wave-agent-sdk 0.0.8 → 0.0.11

package/dist/managers/messageManager.js

@@ -1,6 +1,6 @@
-import { addAssistantMessageToMessages, updateToolBlockInMessage, addErrorBlockToMessage, addDiffBlockToMessage, addUserMessageToMessages, extractUserInputHistory, addMemoryBlockToMessage, addCommandOutputMessage, updateCommandOutputInMessage, completeCommandInMessage, addSubagentBlockToMessage, updateSubagentBlockInMessage, removeLastUserMessage, } from "../utils/messageOperations.js";
+import { addAssistantMessageToMessages, updateToolBlockInMessage, addErrorBlockToMessage, addUserMessageToMessages, extractUserInputHistory, addMemoryBlockToMessage, addCommandOutputMessage, updateCommandOutputInMessage, completeCommandInMessage, addSubagentBlockToMessage, updateSubagentBlockInMessage, removeLastUserMessage, } from "../utils/messageOperations.js";
 import { join } from "path";
-import { cleanupExpiredSessionsFromJsonl, getLatestSessionFromJsonl, loadSessionFromJsonl, appendMessages, createSession, generateSessionId, SESSION_DIR, } from "../services/session.js";
+import { appendMessages, createSession, generateSessionId, SESSION_DIR, } from "../services/session.js";
 import { pathEncoder } from "../utils/pathEncoder.js";
 export class MessageManager {
     constructor(options) {
@@ -8,14 +8,12 @@ export class MessageManager {
         this.messages = [];
         this.latestTotalTokens = 0;
         this.userInputHistory = [];
-        this.sessionStartTime = new Date().toISOString();
         this.workdir = options.workdir;
         this.encodedWorkdir = pathEncoder.encodeSync(this.workdir); // Cache encoded workdir
         this.callbacks = options.callbacks;
         this.logger = options.logger;
         this.savedMessageCount = 0; // Initialize saved message count tracker
         this.sessionType = options.sessionType || "main";
-        this.parentSessionId = options.parentSessionId;
         this.subagentType = options.subagentType;
         // Compute and cache the transcript path
         this.transcriptPath = this.computeTranscriptPath();
@@ -33,9 +31,6 @@ export class MessageManager {
     getUserInputHistory() {
         return [...this.userInputHistory];
     }
-    getSessionStartTime() {
-        return this.sessionStartTime;
-    }
     getWorkdir() {
         return this.workdir;
     }
@@ -71,7 +66,7 @@ export class MessageManager {
      */
     async createSessionIfNeeded() {
         try {
-            await createSession(this.sessionId, this.workdir, this.sessionType, this.parentSessionId, this.subagentType);
+            await createSession(this.sessionId, this.workdir, this.sessionType);
         }
         catch (error) {
             this.logger?.error("Failed to create session:", error);
@@ -99,7 +94,7 @@ export class MessageManager {
             }
             // Use JSONL format for new sessions
             await appendMessages(this.sessionId, unsavedMessages, // Only append new messages
-            this.workdir);
+            this.workdir, this.sessionType);
             // Update the saved message count
             this.savedMessageCount = this.messages.length;
         }
@@ -107,46 +102,6 @@ export class MessageManager {
             this.logger?.error("Failed to save session:", error);
         }
     }
-    /**
-     * Handle session restoration logic
-     */
-    async handleSessionRestoration(restoreSessionId, continueLastSession) {
-        // Clean up expired sessions first
-        cleanupExpiredSessionsFromJsonl(this.workdir).catch((error) => {
-            this.logger?.warn("Failed to cleanup expired sessions:", error);
-        });
-        if (!restoreSessionId && !continueLastSession) {
-            return;
-        }
-        try {
-            let sessionToRestore = null;
-            if (restoreSessionId) {
-                // Use only JSONL format - no legacy support
-                sessionToRestore = await loadSessionFromJsonl(restoreSessionId, this.workdir);
-                if (!sessionToRestore) {
-                    console.error(`Session not found: ${restoreSessionId}`);
-                    process.exit(1);
-                }
-            }
-            else if (continueLastSession) {
-                // Use only JSONL format - no legacy support
-                sessionToRestore = await getLatestSessionFromJsonl(this.workdir);
-                if (!sessionToRestore) {
-                    console.error(`No previous session found for workdir: ${this.workdir}`);
-                    process.exit(1);
-                }
-            }
-            if (sessionToRestore) {
-                console.log(`Restoring session: ${sessionToRestore.id}`);
-                // Initialize from session data
-                this.initializeFromSession(sessionToRestore);
-            }
-        }
-        catch (error) {
