shoud-cli 1.0.11 → 3.0.2

package/src/runtime/agentLoop.js

@@ -1,130 +1,313 @@
 const axios = require('axios');
 const chalk = require('chalk');
 const ora = require('ora');
-const open = require('open');
 const { getToken } = require('../auth/deviceFlow');
-const { verifyPermission } = require('../permissions/engine');
-const { executeTool } = require('../tools/index');
-const { saveCheckpoint, loadCheckpoint, clearCheckpoint } = require('../context/checkpoint');
-
-const API_URL = process.env.SHOUD_API_URL || 'https://shoud.online/api';
-const BILLING_URL = process.env.SHOUD_BILLING_URL || 'https://shoud.vantyrixtek.online';
-
-async function executeTask(prompt) {
-  const token = getToken();
-  if (!token) {
-    console.log(chalk.red('Not signed in. Run `shoud login` first.'));
-    return;
+const { loadSettings } = require('../utils/config');
+const { verifyPermission, createPermissionSession } = require('../security/permissions');
+const { executeTool, toolList } = require('../tools');
+const { redactDeep } = require('../security/secrets');
+const { saveJob, appendAction, appendMessage } = require('../job/manager');
+const { collectBaseline } = require('../job/baseline');
+const { createCheckpoint, finalizeCheckpoint } = require('../job/checkpoint');
+const { runVerification } = require('./verification');
+const { createBudgetTracker, formatBudgetStatus } = require('./budget');
+const { NoProgressDetector } = require('./noProgress');
+const { JobStatus } = require('../job/model');
+const { discoverProject, formatProject } = require('../project/discovery');
+const { loadShoudMd } = require('../project/shoudMd');
+const { formatReceipt } = require('../job/receipt');
+const { ExitCodes } = require('../utils/errors');
+
+/**
+ * Main agent loop. Orchestrates discovery → baseline → checkpoint → loop →
+ * verification → receipt.
+ */
+async function executeTask(job) {
+  const settings = loadSettings();
+  const token = await getToken();
+  if (!token) throw Object.assign(new Error('Not signed in. Run `shoud login`.'), { code: ExitCodes.AUTH_REQUIRED });
+
+  const projectRoot = job.projectRoot;
+  const budget = createBudgetTracker(job.budget);
+  const session = createPermissionSession();
+  const noProgress = new NoProgressDetector();
+
+  // ── 1. Project discovery ──────────────────────────────────────
+  console.log(chalk.cyan('\n● Discovering project...'));
+  const project = discoverProject(projectRoot);
+  job.project = project;
+  console.log(chalk.gray(formatProject(project)));
+
+  // ── 2. Load SHOUD.md ─────────────────────────────────────────
+  const shoud = loadShoudMd(projectRoot);
+  if (shoud.source) console.log(chalk.gray(`\n  Loaded ${shoud.source}`));
+
+  // Combine verification commands: SHOUD.md overrides discovery
+  const verificationCommands = (shoud.verification.length ? shoud.verification : project.verification) || [];
+  job.verification.commands = verificationCommands;
+
+  // ── 3. Baseline ───────────────────────────────────────────────
+  if (verificationCommands.length) {
+    console.log(chalk.cyan('\n● Establishing baseline...'));
+    const baseline = await collectBaseline(project, verificationCommands, {
+      onProgress: (cmd) => process.stdout.write(chalk.gray(`  → ${cmd}\n`)),
+    });
+    job.baseline = baseline;
+    if (baseline.git.dirty) {
+      console.log(chalk.yellow(`\n  ⚠ ${baseline.git.modifiedFiles.length} pre-existing modified file(s) will be preserved.`));
+    }
   }
 
-  let messages = [];
-  const existingState = loadCheckpoint();
+  // ── 4. Checkpoint ─────────────────────────────────────────────
+  const cp = createCheckpoint(job.id, projectRoot);
+  job.checkpoint = cp;
+  console.log(chalk.gray(`\n  Checkpoint saved (undo with: shoud undo ${job.id})`));
 
-  if (existingState) {
-    console.log(chalk.cyan('● Restoring task context from checkpoint...'));
-    messages = existingState.messages;
-  } else {
-    messages.push({ role: 'user', content: prompt });
+  // ── 5. Build the system prompt ────────────────────────────────
+  const systemPrompt = buildSystemPrompt(project, shoud, verificationCommands);
+
+  // ── 6. Initial message ────────────────────────────────────────
+  if (!job.messages.length) {
+    job.messages.push({ role: 'user', content: job.prompt });
   }
 
