@yagni-app/code-staging 1.0.6-staging.1244.1 → 1.0.6-staging.1245.1

package/dist/extension/index.js

@@ -1,4 +1,6 @@
 import { createHash } from "node:crypto";
+import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 import { Text } from "@earendil-works/pi-tui";
 import { DEFAULT_ADVISOR_LIMITS, formatAdvisorSubtotal, makeAdvisorState } from "./advisor.js";
 import { makeChildUsageState } from "./childUsage.js";
@@ -35,6 +37,7 @@ import { registerGoCommand } from "./pipeline/goCommand.js";
 import { registerGoCompareCommand } from "./pipeline/goCompareCommand.js";
 import { DEFAULT_PERMISSION_POLICY, createModeHolder, registerPermissionGate } from "./permission/gate.js";
 import { loadHooksConfig, makeHookRunner, registerHooks } from "./hooks.js";
+import { loadPermissionRules } from "./permissionRules/loadConfig.js";
 import { registerSubagents } from "./subagents.js";
 import { createUltraHolder, registerUltraCommand } from "./ultra.js";
 import { registerTodos } from "./todos.js";
@@ -334,6 +337,8 @@ export async function registerYagni(pi, deps = {}) {
         // The static queue only carries non-connectivity notices (e.g. the
         // `.mcp.json` approval prompt), which stay one-shot.
         let connectivityNoticesFlushed = false;
+        // permission-rule notices are one-shot like connectivity notices.
+        let rulesNoticesFlushed = false;
         pi.on("after_provider_response", (_event, ctx) => {
             try {
                 if (!ctx.hasUI)
@@ -347,6 +352,21 @@ export async function registerYagni(pi, deps = {}) {
                 while (mcpApprovalNotices.length > 0) {
                     ctx.ui.notify(mcpApprovalNotices.shift(), "info");
                 }
+                // one-shot permission-rule config warnings (bad files,
+                // never-consulted tools). One consolidated line, never a wall.
+                if (!rulesNoticesFlushed) {
+                    rulesNoticesFlushed = true;
+                    const parts = [];
+                    if (loadedRules.diagnostics.warnings.length > 0) {
+                        parts.push(`${loadedRules.diagnostics.warnings.length} permission-rule config warning(s)`);
+                    }
+                    if (loadedRules.diagnostics.neverConsultedTools.length > 0) {
+                        parts.push(`rules for unknown tools: ${loadedRules.diagnostics.neverConsultedTools.join(", ")} (ignored)`);
+                    }
+                    if (parts.length > 0) {
+                        ctx.ui.notify(`Permission rules: ${parts.join(" · ")}`, "warning");
+                    }
+                }
             }
             catch {
                 // A notice must never break a turn.
@@ -408,6 +428,25 @@ export async function registerYagni(pi, deps = {}) {
     // the startup load is the trust boundary; live reload was reviewed and
     // rejected as a same-session self-authorization path, PR #1698).
     const sessionGrants = evalMode ? [] : loadGrants();
+    // settings-based permission rules, loaded once at startup (same
+    // trust-boundary posture as grants: no mid-session reload). User config
+    // (~/.yagni-code/config.json) + project config (.yagni-code/config.json);
+    // project allow rules are trust-gated at evaluation time, deny/ask always.
+    const loadedRules = evalMode
+        ? { rules: [], diagnostics: { warnings: [], neverConsultedTools: [] } }
+        : loadPermissionRules({ cwd: process.cwd() });
+    for (const w of loadedRules.diagnostics.warnings) {
+        logEvent({ source: "permission-rules", level: "warn", event: "config_warning", fields: { warning: w } });
+    }
+    if (loadedRules.diagnostics.neverConsultedTools.length > 0) {
+        logEvent({
+            source: "permission-rules",
+            level: "warn",
+            event: "never_consulted_tools",
+            fields: { tools: loadedRules.diagnostics.neverConsultedTools.join(", ") },
+        });
+    }
+    const rulesStateHome = codeStateHome(null, env);
     const GUARDIAN_EVENT_TIMEOUT_MS = 5_000;
     // YAG-506: load user-configurable lifecycle hooks config and create the
     // hook runner for the permission gate. Skipped in eval mode.
