lyra-core 0.1.0

package/src/permission/env-redact.ts

@@ -0,0 +1,54 @@
+/**
+ * Redact secrets-bearing env vars before passing process.env to a shell
+ * subprocess. Mirrors hermes' env passthrough policy: API keys, wallet
+ * material, and provider creds never leak to a child process the brain
+ * controls. The brain may still need PATH, HOME, SHELL, LANG, TERM, etc.
+ */
+
+const ALWAYS_DENY: RegExp[] = [
+  /^LYRA_(OPERATOR|AGENT)_PRIVKEY/i,
+  /^LYRA_KEYCHAIN/i,
+  /^LYRA_TEST_AGENT_PRIVKEY/i,
+  /^OPENAI_API_KEY$/i,
+  /^ANTHROPIC_API_KEY$/i,
+  /^GOOGLE_API_KEY$/i,
+  /^GEMINI_API_KEY$/i,
+  /^GROQ_API_KEY$/i,
+  /^AZURE_OPENAI_API_KEY$/i,
+  /^DEEPSEEK_API_KEY$/i,
+  /^MISTRAL_API_KEY$/i,
+  /^TOGETHER_API_KEY$/i,
+  /^XAI_API_KEY$/i,
+  /^GH_TOKEN$/i,
+  /^GITHUB_TOKEN$/i,
+  /^GITLAB_TOKEN$/i,
+  /^NPM_TOKEN$/i,
+  /^AWS_(ACCESS_KEY_ID|SECRET_ACCESS_KEY|SESSION_TOKEN)$/i,
+  /^GCP_/i,
+  /^GOOGLE_APPLICATION_CREDENTIALS$/i,
+  /^OG_(PRIVKEY|PRIVATE_KEY|MNEMONIC)/i,
+  /_(PRIVKEY|PRIVATE_KEY|SECRET|MNEMONIC|API_KEY|AUTH_TOKEN)$/i,
+  /^DATABASE_URL$/i,
+  /^TELEGRAM_BOT_TOKEN$/i,
+  /^DISCORD_BOT_TOKEN$/i,
+  /^STRIPE_SECRET_KEY$/i,
+]
+
+export interface EnvRedactResult {
+  env: Record<string, string>
+  removed: string[]
+}
+
+export function redactEnv(env: NodeJS.ProcessEnv | Record<string, string>): EnvRedactResult {
+  const out: Record<string, string> = {}
+  const removed: string[] = []
+  for (const [k, v] of Object.entries(env)) {
+    if (typeof v !== 'string') continue
+    if (ALWAYS_DENY.some(re => re.test(k))) {
+      removed.push(k)
+      continue
+    }
+    out[k] = v
+  }
+  return { env: out, removed }
+}

package/src/permission/index.ts

@@ -0,0 +1,16 @@
+export {
+  detectDangerousCommand,
+  DANGEROUS_PATTERNS,
+  type DangerousMatch,
+  type NoMatch,
+} from './dangerous'
+export { PathGuard, type PathGuardOpts, type PathGuardResult } from './path-guard'
+export { redactEnv, type EnvRedactResult } from './env-redact'
+export {
+  PermissionService,
+  type PermissionMode,
+  type PermissionDecision,
+  type PermissionRequest,
+  type PermissionPrompter,
+  type PermissionServiceOpts,
+} from './service'

package/src/permission/path-guard.ts

@@ -0,0 +1,114 @@
+import { realpathSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { resolve } from 'node:path'
+
+/**
+ * Default denylist for `fs.write` / `fs.patch` writes. Hard-deny paths whose
+ * compromise would let the agent leak operator credentials or system state:
+ *
+ *   - SSH/AWS/GCP credential trees (~/.ssh, ~/.aws, ~/.config/gcloud)
+ *   - Dotenv-style files (.env, .env.local, etc.)
+ *   - System config (/etc/, /boot/, /usr/local/etc/)
+ *   - The lyra state tree itself (`agentDir` and parent `~/.lyra/`)
+ *     so the brain can't rewrite its own config or operator keystore.
+ *
+ * The constructor takes the agentDir explicitly so each ToolRegistry instance
+ * has the right denylist for its agent.
