one-code-extension 0.1.4 → 0.3.1

package/extensions/permissions/modes.ts

@@ -28,15 +28,59 @@ export interface CycleOptions {
 	autoInCycle: boolean;
 }
 
+/** Strip a trailing release-date stamp (`-20250601`), noise in a model id. */
+function stripDateSuffix(id: string): string {
+	return id.replace(/-20\d{6}$/, "");
+}
+
 /**
- * Shorten a model id for the footer, which has little room. Drops an OpenRouter
- * style `vendor/` prefix and a trailing date stamp, both of which are noise once
- * the family name is visible: `anthropic/claude-haiku-4-5-20251001` → `haiku-4-5`.
+ * Shorten a model id for a compact slot. Drops an OpenRouter style `vendor/`
+ * prefix and a trailing date stamp, both of which are noise once the family name
+ * is visible: `anthropic/claude-haiku-4-5-20251001` → `haiku-4-5`.
  */
 export function shortModelName(id: string): string {
 	const afterSlash = id.slice(id.lastIndexOf("/") + 1);
-	const undated = afterSlash.replace(/-20\d{6}$/, "");
-	return undated.replace(/^(claude|gpt|gemini|llama|grok|mistral|deepseek|qwen)-/, "");
+	return stripDateSuffix(afterSlash).replace(/^(claude|gpt|gemini|llama|grok|mistral|deepseek|qwen)-/, "");
+}
+
+/**
+ * Model as `(provider) id`, e.g. `(openrouter) google/gemini-3.7-flash`. One
+ * Code runs on any provider, so the provider and the full vendor-qualified id
+ * both matter — a bare short name hides which model an aggregator route points
+ * at. Only the noisy trailing date (`-20250601`) is trimmed. Used by the footer
+ * and the startup banner so both name models the same way.
+ */
+export function formatModel(provider: string, id: string): string {
+	const undated = stripDateSuffix(id);
+	return provider ? `(${provider}) ${undated}` : undated;
+}
+
+/**
+ * Same as `formatModel` for a combined `provider/id` spec (what the subagent
+ * status carries): the first path segment is the provider, the rest is the id
+ * (which may itself contain slashes, e.g. `openrouter/google/gemini-3.7-flash`).
+ */
+export function formatModelSpec(spec: string): string {
+	const slash = spec.indexOf("/");
+	if (slash < 0) return formatModel("", spec);
+	return formatModel(spec.slice(0, slash), spec.slice(slash + 1));
+}
+
+/**
+ * pi's placeholder model id when no provider is configured yet. A fresh machine
+ * with no key reports `{ provider: "unknown", id: "unknown" }`, which
+ * `formatModel` would render as the meaningless `(unknown) unknown`
+ * (distribution review 2026-09-09, M3). The banner and footer show "none"
+ * instead, so the first screen reads as "no provider" rather than a broken model.
+ */
+export const PLACEHOLDER_MODEL = "unknown";
+
+/**
+ * True when `id` names a real selected model, not pi's no-provider placeholder.
+ * A type predicate so callers narrow the id to `string` in the true branch.
+ */
+export function isRealModel(id: string | undefined): id is string {
+	return !!id && id !== PLACEHOLDER_MODEL;
 }
 
 /**
@@ -54,9 +98,13 @@ export const CYCLE_KEY_HINT = "ctrl+q to cycle";
  * the way Claude Code's footer does, so the shortcut sits next to the state it
  * changes.
  */
-export function modeBadge(mode: PermissionMode, opts?: { paused?: boolean; classifierModel?: string }): string {
+export function modeBadge(
+	mode: PermissionMode,
+	opts?: { paused?: boolean; classifierModel?: string; streaming?: boolean },
+): string {
 	const base = badgeBase(mode, opts);
-	return `${base} (${CYCLE_KEY_HINT})`;
+	// Claude Code appends the interrupt hint to this line while the model works.
+	return `${base} (${CYCLE_KEY_HINT})${opts?.streaming ? " · esc to interrupt" : ""}`;
 }
 
