spacecode 2.5.1 → 2.5.3

package/dist/repl.mjs

@@ -4580,9 +4580,22 @@ function guardHost(inner, opts) {
       await log(kind, subject, d, false);
       throw new PolicyViolation(d.rule, `Blocked by policy (${d.rule}): ${d.reason}`);
     }
+    const verdict = opts.rules?.evaluate(kind === "exec" ? "bash" : kind, subject);
+    const ruleTag = verdict?.rule ? `${verdict.rule} [${verdict.scope}]` : "";
+    if (verdict?.effect === "deny") {
+      d = { action: "deny", rule: "rule-deny", reason: `denied by imported rule ${ruleTag}` };
+      await log(kind, subject, d, false);
+      throw new PolicyViolation(d.rule, `Blocked by policy (${d.rule}): ${d.reason}`);
+    }
     if (kind !== "exec" && opts.permissions?.mode === "default") {
       d = { action: "confirm", rule: "confirm-edit", reason: "modifies a file" };
     }
+    if (verdict?.effect === "ask") {
+      d = { action: "confirm", rule: "rule-ask", reason: `imported rule ${ruleTag} asks first${opts.confirm ? "" : "; no way to ask (headless), so refused"}` };
+    } else if (verdict?.effect === "allow" && d.action === "confirm") {
+      await log(kind, subject, { action: "allow", rule: "rule-allow", reason: `allowed by imported rule ${ruleTag} (would be ${d.rule})` }, true);
+      return;
+    }
     if (d.action === "confirm" && kind === "exec" && opts.permissions?.allowsCommand(subject)) {
       await log(kind, subject, { action: "allow", rule: "allow-session", reason: "approved earlier this session" }, true);
       return;
@@ -4606,7 +4619,15 @@ function guardHost(inner, opts) {
   return {
     kind: inner.kind,
     files: {
-      readFile: (p) => inner.files.readFile(p),
+      readFile: async (p) => {
+        const v2 = opts.rules?.evaluate("read_file", p.replace(/^\.\//, ""));
+        if (v2?.effect === "deny") {
+          const d = { action: "deny", rule: "rule-deny", reason: `denied by imported rule ${v2.rule} [${v2.scope}]` };
+          await log("read_file", p, d, false);
+          throw new PolicyViolation(d.rule, `Blocked by policy (${d.rule}): ${d.reason}`);
+        }
+        return inner.files.readFile(p);
+      },
       listDirectory: (p) => inner.files.listDirectory(p),
       writeFile: async (p, c) => {
         await gate("write_file", p, allow, { oldText: "", newText: c });
@@ -5413,6 +5434,291 @@ var init_instructions_tool = __esm({
   }
 });
 
+// ../agent/src/import/trust.ts
+var TrustError, TrustStore;
+var init_trust = __esm({
+  "../agent/src/import/trust.ts"() {
+    "use strict";
+    TrustError = class extends Error {
+    };
+    TrustStore = class {
+      fs;
+      storePath;
+      hashFn;
+      // session decisions are kept in memory only: key = `${realPath}|${contentHash}`
+      sessionMap = /* @__PURE__ */ new Set();
+      constructor(deps) {
+        this.fs = deps.fs;
+        this.storePath = deps.path;
+        this.hashFn = deps.hash;
+      }
+      async repoStatus(repoPath, files) {
+        const realPath = await this.fs.realPath(repoPath);
+        const contentHash = this.computeContentHash(files);
+        const store = await this.readStore();
+        const entry = store.repos[realPath];
+        if (entry?.decision === "never") return "never";
+        if (this.sessionMap.has(`${realPath}|${contentHash}`)) return "session";
+        if (entry?.decision === "trusted" && entry.contentHash === contentHash) return "trusted";
+        return "untrusted";
+      }
+      async setRepo(repoPath, files, decision) {
+        const realPath = await this.fs.realPath(repoPath);
+        const contentHash = this.computeContentHash(files);
+        if (decision === "session") {
+          this.sessionMap.add(`${realPath}|${contentHash}`);