+ */
+export interface PathGuardOpts {
+  agentDir: string
+  /** Extra absolute paths to deny (test override). */
+  extraDeny?: string[]
+}
+
+export interface PathGuardResult {
+  allowed: boolean
+  reason?: string
+}
+
+const DEFAULT_DENY_PATTERNS: RegExp[] = [
+  /\.ssh(\/|$)/,
+  /\.aws(\/|$)/,
+  /\.config\/gcloud(\/|$)/,
+  /(^|\/)\.env(\.|$)/,
+  /^\/etc\//,
+  /^\/boot\//,
+  /^\/usr\/local\/etc\//,
+  /^\/var\/log\//,
+  /^\/sys(\/|$)/,
+  /^\/proc(\/|$)/,
+  /^\/dev(\/|$)/,
+]
+
+/**
+ * macOS `/var/folders/...` resolves to `/private/var/folders/...` via symlink;
+ * Linux is usually direct. `path.resolve()` does NOT follow symlinks, so a
+ * naive textual compare would let a brain that addresses the canonical form
+ * smuggle past the denylist. Canonicalise at construction (and at check time)
+ * so both forms are caught.
+ */
+function safeRealpath(p: string): string {
+  try {
+    return realpathSync(p)
+  } catch {
+    return p
+  }
+}
+
+/** Both forms of one denylist entry, so as-given OR canonical can match. */
+function denyEntry(p: string): string[] {
+  const raw = resolve(p)
+  const canon = safeRealpath(raw)
+  return raw === canon ? [raw] : [raw, canon]
+}
+
+export class PathGuard {
+  private readonly absolutePathsDenied: string[]
+
+  constructor(private readonly opts: PathGuardOpts) {
+    const home = homedir()
+    const lyraRoot = resolve(home, '.lyra')
+    // Each protected location contributes BOTH the raw resolve()'d form and
+    // the realpath-canonical form. macOS resolves /var/folders to /private/...
+    // and a path being checked may not exist yet (e.g. fs.write of a new file
+    // inside agentDir), so realpath at check time would return the raw form.
+    // Storing both at construction lets either match.
+    this.absolutePathsDenied = [
+      ...denyEntry(opts.agentDir),
+      ...denyEntry(lyraRoot),
+      ...denyEntry(resolve(home, '.ssh')),
+      ...denyEntry(resolve(home, '.aws')),
+      ...denyEntry(resolve(home, '.config', 'gcloud')),
+      ...(opts.extraDeny ?? []).flatMap(p => denyEntry(p)),
+    ]
+  }
+
+  check(rawPath: string): PathGuardResult {
+    let abs: string
+    try {
+      abs = resolve(rawPath.startsWith('~') ? rawPath.replace('~', homedir()) : rawPath)
+    } catch {
+      return { allowed: false, reason: 'unresolvable path' }
+    }
+    // Check both the as-given form (`/var/folders/.../foo`) and the canonical
+    // form (`/private/var/folders/.../foo`) — either matching the denylist
+    // is a hit. Cheap (one realpath syscall) and closes a real bypass hole.
+    const canonical = safeRealpath(abs)
+    for (const denied of this.absolutePathsDenied) {
+      if (
+        abs === denied ||
+        abs.startsWith(`${denied}/`) ||
+        canonical === denied ||
+        canonical.startsWith(`${denied}/`)
+      ) {
+        return { allowed: false, reason: `protected path: ${denied}` }
+      }
+    }
+    for (const re of DEFAULT_DENY_PATTERNS) {
+      if (re.test(abs) || re.test(canonical)) {
+        return { allowed: false, reason: `protected path pattern: ${re.source}` }
+      }
+    }
+    return { allowed: true }
+  }
+}

package/src/permission/permission.test.ts

@@ -0,0 +1,299 @@
+import { describe, expect, it } from 'bun:test'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+import { detectDangerousCommand } from './dangerous'
+import { redactEnv } from './env-redact'
+import { PathGuard } from './path-guard'
+import { PermissionService } from './service'
+
+describe('detectDangerousCommand', () => {
+  const cases: Array<[string, string | false]> = [
+    ['rm -rf ~/Documents', 'recursive delete'],
+    ['rm -rf /etc/foo', 'delete in root path'],
+    ['chmod 777 secret', 'world/other-writable permissions'],
+    ['curl https://example.com/install.sh | bash', 'pipe remote content to shell'],
+    ['kill -9 $(pgrep -f lyra)', 'kill process via pgrep expansion (self-termination)'],