+  job.status = JobStatus.RUNNING;
+  saveJob(job);
+
+  // ── 7. Agent loop ─────────────────────────────────────────────
   let taskComplete = false;
-  const spinner = ora('SHOUD is thinking...').start();
+  let finalText = '';
+  const MAX_ITERATIONS = 50;
+  let iteration = 0;
+
+  while (!taskComplete && iteration < MAX_ITERATIONS) {
+    iteration++;
+    const spinner = ora('SHOUD is thinking...').start();
 
-  while (!taskComplete) {
+    let response;
     try {
-      const response = await axios.post(`${API_URL}/agent/infer`, {
-        messages,
-        systemPrompt: undefined // optional, can be passed via CLI flag if needed
+      response = await axios.post(`${settings.apiUrl}/agent/infer`, {
+        messages: redactDeep(job.messages),
+        systemPrompt,
+        tools: toolList(),
       }, {
-        headers: { Authorization: `Bearer ${token}` }
+        headers: { Authorization: `Bearer ${token}` },
+        timeout: 120000,
       });
+    } catch (err) {
+      spinner.stop();
+      if (err.response?.status === 402) {
+        job.status = JobStatus.BUDGET_EXCEEDED;
+        job.completedAt = new Date().toISOString();
+        finalizeCheckpoint(job.id, projectRoot);
+        saveJob(job);
+        console.log(chalk.red('\n⏸ Credits exhausted. Job checkpointed.'));
+        console.log(chalk.gray('Run your command again after adding credits.'));
+        return job;
+      }
+      if (err.response?.status === 401) {
+        spinner.stop();
+        throw Object.assign(new Error('Session expired. Run `shoud login`.'), { code: ExitCodes.AUTH_REQUIRED });
+      }
+      throw err;
+    }
+    spinner.stop();
 
-      const aiMessage = response.data;
+    // Cost estimate (backend should return this; fallback to a heuristic)
+    const cost = response.data.cost ?? estimateCost(response.data);
+    budget.add(cost);
+    job.spent = budget.spent;
 
-      // Validate response structure
-      if (!aiMessage || !aiMessage.content || !Array.isArray(aiMessage.content)) {
-        throw new Error('Invalid response from SHOUD agent.');
-      }
+    const aiMessage = response.data;
+    if (!aiMessage?.content || !Array.isArray(aiMessage.content)) {
+      throw new Error('Invalid response from SHOUD agent.');
+    }
 
-      // Add assistant message to conversation history
-      messages.push({ role: 'assistant', content: aiMessage.content });
-      spinner.stop();
+    job.messages.push({ role: 'assistant', content: aiMessage.content });
+    saveJob(job);
+
+    // Budget check
+    const status = budget.status();
+    if (status.warn) {
+      console.log(chalk.yellow(`\n  Budget: ${formatBudgetStatus(status)}`));
+    }
+    if (status.exceeded) {
+      job.status = JobStatus.BUDGET_EXCEEDED;
+      job.completedAt = new Date().toISOString();
+      finalizeCheckpoint(job.id, projectRoot);
+      saveJob(job);
+      console.log(chalk.red('\n⏸ Budget exhausted. Job checkpointed.'));
+      return job;
+    }
+
+    if (aiMessage.stop_reason === 'tool_use') {
+      const toolResults = [];
+      for (const block of aiMessage.content) {
+        if (block.type !== 'tool_use') continue;
+
+        console.log(chalk.blue(`\n● ${block.name}`));
+        const permission = await verifyPermission(session, block.name, block.input);
 
