privateer-agent 0.1.0 → 0.2.1

package/src/daemon/index.ts

@@ -0,0 +1,322 @@
+import type { Server } from "node:net";
+import type { ToolSet } from "ai";
+import { loadConfig } from "../config/load.ts";
+import { createSession } from "../session.ts";
+import { autoApproveGate } from "../permissions/gate.ts";
+import { loadMcpServers, connectMcpServers } from "../mcp/client.ts";
+import { RelayClient } from "../remote/relayClient.ts";
+import { hasCredentials, revokeChildSession } from "../auth/privateer.ts";
+import {
+  loadRoutines,
+  upsertRoutine,
+  findRoutine,
+  removeRoutine,
+  addPendingRelay,
+  drainPendingRelay,
+  routineRelayId,
+} from "../routines/store.ts";
+import type { Routine } from "../routines/schema.ts";
+import { triggerError, computeNextRun, advanceAfterRun } from "../routines/trigger.ts";
+import { splitRoutineTools, filterMcpTools } from "../routines/toolSelect.ts";
+import { deliver, type RelayPusher } from "../routines/delivery.ts";
+import { startIpcServer, type IpcRequest, type IpcResponse } from "./ipc.ts";
+
+// The safe, read-only-plus-web toolset for unattended runs. No write/edit/bash, so
+// a routine firing with nobody watching can't mutate the filesystem or shell out.
+const SAFE_TOOLS = ["read", "glob", "grep", "web_fetch", "web_search"];
+
+const TICK_MS = 60_000; // scan for due routines once a minute
+
+function log(msg: string): void {
+  process.stdout.write(`[${new Date().toISOString()}] ${msg}\n`);
+}
+
+// Render a run's result as a self-contained markdown document for file/notice output.
+function formatResult(routine: Routine, body: string, status: "ok" | "error", error?: string): string {
+  const when = new Date().toISOString();
+  const head = `# ${routine.name}\n\n_${when} · ${status}${routine.model ? ` · ${routine.model}` : ""}_\n\n`;
+  if (status === "error") return `${head}**Run failed:** ${error ?? "unknown error"}\n\n${body}`.trimEnd() + "\n";
+  return `${head}${body.trim() || "(no output)"}\n`;
+}
+
+export class Daemon {
+  private server?: Server;
+  private timer?: ReturnType<typeof setInterval>;
+  private readonly startedAt = Date.now();
+  // Set of routine ids currently executing, so a slow run can't be re-entered by
+  // the next tick.
+  private readonly running = new Set<string>();
+  // Outbound relay connection to the Privateer server, opened lazily when a signed-in
+  // user has a routine that delivers over `relay`. Pushes results to an attached
+  // controller (e.g. the mobile app) in real time.
+  private relay?: RelayClient;
+  // Best-effort "is a controller attached right now?" — set on controller_attached,
+  // cleared when our socket drops. Used to decide push-live vs queue-for-later.
+  private controllerAttached = false;
+  // The app sent `terminate` (End remote access): keep the relay down until the
+  // daemon restarts, even if routine edits re-run syncRelay. Results still queue
+  // durably and deliver over the other channels meanwhile.
+  private relayTerminated = false;
+  // Push a result live if a controller is attached; otherwise persist it to the
+  // pending queue so it flushes the moment the app next attaches. Either path is
+  // durable, so delivery treats both as handled.
+  private readonly pushRelay: RelayPusher = (routine, content) => {
+    if (this.controllerAttached && this.relay?.sendRoutineResult(routine.name, content)) return "live";
+    addPendingRelay({ routine: routine.name, at: new Date().toISOString(), content });
+    return "queued";
+  };
+
+  start(): void {
+    // Prime nextRun for any routine missing one, then start the loop + IPC server.
