema errors — a malformed session
+ * file should not break the gate. The defensive `try/catch` returns
+ * null and lets the caller fall through to the next layer.
+ */
+export function getCurrentMode(workspaceRoot) {
+    const path = sessionStatePath(workspaceRoot);
+    if (!existsSync(path))
+        return null;
+    try {
+        const raw = readFileSync(path, 'utf8');
+        const parsed = sessionStateSchema.parse(JSON.parse(raw));
+        return isPermissionMode(parsed.permissionMode) ? parsed.permissionMode : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Persist the workspace's permission mode. Creates the `.pugi/` dir
+ * when missing; preserves any unrelated keys in the file (passthrough
+ * schema). Atomic tmp+rename so a kill mid-write does not corrupt the
+ * JSON.
+ */
+export function setCurrentMode(workspaceRoot, mode) {
+    const path = sessionStatePath(workspaceRoot);
+    mkdirSync(dirname(path), { recursive: true });
+    const existing = existsSync(path)
+        ? safeParseObject(readFileSync(path, 'utf8'))
+        : {};
+    const next = { ...existing, permissionMode: mode };
+    const tmpPath = `${path}.tmp`;
+    writeFileSync(tmpPath, `${JSON.stringify(next, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    renameSync(tmpPath, path);
+}
+/**
+ * Leak L7 — read the snapshot of the mode that was active before the
+ * most-recent `/plan` (or `pugi plan`) entry. Returns null when the
+ * file is absent OR the field is unset. Same defensive behaviour as
+ * `getCurrentMode`: a malformed session file never breaks the slash
+ * command — the worst case is `/plan --back` reports "no previous
+ * mode to restore" and the operator picks the target mode explicitly.
+ */
+export function getPreviousMode(workspaceRoot) {
+    const path = sessionStatePath(workspaceRoot);
+    if (!existsSync(path))
+        return null;
+    try {
+        const raw = readFileSync(path, 'utf8');
+        const parsed = sessionStateSchema.parse(JSON.parse(raw));
+        return isPermissionMode(parsed.previousPermissionMode)
+            ? parsed.previousPermissionMode
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Leak L7 — record the mode that was active immediately before the
+ * operator switched to plan. The runtime calls this AT `/plan` entry
+ * with the current mode (whatever `resolveMode` returned). Atomic
+ * tmp+rename keeps the snapshot consistent if the process is killed
+ * mid-write. Pass `null` to clear the snapshot (used after a
+ * successful `/plan --back` so a second `--back` does not loop).
+ */
+export function setPreviousMode(workspaceRoot, mode) {
+    const path = sessionStatePath(workspaceRoot);
+    mkdirSync(dirname(path), { recursive: true });
+    const existing = existsSync(path)
+        ? safeParseObject(readFileSync(path, 'utf8'))
+        : {};
+    const next = { ...existing };
+    if (mode === null) {
+        delete next.previousPermissionMode;
+    }
+    else {
+        next.previousPermissionMode = mode;
+    }
+    const tmpPath = `${path}.tmp`;
+    writeFileSync(tmpPath, `${JSON.stringify(next, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    renameSync(tmpPath, path);
+}
+/**
+ * Read `~/.pugi/config.json::defaultPermissionMode`. Returns null when
+ * the file is absent / the field is unset; same defensive behaviour
+ * as `getCurrentMode` — a malformed global config never breaks the gate.
+ */
+export function getGlobalDefaultMode(homeDir = homedir()) {
+    const path = globalConfigPath(homeDir);
+    if (!existsSync(path))
+        return null;
+    try {
+        const raw = readFileSync(path, 'utf8');
+        const parsed = globalConfigSchema.parse(JSON.parse(raw));
+        return isPermissionMode(parsed.defaultPermissionMode) ? parsed.defaultPermissionMode : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Persist `~/.pugi/config.json::defaultPermissionMode`. Used by the
+ * `/permissions <mode> --persist` flow so a future fresh session
+ * defaults to the same mode without an explicit `--mode` flag.
+ */
+export function setGlobalDefaultMode(mode, homeDir = homedir()) {
+    const path = globalConfigPath(homeDir);
+    mkdirSync(dirname(path), { recursive: true });
+    const existing = existsSync(path)
+        ? safeParseObject(readFileSync(path, 'utf8'))
+        : {};
+    const next = { ...existing, defaultPermissionMode: mode };
+    const tmpPath = `${path}.tmp`;
+    writeFileSync(tmpPath, `${JSON.stringify(next, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    renameSync(tmpPath, path);
+}
+export function resolveMode(options) {
+    if (options.cliFlag) {
+        const flag = parsePermissionMode(options.cliFlag);
+        if (flag)
+            return flag;
+    }
+    const workspace = getCurrentMode(options.workspaceRoot);
+    if (workspace)
+        return workspace;
+    const global = getGlobalDefaultMode(options.homeDir);
+    if (global)
+        return global;
+    return DEFAULT_PERMISSION_MODE;
+}
+/**
+ * Defensive helper — parse JSON to an object; non-object payload (top-
+ * level array, primitive) collapses to an empty object so the merge
+ * doesn't surface a TypeError. The `setCurrentMode` / `setGlobalDefaultMode`
+ * helpers only write objects, so a non-object existing file is corrupted
+ * and we explicitly reset it rather than appending into a non-object.