-      // Check if the assistant used a tool
-      if (aiMessage.stop_reason === 'tool_use') {
-        for (const block of aiMessage.content) {
-          if (block.type === 'tool_use') {
-            console.log(chalk.blue(`\n● Agent requested: ${block.name}`));
-
-            const isAllowed = await verifyPermission(block.name, block.input);
-            let toolResult = '';
-
-            if (isAllowed) {
-              spinner.start(`Executing ${block.name}...`);
-              try {
-                toolResult = executeTool(block.name, block.input);
-                spinner.stop();
-                console.log(chalk.green(`✓ Tool executed.`));
-              } catch (toolError) {
-                spinner.stop();
-                console.log(chalk.red(`✕ Tool execution failed: ${toolError.message}`));
-                toolResult = `Error: ${toolError.message}`;
-              }
-            } else {
-              toolResult = 'User denied permission to execute this tool.';
-              console.log(chalk.red(`✕ Permission denied.`));
-            }
-
-            // Send tool result back to the agent
-            messages.push({
-              role: 'user',
-              content: [{ type: 'tool_result', tool_use_id: block.id, content: toolResult }]
-            });
-
-            // Save checkpoint after each tool interaction
-            saveCheckpoint({ messages });
+        let result;
+        if (!permission.allowed) {
+          result = { ok: false, error: `Permission denied: ${permission.reason}` };
+          console.log(chalk.red(`  ✕ ${permission.reason}`));
+        } else {
+          const ctx = {
+            projectRoot,
+            onOutput: (chunk) => process.stdout.write(chalk.gray(chunk)),
+          };
+          try {
+            result = await executeTool(block.name, ctx, block.input);
+            console.log(chalk.green(`  ✓ done`));
+          } catch (e) {
+            result = { ok: false, error: e.message };
+            console.log(chalk.red(`  ✕ ${e.message}`));
           }
         }
-        spinner.start('Analyzing tool results...');
-      } else {
-        // Task completed (no more tool calls)
-        taskComplete = true;
-        clearCheckpoint();
 
-        // Extract the final text response
-        const textBlocks = aiMessage.content.filter(c => c.type === 'text');
-        const finalResponse = textBlocks.length > 0
-          ? textBlocks.map(t => t.text).join('\n')
-          : 'Task completed.';
+        noProgress.recordAction({}, block.name, block.input);
+        noProgress.recordResult(block.name, block.input, result);
+
+        // Track changed files
+        if (['write_file', 'apply_patch'].includes(block.name) && block.input.path) {
+          if (!job.changedFiles.includes(block.input.path)) {
+            job.changedFiles.push(block.input.path);
+          }
+        }
 
-        console.log(chalk.green('\n✓ Task Complete.\n'));
-        console.log(chalk.white(finalResponse));
+        appendAction(job.id, {
+          at: new Date().toISOString(),
+          tool: block.name,
+          input: redactDeep(block.input),
+          ok: result?.ok !== false,
+          permission: permission.reason,
+        });
+
+        const toolResult = {
+          type: 'tool_result',
+          tool_use_id: block.id,
+          content: serializeResult(block.name, result),
+          is_error: result?.ok === false,
+        };
+        toolResults.push(toolResult);
       }
 
-    } catch (error) {
-      spinner.stop();
+      job.messages.push({ role: 'user', content: toolResults });
+      saveJob(job);
 
-      // Handle insufficient funds (402) specifically
-      if (error.response && error.response.status === 402) {
-        const balance = error.response.data.balance || 0;
-        console.log(chalk.red('\n⏸ Task paused. Insufficient SHOUD Credits.'));
-        console.log(chalk.gray(`Balance: $${balance.toFixed(4)}`));
-        // Save checkpoint so the user can resume later
-        saveCheckpoint({ messages });
-
-        console.log(chalk.cyan('Opening browser to add credits...'));
-        await open(`${BILLING_URL}/?amount=10`);
-        console.log(chalk.gray('Run your command again once credits are added to resume.'));
-        return;
+      // No-progress detection
+      const stuck = noProgress.isStuck();
+      if (stuck) {
+        job.status = JobStatus.BLOCKED;
+        job.completedAt = new Date().toISOString();
+        job.error = `No progress detected: ${stuck.reason}`;
+        finalizeCheckpoint(job.id, projectRoot);
+        saveJob(job);
+        console.log(chalk.yellow(`\n■ SHOUD is blocked: ${stuck.reason}.`));
+        console.log(chalk.gray('No further changes will be attempted.'));
+        return job;
       }
+    } else {
+      // Agent claims completion. We do NOT trust this. Run verification.
+      finalText = aiMessage.content
+        .filter(c => c.type === 'text')
+        .map(t => t.text).join('\n');
+
+      // ── 8. Verification ──────────────────────────────────────
+      if (verificationCommands.length) {
+        console.log(chalk.cyan('\n● Agent claims completion. Verifying...'));
+        job.status = JobStatus.VERIFYING;
+        saveJob(job);
+
+        const results = await runVerification(projectRoot, verificationCommands, {
+          onOutput: (chunk) => process.stdout.write(chalk.gray(chunk)),
+        });
+        job.verification.results = results;
+
+        const allPassed = results.every(r => r.ok);
 