+    this.primeSchedule();
+    this.timer = setInterval(() => void this.tick(), TICK_MS);
+    this.server = startIpcServer((req) => this.handleIpc(req));
+    this.syncRelay();
+    const count = loadRoutines().filter((r) => r.enabled).length;
+    log(`daemon started (pid ${process.pid}); ${count} enabled routine(s). Tick every ${TICK_MS / 1000}s.`);
+    // Fire an immediate scan so a just-due routine doesn't wait a full minute.
+    void this.tick();
+  }
+
+  stop(): void {
+    if (this.timer) clearInterval(this.timer);
+    this.server?.close();
+    this.relay?.stop();
+  }
+
+  // Open the relay connection when it's both wanted (a signed-in account + at least
+  // one enabled routine delivering over `relay`) and not already up. Started ahead
+  // of fire time so it's connected when a routine actually pushes. We never tear it
+  // down once up — an idle authenticated socket is cheap and reconnects itself.
+  private syncRelay(): void {
+    if (this.relay || this.relayTerminated) return;
+    if (!hasCredentials()) return;
+    const wantsRelay = loadRoutines().some((r) => r.enabled && r.delivery.includes("relay"));
+    if (!wantsRelay) return;
+    this.relay = new RelayClient({
+      // The daemon publishes results but is not a drivable terminal: ignore any
+      // prompts/approvals a controller might send.
+      onPrompt: () => {},
+      onInterrupt: () => {},
+      onApprovalResponse: () => {},
+      onControllerAttached: () => this.onControllerAttached(),
+      onAttachment: () => {},
+      onTerminate: () => {
+        this.relayTerminated = true;
+        this.controllerAttached = false;
+        this.relay?.stop();
+        this.relay = undefined;
+        log("relay terminated from the app; staying offline until the daemon restarts");
+      },
+      onStatus: (text) => log(`relay: ${text}`),
+      onDisconnected: () => {
+        this.controllerAttached = false;
+      },
+    }, {
+      // Stable identity so the daemon shows up as one recognizable terminal in the
+      // app across restarts, instead of a fresh random "terminal-xxxx" each boot.
+      termId: routineRelayId(),
+      label: "Privateer Routines",
+    });
+    void this.relay.start();
+    log("relay connection starting (routine has relay delivery + account signed in)");
+  }
+
+  // The app attached: greet it, then flush any routine results that finished while it
+  // was closed so it catches up immediately (in fire order).
+  private onControllerAttached(): void {
+    this.controllerAttached = true;
+    this.relay?.sendSnapshot([{ kind: "notice", text: "Privateer routines — results will appear here as they run." }]);
+    const pending = drainPendingRelay();
+    if (pending.length === 0) return;
+    log(`controller attached — flushing ${pending.length} pending routine result(s)`);
+    for (const p of pending) this.relay?.sendRoutineResult(p.routine, p.content);
+  }
+
+  private primeSchedule(): void {
+    for (const r of loadRoutines()) {
+      if (!r.enabled) continue;
+      if (r.nextRun && !Number.isNaN(Date.parse(r.nextRun))) continue;
+      const nr = computeNextRun(r);
+      if (nr) this.persistRun(r.id, { nextRun: nr.toISOString() });
+    }
+  }
+
+  private async tick(): Promise<void> {
+    const now = Date.now();
+    for (const r of loadRoutines()) {
+      if (!r.enabled || this.running.has(r.id)) continue;
+      if (triggerError(r)) continue; // skip malformed triggers
+      if (!r.nextRun) {
+        const nr = computeNextRun(r);
+        this.persistRun(r.id, { nextRun: nr?.toISOString() });
+        continue;
+      }
