@yagni-app/code 1.0.5 → 1.0.7

package/dist/extension/permission/guardian.d.ts

@@ -99,6 +99,14 @@ export interface CircuitBreakerResult {
     reason?: string;
 }
 export declare function checkCircuitBreaker(state: GuardianState, limits: GuardianLimits): CircuitBreakerResult;
+export interface ParsedVerdict {
+    verdict: GuardianVerdict;
+    /** True when the strict parse failed and the lenient repair ladder salvaged it. */
+    repaired: boolean;
+}
+export declare function parseVerdictDetailed(raw: string): ParsedVerdict | null;
+/** Strict-shaped convenience wrapper: the verdict, or null. Callers that need
+ * the repaired signal use {@link parseVerdictDetailed}. */
 export declare function parseVerdict(raw: string): GuardianVerdict | null;
 export declare function formatGuardianSubtotal(state: GuardianState, limits: GuardianLimits): string;
 export type GuardianError = "timeout" | "malformed" | "network" | "empty" | "aborted";
@@ -106,11 +114,17 @@ export interface ReviewResult {
     verdict: GuardianVerdict | null;
     error?: GuardianError;
     cost: number;
+    /** True when the verdict came from the lenient repair ladder (strict parse
+     * failed first). The verdict is real and flows through the normal
+     * allow/ask/deny handling; this flag only marks it for telemetry. */
+    repaired?: boolean;
     /**
      * Scrubbed + capped copy of the model output when the verdict failed to
-     * parse (`error: "malformed"`). Present so the sink can capture the exact
-     * failure shape. Never contains the raw command unredacted: `scrubSecrets`
-     * removes secret-shaped values before this is stored.
+     * parse (`error: "malformed"`), or of the pre-repair extracted block when
+     * the repair ladder salvaged it (`repaired: true`). Present so the sink can
+     * capture the exact failure shape either way. Never contains the raw
+     * command unredacted: `scrubSecrets` removes secret-shaped values before
+     * this is stored.
      */
     rawOutput?: string;
 }
@@ -152,14 +166,18 @@ export interface GuardianDiagnosticEvent {
     outcome: GuardianOutcome | GuardianError;
     durationMs?: number;
     tier?: string;
+    /** True when the lenient repair ladder salvaged a broken verdict — the
+     * outcome is still the REAL verdict (allow/ask/deny); this flag marks it
+     * for telemetry so repair hit-rate is measurable. */
+    repaired?: true;
     /** Debug-only: command hash for correlation (never the raw command). */
     commandHash?: string;
     /** Debug-only: the Guardian's rationale. */
     rationale?: string;
     /**
      * Scrubbed + capped copy of the unparseable model output, present only for
-     * `outcome: "malformed"`. Always-on (NOT debug-gated): it is already
-     * `scrubSecrets`-redacted and size-capped at the source.
+     * `outcome: "malformed"` or `repaired: true`. Always-on (NOT debug-gated):
+     * it is already `scrubSecrets`-redacted and size-capped at the source.