-            console.error("Failed to restore session:", error);
-            process.exit(1);
-        }
-    }
     setlatestTotalTokens(latestTotalTokens) {
         if (this.latestTotalTokens !== latestTotalTokens) {
             this.latestTotalTokens = latestTotalTokens;
@@ -165,7 +120,6 @@ export class MessageManager {
         this.setUserInputHistory([]);
         this.setSessionId(generateSessionId());
         this.setlatestTotalTokens(0);
-        this.sessionStartTime = new Date().toISOString();
         this.savedMessageCount = 0; // Reset saved message count
     }
     // Initialize state from session data
@@ -173,8 +127,6 @@ export class MessageManager {
         this.setSessionId(sessionData.id);
         this.setMessages([...sessionData.messages]);
         this.setlatestTotalTokens(sessionData.metadata.latestTotalTokens);
-        // Restore the original session start time
-        this.sessionStartTime = sessionData.metadata.startedAt;
         // Extract user input history from session messages
         this.setUserInputHistory(extractUserInputHistory(sessionData.messages));
         // Set saved message count to the number of loaded messages since they're already saved
@@ -205,36 +157,36 @@ export class MessageManager {
         this.callbacks.onUserMessageAdded?.(params);
         // Note: Subagent-specific callbacks are now handled by SubagentManager
     }
-    addAssistantMessage(content, toolCalls, usage, metadata) {
-        const metadataRecord = metadata
-            ? Object.fromEntries(Object.entries(metadata).filter(([, value]) => value !== undefined))
+    addAssistantMessage(content, toolCalls, usage, additionalFields) {
+        const additionalFieldsRecord = additionalFields
+            ? Object.fromEntries(Object.entries(additionalFields).filter(([, value]) => value !== undefined))
             : undefined;
-        const newMessages = addAssistantMessageToMessages(this.messages, content, toolCalls, usage, metadataRecord);
+        const newMessages = addAssistantMessageToMessages(this.messages, content, toolCalls, usage, additionalFieldsRecord);
         this.setMessages(newMessages);
         this.callbacks.onAssistantMessageAdded?.();
         // Note: Subagent-specific callbacks are now handled by SubagentManager
     }
-    mergeAssistantMetadata(metadata) {
-        if (!metadata || Object.keys(metadata).length === 0) {
+    mergeAssistantAdditionalFields(additionalFields) {
+        if (!additionalFields || Object.keys(additionalFields).length === 0) {
             return;
         }
         const newMessages = [...this.messages];
         for (let i = newMessages.length - 1; i >= 0; i--) {
             const message = newMessages[i];
             if (message.role === "assistant") {
-                const mergedMetadata = {
-                    ...(message.metadata || {}),
+                const mergedAdditionalFields = {
+                    ...(message.additionalFields || {}),
                 };
-                for (const [key, value] of Object.entries(metadata)) {
+                for (const [key, value] of Object.entries(additionalFields)) {
                     if (value === undefined) {
                         continue;
                     }
-                    mergedMetadata[key] = value;
+                    mergedAdditionalFields[key] = value;
                 }
-                if (Object.keys(mergedMetadata).length === 0) {
+                if (Object.keys(mergedAdditionalFields).length === 0) {
                     return;
                 }
-                message.metadata = mergedMetadata;
+                message.additionalFields = mergedAdditionalFields;
                 this.setMessages(newMessages);
                 return;
             }
@@ -259,15 +211,6 @@ export class MessageManager {
         this.callbacks.onToolBlockUpdated?.(params);
         // Note: Subagent-specific callbacks are now handled by SubagentManager
     }
-    addDiffBlock(filePath, diffResult) {
-        const newMessages = addDiffBlockToMessage({
-            messages: this.messages,
-            path: filePath,
-            diffResult,
-        });
-        this.setMessages(newMessages);
-        this.callbacks.onDiffBlockAdded?.(filePath, JSON.stringify(diffResult));
-    }
     addErrorBlock(error) {
         const newMessages = addErrorBlockToMessage({
             messages: this.messages,
@@ -408,7 +351,7 @@ export class MessageManager {
         }
         else {
             // Add new text block if none exists
-            lastMessage.blocks.unshift({
+            lastMessage.blocks.push({
                 type: "text",
                 content: newAccumulatedContent,
             });
@@ -418,6 +361,41 @@ export class MessageManager {
         // Note: Subagent-specific callbacks are now handled by SubagentManager