-      // Generic error
-      console.log(chalk.red(`\nError: ${error.response?.data?.error || error.message}`));
-      // Save checkpoint to preserve progress
-      saveCheckpoint({ messages });
-      return;
+        if (allPassed) {
+          job.status = JobStatus.VERIFIED;
+          taskComplete = true;
+        } else {
+          // Feed failures back to agent
+          const failures = results.filter(r => !r.ok)
+            .map(r => `Command "${r.command}" failed (exit ${r.exitCode}):\n${r.summary}`)
+            .join('\n\n');
+          job.messages.push({
+            role: 'user',
+            content: [{
+              type: 'text',
+              text: `Verification failed. You claimed completion but the following checks did not pass. Fix the root cause and try again.\n\n${failures}`,
+            }],
+          });
+          job.status = JobStatus.RUNNING;
+          saveJob(job);
+        }
+      } else {
+        // No verification commands → IMPLEMENTED_NOT_VERIFIED
+        job.status = JobStatus.IMPLEMENTED_NOT_VERIFIED;
+        taskComplete = true;
+      }
     }
   }
+
+  if (iteration >= MAX_ITERATIONS) {
+    job.status = JobStatus.BLOCKED;
+    job.error = 'Max iterations reached without completion.';
+  }
+
+  // ── 9. Finalize ───────────────────────────────────────────────
+  job.completedAt = new Date().toISOString();
+  finalizeCheckpoint(job.id, projectRoot);
+  job.completion = { finalText };
+  saveJob(job);
+
+  // ── 10. Receipt ───────────────────────────────────────────────
+  console.log('\n' + formatReceipt(job));
+
+  return job;
+}
+
+function buildSystemPrompt(project, shoud, verificationCommands) {
+  return `You are SHOUD, an autonomous engineering agent operating on a local project.
+
+PROJECT
+  Root:        ${project.root}
+  Language:    ${project.language || 'unknown'}
+  Framework:   ${project.framework || '—'}
+  Package mgr: ${project.packageManager || '—'}
+  Testing:     ${project.testing || '—'}
+  Git:         ${project.git ? 'yes' : 'no'}
+
+VERIFICATION COMMANDS
+${verificationCommands.map(c => '  - ' + c).join('\n') || '  (none configured)'}
+
+${shoud.rules ? `PROJECT RULES (from SHOUD.md — follow strictly):\n${shoud.rules}\n` : ''}
+GUIDELINES
+- Use structured tools (read_file_range, apply_patch, search_text, git_diff) instead of shelling out for everything.
+- Prefer apply_patch over write_file for small edits.
+- Never modify .env files, secrets, or files inside .shoudignore.
+- Never weaken tests to make them pass. If a test asserts behaviour, fix the code, not the test.
+- When you believe the task is complete, stop calling tools and reply with a short summary.
+  The runtime will independently run verification. Do not claim success prematurely.
+- If blocked by an external prerequisite you cannot resolve, say so clearly and stop.
+`;
+}
+
+function serializeResult(toolName, result) {
+  const { redactDeep } = require('../security/secrets');
+  const cleaned = redactDeep(result);
+  let s = typeof cleaned === 'string' ? cleaned : JSON.stringify(cleaned, null, 2);
+  if (s.length > 16000) s = s.slice(0, 16000) + '\n... [truncated]';
+  return s;
+}
+
+function estimateCost(data) {
+  // Fallback heuristic — backend should really send cost.
+  const text = JSON.stringify(data);
+  return text.length / 40000; // ~$0.000025 per char, rough
 }
 
 module.exports = { executeTask };

package/src/runtime/budget.js

@@ -0,0 +1,30 @@
+const chalk = require('chalk');
+
+function createBudgetTracker(limit) {
+  return {
+    limit,
+    spent: 0,
+    exceeded() { return this.spent >= this.limit; },
+    add(amount) {
+      this.spent += amount;
+      return this.status();
+    },
+    status() {
+      const remaining = this.limit - this.spent;
+      return {
+        limit: this.limit, spent: this.spent, remaining,
+        warn: remaining <= this.limit * 0.1,
+        exceeded: remaining <= 0,
+      };
+    },
+  };
+}
+
+function formatBudgetStatus(b) {
+  const pct = Math.min(100, (b.spent / b.limit) * 100).toFixed(0);
+  const bar = '█'.repeat(Math.round(pct / 5)).padEnd(20, '░');
+  const color = b.exceeded ? chalk.red : b.warn ? chalk.yellow : chalk.green;
+  return color(`  $${b.spent.toFixed(4)} / $${b.limit.toFixed(2)}  ${bar}`);
+}
+
+module.exports = { createBudgetTracker, formatBudgetStatus };

