@yagni-app/code 1.0.6 → 1.0.7

package/dist/extension/permissionRules/bashFileArgs.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Curated bash command → file-operation table.
+ *
+ * The bridge that makes Read/Edit deny rules bite on bash commands: for a
+ * curated set of commands, extract the file paths they touch, classify each
+ * touch as read or write, and run those paths through the same path-rule
+ * engine. `cat .env`, `sed -i .env`, `cp .env x`, `echo x > .env` are all
+ * caught by a `Read(.env)`/`Edit(.env)` deny.
+ *
+ * Ported from Claude Code's BashTool/pathValidation.ts (PATH_EXTRACTORS +
+ * COMMAND_OPERATION_TYPE), adapted to shellParse tokens. Guardrails (same
+ * posture as Claude Code):
+ *   - unknown flags on commands where flags can change path meaning
+ *     (mv/cp --target-directory) → the command is NOT auto-analyzed; it
+ *     degrades to the caller's "ask" path, never silently allowed.
+ *   - glob arguments in write position → not analyzed (write globs bypass
+ *     checks in Claude Code; we degrade to ask).
+ *   - anything unextractable → no opinion; caller decides.
+ */
+export type FileOperation = "read" | "write";
+/** A command's opinion: extracted (op, paths) or needs-ask. */
+export type BashFileArgsResult = {
+    kind: "analyzed";
+    operation: FileOperation;
+    paths: string[];
+} | {
+    kind: "unknown";
+};
+/** Commands whose file paths we can extract confidently. */
+export declare const COMMAND_OPERATION: Record<string, FileOperation>;
+/**
+ * Analyze one bash SUBCOMMAND string. `kind: "unknown"` means no confident
+ * opinion — the caller degrades to ask for deny-evaluation purposes (never
+ * to silent allow).
+ */
+export declare function analyzeSubcommand(subcommand: string): BashFileArgsResult;
+/** Split a full command into subcommand strings (reuses shellRules' splitter). */
+export { splitSubcommands } from "./shellRules.js";
+//# sourceMappingURL=bashFileArgs.d.ts.map

package/dist/extension/permissionRules/bashFileArgs.js

@@ -0,0 +1,236 @@
+/**
+ * Curated bash command → file-operation table.
+ *
+ * The bridge that makes Read/Edit deny rules bite on bash commands: for a
+ * curated set of commands, extract the file paths they touch, classify each
+ * touch as read or write, and run those paths through the same path-rule
+ * engine. `cat .env`, `sed -i .env`, `cp .env x`, `echo x > .env` are all
+ * caught by a `Read(.env)`/`Edit(.env)` deny.
+ *
+ * Ported from Claude Code's BashTool/pathValidation.ts (PATH_EXTRACTORS +
+ * COMMAND_OPERATION_TYPE), adapted to shellParse tokens. Guardrails (same
+ * posture as Claude Code):
+ *   - unknown flags on commands where flags can change path meaning
+ *     (mv/cp --target-directory) → the command is NOT auto-analyzed; it
+ *     degrades to the caller's "ask" path, never silently allowed.
+ *   - glob arguments in write position → not analyzed (write globs bypass
+ *     checks in Claude Code; we degrade to ask).
+ *   - anything unextractable → no opinion; caller decides.
