@yagni-app/code 1.0.5 → 1.0.7

package/dist/extension/permissionRules/engine.js

@@ -0,0 +1,238 @@
+/**
+ * Permission-rule evaluation engine.
+ *
+ * The single entry the gate calls BEFORE hooks/exec-policy/grants/Guardian:
+ *
+ *   evaluateRules(rules, { toolName, params, cwd, isProjectTrusted, ... })
+ *     → { verdict: "deny" | "ask" | "allow", rule } | null (no opinion)
+ *
+ * Evaluation order is Claude Code's: for each behavior in deny → ask → allow,
+ * find the first rule that matches the tool call. Deny/ask are FINAL from the
+ * gate's perspective (nothing downstream may override); allow short-circuits
+ * the Guardian but CANNOT lift the exec-policy forbidden band or the
+ * alwaysConfirmTools contract (those floors live in the gate wiring, which
+ * re-checks them after an allow verdict).
+ *
+ * Matching by tool:
+ *   - bash:            Bash(command-pattern): prefix, :* suffix, or * wildcards; compound split
+ *   - read/edit/write: Read(path)/Edit(path) — gitignore path patterns
+ *                      (read-class rules also consult grep/find/ls paths)
+ *   - web_fetch:       WebFetch(domain:pattern) — hostname globs
+ *   - others:          bare tool-name rules (and mcp__server / mcp__server__tool)
+ *
+ * Edit-class deny also applies to read access of the same path (Claude Code:
+ * a Read deny blocks Edit/Write on the path; an Edit deny blocks reads too —
+ * "edit access implies read access" cuts both ways for denies).
+ */
+import { mcpInfoFromString } from "../mcp/names.js";
+import { analyzeSubcommand, splitSubcommands } from "./bashFileArgs.js";
+import { effectiveRules } from "./loadConfig.js";
+import { pathClassForTool, pathMatches, resolvePatternRoot } from "./pathRules.js";
+import { parseRuleString } from "./parser.js";
+import { shellRuleMatches } from "./shellRules.js";
+// --- tool-name matching (Claude Code's toolMatchesRule, incl. MCP) ---
+function toolNameMatches(ruleTool, callTool) {
+    if (ruleTool === callTool)
+        return true;
+    if (ruleTool === "*")
+        return true;
+    // MCP: `mcp__server` matches every tool of that server; `mcp__server__tool`
+    // matches exactly; `mcp__server__*` is the glob form.
+    const ruleInfo = mcpInfoFromString(ruleTool);
+    const callInfo = mcpInfoFromString(callTool);
+    if (ruleInfo && callInfo) {
+        if (ruleInfo.serverName !== callInfo.serverName)
+            return false;
+        if (ruleInfo.toolName === undefined || ruleInfo.toolName === "*")
+            return true;
+        return ruleInfo.toolName === callInfo.toolName;
+    }
+    return false;
+}
+// --- WebFetch domain matching ---
+function domainMatches(pattern, hostname) {
+    const p = pattern.toLowerCase().trim();
+    const h = hostname.toLowerCase();
+    if (p === "*" || p === "domain:*")
+        return true;
+    if (!p.includes("*"))
+        return p === h;
+    // `*.example.com` matches any depth of subdomain (docs semantics); a bare
+    // `example.com` does NOT match sub.example.com (exact only).
+    if (p.startsWith("*.")) {
+        const base = p.slice(2);
+        // `*.example.com` matches subdomains ONLY (not the apex) — the strict
+        // reading of Claude Code's docs; an apex allow belongs in its own rule.
+        return h.endsWith("." + base);
+    }
+    // Other wildcard placements: simple glob (segment-safe).