 function badgeBase(mode: PermissionMode, opts?: { paused?: boolean; classifierModel?: string }): string {

package/extensions/permissions/project-trust.ts

@@ -0,0 +1,81 @@
+/**
+ * Consent for a repository's own allow rules. `.claude/settings.json` and
+ * `.claude/settings.local.json` travel with the checkout, so an allow rule in
+ * them is a grant made by whoever committed the file, not by the user running
+ * One Code — and in auto mode a rule beats the classifier, so a cloned repo
+ * shipping `Bash(curl:*)` would exfiltrate unclassified. Project hooks and
+ * project `.mcp.json` servers already need a once-per-config consent
+ * (hooks/trust.ts, mcp/trust.ts); this is the same shape for allow rules:
+ * approval keyed to a hash of the rule list, persisted under `~/.onecode`, so
+ * any change to the rules re-prompts. Deny and ask rules from the same files
+ * never prompt — they can only tighten the gate.
+ *
+ * The prompt is lazy: it appears the first time a project rule would be the
+ * deciding allow, not at startup (most sessions never hit one). A declined
+ * prompt sticks for the process, not on disk. Pure fs + hashing here; the
+ * permissions extension owns the dialog.
+ */
+
+import { createHash } from "node:crypto";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { oneCodeStateDir } from "../lib/paths.ts";
+
+interface ApprovalStore {
+	version: 1;
+	approvals: Record<string, { rulesHash: string; approvedAt: string }>;
+}
+
+export function projectAllowStorePath(): string {
+	return join(oneCodeStateDir(), "permissions", "project-allow-approvals.json");
+}
+
+/** Order-insensitive: the same rules in another order are one consent. */
+export function hashProjectAllow(rules: readonly string[]): string {
+	return createHash("sha256").update(JSON.stringify([...rules].sort())).digest("hex");
+}
+
+export function readStoredProjectAllowApproval(projectRoot: string, storePath = projectAllowStorePath()): string | undefined {
+	try {
+		const store = JSON.parse(readFileSync(storePath, "utf-8")) as ApprovalStore;
+		return store.approvals?.[projectRoot]?.rulesHash;
+	} catch {
+		return undefined;
+	}
+}
+
+/** True when the stored consent covers exactly this rule list. */
+export function projectAllowApproved(projectRoot: string, rules: readonly string[], storePath = projectAllowStorePath()): boolean {
+	return rules.length > 0 && readStoredProjectAllowApproval(projectRoot, storePath) === hashProjectAllow(rules);
+}
+
+export function persistProjectAllowApproval(projectRoot: string, rules: readonly string[], storePath = projectAllowStorePath()): void {
+	let store: ApprovalStore = { version: 1, approvals: {} };
+	try {
+		const existing = JSON.parse(readFileSync(storePath, "utf-8")) as ApprovalStore;
+		if (existing && typeof existing === "object" && existing.approvals) store = existing;
+	} catch {
+		// Fresh store.
+	}
+	store.approvals[projectRoot] = { rulesHash: hashProjectAllow(rules), approvedAt: new Date().toISOString() };
+	try {
+		mkdirSync(dirname(storePath), { recursive: true });
+		writeFileSync(storePath, `${JSON.stringify(store, null, "\t")}\n`);
+	} catch {
+		// Approval still holds for this session; it will just re-prompt next run.
+	}
+}
+
+/** The consent dialog's text: what the repository wants pre-approved, and which rule fired now. */
+export function describeProjectAllow(rules: readonly string[], firing: string): { title: string; message: string } {
+	const shown = rules.slice(0, 8);
+	const more = rules.length > shown.length ? `\n… and ${rules.length - shown.length} more` : "";
+	return {
+		title: "Trust this repository's allow rules?",
+		message:
+			`This repository's .claude settings pre-approve ${rules.length} permission rule(s):\n${shown.join("\n")}${more}\n\n` +
+			`The current call matches "${firing}" and would run without a prompt` +
+			" (in auto mode, without the classifier). Whoever committed the file granted this, not you." +
+			" Approval is remembered until the rules change; declining keeps them off for this session.",
+	};
+}