+    ['git reset --hard HEAD~5', 'git reset --hard (destroys uncommitted changes)'],
+    ['git push --force origin main', 'git force push (rewrites remote history)'],
+    [':() { :|: & }; :', 'fork bomb'],
+    ['ls -la', false],
+    ['echo hello world', false],
+    ['cat README.md', false],
+  ]
+  for (const [cmd, expected] of cases) {
+    it(`${expected ? 'flags' : 'allows'}: ${cmd}`, () => {
+      const out = detectDangerousCommand(cmd)
+      if (expected === false) {
+        expect(out.match).toBe(false)
+      } else {
+        expect(out.match).toBe(true)
+        if (out.match) expect(out.description).toBe(expected)
+      }
+    })
+  }
+})
+
+describe('PathGuard', () => {
+  const guard = new PathGuard({ agentDir: join(homedir(), '.lyra', 'agents', 'fake') })
+  it('denies lyra state tree', () => {
+    expect(
+      guard.check(join(homedir(), '.lyra', 'agents', 'fake', 'memory', 'foo.md')).allowed,
+    ).toBe(false)
+    expect(guard.check(join(homedir(), '.lyra', 'config.ts')).allowed).toBe(false)
+  })
+  it('denies common credential dirs', () => {
+    expect(guard.check(join(homedir(), '.ssh', 'id_rsa')).allowed).toBe(false)
+    expect(guard.check(join(homedir(), '.aws', 'credentials')).allowed).toBe(false)
+  })
+  it('denies system paths', () => {
+    expect(guard.check('/etc/passwd').allowed).toBe(false)
+    expect(guard.check('/dev/sda').allowed).toBe(false)
+  })
+  it('allows everyday user paths', () => {
+    expect(guard.check(join(homedir(), 'Documents', 'foo.md')).allowed).toBe(true)
+    expect(guard.check('/tmp/sandbox.txt').allowed).toBe(true)
+  })
+  it('denies dotenv files anywhere', () => {
+    expect(guard.check('/Users/me/myproj/.env.local').allowed).toBe(false)
+  })
+})
+
+describe('redactEnv', () => {
+  it('strips wallet and api-key vars but keeps PATH', () => {
+    const { env, removed } = redactEnv({
+      PATH: '/usr/bin',
+      HOME: '/home/me',
+      LYRA_AGENT_PRIVKEY_HEX: '0xdead',
+      OPENAI_API_KEY: 'sk-x',
+      GH_TOKEN: 'ghp_x',
+      AWS_SECRET_ACCESS_KEY: 'secret',
+      MY_FAVORITE_PRIVKEY: '0xfeed',
+      GREETING: 'hello',
+    })
+    expect(env.PATH).toBe('/usr/bin')
+    expect(env.HOME).toBe('/home/me')
+    expect(env.GREETING).toBe('hello')
+    expect(env.LYRA_AGENT_PRIVKEY_HEX).toBeUndefined()
+    expect(env.OPENAI_API_KEY).toBeUndefined()
+    expect(env.GH_TOKEN).toBeUndefined()
+    expect(env.AWS_SECRET_ACCESS_KEY).toBeUndefined()
+    expect(env.MY_FAVORITE_PRIVKEY).toBeUndefined()
+    expect(removed.sort()).toEqual(
+      [
+        'LYRA_AGENT_PRIVKEY_HEX',
+        'AWS_SECRET_ACCESS_KEY',
+        'GH_TOKEN',
+        'MY_FAVORITE_PRIVKEY',
+        'OPENAI_API_KEY',
+      ].sort(),
+    )
+  })
+})
+
+describe('PermissionService', () => {
+  it('YOLO mode never blocks, never prompts', async () => {
+    let prompted = false
+    const svc = new PermissionService({
+      mode: 'off',
+      prompter: async () => {
+        prompted = true
+        return 'deny'
+      },
+    })
+    const out = await svc.resolve({
+      kind: 'shell.run',
+      command: 'rm -rf /etc',
+      reason: 'shell',
+    })
+    expect(out.allowed).toBe(true)
+    expect(out.via).toBe('yolo')
+    expect(prompted).toBe(false)
+  })
+  it('strict mode hard-denies dangerous commands', async () => {
+    let prompted = false
+    const svc = new PermissionService({
+      mode: 'strict',
+      prompter: async () => {
+        prompted = true
+        return 'allow-once'
+      },
+    })
+    const out = await svc.resolve({
+      kind: 'shell.run',
+      command: 'rm -rf ~/Documents',
+      reason: 'shell',
+    })
+    expect(out.allowed).toBe(false)
+    expect(out.via).toBe('strict-deny')
+    expect(prompted).toBe(false)
+  })
+  it('prompt mode escalates dangerous + remembers session-allow', async () => {
+    let calls = 0
+    const svc = new PermissionService({
