@wrongstack/acp 0.292.1 → 0.293.0

package/dist/client/acp-session.d.ts

@@ -334,11 +334,12 @@ export declare class ACPSession {
      * closing the gap where the agent simply skips the voluntary permission
      * request and sends the privileged callback directly.
      *
-     * Uses the session's permission policy. The default policy
-     * (`defaultPermissionPolicy`) auto-approves everything — this is correct
-     * for trusted local agents (CLI `acp spawn`, Director fan-out). For
-     * untrusted/remote agents, the host should inject
-     * `readOnlyPermissionPolicy` or an interactive policy.
+     * Uses the session's permission policy. The default
+     * (`readOnlyPermissionPolicy`) auto-approves only side-effect-free tool
+     * calls (read/search/fetch/think) and rejects everything else — this is
+     * the safe-by-default posture. For trusted local agents (CLI `acp spawn`,
+     * Director fan-out), inject `defaultPermissionPolicy` to grant
+     * write/execute access.
      *
      * Returns true if the callback is authorized, false if denied.
      */

package/dist/client/acp-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"acp-session.d.ts","sourceRoot":"","sources":["../../src/client/acp-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAmB,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEvF,OAAO,EAEL,KAAK,+BAA+B,EACrC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,UAAU,EAEf,KAAK,cAAc,EAEnB,KAAK,QAAQ,EACb,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAC;AAGzB,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,sCAAsC;IACtC,gBAAgB,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAChD,wCAAwC;IACxC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,uDAAuD;IACvD,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,mDAAmD;IACnD,uBAAuB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC;CACtC;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC5B,MAAM,EAAE,cAAc,CAAC;IACvB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CAChD;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,UAAU,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAC;IACjF,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC;IAC/B,kEAAkE;IAClE,SAAS,EAAE,mBAAmB,EAAE,CAAC;IACjC,+CAA+C;IAC/C,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;AAEnE,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,EAAE,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;KAAE,CAAA;CAAE,GACtF;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAE9C,MAAM,MAAM,mBAAmB,GAC3B,cAAc,GACd,aAAa,GACb,gBAAgB,GAChB,uBAAuB,GACvB,eAAe,GACf,aAAa,GACb,eAAe,GACf,SAAS,GACT,QAAQ,GACR,YAAY,GACZ,wBAAwB,CAAC;AAE7B,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,SAAkB,KAAK,EAAE,OAAO,CAAC;IACjC,YAAY,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAKtE;CACF;AA2BD,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;IACxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;IACpD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoB;IAEzC,OAAO,CAAC,KAAK,CAAiB;IAC9B,OAAO,CAAC,SAAS,CAA0B;IAC3C,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8C;IACtE,OAAO,CAAC,MAAM,CAAK;IACnB,0CAA0C;IAC1C,OAAO,CAAC,MAAM,CAAS;IAGvB,OAAO,CAAC,iBAAiB,CAAyB;IAClD,OAAO,CAAC,SAAS,CAA8E;IAC/F,OAAO,CAAC,WAAW,CAAoB;IACvC,oEAAoE;IACpE,OAAO,CAAC,iBAAiB,CAAgC;IAEzD,OAAO,eAoBN;IAMD,uDAAuD;IACvD,eAAe,IAAI,iBAAiB,CAEnC;IAED,sDAAsD;IACtD,cAAc,IAAI,UAAU,EAAE,CAE7B;IAED,yDAAyD;IACzD,YAAY,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAEnF;IAED,oEAAoE;IACpE,YAAY,IAAI,OAAO,CAEtB;IAED,yCAAyC;IACzC,YAAY,IAAI,SAAS,GAAG,IAAI,CAE/B;IAED,qDAAqD;IACrD,oBAAoB,IAAI,MAAM,CAE7B;IAMD;;;OAGG;IACH,OAAa,KAAK,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CAW/D;IAED;;;;;OAKG;IACH,OAAa,gBAAgB,CAC3B,MAAM,EAAE,+BAA+B,EACvC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,UAAU,CAAC,CAGrB;IAED;;;OAGG;IACH,OAAa,OAAO,CAClB,SAAS,EAAE,kBAAkB,EAC7B,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,UAAU,CAAC,CAErB;IAED,6EAA6E;mBACxD,MAAM;YAgCb,UAAU;IAkDxB;;;;;;OAMG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBlD;IAED;;;OAGG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAiB5B;IAMD;;;;;;;;;OASG;IACG,WAAW,CACf,SAAS,EAAE,SAAS,EACpB,UAAU,CAAC,EAAE,SAAS,EAAE,EACxB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CA2Bf;IAED;;;;;;;;OAQG;IACG,aAAa,CACjB,SAAS,EAAE,SAAS,EACpB,UAAU,CAAC,EAAE,SAAS,EAAE,EACxB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAyBf;IAED;;;;OAIG;IACG,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC,CAwBvH;IAED;;;;OAIG;IACG,aAAa,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBvD;IAED;;OAEG;IACG,WAAW,CACf,eAAe,EAAE,SAAS,EAC1B,GAAG,CAAC,EAAE,MAAM,EACZ,UAAU,CAAC,EAAE,SAAS,EAAE,GACvB,OAAO,CAAC,SAAS,CAAC,CAkBpB;IAED;;OAEG;IACG,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOjE;IAED;;OAEG;IACG,eAAe,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS1F;IAED;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,EAAE,CAAC;QAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CASzF;IAED;;OAEG;IACG,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAQzF;IAED;;OAEG;IACG,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAOrF;IAED;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAOrC;IAMD;;;;;;;;;;;;;;;OAeG;IACG,MAAM,CACV,MAAM,EAAE,YAAY,EAAE,EACtB,MAAM,EAAE,WAAW,EACnB,UAAU,CAAC,EAAE,kBAAkB,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CAgF9B;YAEa,aAAa;IAyB3B;;;;;;OAMG;YACW,YAAY;IAmB1B,wDAAwD;IAClD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CA0B3B;IAMD;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAcxB,OAAO,CAAC,OAAO;YAID,WAAW;IAmCzB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,UAAU;IAIlB,wEAAwE;IACxE,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,aAAa;IA4ErB,OAAO,CAAC,YAAY;IA6DpB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IA+CvB,OAAO,CAAC,YAAY;IASpB,6EAA6E;IAC7E,OAAO,CAAC,eAAe,CAAmC;IAG1D,OAAO,CAAC,OAAO,CAOiD;IAEhE,OAAO,CAAC,YAAY;YAIN,uBAAuB;IA0BrC;;;;;;;;;;;;;;;OAeG;YACW,iBAAiB;YA8BjB,eAAe;YA8Cf,qBAAqB;CAqEpC;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAEtD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CAEzE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CAEzE"}