package/extensions/permissions/protected-paths.ts

@@ -29,15 +29,22 @@ const PROTECTED_DIRS = [
 	// One Code's own state dir — the deny-direction twin of protecting `.claude`:
 	// as generated state moves here, a write that reconfigures the gate must
 	// stay just as guarded in its new home.
-	".one-code",
+	".onecode",
+	// Run-at-login and on-PATH locations (PERMISSIONS-REVIEW-2026-09-05 M7): a
+	// launchd agent plist runs at the next login, a fish config at the next
+	// shell, and `~/.local/bin` is where the `pi` shim and user tools live.
+	// Lowercase — segments are compared case-folded.
+	"library/launchagents",
+	".config/fish",
+	".local/bin",
 ];
 
 /**
  * `.claude/worktrees` is where the agent keeps its own git worktrees, and
- * `.one-code/plans` holds plan-mode documents (rendered to the user, never
+ * `.onecode/plans` holds plan-mode documents (rendered to the user, never
  * executed) — ordinary working space rather than configuration.
  */
-const PROTECTED_DIR_EXCEPTIONS = [".claude/worktrees", ".one-code/plans"];
+const PROTECTED_DIR_EXCEPTIONS = [".claude/worktrees", ".onecode/plans"];
 
 const PROTECTED_FILES = new Set([
 	".gitconfig",
@@ -77,6 +84,10 @@ const PROTECTED_FILES = new Set([
 	"pyrightconfig.json",
 	".mcp.json",
 	".claude.json",
+	// Claude Code's managed (organisation) settings: the highest-authority
+	// permission and auto-mode configuration. Protected in every mode, not only
+	// where the auto-mode safety floor covers it (review P9).
+	"managed-settings.json",
 ]);
 
 // `isWritingTool` / `WRITING_TOOLS` live in auto-mode/paths.ts (the shared lower
@@ -88,6 +99,8 @@ export { isWritingTool } from "../auto-mode/paths.ts";
  * Whether a path is protected. Matched on path *segments* so the check works
  * for absolute paths, cwd-relative ones, and any depth of nesting — a
  * `packages/app/.vscode/settings.json` is as protected as a top-level one.
+ * pi's own agent directory is protected at runtime, not here — its location
+ * is `getAgentDir()`'s to know (`DecideInput.protectedDirs`).
  */
 export function isProtectedPath(candidate: string, cwd?: string): boolean {
 	const forward = candidate.replace(/\\/g, "/").toLowerCase();