+      mode: 'prompt',
+      prompter: async () => {
+        calls++
+        return 'allow-session'
+      },
+    })
+    const req = {
+      kind: 'shell.run' as const,
+      command: 'rm -rf /tmp/agentcache',
+      reason: 'shell',
+    }
+    const first = await svc.resolve(req)
+    expect(first.allowed).toBe(true)
+    const second = await svc.resolve(req)
+    expect(second.allowed).toBe(true)
+    expect(second.via).toBe('session-allow')
+    expect(calls).toBe(1)
+  })
+  it('prompt mode prompts on every non-dangerous shell.run too', async () => {
+    let calls = 0
+    const svc = new PermissionService({
+      mode: 'prompt',
+      prompter: async () => {
+        calls++
+        return 'allow-once'
+      },
+    })
+    await svc.resolve({ kind: 'shell.run', command: 'ls -la', reason: 'shell' })
+    await svc.resolve({ kind: 'shell.run', command: 'ls -la', reason: 'shell' })
+    expect(calls).toBe(2)
+  })
+  it('prompt mode auto-allows non-dangerous fs writes', async () => {
+    const svc = new PermissionService({ mode: 'prompt' })
+    const out = await svc.resolve({
+      kind: 'fs.write',
+      path: '/tmp/a.txt',
+      reason: 'fs.write',
+    })
+    expect(out.allowed).toBe(true)
+    expect(out.via).toBe('allow')
+  })
+  it('prompt mode deny returns a clear reason for the brain', async () => {
+    const svc = new PermissionService({
+      mode: 'prompt',
+      prompter: async () => 'deny',
+    })
+    const out = await svc.resolve({
+      kind: 'chain.send',
+      amount: '0.01',
+      recipient: '0xC635e6Eb223aE14143E23cEEa9440bC773dc87Ec',
+      token: 'Sui',
+      reason: 'native/ERC-20 transfer',
+    })
+    expect(out.allowed).toBe(false)
+    expect(out.via).toBe('deny')
+    expect(out.reason).toBe('rejected in approval modal')
+  })
+  it('setMode flips active resolution', async () => {
+    const svc = new PermissionService({ mode: 'strict' })
+    svc.setMode('off')
+    const out = await svc.resolve({
+      kind: 'shell.run',
+      command: 'rm -rf ~/Documents',
+      reason: 'shell',
+    })
+    expect(out.allowed).toBe(true)
+  })
+
+  // Deterministic policy floor: `force` requires approval beneath the mode.
+  it('force prompts even under YOLO (off) instead of silent allow', async () => {
+    let calls = 0
+    const svc = new PermissionService({
+      mode: 'off',
+      prompter: async () => {
+        calls++
+        return 'allow-once'
+      },
+    })
+    const out = await svc.resolve({
+      kind: 'chain.send',
+      amount: '5',
+      recipient: '0xC635e6Eb223aE14143E23cEEa9440bC773dc87Ec',
+      token: 'MNT',
+      reason: 'native/ERC-20 transfer',
+      force: true,
+    })
+    expect(calls).toBe(1)
+    expect(out.allowed).toBe(true)
+    expect(out.via).toBe('once')
+  })
+
+  it('force under YOLO is blocked when the operator denies', async () => {
+    const svc = new PermissionService({ mode: 'off', prompter: async () => 'deny' })
+    const out = await svc.resolve({
+      kind: 'chain.send',
+      amount: '5',
+      reason: 'native/ERC-20 transfer',
+      force: true,
+    })
+    expect(out.allowed).toBe(false)
+    expect(out.via).toBe('deny')
+  })
+
+  it('force is denied outright in strict mode without prompting', async () => {
+    let calls = 0
+    const svc = new PermissionService({
+      mode: 'strict',
+      prompter: async () => {
+        calls++
+        return 'allow-once'
+      },
+    })
+    const out = await svc.resolve({
+      kind: 'chain.send',
+      amount: '5',
+      reason: 'native/ERC-20 transfer',
+      force: true,
+    })
+    expect(calls).toBe(0)
+    expect(out.allowed).toBe(false)
+    expect(out.via).toBe('strict-deny')
+    expect(out.reason).toContain('approval required')
+  })
+
+  it('force + allow-session generalises to later identical forced requests', async () => {
+    let calls = 0
+    const svc = new PermissionService({
+      mode: 'off',