@@ -420,6 +459,27 @@ export async function registerYagni(pi, deps = {}) {
         guardianState,
         guardianLimits,
         guardianTier,
+        ...(loadedRules.rules.length > 0
+            ? {
+                permissionRules: loadedRules.rules,
+                rulesUserStateHome: rulesStateHome,
+                rulesProjectRoot: process.cwd(),
+                onRuleVerdict: (ev) => {
+                    logEvent({
+                        source: "permission-rules",
+                        level: "debug",
+                        event: `rule_${ev.verdict}`,
+                        sessionId: env.YAGNI_SESSION_ID ?? undefined,
+                        fields: {
+                            tool: ev.toolName,
+                            via: ev.matchedVia,
+                            source: ev.rule.source,
+                            rule: ev.rule.raw,
+                        },
+                    });
+                },
+            }
+            : {}),
         guardianDisabled,
         childUsage,
         guardianReview: (command, deps) => reviewCommand(command, { ...deps, modelTier: guardianTier }),
@@ -471,6 +531,45 @@ export async function registerYagni(pi, deps = {}) {
             if (!evalMode)
                 appendGrant(grant);
         },
+        // persist a user-level allow rule (Guardian ask dialog's third
+        // option). Atomic write, never overwrites other keys, fail-soft.
+        persistUserRule: (ruleString) => {
+            if (evalMode)
+                return;
+            try {
+                const userPath = join(rulesStateHome, "config.json");
+                let parsed = {};
+                if (existsSync(userPath)) {
+                    parsed = JSON.parse(readFileSync(userPath, "utf-8"));
+                    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+                        return;
+                }
+                const perms = (parsed.permissions ?? {});
+                const allow = Array.isArray(perms.allow) ? perms.allow : [];
+                if (!allow.includes(ruleString))
+                    allow.push(ruleString);
+                perms.allow = allow;
+                parsed.permissions = perms;
+                const tmp = join(rulesStateHome, `.config.json.yagni-${process.pid}-${Date.now()}.tmp`);
+                writeFileSync(tmp, `${JSON.stringify(parsed, null, 2)}\n`, { mode: 0o600 });
+                renameSync(tmp, userPath);
+                logEvent({
+                    source: "permission-rules",
+                    level: "info",
+                    event: "user_rule_saved",
+                    sessionId: env.YAGNI_SESSION_ID ?? undefined,
+                    fields: { rule: ruleString },
+                });
+            }
+            catch (err) {
+                logEvent({
+                    source: "permission-rules",
+                    level: "warn",
+                    event: "user_rule_save_failed",
+                    fields: { message: err instanceof Error ? err.message : "unknown" },
+                });
+            }
+        },
         // Opt-in storage stream (YAG-510). Tier decides what leaves the machine:
         // "off" → nothing (not even sent); "hash" → sha256 + family prefix +
         // metadata, no command content; "raw" → adds client-REDACTED command and

package/dist/extension/permission/gate.d.ts

@@ -94,6 +94,33 @@ export interface GateDecision {
      */
     classifyJustification?: string;
 }
+/**
+ * What the hard floors say about an ALLOW-rule verdict — the three invariants
+ * that outrank any user/project permission rule. Extracted from the inline
+ * allow path so the gate reads linearly and the floors are directly testable.
+ * PURE — no I/O, no session state:
+ *
+ *   "allow"   no floor applies — the rule's allow short-circuits everything
+ *   "block"   the exec-policy forbidden band holds despite the allow rule
+ *   "confirm" alwaysConfirmTools keeps its fresh-consent contract
+ *   "hold"    plan mode's no-mutation contract outranks the allow rule —
+ *             fall through to the normal plan-mode gate
+ *
+ * Order is deliberate: plan-mode first (its outcome routes to the EXISTING
+ * plan-mode machinery, not a bespoke block); then the terminal forbidden-band
+ * block; then the confirm deferral.
