@rnbsolucoes/axion-code 0.1.16 → 0.1.18

package/README.md

@@ -280,8 +280,20 @@ guarded dispatcher must use.
 Requests are persisted in the shared session database under
 `%USERPROFILE%\.axion\sessions\axion.db` with the redacted decision, risk class,
 permission mode, impact summary and pending/approved/denied state. This is the
-headless contract that the TUI approval modal and guarded dispatcher will use
-before mutating filesystem, shell or MCP tools are enabled.
+headless contract used by the TUI approval menu and the future guarded
+dispatcher before mutating filesystem, shell or MCP tools are enabled.
+
+Provider stream `tool_call` events now open the TUI approval menu when the
+active permission mode requires review. Approve/Deny records the audited
+decision and returns focus to the chat input. Actual tool execution remains
+limited to the guarded dispatcher allow-list.
+
+`axion tool run` exposes the first guarded dispatcher surface. It currently
+supports `Read`, `Glob`, `Grep`, `Write` and `Edit` inside the active workspace.
+When the active permission mode requires approval, execution is allowed only if
+the supplied approval is already approved and matches the exact redacted tool
+request. Shell, MCP, browser, process and unknown tools remain unsupported even
+when an approval exists.
 
 Examples:
 
@@ -292,6 +304,8 @@ axion permission inspect mcp__serena__replace_symbol_body "{}" --mode full_permi
 axion permission request Bash "{\"command\":\"npm install left-pad\"}" --mode full_permission --session smoke --turn turn-1 --json
 axion permission approvals --session smoke --decision pending --json
 axion permission resolve <approval-id> --deny --reason "not needed" --json
+axion tool run Read "{\"path\":\"README.md\"}" --mode full_permission --json
+axion tool run Write "{\"path\":\"notes/out.txt\",\"content\":\"approved\"}" --session smoke --turn turn-1 --approval <approval-id> --mode request_permission --json
 ```
 
 Security invariants:
@@ -341,7 +355,9 @@ This is a functional direction MVP, not the full harness:
   deferred until the Nexus beta handoff;
 - terminal logo uses Sixel when available and falls back to width-bounded ANSI/block rendering;
 - initial chat splash shows the Axion logo and system name until the first interaction;
-- no mutating tool execution yet; the approval/sandbox classification and persisted approval queue contracts are implemented and inspectable;
+- guarded dispatcher execution is limited to workspace-local `Read`, `Glob`,
+  `Grep`, `Write` and `Edit`; shell, MCP, browser, process and unknown tools
+  remain blocked;
 - no executable Pi RPC bridge yet;
 - no MCP transport execution yet;
 - native subagent execution is prompt-isolated and provider/model-inherited; richer multi-subagent orchestration, streaming and budget telemetry remain next-cycle items.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rnbsolucoes/axion-code",
-  "version": "0.1.16",
+  "version": "0.1.18",
   "description": "Axion Code CLI harness for the Axion ecosystem.",
   "type": "module",
   "repository": {