@wrongstack/core 0.257.0 → 0.260.0

package/dist/{secret-vault-gxtFZYBt.d.ts → secret-vault-CDvDYXWX.d.ts}

@@ -1,4 +1,4 @@
-import { S as SecretScrubber } from './permission-CwBBpCoF.js';
+import { S as SecretScrubber } from './permission-BJ7eO9Vl.js';
 import { L as Logger } from './logger-B63L5bTg.js';
 import { S as SecretVault } from './secret-vault-BJDY28ev.js';
 

package/dist/security/index.d.ts

@@ -1,7 +1,7 @@
-export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-vault-gxtFZYBt.js';
-export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-B8rSu908.js';
-import '../permission-CwBBpCoF.js';
-import '../context-CGdgA0q6.js';
+export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-vault-CDvDYXWX.js';
+export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-DEXOfnpm.js';
+import '../permission-BJ7eO9Vl.js';
+import '../context-JFOVvu6z.js';
 import '../logger-B63L5bTg.js';
 import '../secret-vault-BJDY28ev.js';
 import '../input-reader-E-ffP2ee.js';

package/dist/security/index.js

@@ -1041,7 +1041,16 @@ var DefaultPermissionPolicy = class {
         };
       }
     }
-    if (tool.permission === "auto" && !tool.mutating) {
+    const hasWriteCap = hasCapability(tool, ToolCapabilities.FS_WRITE);
+    const hasShellCap = hasCapability(tool, [
+      ToolCapabilities.SHELL_ARBITRARY,
+      ToolCapabilities.SHELL_RESTRICTED
+    ]);
+    const hasInstallCap = hasCapability(tool, ToolCapabilities.PACKAGE_INSTALL);
+    const hasConfigCap = hasCapability(tool, ToolCapabilities.CONFIG_MUTATE);
+    const hasSubagentCap = hasCapability(tool, ToolCapabilities.SUBAGENT_SPAWN);
+    const isMutating = tool.mutating || hasWriteCap || hasShellCap || hasInstallCap || hasConfigCap || hasSubagentCap;
+    if (tool.permission === "auto" && !isMutating) {
       const decision = { permission: "auto", source: "default" };
       this._evalCache.set(cacheKey, decision);
       return decision;
@@ -1060,7 +1069,27 @@ var DefaultPermissionPolicy = class {
     }
     return { permission: "confirm", source: "default" };
   }
+  // Capability-based destructive check (preferred over name-based)
+  isDestructiveByCapability(tool) {
+    const caps = tool.capabilities ?? [];
+    if (caps.includes("shell.arbitrary")) return true;
+    if (caps.includes("fs.write")) return true;
+    if (caps.includes("fs.write.outside-project")) return true;
+    return false;
+  }
   isDestructiveYoloCall(tool, input, ctx) {
+    if (this.isDestructiveByCapability(tool)) {
+      if (tool.name === "bash") {
+        const command = getInputString(input, "command");
+        return command ? isClearlyDestructiveBashCommand(command, ctx.projectRoot) : true;
+      }
+      if (tool.name === "write" || tool.name === "edit" || tool.name === "replace" || tool.name === "patch") {
+        const targetPath = getInputString(input, "path") ?? getInputString(input, "file");
+        if (!targetPath || !ctx.projectRoot) return false;
+        return !pathLooksInsideProject(targetPath, ctx.projectRoot);
+      }
+      return true;
+    }
     if (tool.name === "bash") {
       const command = getInputString(input, "command");
       return command ? isClearlyDestructiveBashCommand(command, ctx.projectRoot) : true;