+          return;
+        }
+        await this.writeStore({ repos: { [realPath]: { decision, contentHash } }, stdio: {} });
+      }
+      async stdioStatus(def) {
+        const store = await this.readStore();
+        return store.stdio[this.computeStdioHash(def)] ? "approved" : "unapproved";
+      }
+      async approveStdio(def) {
+        await this.writeStore({ repos: {}, stdio: { [this.computeStdioHash(def)]: true } });
+      }
+      computeContentHash(files) {
+        const sorted = {};
+        for (const key of Object.keys(files).sort()) sorted[key] = files[key];
+        return this.hashFn(JSON.stringify(sorted));
+      }
+      computeStdioHash(def) {
+        return this.hashFn(JSON.stringify([def.command, def.args, [...def.envNames].sort()]));
+      }
+      async readStore() {
+        const text = await this.fs.readText(this.storePath);
+        if (text === null) return { version: 1, repos: {}, stdio: {} };
+        let parsed;
+        try {
+          parsed = JSON.parse(text);
+        } catch (e) {
+          throw new TrustError(`Failed to parse trust store at ${this.storePath}: ${String(e)}`);
+        }
+        if (typeof parsed !== "object" || parsed === null) {
+          throw new TrustError(`Malformed trust store at ${this.storePath}`);
+        }
+        const obj = parsed;
+        if (obj.version !== 1) {
+          throw new TrustError(`Unsupported trust store version at ${this.storePath}`);
+        }
+        const repos = obj.repos ?? {};
+        const stdio = obj.stdio ?? {};
+        if (typeof repos !== "object" || repos === null) {
+          throw new TrustError(`Malformed repos section in trust store at ${this.storePath}`);
+        }
+        if (typeof stdio !== "object" || stdio === null) {
+          throw new TrustError(`Malformed stdio section in trust store at ${this.storePath}`);
+        }
+        return { version: 1, repos, stdio };
+      }
+      /** Re-reads immediately before the write and merges, so concurrent writers keep each other's entries. */
+      async writeStore(delta) {
+        const current = await this.readStore();
+        const repos = { ...current.repos };
+        for (const [key, next] of Object.entries(delta.repos)) {
+          if (current.repos[key]?.decision === "never" && next.decision === "trusted") continue;
+          repos[key] = next;
+        }
+        const store = { version: 1, repos, stdio: { ...current.stdio, ...delta.stdio } };
+        await this.fs.writeTextAtomic(this.storePath, JSON.stringify(store, null, 2));
+      }
+    };
+  }
+});
+
+// ../agent/src/import/imports-config.ts
+function allOffConfig() {
+  return {
+    categories: {
+      instructions: false,
+      memory: false,
+      permissions: false,
+      commands: false,
+      mcp: false,
+      skills: false,
+      agents: false
+    },
+    models: {}
+  };
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseImportsConfig(text, path12) {
+  if (text === null) return { config: allOffConfig() };
+  const fail = (reason) => ({ config: allOffConfig(), error: `${path12}: ${reason}` });
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return fail("invalid JSON");
+  }
+  if (!isPlainObject(parsed)) return fail("top-level JSON must be an object");
+  if (parsed.version !== 1) return fail(`unsupported version ${String(parsed.version)}`);
+  const config = allOffConfig();
+  if (parsed.categories !== void 0) {
+    if (!isPlainObject(parsed.categories)) return fail("categories must be an object");
+    for (const [key, value] of Object.entries(parsed.categories)) {
+      if (!IMPORT_CATEGORIES.includes(key)) return fail(`unknown category key "${key}"`);
