praxis-agent 0.9.0 → 0.11.0

package/README.md

@@ -82,11 +82,12 @@ troubleshooting. Run `praxis --help` for the authoritative command surface.
   slash palette, tabbed help and shortcut surfaces, searchable resume picker,
   restored active-branch conversation history, streaming and expandable
   thinking, grouped multi-file reads, globally expandable tool results,
-  command-specific `/add-dir`, `/copy`, `/branch`, `/rename`, `/export`,
+  command-specific `/add-dir`, code-aware `/copy`, `/branch`, `/rename`, `/export`,
   provider-free read-only shared `/hooks`, provider-backed `/compact`, native
   `/rewind`, runtime `/cd`, transcript-free
   `/btw` side questions with background-Agent handoff, interactive
-  `/background` terminal handoff, `/config`, `/usage`, `/mcp`, `/memory` shared
+  `/background` terminal handoff, unified `/status`/`/config`/`/usage` settings
+  tabs, `/mcp`, `/memory` shared
   instruction and auto-memory access, and live extension-reload controls,
   cursor/history composer, per-session model/effort/permission controls,
   context/status/skill/task dashboards, prompt stash and continuation shortcuts,
@@ -108,8 +109,21 @@ troubleshooting. Run `praxis --help` for the authoritative command surface.
   image, web, scheduled prompts, workflows, and worktrees.
 - **Permission boundary** — local allow/ask/deny rules, safe and bare modes,
   searchable scoped-rule creation/removal, local/project/user atomic settings
-  writes, interactive workspace-directory add/remove controls, path confinement,
-  credential redaction, and sanitized child processes.
+  writes, tool-specific Bash/PowerShell/file/notebook/WebFetch/Skill approval
+  dialogs, editable reusable shell and Skill rules, source-root-aware Claude
+  file-rule matching, atomic session permission updates, compound-shell rule
+  suggestions backed by a bounded Bash AST, source-shaped exact/prefix/wildcard
+  matching, wrapper and environment normalization, fail-closed Bash semantic
+  checks with control-flow-aware variable scopes, declaration and literal-only
+  arithmetic analysis, exact `cat` heredoc handling, argv-based
+  command/redirection path validation, full symlink-chain checks, dangerous-removal,
+  sensitive-file, and suspicious Windows-path gates, source-ordered strict sed
+  constraints, internal auto-memory/session/task path handling, compound `cd` +
+  Git protection, mode-ordered `acceptEdits` handling, live raw/resolved-path
+  grants for external directories,
+  safe-property Skill auto-allow, interactive
+  workspace-directory add/remove controls, path confinement, credential
+  redaction, and sanitized child processes.
 - **Durable local work** — resumable sessions, full-history forks, file
   checkpoints, tasks, foreground/background subagents, and top-level agents.
 - **Claude-compatible ecosystem** — shared instructions with recursive `@`