+    const re = new RegExp("^" + p.split("*").map((s) => s.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join("[^.]*") + "$");
+    return re.test(h);
+}
+function hostnameOf(url) {
+    try {
+        return new URL(url).hostname;
+    }
+    catch {
+        return null;
+    }
+}
+// --- main evaluation ---
+export function evaluateRules(rules, ctx) {
+    const active = effectiveRules(rules, ctx.isProjectTrusted);
+    for (const behavior of ["deny", "ask", "allow"]) {
+        const hit = firstMatch(active, behavior, ctx);
+        if (hit)
+            return { verdict: behavior, ...hit };
+    }
+    return null;
+}
+function firstMatch(rules, behavior, ctx) {
+    // Path-class rules evaluate as ONE ordered compile (gitignore semantics:
+    // later lines win, !negation works across rules and files). Non-path rules
+    // stay first-match (Claude Code's per-rule loop).
+    const pathRules = rules.filter((r) => r.behavior === behavior && r.ruleContent !== undefined && pathClassForTool(r.toolName) !== null);
+    if (pathRules.length > 0 && pathClassForTool(ctx.toolName) !== null) {
+        const hit = pathListMatch(pathRules, behavior, ctx);
+        if (hit)
+            return hit;
+    }
+    for (const rule of rules) {
+        if (rule.behavior !== behavior)
+            continue;
+        if (pathRules.includes(rule) && pathClassForTool(ctx.toolName) !== null)
+            continue; // handled above
+        const via = ruleMatchesCall(rule, ctx);
+        if (via)
+            return { rule, matchedVia: via };
+    }
+    return null;
+}
+/** Ordered whole-list evaluation for path-class rules of one behavior. */
+function pathListMatch(pathRules, behavior, ctx) {
+    const callClass = pathClassForTool(ctx.toolName);
+    if (!callClass)
+        return null;
+    const path = pathParam(ctx.params);
+    const resolveOpts = {
+        userStateHome: ctx.userStateHome,
+        projectRoot: ctx.projectRoot,
+        ...(ctx.homeDir ? { homeDir: ctx.homeDir } : {}),
+    };
+    // Class applicability (Claude Code parity):
+    //   - Edit-class rules apply to edit AND read tools (edit implies read).
+    //   - Read-class DENY/ASK rules also apply to edit tools ("Read deny rules
+    //     also block Edit/Write on the same path" — their docs); only Read-class
+    //     ALLOW is read-tool-only (an allow must never widen).
+    const applicable = pathRules.filter((r) => {
+        const rc = pathClassForTool(r.toolName);
+        if (rc === "edit")
+            return true;
+        return callClass === "read" || behavior !== "allow";
+    });
+    if (path && applicable.length > 0) {
+        const patterns = applicable.map((r) => resolvePatternRoot(r.ruleContent ?? "", r.source, resolveOpts));
+        if (anchoredPathMatches(patterns, path, behavior, ctx)) {
+            // Report the LAST rule whose pattern decided the outcome (gitignore's
+            // decisive line) — the list is user-before-project, in file order.
+            return { rule: applicable[applicable.length - 1], matchedVia: "path_pattern" };
+        }
+    }
+    // The bash bridge runs per-rule (bridge matching is per-command-segment,
+    // not an ordered list op) — but only for deny/ask.
+    if (ctx.toolName === "bash" && behavior !== "allow") {
+        for (const rule of applicable) {
+            if (bashBridgeMatches(rule, ctx))
+                return { rule, matchedVia: "file_args" };
+        }
+    }
+    return null;
+}
+/** Ordered compile + the allow-vs-deny anchoring asymmetry. */
+function anchoredPathMatches(patterns, targetPath, behavior, ctx) {
+    if (!pathMatches(patterns, targetPath, { cwd: ctx.cwd }))
+        return false;
+    if (behavior !== "allow")
+        return true;
+    // Rootless single-segment allow patterns are narrowed (Claude Code's
+    // asymmetry): only anchored or multi-segment allow patterns may match.
+    const last = patterns[patterns.length - 1];
+    const content = last.relativePattern;
+    if (content.startsWith("/") || content.includes("/"))
+        return true;
+    return false;
+}
+function ruleMatchesCall(rule, ctx) {
+    // Tool-name-level match first (bare rules + MCP shapes).
