@thegitai/cli 1.0.0-preview.16 → 1.0.0-preview.18

package/dist/src/agent-mode.js

@@ -46,7 +46,7 @@ export function nextAgentMode(mode) {
 export function agentModeAllowsTool(mode, toolName) {
     return mode !== 'plan' || PLAN_MODE_TOOL_NAMES.has(toolName);
 }
-function getUnquotedShellText(command) {
+export function getUnquotedShellText(command) {
     let quote = null;
     let escaped = false;
     let text = '';

package/dist/src/help-text.js

@@ -47,7 +47,9 @@ const HELP_MARKDOWN = [
     '',
     '## Modes',
     '',
-    '- Default — asks before shell commands and file edits.',
+    '- Default — asks before creating, editing or deleting files and before',
+    '  running commands. Each answer can be remembered for the rest of the',
+    '  session; see Safety & approvals.',
     '- Auto-Accept — approves shell commands and file edits for the session.',
     '- Plan — read-only; the agent can inspect, ask typed questions, and plan,',
     '  with file-reading shell commands only. It will not edit files or run tests,',
@@ -91,12 +93,28 @@ const HELP_MARKDOWN = [
     '',
     '## Safety & approvals',
     '',
-    '- TheGitAI asks before running shell commands or applying file edits.',
+    '- In Default mode TheGitAI asks before it creates a file, edits an existing',
+    '  file, deletes a file, or runs a command. These are four separate',
+    '  permissions: allowing edits does not allow deletions, and allowing file',
+    '  changes does not allow commands.',
     '- At each prompt: **↑/↓** moves between choices, **Enter** confirms the',
-    '  highlighted one, and **Esc** denies. Deny is selected by default, and the',
-    '  choices are Approve once, Approve all remaining actions, and Deny.',
+    '  highlighted one, and **Esc** denies. Deny is selected by default.',
     '  Single-letter shortcuts were removed on purpose: a prompt can appear',
     '  while you are typing, and a stray letter must never approve anything.',
+    '- Every prompt offers Approve once, an "Always allow" for that kind of',
+    '  action, and Deny. A command also offers to remember just its prefix — for',
+    '  example approving `npm test -- --watch=false` can allow `npm test`.',
+    '- A prefix is only offered when the command shows a plain verb, as in',
+    '  `npm test` or `git status`. Commands with no verb (`ls -la`), interpreters',
+    '  and wrappers (`bash -c`, `python -c`, `env`, `timeout`, `make`), and',
+    '  destructive or network binaries (`rm`, `sudo`, `curl`) are never offered',
+    '  one — a bare binary grant would mean "anything this program can do".',
+    '  `npm run` must name its script, so the grant is `npm run build`.',
+    '- A remembered prefix never covers a command that chains, pipes, redirects,',
+    '  or substitutes, so allowing `npm test` can never green-light',
+    '  `npm test && rm -rf build`.',
+    '- Everything you allow lasts for the current session only and is forgotten',
+    '  when it ends. `/new` clears it immediately.',
     '- If an approved `sudo` command needs a password, the TUI shows the exact',
     '  command and keeps the password masked and local.',
     '- `-y` / `--yes` at startup auto-approves every shell command and file',