package/extensions/permissions/rule-prose.ts

@@ -0,0 +1,79 @@
+/**
+ * The user's own deny rules, rendered for the approval classifier (pure).
+ *
+ * A permission rule binds the spelling it names and nothing else. `Bash(rm:*)`
+ * refuses `rm scripts/build.sh` and has no opinion about
+ * `python3 -c "import os; os.remove('scripts/build.sh')"`, which is how a
+ * tiny-tier model deleted the file anyway, 3 times out of 3
+ * (WEAK-MODEL-REVIEW-2026-09-06 H2). The rule cannot be widened
+ * deterministically — an earlier attempt remembered the denied path and refused
+ * every later call naming it, which caught the retry but also refused a
+ * harmless later edit of the same file for the rest of the session, and never
+ * caught a FIRST attempt (nothing has been denied yet, so there is nothing to
+ * remember).
+ *
+ * Only something that judges by effect can generalize a rule, so the rules go
+ * to the classifier. This is one-directional, like every other model layer
+ * here: the rule still fires deterministically on its literal form before any
+ * model is consulted, so the classifier can only add blocks the spelling missed
+ * and can never clear something a rule already refused.
+ *
+ * The lines are appended at Claude Code's own HARD BLOCK injection point
+ * (`classifier-prompt.ts buildRuleset`), which is the sanctioned append-only
+ * surface, so prompt fidelity is untouched. They are indexed by the same scan
+ * as the built-in rules (`rules.ts`), so a verdict citing one grounds.
+ */
+
+import { parseRule } from "./matcher.ts";
+
+/** Bound on how many rules are described, so a long deny list cannot dominate the ruleset. */
+const MAX_RULES = 25;
+
+/**
+ * Bound on the quoted rule spec, so a pathological pattern cannot dominate
+ * either. The bound is on the SPEC and not on the finished line: clipping the
+ * line would cut the instruction off its own rule.
+ */
+const MAX_SPEC = 120;
+
+/**
+ * A rule name must survive `ruleNameFromLine`, which cuts at the first `:` or
+ * ` [`. Rule specs contain both (`Bash(rm:*)`, `Read(~/**)`), so the name
+ * carries a punctuation-stripped form and the verbatim spec goes in the body.
+ */
+function nameFragment(spec: string): string {
+	// The rule's own spelling, not the normalized tool name: this name is what the
+	// user is shown when a verdict cites the rule, so `WebFetch` should not come
+	// back as `web_fetch`.
+	const cleaned = spec
+		.replace(/[:[\]`*()]/g, " ")
+		.replace(/\s+/g, " ")
+		.trim();
+	return cleaned.slice(0, 60).trim();
+}
+
+/**
+ * One HARD BLOCK line per deny rule. `ask` rules are deliberately NOT rendered:
+ * an ask rule asks for a decision, and auto mode already routes those to the
+ * classifier — turning them into block rules would convert "check with me" into
+ * "never", which is not what the user wrote.
+ */
+export function denyRuleLines(deny: readonly string[]): string[] {
+	const lines: string[] = [];
+	const seen = new Set<string>();
+	for (const raw of deny) {
+		if (lines.length >= MAX_RULES) break;
+		const rule = parseRule(raw);
+		if (!rule) continue;
+		const full = rule.raw.replace(/[\n\r]+/g, " ").trim();
+		if (!full || seen.has(full)) continue;
+		seen.add(full);
+		const spec = full.length > MAX_SPEC ? `${full.slice(0, MAX_SPEC - 1)}…` : full;
+		lines.push(
+			`User Deny Rule ${nameFragment(spec)}: the user's own settings deny \`${spec}\`. ` +
+				"That is the user's standing decision about a CLASS of action, made in advance, so user intent does NOT clear it. " +
+				"BLOCK the action under review if it would achieve what that rule forbids, whatever command, interpreter, script or tool it is spelled with.",
+		);
+	}
+	return lines;
+}