+    if (rule.ruleContent === undefined) {
+        return toolNameMatches(rule.toolName, ctx.toolName) ? "tool_name" : null;
+    }
+    if (rule.toolName === "bash") {
+        const command = typeof ctx.params.command === "string" ? ctx.params.command : "";
+        if (!command)
+            return null;
+        return shellRuleMatches(rule.ruleContent, command, rule.behavior) ? "bash_pattern" : null;
+    }
+    if (rule.toolName === "web_fetch") {
+        const url = typeof ctx.params.url === "string" ? ctx.params.url : "";
+        const host = hostnameOf(url);
+        if (!host)
+            return null;
+        const m = rule.ruleContent.match(/^domain:(.*)$/);
+        if (!m)
+            return null;
+        return domainMatches(m[1], host) ? "domain_pattern" : null;
+    }
+    // Path-class rules were already handled by pathListMatch in firstMatch;
+    // ruleMatchesCall only sees them for the bash bridge (non-path call tool)
+    // or not at all. Keep the bridge branch here for direct callers.
+    const ruleClass = pathClassForTool(rule.toolName);
+    if (ruleClass) {
+        if (ctx.toolName === "bash" && rule.behavior !== "allow") {
+            if (bashBridgeMatches(rule, ctx))
+                return "file_args";
+        }
+        return null;
+    }
+    // Non-path tools with content (e.g. Agent(name)) — exact content match.
+    if (rule.ruleContent === ctx.toolName)
+        return null;
+    return null;
+}
+function pathParam(params) {
+    const p = params.path ?? params.file_path;
+    return typeof p === "string" && p.length > 0 ? p : null;
+}
+/** Bash bridge: does this path rule bite on the command's file arguments? */
+function bashBridgeMatches(rule, ctx) {
+    const command = typeof ctx.params.command === "string" ? ctx.params.command : "";
+    if (!command)
+        return false;
+    if (pathClassForTool(rule.toolName) === null)
+        return false;
+    for (const segment of splitSubcommands(command)) {
+        const analysis = analyzeSubcommand(segment);
+        if (analysis.kind !== "analyzed")
+            continue;
+        // Claude Code parity: a deny/ask rule for the path bites on ANY file
+        // operation the command performs on it — read-class rules are NOT
+        // limited to read ops (their `checkPathConstraints` consults the same
+        // patterns for write ops). Fail-safe: a deny is a deny.
+        for (const p of analysis.paths) {
+            if (pathMatches([resolvePatternRoot(rule.ruleContent ?? "", rule.source, {
+                    userStateHome: ctx.userStateHome,
+                    projectRoot: ctx.projectRoot,
+                    ...(ctx.homeDir ? { homeDir: ctx.homeDir } : {}),
+                })], p, { cwd: ctx.cwd })) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+/** Parse a raw rule string into a sourced PermissionRule (loader/tests). */
+export function ruleFromRaw(raw, behavior, source) {
+    const { toolName, ruleContent } = parseRuleString(raw);
+    return { behavior, source, toolName, ruleContent, raw };
+}
+//# sourceMappingURL=engine.js.map

package/dist/extension/permissionRules/loadConfig.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Permission-rule settings loader.
+ *
+ * Reads `permissions: { allow, deny, ask }` from the two YAGNI Code settings
+ * files, mirroring the hooks loader (hooks.ts) shape exactly:
+ *   - user:      ~/.yagni-code/config.json — always active
+ *   - project:   .yagni-code/config.json   — deny/ask always active;
+ *                allow gated on workspace trust (Claude Code semantics:
+ *                "deny and ask rules apply right away; allow rules from a
+ *                project file wait for trust")
+ *
+ * Lists UNION across sources (Claude Code: lists merge, never replace).
+ * User-source rules are ordered before project-source rules so path-pattern
+ * negation (`!exception`) behaves like gitignore lines across files.
+ *
+ * Fail-soft: a malformed config file is skipped whole with a warning (same
+ * posture as hooks.ts). Malformed individual rule strings parse as bare
+ * tool names (parser degrades, never throws) and are flagged.
