@theokit/sdk 3.2.3 → 3.3.0

package/dist/index.d.cts

@@ -1,9 +1,9 @@
-import { T as TheokitAgentError, B as BudgetOptions, a as BudgetHandle, b as BudgetSnapshot, E as ErrorMetadata } from './errors-jxK4yfp5.cjs';
-export { A as AgentDisposedError, c as AgentRunError, d as AgentRunErrorCode, e as AuthenticationError, f as BudgetExceedEvent, g as BudgetExceededError, h as BudgetLimit, i as BudgetMode, j as BudgetScope, k as BudgetThresholdEvent, l as BudgetWindow, C as ConfigurationError, m as ErrorCode, I as IntegrationNotConnectedError, n as InvalidTaskIdError, M as MemoryAdapterError, o as MemoryAdapterErrorCode, N as NetworkError, R as RateLimitError, p as TaskNotFoundError, U as UnknownAgentError, q as UnsupportedBudgetOperationError, r as UnsupportedRunOperationError, s as UnsupportedTaskOperationError, t as isTransientError } from './errors-jxK4yfp5.cjs';
-import { A as AgentOptions, L as LocalOptions, P as ProviderRoutingSettings, S as SystemPromptResolver, C as CloudOptions, M as MemorySettings, a as AgentDefinition, b as ContextSettings, c as PluginsSettings, d as SkillsSettings, e as SDKAgent, f as ListAgentsOptions, g as ListResult, h as SDKAgentInfo, G as GetAgentOptions, i as ListRunsOptions, j as GetRunOptions, k as AgentOperationOptions, l as ProviderProfile, m as Plugin, I as InlineSkill, n as ConversationStorageAdapter, o as StoredMessage, p as SessionMeta, q as SessionMetaPatch, O as ObjectiveRecord, B as BudgetTracker, r as MemoryProvider, s as MemoryId, t as PreToolCallDecision, u as StepResult, v as SDKProvider } from './cron-4u1UdmgC.cjs';
-export { w as ActiveMemoryPassArgs, x as ActiveMemoryPassResult, y as AgentGoalConfig, z as AgentMemory, D as BudgetCheck, E as BudgetTotal, F as BudgetUsageEvent, H as CloudEnv, J as CloudRepo, K as ContextBudget, N as ContextManagerKind, Q as ContextSnapshot, R as ContextSource, T as ContextSourceStatus, U as CreateSkillSpec, V as Cron, W as CronCreateOptions, X as CronGetOptions, Y as CronJob, Z as CronJobStatus, _ as CronListOptions, $ as CronOperationOptions, a0 as CronRunOptions, a1 as CronRuntime, a2 as CronSchedulerStatus, a3 as CronStartOptions, a4 as DurableGoalOptions, a5 as GoalEvent, a6 as GoalOptions, a7 as GoalResult, a8 as HookName, a9 as InvalidateCacheOptions, aa as MemoryAdapter, ab as MemoryAdapterCapabilities, ac as MemoryContext, ad as MemoryFact, ae as MemoryProviderHandle, af as MemoryProviderInitOptions, ag as MemoryRevision, ah as MemoryToolSchema, ai as MemoryTurnMessage, aj as ObjectiveStatus, ak as PersonalityPreset, al as PluginContext, am as PostAssistantReplyContext, an as PreToolCallContext, ao as PreUserSendContext, ap as PreUserSendResult, aq as ProviderCapability, ar as ProviderRoute, as as RecordSessionSummaryArgs, at as ResolvedProviderRoute, au as RunUntilIterator, av as SDKAgentPlugins, aw as SDKAgentSkillDetail, ax as SDKAgentSkills, ay as SDKArtifact, az as SDKContextManager, aA as SDKPluginMetadata, aB as SDKProvidersManager, aC as SettingSource, aD as Skill, aE as SkillsResolver, aF as SkillsResolverContext, aG as SystemPromptContext, aH as SystemPromptMemoryFact, aI as SystemPromptSkillRef, aJ as TelemetrySettings } from './cron-4u1UdmgC.cjs';
-import { R as RunResult, M as ModelSelection, C as CustomTool, a as McpServerConfig, b as Run, P as Processor, T as ToolResultContentBlock, S as SDKMessage } from './run-CrHz9BAP.cjs';
-export { A as AgentConversationTurn, c as AssistantMessage, d as CompletionCheck, e as CompletionCheckResult, f as ConversationStep, g as ConversationTurn, h as CostBreakdown, i as CostSource, j as CostStatus, D as DoomLoopThresholds, G as GenerateOptions, k as GenerateRunResult, I as ImageBlock, l as InputProcessorContext, m as InteractionUpdate, n as McpAuthConfig, o as McpHttpServerConfig, p as McpOAuthConfig, q as McpStdioServerConfig, r as MessageOrigin, s as ModelParameterValue, O as OutputProcessorContext, t as PartialToolCallUpdate, u as ProcessorControls, v as ProcessorTripwire, w as ProcessorViolation, x as RunCompactBoundaryEvent, y as RunCompletionCheckEvent, z as RunErrorDetail, B as RunEvent, E as RunEventSink, F as RunGitInfo, H as RunOperation, J as RunPermissionDeniedEvent, K as RunRateLimitEvent, L as RunStatus, N as RunTaskCompletedEvent, Q as RunTaskStartedEvent, U as RunTaskUpdatedEvent, V as RunToCompletionOptions, W as RunToCompletionResult, X as RunToolProgressEvent, Y as RunTripwireEvent, Z as SDKAssistantMessage, _ as SDKImage, $ as SDKImageDimension, a0 as SDKObjectDelta, a1 as SDKRequestMessage, a2 as SDKStatusMessage, a3 as SDKSystemMessage, a4 as SDKTaskMessage, a5 as SDKThinkingMessage, a6 as SDKToolUseMessage, a7 as SDKUserMessage, a8 as SDKUserMessageEvent, a9 as SendOptions, aa as ShellCommand, ab as ShellConversationTurn, ac as ShellOutput, ad as ShellOutputDeltaUpdate, ae as StepCompletedUpdate, af as StepStartedUpdate, ag as StreamToCompletionResult, ah as SummaryCompletedUpdate, ai as SummaryStartedUpdate, aj as SummaryUpdate, ak as TextBlock, al as TextDeltaUpdate, am as ThinkingCompletedUpdate, an as ThinkingDeltaUpdate, ao as ThinkingMessage, ap as TokenDeltaUpdate, aq as TokenUsage, ar as ToolCall, as as ToolCallCompletedUpdate, at as ToolCallStartedUpdate, au as ToolContextMessage, av as ToolResult, aw as ToolResultGuardOptions, ax as ToolUseBlock, ay as TurnEndedUpdate, az as UserMessage, aA as UserMessageAppendedUpdate, aB as emitRunEvent } from './run-CrHz9BAP.cjs';
+import { T as TheokitAgentError, B as BudgetOptions, a as BudgetHandle, b as BudgetSnapshot, E as ErrorMetadata } from './errors-CIDoPGa7.cjs';