      */
     rawOutput?: string;
 }
@@ -170,6 +188,7 @@ export interface GuardianDiagnosticEvent {
 export declare function buildDiagnosticEvent(outcome: GuardianOutcome | GuardianError, opts: {
     durationMs?: number;
     tier?: string;
+    repaired?: boolean;
     rationale?: string;
     commandHash?: string;
     rawOutput?: string;

package/dist/extension/permission/guardian.js

@@ -128,33 +128,158 @@ export function checkCircuitBreaker(state, limits) {
     }
     return { tripped: false };
 }
-// --- Verdict parsing (fail closed on malformed) ---
-export function parseVerdict(raw) {
+const VALID_RISK_LEVELS = ["low", "medium", "high", "critical"];
+/** Validate an already-parsed object into a verdict. The SINGLE validation
+ * gate: strict and repaired parses both end here, so the enum checks stay
+ * exactly as strict after repair as before. */
+function validateVerdictObject(parsed) {
+    if (!parsed)
+        return null;
+    const outcome = parsed.outcome;
+    if (outcome !== "allow" && outcome !== "ask" && outcome !== "deny")
+        return null;
+    const riskLevel = parsed.riskLevel;
+    return {
+        outcome,
+        riskLevel: typeof riskLevel === "string" && VALID_RISK_LEVELS.includes(riskLevel)
+            ? riskLevel
+            : "medium",
+        rationale: typeof parsed.rationale === "string" && parsed.rationale.trim().length > 0
+            ? parsed.rationale.trim()
+            : "No rationale provided.",
+    };
+}
+/** Extract the first {...} block (efficient-tier models may wrap JSON in
+ * markdown fences despite instructions to output raw JSON). */
+function extractJsonBlock(raw) {
+    const jsonMatch = raw.match(/\{[\s\S]*\}/);
+    return jsonMatch ? jsonMatch[0] : raw;
+}
+/**
+ * The lenient repair ladder — applied ONLY after a strict `JSON.parse` of the
+ * extracted block has already thrown. Each rung fixes one observed model
+ * failure shape and immediately retries the strict parse; the ladder runs in
+ * cheapest-first order and the content-synthesizing re-quote is always LAST.
+ * Every rung is end-anchored or last-occurrence-anchored and linear-time.
+ * Returns the repaired JSON string (parsable) or null if no rung fits.
+ *
+ * Observed shapes (captured live on deepseek-v4-flash, all previously "unclear
+ * verdict"): illegal backslash escapes (\d written literally), a doubled
+ * closing quote, and unescaped quotes inside the rationale. The trailing
+ * comma is the most common LLM JSON slip in the wild, not (yet) observed here.
+ *
+ * What the ladder deliberately does NOT fix (all fail closed):
+ * single quotes as structure (ambiguous with English apostrophes), glued
+ * multi-object output (never pick one verdict of two), raw newlines inside
+ * strings (indistinguishable from legal pretty-printed whitespace without
+ * parsing), a broken prefix before the rationale anchor, and truncations.
+ */
+function repairVerdictJson(s) {
+    // The ladder is SEQUENTIAL: each rung transforms the previous result and
+    // immediately retries the strict parse. Composing matters — a blob can
+    // carry more than one failure shape (an illegal backslash escape AND a
+    // trailing comma, say), and each rung alone would leave the other broken.
+    let cur = s;
+    // Rung 1 — illegal backslash escapes (\d, \w, \( … become \\d). Legal JSON
+    // escapes (" \\ \/ b f n r t and \uXXXX) are left untouched by the lookahead.
+    const escapedBackslashes = cur.replace(/\\(?!["\\\/bfnrtu])/g, "\\\\");
+    if (escapedBackslashes !== cur) {
+        try {
+            JSON.parse(escapedBackslashes);
+            return escapedBackslashes;
+        }
+        catch {
+            cur = escapedBackslashes;
+        }
+    }
+    // Rung 2 — doubled closing quote before }: anchored to END so a doubled
+    // quote mid-rationale is untouched (the re-quote rung handles that shape).
+    const collapsedQuote = cur.replace(/""(\s*\})$/, '"$1');
+    if (collapsedQuote !== cur) {
+        try {
+            JSON.parse(collapsedQuote);
+            return collapsedQuote;
+        }
+        catch {
+            cur = collapsedQuote;
+        }
+    }
+    // Rung 3 — trailing comma before }: anchored to END so a comma inside a
+    // rationale value ("a, b") can never be stripped.