package/dist/src/permissions.js

@@ -0,0 +1,243 @@
+import { getUnquotedShellText } from './agent-mode.js';
+export const PERMISSION_BUCKETS = ['create', 'edit', 'delete', 'run'];
+export function createSessionGrants() {
+    return { buckets: [], commandPrefixes: [] };
+}
+export function bucketActionLabel(bucket) {
+    if (bucket === 'create')
+        return 'create files';
+    if (bucket === 'edit')
+        return 'edit files';
+    if (bucket === 'delete')
+        return 'delete files';
+    return 'run commands';
+}
+const NO_PREFIX_GRANT_BINARIES = new Set([
+    'rm',
+    'rmdir',
+    'mv',
+    'dd',
+    'mkfs',
+    'shred',
+    'sudo',
+    'doas',
+    'su',
+    'chmod',
+    'chown',
+    'chgrp',
+    'kill',
+    'pkill',
+    'killall',
+    'shutdown',
+    'reboot',
+    'curl',
+    'wget',
+    'ssh',
+    'scp',
+    'nc',
+    'eval',
+    'exec',
+    'source',
+]);
+const INTERPRETER_OR_WRAPPER_BINARIES = new Set([
+    'bash',
+    'sh',
+    'zsh',
+    'fish',
+    'dash',
+    'ksh',
+    'csh',
+    'tcsh',
+    'python',
+    'python2',
+    'python3',
+    'node',
+    'deno',
+    'bun',
+    'ruby',
+    'perl',
+    'php',
+    'lua',
+    'osascript',
+    'awk',
+    'gawk',
+    'sed',
+    'env',
+    'timeout',
+    'xargs',
+    'nohup',
+    'setsid',
+    'watch',
+    'script',
+    'nice',
+    'ionice',
+    'stdbuf',
+    'time',
+    'sudo',
+    'doas',
+    'su',
+    'find',
+    'make',
+]);
+const SCRIPT_RUNNER_VERBS = new Set(['run', 'exec', 'run-script', 'x', 'dlx']);
+const VERB_PATTERN = /^[A-Za-z][A-Za-z0-9_:-]*$/;
+const BINARY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._+-]*$/;
+const SHELL_CONTROL_OPERATOR_PATTERN = /[&|;<>\n]/;
+const COMMAND_SUBSTITUTION_PATTERN = /`|\$\(/;
+function normalizeCommand(command) {
+    return String(command ?? '').trim().replace(/\s+/g, ' ');
+}
+function parseCommand(command) {
+    const raw = String(command ?? '');
+    if (!raw.trim())
+        return null;
+    if (COMMAND_SUBSTITUTION_PATTERN.test(raw))
+        return null;
+    if (SHELL_CONTROL_OPERATOR_PATTERN.test(getUnquotedShellText(raw)))
+        return null;
+    const all = normalizeCommand(raw).match(/\S+/g) ?? [];
+    const tokens = [];
+    for (const token of all) {
+        if (!tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(token))
+            continue;
+        if (!tokens.length && token === 'command')
+            continue;
+        tokens.push(token);
+    }
+    if (!tokens.length)
+        return null;
+    const binary = (tokens[0].split('/').pop() ?? '').trim();
+    if (!binary)
+        return null;
+    tokens[0] = binary;
+    return { canonical: tokens.join(' '), tokens };
+}
+function grantPrefixFromTokens(tokens) {
+    const binary = tokens[0];
+    if (!BINARY_PATTERN.test(binary))
+        return null;
+    if (NO_PREFIX_GRANT_BINARIES.has(binary))
+        return null;
+    if (INTERPRETER_OR_WRAPPER_BINARIES.has(binary))
+        return null;
+    const verb = tokens[1];
+    if (!verb || !VERB_PATTERN.test(verb))
+        return null;
+    if (SCRIPT_RUNNER_VERBS.has(verb)) {
+        const script = tokens[2];
+        if (!script || !VERB_PATTERN.test(script))
+            return null;
+        return `${binary} ${verb} ${script}`;
+    }
+    return `${binary} ${verb}`;
+}
+export function commandGrantPrefix(command) {
+    const parsed = parseCommand(command);
+    return parsed ? grantPrefixFromTokens(parsed.tokens) : null;
+}
+export function isBucketGranted(grants, bucket) {
+    return Boolean(grants?.buckets.includes(bucket));
+}
+export function isCommandGranted(grants, command) {
+    if (!grants)
+        return false;
+    if (grants.buckets.includes('run'))
+        return true;
+    if (!grants.commandPrefixes.length)
+        return false;
+    const parsed = parseCommand(command);
+    if (!parsed)
+        return false;
+    if (grantPrefixFromTokens(parsed.tokens) === null)
+        return false;
+    return grants.commandPrefixes.some((prefix) => parsed.canonical === prefix || parsed.canonical.startsWith(`${prefix} `));
+}
+export function grantBucket(grants, bucket) {
+    if (!grants.buckets.includes(bucket))
+        grants.buckets.push(bucket);
+}
+export function grantCommandPrefix(grants, prefix) {
+    const normalized = normalizeCommand(prefix);
+    if (!normalized)
+        return;
+    if (!grants.commandPrefixes.includes(normalized)) {
+        grants.commandPrefixes.push(normalized);
+    }
+}
+export function buildPermissionOptions(bucket, command) {
+    const options = [
+        { label: 'Approve once', decision: { kind: 'once' } },
+    ];
+    const prefix = bucket === 'run' && command ? commandGrantPrefix(command) : null;
+    if (prefix) {
+        options.push({
+            label: `Always allow: ${prefix}`,
+            decision: { kind: 'always-prefix', prefix },
+        });
+    }
+    options.push({
+        label: `Always allow: ${bucketActionLabel(bucket)}`,
+        decision: { kind: 'always-bucket' },
+    });
+    options.push({ label: 'Deny', decision: { kind: 'deny' } });
+    return options;
+}
+function declinedSubject(bucket) {
+    if (bucket === 'run') {
+        return { noun: 'command', effect: 'Nothing was executed' };
+    }
+    if (bucket === 'create') {
+        return { noun: 'file creation', effect: 'Nothing was created' };
+    }
+    if (bucket === 'delete') {
+        return { noun: 'file deletion', effect: 'Nothing was deleted' };
+    }
+    return { noun: 'edit', effect: 'Nothing was changed' };
+}
+function declinedResponse(bucket, toolName, extra) {
+    const { noun, effect } = declinedSubject(bucket);
+    return {
+        ok: false,
+        skipped: true,
+        ...extra,
+        failureCategory: 'user_declined',
+        failureDetails: {
+            category: 'user_declined',
+            tool: toolName,
+            action: 'Respect the real user’s decision. Do not retry the same or an equivalent action; reconsider the approach or ask one specific question if needed.',
+        },
+        error: `The real user rejected this proposed ${noun}. ${effect}; this was not a tool failure or an automated system skip.`,
+    };
+}
+export async function ensurePermission(context, request, toolName, extra = {}) {
+    if (context.autoYes)
+        return null;
+    if (isBucketGranted(context.grants, request.bucket))
+        return null;
+    if (request.bucket === 'run' &&
+        request.command &&
+        isCommandGranted(context.grants, request.command)) {
+        return null;
+    }
+    if (!context.requestPermission) {
+        return {
+            ok: false,
+            ...extra,
+            error: `requestPermission is required when autoYes is false (${toolName})`,
+        };
+    }
+    const options = buildPermissionOptions(request.bucket, request.command);
+    const decision = await context.requestPermission({ ...request, options });
+    if (decision.kind === 'deny') {
+        return declinedResponse(request.bucket, toolName, extra);
+    }
+    if (context.grants) {
+        if (decision.kind === 'always-bucket') {
+            grantBucket(context.grants, request.bucket);
+        }
+        else if (decision.kind === 'always-prefix') {
+            grantCommandPrefix(context.grants, decision.prefix);
+        }
+    }
+    return null;
+}

package/dist/src/session-store.js

@@ -4,6 +4,7 @@ import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, w
 import path from 'node:path';
 import { getClientStateDir } from './client-state.js';
 import { normalizeAssistantEditJournal } from './edit-journal.js';
+import { createSessionGrants } from './permissions.js';
 import { cloneSessionSafetyState, createSessionSafetyState, mergeLocalSessionSafetyState, normalizeSessionSafetyState, } from './session-safety.js';
 import { singleLinePreview } from './utils.js';
 const SESSION_STORE_VERSION = 1;
@@ -211,6 +212,7 @@ export function saveSessionState(session, env = process.env) {
 }
 export function applySessionSnapshot(session, snapshot, options = {}) {
     const currentAgentMode = session.agentMode;
+    const previousSessionId = session.sessionId;
     session.sessionId = snapshot.id;
     session.sessionName = snapshot.name;
     session.sessionCreatedAt = snapshot.createdAt;
@@ -220,6 +222,9 @@ export function applySessionSnapshot(session, snapshot, options = {}) {
     session.serverState = sanitizeOpaqueState(snapshot.serverState);
     session.agentMode = options.preserveAgentMode ? currentAgentMode : 'default';
     session.autoYes = session.agentMode === 'auto-accept';
+    if (previousSessionId !== session.sessionId) {
+        session.grants = createSessionGrants();
+    }
     session.turnState = {
         id: null,
         historyStartIndex: session.history.length,