+export { A as AgentDisposedError, c as AgentRunError, d as AgentRunErrorCode, e as AuthenticationError, f as BudgetExceedEvent, g as BudgetExceededError, h as BudgetLimit, i as BudgetMode, j as BudgetScope, k as BudgetThresholdEvent, l as BudgetWindow, C as ConfigurationError, m as ErrorCode, I as IntegrationNotConnectedError, n as InvalidTaskIdError, M as MemoryAdapterError, o as MemoryAdapterErrorCode, N as NetworkError, R as RateLimitError, p as TaskNotFoundError, U as UnknownAgentError, q as UnsupportedBudgetOperationError, r as UnsupportedRunOperationError, s as UnsupportedTaskOperationError, t as isTransientError } from './errors-CIDoPGa7.cjs';
+import { A as AgentOptions, L as LocalOptions, P as ProviderRoutingSettings, S as SystemPromptResolver, C as CloudOptions, M as MemorySettings, a as AgentDefinition, b as ContextSettings, c as PluginsSettings, d as SkillsSettings, e as SDKAgent, f as ListAgentsOptions, g as ListResult, h as SDKAgentInfo, G as GetAgentOptions, i as ListRunsOptions, j as GetRunOptions, k as AgentOperationOptions, l as ProviderProfile, m as Plugin, I as InlineSkill, n as ConversationStorageAdapter, o as StoredMessage, p as SessionMeta, q as SessionMetaPatch, O as ObjectiveRecord, B as BudgetTracker, r as MemoryProvider, s as MemoryId, t as PreToolCallDecision, u as StepResult, v as SDKProvider } from './cron-BxoLC-XX.cjs';
+export { w as ActiveMemoryPassArgs, x as ActiveMemoryPassResult, y as AgentGoalConfig, z as AgentMemory, D as BudgetCheck, E as BudgetTotal, F as BudgetUsageEvent, H as CloudEnv, J as CloudRepo, K as ContextBudget, N as ContextManagerKind, Q as ContextSnapshot, R as ContextSource, T as ContextSourceStatus, U as CreateSkillSpec, V as Cron, W as CronCreateOptions, X as CronGetOptions, Y as CronJob, Z as CronJobStatus, _ as CronListOptions, $ as CronOperationOptions, a0 as CronRunOptions, a1 as CronRuntime, a2 as CronSchedulerStatus, a3 as CronStartOptions, a4 as DurableGoalOptions, a5 as GoalEvent, a6 as GoalOptions, a7 as GoalResult, a8 as HookName, a9 as InvalidateCacheOptions, aa as MemoryAdapter, ab as MemoryAdapterCapabilities, ac as MemoryContext, ad as MemoryFact, ae as MemoryProviderHandle, af as MemoryProviderInitOptions, ag as MemoryRevision, ah as MemoryToolSchema, ai as MemoryTurnMessage, aj as ObjectiveStatus, ak as PersonalityPreset, al as PluginContext, am as PostAssistantReplyContext, an as PreToolCallContext, ao as PreUserSendContext, ap as PreUserSendResult, aq as ProviderCapability, ar as ProviderRoute, as as RecordSessionSummaryArgs, at as ResolvedProviderRoute, au as RunUntilIterator, av as SDKAgentPlugins, aw as SDKAgentSkillDetail, ax as SDKAgentSkills, ay as SDKArtifact, az as SDKContextManager, aA as SDKPluginMetadata, aB as SDKProvidersManager, aC as SettingSource, aD as Skill, aE as SkillsResolver, aF as SkillsResolverContext, aG as SystemPromptContext, aH as SystemPromptMemoryFact, aI as SystemPromptSkillRef, aJ as TelemetrySettings } from './cron-BxoLC-XX.cjs';
+import { R as RunResult, M as ModelSelection, C as CustomTool, a as McpServerConfig, b as Run, P as Processor, T as ToolResultContentBlock, S as SDKMessage, c as PermissionMode, d as PermissionEngine } from './run-CL5Rw6a5.cjs';
+export { A as AgentConversationTurn, e as AssistantMessage, f as CompletionCheck, g as CompletionCheckResult, h as ConversationStep, i as ConversationTurn, j as CostBreakdown, k as CostSource, l as CostStatus, D as DoomLoopThresholds, G as GenerateOptions, m as GenerateRunResult, I as ImageBlock, n as InputProcessorContext, o as InteractionUpdate, p as McpAuthConfig, q as McpHttpServerConfig, r as McpOAuthConfig, s as McpStdioServerConfig, t as MessageOrigin, u as ModelParameterValue, O as OutputProcessorContext, v as PartialToolCallUpdate, w as PermissionAction, x as PermissionEngineOptions, y as PermissionRule, z as ProcessorControls, B as ProcessorTripwire, E as ProcessorViolation, F as RunCompactBoundaryEvent, H as RunCompletionCheckEvent, J as RunErrorDetail, K as RunEvent, L as RunEventSink, N as RunGitInfo, Q as RunOperation, U as RunPermissionDeniedEvent, V as RunRateLimitEvent, W as RunStatus, X as RunTaskCompletedEvent, Y as RunTaskStartedEvent, Z as RunTaskUpdatedEvent, _ as RunToCompletionOptions, $ as RunToCompletionResult, a0 as RunToolProgressEvent, a1 as RunTripwireEvent, a2 as SDKAssistantMessage, a3 as SDKImage, a4 as SDKImageDimension, a5 as SDKObjectDelta, a6 as SDKRequestMessage, a7 as SDKStatusMessage, a8 as SDKSystemMessage, a9 as SDKTaskMessage, aa as SDKThinkingMessage, ab as SDKToolUseMessage, ac as SDKUserMessage, ad as SDKUserMessageEvent, ae as SendOptions, af as ShellCommand, ag as ShellConversationTurn, ah as ShellOutput, ai as ShellOutputDeltaUpdate, aj as StepCompletedUpdate, ak as StepStartedUpdate, al as StreamToCompletionResult, am as SummaryCompletedUpdate, an as SummaryStartedUpdate, ao as SummaryUpdate, ap as TextBlock, aq as TextDeltaUpdate, ar as ThinkingCompletedUpdate, as as ThinkingDeltaUpdate, at as ThinkingMessage, au as TokenDeltaUpdate, av as TokenUsage, aw as ToolCall, ax as ToolCallCompletedUpdate, ay as ToolCallStartedUpdate, az as ToolContextMessage, aA as ToolResult, aB as ToolResultGuardOptions, aC as ToolUseBlock, aD as TurnEndedUpdate, aE as UserMessage, aF as UserMessageAppendedUpdate, aG as applyMode, aH as emitRunEvent } from './run-CL5Rw6a5.cjs';
 import * as zod from 'zod';
 import { ZodType, z } from 'zod';
 
@@ -1470,92 +1470,6 @@ interface MigrateResult {
  */
 declare function migrateSqliteToLance(options: MigrateOptions): Promise<MigrateResult>;
 
-/**
- * `PermissionEngine` — first-match permission rules for tool invocations.