+ */
+function safeParseObject(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+            return parsed;
+        }
+        return {};
+    }
+    catch {
+        return {};
+    }
+}
+//# sourceMappingURL=state.js.map

package/dist/core/permissions/tool-class.js

@@ -0,0 +1,93 @@
+/**
+ * Tool side-effect classification — Leak L6.
+ *
+ * Three classes drive the canonical 4-mode permission gate:
+ *
+ *   - `read`     — observe-only. Plan mode allows; ask still prompts;
+ *                  allow + bypass execute silently. Examples: read,
+ *                  grep, glob, web_fetch, web_search, skills_list.
+ *   - `write`    — mutates workspace, journal, or operator screen with
+ *                  visible side effects. Plan mode refuses; ask prompts;
+ *                  allow + bypass execute. Examples: write, edit, bash,
+ *                  multi_edit, task_*. `ask_user_question` is also
+ *                  classed as `write` because it interrupts the
+ *                  dispatcher's flow control and demands operator
+ *                  attention — plan mode should not prompt operators.
+ *   - `dispatch` — spawns a child subagent or off-tree task. Plan mode
+ *                  refuses (a write-capable child violates plan-mode's
+ *                  read-only contract); ask prompts; allow + bypass
+ *                  execute. Example: `agent`.
+ *
+ * Unknown tool names default to `write` — deny-first safety. A stale
+ * schema entry that the gate has not been told about should not silently
+ * pass in plan mode just because the gate doesn't recognise it.
+ */
+/**
+ * Closed map of every built-in tool name -> side-effect class. The
+ * source of truth for the four standard modes; mirrored against the
+ * `WIRED_TOOLS` set in `core/engine/tool-bridge.ts` so an unrecognised
+ * tool surfaces as the safe deny-first `write` default.
+ *
+ * MCP tools follow the `mcp__<server>__<tool>` namespace and are
+ * uniformly classed via `getToolClass` because per-tool annotations are
+ * not yet a part of the MCP spec — treating them as `write` is the
+ * conservative default until server-side metadata is trustworthy.
+ */
+const BUILT_IN_TOOL_CLASSES = Object.freeze({
+    // Read-only observations.
+    read: 'read',
+    grep: 'read',
+    glob: 'read',
+    ls: 'read',
+    search: 'read',
+    web_fetch: 'read',
+    web_search: 'read',
+    file_cache_check: 'read',
+    skills_list: 'read',
+    skill: 'read',
+    task_get: 'read',
+    task_list: 'read',
+    // Mutating actions.
+    write: 'write',
+    edit: 'write',
+    multi_edit: 'write',
+    bash: 'write',
+    task_create: 'write',
+    task_update: 'write',
+    todo_write: 'write',
+    // `ask_user_question` halts the loop and demands operator attention.
+    // Plan mode should not interrupt — class as write so the gate refuses
+    // it in plan mode but ask + allow + bypass execute normally.
+    ask_user_question: 'write',
+    // Dispatch — spawn a child agent. Refused in plan mode regardless of
+    // the child's role tier (the engine adapter applies role-based
+    // capability filtering, but the gate refuses dispatch up front so a
+    // plan-mode session cannot leak a writeable child).
+    agent: 'dispatch',
+    pugi_delegate: 'dispatch',
+    sub_agent_spawn: 'dispatch',
+});
+const MCP_TOOL_PREFIX = 'mcp__';
+/**
+ * Resolve the class for a tool name. Unknown names default to `write`
+ * (deny-first). MCP tools (any name prefixed with `mcp__`) default to
+ * `write` for the same conservative reason — the MCP spec lacks
+ * per-tool annotations today.
+ */
+export function getToolClass(toolName) {
+    const builtIn = BUILT_IN_TOOL_CLASSES[toolName];
+    if (builtIn)
+        return builtIn;
+    if (toolName.startsWith(MCP_TOOL_PREFIX))
+        return 'write';
+    return 'write';
+}
+/**
+ * Expose the built-in class map for diagnostic surfaces (`pugi doctor`,
+ * test fixtures). Caller MUST NOT mutate — the object is already frozen
+ * so any attempt throws in strict mode.
+ */
+export function listBuiltInToolClasses() {
+    return BUILT_IN_TOOL_CLASSES;
+}
+//# sourceMappingURL=tool-class.js.map