+ */
+export type RuleSource = "user" | "project";
+export type RuleBehavior = "allow" | "deny" | "ask";
+/** A parsed, sourced permission rule. */
+export interface PermissionRule {
+    behavior: RuleBehavior;
+    source: RuleSource;
+    toolName: string;
+    ruleContent?: string;
+    /** The original rule string, for diagnostics and verdict logs. */
+    raw: string;
+}
+export interface LoadRulesDiagnostics {
+    /** Non-fatal problems: bad files, unparsed rules, unknown keys. */
+    warnings: string[];
+    /** Rule tool names that no rule consumer consults (Claude-only tools). */
+    neverConsultedTools: string[];
+}
+export interface LoadedRules {
+    rules: PermissionRule[];
+    diagnostics: LoadRulesDiagnostics;
+}
+/** The tools a rule can actually be consulted for at the gate. */
+export declare const KNOWN_RULE_TOOLS: Set<string>;
+/** Load + union rules from both files. Pure I/O; no throw. */
+export declare function loadPermissionRules(opts?: {
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    userHome?: string;
+    /** Override the user state home (tests). */
+    stateHomeOverride?: string | null;
+}): LoadedRules;
+/** Filter rules by behavior + trust (project allow needs trust; deny/ask always). */
+export declare function effectiveRules(rules: readonly PermissionRule[], isProjectTrusted: boolean): PermissionRule[];
+//# sourceMappingURL=loadConfig.d.ts.map

package/dist/extension/permissionRules/loadConfig.js

@@ -0,0 +1,90 @@
+/**
+ * Permission-rule settings loader.
+ *
+ * Reads `permissions: { allow, deny, ask }` from the two YAGNI Code settings
+ * files, mirroring the hooks loader (hooks.ts) shape exactly:
+ *   - user:      ~/.yagni-code/config.json — always active
+ *   - project:   .yagni-code/config.json   — deny/ask always active;
+ *                allow gated on workspace trust (Claude Code semantics:
+ *                "deny and ask rules apply right away; allow rules from a
+ *                project file wait for trust")
+ *
+ * Lists UNION across sources (Claude Code: lists merge, never replace).
+ * User-source rules are ordered before project-source rules so path-pattern
+ * negation (`!exception`) behaves like gitignore lines across files.
+ *
+ * Fail-soft: a malformed config file is skipped whole with a warning (same
+ * posture as hooks.ts). Malformed individual rule strings parse as bare
+ * tool names (parser degrades, never throws) and are flagged.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { codeStateHome } from "../stateHome.js";
+import { parseRuleString } from "./parser.js";
+/** The tools a rule can actually be consulted for at the gate. */
+export const KNOWN_RULE_TOOLS = new Set([
+    "read", "edit", "write", "grep", "find", "ls", "bash", "web_fetch",
+    "ask_yagni", "ask_advisor", "ask_user_question", "file_ticket",
+    "update_ticket_status", "review_business_match", "suggest_next_work",
+    "record_engineering_context", "record_decision",
+]);
+function readRulesFromFile(path, source, behavior, out, warnings) {
+    try {
+        if (!existsSync(path))
+            return;
+        const raw = readFileSync(path, "utf-8");
+        if (raw.trim() === "")
+            return;
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            warnings.push(`${source} settings: not a JSON object — permissions skipped (${path})`);
+            return;
+        }
+        const permissions = parsed.permissions;
+        if (permissions === undefined)
+            return;
+        if (!permissions || typeof permissions !== "object" || Array.isArray(permissions)) {
+            warnings.push(`${source} settings: "permissions" is not an object — skipped (${path})`);
+            return;
+        }
+        const entries = permissions[behavior];
+        if (entries === undefined)
+            return;
+        const list = Array.isArray(entries) ? entries : [entries];
+        for (const entry of list) {
+            if (typeof entry !== "string") {
+                warnings.push(`${source} settings: non-string ${behavior} rule skipped (${path})`);
+                continue;
+            }
+            const { toolName, ruleContent } = parseRuleString(entry);
+            out.push({ behavior, source, toolName, ruleContent, raw: entry });
+        }
+    }
+    catch {
+        warnings.push(`${source} settings: malformed JSON — permissions skipped (${path})`);
+    }
+}
+/** Load + union rules from both files. Pure I/O; no throw. */
+export function loadPermissionRules(opts = {}) {
+    const warnings = [];
+    const rules = [];
+    const stateHome = opts.stateHomeOverride ?? codeStateHome(null, opts.env, opts.userHome);
+    const userPath = join(stateHome, "config.json");
+    const projectPath = join(opts.cwd ?? process.cwd(), ".yagni-code", "config.json");
+    // User first, project second — ordering matters for path-rule negation.