+      prompter: async () => {
+        calls++
+        return 'allow-session'
+      },
+    })
+    const req = {
+      kind: 'chain.send' as const,
+      amount: '5',
+      recipient: '0xC635e6Eb223aE14143E23cEEa9440bC773dc87Ec',
+      token: 'MNT',
+      reason: 'native/ERC-20 transfer',
+      force: true,
+    }
+    const first = await svc.resolve(req)
+    const second = await svc.resolve(req)
+    expect(calls).toBe(1)
+    expect(first.via).toBe('session-allow')
+    expect(second.via).toBe('session-allow')
+  })
+
+  it('non-forced value-moving tx still silent-allows under YOLO', async () => {
+    let calls = 0
+    const svc = new PermissionService({
+      mode: 'off',
+      prompter: async () => {
+        calls++
+        return 'deny'
+      },
+    })
+    const out = await svc.resolve({
+      kind: 'chain.send',
+      amount: '0.001',
+      reason: 'native/ERC-20 transfer',
+    })
+    expect(calls).toBe(0)
+    expect(out.allowed).toBe(true)
+    expect(out.via).toBe('yolo')
+  })
+})

package/src/permission/service.ts

@@ -0,0 +1,191 @@
+import { detectDangerousCommand } from './dangerous'
+
+/**
+ * Permission system core. Three resolution modes:
+ *   - 'strict': dangerous patterns always denied, no prompt
+ *   - 'prompt': dangerous patterns prompt the user once / for the session / deny
+ *   - 'off' (YOLO): dangerous patterns allowed silently
+ *
+ * Approvals are scoped per-session via a Set of allowed pattern keys. The
+ * service is UI-agnostic; chat.tsx wires `setPrompter()` to its own modal.
+ * In headless contexts (tests, scripted CLI) the default prompter denies.
+ */
+export type PermissionMode = 'strict' | 'prompt' | 'off'
+export type PermissionDecision = 'allow-once' | 'allow-session' | 'deny'
+
+export interface PermissionRequest {
+  kind:
+    | 'shell.run'
+    | 'shell.process'
+    | 'code.execute'
+    | 'fs.write'
+    | 'fs.patch'
+    | 'chain.send'
+    | 'chain.swap'
+    | 'chain.write'
+  command?: string
+  path?: string
+  /** For value-moving tx tools: human-readable amount (e.g. "0.05 Sui"). */
+  amount?: string
+  /** For value-moving tx tools: 0x recipient or contract address. */
+  recipient?: string
+  /** For value-moving tx tools: token symbol. */
+  token?: string
+  /** Description of why approval is needed (e.g. "delete in root path"). */
+  reason: string
+  /**
+   * Deterministic policy floor: when true, the on-chain policy engine has
+   * flagged this action as material-risk and it MUST be approved by a human
+   * regardless of the session permission mode — even under YOLO. In `strict`
+   * mode a forced request is denied outright. This is how fund controls are
+   * enforced in code rather than left to the model (CLAUDE.md).
+   */
+  force?: boolean
+}
+
+export type PermissionPrompter = (req: PermissionRequest) => Promise<PermissionDecision>
+
+export interface PermissionServiceOpts {
+  mode: PermissionMode
+  prompter?: PermissionPrompter
+}
+
+const DEFAULT_DENY_PROMPTER: PermissionPrompter = async () => 'deny'
+
+export class PermissionService {
+  private mode: PermissionMode
+  private prompter: PermissionPrompter
+  private readonly sessionAllowed = new Set<string>()
+
+  constructor(opts: PermissionServiceOpts) {
+    this.mode = opts.mode
+    this.prompter = opts.prompter ?? DEFAULT_DENY_PROMPTER
+  }
+
+  setMode(mode: PermissionMode): void {
+    this.mode = mode
+  }
+
+  setPrompter(p: PermissionPrompter): void {
+    this.prompter = p
+  }
+
+  isYolo(): boolean {
+    return this.mode === 'off'
+  }
+
+  getMode(): PermissionMode {
+    return this.mode
+  }
+
+  /**
+   * Resolve a permission for a tool call.
+   *   - `force` (policy floor): material-risk per the on-chain policy — prompt
+   *     beneath any mode; deny in strict; even YOLO must approve.
+   *   - YOLO ('off'): otherwise always allow.
+   *   - Strict: dangerous pattern => deny, otherwise allow.