+    const strippedComma = cur.replace(/,(\s*\})$/, '$1');
+    if (strippedComma !== cur) {
+        try {
+            JSON.parse(strippedComma);
+            return strippedComma;
+        }
+        catch {
+            cur = strippedComma;
+        }
+    }
+    // Rung 4 (last resort, the only rung that synthesizes content) — re-quote
+    // the trailing rationale value. Applies only when the shape is
+    // {…"rationale":"<rest-to-end>}: the prefix before the anchor must carry no
+    // closing brace (rules out prose and glued multi-object output — an earlier
+    // sibling object always leaves a } behind), and the extracted rationale text
+    // must carry no braces either (rules out a glued TAIL). Every " and \ in the
+    // tail is escaped in ONE pass so whatever the model wrote inside the
+    // rationale becomes literal text. Anchor ambiguity resolves to the LAST
+    // "rationale":" occurrence; single pass, no loops.
+    const anchor = cur.lastIndexOf('"rationale":"');
+    if (anchor !== -1) {
+        const prefix = cur.slice(0, anchor);
+        const tail = cur.slice(anchor + '"rationale":"'.length);
+        // The tail must be the trailing value closing the object: non-empty
+        // content, an optional-whitespace + } at the very end.
+        const tailMatch = tail.match(/^(.+?)(\s*\})$/);
+        if (tailMatch && !prefix.includes("}")) {
+            const rawRationale = tailMatch[1].replace(/"+$/, "");
+            if (rawRationale.length > 0 &&
+                !rawRationale.includes("{") &&
+                !rawRationale.includes("}")) {
+                const reQuoted = prefix +
+                    '"rationale":"' +
+                    rawRationale.replace(/["\\]/g, "\\$&") +
+                    '"}';
+                try {
+                    JSON.parse(reQuoted);
+                    return reQuoted;
+                }
+                catch {
+                    /* fail closed */
+                }
+            }
+        }
+    }
+    return null;
+}
+export function parseVerdictDetailed(raw) {
+    const jsonStr = extractJsonBlock(raw);
     try {
-        // Efficient-tier models may wrap JSON in markdown fences despite
-        // instructions to output raw JSON. Extract the first {...} block.
-        const jsonMatch = raw.match(/\{[\s\S]*\}/);
-        const jsonStr = jsonMatch ? jsonMatch[0] : raw;
         const parsed = JSON.parse(jsonStr);
-        const outcome = parsed?.outcome;
-        if (outcome !== "allow" && outcome !== "ask" && outcome !== "deny")
-            return null;
-        const riskLevel = parsed.riskLevel;
-        const validLevels = ["low", "medium", "high", "critical"];
-        return {
-            outcome,
-            riskLevel: typeof riskLevel === "string" && validLevels.includes(riskLevel)
-                ? riskLevel
-                : "medium",
-            rationale: typeof parsed.rationale === "string" && parsed.rationale.trim().length > 0
-                ? parsed.rationale.trim()
-                : "No rationale provided.",
-        };
+        const verdict = validateVerdictObject(parsed);
+        return verdict ? { verdict, repaired: false } : null;
     }
     catch {
-        return null;
+        // Strict parse failed — try the repair ladder on the same extracted block.
+        const repairedJson = repairVerdictJson(jsonStr);
+        if (repairedJson === null)
+            return null;
+        try {
+            const parsed = JSON.parse(repairedJson);
+            const verdict = validateVerdictObject(parsed);
+            return verdict ? { verdict, repaired: true } : null;
+        }
+        catch {
+            return null;
+        }
     }
 }
+/** Strict-shaped convenience wrapper: the verdict, or null. Callers that need
+ * the repaired signal use {@link parseVerdictDetailed}. */
+export function parseVerdict(raw) {
+    return parseVerdictDetailed(raw)?.verdict ?? null;
+}
 // --- /cost subtotal ---
 export function formatGuardianSubtotal(state, limits) {
     if (state.reviews === 0)
@@ -236,8 +361,8 @@ export async function reviewCommand(command, deps) {
             }
             return { verdict: null, error: "empty", cost };
         }
-        const verdict = parseVerdict(output);
-        if (!verdict) {
+        const parsed = parseVerdictDetailed(output);
+        if (!parsed) {
             // Scrubbed + capped so the local sink and Sentry can see the exact
             // failure shape without carrying a raw command or a secret it echoed.