+ */
+import { shellParse } from "../permission/execPolicy.js";
+/** Commands whose file paths we can extract confidently. */
+export const COMMAND_OPERATION = {
+    // read-only
+    cat: "read", head: "read", tail: "read", sort: "read", uniq: "read",
+    wc: "read", cut: "read", paste: "read", column: "read", file: "read",
+    stat: "read", diff: "read", awk: "read", strings: "read", hexdump: "read",
+    od: "read", base64: "read", nl: "read", grep: "read", rg: "read",
+    sha256sum: "read", sha1sum: "read", md5sum: "read", jq: "read",
+    ls: "read", find: "read", git: "read",
+    // mutating on their targets
+    rm: "write", rmdir: "write", mv: "write", cp: "write", touch: "write",
+    mkdir: "write", sed: "write", tee: "write",
+};
+// --- token helpers (over shellParse output) ---
+function argTokens(command) {
+    const parsed = shellParse(command);
+    const tokens = [];
+    const redirects = [];
+    for (const t of parsed) {
+        if (typeof t === "string") {
+            tokens.push(t);
+        }
+        else if ("op" in t) {
+            if (t.op === "redirect" && t.direction === "out" && typeof t.target === "string") {
+                redirects.push(t.target);
+            }
+            else if (t.op !== "background") {
+                // substitution / in-redirect / background: can't analyze confidently
+                return null;
+            }
+        }
+    }
+    return { tokens, redirects };
+}
+/** Drop flag tokens, honoring `--` end-of-options (Claude's filterOutFlags). */
+function filterOutFlags(args) {
+    const out = [];
+    let afterDoubleDash = false;
+    for (const a of args) {
+        if (!afterDoubleDash && a === "--") {
+            afterDoubleDash = true;
+            continue;
+        }
+        if (!afterDoubleDash && a.startsWith("-"))
+            continue;
+        out.push(a);
+    }
+    return out;
+}
+/** Pattern-first commands (grep/rg/awk/sed-style): first positional is the pattern. */
+function patternCommandPaths(args, flagsWithValues, defaults) {
+    const out = [];
+    let skipNext = false;
+    let patternFound = false;
+    let afterDoubleDash = false;
+    for (const a of args) {
+        if (skipNext) {
+            skipNext = false;
+            continue;
+        }
+        if (!afterDoubleDash && a === "--") {
+            afterDoubleDash = true;
+            continue;
+        }
+        if (!afterDoubleDash && a.startsWith("-")) {
+            const flag = a.split("=")[0];
+            if (flagsWithValues.has(flag) && !a.includes("="))
+                skipNext = true;
+            continue;
+        }
+        if (!patternFound) {
+            patternFound = true;
+            continue;
+        }
+        out.push(a);
+    }
+    return out.length > 0 ? out : defaults;
+}
+const GREP_FLAGS = new Set(["-e", "--regexp", "-f", "--file", "--exclude", "--include", "--exclude-dir", "--include-dir", "-m", "--max-count", "-A", "--after-context", "-B", "--before-context", "-C", "--context"]);
+const RG_FLAGS = new Set(["-e", "--regexp", "-f", "--file", "-t", "--type", "-T", "--type-not", "-g", "--glob", "-m", "--max-count", "--max-depth", "-r", "--replace", "-A", "--after-context", "-B", "--before-context", "-C", "--context"]);
+// mv/cp validators: ANY flag → unknown (Claude blocks all flags for these —
+// --target-directory=PATH changes path meaning).
+function hasFlag(args) {
+    let afterDoubleDash = false;
+    for (const a of args) {
+        if (!afterDoubleDash && a === "--") {
+            afterDoubleDash = true;
+            continue;
+        }
+        if (!afterDoubleDash && a.startsWith("-") && a !== "-")
+            return true;
+    }
+    return false;
+}
+const GLOBISH = /[*?[]/;
+/**
+ * Analyze one bash SUBCOMMAND string. `kind: "unknown"` means no confident
+ * opinion — the caller degrades to ask for deny-evaluation purposes (never
+ * to silent allow).
+ */
+export function analyzeSubcommand(subcommand) {
+    const parsed = argTokens(subcommand);
+    if (!parsed || parsed.tokens.length === 0)
+        return { kind: "unknown" };
+    // Redirect targets are ALWAYS write access, regardless of the command
+    // being curated (Claude Code validates redirect targets independently of
+    // the command table). `echo x > .env` must not escape the .env deny.