package/dist/src/session.js

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import { normalizeAgentMode, } from './agent-mode.js';
+import { createSessionGrants, } from './permissions.js';
 import { createSessionSafetyState, } from './session-safety.js';
 import { clampInteger } from './utils.js';
 const DEFAULT_MAX_TOOL_STEPS = 32;
@@ -31,7 +32,7 @@ function preserveProviderSelection(serverState) {
         : null;
     return providerSelection ? { providerSelection } : {};
 }
-export function createSession({ rootDir, autoYes = false, agentMode, modelId, maxToolSteps = DEFAULT_MAX_TOOL_STEPS, confirmCommand = null, confirmPatch = null, requestSudoPassword = null, requestUserInput = null, onStatus = null, onContextLog = null, onToolEvent = null, env = process.env, sessionId = createSessionId(), sessionName = null, history = [], serverState = null, editJournal = [], stickyFilePaths = [], editCounter = 0, safety = createSessionSafetyState(), }) {
+export function createSession({ rootDir, autoYes = false, agentMode, modelId, maxToolSteps = DEFAULT_MAX_TOOL_STEPS, requestPermission = null, requestSudoPassword = null, requestUserInput = null, onStatus = null, onContextLog = null, onToolEvent = null, env = process.env, sessionId = createSessionId(), sessionName = null, history = [], serverState = null, editJournal = [], stickyFilePaths = [], editCounter = 0, safety = createSessionSafetyState(), }) {
     const createdAt = new Date().toISOString();
     const initialAgentMode = normalizeAgentMode(agentMode ?? (autoYes ? 'auto-accept' : 'default'));
     return {
@@ -43,8 +44,8 @@ export function createSession({ rootDir, autoYes = false, agentMode, modelId, ma
         onStatus: onStatus ?? defaultStatus,
         onContextLog: onContextLog ?? defaultContextLog,
         onToolEvent,
-        confirmCommand,
-        confirmPatch,
+        grants: createSessionGrants(),
+        requestPermission,
         requestSudoPassword,
         requestUserInput,
         history: JSON.parse(JSON.stringify(history)),
@@ -80,6 +81,7 @@ export function startNewConversation(session) {
 }
 export function clearConversation(session) {
     session.history = [];
+    session.grants = createSessionGrants();
     session.serverState = preserveProviderSelection(session.serverState);
     session.turnState = {
         id: null,

package/dist/src/tool-executor.js

@@ -277,8 +277,8 @@ export async function executeLocalToolCall(toolContext, session, call) {
             sessionId: session.sessionId,
             projectIndex: toolContext.projectIndex,
             autoYes: session.autoYes,
-            confirmCommand: session.confirmCommand,
-            confirmPatch: session.confirmPatch,
+            grants: session.grants,
+            requestPermission: session.requestPermission,
             requestSudoPassword: session.requestSudoPassword,
             onStatus: session.onStatus,
             editJournal: session.clientState.editJournal,

package/dist/src/tools/delete-file.js

@@ -3,6 +3,7 @@ import { classifyProjectPath, deleteProjectFile } from '../patcher.js';
 import { isTuiMode } from '../runtime-mode.js';
 import { removeIndexFile } from '../project-index.js';
 import { invalidateShellDiagnosticsCache, runShellDiagnostics, } from './shell-diagnostics.js';
+import { ensurePermission } from '../permissions.js';
 export async function deleteFile(context, args) {
     const { rootDir, projectIndex } = context;
     const filePath = String(args.filePath ?? '').trim();
@@ -24,6 +25,19 @@ export async function deleteFile(context, args) {
         };
     }
     const scratchPath = pathKind === 'scratch';
+    if (!scratchPath) {
+        const denied = await ensurePermission(context, {
+            bucket: 'delete',
+            title: 'Approve file deletion?',
+            body: `Delete ${filePath}`,
+            filePath,
+        }, 'delete_file', { filePath });
+        if (denied) {
+            if (!isTuiMode())
+                console.log(chalk.dim(`  ⏭  Delete skipped: ${filePath}`));
+            return denied;
+        }
+    }
     const result = deleteProjectFile(rootDir, filePath);
     if (result.deleted) {
         if (!scratchPath) {

package/dist/src/tools/patch-file.js

@@ -7,9 +7,10 @@ import { repairFilePath } from './path-suggest.js';
 import { isTuiMode } from '../runtime-mode.js';
 import { getCurrentFileHash, resolveRedactionTokens } from '../session-safety.js';
 import { invalidateShellDiagnosticsCache, runShellDiagnostics, } from './shell-diagnostics.js';
+import { ensurePermission } from '../permissions.js';
 const DOCUMENT_EXTENSIONS = new Set(['.pdf', '.xlsx', '.docx']);
 export async function patchFile(context, args) {
-    const { rootDir, projectIndex, autoYes, confirmPatch } = context;
+    const { rootDir, projectIndex } = context;
     const filePath = repairFilePath(rootDir, String(args.filePath ?? '').trim());
     let patch = typeof args.patch === 'string' ? args.patch : '';
     if (!filePath) {
@@ -74,23 +75,18 @@ export async function patchFile(context, args) {
         };
     }
     renderDiffPreview(filePath, patch);
-    if (!autoYes && confirmPatch) {
-        const confirmed = await confirmPatch(filePath, patch);
-        if (!confirmed) {
+    if (!scratchPath) {
+        const denied = await ensurePermission(context, {
+            bucket: getCurrentFileHash(rootDir, filePath) === null ? 'create' : 'edit',
+            title: 'Approve patch?',
+            body: 'Review changes before applying.',
+            filePath,
+            diff: patch,
+        }, 'patch_file', { filePath });
+        if (denied) {
             if (!isTuiMode())
                 console.log(chalk.dim(`  ⏭  Patch skipped: ${filePath}`));
-            return {
-                ok: false,
-                skipped: true,
-                filePath,
-                failureCategory: 'user_declined',
-                failureDetails: {
-                    category: 'user_declined',
-                    tool: 'patch_file',
-                    action: 'Respect the real user’s decision. Do not retry the same or an equivalent edit; reconsider the approach or ask one specific question if needed.',
-                },
-                error: 'The real user rejected this proposed patch. Nothing was changed; this was not a tool failure or an automated system skip.',
-            };
+            return denied;
         }
     }
     const { changed } = writeProjectFile(rootDir, filePath, patchedContent);