package/extensions/permissions/session-grant.ts

@@ -0,0 +1,91 @@
+/**
+ * What "Yes, and don't ask again this session" grants (pure).
+ *
+ * Until 2026-09-05 the option minted a bare tool rule for every tool but bash:
+ * one approved in-project write granted every write to every path for the rest
+ * of the process, one fetch every URL, one MCP call every argument, and in auto
+ * mode the minted rule stood as a classifier bypass for that tool
+ * (PERMISSIONS-REVIEW-2026-09-05 M2). Claude Code's equivalents are scoped —
+ * "allow all edits during this session" is working-directory-scoped, WebFetch
+ * grants a domain — and the option names what it grants. So does this: the
+ * grant is scoped by the subject's kind (permissions/matcher.ts `subjectKind`),
+ * the label says exactly what it covers, and there is no grant at all where a
+ * rule could not matter (a protected path, the auto-mode safety floor — both are
+ * checked before allow rules) or where the classifier is the boundary (auto
+ * mode: session allows are never applied there).
+ */
+
+import { dirname } from "node:path";
+import { toAbsolute } from "../auto-mode/paths.ts";
+import { escapeLiteral, isAtOrInsideDir, normalizeToolName, parseRule, type PermissionMode, type PermissionRule, subjectKind, urlHost } from "./matcher.ts";
+
+export interface SessionGrant {
+	/** The rule to add to the session's allow list when the user picks this option. */
+	rule: PermissionRule;
+	/** The option label, naming the scope granted. */
+	label: string;
+}
+
+export interface SessionGrantInput {
+	toolName: string;
+	/** The subject the prompt shows (the original command in a worktree session). */
+	subject: string;
+	/** The directory the call runs in (a worktree's path in a worktree session). */
+	cwd: string;
+	mode: PermissionMode;
+	/** The `decide()` cause behind the prompt. */
+	cause: string;
+	/** The auto-mode safety floor raised this prompt — no rule can cover it. */
+	floor?: boolean;
+	home: string;
+}
+
+/** `~`-abbreviated path for a label. */
+function displayPath(path: string, home: string): string {
+	return path === home ? "~" : path.startsWith(`${home}/`) ? `~/${path.slice(home.length + 1)}` : path;
+}
+
+/** Claude Code's `//absolute` rule form for a directory and everything under it. */
+function absoluteDirPattern(dir: string): string {
+	return `/${dir.replace(/\/+$/, "")}/**`;
+}
+
+export function sessionGrant(input: SessionGrantInput): SessionGrant | undefined {
+	const { subject, cwd, mode, cause, home } = input;
+	// Auto mode never applies session allows (the classifier is the boundary and
+	// its prompts are resume/floor prompts, not per-action approvals); protected
+	// paths and the safety floor are judged before allow rules, so a rule minted
+	// here could never cover them.
+	if (mode === "auto" || input.floor || cause === "protected-path") return undefined;
+
+	const tool = normalizeToolName(input.toolName);
+	const mint = (raw: string, label: string): SessionGrant | undefined => {
+		const rule = parseRule(raw);
+		return rule ? { rule, label } : undefined;
+	};
+
+	switch (subjectKind(tool)) {
+		case "command":
+			// The approved command, as an exact literal — never a glob.
+			if (!subject) return undefined;
+			return mint(`${tool}(${escapeLiteral(subject)})`, "Yes, and don't ask again for this exact command this session");
+		case "path": {
+			if (!subject) return undefined;
+			const absolute = toAbsolute(cwd, subject, home);
+			// Inside the working directory this is Claude Code's "allow all edits
+			// during this session"; outside, the grant stops at the file's directory.
+			if (isAtOrInsideDir(absolute, cwd, cwd)) {
+				return mint(`${tool}(${absoluteDirPattern(cwd)})`, `Yes, and allow ${tool} anywhere in the working directory this session`);
+			}
+			const dir = dirname(absolute);
+			return mint(`${tool}(${absoluteDirPattern(dir)})`, `Yes, and allow ${tool} under ${displayPath(dir, home)} this session`);
+		}
+		case "url": {
+			const host = urlHost(subject);
+			if (!host) return undefined;
+			return mint(`${tool}(domain:${host})`, `Yes, and don't ask again for ${host} this session`);
+		}
+		case "text":
+			return mint(tool, `Yes, and don't ask again for ${tool} this session`);
+	}
+}

package/extensions/permissions/settings.ts

@@ -2,23 +2,55 @@
  * Claude Code settings.json permissions loading/merging/persistence (pure fs).
  *
  * Sources, lowest to highest precedence:
- *   ~/.claude/settings.json          (user)
- *   <cwd>/.claude/settings.json      (project, checked in)
- *   <cwd>/.claude/settings.local.json (project, personal)
+ *   ~/.claude/settings.json               (user, borrowed — read only)
+ *   ~/.onecode/settings.json             (One Code global — read + write)
+ *   <cwd>/.claude/settings.json           (project, checked in — read only)
+ *   <cwd>/.claude/settings.local.json     (project, personal — read only)
+ *   ~/.onecode/projects/<slug>/settings.json (One Code per repo — read + write)
+ *   <managed-settings.json>                (organisation policy — read only, highest)
  *
- * allow/deny/ask arrays concatenate across sources; defaultMode from the most
- * specific source wins. Unknown keys in the files are preserved on write.
+ * allow/deny/ask arrays concatenate across sources — except that the two
+ * in-repo files' allow rules land in `projectAllow`, gated behind consent
+ * (review P10); defaultMode from the most specific `.claude` source wins, with
+ * managed settings above all (the One Code files contribute rules only).
+ * One Code persists the rules it records to its own files, never into Claude
+ * Code's — `persistAllowRule` is pointed at a One Code path by its caller.
+ * Unknown keys in the files are preserved on write.
  */
 