- *
- * Evaluates a tool name (and optional arguments, #55) against an ordered list
- * of rules. First matching rule wins; when no rule matches the `defaultAction`
- * is returned. #55 — the default is now `"ask"` (FAIL-CLOSED): a permission
- * engine that cannot positively allow must not silently allow. Opt back into
- * the previous fail-open behavior with `{ defaultAction: "allow" }`.
- */
-type PermissionAction = "allow" | "deny" | "ask";
-/**
- * SE1 — a per-run permission MODE that adjusts the rule-engine verdict globally.
- * A PURE post-processor of the verdict (no tool-safety metadata needed, so it fits
- * a bring-your-own-tools runtime). Grounded in OpenCode (plan agent = deny-all,
- * `dangerously-skip-permissions`) + Codex (`AskForApproval`: `OnRequest` default,
- * `Never`, `UnlessTrusted`). See {@link applyMode} for the exact table.
- *
- * - `default` — verdict as-is (rules decide; unmatched ⇒ `ask`, fail-closed).
- * - `plan` — read-only: `allow` rules pass, everything else ⇒ `deny` (mutations blocked).
- *   NOTE: `plan` gates on the resolved verdict, so an engine configured with
- *   `{ defaultAction: "allow" }` still yields `allow` for UNMATCHED calls under
- *   `plan` — pair `plan` with the default fail-closed engine (`defaultAction: "ask"`)
- *   for full read-only behavior.
- * - `acceptEdits` — auto-approve the UNMATCHED verdict, but STILL honor an explicit
- *   `ask` rule (a caller gates a risky tool with an ask rule). Codex `UnlessTrusted`.
- * - `bypass` — everything ⇒ `allow` EXCEPT an explicit `deny` rule. Never asks.
- *   OpenCode `dangerously-skip-permissions` / Codex `Never`.
- */
-type PermissionMode = "default" | "plan" | "acceptEdits" | "bypass";
-/**
- * SE1 — apply a {@link PermissionMode} to a rule-engine verdict. Pure.
- *
- * `explicit` is `true` when the verdict came from a rule that matched by name (and
- * args), `false` when it is the fail-closed default for an unmatched call. The flag
- * is load-bearing for `acceptEdits`, which auto-approves the unmatched default but
- * keeps honoring an explicit `ask` rule (unlike `bypass`, which allows even that).
- *
- * INVARIANT (both OpenCode + Codex): an explicit `deny` is immune to EVERY
- * auto-approve mode — `bypass`/`acceptEdits` never un-deny.
- */
-declare function applyMode(verdict: PermissionAction, mode: PermissionMode, explicit: boolean): PermissionAction;
-/**
- * #55 — an argument matcher. A rule with `args` gates on the tool's argument
- * VALUES, not just its name: an exact string, a RegExp (tested against the
- * stringified value), or a predicate. Every declared arg must match for the
- * rule to apply — so `{ tool: "shell", args: { command: /rm\s+-rf/ } }` denies
- * a destructive shell call while leaving `ls` to fall through.
- */
-type ArgMatcher = string | RegExp | ((value: unknown) => boolean);
-interface PermissionRule {
-    /** Tool name (exact string) or pattern (RegExp). */
-    tool: string | RegExp;
-    /**
-     * #55 — optional per-argument matchers. When present, the rule matches only
-     * if the tool name matches AND every declared arg predicate matches the
-     * corresponding call argument. A missing/undefined arg fails its predicate
-     * (the rule does not match) — never throws.
-     */
-    args?: Record<string, ArgMatcher>;
-    /** Action to take when rule matches. */
-    action: PermissionAction;
-}
-/** Options for {@link PermissionEngine}. */
-interface PermissionEngineOptions {
-    /**
-     * Action when no rule matches. #55 — default is now `"ask"` (fail-closed): a
-     * permission engine that cannot positively allow must not silently allow.
-     * Pass `"allow"` to restore the previous fail-open behavior.
-     */
-    readonly defaultAction?: PermissionAction;
-}
-declare class PermissionEngine {
-    #private;
-    private readonly rules;
-    private readonly defaultAction;
-    constructor(rules: PermissionRule[], options?: PermissionEngineOptions);
-    /**
-     * Evaluate a tool name (and optional arguments) against the rules. First
-     * match wins; falls back to the configured `defaultAction` (default `"ask"`,
-     * fail-closed) when no rule matches. #55 — a rule with `args` gates on the
-     * argument values, so the same tool name can resolve to different actions
-     * depending on what it is asked to do.