package/dist/src/tools/replace-document-text.js

@@ -6,6 +6,8 @@ import { readCliAuthConfig } from '../api/auth.js';
 import { resolveProjectPath, writeProjectFileBuffer } from '../patcher.js';
 import { repairFilePath, suggestClosestPath } from './path-suggest.js';
 import { isTuiMode } from '../runtime-mode.js';
+import { ensurePermission } from '../permissions.js';
+import { getCurrentFileHash } from '../session-safety.js';
 function normalizeReplacements(value) {
     if (!Array.isArray(value))
         return [];
@@ -178,27 +180,35 @@ export async function replaceDocumentText(context, args) {
     }
     const preview = String(serverResult.preview ?? '');
     renderPreview(targetPath, preview);
-    if (!context.autoYes && context.confirmPatch) {
-        const confirmed = await context.confirmPatch(targetPath, preview);
-        if (!confirmed) {
-            if (!isTuiMode()) {
-                console.log(chalk.dim(`  replace_document_text skipped: ${targetPath}`));
-            }
-            return {
-                ok: false,
-                skipped: true,
-                filePath: targetPath,
-                failureCategory: 'user_declined',
-                failureDetails: {
-                    category: 'user_declined',
-                    tool: 'replace_document_text',
-                    action: 'Respect the real user’s decision. Do not retry the same or an equivalent edit; reconsider the approach or ask one specific question if needed.',
-                },
-                error: 'The real user rejected this proposed document edit. Nothing was changed; this was not a tool failure or an automated system skip.',
-            };
+    const targetHashBeforeApproval = getCurrentFileHash(context.rootDir, targetPath);
+    const documentIsNew = targetHashBeforeApproval === null;
+    const denied = await ensurePermission(context, {
+        bucket: documentIsNew ? 'create' : 'edit',
+        title: documentIsNew ? 'Approve new document?' : 'Approve document edit?',
+        body: 'Review changes before applying.',
+        filePath: targetPath,
+        diff: preview,
+    }, 'replace_document_text', { filePath: targetPath });
+    if (denied) {
+        if (!isTuiMode()) {
+            console.log(chalk.dim(`  replace_document_text skipped: ${targetPath}`));
         }
+        return denied;
     }
     const fileData = String(serverResult.fileData ?? '');
+    if (getCurrentFileHash(context.rootDir, targetPath) !== targetHashBeforeApproval) {
+        return {
+            ok: false,
+            filePath: targetPath,
+            failureCategory: 'conflict',
+            error: `replace_document_text refused: ${targetPath} changed on disk while the approval prompt was open.`,
+            failureDetails: {
+                category: 'conflict',
+                tool: 'replace_document_text',
+                action: 'Re-read the document to see its current contents, then rebuild the replacements against it and retry.',
+            },
+        };
+    }
     const nextData = Buffer.from(fileData, 'base64');
     const write = writeProjectFileBuffer(context.rootDir, targetPath, nextData);
     const failedCount = Number(serverResult.failedCount ?? 0);

package/dist/src/tools/run-command.js

@@ -2,13 +2,14 @@ import chalk from '../colors.js';
 import { startBackgroundJob } from '../background-jobs.js';
 import { getBlockedCommandReason, runCommand, } from '../executor.js';
 import { syncIndexFromDisk } from '../project-index.js';
+import { ensurePermission } from '../permissions.js';
 import { isTuiMode } from '../runtime-mode.js';
 import { redactConnectionStringCredentials } from '../secret-preview.js';
 import { buildNestedGitHint } from '../session-safety.js';
 import { buildDeferredShellDiagnostics, invalidateShellDiagnosticsCache, } from './shell-diagnostics.js';
 const MAX_OUTPUT_CHARS = 4000;
 export async function runShellCommand(context, args) {
-    const { rootDir, projectIndex, autoYes, confirmCommand, requestSudoPassword, onStatus, } = context;
+    const { rootDir, projectIndex, requestSudoPassword, onStatus, } = context;
     const command = String(args.command ?? '').trim();
     if (!command) {
         return { ok: false, error: 'command is required' };
@@ -31,33 +32,18 @@ export async function runShellCommand(context, args) {
     }
     if (!isTuiMode())
         console.log(chalk.bold.yellow(`\n  ⚡ Command: ${command}`));
-    if (!autoYes) {
-        if (confirmCommand == null) {
-            return {
-                ok: false,
-                command,
-                error: 'confirmCommand is required when autoYes is false',
-            };
-        }
-        const approved = await confirmCommand(runInBackground
+    const denied = await ensurePermission(context, {
+        bucket: 'run',
+        title: 'Approve command?',
+        body: runInBackground
             ? `${command}\n\nRuns as a managed background job until it exits or is killed.`
-            : command);
-        if (!approved) {
-            if (!isTuiMode())
-                console.log(chalk.dim(`  ⏭  Skipped: ${command}`));
-            return {
-                ok: false,
-                skipped: true,
-                command,
-                failureCategory: 'user_declined',
-                failureDetails: {
-                    category: 'user_declined',
-                    tool: 'run_command',
-                    action: 'Respect the real user’s decision. Do not retry the same or an equivalent action; reconsider the approach or ask one specific question if needed.',
-                },
-                error: 'The real user rejected this proposed command. Nothing was executed; this was not a tool failure or an automated system skip.',
-            };
-        }
+            : command,
+        command,
+    }, 'run_command', { command });
+    if (denied) {
+        if (!isTuiMode())
+            console.log(chalk.dim(`  ⏭  Skipped: ${command}`));
+        return denied;
     }
     if (runInBackground) {
         return runBackgroundCommand(context, command, args.timeout_ms, repoHint);