         this.callbacks.onMessagesChange?.([...this.messages]); // Still need to notify of changes
     }
+    /**
+     * Update the current assistant message reasoning during streaming
+     * This method updates the last assistant message's reasoning content without creating a new message
+     */
+    updateCurrentMessageReasoning(newAccumulatedReasoning) {
+        if (this.messages.length === 0)
+            return;
+        const lastMessage = this.messages[this.messages.length - 1];
+        if (lastMessage.role !== "assistant")
+            return;
+        // Get the current reasoning content to calculate the chunk
+        const reasoningBlockIndex = lastMessage.blocks.findIndex((block) => block.type === "reasoning");
+        const currentReasoning = reasoningBlockIndex >= 0
+            ? lastMessage.blocks[reasoningBlockIndex].content || ""
+            : "";
+        // Calculate the chunk (new content since last update)
+        const chunk = newAccumulatedReasoning.slice(currentReasoning.length);
+        if (reasoningBlockIndex >= 0) {
+            // Update existing reasoning block
+            lastMessage.blocks[reasoningBlockIndex] = {
+                type: "reasoning",
+                content: newAccumulatedReasoning,
+            };
+        }
+        else {
+            // Add new reasoning block if none exists
+            lastMessage.blocks.push({
+                type: "reasoning",
+                content: newAccumulatedReasoning,
+            });
+        }
+        // Trigger callbacks with chunk and accumulated reasoning content
+        this.callbacks.onAssistantReasoningUpdated?.(chunk, newAccumulatedReasoning);
+        this.callbacks.onMessagesChange?.([...this.messages]); // Still need to notify of changes
+    }
     /**
      * Remove the last user message from the conversation
      * Used for hook error handling when the user prompt needs to be erased

package/dist/managers/permissionManager.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Permission Manager for handling tool permission checks
+ *
+ * This manager provides utilities for checking permissions before tool execution.
+ * It implements the permission logic for different modes (default vs bypass) and
+ * handles custom callback integration.
+ */
+import type { PermissionDecision, ToolPermissionContext, PermissionCallback, PermissionMode } from "../types/permissions.js";
+import type { Logger } from "../types/index.js";
+export interface PermissionManagerOptions {
+    /** Logger for debugging permission decisions */
+    logger?: Logger;
+    /** Configured default permission mode from settings */
+    configuredDefaultMode?: PermissionMode;
+    /** Allowed rules from settings */
+    allowedRules?: string[];
+}
+export declare class PermissionManager {
+    private logger?;
+    private configuredDefaultMode?;
+    private allowedRules;
+    private onConfiguredDefaultModeChange?;
+    constructor(options?: PermissionManagerOptions);
+    /**
+     * Set a callback to be notified when the effective permission mode changes due to configuration updates
+     */
+    setOnConfiguredDefaultModeChange(callback: (mode: PermissionMode) => void): void;
+    /**
+     * Update the configured default mode (e.g., when configuration reloads)
+     */
+    updateConfiguredDefaultMode(defaultMode?: PermissionMode): void;
+    /**
+     * Get all currently allowed rules
+     */
+    getAllowedRules(): string[];
+    /**
+     * Update the allowed rules (e.g., when configuration reloads)
+     */
+    updateAllowedRules(rules: string[]): void;
+    /**
+     * Get the current effective permission mode for tool execution context
+     */
+    getCurrentEffectiveMode(cliPermissionMode?: PermissionMode): PermissionMode;
+    /**
+     * Resolve the effective permission mode based on CLI override and configured default
+     */
+    resolveEffectivePermissionMode(cliPermissionMode?: PermissionMode): PermissionMode;
+    /**
+     * Check if a tool execution requires permission and handle the authorization flow
+     * Called by individual tools after validation/diff, before real operation
+     */
+    checkPermission(context: ToolPermissionContext): Promise<PermissionDecision>;
+    /**
+     * Determine if a tool requires permission checks based on its name
+     */
+    isRestrictedTool(toolName: string): boolean;
+    /**
+     * Helper method to create a permission context for CLI integration
+     */
+    createContext(toolName: string, permissionMode: PermissionMode, callback?: PermissionCallback, toolInput?: Record<string, unknown>): ToolPermissionContext;
+    /**
+     * Check if a tool call is allowed by persistent rules
+     */
+    private isAllowedByRule;
+    /**
+     * Expand a bash command into individual permission rules, filtering out safe commands.