+      if (typeof value !== "boolean") return fail(`category "${key}" must be a boolean`);
+      config.categories[key] = value;
+    }
+  }
+  if (parsed.models !== void 0) {
+    if (!isPlainObject(parsed.models)) return fail("models must be an object");
+    for (const key of MODEL_KEYS) {
+      const value = parsed.models[key];
+      if (value === void 0) continue;
+      if (typeof value !== "string" || value.trim() === "") return fail(`model "${key}" must be a non-empty string`);
+      config.models[key] = value;
+    }
+  }
+  return { config };
+}
+var IMPORT_CATEGORIES, MODEL_KEYS;
+var init_imports_config = __esm({
+  "../agent/src/import/imports-config.ts"() {
+    "use strict";
+    IMPORT_CATEGORIES = [
+      "instructions",
+      "memory",
+      "permissions",
+      "commands",
+      "mcp",
+      "skills",
+      "agents"
+    ];
+    MODEL_KEYS = ["main", "agent", "skill", "router"];
+  }
+});
+
+// ../agent/src/import/permission-rules.ts
+function splitCommand(cmd) {
+  const segments2 = [];
+  let cur = "";
+  let quote = null;
+  let compound = false;
+  const flush = () => {
+    const s = cur.trim();
+    if (s) segments2.push(s);
+    cur = "";
+  };
+  for (let i = 0; i < cmd.length; i++) {
+    const ch = cmd[i];
+    if (quote) {
+      cur += ch;
+      if (ch === quote) quote = null;
+    } else if (ch === '"' || ch === "'") {
+      quote = ch;
+      cur += ch;
+    } else if (";&|\n`()<>".includes(ch) || ch === "$" && cmd[i + 1] === "(") {
+      compound = true;
+      flush();
+    } else {
+      cur += ch;
+    }
+  }
+  if (quote) return { compound: true, segments: [cmd.trim()] };
+  flush();
+  return compound ? { compound, segments: segments2 } : { compound, segments: [cmd.trim()] };
+}
+function matchesBash(pattern, cmd, effect) {
+  const { compound, segments: segments2 } = splitCommand(cmd);
+  if (compound && effect === "allow") return false;
+  const prefix = pattern.endsWith(":*") ? pattern.slice(0, -2).trim() : null;
+  const hit = (s) => prefix === null ? s === pattern.trim() : s === prefix || s.startsWith(prefix) && /\s/.test(s[prefix.length] ?? "");
+  return segments2.some(hit);
+}
+function globToRegExp(glob) {
+  let re3 = "";
+  for (let i = 0; i < glob.length; i++) {
+    const ch = glob[i];
+    if (ch === "*") {
+      if (glob[i + 1] === "*") {
+        re3 += ".*";
+        i++;
+        if (glob[i + 1] === "/") i++;
+      } else re3 += "[^/]*";
+    } else if (ch === "?") re3 += "[^/]";
+    else re3 += ch.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp("^" + re3 + "$");
+}
+function compile(text, effect, scope) {
+  const m2 = /^([A-Za-z0-9_-]+)(?:\((.*)\))?$/s.exec(text.trim());
+  if (!m2) return "malformed rule";
+  const [, name, rawArg] = m2;
+  const arg = rawArg === void 0 || rawArg.trim() === "" ? null : rawArg.trim();
+  const tools = name.startsWith("mcp__") ? [name] : TOOL_MAP[name];
+  if (!tools) return `unsupported tool ${name}`;
+  if (arg === null) return { effect, scope, text, tools, arg, test: () => true };
+  if (name === "Bash") return { effect, scope, text, tools, arg, test: (s, e) => matchesBash(arg, s, e) };
+  if (name.startsWith("mcp__")) return "argument patterns are not supported for MCP tools";
+  const re3 = globToRegExp(arg);
+  return { effect, scope, text, tools, arg, test: (s) => re3.test(s) };
+}
+function buildRuleSet(sources) {
+  const rules = [];
+  const skipped = [];
+  const counts = {};
+  for (const s of ["user", "repo", "local"]) counts[s] = { allow: 0, deny: 0, ask: 0 };
+  for (const src of sources) {
+    for (const effect of ["deny", "ask", "allow"]) {
+      for (const text of src[effect] ?? []) {
+        const c = typeof text === "string" ? compile(text, effect, src.scope) : "malformed rule";