+    if (parsed.redirects.length > 0) {
+        const [cmd, ...args] = parsed.tokens;
+        const operation = COMMAND_OPERATION[cmd];
+        const paths = operation
+            ? extractPaths(cmd, args)
+            : [];
+        if (paths === null)
+            return { kind: "unknown" };
+        const base = paths.filter((p) => p.length > 0);
+        if (operation === "write" && base.some((p) => GLOBISH.test(p)))
+            return { kind: "unknown" };
+        return { kind: "analyzed", operation: "write", paths: [...base, ...parsed.redirects] };
+    }
+    const [cmd, ...args] = parsed.tokens;
+    const operation = COMMAND_OPERATION[cmd];
+    if (!operation)
+        return { kind: "unknown" };
+    const paths = extractPaths(cmd, args);
+    if (paths === null)
+        return { kind: "unknown" };
+    if (operation === "write" && paths.some((p) => GLOBISH.test(p))) {
+        return { kind: "unknown" };
+    }
+    return { kind: "analyzed", operation, paths: paths.filter((p) => p.length > 0) };
+}
+function extractPaths(cmd, args) {
+    switch (cmd) {
+        case "grep":
+            return patternCommandPaths(args, GREP_FLAGS, []);
+        case "rg":
+            return patternCommandPaths(args, RG_FLAGS, ["."]);
+        case "ls": {
+            const out = filterOutFlags(args);
+            return out.length > 0 ? out : ["."];
+        }
+        case "find": {
+            // collect positionals until the first real flag
+            const out = [];
+            let hitFlag = false;
+            for (const a of args) {
+                if (a.startsWith("-")) {
+                    hitFlag = true;
+                    continue;
+                }
+                if (!hitFlag)
+                    out.push(a);
+            }
+            return out.length > 0 ? out : ["."];
+        }
+        case "git":
+            // Only `git diff --no-index` reaches arbitrary files outside the repo;
+            // other git subcommands are covered by the repo's own boundaries.
+            if (args[0] === "diff" && args.includes("--no-index")) {
+                return filterOutFlags(args.slice(1)).slice(0, 2);
+            }
+            return [];
+        case "sed": {
+            // -f FILE reads a script file; positionals after the script are files.
+            const out = [];
+            let skipNext = false;
+            let scriptFound = false;
+            let afterDoubleDash = false;
+            for (const a of args) {
+                if (skipNext) {
+                    skipNext = false;
+                    continue;
+                }
+                if (!afterDoubleDash && a === "--") {
+                    afterDoubleDash = true;
+                    continue;
+                }
+                if (!afterDoubleDash && a.startsWith("-")) {
+                    if (a === "-f" || a === "--file") {
+                        const f = args[args.indexOf(a) + 1];
+                        if (f)
+                            out.push(f);
+                        skipNext = true;
+                        scriptFound = true;
+                    }
+                    else if (a === "-e" || a === "--expression") {
+                        skipNext = true;
+                        scriptFound = true;
+                    }
+                    else if (a.includes("e") || a.includes("f")) {
+                        scriptFound = true;
+                    }
+                    continue;
+                }
+                if (!scriptFound) {
+                    scriptFound = true;
+                    continue;
+                }
+                out.push(a);
+            }
+            return out;
+        }
+        case "mv":
+        case "cp":
+            // ANY flag → unknown (--target-directory=PATH changes path meaning).
+            if (hasFlag(args))
+                return null;
+            return filterOutFlags(args);
+        default:
+            return filterOutFlags(args);
+    }
+}
+/** Split a full command into subcommand strings (reuses shellRules' splitter). */
+export { splitSubcommands } from "./shellRules.js";
+//# sourceMappingURL=bashFileArgs.js.map

package/dist/extension/permissionRules/engine.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Permission-rule evaluation engine.