-     */
-    evaluate(toolName: string, args?: Record<string, unknown>, mode?: PermissionMode): PermissionAction;
-}
-
 /**
  * M7-5 — `createPermissionPlugin`: wire a {@link PermissionEngine} into the
  * `definePlugin` `pre_tool_call` veto seam. This is the canonical exemplar that
@@ -2406,4 +2320,4 @@ declare function toShareGptTrajectory(result: BatchResult, options?: {
     model?: string;
 }): ShareGptTrajectory | null;
 
-export { Agent, AgentBuilder, AgentDefinition, AgentFactory, AgentOperationOptions, AgentOptions, type AgentPromptResult, type AgentRegistryOptions, type BatchItem, type BatchOptions, type BatchProgress, type BatchResult, Budget, BudgetHandle, BudgetOptions, BudgetSnapshot, BudgetTracker, CloudOptions, ContextSettings, ConversationStorageAdapter, type CounterBudgetTrackerOptions, CustomTool, type DeepPartial, type DefineProviderOptions, type DefineToolSpec, type DreamingSweepOptions, type DreamingSweepResult, ErrorMetadata, EventBus, type EvictReason, FileSystemConversationStorage, GenerateObjectError, type GenerateObjectOptions, type GenerateObjectResult, GetAgentOptions, GetRunOptions, InMemoryConversationStorage, InlineSkill, JobQueue, type JobQueueOptions, ListAgentsOptions, ListResult, ListRunsOptions, LiveAgentRegistry, LocalOptions, McpServerConfig, Memory, MemoryId, MemoryProvider, MemorySettings, type MigrateOptions, type MigrateResult, type ModelListItem, type ModelParameterDefinition, ModelSelection, type ModelVariant, NoopMemoryProvider, type NormalizedJsonSchema, ObjectiveRecord, type PermissionAction, PermissionEngine, type PermissionEngineOptions, type PermissionGate, type PermissionGateContext, type PermissionGateDecision, type PermissionMode, PermissionPlugin, type PermissionPluginOptions, type PermissionRule, Plugin, PluginsSettings, PreToolCallDecision, Processor, Provider, ProviderProfile, ProviderRoutingSettings, type ReplayHistoryOptions, Run, RunResult, SDKAgent, SDKAgentInfo, SDKMessage, type SDKModel, SDKProvider, type SDKRepository, type SDKUser, Security, Session, type SessionCapabilityResult, type SessionListOptions, type SessionManager, SessionMeta, SessionMetaPatch, type SessionScope, type SessionSummary, type ShareGptMessage, type ShareGptTrajectory, SkillReadTool, SkillsSettings, Squad, type SquadOptions, type SquadRun, StoredMessage, StreamObjectError, type StreamObjectEvent, type StreamObjectOptions, SystemPromptResolver, TASK_RESERVED_PREFIXES, Task, type TaskCancelResult, type TaskConfigureOptions, type TaskEvent, type TaskFilter, type TaskHandle, type TaskKind, type TaskState, type TaskStoreOptions, type TaskSubmitOptions, type TaskWorkContext, type TaskWorkFn, Theokit, TheokitAgentError, type TheokitRequestOptions, TokenLimiter, type TokenLimiterOptions, Tool, ToolError, ToolResultContentBlock, UnicodeNormalizer, type UnicodeNormalizerOptions, UsageAccumulator, applyMode, buildReplayHistory, chargeAndCheckThresholds, computeCost, createCounterBudgetTracker, estimateTokens, extractRawId, getPricingEntry, inferApiMode, isValidTaskId, migrateSqliteToLance, mkMemoryId, normalizeSchema, normalizeUsage, preflightCheck, scopedConversationId, sessionScopePrefix, toShareGptTrajectory, withCwdMutex };
+export { Agent, AgentBuilder, AgentDefinition, AgentFactory, AgentOperationOptions, AgentOptions, type AgentPromptResult, type AgentRegistryOptions, type BatchItem, type BatchOptions, type BatchProgress, type BatchResult, Budget, BudgetHandle, BudgetOptions, BudgetSnapshot, BudgetTracker, CloudOptions, ContextSettings, ConversationStorageAdapter, type CounterBudgetTrackerOptions, CustomTool, type DeepPartial, type DefineProviderOptions, type DefineToolSpec, type DreamingSweepOptions, type DreamingSweepResult, ErrorMetadata, EventBus, type EvictReason, FileSystemConversationStorage, GenerateObjectError, type GenerateObjectOptions, type GenerateObjectResult, GetAgentOptions, GetRunOptions, InMemoryConversationStorage, InlineSkill, JobQueue, type JobQueueOptions, ListAgentsOptions, ListResult, ListRunsOptions, LiveAgentRegistry, LocalOptions, McpServerConfig, Memory, MemoryId, MemoryProvider, MemorySettings, type MigrateOptions, type MigrateResult, type ModelListItem, type ModelParameterDefinition, ModelSelection, type ModelVariant, NoopMemoryProvider, type NormalizedJsonSchema, ObjectiveRecord, PermissionEngine, type PermissionGate, type PermissionGateContext, type PermissionGateDecision, PermissionMode, PermissionPlugin, type PermissionPluginOptions, Plugin, PluginsSettings, PreToolCallDecision, Processor, Provider, ProviderProfile, ProviderRoutingSettings, type ReplayHistoryOptions, Run, RunResult, SDKAgent, SDKAgentInfo, SDKMessage, type SDKModel, SDKProvider, type SDKRepository, type SDKUser, Security, Session, type SessionCapabilityResult, type SessionListOptions, type SessionManager, SessionMeta, SessionMetaPatch, type SessionScope, type SessionSummary, type ShareGptMessage, type ShareGptTrajectory, SkillReadTool, SkillsSettings, Squad, type SquadOptions, type SquadRun, StoredMessage, StreamObjectError, type StreamObjectEvent, type StreamObjectOptions, SystemPromptResolver, TASK_RESERVED_PREFIXES, Task, type TaskCancelResult, type TaskConfigureOptions, type TaskEvent, type TaskFilter, type TaskHandle, type TaskKind, type TaskState, type TaskStoreOptions, type TaskSubmitOptions, type TaskWorkContext, type TaskWorkFn, Theokit, TheokitAgentError, type TheokitRequestOptions, TokenLimiter, type TokenLimiterOptions, Tool, ToolError, ToolResultContentBlock, UnicodeNormalizer, type UnicodeNormalizerOptions, UsageAccumulator, buildReplayHistory, chargeAndCheckThresholds, computeCost, createCounterBudgetTracker, estimateTokens, extractRawId, getPricingEntry, inferApiMode, isValidTaskId, migrateSqliteToLance, mkMemoryId, normalizeSchema, normalizeUsage, preflightCheck, scopedConversationId, sessionScopePrefix, toShareGptTrajectory, withCwdMutex };

package/dist/index.d.ts

@@ -1,9 +1,9 @@
-import { T as TheokitAgentError, B as BudgetOptions, a as BudgetHandle, b as BudgetSnapshot, E as ErrorMetadata } from './errors-_fPS0X80.js';