+        if (typeof c === "string") skipped.push({ text: String(text), scope: src.scope, reason: c });
+        else {
+          rules.push(c);
+          counts[src.scope][effect]++;
+        }
+      }
+    }
+  }
+  const frozen = Object.freeze(rules);
+  return {
+    skipped,
+    counts,
+    evaluate(tool, subject) {
+      for (const effect of ["deny", "ask", "allow"]) {
+        const r = frozen.find((c) => c.effect === effect && c.tools.includes(tool) && c.test(subject, effect));
+        if (r) return { effect, rule: r.text, scope: r.scope };
+      }
+      return { effect: "none" };
+    }
+  };
+}
+function defaultModeFor(mode) {
+  switch (mode) {
+    case void 0:
+    case "default":
+      return { mode: "default" };
+    case "acceptEdits":
+      return { mode: "accept-edits" };
+    case "plan":
+      return { mode: "plan" };
+    case "bypassPermissions":
+      return { mode: "yolo" };
+    default:
+      return { mode: null, reason: `unmappable defaultMode "${mode}"` };
+  }
+}
+var TOOL_MAP;
+var init_permission_rules = __esm({
+  "../agent/src/import/permission-rules.ts"() {
+    "use strict";
+    TOOL_MAP = {
+      Bash: ["bash"],
+      Read: ["read_file"],
+      Edit: ["edit_file", "write_file"],
+      Write: ["edit_file", "write_file"],
+      MultiEdit: ["edit_file", "write_file"],
+      Glob: ["list_directory"],
+      Grep: ["search"]
+    };
+  }
+});
+
 // ../agent/src/index.ts
 var init_src = __esm({
   "../agent/src/index.ts"() {
@@ -5450,13 +5756,16 @@ var init_src = __esm({
     init_coverage();
     init_adapt_plan();
     init_instructions_tool();
+    init_trust();
+    init_imports_config();
+    init_permission_rules();
   }
 });
 
 // src/api-key.ts
 import { join } from "node:path";
 async function resolveApiKey(deps) {
-  const { env: env3, readFile: readFile5, homedir: homedir3 } = deps;
+  const { env: env3, readFile: readFile7, homedir: homedir3 } = deps;
   for (const name of ["SPACECODE_API_KEY", "ANTHROPIC_API_KEY"]) {
     const value = env3[name]?.trim();
     if (value) return value;
@@ -5465,7 +5774,7 @@ async function resolveApiKey(deps) {
   const file = join(dir, "auth.json");
   let raw;
   try {
-    raw = await readFile5(file);
+    raw = await readFile7(file);
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw new Error(`Cannot read ${file}: ${err instanceof Error ? err.message : String(err)}`);
@@ -5518,10 +5827,17 @@ function fileCache(deps) {
   };
 }
 async function prepareProfile(deps) {
+  let state;
   try {
-    return await prepareProfileUnsafe(deps);
+    state = await prepareProfileUnsafe(deps);
   } catch (err) {
-    return EMPTY([`profile: not loaded (unexpected error: ${err instanceof Error ? err.message : String(err)})`]);
+    state = EMPTY([`profile: not loaded (unexpected error: ${err instanceof Error ? err.message : String(err)})`]);
+  }
+  if (!deps.importGate) return state;
+  try {
+    return { ...state, statusLines: [...state.statusLines, ...await deps.importGate()] };
+  } catch (err) {
+    return { ...state, statusLines: [...state.statusLines, `imports: gate failed (${err instanceof Error ? err.message : String(err)}); nothing from repos loads`] };
   }
 }
 async function prepareProfileUnsafe(deps) {
@@ -32203,7 +32519,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes2, createHash } = __require("crypto");
+    var { randomBytes: randomBytes2, createHash: createHash2 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -32871,7 +33187,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash("sha1").update(key + GUID).digest("base64");