+ */
+export type AllowRuleFloorOutcome = {
+    kind: "allow";
+} | {
+    kind: "block";
+    reason: string;
+} | {
+    kind: "confirm";
+} | {
+    kind: "hold";
+};
+export declare function allowRuleFloorVerdict(toolName: string, params: Record<string, unknown>, mode: PermissionMode, policy: PermissionPolicy): AllowRuleFloorOutcome;
 /**
  * Pure permission decision for one tool call under a mode + policy. Auto allows
  * ordinary tools; plan blocks the write/exec set; review marks writes for confirmation
@@ -187,12 +214,38 @@ export interface RegisterPermissionDeps {
     /** Persist a new grant (fire-and-forget; the in-memory list is updated
      * either way). index.ts wires approvedPrefixes.appendGrant. */
     persistGrant?: (grant: ApprovedPrefixGrant) => void;
+    /**
+     * persist a user-level permission rule string (e.g.
+     * `Bash(git push:*)`) into ~/.yagni-code/config.json permissions.allow.
+     * Wired by index.ts; offered as a third option on Guardian ask dialogs.
+     * Fail-soft: the in-session approval applies even if the write fails.
+     */
+    persistUserRule?: (ruleString: string) => void;
     /**
      * Called (fire-and-forget) at every terminal prompt-band outcome with the
      * rich storage event (raw command — the wiring layer redacts/hashes).
      * Fail-soft; never blocks.
      */
     onGuardianEvent?: (event: GuardianGateEvent) => void;
+    /**
+     * settings-based permission rules (user + project config.json).
+     * When present, evaluated at the TOP of the tool_call handler, before
+     * hooks: deny → ask → allow, first match wins. Deny/ask are final; allow
+     * short-circuits the Guardian but can never lift the exec-policy forbidden
+     * band or the alwaysConfirmTools contract (both re-checked below).
+     */
+    permissionRules?: readonly import("../permissionRules/loadConfig.js").PermissionRule[];
+    /** ~/.yagni-code — the user `/`-anchor base for path rules. */
+    rulesUserStateHome?: string;
+    /** Project root for project-source `/`-anchored path rules; null outside a repo. */
+    rulesProjectRoot?: string | null;
+    /** Overrides ~ expansion for path rules (tests). */
+    rulesHomeDir?: string;
+    /** Called (fire-and-soft) after every rule verdict for debug logging. */
+    onRuleVerdict?: (event: import("../permissionRules/engine.js").RuleEvaluation & {
+        toolName: string;
+        cwd: string;
+    }) => void;
     /**
      * User-configurable lifecycle hooks (YAG-506). When present, PreToolUse
      * hooks run before decideGate and can short-circuit (allow/deny/ask),

package/dist/extension/permission/gate.js

@@ -27,8 +27,10 @@
  * the context so the model doesn't keep believing it is restricted.
  */
 import { describePrefix, matchesGrant, validateGrant, } from "./approvedPrefixes.js";
+import { logEvent } from "../errorSink.js";
 import { makeBlessStore as defaultMakeBlessStore } from "../bless.js";
 import { classifyCommand, DEFAULT_EXEC_POLICY } from "./execPolicy.js";
+import { evaluateRules } from "../permissionRules/engine.js";
 import { isDebug } from "../diagnostics.js";
 import { buildDiagnosticEvent, checkCircuitBreaker, DEFAULT_GUARDIAN_LIMITS, } from "./guardian.js";
 export function createModeHolder(initial = "auto") {
@@ -49,6 +51,52 @@ export const DEFAULT_PERMISSION_POLICY = {
     reviewConfirmTools: ["write", "edit", "bash", "file_ticket", "update_ticket_status"],
     alwaysConfirmTools: ["file_ticket", "update_ticket_status"],
 };
+export function allowRuleFloorVerdict(toolName, params, mode, policy) {
+    // Floor 0 — plan mode: the mode's contract (no mutations without Guardian
+    // review; grants are already skipped in plan) applies BEFORE any allow
+    // rule. Side-effect tools route to the existing plan-mode gate below; a
+    // non-side-effect tool (read/grep/ask_yagni/…) allows — plan mode never
+    // held reads. Deny/ask rules fired before this point (they only restrict).
+    if (mode === "plan" && sideEffectToolsFor(policy).has(toolName)) {
+        return { kind: "hold" };
+    }
+    // Floor 1 — the exec-policy forbidden band (bash only). An allow rule can
+    // never un-forbid a destructive command.