+ *
+ * The single entry the gate calls BEFORE hooks/exec-policy/grants/Guardian:
+ *
+ *   evaluateRules(rules, { toolName, params, cwd, isProjectTrusted, ... })
+ *     → { verdict: "deny" | "ask" | "allow", rule } | null (no opinion)
+ *
+ * Evaluation order is Claude Code's: for each behavior in deny → ask → allow,
+ * find the first rule that matches the tool call. Deny/ask are FINAL from the
+ * gate's perspective (nothing downstream may override); allow short-circuits
+ * the Guardian but CANNOT lift the exec-policy forbidden band or the
+ * alwaysConfirmTools contract (those floors live in the gate wiring, which
+ * re-checks them after an allow verdict).
+ *
+ * Matching by tool:
+ *   - bash:            Bash(command-pattern): prefix, :* suffix, or * wildcards; compound split
+ *   - read/edit/write: Read(path)/Edit(path) — gitignore path patterns
+ *                      (read-class rules also consult grep/find/ls paths)
+ *   - web_fetch:       WebFetch(domain:pattern) — hostname globs
+ *   - others:          bare tool-name rules (and mcp__server / mcp__server__tool)
+ *
+ * Edit-class deny also applies to read access of the same path (Claude Code:
+ * a Read deny blocks Edit/Write on the path; an Edit deny blocks reads too —
+ * "edit access implies read access" cuts both ways for denies).
+ */
+import type { PermissionRule, RuleSource } from "./loadConfig.js";
+export type RuleVerdict = "deny" | "ask" | "allow";
+export interface RuleEvaluationContext {
+    toolName: string;
+    params: Record<string, unknown>;
+    cwd: string;
+    isProjectTrusted: boolean;
+    /** ~/.yagni-code (user `/`-anchor base). */
+    userStateHome: string;
+    /** Project root for project-source `/`-anchored patterns; null outside a repo. */
+    projectRoot: string | null;
+    /** Overrides ~ expansion (tests); defaults to os.homedir(). */
+    homeDir?: string;
+}
+export interface RuleEvaluation {
+    verdict: RuleVerdict;
+    rule: PermissionRule;
+    /** Which matcher produced the hit (verdict logs / deny messages). */
+    matchedVia: "tool_name" | "bash_pattern" | "path_pattern" | "domain_pattern" | "file_args";
+}
+export declare function evaluateRules(rules: readonly PermissionRule[], ctx: RuleEvaluationContext): RuleEvaluation | null;
+/** Parse a raw rule string into a sourced PermissionRule (loader/tests). */
+export declare function ruleFromRaw(raw: string, behavior: PermissionRule["behavior"], source: RuleSource): PermissionRule;
+//# sourceMappingURL=engine.d.ts.map

package/dist/extension/permissionRules/engine.js

@@ -0,0 +1,238 @@
+/**
+ * Permission-rule evaluation engine.
+ *
+ * The single entry the gate calls BEFORE hooks/exec-policy/grants/Guardian:
+ *
+ *   evaluateRules(rules, { toolName, params, cwd, isProjectTrusted, ... })
+ *     → { verdict: "deny" | "ask" | "allow", rule } | null (no opinion)
+ *
+ * Evaluation order is Claude Code's: for each behavior in deny → ask → allow,
+ * find the first rule that matches the tool call. Deny/ask are FINAL from the
+ * gate's perspective (nothing downstream may override); allow short-circuits
+ * the Guardian but CANNOT lift the exec-policy forbidden band or the
+ * alwaysConfirmTools contract (those floors live in the gate wiring, which
+ * re-checks them after an allow verdict).
+ *
+ * Matching by tool:
+ *   - bash:            Bash(command-pattern): prefix, :* suffix, or * wildcards; compound split
+ *   - read/edit/write: Read(path)/Edit(path) — gitignore path patterns
+ *                      (read-class rules also consult grep/find/ls paths)
+ *   - web_fetch:       WebFetch(domain:pattern) — hostname globs
+ *   - others:          bare tool-name rules (and mcp__server / mcp__server__tool)
+ *
+ * Edit-class deny also applies to read access of the same path (Claude Code:
+ * a Read deny blocks Edit/Write on the path; an Edit deny blocks reads too —
+ * "edit access implies read access" cuts both ways for denies).