+        const digest = createHash2("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -33240,7 +33556,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter3 = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash } = __require("crypto");
+    var { createHash: createHash2 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -33547,7 +33863,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash("sha1").update(key + GUID).digest("base64");
+        const digest = createHash2("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -34487,7 +34803,7 @@ var init_source = __esm({
       object.level = options.level === void 0 ? colorLevel : options.level;
     };
     chalkFactory = (options) => {
-      const chalk2 = (...strings) => strings.join(" ");
+      const chalk2 = (...strings2) => strings2.join(" ");
       applyOptions(chalk2, options);
       Object.setPrototypeOf(chalk2, createChalk.prototype);
       return chalk2;
@@ -40921,7 +41237,7 @@ var require_core = __commonJS({
       return match && match.index === 0;
     }
     var BACKREF_RE = /\[(?:[^\\\]]|\\.)*\]|\(\??|\\([1-9][0-9]*)|\\./;
-    function join4(regexps, separator = "|") {
+    function join7(regexps, separator = "|") {
       let numCaptures = 0;
       return regexps.map((regex2) => {
         numCaptures += 1;
@@ -41225,7 +41541,7 @@ var require_core = __commonJS({
             this.exec = () => null;
           }
           const terminators = this.regexes.map((el) => el[1]);
-          this.matcherRe = langRe(join4(terminators), true);
+          this.matcherRe = langRe(join7(terminators), true);
           this.lastIndex = 0;
         }
         /** @param {string} s */
@@ -84152,12 +84468,12 @@ var require_source = __commonJS({
       return openAll + string + closeAll;
     };
     var template;
-    var chalkTag = (chalk3, ...strings) => {
-      const [firstString] = strings;
+    var chalkTag = (chalk3, ...strings2) => {
+      const [firstString] = strings2;
       if (!isArray(firstString) || !isArray(firstString.raw)) {
-        return strings.join(" ");
+        return strings2.join(" ");
       }
-      const arguments_ = strings.slice(1);
+      const arguments_ = strings2.slice(1);
       const parts = [firstString.raw[0]];
       for (let i = 1; i < firstString.length; i++) {
         parts.push(
@@ -100505,6 +100821,7 @@ function createLocalToolset(opts) {
     audit: new FileAuditLog(auditFile),
     mode: opts.yolo ? "yolo" : "enforce",
     permissions: opts.permissions,
+    ...opts.rules ? { rules: opts.rules } : {},
     confirm: opts.confirm
   });
   const { handlers: githubHandlers } = createGitHubTools((command) => host.exec(command));
@@ -100870,9 +101187,149 @@ var init_node_mentions = __esm({
   }
 });
 
+// src/import-gate.ts
+import { createHash, randomUUID } from "node:crypto";
+import { chmod as chmod3, mkdir as mkdir3, readFile as readFile4, realpath as realpath2, rename as rename3, writeFile as writeFile3 } from "node:fs/promises";
+import { dirname as dirname3, join as join4 } from "node:path";
+async function readOrNull(path12) {
+  try {
+    return await readFile4(path12, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  }
+}
+async function writeTextAtomic(path12, text) {
+  await mkdir3(dirname3(path12), { recursive: true });
+  const tmp = `${path12}.${process.pid}.${randomUUID()}.tmp`;
+  await writeFile3(tmp, text, { mode: 384 });
+  await chmod3(tmp, 384);
+  await rename3(tmp, path12);
+}
+function nodeTrustFs() {
+  return { readText: readOrNull, writeTextAtomic, realPath: (p) => realpath2(p) };
+}
+function createNodeTrustStore(configDir) {
+  return new TrustStore({ fs: nodeTrustFs(), path: join4(configDir, "trust.json"), hash: sha256 });
+}
+async function importGateStatus(deps) {
+  const lines2 = [];
+  const configPath = join4(deps.configDir, "imports.json");