+    if (toolName === "bash") {
+        const cmdRaw = params.command;
+        const command = typeof cmdRaw === "string" ? cmdRaw.trim() : "";
+        if (command) {
+            try {
+                const execPolicy = policy.execPolicy ?? DEFAULT_EXEC_POLICY;
+                const classification = classifyCommand(command, execPolicy);
+                if (classification.decision === "forbidden") {
+                    return {
+                        kind: "block",
+                        reason: `${classification.justification}. Do not attempt the same outcome via a workaround or indirect execution — use a materially safer alternative, or ask the user.`,
+                    };
+                }
+            }
+            catch {
+                // classifyCommand threw — no floor opinion from here (the normal gate
+                // path re-runs classification with its own fail-closed handling).
+            }
+        }
+    }
+    // Floor 2 — alwaysConfirmTools keeps its fresh-consent contract
+    // (file_ticket / update_ticket_status) in every mode.
+    if (policy.alwaysConfirmTools?.includes(toolName)) {
+        return { kind: "confirm" };
+    }
+    return { kind: "allow" };
+}
+/** The side-effect tool set for a policy (plan-mode hold decision). */
+function sideEffectToolsFor(policy) {
+    return new Set([
+        ...policy.planBlockTools,
+        ...policy.reviewConfirmTools,
+        ...(policy.alwaysConfirmTools ?? []),
+    ]);
+}
 /**
  * Pure permission decision for one tool call under a mode + policy. Auto allows
  * ordinary tools; plan blocks the write/exec set; review marks writes for confirmation
@@ -300,6 +348,8 @@ export function registerPermissionGate(pi, deps = {}) {
     deps.modeHolder?.onSet((m) => {
         if (m !== mode)
             approvedCommands.clear();
+        if (m !== mode)
+            ruleAskApprovals.clear();
         mode = m;
     });
     // The session bless store is created lazily on the first tool_call (it needs
@@ -349,6 +399,23 @@ export function registerPermissionGate(pi, deps = {}) {
     // LRU-capped, cleared on every /mode transition.
     const APPROVED_CACHE_MAX = 50;
     const approvedCommands = new Map();
+    // Session cache for ASK-RULE approvals (the rules analog of the exact-command
+    // approval cache above): a user "yes" on a permission-rule ask covers an
+    // identical later (tool, rule, input) call for the rest of the session, so a
+    // retrying model cannot re-prompt the same question in a loop. Keyed by
+    // tool + rule raw + the primary input param; cleared with the other caches
+    // on every /mode transition (mode changes re-ask — the safe direction).
+    const ruleAskApprovals = new Map();
+    const ruleAskKey = (toolName, ruleRaw, params) => {
+        const primary = typeof params.command === "string"
+            ? params.command
+            : typeof params.path === "string"
+                ? params.path
+                : typeof params.url === "string"
+                    ? params.url
+                    : JSON.stringify(params);
+        return `${toolName}\u0000${ruleRaw}\u0000${primary}`;
+    };
     const cacheKey = (cwd, command) => `${cwd}\u0000${command}`;
     const rememberApproved = (cwd, command) => {
         const key = cacheKey(cwd, command);
@@ -419,6 +486,39 @@ export function registerPermissionGate(pi, deps = {}) {
             return "no";
         return ctx.signal?.aborted ? "aborted" : "dismissed";
     };
+    /**
+     * variant: the Guardian ask dialog with an optional third option
+     * (persist a user-level permission rule). Same semantics as askUser.
+     */
+    const askUserWithOptions = async (ctx, title, rememberLabel, ruleLabel) => {
+        if (ctx.signal?.aborted)
+            return "aborted";
+        const options = [
+            ASK_YES,
+            ...(rememberLabel ? [rememberLabel] : []),
+            ...(ruleLabel ? [ruleLabel] : []),
+            ASK_NO,
+        ];
+        let choice;
+        try {
+            choice = await ctx.ui.select(title, options, {
+                ...(ctx.signal ? { signal: ctx.signal } : {}),
+                timeout: ASK_TIMEOUT_MS,
+            });
+        }
+        catch {
+            choice = undefined;
+        }
+        if (choice === ASK_YES)
+            return "yes";
+        if (rememberLabel !== null && choice === rememberLabel)
+            return "remember";
+        if (ruleLabel !== null && choice === ruleLabel)
+            return "rule";
+        if (choice === ASK_NO)
+            return "no";
+        return ctx.signal?.aborted ? "aborted" : "dismissed";
+    };
     const buildAskTitle = (command, rationale, riskLevel) => {
         const risk = riskLevel ? ` (risk: ${riskLevel})` : "";
         return `Guardian asks${risk}\n${rationale}\n$ ${boundedCommand(command)}`;
@@ -427,8 +527,121 @@ export function registerPermissionGate(pi, deps = {}) {
         // Snapshot the mode ONCE: /mode can flip mid-await, and post-await reads
         // of the closure variable would disagree with the decision already made.