             return {
@@ -247,7 +372,19 @@ export async function reviewCommand(command, deps) {
                 rawOutput: scrubSecrets(output).slice(0, GUARDIAN_RAW_OUTPUT_CAP),
             };
         }
-        return { verdict, cost };
+        if (parsed.repaired) {
+            // The repair ladder salvaged a broken-but-salvageable verdict. The
+            // verdict is real (validation is exactly as strict as the happy path);
+            // capture the pre-repair shape so telemetry can keep watching what the
+            // model is still emitting wrong.
+            return {
+                verdict: parsed.verdict,
+                cost,
+                repaired: true,
+                rawOutput: scrubSecrets(output).slice(0, GUARDIAN_RAW_OUTPUT_CAP),
+            };
+        }
+        return { verdict: parsed.verdict, cost };
     }
     catch (err) {
         // Distinguish the caller aborting (user hit ESC — must NOT be treated as
@@ -275,6 +412,7 @@ export function buildDiagnosticEvent(outcome, opts) {
         outcome,
         ...(opts.durationMs !== undefined ? { durationMs: opts.durationMs } : {}),
         ...(opts.tier !== undefined ? { tier: opts.tier } : {}),
+        ...(opts.repaired ? { repaired: true } : {}),
         ...(opts.rawOutput !== undefined ? { rawOutput: opts.rawOutput } : {}),
     };
     if (opts.debug) {

package/dist/extension/permissionRules/bashFileArgs.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Curated bash command → file-operation table.
+ *
+ * The bridge that makes Read/Edit deny rules bite on bash commands: for a
+ * curated set of commands, extract the file paths they touch, classify each
+ * touch as read or write, and run those paths through the same path-rule
+ * engine. `cat .env`, `sed -i .env`, `cp .env x`, `echo x > .env` are all
+ * caught by a `Read(.env)`/`Edit(.env)` deny.
+ *
+ * Ported from Claude Code's BashTool/pathValidation.ts (PATH_EXTRACTORS +
+ * COMMAND_OPERATION_TYPE), adapted to shellParse tokens. Guardrails (same
+ * posture as Claude Code):
+ *   - unknown flags on commands where flags can change path meaning
+ *     (mv/cp --target-directory) → the command is NOT auto-analyzed; it
+ *     degrades to the caller's "ask" path, never silently allowed.
+ *   - glob arguments in write position → not analyzed (write globs bypass
+ *     checks in Claude Code; we degrade to ask).
+ *   - anything unextractable → no opinion; caller decides.
+ */
+export type FileOperation = "read" | "write";
+/** A command's opinion: extracted (op, paths) or needs-ask. */
+export type BashFileArgsResult = {
+    kind: "analyzed";
+    operation: FileOperation;
+    paths: string[];
+} | {
+    kind: "unknown";
+};
+/** Commands whose file paths we can extract confidently. */
+export declare const COMMAND_OPERATION: Record<string, FileOperation>;
+/**
+ * Analyze one bash SUBCOMMAND string. `kind: "unknown"` means no confident
+ * opinion — the caller degrades to ask for deny-evaluation purposes (never
+ * to silent allow).
+ */
+export declare function analyzeSubcommand(subcommand: string): BashFileArgsResult;
+/** Split a full command into subcommand strings (reuses shellRules' splitter). */
+export { splitSubcommands } from "./shellRules.js";
+//# sourceMappingURL=bashFileArgs.d.ts.map

package/dist/extension/permissionRules/bashFileArgs.js

@@ -0,0 +1,236 @@
+/**
+ * Curated bash command → file-operation table.
+ *
+ * The bridge that makes Read/Edit deny rules bite on bash commands: for a
+ * curated set of commands, extract the file paths they touch, classify each
+ * touch as read or write, and run those paths through the same path-rule
+ * engine. `cat .env`, `sed -i .env`, `cp .env x`, `echo x > .env` are all
+ * caught by a `Read(.env)`/`Edit(.env)` deny.