+  try {
+    const loaded = parseImportsConfig(await readOrNull(configPath), configPath);
+    if (loaded.error) lines2.push(`imports: ${loaded.error} (every category off)`);
+    else {
+      const on = IMPORT_CATEGORIES.filter((c) => loaded.config.categories[c]);
+      lines2.push(on.length ? `imports: on for ${on.join(", ")}` : "imports: every category off (default)");
+    }
+  } catch (err) {
+    lines2.push(`imports: not read (${err instanceof Error ? err.message : String(err)}); every category off`);
+  }
+  try {
+    const files = {};
+    for (const name of REPO_SOURCE_FILES) {
+      const text = await readOrNull(join4(deps.cwd, name));
+      if (text !== null) files[name] = text;
+    }
+    const found = Object.keys(files);
+    if (found.length === 0) return lines2;
+    const status = await createNodeTrustStore(deps.configDir).repoStatus(deps.cwd, files);
+    const names = found.join(", ");
+    if (status === "trusted" || status === "session") lines2.push(`repo sources: ${names} (trusted${status === "session" ? " for this session" : ""})`);
+    else if (status === "never") lines2.push(`repo sources: ${names} NOT loaded (marked never trust)`);
+    else lines2.push(`repo sources: ${names} NOT loaded (untrusted${deps.interactive ? "" : ", non-interactive run"})`);
+  } catch (err) {
+    lines2.push(`repo sources: NOT loaded (trust check failed: ${err instanceof Error ? err.message : String(err)})`);
+  }
+  return lines2;
+}
+var REPO_SOURCE_FILES, sha256;
+var init_import_gate = __esm({
+  "src/import-gate.ts"() {
+    "use strict";
+    init_src();
+    REPO_SOURCE_FILES = [".mcp.json", ".claude/settings.json", ".claude/settings.local.json", "CLAUDE.local.md"];
+    sha256 = (text) => createHash("sha256").update(text).digest("hex");
+  }
+});
+
+// src/permission-rules-loader.ts
+import { readFile as readFile5 } from "node:fs/promises";
+import { join as join5 } from "node:path";
+async function readOrNull2(path12) {
+  try {
+    return await readFile5(path12, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  }
+}
+async function loadPermissionRules(deps) {
+  const none = (line) => ({ rules: void 0, defaultMode: void 0, statusLines: [line] });
+  const configPath = join5(deps.configDir, "imports.json");
+  try {
+    const loaded = parseImportsConfig(await readOrNull2(configPath), configPath);
+    if (loaded.error) return none("permission rules: off (imports.json unreadable)");
+    if (!loaded.config.categories.permissions) return none("permission rules: off (imports.json has permissions off)");
+  } catch (err) {
+    return none(`permission rules: off (imports.json not read: ${err instanceof Error ? err.message : String(err)})`);
+  }
+  const lines2 = [];
+  const files = [{ scope: "user", path: join5(deps.homeDir, ".claude", "settings.json") }];
+  try {
+    const sources2 = {};
+    for (const name of REPO_SOURCE_FILES) {
+      const text = await readOrNull2(join5(deps.cwd, name));
+      if (text !== null) sources2[name] = text;
+    }
+    if (sources2[".claude/settings.json"] !== void 0 || sources2[".claude/settings.local.json"] !== void 0) {
+      const status = await createNodeTrustStore(deps.configDir).repoStatus(deps.cwd, sources2);
+      if (status === "trusted" || status === "session") {
+        files.push({ scope: "repo", path: join5(deps.cwd, ".claude", "settings.json") }, { scope: "local", path: join5(deps.cwd, ".claude", "settings.local.json") });
+      } else lines2.push(`permission rules: repo settings NOT loaded (${status === "never" ? "marked never trust" : "untrusted repo"})`);
+    }
+  } catch (err) {
+    lines2.push(`permission rules: repo settings NOT loaded (trust check failed: ${err instanceof Error ? err.message : String(err)})`);