+ */
+import { mcpInfoFromString } from "../mcp/names.js";
+import { analyzeSubcommand, splitSubcommands } from "./bashFileArgs.js";
+import { effectiveRules } from "./loadConfig.js";
+import { pathClassForTool, pathMatches, resolvePatternRoot } from "./pathRules.js";
+import { parseRuleString } from "./parser.js";
+import { shellRuleMatches } from "./shellRules.js";
+// --- tool-name matching (Claude Code's toolMatchesRule, incl. MCP) ---
+function toolNameMatches(ruleTool, callTool) {
+    if (ruleTool === callTool)
+        return true;
+    if (ruleTool === "*")
+        return true;
+    // MCP: `mcp__server` matches every tool of that server; `mcp__server__tool`
+    // matches exactly; `mcp__server__*` is the glob form.
+    const ruleInfo = mcpInfoFromString(ruleTool);
+    const callInfo = mcpInfoFromString(callTool);
+    if (ruleInfo && callInfo) {
+        if (ruleInfo.serverName !== callInfo.serverName)
+            return false;
+        if (ruleInfo.toolName === undefined || ruleInfo.toolName === "*")
+            return true;
+        return ruleInfo.toolName === callInfo.toolName;
+    }
+    return false;
+}
+// --- WebFetch domain matching ---
+function domainMatches(pattern, hostname) {
+    const p = pattern.toLowerCase().trim();
+    const h = hostname.toLowerCase();
+    if (p === "*" || p === "domain:*")
+        return true;
+    if (!p.includes("*"))
+        return p === h;
+    // `*.example.com` matches any depth of subdomain (docs semantics); a bare
+    // `example.com` does NOT match sub.example.com (exact only).
+    if (p.startsWith("*.")) {
+        const base = p.slice(2);
+        // `*.example.com` matches subdomains ONLY (not the apex) — the strict
+        // reading of Claude Code's docs; an apex allow belongs in its own rule.
+        return h.endsWith("." + base);
+    }
+    // Other wildcard placements: simple glob (segment-safe).
+    const re = new RegExp("^" + p.split("*").map((s) => s.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join("[^.]*") + "$");
+    return re.test(h);
+}
+function hostnameOf(url) {
+    try {
+        return new URL(url).hostname;
+    }
+    catch {
+        return null;
+    }
+}
+// --- main evaluation ---
+export function evaluateRules(rules, ctx) {
+    const active = effectiveRules(rules, ctx.isProjectTrusted);
+    for (const behavior of ["deny", "ask", "allow"]) {
+        const hit = firstMatch(active, behavior, ctx);
+        if (hit)
+            return { verdict: behavior, ...hit };
+    }
+    return null;
+}
+function firstMatch(rules, behavior, ctx) {
+    // Path-class rules evaluate as ONE ordered compile (gitignore semantics:
+    // later lines win, !negation works across rules and files). Non-path rules
+    // stay first-match (Claude Code's per-rule loop).
+    const pathRules = rules.filter((r) => r.behavior === behavior && r.ruleContent !== undefined && pathClassForTool(r.toolName) !== null);
+    if (pathRules.length > 0 && pathClassForTool(ctx.toolName) !== null) {
+        const hit = pathListMatch(pathRules, behavior, ctx);
+        if (hit)
+            return hit;
+    }
+    for (const rule of rules) {
+        if (rule.behavior !== behavior)
+            continue;
+        if (pathRules.includes(rule) && pathClassForTool(ctx.toolName) !== null)
+            continue; // handled above
+        const via = ruleMatchesCall(rule, ctx);
+        if (via)
+            return { rule, matchedVia: via };
+    }
+    return null;
+}
+/** Ordered whole-list evaluation for path-class rules of one behavior. */
+function pathListMatch(pathRules, behavior, ctx) {
+    const callClass = pathClassForTool(ctx.toolName);
+    if (!callClass)
+        return null;
+    const path = pathParam(ctx.params);
+    const resolveOpts = {
+        userStateHome: ctx.userStateHome,
+        projectRoot: ctx.projectRoot,
+        ...(ctx.homeDir ? { homeDir: ctx.homeDir } : {}),
+    };
+    // Class applicability (Claude Code parity):
+    //   - Edit-class rules apply to edit AND read tools (edit implies read).