package/src/runtime/noProgress.js

@@ -0,0 +1,38 @@
+/**
+
+Detects when the agent is spinning: same error, same patch, no file changes.
+*/
+class NoProgressDetector {
+constructor({ maxRepeats = 3 } = {}) {
+this.maxRepeats = maxRepeats;
+this.errorHistory = new Map();
+this.patchHistory = new Map();
+this.actionsSinceChange = 0;
+}
+
+recordAction(action, toolName, input) {
+if (toolName === 'write_file' || toolName === 'apply_patch') {
+const key = JSON.stringify({ path: input.path, content: input.content || input.new_text || '' });
+this.patchHistory.set(key, (this.patchHistory.get(key) || 0) + 1);
+this.actionsSinceChange = 0;
+} else {
+this.actionsSinceChange++;
+}
+}
+
+recordResult(toolName, input, result) {
+if (toolName === 'execute_shell' && result && !result.ok) {
+const key = (result.stderr || result.stdout || '').slice(0, 500);
+this.errorHistory.set(key, (this.errorHistory.get(key) || 0) + 1);
+}
+}
+
+isStuck() {
+for (const count of this.errorHistory.values()) if (count >= this.maxRepeats) return { reason: 'repeated error' };
+for (const count of this.patchHistory.values()) if (count >= this.maxRepeats) return { reason: 'repeated patch' };
+if (this.actionsSinceChange >= 8) return { reason: 'no file changes after 8 actions' };
+return null;
+}
+}
+
+module.exports = { NoProgressDetector };

package/src/runtime/verification.js

@@ -0,0 +1,39 @@
+const { runShell } = require('../tools/shell');
+const { redact } = require('../security/secrets');
+
+/**
+ * Run verification commands. Returns results in the same shape the
+ * receipt expects. Streams output to onOutput.
+ */
+async function runVerification(projectRoot, commands, { onOutput, timeout = 600000 } = {}) {
+  const results = [];
+  for (const cmd of commands) {
+    if (onOutput) onOutput(`\n● Verifying: ${cmd}\n`);
+    const r = await runShell(cmd, {
+      cwd: projectRoot,
+      timeout,
+      onOutput: onOutput ? (chunk) => onOutput(chunk) : undefined,
+    });
+    const summary = summarizeOutput(r);
+    results.push({
+      command: cmd,
+      ok: r.ok,
+      exitCode: r.exitCode,
+      duration: r.duration,
+      summary: summary.text,
+      redactions: summary.redactions,
+    });
+  }
+  return results;
+}
+
+function summarizeOutput(result) {
+  const combined = [result.stdout, result.stderr].filter(Boolean).join('\n');
+  const lines = combined.split('\n');
+  // Keep the last 200 lines; redact secrets
+  const truncated = lines.slice(-200).join('\n');
+  const { text, redactions } = redact(truncated);
+  return { text, redactions };
+}
+
+module.exports = { runVerification };