package/dist/application/session-service.d.ts

@@ -1,7 +1,7 @@
 import type { ClaudeConditionalRuleResolver } from '../compatibility/claude/context.js';
 import { type ClaudeFileResource, type ClaudeFileResourceConfig } from '../compatibility/claude/file-resources.js';
 import { type ClaudeDisplayTranscriptItem } from '../compatibility/claude/projection.js';
-import { type ModelDocument, type ModelImage, type ModelToolCall, type ModelProvider, type ModelUsage, type PermissionApproval, type PermissionResolver, type RuntimeEventSink, type ToolRegistry } from '../core/runtime.js';
+import { type ModelDocument, type ModelImage, type ModelToolCall, type ModelProvider, type ModelUsage, type PermissionApproval, type PermissionDecision, type PermissionResolver, type PermissionUpdate, type RuntimeEventSink, type ToolRegistry } from '../core/runtime.js';
 import { type BackgroundTaskSnapshot } from './background-task-runtime.js';
 import type { ModelPricingRegistry } from '../core/usage.js';
 import type { Compactor } from '../core/compaction.js';
@@ -24,7 +24,8 @@ export interface ClaudeSessionServiceOptions {
     tools?: ToolRegistry;
     permissions?: PermissionResolver;
     permissionResolverForMode?: (mode: AgentPermissionMode) => PermissionResolver;
-    approveTool?: (call: ModelToolCall, originalCall?: ModelToolCall) => PermissionApproval | Promise<PermissionApproval>;
+    persistPermissionUpdates?: (updates: readonly PermissionUpdate[]) => void | Promise<void>;
+    approveTool?: (call: ModelToolCall, originalCall?: ModelToolCall, decision?: PermissionDecision) => PermissionApproval | Promise<PermissionApproval>;
     approveRecovery?: (call: ModelToolCall) => boolean | Promise<boolean>;
     contextAssembler?: ContextAssembler;
     conditionalRuleResolver?: Pick<ClaudeConditionalRuleResolver, 'resolve'>;
@@ -143,6 +144,7 @@ export declare class ClaudeSessionService {
     private readonly backgroundTasks;
     private readonly worktreeManager;
     private readonly sessionCwds;
+    private readonly sessionPermissionUpdates;
     private readonly hostedSubagents;
     private readonly hostedSubagentsByRegistry;
     private readonly backgroundNotificationWrites;
@@ -160,6 +162,7 @@ export declare class ClaudeSessionService {
     private requireMcp;
     taskSnapshots(sessionId: string): Promise<BackgroundTaskSnapshot>;
     stopTask(sessionId: string, taskId: string): Promise<void>;
+    private applyPermissionUpdates;
     close(): Promise<void>;
     createHostedToolRegistry(sessionId: string): ToolRegistry;
     run(prompt: string, signal?: AbortSignal, sessionId?: string, name?: string, images?: readonly ModelImage[], documents?: readonly ModelDocument[]): Promise<SessionRunResult>;

package/dist/application/session-service.js

@@ -92,6 +92,7 @@ export class ClaudeSessionService {
     backgroundTasks;
     worktreeManager;
     sessionCwds = new Map();
+    sessionPermissionUpdates = new Map();
     hostedSubagents = new Set();
     hostedSubagentsByRegistry = new WeakMap();
     backgroundNotificationWrites = new Map();
@@ -159,6 +160,18 @@ export class ClaudeSessionService {
     stopTask(sessionId, taskId) {
         return this.backgroundTasks.stop(sessionId, taskId);
     }
+    async applyPermissionUpdates(sessionId, updates) {
+        if (updates.length === 0)
+            return;
+        await this.options.persistPermissionUpdates?.(updates);
+        const current = this.sessionPermissionUpdates.get(sessionId) ?? [];
+        current.push(...updates);
+        this.sessionPermissionUpdates.set(sessionId, current);
+        const mode = updates.findLast((update) => update.type === 'setMode')?.mode;
+        if (mode && this.options.interactiveTools) {
+            await this.options.interactiveTools.setMode(sessionId, mode);
+        }
+    }
     async close() {
         this.scheduledPrompts?.close();
         await Promise.all([...this.hostedSubagents].map((executor) => executor.close()));
@@ -247,6 +260,8 @@ export class ClaudeSessionService {
                 ...(this.options.approveTool
                     ? { approveTool: this.options.approveTool }
                     : {}),
+                permissionUpdates: () => this.sessionPermissionUpdates.get(sessionId) ?? [],
+                onPermissionUpdates: (updates) => this.applyPermissionUpdates(sessionId, updates),
                 ...(this.options.eventSink
                     ? { eventSink: this.options.eventSink }
                     : {}),
@@ -1455,6 +1470,8 @@ export class ClaudeSessionService {
                     ...(this.options.approveTool
                         ? { approveTool: this.options.approveTool }
                         : {}),
+                    permissionUpdates: () => this.sessionPermissionUpdates.get(sessionId) ?? [],
+                    onPermissionUpdates: (updates) => this.applyPermissionUpdates(sessionId, updates),
                     ...(this.options.eventSink
                         ? { eventSink: this.options.eventSink }
                         : {}),
@@ -1723,6 +1740,8 @@ export class ClaudeSessionService {
                     toolResultDirectory,
                     messages: projectClaudeModelMessages(snapshot.entries),
                     observer,
+                    permissionUpdates: this.sessionPermissionUpdates.get(sessionId) ?? [],
+                    onPermissionUpdates: (updates) => this.applyPermissionUpdates(sessionId, updates),
                     ...(signal ? { signal } : {}),
                     ...(approveRecovery
                         ? {
@@ -2087,6 +2106,8 @@ export class ClaudeSessionService {
                             ...(this.options.approveTool
                                 ? { approveTool: this.options.approveTool }
                                 : {}),
+                            permissionUpdates: this.sessionPermissionUpdates.get(sessionId) ?? [],
+                            onPermissionUpdates: (updates) => this.applyPermissionUpdates(sessionId, updates),
                             ...(signal ? { signal } : {}),
                         });
                     }
@@ -2215,6 +2236,8 @@ export class ClaudeSessionService {
                     ...(this.options.approveTool
                         ? { approveTool: this.options.approveTool }
                         : {}),
+                    permissionUpdates: this.sessionPermissionUpdates.get(sessionId) ?? [],
+                    onPermissionUpdates: (updates) => this.applyPermissionUpdates(sessionId, updates),
                 };
                 const result = signal
                     ? await runtime.run({ ...runtimeRequest, signal })