+ *
+ * Ported from Claude Code's BashTool/pathValidation.ts (PATH_EXTRACTORS +
+ * COMMAND_OPERATION_TYPE), adapted to shellParse tokens. Guardrails (same
+ * posture as Claude Code):
+ *   - unknown flags on commands where flags can change path meaning
+ *     (mv/cp --target-directory) → the command is NOT auto-analyzed; it
+ *     degrades to the caller's "ask" path, never silently allowed.
+ *   - glob arguments in write position → not analyzed (write globs bypass
+ *     checks in Claude Code; we degrade to ask).
+ *   - anything unextractable → no opinion; caller decides.
+ */
+import { shellParse } from "../permission/execPolicy.js";
+/** Commands whose file paths we can extract confidently. */
+export const COMMAND_OPERATION = {
+    // read-only
+    cat: "read", head: "read", tail: "read", sort: "read", uniq: "read",
+    wc: "read", cut: "read", paste: "read", column: "read", file: "read",
+    stat: "read", diff: "read", awk: "read", strings: "read", hexdump: "read",
+    od: "read", base64: "read", nl: "read", grep: "read", rg: "read",
+    sha256sum: "read", sha1sum: "read", md5sum: "read", jq: "read",
+    ls: "read", find: "read", git: "read",
+    // mutating on their targets
+    rm: "write", rmdir: "write", mv: "write", cp: "write", touch: "write",
+    mkdir: "write", sed: "write", tee: "write",
+};
+// --- token helpers (over shellParse output) ---
+function argTokens(command) {
+    const parsed = shellParse(command);
+    const tokens = [];
+    const redirects = [];
+    for (const t of parsed) {
+        if (typeof t === "string") {
+            tokens.push(t);
+        }
+        else if ("op" in t) {
+            if (t.op === "redirect" && t.direction === "out" && typeof t.target === "string") {
+                redirects.push(t.target);
+            }
+            else if (t.op !== "background") {
+                // substitution / in-redirect / background: can't analyze confidently
+                return null;
+            }
+        }
+    }
+    return { tokens, redirects };
+}
+/** Drop flag tokens, honoring `--` end-of-options (Claude's filterOutFlags). */
+function filterOutFlags(args) {
+    const out = [];
+    let afterDoubleDash = false;
+    for (const a of args) {
+        if (!afterDoubleDash && a === "--") {
+            afterDoubleDash = true;
+            continue;
+        }
+        if (!afterDoubleDash && a.startsWith("-"))
+            continue;
+        out.push(a);
+    }
+    return out;
+}
+/** Pattern-first commands (grep/rg/awk/sed-style): first positional is the pattern. */
+function patternCommandPaths(args, flagsWithValues, defaults) {
+    const out = [];
+    let skipNext = false;
+    let patternFound = false;
+    let afterDoubleDash = false;
+    for (const a of args) {
+        if (skipNext) {
+            skipNext = false;
+            continue;
+        }
+        if (!afterDoubleDash && a === "--") {
+            afterDoubleDash = true;
+            continue;
+        }
+        if (!afterDoubleDash && a.startsWith("-")) {
+            const flag = a.split("=")[0];
+            if (flagsWithValues.has(flag) && !a.includes("="))
+                skipNext = true;
+            continue;
+        }
+        if (!patternFound) {
+            patternFound = true;
+            continue;
+        }
+        out.push(a);
+    }
+    return out.length > 0 ? out : defaults;
+}
+const GREP_FLAGS = new Set(["-e", "--regexp", "-f", "--file", "--exclude", "--include", "--exclude-dir", "--include-dir", "-m", "--max-count", "-A", "--after-context", "-B", "--before-context", "-C", "--context"]);
+const RG_FLAGS = new Set(["-e", "--regexp", "-f", "--file", "-t", "--type", "-T", "--type-not", "-g", "--glob", "-m", "--max-count", "--max-depth", "-r", "--replace", "-A", "--after-context", "-B", "--before-context", "-C", "--context"]);
+// mv/cp validators: ANY flag → unknown (Claude blocks all flags for these —
+// --target-directory=PATH changes path meaning).