+    for (const behavior of ["deny", "ask", "allow"]) {
+        readRulesFromFile(userPath, "user", behavior, rules, warnings);
+        readRulesFromFile(projectPath, "project", behavior, rules, warnings);
+    }
+    const neverConsultedTools = [
+        ...new Set(rules.map((r) => r.toolName).filter((t) => !KNOWN_RULE_TOOLS.has(t) && !t.startsWith("mcp__"))),
+    ];
+    return { rules, diagnostics: { warnings, neverConsultedTools } };
+}
+/** Filter rules by behavior + trust (project allow needs trust; deny/ask always). */
+export function effectiveRules(rules, isProjectTrusted) {
+    if (isProjectTrusted)
+        return [...rules];
+    return rules.filter((r) => !(r.source === "project" && r.behavior === "allow"));
+}
+//# sourceMappingURL=loadConfig.js.map

package/dist/extension/permissionRules/parser.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Permission-rule string parser.
+ *
+ * Parses `ToolName` / `ToolName(content)` rule strings — the exact format
+ * Claude Code uses in settings.json `permissions.allow/deny/ask` arrays —
+ * so a rule pasted from Claude Code works unchanged.
+ *
+ * Tool-name aliasing: Claude Code names (Read/Edit/Write/…) map onto this
+ * agent's tool names (read/edit/write/…). Both spellings are accepted; rules
+ * for tools that do not exist here parse fine but are flagged
+ * never-consulted by the loader's diagnostics.
+ *
+ * Ported from Claude Code's permissionRuleParser.ts (escaping semantics,
+ * `ToolName(*)` ≡ tool-wide) with the alias table added.
+ */
+export interface ParsedRuleValue {
+    /** Normalized tool name this rule targets (after aliasing). */
+    toolName: string;
+    /** The raw content inside the parens, unescaped; undefined for bare rules. */
+    ruleContent?: string;
+}
+/** Normalize a rule's tool name: lowercase → alias → MCP passthrough. */
+export declare function normalizeRuleToolName(raw: string): string;
+/** Escape parens/backslashes in rule content for storage (parser inverse). */
+export declare function escapeRuleContent(content: string): string;
+/** Unescape rule content after parsing. */
+export declare function unescapeRuleContent(content: string): string;
+/**
+ * Parse a rule string into its components. Malformed shapes degrade the same
+ * way Claude Code's parser degrades them: treat the whole string as a bare
+ * tool name (never throw) — the loader's diagnostics flag them.
+ *
+ * `Bash(*)` and `Bash()` are tool-wide rules, same as bare `Bash`.
+ */
+export declare function parseRuleString(ruleString: string): ParsedRuleValue;
+/** Serialize a parsed rule back to its string form (loader diagnostics). */
+export declare function ruleValueToString(value: ParsedRuleValue): string;
+//# sourceMappingURL=parser.d.ts.map

package/dist/extension/permissionRules/parser.js

@@ -0,0 +1,136 @@
+/**
+ * Permission-rule string parser.
+ *
+ * Parses `ToolName` / `ToolName(content)` rule strings — the exact format
+ * Claude Code uses in settings.json `permissions.allow/deny/ask` arrays —
+ * so a rule pasted from Claude Code works unchanged.
+ *
+ * Tool-name aliasing: Claude Code names (Read/Edit/Write/…) map onto this
+ * agent's tool names (read/edit/write/…). Both spellings are accepted; rules
+ * for tools that do not exist here parse fine but are flagged
+ * never-consulted by the loader's diagnostics.