         const modeAtEntry = mode;
+        // set when an allow-rule verdict hits an alwaysConfirmTools tool
+        // (Floor 2) — forces the confirm flow below instead of short-circuiting.
+        let ruleAskConfirm = false;
         try {
             const input = event.input ?? {};
+            // settings permission rules run BEFORE hooks (Claude Code
+            // semantics: a deny rule blocks even when a hook would allow). Order
+            // deny → ask → allow; the verdict is final for deny/ask, and allow
+            // short-circuits everything below EXCEPT the two hard floors.
+            const rulesDeps = deps.permissionRules;
+            // The guard + evaluation share ONE try: a poisoned rules array can
+            // throw at the `.length` guard just as easily as inside evaluateRules,
+            // and both are engine errors — both must log engine_error and degrade
+            // to the normal gate, never escape to the outer fail-open catch.
+            let ruleVerdict = null;
+            try {
+                if (rulesDeps && rulesDeps.length > 0) {
+                    const cwd = ctx?.cwd ?? ".";
+                    ruleVerdict = evaluateRules(rulesDeps, {
+                        toolName: event.toolName,
+                        params: input,
+                        cwd,
+                        isProjectTrusted: (() => { try {
+                            return ctx?.isProjectTrusted() ?? true;
+                        }
+                        catch {
+                            return true;
+                        } })(),
+                        userStateHome: deps.rulesUserStateHome ?? cwd,
+                        projectRoot: deps.rulesProjectRoot ?? null,
+                        ...(deps.rulesHomeDir ? { homeDir: deps.rulesHomeDir } : {}),
+                    });
+                }
+            }
+            catch (err) {
+                // Fail-soft: a rule-engine error never blocks or allows — but it
+                // must not be SILENT: for a would-be deny this degrades to the
+                // normal gate (likely an allow), so the trail needs the failure.
+                // Error class only — never the thrown message (it can carry
+                // command content) or the user content.
+                logEvent({
+                    source: "permission-rules",
+                    level: "warn",
+                    event: "engine_error",
+                    fields: {
+                        tool: event.toolName,
+                        error: err instanceof Error ? err.constructor.name : typeof err,
+                    },
+                });
+            }
+            if (ruleVerdict) {
+                try {
+                    deps.onRuleVerdict?.({ ...ruleVerdict, toolName: event.toolName, cwd: ctx?.cwd ?? "." });
+                }
+                catch { /* logging must never affect the gate */ }
+                if (ruleVerdict.verdict === "deny") {
+                    const origin = ruleVerdict.rule.source === "project" ? "the project's settings" : "your user settings";
+                    return {
+                        block: true,
+                        reason: `${event.toolName} was denied by a permission rule in ${origin} (${ruleVerdict.rule.raw}). Do not attempt the same outcome via a workaround or indirect execution — ask the user to change the rule if this action is genuinely needed.`,
+                    };
+                }
+                if (ruleVerdict.verdict === "ask") {
+                    // Ask is final: nothing below may auto-allow it. With a UI, the
+                    // user arbitrates; headless (incl. /go children) fails closed.
+                    if (!ctx?.hasUI) {
+                        return {
+                            block: true,
+                            reason: `${event.toolName} requires user approval (permission rule ${ruleVerdict.rule.raw}); no UI available — the call was held.`,
+                        };
+                    }
+                    if (ctx.signal?.aborted)
+                        return { block: true };
+                    // Session approval cache: an identical (tool, rule, input) "yes"
+                    // earlier this session covers this call — a retrying model must
+                    // not re-prompt the same question (dialog-storm guard).