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { managedSettingsPaths } from "../auto-mode/config.ts";
+import { readSettingsFile as readClaudeSettingsFile, settingsPaths } from "../lib/claude-settings.ts";
+import {
+	oneCodeProjectSettingsPath,
+	oneCodeSettingsPath,
+	readSettingsForWrite,
+	writeSettings,
+} from "../lib/one-code-settings.ts";
 import type { PermissionMode } from "./matcher.ts";
 
+export { settingsPaths };
+
 export interface PermissionSettings {
+	/** Allow rules from sources the user wrote or that outrank the repo (user, One Code, managed). */
 	allow: string[];
+	/**
+	 * Allow rules from the repository's own `.claude/settings.json` /
+	 * `settings.local.json`. A checked-in file pre-approving `Bash(curl:*)` is a
+	 * grant the user never made, so these apply only after a once-per-config
+	 * consent (project-trust.ts) — deny and ask rules from the same files load
+	 * freely, since they can only tighten the gate.
+	 */
+	projectAllow: string[];
 	deny: string[];
 	ask: string[];
 	defaultMode?: PermissionMode;
+	/**
+	 * Claude Code's `permissions.disableBypassPermissionsMode: "disable"` seen in
+	 * any source: bypassPermissions is refused however it is requested (flag,
+	 * `--dangerously-skip-permissions`, settings). A restriction, so every scope
+	 * may set it — the repo included.
+	 */
+	disableBypassPermissionsMode?: boolean;
 }
 
 interface ClaudeSettingsFile {
@@ -27,10 +59,26 @@ interface ClaudeSettingsFile {
 		deny?: string[];
 		ask?: string[];
 		defaultMode?: string;
+		disableBypassPermissionsMode?: string;
 	};
 	[key: string]: unknown;
 }
 
+/**
+ * Modes a repository's own files (`<cwd>/.claude/settings.json`,
+ * `settings.local.json`) may NOT select — honoured from user and managed scope
+ * only. Both files live in the checkout, so honouring these there lets a cloned
+ * repo grant itself the mode: `auto`, whose classifier is what contains it
+ * (Claude Code makes the same exclusion), and `bypassPermissions`, which has no
+ * classifier, no prompt and no protected path at all — the footer badge is the
+ * only sign (PERMISSIONS-REVIEW-2026-09-05 H3, measured: a checked-in
+ * `bypassPermissions` ran an outside-project write with no prompt). `dontAsk`
+ * and `acceptEdits` stay honoured: neither can approve what default mode would
+ * not (dontAsk turns asks into denials; acceptEdits is confined to the working
+ * directory).
+ */
+export const MODES_NEVER_FROM_PROJECT: ReadonlySet<PermissionMode> = new Set<PermissionMode>(["auto", "bypassPermissions"]);
+
 const MODES: PermissionMode[] = ["default", "acceptEdits", "plan", "bypassPermissions", "dontAsk", "auto"];
 
 /** Display-name aliases Claude Code accepts wherever a mode is named. */
@@ -47,39 +95,41 @@ export function normalizePermissionMode(value: unknown): PermissionMode | undefi
 }
 
 function readSettingsFile(path: string): ClaudeSettingsFile | undefined {
-	if (!existsSync(path)) return undefined;
-	try {
-		return JSON.parse(readFileSync(path, "utf-8")) as ClaudeSettingsFile;
-	} catch {
-		return undefined;
-	}
-}
-
-export function settingsPaths(cwd: string, home: string): { user: string; project: string; local: string } {
-	return {
-		user: join(home, ".claude", "settings.json"),
-		project: join(cwd, ".claude", "settings.json"),
-		local: join(cwd, ".claude", "settings.local.json"),
-	};
+	// Shared reader (lib/claude-settings.ts) — this module narrows to the
+	// permissions-relevant shape.
+	return readClaudeSettingsFile(path) as ClaudeSettingsFile | undefined;
 }
 