+      if (Date.parse(r.nextRun) <= now) {
+        await this.runRoutine(r);
+      }
+    }
+  }
+
+  // Execute a routine to completion and deliver the result. Advances nextRun past
+  // now afterwards (skipping any backlog) so at most one run fires per tick.
+  async runRoutine(routine: Routine): Promise<IpcResponse> {
+    if (this.running.has(routine.id)) return { ok: false, message: "already running" };
+    this.running.add(routine.id);
+    log(`running routine "${routine.name}"`);
+
+    const config = loadConfig();
+    const modelSpec = routine.model ?? config.defaultModel;
+    const split = splitRoutineTools(routine.tools);
+    // If the routine names no builtin tools, it still gets the safe read/web set —
+    // a routine that only lists MCP selectors shouldn't lose the ability to read.
+    const allowedTools = split.builtin.length > 0 ? split.builtin : SAFE_TOOLS;
+    const wantsEmail = routine.delivery.includes("email");
+
+    // MCP tools are fulfilled inside the agent turn. Two grants exist: explicit
+    // "<server>__<tool>" selectors in routine.tools (least privilege: only the named
+    // servers are launched and only the selected tools exposed), and the legacy email
+    // delivery, which exposes every configured server so the mail tool is reachable.
+    // Either way, egress stays an explicit tool action rather than a side channel.
+    let extraTools: ToolSet | undefined;
+    let closeMcp: (() => void) | undefined;
+    let prompt = routine.prompt;
+    if (split.mcp.length > 0 || wantsEmail) {
+      try {
+        const all = loadMcpServers(routine.cwd);
+        for (const s of split.servers) {
+          if (!all[s]) log(`  mcp: server "${s}" not configured in mcp.json — skipping`);
+        }
+        const servers = wantsEmail
+          ? all
+          : Object.fromEntries(Object.entries(all).filter(([name]) => split.servers.includes(name)));
+        const conn = await connectMcpServers(servers, routine.cwd, autoApproveGate);
+        const selected = filterMcpTools(conn.tools, split.mcp);
+        // Email needs every server's tools (the mail tool isn't in the selectors);
+        // otherwise expose only what the routine was granted.
+        extraTools = wantsEmail ? conn.tools : selected;
+        closeMcp = () => conn.clients.forEach((c) => c.close());
+        if (split.mcp.length > 0 && Object.keys(selected).length === 0) {
+          log(`  mcp: selectors matched no tools (${split.mcp.join(", ")})`);
+        }
+        if (wantsEmail) {
+          prompt +=
+            "\n\nWhen finished, email the result to the account owner using the available mail tool " +
+            "(e.g. a Gmail create/send tool). Keep the subject short and put the summary in the body.";
+        }
+      } catch (err) {
+        log(`  mcp setup failed: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+
+    let out = "";
+    let status: "ok" | "error" = "ok";
+    let error: string | undefined;
+    try {
+      const session = createSession({
+        config,
+        modelSpec,
+        cwd: routine.cwd,
+        gate: autoApproveGate,
+        confineToCwd: true,
+        allowedTools,
+        extraTools,
+      });
+      for await (const ev of session.engine.send(prompt)) {
+        if (ev.type === "text") out += ev.text;
+        else if (ev.type === "error") {
+          status = "error";
+          error = ev.error;
+        }
+      }
+    } catch (err) {
+      status = "error";
+      error = err instanceof Error ? err.message : String(err);
+    } finally {
+      closeMcp?.();
+    }
+
+    const content = formatResult(routine, out, status, error);