+{"version":3,"file":"acp-session.d.ts","sourceRoot":"","sources":["../../src/client/acp-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAmB,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEvF,OAAO,EAEL,KAAK,+BAA+B,EACrC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,UAAU,EAEf,KAAK,cAAc,EAEnB,KAAK,QAAQ,EACb,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAC;AAGzB,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,sCAAsC;IACtC,gBAAgB,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAChD,wCAAwC;IACxC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,uDAAuD;IACvD,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,mDAAmD;IACnD,uBAAuB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC;CACtC;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC5B,MAAM,EAAE,cAAc,CAAC;IACvB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CAChD;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,UAAU,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAC;IACjF,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC;IAC/B,kEAAkE;IAClE,SAAS,EAAE,mBAAmB,EAAE,CAAC;IACjC,+CAA+C;IAC/C,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;AAEnE,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,EAAE,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;KAAE,CAAA;CAAE,GACtF;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAE9C,MAAM,MAAM,mBAAmB,GAC3B,cAAc,GACd,aAAa,GACb,gBAAgB,GAChB,uBAAuB,GACvB,eAAe,GACf,aAAa,GACb,eAAe,GACf,SAAS,GACT,QAAQ,GACR,YAAY,GACZ,wBAAwB,CAAC;AAE7B,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,SAAkB,KAAK,EAAE,OAAO,CAAC;IACjC,YAAY,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAKtE;CACF;AA2BD,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;IACxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;IACpD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoB;IAEzC,OAAO,CAAC,KAAK,CAAiB;IAC9B,OAAO,CAAC,SAAS,CAA0B;IAC3C,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8C;IACtE,OAAO,CAAC,MAAM,CAAK;IACnB,0CAA0C;IAC1C,OAAO,CAAC,MAAM,CAAS;IAGvB,OAAO,CAAC,iBAAiB,CAAyB;IAClD,OAAO,CAAC,SAAS,CAA8E;IAC/F,OAAO,CAAC,WAAW,CAAoB;IACvC,oEAAoE;IACpE,OAAO,CAAC,iBAAiB,CAAgC;IAEzD,OAAO,eAoBN;IAMD,uDAAuD;IACvD,eAAe,IAAI,iBAAiB,CAEnC;IAED,sDAAsD;IACtD,cAAc,IAAI,UAAU,EAAE,CAE7B;IAED,yDAAyD;IACzD,YAAY,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAEnF;IAED,oEAAoE;IACpE,YAAY,IAAI,OAAO,CAEtB;IAED,yCAAyC;IACzC,YAAY,IAAI,SAAS,GAAG,IAAI,CAE/B;IAED,qDAAqD;IACrD,oBAAoB,IAAI,MAAM,CAE7B;IAMD;;;OAGG;IACH,OAAa,KAAK,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CAW/D;IAED;;;;;OAKG;IACH,OAAa,gBAAgB,CAC3B,MAAM,EAAE,+BAA+B,EACvC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,UAAU,CAAC,CAGrB;IAED;;;OAGG;IACH,OAAa,OAAO,CAClB,SAAS,EAAE,kBAAkB,EAC7B,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,UAAU,CAAC,CAErB;IAED,6EAA6E;mBACxD,MAAM;YAgCb,UAAU;IAkDxB;;;;;;OAMG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBlD;IAED;;;OAGG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAiB5B;IAMD;;;;;;;;;OASG;IACG,WAAW,CACf,SAAS,EAAE,SAAS,EACpB,UAAU,CAAC,EAAE,SAAS,EAAE,EACxB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CA2Bf;IAED;;;;;;;;OAQG;IACG,aAAa,CACjB,SAAS,EAAE,SAAS,EACpB,UAAU,CAAC,EAAE,SAAS,EAAE,EACxB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAyBf;IAED;;;;OAIG;IACG,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC,CAwBvH;IAED;;;;OAIG;IACG,aAAa,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBvD;IAED;;OAEG;IACG,WAAW,CACf,eAAe,EAAE,SAAS,EAC1B,GAAG,CAAC,EAAE,MAAM,EACZ,UAAU,CAAC,EAAE,SAAS,EAAE,GACvB,OAAO,CAAC,SAAS,CAAC,CAkBpB;IAED;;OAEG;IACG,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOjE;IAED;;OAEG;IACG,eAAe,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS1F;IAED;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,EAAE,CAAC;QAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CASzF;IAED;;OAEG;IACG,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAQzF;IAED;;OAEG;IACG,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAOrF;IAED;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAOrC;IAMD;;;;;;;;;;;;;;;OAeG;IACG,MAAM,CACV,MAAM,EAAE,YAAY,EAAE,EACtB,MAAM,EAAE,WAAW,EACnB,UAAU,CAAC,EAAE,kBAAkB,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CAgF9B;YAEa,aAAa;IAyB3B;;;;;;OAMG;YACW,YAAY;IAmB1B,wDAAwD;IAClD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CA0B3B;IAMD;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAcxB,OAAO,CAAC,OAAO;YAID,WAAW;IAmCzB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,UAAU;IAIlB,wEAAwE;IACxE,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,aAAa;IA4ErB,OAAO,CAAC,YAAY;IA6DpB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IA+CvB,OAAO,CAAC,YAAY;IASpB,6EAA6E;IAC7E,OAAO,CAAC,eAAe,CAAmC;IAG1D,OAAO,CAAC,OAAO,CAOiD;IAEhE,OAAO,CAAC,YAAY;YAIN,uBAAuB;IA0BrC;;;;;;;;;;;;;;;;OAgBG;YACW,iBAAiB;YAgCjB,eAAe;YA+Cf,qBAAqB;CAsEpC;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAEtD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CAEzE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CAEzE"}