+   *   - Prompt: dangerous pattern OR shell.run => consult `prompter`,
+   *     honour session-allow on subsequent identical signatures.
+   */
+  async resolve(req: PermissionRequest): Promise<{
+    allowed: boolean
+    reason?: string
+    via: 'yolo' | 'allow' | 'session-allow' | 'once' | 'deny' | 'strict-deny'
+  }> {
+    const dangerous = req.command ? detectDangerousCommand(req.command) : { match: false as const }
+
+    // Signature for session-allow tracking. When the request matched a
+    // dangerous pattern, key on the PATTERN (e.g. "delete in root path") so
+    // the user's "allow session" covers every match of the same pattern for
+    // the rest of the session, not just the literal command.
+    const sigKey = dangerous.match ? this.signature(req, dangerous.key) : this.signature(req)
+    if (this.sessionAllowed.has(sigKey)) {
+      return { allowed: true, via: 'session-allow' }
+    }
+
+    // Deterministic policy floor: a `force`-flagged action is material-risk per
+    // the on-chain policy engine and requires human approval BENEATH the
+    // session mode — even under YOLO. strict denies it outright; otherwise it
+    // consults the prompter regardless of mode. Fund controls live in code.
+    if (req.force) {
+      if (this.mode === 'strict') {
+        return {
+          allowed: false,
+          reason: `${req.reason} (policy: approval required, denied in strict mode)`,
+          via: 'strict-deny',
+        }
+      }
+      const decision = await this.prompter(req)
+      return this.applyDecision(decision, sigKey)
+    }
+
+    if (this.mode === 'off') return { allowed: true, via: 'yolo' }
+
+    // Value-moving on-chain tools: ALWAYS prompt in `prompt` mode regardless
+    // of dangerous-pattern match (which is regex-based and doesn't fire here).
+    // In `strict` mode they're denied — strict means "no autonomous spending".
+    const isValueMoving =
+      req.kind === 'chain.send' || req.kind === 'chain.swap' || req.kind === 'chain.write'
+    if (this.mode === 'strict') {
+      if (isValueMoving) {
+        return {
+          allowed: false,
+          reason: 'value-moving tx denied in strict mode',
+          via: 'strict-deny',
+        }
+      }
+      if (dangerous.match) {
+        return { allowed: false, reason: dangerous.description, via: 'strict-deny' }
+      }
+      return { allowed: true, via: 'allow' }
+    }
+
+    // mode === 'prompt': dangerous patterns + every shell-class invocation
+    // + every value-moving on-chain tx consult the prompter.
+    if (dangerous.match) {
+      const decision = await this.prompter({ ...req, reason: dangerous.description })
+      return this.applyDecision(decision, sigKey)
+    }
+    if (
+      req.kind === 'shell.run' ||
+      req.kind === 'shell.process' ||
+      req.kind === 'code.execute' ||
+      isValueMoving
+    ) {
+      const decision = await this.prompter(req)
+      return this.applyDecision(decision, sigKey)
+    }
+    return { allowed: true, via: 'allow' }
+  }
+
+  /**
+   * Approve a fs.write/fs.patch path explicitly (skip prompter). Tests use
+   * this; chat.tsx wires it through the approval modal.
+   */
+  approveSession(req: PermissionRequest): void {
+    this.sessionAllowed.add(this.signature(req))
+  }
+
+  private applyDecision(
+    decision: PermissionDecision,
+    sigKey: string,
+  ): { allowed: boolean; reason?: string; via: 'session-allow' | 'once' | 'deny' } {
+    if (decision === 'allow-session') {
+      this.sessionAllowed.add(sigKey)
+      return { allowed: true, via: 'session-allow' }
+    }
+    if (decision === 'allow-once') return { allowed: true, via: 'once' }
+    return { allowed: false, reason: 'rejected in approval modal', via: 'deny' }
+  }
+
+  private signature(req: PermissionRequest, dangerousKey?: string): string {
+    // For dangerous-pattern matches, key on the pattern type ("delete in
+    // root path", "recursive delete", ...) so allow-session generalises
+    // across every command that triggers the same pattern. Without this,
+    // each unique rm path was a fresh decision.
+    if (dangerousKey) return `${req.kind}|dangerous:${dangerousKey}`
+    return [req.kind, req.command ?? '', req.path ?? '', req.recipient ?? '', req.token ?? ''].join(
+      '|',
+    )
+  }
+}