symbiot 0.50.1 → 0.50.2

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 What each Symbiot release brought, newest first. When Approve bumps the version, it writes that release here from the tasks it approved, worded as release notes by your connected AI (or in the tasks' own words without one). The app shows the releases newer than yours under "What's new" when it offers an update, and once more after you update.
 
+## 0.50.2
+
+- **An allow list is one click.** When an agent needs permissions it doesn't have, it proposes them, as narrow as the task needs, in `.symbiot/allowlist.proposed.json` and offers it as a choice. Pick it in the app and Symbiot turns it on for that folder only and runs the agent again: no copying files, no running claude in a terminal. A list that would let an agent run anything at all (a shell, sudo, rm) is never turned on by a click.
+- **Fixed:** a flag could end up in the agent command as a rule (`Bash(--allowedtools:*)`). It can't any more, and an old one is cleaned out on the next grant.
+
 ## 0.50.1
 
 - **A permission you pick is given.** When an agent asks for one ("let agents read ~/.config/symbiot/screens") and you choose it in the app, Symbiot grants it then and there (as Settings' grant boxes do) and the agent carries on, instead of leaving it as a step for you to do by hand. Steps only you can do, like pasting your own message, are still yours.

package/agents.mjs

@@ -46,6 +46,7 @@ function setHandoffCmd(cmd) {
 // looked bare and became Bash(Bashnpm install:*:*).
 function grantRule(tool) {
   let t = String(tool || "").trim().replace(/^["'`]+|["'`]+$/g, "").trim();
+  if (/^-/.test(t)) return ""; // a flag (--allowedTools) is never a tool
   if (/^[A-Za-z]+\(.*\)$/.test(t)) return t;
   t = t.replace(/[()"'`]/g, "").replace(/:\*$/, "").trim();
   return t ? `Bash(${t}:*)` : "";
@@ -62,7 +63,7 @@ function grantAgent({ tool, dir } = {}) {
   if (!isClaudeCmd(cmd)) return { error: "Grants apply to the Claude agent command. Pick a Claude preset first, or edit the command directly." };
   if (tool) cmd = allowTool(cmd, grantRule(tool));
   if (dir) { const d = String(dir).trim(); if (d && !cmd.includes(`--add-dir "${d}"`)) cmd += ` --add-dir "${d}"`; }
-  cmd = cmd.replace(/\s+/g, " ").trim();
+  cmd = cmd.replace(/\s*"Bash\(-[^"]*\)"/g, "").replace(/\s+/g, " ").trim(); // and drop any flag that got in as a rule before
   cfg.agentCmd = cmd; saveConfig(cfg);
   return { ok: true, cmd };
 }
@@ -577,9 +578,27 @@ function agentQuestions(path, repo) {
 // say-so. "let agents read ~/x" / "allow /x" becomes --add-dir, "let agents run
 // \`tool\`" a grant for that tool (never sudo/rm), as Settings' grant boxes do. What's
 // granted isn't a step left for the user. Returns what was granted, or null.
-function grantFromStep(step) {
+// An allow list an agent proposed (.symbiot/allowlist.proposed.json) is turned on for
+// that folder only (.claude/settings.local.json, merged), unless it would let an agent
+// run anything at all (a shell, sudo, rm, Bash(*)): then it stays the user's step.
+const WIDE_RULE = /^Bash(\((\*|sudo|su|rm|bash|sh|zsh|dash|dd|mkfs|chmod|chown|eval|exec)\b[^)]*\))?$|^Bash\(\*/i;
+function installAllowlist(path) {
+  let p; try { p = JSON.parse(readFileSync(join(path, ".symbiot", "allowlist.proposed.json"), "utf8")).permissions || {}; } catch { return null; }
+  const list = (x) => (Array.isArray(x) ? x.filter((r) => typeof r === "string" && r.trim()).map((r) => r.trim()) : []);
+  const allow = list(p.allow), deny = list(p.deny), dirs = list(p.additionalDirectories);
+  if (!allow.length && !dirs.length) return null;
+  if (allow.some((r) => WIDE_RULE.test(r))) return null;
+  const f = join(path, ".claude", "settings.local.json");
+  let cur = {}; try { cur = JSON.parse(readFileSync(f, "utf8")); } catch {}
+  const perm = cur.permissions || {}, merge = (a, b) => [...new Set([...list(a), ...b])];
+  cur.permissions = { ...perm, allow: merge(perm.allow, allow), deny: merge(perm.deny, deny), additionalDirectories: merge(perm.additionalDirectories, dirs) };
+  try { mkdirSync(join(path, ".claude"), { recursive: true }); writeFileSync(f, JSON.stringify(cur, null, 2) + "\n", { mode: 0o600 }); } catch { return null; }
+  return [`the allow list for this folder (${allow.length} rule${allow.length === 1 ? "" : "s"})`];
+}
+function grantFromStep(step, path = "") {
   const t = String(step || "");
-  if (!/only you: a permission|\b(let|allow) (the )?agents?\b|\ballow (access|reading)\b/i.test(t)) return null;
+  if (path && /allowlist\.proposed\.json|settings\.local\.json|press allow|\ballow list\b/i.test(t)) { const g = installAllowlist(path); if (g) return g; }
+  if (!/only you: a permission|only you: what (this|the) agent|\b(let|allow) (the )?agents?\b|\ballow (access|reading)\b/i.test(t)) return null;
   const got = [];
   const dir = (t.match(/(~\/[^\s,;)`'"]+|\/(?:home|Users|opt|srv|mnt|media|tmp)\/[^\s,;)`'"]+)/) || [])[1];
   if (dir) { const d = dir.replace(/^~(?=\/)/, homedir()).replace(/[.]$/, ""); const r = grantAgent({ dir: d }); if (r && r.ok) got.push(d); }
@@ -609,7 +628,7 @@ function answerQuestions(path, answers, opts = {}) {
   const steps = rows.filter((x) => yourStep(x.a) || holdAnswer(x.a)).map((x) => yourStep(x.a) ? { step: stepText(x.a), named: x.a.split("🤖")[0] }
     : { step: (youOpts(x.q).map(stepText)[0] || x.a).trim(), named: [x.a, ...youOpts(x.q)].join(" ") });
   const granted = [];
-  const yours = steps.map((s) => s.step).filter(Boolean).filter((st) => { const g = grantFromStep(st); if (g) granted.push(...g); return !g; });
+  const yours = steps.map((s) => s.step).filter(Boolean).filter((st) => { const g = grantFromStep(st, path); if (g) granted.push(...g); return !g; });
   if (granted.length) out.granted = granted;
   if (yours.length) {
     const step = yours.join(" "), files = namedFiles(steps.map((s) => s.named).join(" "), path);