-export { A as AgentDisposedError, c as AgentRunError, d as AgentRunErrorCode, e as AuthenticationError, f as BudgetExceedEvent, g as BudgetExceededError, h as BudgetLimit, i as BudgetMode, j as BudgetScope, k as BudgetThresholdEvent, l as BudgetWindow, C as ConfigurationError, m as ErrorCode, I as IntegrationNotConnectedError, n as InvalidTaskIdError, M as MemoryAdapterError, o as MemoryAdapterErrorCode, N as NetworkError, R as RateLimitError, p as TaskNotFoundError, U as UnknownAgentError, q as UnsupportedBudgetOperationError, r as UnsupportedRunOperationError, s as UnsupportedTaskOperationError, t as isTransientError } from './errors-_fPS0X80.js';
-import { A as AgentOptions, L as LocalOptions, P as ProviderRoutingSettings, S as SystemPromptResolver, C as CloudOptions, M as MemorySettings, a as AgentDefinition, b as ContextSettings, c as PluginsSettings, d as SkillsSettings, e as SDKAgent, f as ListAgentsOptions, g as ListResult, h as SDKAgentInfo, G as GetAgentOptions, i as ListRunsOptions, j as GetRunOptions, k as AgentOperationOptions, l as ProviderProfile, m as Plugin, I as InlineSkill, n as ConversationStorageAdapter, o as StoredMessage, p as SessionMeta, q as SessionMetaPatch, O as ObjectiveRecord, B as BudgetTracker, r as MemoryProvider, s as MemoryId, t as PreToolCallDecision, u as StepResult, v as SDKProvider } from './cron-DuhVPer6.js';
-export { w as ActiveMemoryPassArgs, x as ActiveMemoryPassResult, y as AgentGoalConfig, z as AgentMemory, D as BudgetCheck, E as BudgetTotal, F as BudgetUsageEvent, H as CloudEnv, J as CloudRepo, K as ContextBudget, N as ContextManagerKind, Q as ContextSnapshot, R as ContextSource, T as ContextSourceStatus, U as CreateSkillSpec, V as Cron, W as CronCreateOptions, X as CronGetOptions, Y as CronJob, Z as CronJobStatus, _ as CronListOptions, $ as CronOperationOptions, a0 as CronRunOptions, a1 as CronRuntime, a2 as CronSchedulerStatus, a3 as CronStartOptions, a4 as DurableGoalOptions, a5 as GoalEvent, a6 as GoalOptions, a7 as GoalResult, a8 as HookName, a9 as InvalidateCacheOptions, aa as MemoryAdapter, ab as MemoryAdapterCapabilities, ac as MemoryContext, ad as MemoryFact, ae as MemoryProviderHandle, af as MemoryProviderInitOptions, ag as MemoryRevision, ah as MemoryToolSchema, ai as MemoryTurnMessage, aj as ObjectiveStatus, ak as PersonalityPreset, al as PluginContext, am as PostAssistantReplyContext, an as PreToolCallContext, ao as PreUserSendContext, ap as PreUserSendResult, aq as ProviderCapability, ar as ProviderRoute, as as RecordSessionSummaryArgs, at as ResolvedProviderRoute, au as RunUntilIterator, av as SDKAgentPlugins, aw as SDKAgentSkillDetail, ax as SDKAgentSkills, ay as SDKArtifact, az as SDKContextManager, aA as SDKPluginMetadata, aB as SDKProvidersManager, aC as SettingSource, aD as Skill, aE as SkillsResolver, aF as SkillsResolverContext, aG as SystemPromptContext, aH as SystemPromptMemoryFact, aI as SystemPromptSkillRef, aJ as TelemetrySettings } from './cron-DuhVPer6.js';
-import { R as RunResult, M as ModelSelection, C as CustomTool, a as McpServerConfig, b as Run, P as Processor, T as ToolResultContentBlock, S as SDKMessage } from './run-CrHz9BAP.js';
-export { A as AgentConversationTurn, c as AssistantMessage, d as CompletionCheck, e as CompletionCheckResult, f as ConversationStep, g as ConversationTurn, h as CostBreakdown, i as CostSource, j as CostStatus, D as DoomLoopThresholds, G as GenerateOptions, k as GenerateRunResult, I as ImageBlock, l as InputProcessorContext, m as InteractionUpdate, n as McpAuthConfig, o as McpHttpServerConfig, p as McpOAuthConfig, q as McpStdioServerConfig, r as MessageOrigin, s as ModelParameterValue, O as OutputProcessorContext, t as PartialToolCallUpdate, u as ProcessorControls, v as ProcessorTripwire, w as ProcessorViolation, x as RunCompactBoundaryEvent, y as RunCompletionCheckEvent, z as RunErrorDetail, B as RunEvent, E as RunEventSink, F as RunGitInfo, H as RunOperation, J as RunPermissionDeniedEvent, K as RunRateLimitEvent, L as RunStatus, N as RunTaskCompletedEvent, Q as RunTaskStartedEvent, U as RunTaskUpdatedEvent, V as RunToCompletionOptions, W as RunToCompletionResult, X as RunToolProgressEvent, Y as RunTripwireEvent, Z as SDKAssistantMessage, _ as SDKImage, $ as SDKImageDimension, a0 as SDKObjectDelta, a1 as SDKRequestMessage, a2 as SDKStatusMessage, a3 as SDKSystemMessage, a4 as SDKTaskMessage, a5 as SDKThinkingMessage, a6 as SDKToolUseMessage, a7 as SDKUserMessage, a8 as SDKUserMessageEvent, a9 as SendOptions, aa as ShellCommand, ab as ShellConversationTurn, ac as ShellOutput, ad as ShellOutputDeltaUpdate, ae as StepCompletedUpdate, af as StepStartedUpdate, ag as StreamToCompletionResult, ah as SummaryCompletedUpdate, ai as SummaryStartedUpdate, aj as SummaryUpdate, ak as TextBlock, al as TextDeltaUpdate, am as ThinkingCompletedUpdate, an as ThinkingDeltaUpdate, ao as ThinkingMessage, ap as TokenDeltaUpdate, aq as TokenUsage, ar as ToolCall, as as ToolCallCompletedUpdate, at as ToolCallStartedUpdate, au as ToolContextMessage, av as ToolResult, aw as ToolResultGuardOptions, ax as ToolUseBlock, ay as TurnEndedUpdate, az as UserMessage, aA as UserMessageAppendedUpdate, aB as emitRunEvent } from './run-CrHz9BAP.js';
+import { T as TheokitAgentError, B as BudgetOptions, a as BudgetHandle, b as BudgetSnapshot, E as ErrorMetadata } from './errors-CFEt27lI.js';
+export { A as AgentDisposedError, c as AgentRunError, d as AgentRunErrorCode, e as AuthenticationError, f as BudgetExceedEvent, g as BudgetExceededError, h as BudgetLimit, i as BudgetMode, j as BudgetScope, k as BudgetThresholdEvent, l as BudgetWindow, C as ConfigurationError, m as ErrorCode, I as IntegrationNotConnectedError, n as InvalidTaskIdError, M as MemoryAdapterError, o as MemoryAdapterErrorCode, N as NetworkError, R as RateLimitError, p as TaskNotFoundError, U as UnknownAgentError, q as UnsupportedBudgetOperationError, r as UnsupportedRunOperationError, s as UnsupportedTaskOperationError, t as isTransientError } from './errors-CFEt27lI.js';