package/dist/src/tools/run-node-script.js

@@ -1,5 +1,6 @@
 import chalk from '../colors.js';
 import { execFileSync, spawn } from 'node:child_process';
+import { ensurePermission } from '../permissions.js';
 import { syncIndexFromDisk } from '../project-index.js';
 import { isTuiMode } from '../runtime-mode.js';
 import { buildDeferredShellDiagnostics, invalidateShellDiagnosticsCache, } from './shell-diagnostics.js';
@@ -148,7 +149,7 @@ function executeNodeScript(rootDir, script, timeout) {
     });
 }
 export async function runNodeScript(context, args) {
-    const { rootDir, autoYes, confirmCommand } = context;
+    const { rootDir } = context;
     const script = typeof args.script === 'string' ? args.script : '';
     if (!script.trim()) {
         return { ok: false, error: 'script is required' };
@@ -158,32 +159,16 @@ export async function runNodeScript(context, args) {
         console.log(chalk.bold.yellow(`\n  ⚡ Node script:\n${commandForApproval}\n`));
         console.log(chalk.dim(`    in: ${rootDir}\n`));
     }
-    if (!autoYes) {
-        if (confirmCommand == null) {
-            return {
-                ok: false,
-                command: COMMAND_LABEL,
-                error: 'confirmCommand is required when autoYes is false',
-            };
-        }
-        const approved = await confirmCommand(commandForApproval);
-        if (!approved) {
-            if (!isTuiMode()) {
-                console.log(chalk.dim(`  ⏭  Skipped: ${COMMAND_LABEL}`));
-            }
-            return {
-                ok: false,
-                skipped: true,
-                command: COMMAND_LABEL,
-                failureCategory: 'user_declined',
-                failureDetails: {
-                    category: 'user_declined',
-                    tool: 'run_node_script',
-                    action: 'Respect the real user’s decision. Do not retry the same or an equivalent action; reconsider the approach or ask one specific question if needed.',
-                },
-                error: 'The real user rejected this proposed script. Nothing was executed; this was not a tool failure or an automated system skip.',
-            };
+    const denied = await ensurePermission(context, {
+        bucket: 'run',
+        title: 'Approve node script?',
+        body: commandForApproval,
+    }, 'run_node_script', { command: COMMAND_LABEL });
+    if (denied) {
+        if (!isTuiMode()) {
+            console.log(chalk.dim(`  ⏭  Skipped: ${COMMAND_LABEL}`));
         }
+        return denied;
     }
     const beforeGitStatus = readGitStatusSignature(rootDir);
     const result = await executeNodeScript(rootDir, script, typeof args.timeout_ms === 'number' && args.timeout_ms > 0

package/dist/src/tools/str-replace.js

@@ -7,6 +7,7 @@ import { upsertIndexFile } from '../project-index.js';
 import { isTuiMode } from '../runtime-mode.js';
 import { getCurrentFileHash, resolveRedactionTokens } from '../session-safety.js';
 import { invalidateShellDiagnosticsCache, runShellDiagnostics, } from './shell-diagnostics.js';
+import { ensurePermission } from '../permissions.js';
 const DOCUMENT_EXTENSIONS = new Set(['.pdf', '.xlsx', '.docx']);
 function countOccurrences(haystack, needle) {
     if (needle.length === 0)
@@ -76,7 +77,7 @@ function buildStrReplacePreview(oldString, newString) {
     return `@@ str_replace @@\n${minus}\n${plus}`;
 }
 export async function strReplace(context, args) {
-    const { rootDir, projectIndex, autoYes, confirmPatch } = context;
+    const { rootDir, projectIndex } = context;
     const filePath = repairFilePath(rootDir, String(args.filePath ?? args.file_path ?? '').trim());
     let oldString = typeof args.old_string === 'string'
         ? args.old_string
@@ -175,23 +176,18 @@ export async function strReplace(context, args) {
         }
         console.log();
     }
-    if (!autoYes && confirmPatch) {
-        const confirmed = await confirmPatch(filePath, preview);
-        if (!confirmed) {
+    if (!scratchPath) {
+        const denied = await ensurePermission(context, {
+            bucket: 'edit',
+            title: 'Approve patch?',
+            body: 'Review changes before applying.',
+            filePath,
+            diff: preview,
+        }, 'str_replace', { filePath });
+        if (denied) {
             if (!isTuiMode())
                 console.log(chalk.dim(`  ⏭  str_replace skipped: ${filePath}`));
-            return {
-                ok: false,
-                skipped: true,
-                filePath,
-                failureCategory: 'user_declined',
-                failureDetails: {
-                    category: 'user_declined',
-                    tool: 'str_replace',
-                    action: 'Respect the real user’s decision. Do not retry the same or an equivalent edit; reconsider the approach or ask one specific question if needed.',
-                },
-                error: 'The real user rejected this proposed edit. Nothing was changed; this was not a tool failure or an automated system skip.',
-            };
+            return denied;
         }
     }
     const nextContent = originalContent.split(oldString).join(newString);