package/src/security/permissions.js

@@ -0,0 +1,132 @@
+const fs = require('fs');
+const inquirer = require('inquirer');
+const chalk = require('chalk');
+const { paths } = require('../utils/config');
+const { Risk, RiskLabel, classifyCommand } = require('./riskClassifier');
+
+function loadAllowlist() {
+  try {
+    if (fs.existsSync(paths.ALLOWLIST_FILE)) {
+      return JSON.parse(fs.readFileSync(paths.ALLOWLIST_FILE, 'utf-8'));
+    }
+  } catch (_) {}
+  return { commands: [], paths: [], risks: [] };
+}
+
+function saveAllowlist(data) {
+  fs.writeFileSync(paths.ALLOWLIST_FILE, JSON.stringify(data, null, 2), { mode: 0o600 });
+}
+
+/**
+ * In-memory session allowlist. Cleared when CLI exits.
+ */
+function createPermissionSession() {
+  return {
+    sessionCommands: new Set(),
+    sessionPaths: new Set(),
+    sessionRisks: new Set(),
+  };
+}
+
+function isPersistentlyAllowed(session, toolName, input) {
+  const allowlist = loadAllowlist();
+
+  if (toolName === 'read_file' || toolName === 'list_directory' ||
+      toolName === 'search_text' || toolName === 'search_files' ||
+      toolName === 'read_file_range' || toolName === 'git_status' ||
+      toolName === 'git_diff' || toolName === 'git_log' ||
+      toolName === 'project_info') {
+    return { allowed: true, reason: 'read-only tool' };
+  }
+
+  if (toolName === 'execute_shell') {
+    const { risk } = classifyCommand(input.command || '');
+    if (risk <= Risk.PROJECT_LOCAL) return { allowed: true, reason: 'low risk' };
+
+    if (risk >= Risk.LOCAL_MODIFICATION && allowlist.risks.includes(Risk[risk])) {
+      return { allowed: true, reason: 'risk-level allowlisted' };
+    }
+
+    const first = (input.command || '').trim().split(/\s+/)[0];
+    if (allowlist.commands.includes(first)) return { allowed: true, reason: 'command allowlisted' };
+
+    if (session.sessionCommands.has(first)) return { allowed: true, reason: 'session allow' };
+    if (session.sessionRisks.has(risk)) return { allowed: true, reason: 'session risk allow' };
+  }
+
+  if (toolName === 'write_file' || toolName === 'apply_patch') {
+    const p = input.path || '';
+    if (allowlist.paths.includes(p) || session.sessionPaths.has(p)) {
+      return { allowed: true, reason: 'path allowlisted' };
+    }
+  }
+
+  return { allowed: false };
+}
+
+async function verifyPermission(session, toolName, input) {
+  const pre = isPersistentlyAllowed(session, toolName, input);
+  if (pre.allowed) return { allowed: true, reason: pre.reason };
+
+  // Compute risk for display
+  let risk = null;
+  let details = '';
+  if (toolName === 'execute_shell') {
+    const c = classifyCommand(input.command || '');
+    risk = c.risk;
+    details = c.reasons.join(' · ');
+  } else if (toolName === 'write_file' || toolName === 'apply_patch') {
+    risk = Risk.LOCAL_MODIFICATION;
+    details = `path: ${input.path}`;
+  }
+
+  const riskLabel = risk !== null ? RiskLabel[risk] : 'WRITE';
+
+  console.log(chalk.yellow(`\n⚠ SHOUD requests permission: ${chalk.bold(toolName)} [${riskLabel}]`));
+  if (toolName === 'execute_shell') console.log(chalk.gray(`  ${input.command}`));
+  else if (input.path) console.log(chalk.gray(`  ${input.path}`));
+  if (details) console.log(chalk.gray(`  (${details})`));
+
+  const choices = [
+    { name: 'Allow once', value: 'once' },
+    { name: 'Allow for this session', value: 'session' },
+    { name: 'Always allow', value: 'always' },
+    { name: 'Deny', value: 'deny' },
+  ];
+
+  // For destructive commands, require type-to-confirm
+  if (risk === Risk.DESTRUCTIVE) {
+    console.log(chalk.red.bold('\n  ⚠ DESTRUCTIVE OPERATION — requires explicit confirmation.'));
+    const { confirm } = await inquirer.prompt([{
+      type: 'input', name: 'confirm',
+      message: 'Type "confirm" to proceed:',
+    }]);
+    if (confirm !== 'confirm') return { allowed: false, reason: 'user refused destructive op' };
+    // Still confirm permission below
+  }
+
+  const { permission } = await inquirer.prompt([{
+    type: 'list', name: 'permission',
+    message: 'Allow this operation?',
+    choices,
+  }]);
+
+  if (permission === 'deny') return { allowed: false, reason: 'user denied' };
+
+  if (permission === 'session' || permission === 'always') {
+    const allowlist = loadAllowlist();
+    if (toolName === 'execute_shell') {
+      const first = (input.command || '').trim().split(/\s+/)[0];
+      if (permission === 'session') session.sessionCommands.add(first);
+      else if (!allowlist.commands.includes(first)) { allowlist.commands.push(first); saveAllowlist(allowlist); }
+    } else if (toolName === 'write_file' || toolName === 'apply_patch') {
+      const p = input.path;
+      if (permission === 'session') session.sessionPaths.add(p);
+      else if (!allowlist.paths.includes(p)) { allowlist.paths.push(p); saveAllowlist(allowlist); }
+    }
+  }
+
+  return { allowed: true, reason: permission };
+}
+
+module.exports = { verifyPermission, createPermissionSession, loadAllowlist };