agent-from-zero 0.36.0 → 0.37.0

package/dist/config.js

@@ -111,6 +111,7 @@ export const CONFIG = {
         // the test suite injects rules here instead of writing temp files.
         allow: [...(globalSettings.permissions?.allow ?? []), ...(projectSettings.permissions?.allow ?? [])],
         deny: [...(globalSettings.permissions?.deny ?? []), ...(projectSettings.permissions?.deny ?? [])],
+        ask: [...(globalSettings.permissions?.ask ?? []), ...(projectSettings.permissions?.ask ?? [])],
     },
     // Hooks for every event, merged across layers (global first, then project) by
     // a generic union so adding a new event needs no edit here.

package/dist/loop.js

@@ -744,8 +744,14 @@ async function authorizeCall(call, opts) {
             emit("agent_tool_declined", { tool: call.name, ...(reviewId ? { reviewId } : {}) }); // the human said no — that is signal
         if (!ok && !opts.quiet)
             sink(opts).note(mark.declined); // make the refusal visible
-        if (!ok)
+        if (!ok) {
+            // Say what actually happened. An unattended worker was never declined by
+            // anyone — saying so teaches the model to rephrase and retry against a
+            // refusal that never existed.
+            if (opts.canPrompt === false)
+                return `[permission] Nobody is reachable to approve this here${reviewReason ? `: ${reviewReason}` : "."} Not executed. Report it in your result and continue with what the rules allow; do not retry the same effect through another tool, wrapper or worker.`;
             return `[permission] Action not approved${reviewReason ? `: ${reviewReason}` : ". The user declined this action"}. Ask the user how to proceed, or choose a safer alternative.`;
+        }
     }
     if (opts.reviewBudget?.exhausted)
         return "[permission] Review limit reached; not executed. Wait for human direction.";

package/dist/permissions.js

@@ -3,6 +3,7 @@ import fs from "node:fs"; // resolve symlinks before auto mode grants file acces
 import os from "node:os"; // `cd ~` in the recoverable-shell analyzer
 import { execFileSync } from "node:child_process"; // ask git whether a deletion target is disposable
 import { CONFIG } from "./config.js"; // user-configured allow/deny rules from settings files
+import { emit } from "./telemetry.js"; // a bypassed approval leaves an audit row, not silence
 // ---- The no-fly zone --------------------------------------------------------
 // Writes here are never OK, in any mode. .git can destroy history, shell rc
 // files inject code into every future terminal, .ssh/.env leak credentials.
@@ -442,6 +443,18 @@ export function recoverableShell(command) {
     }
     return readOnly ? { readOnly, reason: "read-only command" } : { readOnly, reason: "recoverable: git can undo it, or it only removes gitignored or temp files" };
 }
+// ---- The user's prod guard (permissions.ask) ----------------------------------
+// Text that always needs a human: a prod context, a deployment verb, a prod
+// path. Checked BEFORE auto review and BEFORE the bypass rewrite, so neither
+// can approve it. Case-insensitive substring, on the whole command or the path.
+function guardHit(text) {
+    const haystack = text.toLowerCase();
+    for (const rule of CONFIG.permissions.ask ?? []) {
+        if (rule && haystack.includes(rule.toLowerCase()))
+            return rule;
+    }
+    return null;
+}
 // Decide what a bash command deserves: deny, ask, or allow.
 function checkBash(command, auto = false) {
     const summary = command.trim(); // what the user will see in the prompt
@@ -458,6 +471,9 @@ function checkBash(command, auto = false) {
     for (const d of user.deny)
         if (command.toLowerCase().includes(d.toLowerCase()))
             return { decision: "deny", reason: `denied by your settings ("${d}")`, summary };
+    const guard = guardHit(command);
+    if (guard)
+        return { decision: "ask", requiresHuman: true, reason: `prod guard: "${guard}"`, summary };
     // node/npm/npx, git aliases and tool-wide grants can run arbitrary code.
     // Auto mode must inspect the actual command, including background commands.
     if (auto) {
@@ -539,7 +555,11 @@ export function checkPermission(toolName, argsJson, auto = false) {
             summary: base.summary,
         };
     }
-    if (CONFIG.bypassPermissions && base.decision === "ask" && toolName !== "exit_plan_mode" && toolName !== "ask_user") {
+    if (CONFIG.bypassPermissions && base.decision === "ask" && !base.requiresHuman && toolName !== "exit_plan_mode" && toolName !== "ask_user") {
+        // Bypass may skip an ordinary approval, never one the user's own guard list
+        // marked for a human. Every skip is recorded: a bypass run with no audit row
+        // is indistinguishable from a run that never checked.
+        emit("agent_permission_bypassed", { tool: toolName, reason: base.reason });
         return { decision: "allow", reason: "permission approvals bypassed for this run", summary: base.summary };
     }
     return base;
@@ -645,6 +665,9 @@ function basePermission(toolName, argsJson, auto) {
             const hit = noFlyHit(p); // is it in the no-fly zone?
             if (hit)
                 return { decision: "deny", reason: hit, summary: p }; // hard stop — deny always wins
+            const guard = guardHit(p); // the user's prod guard, applied to the path
+            if (guard)
+                return { decision: "ask", requiresHuman: true, reason: `prod guard: "${guard}"`, summary: p };
             // The user may pre-approve write tools ("tool:edit_file") to skip the
             // prompt — note this runs AFTER the no-fly check, so it widens "ask",
             // never "deny".

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-from-zero",
-  "version": "0.36.0",
+  "version": "0.37.0",
   "type": "module",
   "bin": {
     "mini-agent": "dist/agent.js"