+     * Used when saving permissions to the allow list.
+     *
+     * @param command The full bash command string
+     * @param workdir The working directory for path safety checks
+     * @returns Array of permission rules in "Bash(cmd)" format
+     */
+    expandBashRule(command: string, workdir: string): string[];
+}
+//# sourceMappingURL=permissionManager.d.ts.map

package/dist/managers/permissionManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionManager.d.ts","sourceRoot":"","sources":["../../src/managers/permissionManager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EACV,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,cAAc,EACf,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAYhD,MAAM,WAAW,wBAAwB;IACvC,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uDAAuD;IACvD,qBAAqB,CAAC,EAAE,cAAc,CAAC;IACvC,kCAAkC;IAClC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,qBAAqB,CAAC,CAAiB;IAC/C,OAAO,CAAC,YAAY,CAAgB;IACpC,OAAO,CAAC,6BAA6B,CAAC,CAAiC;gBAE3D,OAAO,GAAE,wBAA6B;IAMlD;;OAEG;IACI,gCAAgC,CACrC,QAAQ,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,IAAI,GACvC,IAAI;IAIP;;OAEG;IACH,2BAA2B,CAAC,WAAW,CAAC,EAAE,cAAc,GAAG,IAAI;IAyB/D;;OAEG;IACI,eAAe,IAAI,MAAM,EAAE;IAIlC;;OAEG;IACH,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAOzC;;OAEG;IACH,uBAAuB,CAAC,iBAAiB,CAAC,EAAE,cAAc,GAAG,cAAc;IAI3E;;OAEG;IACH,8BAA8B,CAC5B,iBAAiB,CAAC,EAAE,cAAc,GACjC,cAAc;IAuBjB;;;OAGG;IACG,eAAe,CACnB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,kBAAkB,CAAC;IAqF9B;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAW3C;;OAEG;IACH,aAAa,CACX,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,cAAc,EAC9B,QAAQ,CAAC,EAAE,kBAAkB,EAC7B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,qBAAqB;IAuExB;;OAEG;IACH,OAAO,CAAC,eAAe;IAiEvB;;;;;;;OAOG;IACI,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE;CAiFlE"}

package/dist/managers/permissionManager.js

@@ -0,0 +1,368 @@
+/**
+ * Permission Manager for handling tool permission checks
+ *
+ * This manager provides utilities for checking permissions before tool execution.
+ * It implements the permission logic for different modes (default vs bypass) and
+ * handles custom callback integration.