+ *
+ * Ported from Claude Code's permissionRuleParser.ts (escaping semantics,
+ * `ToolName(*)` ≡ tool-wide) with the alias table added.
+ */
+import { mcpInfoFromString } from "../mcp/names.js";
+/**
+ * Claude Code tool names → this agent's tool names. Keys are matched
+ * case-insensitively at parse time (Claude Code rules use PascalCase; our
+ * registered tools are lowercase). MCP names (`mcp__server__tool`) pass
+ * through untouched — naming is already byte-identical (mcp/names.ts).
+ */
+const TOOL_NAME_ALIASES = {
+    read: "read",
+    edit: "edit",
+    write: "write",
+    grep: "grep",
+    find: "find",
+    glob: "find", // Claude Code's Glob ≈ our find (pattern-based file search)
+    ls: "ls",
+    bash: "bash",
+    webfetch: "web_fetch", // Claude Code's WebFetch → our web_fetch
+    // YAGNI-registered tools, accepted under their own names (aliases exist so
+    // a rule copied from a Claude Code setup that wrapped the same capability
+    // under a different name still lands on ours where sensible).
+    ask_yagni: "ask_yagni",
+    ask_advisor: "ask_advisor",
+    ask_user_question: "ask_user_question",
+    web_fetch: "web_fetch",
+    file_ticket: "file_ticket",
+    update_ticket_status: "update_ticket_status",
+    review_business_match: "review_business_match",
+    suggest_next_work: "suggest_next_work",
+    record_engineering_context: "record_engineering_context",
+    record_decision: "record_decision",
+};
+/** Normalize a rule's tool name: lowercase → alias → MCP passthrough. */
+export function normalizeRuleToolName(raw) {
+    const lower = raw.toLowerCase();
+    const aliased = TOOL_NAME_ALIASES[lower];
+    if (aliased)
+        return aliased;
+    // MCP names are lowercase by construction (mcp/names.ts); no aliasing.
+    if (mcpInfoFromString(raw) !== null)
+        return raw;
+    // Unknown tool: keep the lowercased name so diagnostics can name it.
+    return lower;
+}
+/** Escape parens/backslashes in rule content for storage (parser inverse). */
+export function escapeRuleContent(content) {
+    return content
+        .replace(/\\/g, "\\\\")
+        .replace(/\(/g, "\\(")
+        .replace(/\)/g, "\\)");
+}
+/** Unescape rule content after parsing. */
+export function unescapeRuleContent(content) {
+    return content
+        .replace(/\\\(/g, "(")
+        .replace(/\\\)/g, ")")
+        .replace(/\\\\/g, "\\");
+}
+/** Index of the first occurrence of `ch` not escaped by an odd backslash run. */
+function findFirstUnescapedChar(str, ch) {
+    for (let i = 0; i < str.length; i++) {
+        if (str[i] !== ch)
+            continue;
+        let backslashes = 0;
+        let j = i - 1;
+        while (j >= 0 && str[j] === "\\") {
+            backslashes++;
+            j--;
+        }
+        if (backslashes % 2 === 0)
+            return i;
+    }
+    return -1;
+}
+function findLastUnescapedChar(str, ch) {
+    for (let i = str.length - 1; i >= 0; i--) {
+        if (str[i] !== ch)
+            continue;
+        let backslashes = 0;
+        let j = i - 1;
+        while (j >= 0 && str[j] === "\\") {
+            backslashes++;
+            j--;
+        }
+        if (backslashes % 2 === 0)
+            return i;
+    }
+    return -1;
+}
+/**
+ * Parse a rule string into its components. Malformed shapes degrade the same
+ * way Claude Code's parser degrades them: treat the whole string as a bare
+ * tool name (never throw) — the loader's diagnostics flag them.
+ *
+ * `Bash(*)` and `Bash()` are tool-wide rules, same as bare `Bash`.