package/handover.mjs

@@ -21,7 +21,7 @@ function handoverRules(lanes = [], here = "") {
 }
 // The rule for options in QUESTIONS.md: the user gets only what no agent can do,
 // and the option says which kind it is.
-const ONLY_YOU = "- Only what no agent can do is the user's: their body (a phone in their hand, a cable, which network they're on), their identity or secrets (signing in, a 2FA code, a token from a provider's console) or a decision that's theirs (closing an account, spending money, sending something in their name). Start such an option with `👤 You (only you: <which>):`, e.g. `👤 You (only you: your Meta token): paste it into .env`. Anything an agent could do, yours or another lane's, is never a 👤 step: do it, or hand it over. An option where picking it is enough starts with `🤖 Agent:`. Tag actions only: an option that just reports what the user saw or decides (`it notified me`, `not tried yet`) gets no tag.";
+const ONLY_YOU = "- Only what no agent can do is the user's: their body (a phone in their hand, a cable, which network they're on), their identity or secrets (signing in, a 2FA code, a token from a provider's console) or a decision that's theirs (closing an account, spending money, sending something in their name). Start such an option with `👤 You (only you: <which>):`, e.g. `👤 You (only you: your Meta token): paste it into .env`. Anything an agent could do, yours or another lane's, is never a 👤 step: do it, or hand it over. An option where picking it is enough starts with `🤖 Agent:`. Tag actions only: an option that just reports what the user saw or decides (`it notified me`, `not tried yet`) gets no tag. A permission your run doesn't have (a command, a folder) is never a chore for the user: write the rules, as narrow as the task needs, to `.symbiot/allowlist.proposed.json` (`{\"permissions\": {\"allow\": [...], \"deny\": [...], \"additionalDirectories\": [...]}}`) and offer `👤 You (only you: a permission): allow the list in .symbiot/allowlist.proposed.json`. Picking it in Symbiot turns it on for this folder and runs you again; don't ask them to copy files or run claude in a terminal for it.";
 
 // What an agent handed over: [{ lane, text }] from its .symbiot/HANDOFF.md.
 function parseHandoffs(md) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "symbiot",
-  "version": "0.50.1",
+  "version": "0.50.2",
   "description": "Your week, written from your real work. Reads your local git and writes it up with the AI of your choice — Claude, OpenAI, Gemini, or a local model.",
   "type": "module",
   "bin": {