+ */
+import path from "node:path";
+import { RESTRICTED_TOOLS } from "../types/permissions.js";
+import { splitBashCommand, stripEnvVars, stripRedirections, getSmartPrefix, DANGEROUS_COMMANDS, } from "../utils/bashParser.js";
+import { isPathInside } from "../utils/pathSafety.js";
+const SAFE_COMMANDS = ["cd", "ls", "pwd"];
+export class PermissionManager {
+    constructor(options = {}) {
+        this.allowedRules = [];
+        this.logger = options.logger;
+        this.configuredDefaultMode = options.configuredDefaultMode;
+        this.allowedRules = options.allowedRules || [];
+    }
+    /**
+     * Set a callback to be notified when the effective permission mode changes due to configuration updates
+     */
+    setOnConfiguredDefaultModeChange(callback) {
+        this.onConfiguredDefaultModeChange = callback;
+    }
+    /**
+     * Update the configured default mode (e.g., when configuration reloads)
+     */
+    updateConfiguredDefaultMode(defaultMode) {
+        const oldEffectiveMode = this.getCurrentEffectiveMode();
+        this.logger?.debug("Updating configured default permission mode", {
+            previous: this.configuredDefaultMode,
+            new: defaultMode,
+        });
+        this.configuredDefaultMode = defaultMode;
+        const newEffectiveMode = this.getCurrentEffectiveMode();
+        if (oldEffectiveMode !== newEffectiveMode &&
+            this.onConfiguredDefaultModeChange) {
+            this.logger?.debug("Effective permission mode changed due to configuration update", {
+                oldMode: oldEffectiveMode,
+                newMode: newEffectiveMode,
+            });
+            this.onConfiguredDefaultModeChange(newEffectiveMode);
+        }
+    }
+    /**
+     * Get all currently allowed rules
+     */
+    getAllowedRules() {
+        return [...this.allowedRules];
+    }
+    /**
+     * Update the allowed rules (e.g., when configuration reloads)
+     */
+    updateAllowedRules(rules) {
+        this.logger?.debug("Updating allowed permission rules", {
+            count: rules.length,
+        });
+        this.allowedRules = rules;
+    }
+    /**
+     * Get the current effective permission mode for tool execution context
+     */
+    getCurrentEffectiveMode(cliPermissionMode) {
+        return this.resolveEffectivePermissionMode(cliPermissionMode);
+    }
+    /**
+     * Resolve the effective permission mode based on CLI override and configured default
+     */
+    resolveEffectivePermissionMode(cliPermissionMode) {
+        // CLI override takes highest precedence
+        if (cliPermissionMode !== undefined) {
+            this.logger?.debug("Using CLI permission mode override", {
+                cliMode: cliPermissionMode,
+                configuredDefault: this.configuredDefaultMode,
+            });
+            return cliPermissionMode;
+        }
+        // Use configured default mode if available
+        if (this.configuredDefaultMode !== undefined) {
+            this.logger?.debug("Using configured default permission mode", {
+                configuredDefault: this.configuredDefaultMode,
+            });
+            return this.configuredDefaultMode;
+        }
+        // Fall back to system default
+        this.logger?.debug("Using system default permission mode");
+        return "default";
+    }
+    /**
+     * Check if a tool execution requires permission and handle the authorization flow
+     * Called by individual tools after validation/diff, before real operation
+     */
+    async checkPermission(context) {
+        this.logger?.debug("Checking permission for tool", {
+            toolName: context.toolName,
+            permissionMode: context.permissionMode,
+            hasCallback: !!context.canUseToolCallback,
+        });
+        // 1. If bypassPermissions mode, always allow
+        if (context.permissionMode === "bypassPermissions") {
+            this.logger?.debug("Permission bypassed for tool", {
+                toolName: context.toolName,
+            });
+            return { behavior: "allow" };
+        }
+        // 1.1 If acceptEdits mode, allow Edit, MultiEdit, Delete, Write
+        if (context.permissionMode === "acceptEdits") {
+            const autoAcceptedTools = ["Edit", "MultiEdit", "Delete", "Write"];
+            if (autoAcceptedTools.includes(context.toolName)) {
+                this.logger?.debug("Permission automatically accepted for tool in acceptEdits mode", {
+                    toolName: context.toolName,
+                });
+                return { behavior: "allow" };
+            }
+        }
+        // 1.2 Check if tool call matches any allowed rule
+        if (this.isAllowedByRule(context)) {
+            this.logger?.debug("Permission allowed by persistent rule", {
+                toolName: context.toolName,
+            });
+            return { behavior: "allow" };
+        }
+        // 2. If not a restricted tool, always allow
+        if (!this.isRestrictedTool(context.toolName)) {
+            this.logger?.debug("Tool is not restricted, allowing", {
+                toolName: context.toolName,
+            });
+            return { behavior: "allow" };
+        }
+        // 3. If custom callback provided, call it and return result
+        if (context.canUseToolCallback) {
+            try {
+                this.logger?.debug("Calling custom permission callback for tool", {