+    //   - Read-class DENY/ASK rules also apply to edit tools ("Read deny rules
+    //     also block Edit/Write on the same path" — their docs); only Read-class
+    //     ALLOW is read-tool-only (an allow must never widen).
+    const applicable = pathRules.filter((r) => {
+        const rc = pathClassForTool(r.toolName);
+        if (rc === "edit")
+            return true;
+        return callClass === "read" || behavior !== "allow";
+    });
+    if (path && applicable.length > 0) {
+        const patterns = applicable.map((r) => resolvePatternRoot(r.ruleContent ?? "", r.source, resolveOpts));
+        if (anchoredPathMatches(patterns, path, behavior, ctx)) {
+            // Report the LAST rule whose pattern decided the outcome (gitignore's
+            // decisive line) — the list is user-before-project, in file order.
+            return { rule: applicable[applicable.length - 1], matchedVia: "path_pattern" };
+        }
+    }
+    // The bash bridge runs per-rule (bridge matching is per-command-segment,
+    // not an ordered list op) — but only for deny/ask.
+    if (ctx.toolName === "bash" && behavior !== "allow") {
+        for (const rule of applicable) {
+            if (bashBridgeMatches(rule, ctx))
+                return { rule, matchedVia: "file_args" };
+        }
+    }
+    return null;
+}
+/** Ordered compile + the allow-vs-deny anchoring asymmetry. */
+function anchoredPathMatches(patterns, targetPath, behavior, ctx) {
+    if (!pathMatches(patterns, targetPath, { cwd: ctx.cwd }))
+        return false;
+    if (behavior !== "allow")
+        return true;
+    // Rootless single-segment allow patterns are narrowed (Claude Code's
+    // asymmetry): only anchored or multi-segment allow patterns may match.
+    const last = patterns[patterns.length - 1];
+    const content = last.relativePattern;
+    if (content.startsWith("/") || content.includes("/"))
+        return true;
+    return false;
+}
+function ruleMatchesCall(rule, ctx) {
+    // Tool-name-level match first (bare rules + MCP shapes).
+    if (rule.ruleContent === undefined) {
+        return toolNameMatches(rule.toolName, ctx.toolName) ? "tool_name" : null;
+    }
+    if (rule.toolName === "bash") {
+        const command = typeof ctx.params.command === "string" ? ctx.params.command : "";
+        if (!command)
+            return null;
+        return shellRuleMatches(rule.ruleContent, command, rule.behavior) ? "bash_pattern" : null;
+    }
+    if (rule.toolName === "web_fetch") {
+        const url = typeof ctx.params.url === "string" ? ctx.params.url : "";
+        const host = hostnameOf(url);
+        if (!host)
+            return null;
+        const m = rule.ruleContent.match(/^domain:(.*)$/);
+        if (!m)
+            return null;
+        return domainMatches(m[1], host) ? "domain_pattern" : null;
+    }
+    // Path-class rules were already handled by pathListMatch in firstMatch;
+    // ruleMatchesCall only sees them for the bash bridge (non-path call tool)
+    // or not at all. Keep the bridge branch here for direct callers.
+    const ruleClass = pathClassForTool(rule.toolName);
+    if (ruleClass) {
+        if (ctx.toolName === "bash" && rule.behavior !== "allow") {
+            if (bashBridgeMatches(rule, ctx))
+                return "file_args";
+        }
+        return null;
+    }
+    // Non-path tools with content (e.g. Agent(name)) — exact content match.