package/dist/client/permission.d.ts

@@ -25,14 +25,18 @@ export type PermissionPolicy = (req: PermissionRequest) => Promise<RequestPermis
  * the Director fan-out) work without a human in the loop. Interactive
  * surfaces (TUI/WebUI) MUST inject a policy that surfaces the request to
  * the user — pass `permissionPolicy` to `ACPSession` / the subagent runner.
- * For untrusted agents prefer {@link readOnlyPermissionPolicy}.
+ *
+ * NOTE: This is NO LONGER the default for `ACPSession` — the session now
+ * defaults to {@link readOnlyPermissionPolicy} (safe-by-default). Pass this
+ * policy explicitly when the agent is trusted and needs write/execute access.
  */
 export declare const defaultPermissionPolicy: PermissionPolicy;
 /**
  * Safe-by-default policy: auto-approve only side-effect-free tool calls
  * (read/search/fetch/think); reject anything that would write files or
- * run commands. Use this when driving an untrusted external agent and no
- * interactive surface is available to ask the user.
+ * run commands. This is the DEFAULT policy for `ACPSession` when no
+ * `permissionPolicy` is provided. Pass {@link defaultPermissionPolicy}
+ * explicitly when the agent is trusted and needs write/execute access.
  */
 export declare const readOnlyPermissionPolicy: PermissionPolicy;
 /**