package/dist/application/subagent-service.d.ts

@@ -1,6 +1,6 @@
 import { type ClaudeSidechainPermissionMode } from '../compatibility/claude/sidechain.js';
 import { type ContextAssembler } from '../core/context.js';
-import { type ModelProvider, type ModelToolCall, type ModelToolDefinition, type ModelUsage, type PermissionResolver, type PermissionApproval, type RuntimeEventSink, type ToolExecutionContext, type ToolExecutionResult, type ToolRegistry } from '../core/runtime.js';
+import { type ModelProvider, type ModelToolCall, type ModelToolDefinition, type ModelUsage, type PermissionResolver, type PermissionApproval, type PermissionDecision, type PermissionUpdate, type RuntimeEventSink, type ToolExecutionContext, type ToolExecutionResult, type ToolRegistry } from '../core/runtime.js';
 import type { ClaudeExtensionCatalog } from '../extensions/claude-extensions.js';
 import type { ClaudeHookRunner } from '../hooks/claude-hooks.js';
 import { type BackgroundAgentSnapshot } from './background-agent-manager.js';
@@ -56,7 +56,9 @@ export interface ClaudeSubagentExecutorOptions {
     hooks?: ClaudeHookRunner;
     contextAssembler?: ContextAssembler;
     contextReserveTokens?: number;
-    approveTool?: (call: ModelToolCall, originalCall?: ModelToolCall) => PermissionApproval | Promise<PermissionApproval>;
+    approveTool?: (call: ModelToolCall, originalCall?: ModelToolCall, decision?: PermissionDecision) => PermissionApproval | Promise<PermissionApproval>;
+    permissionUpdates?: () => readonly PermissionUpdate[];
+    onPermissionUpdates?: (updates: readonly PermissionUpdate[]) => void | Promise<void>;
     eventSink?: RuntimeEventSink;
     maxDepth?: number;
     maxCalls?: number;

package/dist/application/subagent-service.js

@@ -1139,6 +1139,10 @@ export class ClaudeSubagentExecutor {
                 ...(this.options.approveTool
                     ? { approveTool: this.options.approveTool }
                     : {}),
+                permissionUpdates: this.options.permissionUpdates?.() ?? [],
+                ...(this.options.onPermissionUpdates
+                    ? { onPermissionUpdates: this.options.onPermissionUpdates }
+                    : {}),
                 ...(this.options.hooks || this.options.backgroundTaskNotifications
                     ? {
                         onStop: async (text) => {