+  }
+  const sources = [];
+  let defaultMode;
+  for (const f of files) {
+    try {
+      const text = await readOrNull2(f.path);
+      if (text === null) continue;
+      const parsed = JSON.parse(text);
+      const perms = parsed?.permissions;
+      if (!perms || typeof perms !== "object") continue;
+      sources.push({ scope: f.scope, allow: strings(perms.allow), deny: strings(perms.deny), ask: strings(perms.ask) });
+      if (typeof perms.defaultMode === "string") {
+        const m2 = defaultModeFor(perms.defaultMode);
+        if (m2.mode) defaultMode = m2.mode;
+        else lines2.push(`permission rules: ${f.path}: ${m2.reason}`);
+      }
+    } catch (err) {
+      lines2.push(`permission rules: ${f.path} NOT loaded (${err instanceof Error ? err.message : String(err)})`);
+    }
+  }
+  const rules = buildRuleSet(sources);
+  const parts = ["user", "repo", "local"].filter((s) => sources.some((x2) => x2.scope === s)).map((s) => `${s} ${rules.counts[s].allow} allow/${rules.counts[s].deny} deny/${rules.counts[s].ask} ask`);
+  lines2.unshift(`permission rules: ${parts.length ? parts.join(", ") : "none found"}${defaultMode ? `; default mode ${defaultMode}` : ""}`);
+  for (const s of rules.skipped) lines2.push(`permission rules: skipped [${s.scope}] "${s.text}" (${s.reason})`);
+  return { rules, defaultMode, statusLines: lines2 };
+}
+var strings;
+var init_permission_rules_loader = __esm({
+  "src/permission-rules-loader.ts"() {
+    "use strict";
+    init_src();
+    init_import_gate();
+    strings = (v2) => Array.isArray(v2) ? v2.filter((x2) => typeof x2 === "string") : void 0;
+  }
+});
+
 // src/useReplController.ts
-import { readFile as readFile4, writeFile as writeFile3, mkdir as mkdir3 } from "node:fs/promises";
+import { readFile as readFile6, writeFile as writeFile4, mkdir as mkdir4 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
+import { join as join6 } from "node:path";
 import { execFile as execFile3 } from "node:child_process";
 function useReplController({ repoName: repoName2, yolo: yolo2, mentions: mentionsOpt, sessions, resumeLatest: resumeLatest2, onViewTurns, onViewResume, isEscOwned }) {
   const { exit } = use_app_default();
@@ -100914,6 +101371,7 @@ function useReplController({ repoName: repoName2, yolo: yolo2, mentions: mention
   const abortRef = (0, import_react30.useRef)(null);
   const pendingRef = (0, import_react30.useRef)(null);
   const toolsetRef = (0, import_react30.useRef)(null);
+  const rulesRef = (0, import_react30.useRef)(void 0);
   (0, import_react30.useEffect)(() => {
     sessionTokensRef.current = sessionTokens;
   }, [sessionTokens]);
@@ -100966,6 +101424,7 @@ function useReplController({ repoName: repoName2, yolo: yolo2, mentions: mention
       cwd: process.cwd(),
       permissions,
       onTodos: setTodos,
+      ...rulesRef.current ? { rules: rulesRef.current } : {},
       ...profileRef.current && profileRef.current.tools.length > 0 ? { extra: { tools: profileRef.current.tools, handlers: profileRef.current.handlers } } : {},
       confirm: (req) => new Promise((resolve2) => {
         const item = {
@@ -101165,7 +101624,7 @@ function useReplController({ repoName: repoName2, yolo: yolo2, mentions: mention
           }
           setIsRunning(true);
           try {
-            const apiKey2 = await resolveApiKey({ env: process.env, readFile: (p) => readFile4(p, "utf-8"), homedir: homedir2 });
+            const apiKey2 = await resolveApiKey({ env: process.env, readFile: (p) => readFile6(p, "utf-8"), homedir: homedir2 });
             if (!apiKey2) {
               notice(MISSING_KEY_MESSAGE);
               return;