package/dist/src/tools/write-file.js

@@ -2,11 +2,47 @@ import chalk from '../colors.js';
 import path from 'node:path';
 import { normalizeProjectRelativePath } from '../artifact-policy.js';
 import { classifyProjectPath, writeProjectFile } from '../patcher.js';
+import { readFileEditSnapshot } from '../edit-journal.js';
 import { upsertIndexFile } from '../project-index.js';
 import { isTuiMode } from '../runtime-mode.js';
 import { getCurrentFileHash, hasFreshFullReadCoverage, resolveRedactionTokens, } from '../session-safety.js';
 import { invalidateShellDiagnosticsCache, runShellDiagnostics, } from './shell-diagnostics.js';
+import { ensurePermission } from '../permissions.js';
 const DOCUMENT_EXTENSIONS = new Set(['.pdf', '.xlsx', '.docx']);
+const MAX_WRITE_PREVIEW_LINES = 400;
+function boundedLines(text, limit) {
+    const lines = [];
+    let omitted = 0;
+    let start = 0;
+    for (;;) {
+        const newline = text.indexOf('\n', start);
+        if (lines.length < limit) {
+            lines.push(text.slice(start, newline === -1 ? undefined : newline));
+        }
+        else {
+            omitted += 1;
+        }
+        if (newline === -1)
+            break;
+        start = newline + 1;
+    }
+    return { lines, omitted };
+}
+function buildWritePreview(previous, next) {
+    const rows = ['@@ write_file @@'];
+    const append = (text, sign, marker) => {
+        const { lines, omitted } = boundedLines(text, MAX_WRITE_PREVIEW_LINES);
+        for (const line of lines)
+            rows.push(`${sign}${line}`);
+        if (omitted > 0) {
+            rows.push(`@@ ${omitted} more ${marker} line(s) not shown @@`);
+        }
+    };
+    if (previous !== null)
+        append(previous, '-', 'removed');
+    append(next, '+', 'added');
+    return rows.join('\n');
+}
 export async function writeFile(context, args) {
     const { rootDir, projectIndex } = context;
     const filePath = String(args.filePath ?? '').trim();
@@ -60,6 +96,36 @@ export async function writeFile(context, args) {
         };
     }
     content = resolveRedactionTokens(context.safety, content, coveragePath, currentHash);
+    if (!scratchPath) {
+        const before = currentHash === null ? null : readFileEditSnapshot(rootDir, filePath);
+        const existing = before && before.contentEncoding === 'utf8' ? before.content : null;
+        const denied = await ensurePermission(context, {
+            bucket: currentHash === null ? 'create' : 'edit',
+            title: currentHash === null ? 'Approve new file?' : 'Approve patch?',
+            body: 'Review changes before applying.',
+            filePath,
+            diff: buildWritePreview(existing, content),
+        }, 'write_file', { filePath });
+        if (denied) {
+            if (!isTuiMode())
+                console.log(chalk.dim(`  ⏭  write_file skipped: ${filePath}`));
+            return denied;
+        }
+        if (getCurrentFileHash(rootDir, filePath) !== currentHash) {
+            return {
+                ok: false,
+                filePath,
+                failureCategory: 'conflict',
+                error: `write_file refused: ${filePath} changed on disk while the approval prompt was open.`,
+                failureDetails: {
+                    category: 'conflict',
+                    tool: 'write_file',
+                    action: 'Re-read the file to see its current contents, then decide whether the write is still correct and retry.',
+                },
+                currentHash,
+            };
+        }
+    }
     const { changed } = writeProjectFile(rootDir, filePath, content);
     let indexedChunks = 0;
     let retrievalTokensUsed = 0;