+import { A as AgentOptions, L as LocalOptions, P as ProviderRoutingSettings, S as SystemPromptResolver, C as CloudOptions, M as MemorySettings, a as AgentDefinition, b as ContextSettings, c as PluginsSettings, d as SkillsSettings, e as SDKAgent, f as ListAgentsOptions, g as ListResult, h as SDKAgentInfo, G as GetAgentOptions, i as ListRunsOptions, j as GetRunOptions, k as AgentOperationOptions, l as ProviderProfile, m as Plugin, I as InlineSkill, n as ConversationStorageAdapter, o as StoredMessage, p as SessionMeta, q as SessionMetaPatch, O as ObjectiveRecord, B as BudgetTracker, r as MemoryProvider, s as MemoryId, t as PreToolCallDecision, u as StepResult, v as SDKProvider } from './cron-DFta_5kE.js';
+export { w as ActiveMemoryPassArgs, x as ActiveMemoryPassResult, y as AgentGoalConfig, z as AgentMemory, D as BudgetCheck, E as BudgetTotal, F as BudgetUsageEvent, H as CloudEnv, J as CloudRepo, K as ContextBudget, N as ContextManagerKind, Q as ContextSnapshot, R as ContextSource, T as ContextSourceStatus, U as CreateSkillSpec, V as Cron, W as CronCreateOptions, X as CronGetOptions, Y as CronJob, Z as CronJobStatus, _ as CronListOptions, $ as CronOperationOptions, a0 as CronRunOptions, a1 as CronRuntime, a2 as CronSchedulerStatus, a3 as CronStartOptions, a4 as DurableGoalOptions, a5 as GoalEvent, a6 as GoalOptions, a7 as GoalResult, a8 as HookName, a9 as InvalidateCacheOptions, aa as MemoryAdapter, ab as MemoryAdapterCapabilities, ac as MemoryContext, ad as MemoryFact, ae as MemoryProviderHandle, af as MemoryProviderInitOptions, ag as MemoryRevision, ah as MemoryToolSchema, ai as MemoryTurnMessage, aj as ObjectiveStatus, ak as PersonalityPreset, al as PluginContext, am as PostAssistantReplyContext, an as PreToolCallContext, ao as PreUserSendContext, ap as PreUserSendResult, aq as ProviderCapability, ar as ProviderRoute, as as RecordSessionSummaryArgs, at as ResolvedProviderRoute, au as RunUntilIterator, av as SDKAgentPlugins, aw as SDKAgentSkillDetail, ax as SDKAgentSkills, ay as SDKArtifact, az as SDKContextManager, aA as SDKPluginMetadata, aB as SDKProvidersManager, aC as SettingSource, aD as Skill, aE as SkillsResolver, aF as SkillsResolverContext, aG as SystemPromptContext, aH as SystemPromptMemoryFact, aI as SystemPromptSkillRef, aJ as TelemetrySettings } from './cron-DFta_5kE.js';
+import { R as RunResult, M as ModelSelection, C as CustomTool, a as McpServerConfig, b as Run, P as Processor, T as ToolResultContentBlock, S as SDKMessage, c as PermissionMode, d as PermissionEngine } from './run-CL5Rw6a5.js';
+export { A as AgentConversationTurn, e as AssistantMessage, f as CompletionCheck, g as CompletionCheckResult, h as ConversationStep, i as ConversationTurn, j as CostBreakdown, k as CostSource, l as CostStatus, D as DoomLoopThresholds, G as GenerateOptions, m as GenerateRunResult, I as ImageBlock, n as InputProcessorContext, o as InteractionUpdate, p as McpAuthConfig, q as McpHttpServerConfig, r as McpOAuthConfig, s as McpStdioServerConfig, t as MessageOrigin, u as ModelParameterValue, O as OutputProcessorContext, v as PartialToolCallUpdate, w as PermissionAction, x as PermissionEngineOptions, y as PermissionRule, z as ProcessorControls, B as ProcessorTripwire, E as ProcessorViolation, F as RunCompactBoundaryEvent, H as RunCompletionCheckEvent, J as RunErrorDetail, K as RunEvent, L as RunEventSink, N as RunGitInfo, Q as RunOperation, U as RunPermissionDeniedEvent, V as RunRateLimitEvent, W as RunStatus, X as RunTaskCompletedEvent, Y as RunTaskStartedEvent, Z as RunTaskUpdatedEvent, _ as RunToCompletionOptions, $ as RunToCompletionResult, a0 as RunToolProgressEvent, a1 as RunTripwireEvent, a2 as SDKAssistantMessage, a3 as SDKImage, a4 as SDKImageDimension, a5 as SDKObjectDelta, a6 as SDKRequestMessage, a7 as SDKStatusMessage, a8 as SDKSystemMessage, a9 as SDKTaskMessage, aa as SDKThinkingMessage, ab as SDKToolUseMessage, ac as SDKUserMessage, ad as SDKUserMessageEvent, ae as SendOptions, af as ShellCommand, ag as ShellConversationTurn, ah as ShellOutput, ai as ShellOutputDeltaUpdate, aj as StepCompletedUpdate, ak as StepStartedUpdate, al as StreamToCompletionResult, am as SummaryCompletedUpdate, an as SummaryStartedUpdate, ao as SummaryUpdate, ap as TextBlock, aq as TextDeltaUpdate, ar as ThinkingCompletedUpdate, as as ThinkingDeltaUpdate, at as ThinkingMessage, au as TokenDeltaUpdate, av as TokenUsage, aw as ToolCall, ax as ToolCallCompletedUpdate, ay as ToolCallStartedUpdate, az as ToolContextMessage, aA as ToolResult, aB as ToolResultGuardOptions, aC as ToolUseBlock, aD as TurnEndedUpdate, aE as UserMessage, aF as UserMessageAppendedUpdate, aG as applyMode, aH as emitRunEvent } from './run-CL5Rw6a5.js';
 import * as zod from 'zod';
 import { ZodType, z } from 'zod';
 
@@ -1470,92 +1470,6 @@ interface MigrateResult {
  */
 declare function migrateSqliteToLance(options: MigrateOptions): Promise<MigrateResult>;
 
-/**
- * `PermissionEngine` — first-match permission rules for tool invocations.
- *
- * Evaluates a tool name (and optional arguments, #55) against an ordered list
- * of rules. First matching rule wins; when no rule matches the `defaultAction`
- * is returned. #55 — the default is now `"ask"` (FAIL-CLOSED): a permission
- * engine that cannot positively allow must not silently allow. Opt back into
- * the previous fail-open behavior with `{ defaultAction: "allow" }`.
- */
-type PermissionAction = "allow" | "deny" | "ask";
-/**
- * SE1 — a per-run permission MODE that adjusts the rule-engine verdict globally.
- * A PURE post-processor of the verdict (no tool-safety metadata needed, so it fits
- * a bring-your-own-tools runtime). Grounded in OpenCode (plan agent = deny-all,
- * `dangerously-skip-permissions`) + Codex (`AskForApproval`: `OnRequest` default,
- * `Never`, `UnlessTrusted`). See {@link applyMode} for the exact table.
- *
- * - `default` — verdict as-is (rules decide; unmatched ⇒ `ask`, fail-closed).
- * - `plan` — read-only: `allow` rules pass, everything else ⇒ `deny` (mutations blocked).