+                    const askKey = ruleAskKey(event.toolName, ruleVerdict.rule.raw, input);
+                    if (ruleAskApprovals.has(askKey))
+                        return {};
+                    const origin = ruleVerdict.rule.source === "project" ? "the project's settings" : "your user settings";
+                    const choice = await askUser(ctx, `Permission rule (ask) in ${origin}:\n${ruleVerdict.rule.raw}\nAllow ${event.toolName}?`, null);
+                    if (choice === "yes") {
+                        if (ruleAskApprovals.size > APPROVED_CACHE_MAX)
+                            ruleAskApprovals.clear();
+                        ruleAskApprovals.set(askKey, true);
+                        return {};
+                    }
+                    if (choice === "aborted")
+                        return { block: true };
+                    return {
+                        block: true,
+                        reason: `The user declined ${event.toolName} (permission rule ${ruleVerdict.rule.raw}). Ask what they would like to do differently, or take a different approach.`,
+                    };
+                }
+                // verdict === "allow": the floors decide whether the allow
+                // short-circuits. Linear by construction — allowRuleFloorVerdict
+                // owns the three invariants (plan-mode hold, forbidden band,
+                // alwaysConfirmTools confirm) and is unit-tested directly.
+                const floor = allowRuleFloorVerdict(event.toolName, input, modeAtEntry, effectivePolicy);
+                if (floor.kind === "block") {
+                    return { block: true, reason: floor.reason };
+                }
+                if (floor.kind === "confirm") {
+                    // Defer to the existing confirm flow via the ruleAskConfirm flag
+                    // (set below) — alwaysConfirmTools keeps its fresh-consent contract.
+                    ruleAskConfirm = true;
+                }
+                else if (floor.kind === "hold") {
+                    // Plan mode's no-mutation contract outranks the allow rule —
+                    // fall through to the normal plan-mode gate below.
+                }
+                else {
+                    return {};
+                }
+            }
             // YAG-506: PreToolUse hooks run BEFORE decideGate. They can short-circuit
             // (allow/deny/ask) or fall through to the normal gate logic. The result
             // is cached in preToolUseResult so the "ask" check below does NOT
@@ -681,12 +894,22 @@ export function registerPermissionGate(pi, deps = {}) {
                             }
                         }
                         // Offer "don't ask again" only when the grant would actually
-                        // cover this command (grant-time validation).
+                        // cover this command (grant-time validation). adds a
+                        // third option: persist a user-level permission rule (survives
+                        // across repos, unlike the repo-scoped grant) — offered only when
+                        // a grantCandidate also exists (the same prefix discipline; the
+                        // rule is the same pattern in settings form).
                         const grantCandidate = validateGrant(command, effectivePolicy.execPolicy ?? DEFAULT_EXEC_POLICY, resolveRepoKeyFor(cwd));
+                        const ruleCandidate = grantCandidate
+                            ? `Bash(${grantCandidate.pattern.join(" ")}:*)`
+                            : null;
                         const rememberLabel = grantCandidate
                             ? `Yes, and don't ask again for \`${describePrefix(grantCandidate.pattern)}\` in this repo`
                             : null;
-                        const resolution = await askUser(ctx, buildAskTitle(command, verdict.rationale, verdict.riskLevel), rememberLabel);
+                        const ruleLabel = grantCandidate && deps.persistUserRule
+                            ? `Yes, and always allow \`${grantCandidate.pattern.join(" ")}\` in my user settings`
+                            : null;
+                        const resolution = await askUserWithOptions(ctx, buildAskTitle(command, verdict.rationale, verdict.riskLevel), rememberLabel, ruleLabel);
                         if (resolution === "yes") {
                             rememberApproved(cwd, command);
                             emitGateEvent({
@@ -699,6 +922,44 @@ export function registerPermissionGate(pi, deps = {}) {
                             });
                             return {};
                         }
+                        if (resolution === "rule" && ruleCandidate && deps.persistUserRule) {
+                            let persisted = false;
+                            try {
+                                deps.persistUserRule(ruleCandidate);
+                                persisted = true;
+                                // Also covers this session like a grant would:
+                                rememberApproved(cwd, command);
+                            }
+                            catch (err) {
+                                // Fail-soft: the in-memory approval still applies THIS
+                                // session. But the user just made an explicit durable choice
+                                // in the dialog — a silent failure would leave them believing
+                                // a rule exists that will not survive restart. Log the
+                                // failure (rule string only, it is user-configured text, plus
+                                // error class — never the thrown message) and tell the user.
