@rnbsolucoes/axion-code 0.1.17 → 0.1.18

package/README.md

@@ -286,7 +286,14 @@ dispatcher before mutating filesystem, shell or MCP tools are enabled.
 Provider stream `tool_call` events now open the TUI approval menu when the
 active permission mode requires review. Approve/Deny records the audited
 decision and returns focus to the chat input. Actual tool execution remains
-blocked until the guarded dispatcher is enabled.
+limited to the guarded dispatcher allow-list.
+
+`axion tool run` exposes the first guarded dispatcher surface. It currently
+supports `Read`, `Glob`, `Grep`, `Write` and `Edit` inside the active workspace.
+When the active permission mode requires approval, execution is allowed only if
+the supplied approval is already approved and matches the exact redacted tool
+request. Shell, MCP, browser, process and unknown tools remain unsupported even
+when an approval exists.
 
 Examples:
 
@@ -297,6 +304,8 @@ axion permission inspect mcp__serena__replace_symbol_body "{}" --mode full_permi
 axion permission request Bash "{\"command\":\"npm install left-pad\"}" --mode full_permission --session smoke --turn turn-1 --json
 axion permission approvals --session smoke --decision pending --json
 axion permission resolve <approval-id> --deny --reason "not needed" --json
+axion tool run Read "{\"path\":\"README.md\"}" --mode full_permission --json
+axion tool run Write "{\"path\":\"notes/out.txt\",\"content\":\"approved\"}" --session smoke --turn turn-1 --approval <approval-id> --mode request_permission --json
 ```
 
 Security invariants:
@@ -346,9 +355,9 @@ This is a functional direction MVP, not the full harness:
   deferred until the Nexus beta handoff;
 - terminal logo uses Sixel when available and falls back to width-bounded ANSI/block rendering;
 - initial chat splash shows the Axion logo and system name until the first interaction;
-- no mutating tool execution yet; the approval/sandbox classification,
-  persisted approval queue and TUI approval menu are implemented and
-  inspectable;
+- guarded dispatcher execution is limited to workspace-local `Read`, `Glob`,
+  `Grep`, `Write` and `Edit`; shell, MCP, browser, process and unknown tools
+  remain blocked;
 - no executable Pi RPC bridge yet;
 - no MCP transport execution yet;
 - native subagent execution is prompt-isolated and provider/model-inherited; richer multi-subagent orchestration, streaming and budget telemetry remain next-cycle items.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rnbsolucoes/axion-code",
-  "version": "0.1.17",
+  "version": "0.1.18",
   "description": "Axion Code CLI harness for the Axion ecosystem.",
   "type": "module",
   "repository": {