+function hasFlag(args) {
+    let afterDoubleDash = false;
+    for (const a of args) {
+        if (!afterDoubleDash && a === "--") {
+            afterDoubleDash = true;
+            continue;
+        }
+        if (!afterDoubleDash && a.startsWith("-") && a !== "-")
+            return true;
+    }
+    return false;
+}
+const GLOBISH = /[*?[]/;
+/**
+ * Analyze one bash SUBCOMMAND string. `kind: "unknown"` means no confident
+ * opinion — the caller degrades to ask for deny-evaluation purposes (never
+ * to silent allow).
+ */
+export function analyzeSubcommand(subcommand) {
+    const parsed = argTokens(subcommand);
+    if (!parsed || parsed.tokens.length === 0)
+        return { kind: "unknown" };
+    // Redirect targets are ALWAYS write access, regardless of the command
+    // being curated (Claude Code validates redirect targets independently of
+    // the command table). `echo x > .env` must not escape the .env deny.
+    if (parsed.redirects.length > 0) {
+        const [cmd, ...args] = parsed.tokens;
+        const operation = COMMAND_OPERATION[cmd];
+        const paths = operation
+            ? extractPaths(cmd, args)
+            : [];
+        if (paths === null)
+            return { kind: "unknown" };
+        const base = paths.filter((p) => p.length > 0);
+        if (operation === "write" && base.some((p) => GLOBISH.test(p)))
+            return { kind: "unknown" };
+        return { kind: "analyzed", operation: "write", paths: [...base, ...parsed.redirects] };
+    }
+    const [cmd, ...args] = parsed.tokens;
+    const operation = COMMAND_OPERATION[cmd];
+    if (!operation)
+        return { kind: "unknown" };
+    const paths = extractPaths(cmd, args);
+    if (paths === null)
+        return { kind: "unknown" };
+    if (operation === "write" && paths.some((p) => GLOBISH.test(p))) {
+        return { kind: "unknown" };
+    }
+    return { kind: "analyzed", operation, paths: paths.filter((p) => p.length > 0) };
+}
+function extractPaths(cmd, args) {
+    switch (cmd) {
+        case "grep":
+            return patternCommandPaths(args, GREP_FLAGS, []);
+        case "rg":
+            return patternCommandPaths(args, RG_FLAGS, ["."]);
+        case "ls": {
+            const out = filterOutFlags(args);
+            return out.length > 0 ? out : ["."];
+        }
+        case "find": {
+            // collect positionals until the first real flag
+            const out = [];
+            let hitFlag = false;
+            for (const a of args) {
+                if (a.startsWith("-")) {
+                    hitFlag = true;
+                    continue;
+                }
+                if (!hitFlag)
+                    out.push(a);
+            }
+            return out.length > 0 ? out : ["."];
+        }
+        case "git":
+            // Only `git diff --no-index` reaches arbitrary files outside the repo;
+            // other git subcommands are covered by the repo's own boundaries.
+            if (args[0] === "diff" && args.includes("--no-index")) {
+                return filterOutFlags(args.slice(1)).slice(0, 2);
+            }
+            return [];
+        case "sed": {
+            // -f FILE reads a script file; positionals after the script are files.