 export function loadPermissionSettings(cwd: string, home: string): PermissionSettings {
 	const paths = settingsPaths(cwd, home);
-	const merged: PermissionSettings = { allow: [], deny: [], ask: [] };
+	const merged: PermissionSettings = { allow: [], projectAllow: [], deny: [], ask: [] };
+
+	// One Code writes the rules it records (via /allow, the auto-mode setup) to its
+	// own files, never into Claude Code's — so its own files are read alongside the
+	// borrowed `.claude` ladder. They contribute allow/deny/ask rules only;
+	// `defaultMode` stays sourced from the `.claude` files (nothing here writes it,
+	// and keeping the auto-mode reasoning to one place avoids a second `auto` path).
+	const oneCodeGlobal = oneCodeSettingsPath(home);
+	const oneCodeProject = oneCodeProjectSettingsPath(cwd, home);
 
-	for (const path of [paths.user, paths.project, paths.local]) {
+	// Managed settings last: Claude Code's organisation policy outranks every
+	// user/project file, for rules and for defaultMode alike (review P14).
+	const managed = managedSettingsPaths();
+	for (const path of [paths.user, oneCodeGlobal, paths.project, paths.local, oneCodeProject, ...managed]) {
 		const file = readSettingsFile(path);
 		const perms = file?.permissions;
 		if (!perms) continue;
-		if (Array.isArray(perms.allow)) merged.allow.push(...perms.allow.filter((r) => typeof r === "string"));
+		const allowTarget = path === paths.project || path === paths.local ? merged.projectAllow : merged.allow;
+		if (Array.isArray(perms.allow)) allowTarget.push(...perms.allow.filter((r) => typeof r === "string"));
 		if (Array.isArray(perms.deny)) merged.deny.push(...perms.deny.filter((r) => typeof r === "string"));
 		if (Array.isArray(perms.ask)) merged.ask.push(...perms.ask.filter((r) => typeof r === "string"));
+		if (perms.disableBypassPermissionsMode === "disable") merged.disableBypassPermissionsMode = true;
+		if (path === oneCodeGlobal || path === oneCodeProject) continue;
 		const defaultMode = normalizePermissionMode(perms.defaultMode);
-		// `auto` is honoured from user settings only. Both project files live in the
-		// repository, so accepting it there would let a checked-in file put the
-		// session into auto mode — a repo granting itself the looser mode whose
-		// classifier is what contains it. Claude Code makes the same exclusion.
-		if (defaultMode && !(defaultMode === "auto" && path !== paths.user)) {
+		// The modes a repo may not grant itself (MODES_NEVER_FROM_PROJECT) are
+		// honoured from user and managed scope only.
+		const fromProject = path === paths.project || path === paths.local;
+		if (defaultMode && !(fromProject && MODES_NEVER_FROM_PROJECT.has(defaultMode))) {
 			merged.defaultMode = defaultMode;
 		}
 	}
@@ -87,12 +137,41 @@ export function loadPermissionSettings(cwd: string, home: string): PermissionSet
 	return merged;
 }
 
-/** Append an allow rule to a settings file, creating it if needed. */
+/**
+ * The mode a session starts in, from the modes requested in Claude Code's
+ * precedence order (`--dangerously-skip-permissions`, `--permission-mode`,
+ * settings' `defaultMode`), skipping `bypassPermissions` wherever a settings
+ * source disabled it (CC's `permissionSetup.ts`). `mode` is undefined when
+ * nothing usable was requested — the caller keeps its live mode, so a
+ * mid-session reload never undoes a ctrl+q switch. `bypassRefused` says a
+ * bypass request was skipped, for CC's "disabled by settings" notification.
+ */
+export function resolveStartupMode(
+	requested: (PermissionMode | undefined)[],
+	settings: Pick<PermissionSettings, "disableBypassPermissionsMode">,
+): { mode?: PermissionMode; bypassRefused: boolean } {
+	let bypassRefused = false;
+	for (const candidate of requested) {
+		if (!candidate) continue;
+		if (candidate === "bypassPermissions" && settings.disableBypassPermissionsMode) {
+			bypassRefused = true;
+			continue;
+		}
+		return { mode: candidate, bypassRefused };
+	}
+	return { bypassRefused };
+}
+
+/**
+ * Append an allow rule to a One Code settings file, creating it if needed.
+ * Strict read + atomic write, like the other `~/.onecode` writers: a malformed
+ * file is not silently clobbered (it may also hold classifierModel/subagentModel),
+ * and a half-written file is never visible to a concurrent reader.
+ */
 export function persistAllowRule(rule: string, filePath: string): void {
-	const file = readSettingsFile(filePath) ?? {};
+	const file = readSettingsForWrite(filePath) as ClaudeSettingsFile;
 	const permissions = (file.permissions ??= {});
 	const allow = (permissions.allow ??= []);
 	if (!allow.includes(rule)) allow.push(rule);
-	mkdirSync(dirname(filePath), { recursive: true });
-	writeFileSync(filePath, `${JSON.stringify(file, null, 2)}\n`);
+	writeSettings(filePath, file as Record<string, unknown>);
 }