+ */
+export function parseRuleString(ruleString) {
+    const openIdx = findFirstUnescapedChar(ruleString, "(");
+    if (openIdx === -1) {
+        return { toolName: normalizeRuleToolName(ruleString.trim()) };
+    }
+    const closeIdx = findLastUnescapedChar(ruleString, ")");
+    if (closeIdx === -1 || closeIdx <= openIdx || closeIdx !== ruleString.length - 1) {
+        return { toolName: normalizeRuleToolName(ruleString.trim()) };
+    }
+    const toolName = ruleString.slice(0, openIdx).trim();
+    if (!toolName) {
+        return { toolName: normalizeRuleToolName(ruleString.trim()) };
+    }
+    const rawContent = ruleString.slice(openIdx + 1, closeIdx);
+    if (rawContent === "" || rawContent === "*") {
+        return { toolName: normalizeRuleToolName(toolName) };
+    }
+    return { toolName: normalizeRuleToolName(toolName), ruleContent: unescapeRuleContent(rawContent) };
+}
+/** Serialize a parsed rule back to its string form (loader diagnostics). */
+export function ruleValueToString(value) {
+    if (value.ruleContent === undefined)
+        return value.toolName;
+    return `${value.toolName}(${escapeRuleContent(value.ruleContent)})`;
+}
+//# sourceMappingURL=parser.js.map

package/dist/extension/permissionRules/pathRules.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Path-based permission rules — ported from Claude Code's
+ * filesystem.ts (patternWithRoot + matchingRuleForInput), powered by the
+ * vendored `ignore` package (the gitignore engine) so pattern semantics are
+ * byte-compatible with both git's .gitignore and Claude Code.
+ *
+ * Pattern anchors (Claude Code parity):
+ *   //path   absolute from filesystem root
+ *   ~/path   relative to the user's home directory
+ *   /path    relative to the SETTINGS FILE's directory (user config →
+ *            ~/.yagni-code/, project config → the project root)
+ *   path     relative to the session cwd; a bare filename matches at ANY
+ *            depth (`.env` equals `**` / `.env` in glob terms)
+ *
+ * Compile semantics: all patterns for one (tool-class, behavior) compile
+ * into ONE ordered `ignore` instance — user-source patterns first, then
+ * project — so gitignore's later-line-wins and `!exception` negation work
+ * across rules from both files (Claude Code's matchingRuleForInput builds
+ * one ignore().add(patterns) per root the same way).
+ *
+ * Behavior asymmetry (Claude Code parity): allow rules with a rootless
+ * single-segment pattern anchor at the settings dir (narrow); deny/ask
+ * rules match at any depth (broad — the fail-safe direction).
+ */
+import type { RuleSource } from "./loadConfig.js";
+export interface PathMatchOptions {
+    cwd: string;
+    /** Overrides ~ expansion (tests); defaults to os.homedir(). */
+    homeDir?: string;
+}
+export type PathToolClass = "read" | "edit";
+/** Which tools a rule's toolName maps to for path purposes. */
+export declare function pathClassForTool(toolName: string): PathToolClass | null;
+/** One path-pattern rule, resolved to a root + relative pattern. */
+export interface ResolvedPathPattern {
+    relativePattern: string;
+    /** The directory the pattern resolves against; null = cwd-relative. */
+    root: string | null;
+    source: RuleSource;
+}
+/**
+ * Split an anchored pattern into (root, relativePattern). Mirrors Claude
+ * Code's patternWithRoot. Project-source `/` anchors at the project root
+ * (passed in); user-source `/` anchors at the YAGNI Code state home
+ * (~/.yagni-code).
+ */
+export declare function resolvePatternRoot(pattern: string, source: RuleSource, opts: {
+    userStateHome: string;
+    projectRoot: string | null;
+    homeDir?: string;
+}): ResolvedPathPattern;
+/**
+ * Does the (absolute or cwd-relative) target path match the given patterns?
+ * Patterns are tried in order; later patterns win (gitignore semantics) —
+ * so the caller must pass user-source patterns before project-source.
+ */
+export declare function pathMatches(patterns: readonly ResolvedPathPattern[], targetPath: string, opts: PathMatchOptions): boolean;
+//# sourceMappingURL=pathRules.d.ts.map