- *   NOTE: `plan` gates on the resolved verdict, so an engine configured with
- *   `{ defaultAction: "allow" }` still yields `allow` for UNMATCHED calls under
- *   `plan` — pair `plan` with the default fail-closed engine (`defaultAction: "ask"`)
- *   for full read-only behavior.
- * - `acceptEdits` — auto-approve the UNMATCHED verdict, but STILL honor an explicit
- *   `ask` rule (a caller gates a risky tool with an ask rule). Codex `UnlessTrusted`.
- * - `bypass` — everything ⇒ `allow` EXCEPT an explicit `deny` rule. Never asks.
- *   OpenCode `dangerously-skip-permissions` / Codex `Never`.
- */
-type PermissionMode = "default" | "plan" | "acceptEdits" | "bypass";
-/**
- * SE1 — apply a {@link PermissionMode} to a rule-engine verdict. Pure.
- *
- * `explicit` is `true` when the verdict came from a rule that matched by name (and
- * args), `false` when it is the fail-closed default for an unmatched call. The flag
- * is load-bearing for `acceptEdits`, which auto-approves the unmatched default but
- * keeps honoring an explicit `ask` rule (unlike `bypass`, which allows even that).
- *
- * INVARIANT (both OpenCode + Codex): an explicit `deny` is immune to EVERY
- * auto-approve mode — `bypass`/`acceptEdits` never un-deny.
- */
-declare function applyMode(verdict: PermissionAction, mode: PermissionMode, explicit: boolean): PermissionAction;
-/**
- * #55 — an argument matcher. A rule with `args` gates on the tool's argument
- * VALUES, not just its name: an exact string, a RegExp (tested against the
- * stringified value), or a predicate. Every declared arg must match for the
- * rule to apply — so `{ tool: "shell", args: { command: /rm\s+-rf/ } }` denies
- * a destructive shell call while leaving `ls` to fall through.
- */
-type ArgMatcher = string | RegExp | ((value: unknown) => boolean);
-interface PermissionRule {
-    /** Tool name (exact string) or pattern (RegExp). */
-    tool: string | RegExp;
-    /**
-     * #55 — optional per-argument matchers. When present, the rule matches only
-     * if the tool name matches AND every declared arg predicate matches the
-     * corresponding call argument. A missing/undefined arg fails its predicate
-     * (the rule does not match) — never throws.
-     */
-    args?: Record<string, ArgMatcher>;
-    /** Action to take when rule matches. */
-    action: PermissionAction;
-}
-/** Options for {@link PermissionEngine}. */
-interface PermissionEngineOptions {
-    /**
-     * Action when no rule matches. #55 — default is now `"ask"` (fail-closed): a
-     * permission engine that cannot positively allow must not silently allow.
-     * Pass `"allow"` to restore the previous fail-open behavior.
-     */
-    readonly defaultAction?: PermissionAction;
-}
-declare class PermissionEngine {
-    #private;
-    private readonly rules;
-    private readonly defaultAction;
-    constructor(rules: PermissionRule[], options?: PermissionEngineOptions);
-    /**
-     * Evaluate a tool name (and optional arguments) against the rules. First
-     * match wins; falls back to the configured `defaultAction` (default `"ask"`,
-     * fail-closed) when no rule matches. #55 — a rule with `args` gates on the
-     * argument values, so the same tool name can resolve to different actions
-     * depending on what it is asked to do.
-     */
-    evaluate(toolName: string, args?: Record<string, unknown>, mode?: PermissionMode): PermissionAction;
-}
-
 /**
  * M7-5 — `createPermissionPlugin`: wire a {@link PermissionEngine} into the
  * `definePlugin` `pre_tool_call` veto seam. This is the canonical exemplar that
@@ -2406,4 +2320,4 @@ declare function toShareGptTrajectory(result: BatchResult, options?: {
     model?: string;
 }): ShareGptTrajectory | null;
 
-export { Agent, AgentBuilder, AgentDefinition, AgentFactory, AgentOperationOptions, AgentOptions, type AgentPromptResult, type AgentRegistryOptions, type BatchItem, type BatchOptions, type BatchProgress, type BatchResult, Budget, BudgetHandle, BudgetOptions, BudgetSnapshot, BudgetTracker, CloudOptions, ContextSettings, ConversationStorageAdapter, type CounterBudgetTrackerOptions, CustomTool, type DeepPartial, type DefineProviderOptions, type DefineToolSpec, type DreamingSweepOptions, type DreamingSweepResult, ErrorMetadata, EventBus, type EvictReason, FileSystemConversationStorage, GenerateObjectError, type GenerateObjectOptions, type GenerateObjectResult, GetAgentOptions, GetRunOptions, InMemoryConversationStorage, InlineSkill, JobQueue, type JobQueueOptions, ListAgentsOptions, ListResult, ListRunsOptions, LiveAgentRegistry, LocalOptions, McpServerConfig, Memory, MemoryId, MemoryProvider, MemorySettings, type MigrateOptions, type MigrateResult, type ModelListItem, type ModelParameterDefinition, ModelSelection, type ModelVariant, NoopMemoryProvider, type NormalizedJsonSchema, ObjectiveRecord, type PermissionAction, PermissionEngine, type PermissionEngineOptions, type PermissionGate, type PermissionGateContext, type PermissionGateDecision, type PermissionMode, PermissionPlugin, type PermissionPluginOptions, type PermissionRule, Plugin, PluginsSettings, PreToolCallDecision, Processor, Provider, ProviderProfile, ProviderRoutingSettings, type ReplayHistoryOptions, Run, RunResult, SDKAgent, SDKAgentInfo, SDKMessage, type SDKModel, SDKProvider, type SDKRepository, type SDKUser, Security, Session, type SessionCapabilityResult, type SessionListOptions, type SessionManager, SessionMeta, SessionMetaPatch, type SessionScope, type SessionSummary, type ShareGptMessage, type ShareGptTrajectory, SkillReadTool, SkillsSettings, Squad, type SquadOptions, type SquadRun, StoredMessage, StreamObjectError, type StreamObjectEvent, type StreamObjectOptions, SystemPromptResolver, TASK_RESERVED_PREFIXES, Task, type TaskCancelResult, type TaskConfigureOptions, type TaskEvent, type TaskFilter, type TaskHandle, type TaskKind, type TaskState, type TaskStoreOptions, type TaskSubmitOptions, type TaskWorkContext, type TaskWorkFn, Theokit, TheokitAgentError, type TheokitRequestOptions, TokenLimiter, type TokenLimiterOptions, Tool, ToolError, ToolResultContentBlock, UnicodeNormalizer, type UnicodeNormalizerOptions, UsageAccumulator, applyMode, buildReplayHistory, chargeAndCheckThresholds, computeCost, createCounterBudgetTracker, estimateTokens, extractRawId, getPricingEntry, inferApiMode, isValidTaskId, migrateSqliteToLance, mkMemoryId, normalizeSchema, normalizeUsage, preflightCheck, scopedConversationId, sessionScopePrefix, toShareGptTrajectory, withCwdMutex };