+    const report = deliver(routine, content, status, { pushRelay: this.pushRelay });
+    log(`  "${routine.name}" ${status}; delivered via ${report.delivered.join(", ") || "(none)"}`);
+
+    // Recurring routines reschedule; one-offs disable themselves after firing.
+    this.persistRun(routine.id, {
+      lastRun: new Date().toISOString(),
+      lastStatus: status,
+      lastError: error,
+      ...advanceAfterRun(routine),
+    });
+    this.running.delete(routine.id);
+    return { ok: status === "ok", message: report.delivered.join(", ") || undefined };
+  }
+
+  // Merge run bookkeeping into the persisted routine, re-reading first so we don't
+  // clobber concurrent IPC edits (add/pause/remove).
+  private persistRun(id: string, patch: Partial<Routine>): void {
+    const current = findRoutine(loadRoutines(), id);
+    if (!current) return;
+    upsertRoutine({ ...current, ...patch });
+  }
+
+  private async handleIpc(req: IpcRequest): Promise<IpcResponse> {
+    switch (req.cmd) {
+      case "status":
+        return { ok: true, pid: process.pid, uptimeSec: Math.round((Date.now() - this.startedAt) / 1000), routines: loadRoutines() };
+      case "list":
+        return { ok: true, routines: loadRoutines() };
+      case "add": {
+        const err = triggerError(req.routine);
+        if (err) return { ok: false, message: `invalid trigger: ${err}` };
+        const nr = computeNextRun(req.routine);
+        upsertRoutine({ ...req.routine, nextRun: nr?.toISOString() });
+        this.syncRelay(); // connect the relay if this routine introduced relay delivery
+        return { ok: true, message: `routine "${req.routine.name}" saved`, routines: loadRoutines() };
+      }
+      case "remove": {
+        const removed = removeRoutine(req.idOrName);
+        return removed
+          ? { ok: true, message: `removed "${removed.name}"`, routines: loadRoutines() }
+          : { ok: false, message: `no routine "${req.idOrName}"` };
+      }
+      case "pause":
+      case "resume": {
+        const r = findRoutine(loadRoutines(), req.idOrName);
+        if (!r) return { ok: false, message: `no routine "${req.idOrName}"` };
+        const enabled = req.cmd === "resume";
+        const nr = enabled ? computeNextRun(r)?.toISOString() : undefined;
+        upsertRoutine({ ...r, enabled, nextRun: nr });
+        if (enabled) this.syncRelay();
+        return { ok: true, message: `${enabled ? "resumed" : "paused"} "${r.name}"`, routines: loadRoutines() };
+      }
+      case "run-now": {
+        const r = findRoutine(loadRoutines(), req.idOrName);
+        if (!r) return { ok: false, message: `no routine "${req.idOrName}"` };
+        // Fire in the background so the IPC caller isn't blocked on a long run.
+        void this.runRoutine(r);
+        return { ok: true, message: `running "${r.name}" now` };
+      }
+      case "reload":
+        this.primeSchedule();
+        this.syncRelay();
+        return { ok: true, message: "schedule reloaded", routines: loadRoutines() };
+      default:
+        return { ok: false, message: "unknown command" };
+    }
+  }
+}
+
+// Entry point for `privateer daemon`.
+export function runDaemon(): void {
+  const daemon = new Daemon();
+  daemon.start();
+  const shutdown = () => {
+    log("shutting down");
+    daemon.stop();
+    // Release this process's Privateer session so the daemon drops off the
+    // app's Linked Devices immediately (best effort, then exit regardless).
+    void revokeChildSession().finally(() => process.exit(0));
+  };
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
+}