package/dist/cli/interactive.d.ts

@@ -1,5 +1,5 @@
 import type { ForkResult, ManualCompactResult, ManualCompactSelection, RewindPoint, SessionForkCheckpoint, SessionRunResult, SessionSummary, SideQuestionForkResult, SideQuestionResult } from '../application/session-service.js';
-import type { ModelImage, ModelToolCall, RuntimeEventSink } from '../core/runtime.js';
+import type { ModelImage, ModelToolCall, PermissionApproval, PermissionDecision, RuntimeEventSink } from '../core/runtime.js';
 import type { CliElicitationRequest, CliElicitationResult, CliRuntimeInfo } from './protocol.js';
 import type { ClaudeInteractiveToolCallbacks } from '../tools/claude-interactive-tools.js';
 import { type ClaudePermissionMode } from '../permissions/claude-permission-resolver.js';
@@ -71,7 +71,7 @@ export interface InteractiveServiceFactory {
         requireProvider: boolean;
         hooksOnly?: boolean;
         approveRecovery?: (call: ModelToolCall) => boolean | Promise<boolean>;
-        approveTool?: (call: ModelToolCall) => boolean | Promise<boolean>;
+        approveTool?: (call: ModelToolCall, originalCall?: ModelToolCall, decision?: PermissionDecision) => PermissionApproval | Promise<PermissionApproval>;
         onElicitation?: (request: CliElicitationRequest) => Promise<CliElicitationResult>;
         askUser?: ClaudeInteractiveToolCallbacks['askUser'];
         approvePlan?: ClaudeInteractiveToolCallbacks['approvePlan'];
@@ -172,8 +172,9 @@ interface InteractiveAppProps {
     runtimeSettings?: PraxisRuntimeSettings;
     runtimeSettingsTarget?: ConfigSettingsTarget;
     notificationWriter?: TuiNotificationWriter;
+    elicitationUrlOpener?: (url: string) => void | Promise<void>;
 }
-export declare function InteractiveApp({ factory, initialSessions, initialPrompt, initialHistory, signal, onCancel, onTurnChange, onCleanup, onRendererChange, onBackground, axScreenReader, allowNewSession, resume, display, terminalWidth, slashCommands, agents, allowDangerouslySkipPermissions, additionalDirectories, diffLoader, fileLoader, externalEditor, keybindingsConfigRoot, keybindingsFile, keybindingsLoader, keybindingsEditor, memoryFilesLoader, memoryEditor, memoryFolderOpener, suspendProcess, clipboardReader, clipboardWriter, sideQuestionClipboardWriter, exportWriter, permissionRuleStore, recentlyDeniedStore: suppliedRecentlyDeniedStore, terminalSetup: terminalSetupOverride, themeStore, initialThemeSettings, initialThemeLoadError, workspaceDirectoryResolver, workspaceDirectoryCompleter, runtimeSettings: suppliedRuntimeSettings, runtimeSettingsTarget, notificationWriter, }: InteractiveAppProps): import("react").JSX.Element;
+export declare function InteractiveApp({ factory, initialSessions, initialPrompt, initialHistory, signal, onCancel, onTurnChange, onCleanup, onRendererChange, onBackground, axScreenReader, allowNewSession, resume, display, terminalWidth, slashCommands, agents, allowDangerouslySkipPermissions, additionalDirectories, diffLoader, fileLoader, externalEditor, keybindingsConfigRoot, keybindingsFile, keybindingsLoader, keybindingsEditor, memoryFilesLoader, memoryEditor, memoryFolderOpener, suspendProcess, clipboardReader, clipboardWriter, sideQuestionClipboardWriter, exportWriter, permissionRuleStore, recentlyDeniedStore: suppliedRecentlyDeniedStore, terminalSetup: terminalSetupOverride, themeStore, initialThemeSettings, initialThemeLoadError, workspaceDirectoryResolver, workspaceDirectoryCompleter, runtimeSettings: suppliedRuntimeSettings, runtimeSettingsTarget, notificationWriter, elicitationUrlOpener, }: InteractiveAppProps): import("react").JSX.Element;
 export declare function runInteractive(options: {
     factory: InteractiveServiceFactory;
     initialPrompt?: string;