+export { Agent, AgentBuilder, AgentDefinition, AgentFactory, AgentOperationOptions, AgentOptions, type AgentPromptResult, type AgentRegistryOptions, type BatchItem, type BatchOptions, type BatchProgress, type BatchResult, Budget, BudgetHandle, BudgetOptions, BudgetSnapshot, BudgetTracker, CloudOptions, ContextSettings, ConversationStorageAdapter, type CounterBudgetTrackerOptions, CustomTool, type DeepPartial, type DefineProviderOptions, type DefineToolSpec, type DreamingSweepOptions, type DreamingSweepResult, ErrorMetadata, EventBus, type EvictReason, FileSystemConversationStorage, GenerateObjectError, type GenerateObjectOptions, type GenerateObjectResult, GetAgentOptions, GetRunOptions, InMemoryConversationStorage, InlineSkill, JobQueue, type JobQueueOptions, ListAgentsOptions, ListResult, ListRunsOptions, LiveAgentRegistry, LocalOptions, McpServerConfig, Memory, MemoryId, MemoryProvider, MemorySettings, type MigrateOptions, type MigrateResult, type ModelListItem, type ModelParameterDefinition, ModelSelection, type ModelVariant, NoopMemoryProvider, type NormalizedJsonSchema, ObjectiveRecord, PermissionEngine, type PermissionGate, type PermissionGateContext, type PermissionGateDecision, PermissionMode, PermissionPlugin, type PermissionPluginOptions, Plugin, PluginsSettings, PreToolCallDecision, Processor, Provider, ProviderProfile, ProviderRoutingSettings, type ReplayHistoryOptions, Run, RunResult, SDKAgent, SDKAgentInfo, SDKMessage, type SDKModel, SDKProvider, type SDKRepository, type SDKUser, Security, Session, type SessionCapabilityResult, type SessionListOptions, type SessionManager, SessionMeta, SessionMetaPatch, type SessionScope, type SessionSummary, type ShareGptMessage, type ShareGptTrajectory, SkillReadTool, SkillsSettings, Squad, type SquadOptions, type SquadRun, StoredMessage, StreamObjectError, type StreamObjectEvent, type StreamObjectOptions, SystemPromptResolver, TASK_RESERVED_PREFIXES, Task, type TaskCancelResult, type TaskConfigureOptions, type TaskEvent, type TaskFilter, type TaskHandle, type TaskKind, type TaskState, type TaskStoreOptions, type TaskSubmitOptions, type TaskWorkContext, type TaskWorkFn, Theokit, TheokitAgentError, type TheokitRequestOptions, TokenLimiter, type TokenLimiterOptions, Tool, ToolError, ToolResultContentBlock, UnicodeNormalizer, type UnicodeNormalizerOptions, UsageAccumulator, buildReplayHistory, chargeAndCheckThresholds, computeCost, createCounterBudgetTracker, estimateTokens, extractRawId, getPricingEntry, inferApiMode, isValidTaskId, migrateSqliteToLance, mkMemoryId, normalizeSchema, normalizeUsage, preflightCheck, scopedConversationId, sessionScopePrefix, toShareGptTrajectory, withCwdMutex };

package/dist/index.js

@@ -9013,7 +9013,9 @@ async function vetoFromPluginPreHook(inputs, call, callId, events) {
     name: call.name,
     args: call.input,
     agentId: inputs.agentId,
-    runId: inputs.runId
+    runId: inputs.runId,
+    // SE1 — thread the run's permission mode so a PermissionPlugin gates per-run.
+    ...inputs.permissionMode !== void 0 ? { permissionMode: inputs.permissionMode } : {}
   });
   if (pluginVeto === void 0) return void 0;
   emitRunEvent(inputs.runEventSink, {
@@ -13438,6 +13440,10 @@ function buildLoopInputs(options, runId, userText) {
     ...options.onDelta !== void 0 ? { onDelta: options.onDelta } : {},
     ...options.sendOptions.toolChoice !== void 0 ? { toolChoice: options.sendOptions.toolChoice } : {},
     ...options.sendOptions.activeTools !== void 0 ? { activeTools: options.sendOptions.activeTools } : {},
+    // SE1 — resolve the run's permission mode: per-send wins over creation-time.
+    ...(options.sendOptions.permissionMode ?? options.agentOptions.permissionMode) !== void 0 ? {
+      permissionMode: options.sendOptions.permissionMode ?? options.agentOptions.permissionMode
+    } : {},
     ...options.priorMessages !== void 0 ? { priorMessages: options.priorMessages } : {},
     ...options.memoryTools !== void 0 && options.memoryTools.length > 0 ? { memoryTools: options.memoryTools } : {},
     ...buildCustomToolsInput(
@@ -22843,13 +22849,17 @@ function applyMode(verdict, mode, explicit) {
       return verdict;
     // allow stays allow
     case "bypass":
+    case "bypassPermissions":
       return "allow";
   }
 }
 function argMatches(matcher, value) {
   if (typeof matcher === "function") return matcher(value);
   if (value === void 0) return false;
-  if (matcher instanceof RegExp) return matcher.test(String(value));
+  if (matcher instanceof RegExp) {
+    matcher.lastIndex = 0;
+    return matcher.test(String(value));
+  }
   return matcher === value;
 }
 var PermissionEngine = class {
@@ -22893,19 +22903,19 @@ async function resolveAsk(opts, name, args, mode) {
     } catch {
       return { block: true, message: `permission gate error (fail-closed): ${name}` };
     }
-    return decision.behavior === "deny" ? { block: true, message: decision.message ?? `denied: ${name}` } : void 0;
+    return decision?.behavior === "allow" ? void 0 : { block: true, message: decision?.message ?? `denied: ${name}` };
   }
   return opts.onAsk ? opts.onAsk(name) : { block: true, message: `requires approval: ${name}` };
 }
 function createPermissionPlugin(engine, opts = {}) {
-  const mode = opts.mode ?? "default";
   return definePlugin({
     name: opts.name ?? "permission-engine",
     version: "1.0.0",
     kind: "general",
     register(ctx) {
       ctx.on("pre_tool_call", async (rawCtx) => {
-        const { name, args } = rawCtx;
+        const { name, args, permissionMode } = rawCtx;
+        const mode = permissionMode ?? opts.mode ?? "default";
         const action = engine.evaluate(name, args, mode);
         if (action === "deny") {
           return { block: true, message: `denied by permission engine: ${name}` };