+            const out = [];
+            let skipNext = false;
+            let scriptFound = false;
+            let afterDoubleDash = false;
+            for (const a of args) {
+                if (skipNext) {
+                    skipNext = false;
+                    continue;
+                }
+                if (!afterDoubleDash && a === "--") {
+                    afterDoubleDash = true;
+                    continue;
+                }
+                if (!afterDoubleDash && a.startsWith("-")) {
+                    if (a === "-f" || a === "--file") {
+                        const f = args[args.indexOf(a) + 1];
+                        if (f)
+                            out.push(f);
+                        skipNext = true;
+                        scriptFound = true;
+                    }
+                    else if (a === "-e" || a === "--expression") {
+                        skipNext = true;
+                        scriptFound = true;
+                    }
+                    else if (a.includes("e") || a.includes("f")) {
+                        scriptFound = true;
+                    }
+                    continue;
+                }
+                if (!scriptFound) {
+                    scriptFound = true;
+                    continue;
+                }
+                out.push(a);
+            }
+            return out;
+        }
+        case "mv":
+        case "cp":
+            // ANY flag → unknown (--target-directory=PATH changes path meaning).
+            if (hasFlag(args))
+                return null;
+            return filterOutFlags(args);
+        default:
+            return filterOutFlags(args);
+    }
+}
+/** Split a full command into subcommand strings (reuses shellRules' splitter). */
+export { splitSubcommands } from "./shellRules.js";
+//# sourceMappingURL=bashFileArgs.js.map

package/dist/extension/permissionRules/engine.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Permission-rule evaluation engine.
+ *
+ * The single entry the gate calls BEFORE hooks/exec-policy/grants/Guardian:
+ *
+ *   evaluateRules(rules, { toolName, params, cwd, isProjectTrusted, ... })
+ *     → { verdict: "deny" | "ask" | "allow", rule } | null (no opinion)
+ *
+ * Evaluation order is Claude Code's: for each behavior in deny → ask → allow,
+ * find the first rule that matches the tool call. Deny/ask are FINAL from the
+ * gate's perspective (nothing downstream may override); allow short-circuits
+ * the Guardian but CANNOT lift the exec-policy forbidden band or the
+ * alwaysConfirmTools contract (those floors live in the gate wiring, which
+ * re-checks them after an allow verdict).
+ *
+ * Matching by tool:
+ *   - bash:            Bash(command-pattern): prefix, :* suffix, or * wildcards; compound split
+ *   - read/edit/write: Read(path)/Edit(path) — gitignore path patterns
+ *                      (read-class rules also consult grep/find/ls paths)
+ *   - web_fetch:       WebFetch(domain:pattern) — hostname globs
+ *   - others:          bare tool-name rules (and mcp__server / mcp__server__tool)
+ *
+ * Edit-class deny also applies to read access of the same path (Claude Code:
+ * a Read deny blocks Edit/Write on the path; an Edit deny blocks reads too —
+ * "edit access implies read access" cuts both ways for denies).
+ */
+import type { PermissionRule, RuleSource } from "./loadConfig.js";
+export type RuleVerdict = "deny" | "ask" | "allow";
+export interface RuleEvaluationContext {
+    toolName: string;
+    params: Record<string, unknown>;
+    cwd: string;
+    isProjectTrusted: boolean;
+    /** ~/.yagni-code (user `/`-anchor base). */
+    userStateHome: string;
+    /** Project root for project-source `/`-anchored patterns; null outside a repo. */
+    projectRoot: string | null;
+    /** Overrides ~ expansion (tests); defaults to os.homedir(). */
+    homeDir?: string;
+}
+export interface RuleEvaluation {
+    verdict: RuleVerdict;
+    rule: PermissionRule;
+    /** Which matcher produced the hit (verdict logs / deny messages). */
+    matchedVia: "tool_name" | "bash_pattern" | "path_pattern" | "domain_pattern" | "file_args";
+}
+export declare function evaluateRules(rules: readonly PermissionRule[], ctx: RuleEvaluationContext): RuleEvaluation | null;
+/** Parse a raw rule string into a sourced PermissionRule (loader/tests). */
+export declare function ruleFromRaw(raw: string, behavior: PermissionRule["behavior"], source: RuleSource): PermissionRule;
+//# sourceMappingURL=engine.d.ts.map