package/src/daemon/ipc.ts

@@ -0,0 +1,127 @@
+import { createServer, createConnection, type Socket, type Server } from "node:net";
+import { existsSync, unlinkSync, chmodSync } from "node:fs";
+import { join } from "node:path";
+import { globalDir } from "../config/load.ts";
+import type { Routine } from "../routines/schema.ts";
+
+// The CLI/TUI talks to the resident daemon over a unix domain socket. The protocol
+// is one JSON request per connection, answered with one JSON response, both
+// newline-terminated. Kept tiny and local — nothing crosses the machine boundary.
+
+export function daemonSocketPath(): string {
+  return join(globalDir(), "daemon.sock");
+}
+
+export type IpcRequest =
+  | { cmd: "status" }
+  | { cmd: "list" }
+  | { cmd: "add"; routine: Routine }
+  | { cmd: "remove"; idOrName: string }
+  | { cmd: "pause"; idOrName: string }
+  | { cmd: "resume"; idOrName: string }
+  | { cmd: "run-now"; idOrName: string }
+  | { cmd: "reload" };
+
+export interface IpcResponse {
+  ok: boolean;
+  message?: string;
+  routines?: Routine[];
+  // Daemon liveness/uptime for `status`.
+  pid?: number;
+  uptimeSec?: number;
+}
+
+export type IpcHandler = (req: IpcRequest) => Promise<IpcResponse> | IpcResponse;
+
+// Start the daemon-side socket server. Returns the Server so the caller can close it.
+export function startIpcServer(handler: IpcHandler): Server {
+  const path = daemonSocketPath();
+  // A stale socket file from a previous crash would block bind; remove it first.
+  if (existsSync(path)) {
+    try {
+      unlinkSync(path);
+    } catch {
+      /* ignore — bind will surface a clearer error */
+    }
+  }
+  const server = createServer((sock: Socket) => {
+    let buf = "";
+    sock.on("data", (chunk) => {
+      buf += chunk.toString("utf8");
+      const nl = buf.indexOf("\n");
+      if (nl < 0) return; // wait for the full line
+      const line = buf.slice(0, nl);
+      void (async () => {
+        let res: IpcResponse;
+        try {
+          res = await handler(JSON.parse(line) as IpcRequest);
+        } catch (err) {
+          res = { ok: false, message: err instanceof Error ? err.message : String(err) };
+        }
+        sock.end(JSON.stringify(res) + "\n");
+      })();
+    });
+    sock.on("error", () => sock.destroy());
+  });
+  server.listen(path, () => {
+    try {
+      chmodSync(path, 0o600); // owner-only IPC endpoint
+    } catch {
+      /* non-POSIX — best effort */
+    }
+  });
+  return server;
+}
+
+// Client side: send one request, resolve with the response. Rejects if the daemon
+// isn't running (no socket / connection refused) so callers can offer to start it.
+export function sendToDaemon(req: IpcRequest, timeoutMs = 5_000): Promise<IpcResponse> {
+  const path = daemonSocketPath();
+  return new Promise<IpcResponse>((resolve, reject) => {
+    if (!existsSync(path)) {
+      reject(new DaemonNotRunningError());
+      return;
+    }
+    const sock = createConnection(path);
+    let buf = "";
+    const timer = setTimeout(() => {
+      sock.destroy();
+      reject(new Error("daemon did not respond in time"));
+    }, timeoutMs);
+    sock.on("connect", () => sock.end(JSON.stringify(req) + "\n"));
+    sock.on("data", (chunk) => {
+      buf += chunk.toString("utf8");
+    });
+    sock.on("end", () => {
+      clearTimeout(timer);
+      try {
+        resolve(JSON.parse(buf.trim()) as IpcResponse);
+      } catch {
+        reject(new Error("malformed response from daemon"));
+      }
+    });
+    sock.on("error", (err: NodeJS.ErrnoException) => {
+      clearTimeout(timer);
+      // ECONNREFUSED means a stale socket file with no listener behind it.
+      if (err.code === "ENOENT" || err.code === "ECONNREFUSED") reject(new DaemonNotRunningError());
+      else reject(err);
+    });
+  });
+}
+
+export class DaemonNotRunningError extends Error {
+  constructor() {
+    super("Privateer daemon is not running. Start it with `privateer daemon`.");
+    this.name = "DaemonNotRunningError";
+  }
+}
+
+// Convenience: is the daemon reachable right now?
+export async function daemonIsRunning(): Promise<boolean> {
+  try {
+    const res = await sendToDaemon({ cmd: "status" }, 2_000);
+    return res.ok;
+  } catch {
+    return false;
+  }
+}

package/src/engine/errors.ts

@@ -153,6 +153,16 @@ export function describeError(err: unknown): DescribedError {
       hint: "Upgrade or top up your Privateer account, or run /provider to use your own API key.",
     });
   }
+  // Privateer machine-login expiry (thrown by the session spawn after the
+  // server rejects the parent refresh token). The stored credentials are
+  // already wiped; the only fix is a fresh /login, so say exactly that and
+  // never mark it retryable.
+  if (/privateer session expired/i.test(text)) {
+    return out({
+      message: "Your Privateer session expired — this terminal was signed out.",
+      hint: "Run /login to sign back in to your Privateer account.",
+    });
+  }
   if (status === 401 || status === 403) {
     return out({
       message: `Authentication failed${forProvider} (${status}).`,

package/src/main.tsx

@@ -1,13 +1,18 @@
 import React from "react";
 import { render } from "ink";
 import { Command } from "commander";
+import { spawn } from "node:child_process";
+import { openSync } from "node:fs";
+import { join } from "node:path";
 import { Root } from "./components/Root.tsx";
 import { NAME, VERSION, DESCRIPTION } from "./version.ts";
-import { loadConfig } from "./config/load.ts";
+import { loadConfig, globalDir } from "./config/load.ts";
 import { createSession } from "./session.ts";
 import { loadLatest, loadSession } from "./memory/store.ts";
 import { configuredProviders } from "./providers/resolve.ts";
 import { describeError } from "./engine/errors.ts";
+import { runDaemon } from "./daemon/index.ts";
+import { revokeChildSession } from "./auth/privateer.ts";
 