package/dist/src/ui/repl.js

@@ -1,4 +1,5 @@
 import { createRatatuiBridge } from './tui/bridge.js';
+import { bucketActionLabel, } from '../permissions.js';
 import { approvalScrollLimit, buildTuiFrame, formatJobElapsed, formatTodoProgress, pickThinkingFallbackPhrase, renderTranscriptEntryLines, THINKING_FALLBACK_PHRASES, userInputViewportForFrame, } from './tui/build-frame.js';
 import { createTerminalTitleController } from './tui/terminal-title.js';
 import { captureTerminalWrites, releaseTerminalWrites, } from './tui/terminal-writes.js';
@@ -74,23 +75,6 @@ const WORKING_TOOL_PREVIEW_ITEMS = 4;
 const THINKING_NOTE_PREVIEW_ROWS = 3;
 const WORKING_TOOL_PREVIEW_ROWS = 3;
 const AGENT_MODE_LABEL_WIDTH = 16;
-const APPROVAL_OPTIONS = [
-    {
-        value: 'y',
-        label: 'Approve once',
-        description: 'Run this action only this time',
-    },
-    {
-        value: 'a',
-        label: 'Approve all remaining actions',
-        description: 'Turn on auto-approve for the rest of the session',
-    },
-    {
-        value: 'n',
-        label: 'Deny',
-        description: 'Reject this action',
-    },
-];
 export const SLASH_COMMANDS = [
     {
         command: '/help',
@@ -995,7 +979,7 @@ function createInitialShellState(session, serverModels, debugUi) {
         activeTurnInputPreformatted: false,
         agentMode: session.agentMode,
         analyzingImages: 0,
-        approvalCursor: getDefaultApprovalCursor(),
+        approvalCursor: 0,
         approvalPrompt: null,
         approvalScrollOffset: 0,
         autoYes: session.autoYes,
@@ -1279,16 +1263,13 @@ export function navigatePromptHistory(state, direction) {
         promptHistoryCursor: nextCursor,
     };
 }
-function getDefaultApprovalCursor() {
-    const denyIndex = APPROVAL_OPTIONS.findIndex((option) => option.value === 'n');
-    return denyIndex === -1 ? 0 : denyIndex;
-}
-export function getNextApprovalCursor(currentIndex, direction) {
-    return (currentIndex + direction + APPROVAL_OPTIONS.length) % APPROVAL_OPTIONS.length;
+export function getDefaultApprovalCursor(optionCount) {
+    return Math.max(0, optionCount - 1);
 }
-export function getApprovalChoiceForCursor(cursor) {
-    return (APPROVAL_OPTIONS[Math.min(Math.max(cursor, 0), APPROVAL_OPTIONS.length - 1)]
-        ?.value ?? 'n');
+export function getNextApprovalCursor(currentIndex, direction, optionCount) {
+    if (optionCount <= 0)
+        return 0;
+    return (currentIndex + direction + optionCount) % optionCount;
 }
 export function pauseBusyClock(state, nowMs) {
     if (state.busySince === null || state.busyPausedAt !== null)
@@ -1372,7 +1353,7 @@ export async function runClientInteractive({ appendPromptHistory, authConfig, de
         let currentServerModels = serverModels;
         let sessionAutoYes = session.autoYes;
         let resolveDone = null;
-        let resolveApprovalChoice = null;
+        let resolvePermissionDecision = null;
         let resolveSudoPassword = null;
         let pendingUserInput = null;
         let cleanupSudoPasswordPrompt = null;
@@ -1598,14 +1579,14 @@ export async function runClientInteractive({ appendPromptHistory, authConfig, de
             }
         };
         const dismissPendingApproval = () => {
-            if (!resolveApprovalChoice)
+            if (!resolvePermissionDecision)
                 return;
-            const pendingResolve = resolveApprovalChoice;
-            resolveApprovalChoice = null;
-            pendingResolve('n');
+            const pendingResolve = resolvePermissionDecision;
+            resolvePermissionDecision = null;
+            pendingResolve({ kind: 'deny' });
             store.update((current) => ({
                 ...resumeBusyClock(current, Date.now()),
-                approvalCursor: getDefaultApprovalCursor(),
+                approvalCursor: 0,
                 approvalPrompt: null,
                 approvalScrollOffset: 0,
             }));
@@ -1929,41 +1910,45 @@ export async function runClientInteractive({ appendPromptHistory, authConfig, de
             pending.resolve(result);
             scheduleLiveFrameRemount();
         };
-        const openApprovalPrompt = (title, body, options = {}) => new Promise((resolve) => {
+        const openApprovalPrompt = (request) => new Promise((resolve) => {
+            const deny = { kind: 'deny' };
             if (exiting) {
-                resolve('n');
+                resolve(deny);
                 return;
             }
-            resolveApprovalChoice = resolve;
+            resolvePermissionDecision = resolve;
             store.update((current) => ({
                 ...pauseBusyClock(current, Date.now()),
-                approvalCursor: getDefaultApprovalCursor(),
+                approvalCursor: getDefaultApprovalCursor(request.options.length),
                 approvalOpenedAt: Date.now(),
                 approvalScrollOffset: 0,
                 approvalPrompt: {
-                    title,
-                    body,
-                    diffPreview: options.diff && options.filePath
-                        ? parseDiffPreview(options.diff)
+                    title: request.title,
+                    body: request.body,
+                    diffPreview: request.diff && request.filePath
+                        ? parseDiffPreview(request.diff)
                         : undefined,
-                    filePath: options.filePath,
+                    filePath: request.filePath,
+                    options: request.options,
                     returnStatus: current.status,
                 },
-                status: title,
+                status: request.title,
             }));
         });
-        const handleInlineApprovalChoice = async (choice) => {
+        const handleInlineApprovalChoice = async (index) => {
             const current = store.getState();
-            const pendingResolve = resolveApprovalChoice;
-            resolveApprovalChoice = null;
+            const options = current.approvalPrompt?.options ?? [];
+            const chosen = options[index]?.decision ?? { kind: 'deny' };
+            const pendingResolve = resolvePermissionDecision;
+            resolvePermissionDecision = null;
             store.update((next) => ({
                 ...resumeBusyClock(next, Date.now()),
-                approvalCursor: getDefaultApprovalCursor(),
+                approvalCursor: getDefaultApprovalCursor(options.length),
                 approvalPrompt: null,
                 approvalScrollOffset: 0,
                 status: current.approvalPrompt?.returnStatus ?? next.status,
             }));
-            pendingResolve?.(choice);
+            pendingResolve?.(chosen);
         };
         const refreshServerModels = async () => {
             currentServerModels = await models.fetchServerModels({ config: authConfig });
@@ -2872,44 +2857,28 @@ export async function runClientInteractive({ appendPromptHistory, authConfig, de
         projectIndex.onContextLog = session.onContextLog;
         session.requestSudoPassword = async ({ command, prompt, signal }) => openSudoPasswordPrompt(command, prompt, signal);
         session.requestUserInput = async (request, signal) => openUserInputPrompt(request.questions, signal);
-        session.confirmCommand = async (command) => {
+        session.requestPermission = async (request) => {
+            const deny = { kind: 'deny' };
             if (exiting)
-                return false;
+                return deny;
             if (sessionAutoYes)
-                return true;
-            const choice = await openApprovalPrompt('Approve command?', command);
-            if (choice === 'a') {
-                setAgentMode('auto-accept');
-                syncShellStateFromSession();
+                return { kind: 'once' };
+            const decision = await openApprovalPrompt(request);
+            if (decision.kind === 'always-bucket') {
                 appendTurnAwareEntry({
-                    body: 'Auto-approve enabled for the rest of this session.',
+                    body: `Allowed for the rest of this session: ${bucketActionLabel(request.bucket)}.`,
                     kind: 'system',
                     title: 'Approvals',
                 });
-                return true;
             }
-            return choice === 'y';
-        };
-        session.confirmPatch = async (filePath, patch) => {
-            if (exiting)
-                return false;
-            if (sessionAutoYes)
-                return true;
-            const choice = await openApprovalPrompt('Approve patch?', 'Review changes before applying.', {
-                diff: patch,
-                filePath,
-            });
-            if (choice === 'a') {
-                setAgentMode('auto-accept');
-                syncShellStateFromSession();
+            else if (decision.kind === 'always-prefix') {
                 appendTurnAwareEntry({
-                    body: 'Auto-approve enabled for the rest of this session.',
+                    body: `Allowed for the rest of this session: commands starting with \`${decision.prefix}\`.`,
                     kind: 'system',
                     title: 'Approvals',
                 });
-                return true;
             }
-            return choice === 'y';
+            return decision;
         };
         const shellInputHandlers = {
             getApprovalScrollLimit: () => {