+    if (rule.ruleContent === ctx.toolName)
+        return null;
+    return null;
+}
+function pathParam(params) {
+    const p = params.path ?? params.file_path;
+    return typeof p === "string" && p.length > 0 ? p : null;
+}
+/** Bash bridge: does this path rule bite on the command's file arguments? */
+function bashBridgeMatches(rule, ctx) {
+    const command = typeof ctx.params.command === "string" ? ctx.params.command : "";
+    if (!command)
+        return false;
+    if (pathClassForTool(rule.toolName) === null)
+        return false;
+    for (const segment of splitSubcommands(command)) {
+        const analysis = analyzeSubcommand(segment);
+        if (analysis.kind !== "analyzed")
+            continue;
+        // Claude Code parity: a deny/ask rule for the path bites on ANY file
+        // operation the command performs on it — read-class rules are NOT
+        // limited to read ops (their `checkPathConstraints` consults the same
+        // patterns for write ops). Fail-safe: a deny is a deny.
+        for (const p of analysis.paths) {
+            if (pathMatches([resolvePatternRoot(rule.ruleContent ?? "", rule.source, {
+                    userStateHome: ctx.userStateHome,
+                    projectRoot: ctx.projectRoot,
+                    ...(ctx.homeDir ? { homeDir: ctx.homeDir } : {}),
+                })], p, { cwd: ctx.cwd })) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+/** Parse a raw rule string into a sourced PermissionRule (loader/tests). */
+export function ruleFromRaw(raw, behavior, source) {
+    const { toolName, ruleContent } = parseRuleString(raw);
+    return { behavior, source, toolName, ruleContent, raw };
+}
+//# sourceMappingURL=engine.js.map

package/dist/extension/permissionRules/loadConfig.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Permission-rule settings loader.
+ *
+ * Reads `permissions: { allow, deny, ask }` from the two YAGNI Code settings
+ * files, mirroring the hooks loader (hooks.ts) shape exactly:
+ *   - user:      ~/.yagni-code/config.json — always active
+ *   - project:   .yagni-code/config.json   — deny/ask always active;
+ *                allow gated on workspace trust (Claude Code semantics:
+ *                "deny and ask rules apply right away; allow rules from a
+ *                project file wait for trust")
+ *
+ * Lists UNION across sources (Claude Code: lists merge, never replace).
+ * User-source rules are ordered before project-source rules so path-pattern
+ * negation (`!exception`) behaves like gitignore lines across files.
+ *
+ * Fail-soft: a malformed config file is skipped whole with a warning (same
+ * posture as hooks.ts). Malformed individual rule strings parse as bare
+ * tool names (parser degrades, never throws) and are flagged.
+ */
+export type RuleSource = "user" | "project";
+export type RuleBehavior = "allow" | "deny" | "ask";
+/** A parsed, sourced permission rule. */
+export interface PermissionRule {
+    behavior: RuleBehavior;
+    source: RuleSource;
+    toolName: string;
+    ruleContent?: string;
+    /** The original rule string, for diagnostics and verdict logs. */
+    raw: string;
+}
+export interface LoadRulesDiagnostics {
+    /** Non-fatal problems: bad files, unparsed rules, unknown keys. */
+    warnings: string[];
+    /** Rule tool names that no rule consumer consults (Claude-only tools). */
+    neverConsultedTools: string[];
+}
+export interface LoadedRules {
+    rules: PermissionRule[];
+    diagnostics: LoadRulesDiagnostics;
+}
+/** The tools a rule can actually be consulted for at the gate. */
+export declare const KNOWN_RULE_TOOLS: Set<string>;
+/** Load + union rules from both files. Pure I/O; no throw. */
+export declare function loadPermissionRules(opts?: {
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    userHome?: string;
+    /** Override the user state home (tests). */
+    stateHomeOverride?: string | null;
+}): LoadedRules;
+/** Filter rules by behavior + trust (project allow needs trust; deny/ask always). */
+export declare function effectiveRules(rules: readonly PermissionRule[], isProjectTrusted: boolean): PermissionRule[];
+//# sourceMappingURL=loadConfig.d.ts.map