 // Set while Ink owns the screen. A stray unhandled rejection while the TUI is up
 // must NOT reach stdout/stderr — Node's default printer dumps the whole error
@@ -58,6 +63,16 @@ async function main() {
     .option("-r, --resume <id>", "resume a specific session by id (printed on exit)")
     .option("--onboard", "run the provider/key setup flow")
     .action(async (promptParts: string[], options: CliOptions) => {
+      // Terminal-window close (SIGHUP) or a kill (SIGTERM) bypasses the normal
+      // exit path below — revoke this terminal's Privateer session first so it
+      // drops off the app's Linked Devices immediately instead of lingering
+      // until server-side expiry. Installing a handler replaces Node's default
+      // terminate-on-signal, so exit explicitly with the conventional code.
+      const revokeAndExit = (code: number) => () => {
+        void revokeChildSession().finally(() => process.exit(code));
+      };
+      process.on("SIGHUP", revokeAndExit(129));
+      process.on("SIGTERM", revokeAndExit(143));
       try {
         if (options.cwd) process.chdir(options.cwd);
         const config = loadConfig();
@@ -79,6 +94,7 @@ async function main() {
 
         if (options.print) {
           await runPrint(modelSpec, promptParts.join(" ").trim(), config.confineToCwd);
+          await revokeChildSession();
           return;
         }
 
@@ -101,6 +117,11 @@ async function main() {
         await waitUntilExit();
         tuiActive = false;
 
+        // This terminal is done — release its Privateer session so it leaves the
+        // app's Linked Devices right away. Started before the resume hint prints
+        // and awaited after, so it doesn't delay the output.
+        const revoked = revokeChildSession();
+
         // On exit, print a hash that resumes this conversation later (à la Claude
         // Code). The latest persisted session carries the id used this run; it only
         // exists once at least one turn has been saved.
@@ -108,6 +129,7 @@ async function main() {
         if (last && last.messages.length > 0) {
           process.stdout.write(`\nResume this session:  ${NAME} --resume ${last.id}\n`);
         }
+        await revoked;
       } catch (err) {
         // Configuration/resolution errors are expected and user-facing — print them
         // cleanly without a stack trace.
@@ -116,6 +138,26 @@ async function main() {
       }
     });
 
+  // The scheduler daemon: a resident process that fires routines on their cron
+  // schedule. Runs in the foreground by default; --detach forks a background copy.
+  program
+    .command("daemon")
+    .description("run the scheduler that fires saved routines on their cron schedule")
+    .option("--detach", "start the daemon in the background and return")
+    .action((opts: { detach?: boolean }) => {
+      if (opts.detach) {
+        const logPath = join(globalDir(), "daemon.log");
+        const out = openSync(logPath, "a");
+        // Re-invoke this same runtime + script without --detach, fully detached.
+        const args = process.argv.slice(1).filter((a) => a !== "--detach");
+        const child = spawn(process.argv[0], args, { detached: true, stdio: ["ignore", out, out] });
+        child.unref();
+        process.stdout.write(`Daemon started in background (pid ${child.pid}).\nLogs: ${logPath}\n`);
+        return;
+      }
+      runDaemon();
+    });
+
   await program.parseAsync(process.argv);
 }
 

package/src/mcp/client.ts

@@ -23,6 +23,10 @@ export interface McpToolDef {
   name: string;
   description?: string;
   inputSchema?: Record<string, unknown>;
+  // Standard MCP behavioral hints. We use `destructiveHint`/`readOnlyHint` to
+  // decide whether a tool may auto-approve: a tool that performs an irreversible
+  // external action marks itself destructive so it ALWAYS reaches the human.
+  annotations?: { readOnlyHint?: boolean; destructiveHint?: boolean };
 }
 