package/dist/client/permission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../../src/client/permission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EACV,gBAAgB,EAChB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,oBAAoB,CAAC;AAE5B,4CAA4C;AAC5C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,0BAA0B,CAAC;IACrC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACrC,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,+DAA+D;AAC/D,MAAM,MAAM,gBAAgB,GAAG,CAC7B,GAAG,EAAE,iBAAiB,KACnB,OAAO,CAAC,wBAAwB,CAAC,CAAC;AAgDvC;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,EAAE,gBAGrC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAE,gBAOtC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAC7D,gBAAgB,CAMlB"}
+{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../../src/client/permission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EACV,gBAAgB,EAChB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,oBAAoB,CAAC;AAE5B,4CAA4C;AAC5C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,0BAA0B,CAAC;IACrC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACrC,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,+DAA+D;AAC/D,MAAM,MAAM,gBAAgB,GAAG,CAC7B,GAAG,EAAE,iBAAiB,KACnB,OAAO,CAAC,wBAAwB,CAAC,CAAC;AAgDvC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,gBAGrC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,gBAOtC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAC7D,gBAAgB,CAMlB"}

package/dist/client.js

@@ -842,7 +842,7 @@ var ACPSession = class _ACPSession {
       termOpts.outputByteLimit = opts.terminalOutputByteLimit;
     }
     this.terminalServer = new TerminalServer(termOpts);
-    this.permissionPolicy = opts.permissionPolicy ?? defaultPermissionPolicy;
+    this.permissionPolicy = opts.permissionPolicy ?? readOnlyPermissionPolicy;
   }
   // ──────────────────────────────────────────────────────────────────────
   // Public accessors
@@ -1657,11 +1657,12 @@ var ACPSession = class _ACPSession {
    * closing the gap where the agent simply skips the voluntary permission
    * request and sends the privileged callback directly.
    *
-   * Uses the session's permission policy. The default policy
-   * (`defaultPermissionPolicy`) auto-approves everything — this is correct
-   * for trusted local agents (CLI `acp spawn`, Director fan-out). For
-   * untrusted/remote agents, the host should inject
-   * `readOnlyPermissionPolicy` or an interactive policy.
+   * Uses the session's permission policy. The default
+   * (`readOnlyPermissionPolicy`) auto-approves only side-effect-free tool
+   * calls (read/search/fetch/think) and rejects everything else — this is
+   * the safe-by-default posture. For trusted local agents (CLI `acp spawn`,
+   * Director fan-out), inject `defaultPermissionPolicy` to grant
+   * write/execute access.
    *
    * Returns true if the callback is authorized, false if denied.
    */
@@ -1673,7 +1674,8 @@ var ACPSession = class _ACPSession {
           toolCallId: partial.toolCallId,
           title: partial.title,
           kind: partial.kind,
-          status: "pending"
+          status: "pending",
+          ...partial.rawInput ? { rawInput: partial.rawInput } : {}
         },
         options: [
           { optionId: "allow", name: "Allow", kind: "allow_once" },
@@ -1698,7 +1700,8 @@ var ACPSession = class _ACPSession {
       const allowed = await this.authorizeCallback({
         toolCallId: `acp-fs-write-${id}`,
         title: `Write file: ${params.path}`,
-        kind: "edit"
+        kind: "edit",
+        rawInput: { path: params.path, sessionId: params.sessionId }
       });
       if (!allowed) {
         await this.sendErrorResponse(id, -32602, "filesystem write denied by permission policy");
@@ -1736,7 +1739,8 @@ var ACPSession = class _ACPSession {
           const allowed = await this.authorizeCallback({
             toolCallId: `acp-terminal-create-${id}`,
             title: `Run command: ${String(params.command ?? "")} ${(Array.isArray(params.args) ? params.args : []).join(" ")}`.trim(),
-            kind: "execute"
+            kind: "execute",
+            rawInput: { command: params.command, args: params.args, cwd: params.cwd, sessionId: params.sessionId }
           });
           if (!allowed) {
             await this.sendErrorResponse(id, -32602, "terminal create denied by permission policy");