@@ -101187,7 +101646,7 @@ function useReplController({ repoName: repoName2, yolo: yolo2, mentions: mention
         }
         case "model": {
           try {
-            const apiKey2 = await resolveApiKey({ env: process.env, readFile: (p) => readFile4(p, "utf-8"), homedir: homedir2 });
+            const apiKey2 = await resolveApiKey({ env: process.env, readFile: (p) => readFile6(p, "utf-8"), homedir: homedir2 });
             if (!apiKey2) {
               notice(MISSING_KEY_MESSAGE);
               return;
@@ -101229,7 +101688,7 @@ ${tools.map((t) => `  ${t.name}`).join("\n")}`);
     try {
       apiKey = await resolveApiKey({
         env: process.env,
-        readFile: (p) => readFile4(p, "utf-8"),
+        readFile: (p) => readFile6(p, "utf-8"),
         homedir: homedir2
       });
     } catch (err) {
@@ -101265,15 +101724,23 @@ ${tools.map((t) => `  ${t.name}`).join("\n")}`);
     try {
       profilePromiseRef.current ??= prepareProfile({
         env: process.env,
-        readFile: (p) => readFile4(p, "utf-8"),
-        writeFile: (p, d) => writeFile3(p, d, { encoding: "utf-8", mode: 384 }),
+        readFile: (p) => readFile6(p, "utf-8"),
+        writeFile: (p, d) => writeFile4(p, d, { encoding: "utf-8", mode: 384 }),
         mkdir: async (p) => {
-          await mkdir3(p, { recursive: true });
+          await mkdir4(p, { recursive: true });
         },
         homedir: homedir2,
         fetch,
         cwd: process.cwd(),
-        gitRoot: gitTopLevel
+        gitRoot: gitTopLevel,
+        importGate: async () => {
+          const configDir = process.env.SPACECODE_CONFIG_DIR?.trim() || join6(homedir2(), ".spacecode");
+          const gate = await importGateStatus({ configDir, cwd: process.cwd(), interactive: Boolean(process.stdin.isTTY) });
+          const loaded = await loadPermissionRules({ configDir, homeDir: homedir2(), cwd: process.cwd() });
+          rulesRef.current = loaded.rules;
+          if (loaded.defaultMode && !yolo2) permissions.set(loaded.defaultMode);
+          return [...gate, ...loaded.statusLines];
+        }
       });
       profileRef.current = await profilePromiseRef.current;
       const toolset = createToolset();
@@ -101400,6 +101867,8 @@ var init_useReplController = __esm({
     init_node_mentions();
     init_api_key();
     init_profile_runtime();
+    init_import_gate();
+    init_permission_rules_loader();
     init_slash_commands();
     init_useEventAccumulator();
     gitTopLevel = () => new Promise((resolve2) => {
@@ -101984,7 +102453,7 @@ function clearOnResize(stdout) {
 var import_jsx_runtime14 = __toESM(require_jsx_runtime(), 1);
 if (process.argv[2] === "import-claude") {
   const { runImportClaude: runImportClaude2 } = await Promise.resolve().then(() => (init_import_claude(), import_claude_exports));
-  const { readFile: readFile5, readdir: readdir3 } = await import("node:fs/promises");
+  const { readFile: readFile7, readdir: readdir3 } = await import("node:fs/promises");
   const { execFile: execFile4 } = await import("node:child_process");
   const gitRoot = () => new Promise((resolve2) => {
     execFile4("git", ["rev-parse", "--show-toplevel"], { cwd: process.cwd() }, (err, stdout) => resolve2(err ? null : stdout.trim() || null));
@@ -101992,8 +102461,8 @@ if (process.argv[2] === "import-claude") {
   const code = await runImportClaude2({
     argv: process.argv.slice(2),
     env: process.env,
-    fs: { readFile: (p) => readFile5(p, "utf-8"), readdir: (p) => readdir3(p) },
-    readFile: (p) => readFile5(p, "utf-8"),
+    fs: { readFile: (p) => readFile7(p, "utf-8"), readdir: (p) => readdir3(p) },
+    readFile: (p) => readFile7(p, "utf-8"),
     homedir: os5.homedir,
     cwd: process.cwd(),
     gitRoot,