+                                logEvent({
+                                    source: "permission-rules",
+                                    level: "warn",
+                                    event: "user_rule_save_failed",
+                                    fields: {
+                                        rule: ruleCandidate,
+                                        error: err instanceof Error ? err.constructor.name : typeof err,
+                                    },
+                                });
+                                if (ctx?.hasUI) {
+                                    ctx.ui.notify(`Could not save the permission rule to your settings — it applies to this session only.`, "warning");
+                                }
+                            }
+                            emitGateEvent({
+                                ...eventBase,
+                                outcome: persisted ? "ask_approved_remembered" : "ask_approved",
+                                riskLevel: verdict.riskLevel,
+                                rationale: verdict.rationale,
+                                durationMs,
+                                consulted: true,
+                            });
+                            return {};
+                        }
                         if (resolution === "remember" && grantCandidate) {
                             const grantRecord = {
                                 ...grantCandidate,
@@ -823,6 +1084,11 @@ export function registerPermissionGate(pi, deps = {}) {
             if (preToolUseResult?.decision === "ask") {
                 decision = { block: false, confirm: true };
             }
+            // an allow-rule verdict on an alwaysConfirmTools tool forced
+            // the confirm flow (Floor 2 above) — same treatment as a hook "ask".
+            if (ruleAskConfirm) {
+                decision = { block: false, confirm: true };
+            }
             if (decision.confirm) {
                 // YAG-506: PermissionRequest hooks run before the confirm dialog.
                 if (hookRunner) {
@@ -937,6 +1203,7 @@ export function registerPermissionGate(pi, deps = {}) {
                 // A mode change is a trust-posture change: session ask-approvals do
                 // not carry across it (grants persist but are suppressed in review).
                 approvedCommands.clear();
+                ruleAskApprovals.clear();
             }
             mode = arg;
             paintMode(ctx);

package/dist/extension/permissionRules/bashFileArgs.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Curated bash command → file-operation table.
+ *
+ * The bridge that makes Read/Edit deny rules bite on bash commands: for a
+ * curated set of commands, extract the file paths they touch, classify each
+ * touch as read or write, and run those paths through the same path-rule
+ * engine. `cat .env`, `sed -i .env`, `cp .env x`, `echo x > .env` are all
+ * caught by a `Read(.env)`/`Edit(.env)` deny.
+ *
+ * Ported from Claude Code's BashTool/pathValidation.ts (PATH_EXTRACTORS +
+ * COMMAND_OPERATION_TYPE), adapted to shellParse tokens. Guardrails (same
+ * posture as Claude Code):
+ *   - unknown flags on commands where flags can change path meaning
+ *     (mv/cp --target-directory) → the command is NOT auto-analyzed; it
+ *     degrades to the caller's "ask" path, never silently allowed.
+ *   - glob arguments in write position → not analyzed (write globs bypass
+ *     checks in Claude Code; we degrade to ask).
+ *   - anything unextractable → no opinion; caller decides.
+ */
+export type FileOperation = "read" | "write";
+/** A command's opinion: extracted (op, paths) or needs-ask. */
+export type BashFileArgsResult = {
+    kind: "analyzed";
+    operation: FileOperation;
+    paths: string[];
+} | {
+    kind: "unknown";
+};
+/** Commands whose file paths we can extract confidently. */
+export declare const COMMAND_OPERATION: Record<string, FileOperation>;
+/**
+ * Analyze one bash SUBCOMMAND string. `kind: "unknown"` means no confident
+ * opinion — the caller degrades to ask for deny-evaluation purposes (never
+ * to silent allow).
+ */
+export declare function analyzeSubcommand(subcommand: string): BashFileArgsResult;
+/** Split a full command into subcommand strings (reuses shellRules' splitter). */
+export { splitSubcommands } from "./shellRules.js";
+//# sourceMappingURL=bashFileArgs.d.ts.map