 // Read mcp.json from project then user scope (project overrides). Accepts either a
@@ -148,7 +152,12 @@ export class McpClient {
   async listTools(): Promise<McpToolDef[]> {
     const res = await this.client!.listTools();
     return Array.isArray(res?.tools)
-      ? res.tools.map((t) => ({ name: t.name, description: t.description, inputSchema: t.inputSchema as Record<string, unknown> }))
+      ? res.tools.map((t) => ({
+          name: t.name,
+          description: t.description,
+          inputSchema: t.inputSchema as Record<string, unknown>,
+          annotations: t.annotations as McpToolDef["annotations"],
+        }))
       : [];
   }
 
@@ -184,6 +193,11 @@ export function adaptMcpTools(
   const set: ToolSet = {};
   for (const d of defs) {
     const name = `${server}__${d.name}`;
+    // A mutating tool (e.g. send email, delete file) marks itself destructive. We
+    // map that to `alwaysAsk`, which the gate never auto-approves — so it always
+    // prompts the human (phone on remote turns, terminal otherwise) even under
+    // bypass mode or the allowlist. Read-only tools follow the normal policy.
+    const destructive = d.annotations?.destructiveHint === true && d.annotations?.readOnlyHint !== true;
     set[name] = tool({
       description: d.description ?? `${d.name} (MCP server: ${server})`,
       inputSchema: jsonSchema((d.inputSchema as any) ?? { type: "object", properties: {} }),
@@ -193,6 +207,7 @@ export function adaptMcpTools(
           kind: "fetch",
           title: `MCP ${server}: ${d.name}`,
           detail: JSON.stringify(args ?? {}).slice(0, 120),
+          alwaysAsk: destructive,
         });
         if (decision === "deny") throw new PermissionDeniedError(name);
         return client.callTool(d.name, args);

package/src/permissions/gate.ts

@@ -14,6 +14,11 @@ export interface PermissionRequest {
   title: string; // short action label, e.g. "Run command"
   detail: string; // the command, or file path + change preview
   protected?: boolean; // target is a guarded file: never auto-approve, always prompt
+  // Always require a human decision, ABOVE bypass mode and the allowlist (like a
+  // dangerous shell command). Set for MCP tools that declare themselves
+  // destructive (destructiveHint), so even a "take no prisoners" run can't fire
+  // an irreversible external action silently. The decision is never remembered.
+  alwaysAsk?: boolean;
   // Target resolves outside the working directory: never auto-approve (unless bypass),
   // always prompt. `path` carries the absolute target so "always" can remember its dir.
   outside?: boolean;

package/src/permissions/mode.ts

@@ -27,6 +27,10 @@ export function decideAuto(
   // Dangerous shell (destructive / secret-exfil) always confirms — this sits
   // above bypass and the allowlist so an injected command can't run silently.
   if (req.kind === "bash" && isDangerousCommand(req.detail, denylist)) return "ask";
+  // Explicitly destructive actions (e.g. an MCP tool that declares destructiveHint)
+  // always confirm too — also above bypass, so "skip permissions" can't fire them
+  // blind.
+  if (req.alwaysAsk) return "ask";
   if (mode === "bypass") return "allow";
   // Access outside the working directory always confirms (the user has to explicitly
   // allow leaving cwd), even under acceptEdits or the allowlist.

package/src/permissions/uiGate.ts

@@ -48,9 +48,10 @@ export class ModeGate implements PermissionGate {
 
     if (auto !== "ask") return auto;
 
-    // A dangerous command can be approved once, but is never remembered: adding
-    // it to the allowlist would let a later injected variant slip through.
-    const dangerous = req.kind === "bash" && isDangerousCommand(req.detail, denylist);
+    // A dangerous command (or an always-ask destructive action) can be approved
+    // once, but is never remembered: adding it to the allowlist or relaxing the
+    // mode would let a later variant slip through.
+    const dangerous = req.alwaysAsk === true || (req.kind === "bash" && isDangerousCommand(req.detail, denylist));
 
     const outcome = await this.deps.ask(req);
     if (outcome === "deny") return "deny";