package/extensions/permissions/subagent-gate.ts

@@ -0,0 +1,57 @@
+/**
+ * The parent→child permission bridge.
+ *
+ * In-process subagent sessions get a `noExtensions` loader, so the real
+ * `permissions` extension never loads inside them. To match Claude Code — where a
+ * subagent's tool calls go through the *same* permission pipeline as the main
+ * agent (mode inheritance, the auto-mode classifier, and interactive prompts that
+ * bubble to the user; findings §17.1) — the parent's `permissions` extension
+ * publishes a decision closure on this channel. `subagents` captures it and
+ * threads it into the child runner, whose `permission-gate` calls it for every
+ * child tool call instead of its fail-closed local fallback.
+ *
+ * The closure is invoked in-process from the child's `tool_call` handler; it runs
+ * against the parent's live mode/rules/ctx (so a prompt renders on the parent's
+ * terminal). A plain function over `pi.events` is the only transport that works:
+ * each child session has its own EventBus, so `pi.events` does not cross the
+ * boundary — but the parent's `subagents` and `permissions` extensions share one,
+ * and the closure is carried the rest of the way as an ordinary reference (the
+ * same shape as `MCP_TOOLS_CHANNEL` sharing tool definitions).
+ */
+
+import { type BridgeWatchApi, watchBridge } from "../lib/bridge-watch.ts";
+
+export const SUBAGENT_GATE_CHANNEL = "one-code:subagent-permission-gate";
+
+/** One child tool call to evaluate. `cwd` is the child's runtime cwd (a worktree, if isolated). */
+export interface ChildToolCall {
+	toolName: string;
+	input: Record<string, unknown>;
+	cwd: string;
+	/**
+	 * The child's live turn signal: a classifier call is aborted when the child
+	 * turn is, and a prompt bubbled to the user is dismissed (as a denial) when
+	 * the child is stopped mid-prompt — otherwise a dead agent's dialog stays on
+	 * screen and holds the prompt chain (SUBAGENT-REVIEW M5).
+	 */
+	signal?: AbortSignal;
+	/** The child session's id (what the gate can see); the runner maps it to `agent`. */
+	sessionId?: string;
+	/** The run name of the asking agent, for the prompt title — set by the runner, not the gate. */
+	agent?: string;
+}
+
+/** A permission decision: `undefined` = allow; otherwise block with a model-facing reason. */
+export type ChildGateDecision = { block: true; reason: string } | undefined;
+
+/** The parent's decision closure, threaded into a child's permission gate. */
+export type PermissionBridge = (call: ChildToolCall) => Promise<ChildGateDecision>;
+
+export interface SubagentGatePayload {
+	decide: PermissionBridge;
+}
+
+/** A lazy getter for the latest published permission bridge (`lib/bridge-watch.ts`); undefined until the permissions extension publishes. */
+export function watchPermissionBridge(pi: BridgeWatchApi): () => PermissionBridge | undefined {
+	return watchBridge(pi, SUBAGENT_GATE_CHANNEL, (data) => (data as SubagentGatePayload | undefined)?.decide);
+}