+                    toolName: context.toolName,
+                });
+                const decision = await context.canUseToolCallback(context);
+                this.logger?.debug("Custom callback returned decision", {
+                    toolName: context.toolName,
+                    decision,
+                });
+                return decision;
+            }
+            catch (error) {
+                const errorMessage = error instanceof Error ? error.message : String(error);
+                this.logger?.error("Error in permission callback", {
+                    toolName: context.toolName,
+                    error: errorMessage,
+                });
+                return {
+                    behavior: "deny",
+                    message: "Error in permission callback",
+                };
+            }
+        }
+        // 4. For default mode on restricted tools without callback, integrate with CLI confirmation
+        // Note: CLI confirmation integration will be implemented in Phase 2
+        this.logger?.warn("No permission callback provided for restricted tool in default mode", {
+            toolName: context.toolName,
+        });
+        return {
+            behavior: "deny",
+            message: `Tool '${context.toolName}' requires permission approval. No permission callback configured.`,
+        };
+    }
+    /**
+     * Determine if a tool requires permission checks based on its name
+     */
+    isRestrictedTool(toolName) {
+        const isRestricted = RESTRICTED_TOOLS.includes(toolName);
+        this.logger?.debug("Checking if tool is restricted", {
+            toolName,
+            isRestricted,
+        });
+        return isRestricted;
+    }
+    /**
+     * Helper method to create a permission context for CLI integration
+     */
+    createContext(toolName, permissionMode, callback, toolInput) {
+        let suggestedPrefix;
+        if (toolName === "Bash" && toolInput?.command) {
+            const command = String(toolInput.command);
+            const parts = splitBashCommand(command);
+            // Only suggest prefix for single commands to avoid confusion with complex chains
+            if (parts.length === 1) {
+                const processedPart = stripRedirections(stripEnvVars(parts[0]));
+                suggestedPrefix = getSmartPrefix(processedPart) ?? undefined;
+            }
+        }
+        const context = {
+            toolName,
+            permissionMode,
+            canUseToolCallback: callback,
+            toolInput,
+            suggestedPrefix,
+        };
+        // Set hidePersistentOption for dangerous or out-of-bounds bash commands
+        if (toolName === "Bash" && toolInput?.command) {
+            const command = String(toolInput.command);
+            const workdir = toolInput.workdir;
+            const parts = splitBashCommand(command);
+            const isDangerous = parts.some((part) => {
+                const processedPart = stripRedirections(stripEnvVars(part));
+                const commandMatch = processedPart.match(/^(\w+)(\s+.*)?$/);
+                if (commandMatch) {
+                    const cmd = commandMatch[1];
+                    const args = commandMatch[2]?.trim() || "";
+                    // Check blacklist
+                    if (DANGEROUS_COMMANDS.includes(cmd)) {
+                        return true;
+                    }
+                    // Check out-of-bounds for cd and ls
+                    if (workdir && (cmd === "cd" || cmd === "ls")) {
+                        const pathArgs = (args.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || []).filter((arg) => !arg.startsWith("-")) || [];
+                        return pathArgs.some((pathArg) => {
+                            const cleanPath = pathArg.replace(/^['"](.*)['"]$/, "$1");
+                            const absolutePath = path.resolve(workdir, cleanPath);
+                            return !isPathInside(absolutePath, workdir);
+                        });
+                    }
+                }
+                return false;
+            });
+            if (isDangerous) {
+                context.hidePersistentOption = true;
+            }
+        }
+        this.logger?.debug("Created permission context", {
+            toolName,
+            permissionMode,
+            hasCallback: !!callback,
+            hasToolInput: !!toolInput,
+            suggestedPrefix,
+        });
+        return context;
+    }
+    /**
+     * Check if a tool call is allowed by persistent rules
+     */
+    isAllowedByRule(context) {
+        if (context.toolName === "Bash" && context.toolInput?.command) {
+            const command = String(context.toolInput.command);
+            const parts = splitBashCommand(command);
+            if (parts.length === 0)
+                return false;
+            const workdir = context.toolInput?.workdir;
+            return parts.every((part) => {
+                const processedPart = stripRedirections(stripEnvVars(part));
+                // Check for safe commands
+                const commandMatch = processedPart.match(/^(\w+)(\s+.*)?$/);
+                if (commandMatch) {
+                    const cmd = commandMatch[1];
+                    const args = commandMatch[2]?.trim() || "";
+                    if (SAFE_COMMANDS.includes(cmd)) {