package/dist/src/ui/tui/build-frame.js

@@ -768,7 +768,6 @@ function modelPickerPanelSideLine(content, innerWidth) {
 }
 const MODEL_PICKER_COST_WIDTH = 6;
 const MODEL_PICKER_MODEL_WIDTH = 42;
-const MODEL_PICKER_NUMBER_WIDTH = 4;
 const MODEL_PICKER_SEPARATOR = ' │ ';
 const MODEL_PICKER_WIDE_MIN_WIDTH = 78;
 function modelPickerTopBorder(panelWidth) {
@@ -795,7 +794,6 @@ function modelPickerCostText(rating) {
 }
 function modelPickerNotesWidth(innerWidth) {
     return Math.max(18, innerWidth -
-        MODEL_PICKER_NUMBER_WIDTH -
         MODEL_PICKER_MODEL_WIDTH -
         MODEL_PICKER_COST_WIDTH -
         MODEL_PICKER_SEPARATOR.length * 2);
@@ -818,12 +816,10 @@ function modelPickerItemLines(option, selected, innerWidth) {
         : selected
             ? { color: 'cyan', bold: true }
             : {};
-    const numberCell = modelPickerCell(String(option.publicId), MODEL_PICKER_NUMBER_WIDTH, { color: 'cyan', bold: selected, ...selectedStyle });
     const cost = modelPickerCostText(option.costRating);
     if (innerWidth < MODEL_PICKER_WIDE_MIN_WIDTH) {
-        const modelWidth = Math.max(12, innerWidth - MODEL_PICKER_NUMBER_WIDTH - MODEL_PICKER_COST_WIDTH - 2);
+        const modelWidth = Math.max(12, innerWidth - MODEL_PICKER_COST_WIDTH - 2);
         const row = [
-            numberCell,
             ...modelPickerModelSpans(option, selected, modelWidth, false, labelStyle, selectedStyle),
             span('  ', selectedStyle),
             modelPickerCell(cost, MODEL_PICKER_COST_WIDTH, selectedStyle),
@@ -833,7 +829,6 @@ function modelPickerItemLines(option, selected, innerWidth) {
         ];
     }
     const row = [
-        numberCell,
         ...modelPickerModelSpans(option, selected, MODEL_PICKER_MODEL_WIDTH, true, labelStyle, selectedStyle),
         span(MODEL_PICKER_SEPARATOR, { color: 'gray', ...selectedStyle }),
         modelPickerCell(cost, MODEL_PICKER_COST_WIDTH, selectedStyle),
@@ -850,9 +845,9 @@ function modelPickerItemLines(option, selected, innerWidth) {
 function modelPickerHeaderLine(innerWidth) {
     const heading = { color: MODEL_PICKER_ACCENT_COLOR, bold: true };
     if (innerWidth < MODEL_PICKER_WIDE_MIN_WIDTH) {
-        return line(modelPickerCell('#', MODEL_PICKER_NUMBER_WIDTH, heading), modelPickerCell('Model', Math.max(1, innerWidth - MODEL_PICKER_NUMBER_WIDTH), heading));
+        return line(modelPickerCell('Model', Math.max(1, innerWidth), heading));
     }
-    return line(modelPickerCell('#', MODEL_PICKER_NUMBER_WIDTH, heading), modelPickerCell('Model', MODEL_PICKER_MODEL_WIDTH, heading), span(MODEL_PICKER_SEPARATOR, { color: 'gray' }), modelPickerCell('Cost', MODEL_PICKER_COST_WIDTH, heading), span(MODEL_PICKER_SEPARATOR, { color: 'gray' }), modelPickerCell('Notes', modelPickerNotesWidth(innerWidth), heading));
+    return line(modelPickerCell('Model', MODEL_PICKER_MODEL_WIDTH, heading), span(MODEL_PICKER_SEPARATOR, { color: 'gray' }), modelPickerCell('Cost', MODEL_PICKER_COST_WIDTH, heading), span(MODEL_PICKER_SEPARATOR, { color: 'gray' }), modelPickerCell('Notes', modelPickerNotesWidth(innerWidth), heading));
 }
 function buildModelPickerPanel(options, selectedIndex, width, availableHeight) {
     const panelWidth = Math.max(28, Math.min(width, MODEL_PICKER_PANEL_MAX_WIDTH));
@@ -1100,7 +1095,7 @@ function buildOverlayLines(state, width, height, nowMs) {
             if (padded)
                 lines.push(plainLine(''));
         }
-        const options = ['Approve once', 'Approve all remaining actions', 'Deny'];
+        const options = (prompt.options ?? []).map((option) => option.label);
         options.forEach((label, index) => {
             const selected = index === state.approvalCursor;
             lines.push(line(span(selected ? '› ' : '  ', {

package/dist/src/ui/tui/shell-input.js

@@ -1,5 +1,5 @@
 import { readClipboardImage, readClipboardText } from '../../core/clipboard.js';
-import { applySlashCommandSuggestion, buildModelPickerOptions, deleteAtCursor, deleteBeforeCursor, getApprovalChoiceForCursor, getInputCommandToken, getNextApprovalCursor, getNextModelPickerIndex, getSlashCommandSuggestions, insertAtCursor, isExactSlashCommandToken, navigatePromptHistory, shouldRemountLiveFrameForComposerInputChange, } from '../repl.js';
+import { applySlashCommandSuggestion, buildModelPickerOptions, deleteAtCursor, deleteBeforeCursor, getInputCommandToken, getNextApprovalCursor, getNextModelPickerIndex, getSlashCommandSuggestions, insertAtCursor, isExactSlashCommandToken, navigatePromptHistory, shouldRemountLiveFrameForComposerInputChange, } from '../repl.js';
 import { buildPastePlaceholder, shouldCollapsePaste, } from '../paste-collapse.js';
 import { handleUserInputPromptEvent, } from './user-input.js';
 const APPROVAL_PREVIEW_PAGE_ROWS = 3;
@@ -293,7 +293,7 @@ export function handleShellKeyEvent(store, handlers, event) {
         if (key.upArrow || key.downArrow) {
             store.update((current) => ({
                 ...current,
-                approvalCursor: getNextApprovalCursor(current.approvalCursor, key.upArrow ? -1 : 1),
+                approvalCursor: getNextApprovalCursor(current.approvalCursor, key.upArrow ? -1 : 1, current.approvalPrompt?.options?.length ?? 0),
             }));
             return;
         }
@@ -301,11 +301,11 @@ export function handleShellKeyEvent(store, handlers, event) {
             return;
         }
         if (key.escape) {
-            void handlers.onResolveApproval('n');
+            void handlers.onResolveApproval(-1);
             return;
         }
         if (key.returnKey) {
-            void handlers.onResolveApproval(getApprovalChoiceForCursor(state.approvalCursor));
+            void handlers.onResolveApproval(state.approvalCursor);
         }
         return;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thegitai/cli",
-  "version": "1.0.0-preview.16",
+  "version": "1.0.0-preview.18",
   "description": "TheGitAI is an AI coding agent for your terminal. It indexes your repository, writes and edits files, runs commands, and builds features with you.",
   "keywords": [
     "ai",
@@ -37,10 +37,10 @@
     "@lydell/node-pty-linux-x64": "1.1.0",
     "@lydell/node-pty-win32-arm64": "1.1.0",
     "@lydell/node-pty-win32-x64": "1.1.0",
-    "@thegitai/tui-darwin-arm64": "1.0.0-preview.16",
-    "@thegitai/tui-darwin-x64": "1.0.0-preview.16",
-    "@thegitai/tui-linux-x64": "1.0.0-preview.16",
-    "@thegitai/tui-win32-x64": "1.0.0-preview.16",
+    "@thegitai/tui-darwin-arm64": "1.0.0-preview.18",
+    "@thegitai/tui-darwin-x64": "1.0.0-preview.18",
+    "@thegitai/tui-linux-x64": "1.0.0-preview.18",
+    "@thegitai/tui-win32-x64": "1.0.0-preview.18",
     "@vscode/ripgrep": "1.18.0"
   },
   "publishConfig": {