+                        if (workdir) {
+                            if (cmd === "pwd") {
+                                return true;
+                            }
+                            // For cd and ls, check paths
+                            const pathArgs = (args.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || []).filter((arg) => !arg.startsWith("-")) || [];
+                            if (pathArgs.length === 0) {
+                                // cd or ls without arguments operates on current dir (workdir)
+                                return true;
+                            }
+                            const allPathsSafe = pathArgs.every((pathArg) => {
+                                // Remove quotes if present
+                                const cleanPath = pathArg.replace(/^['"](.*)['"]$/, "$1");
+                                const absolutePath = path.resolve(workdir, cleanPath);
+                                return isPathInside(absolutePath, workdir);
+                            });
+                            if (allPathsSafe) {
+                                return true;
+                            }
+                        }
+                    }
+                }
+                const action = `${context.toolName}(${processedPart})`;
+                const allowedByRule = this.allowedRules.some((rule) => {
+                    if (rule.endsWith(":*)")) {
+                        const prefix = rule.slice(0, -3);
+                        return action.startsWith(prefix);
+                    }
+                    return action === rule;
+                });
+                if (allowedByRule)
+                    return true;
+                return !this.isRestrictedTool(context.toolName);
+            });
+        }
+        // Add other tools if needed in the future
+        return false;
+    }
+    /**
+     * Expand a bash command into individual permission rules, filtering out safe commands.
+     * Used when saving permissions to the allow list.
+     *
+     * @param command The full bash command string
+     * @param workdir The working directory for path safety checks
+     * @returns Array of permission rules in "Bash(cmd)" format
+     */
+    expandBashRule(command, workdir) {
+        const parts = splitBashCommand(command);
+        const rules = [];
+        for (const part of parts) {
+            const processedPart = stripRedirections(stripEnvVars(part));
+            // Check for safe commands
+            const commandMatch = processedPart.match(/^(\w+)(\s+.*)?$/);
+            let isSafe = false;
+            if (commandMatch) {
+                const cmd = commandMatch[1];
+                const args = commandMatch[2]?.trim() || "";
+                if (SAFE_COMMANDS.includes(cmd)) {
+                    if (cmd === "pwd") {
+                        isSafe = true;
+                    }
+                    else {
+                        // For cd and ls, check paths
+                        const pathArgs = (args.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || []).filter((arg) => !arg.startsWith("-")) || [];
+                        if (pathArgs.length === 0) {
+                            isSafe = true;
+                        }
+                        else {
+                            const allPathsSafe = pathArgs.every((pathArg) => {
+                                const cleanPath = pathArg.replace(/^['"](.*)['"]$/, "$1");
+                                const absolutePath = path.resolve(workdir, cleanPath);
+                                return isPathInside(absolutePath, workdir);
+                            });
+                            if (allPathsSafe) {
+                                isSafe = true;
+                            }
+                        }
+                    }
+                }
+            }
+            if (!isSafe) {
+                // Check if command is dangerous or out-of-bounds
+                const commandMatch = processedPart.match(/^(\w+)(\s+.*)?$/);
+                if (commandMatch) {
+                    const cmd = commandMatch[1];
+                    const args = commandMatch[2]?.trim() || "";
+                    if (DANGEROUS_COMMANDS.includes(cmd)) {
+                        continue;
+                    }
+                    if (cmd === "cd" || cmd === "ls") {
+                        const pathArgs = (args.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || []).filter((arg) => !arg.startsWith("-")) || [];
+                        const isOutOfBounds = pathArgs.some((pathArg) => {
+                            const cleanPath = pathArg.replace(/^['"](.*)['"]$/, "$1");
+                            const absolutePath = path.resolve(workdir, cleanPath);
+                            return !isPathInside(absolutePath, workdir);
+                        });
+                        if (isOutOfBounds) {
+                            continue;
+                        }
+                    }
+                }
+                const smartPrefix = getSmartPrefix(processedPart);
+                if (smartPrefix) {
+                    rules.push(`Bash(${smartPrefix}:*)`);
+                }
+                else {
+                    rules.push(`Bash(${processedPart})`);
+                }
+            }
+        }
+        return rules;
+    }
+}