zelari-code 2.11.2 → 2.13.0

package/dist/cli/safety/policyEngine.js

@@ -0,0 +1,315 @@
+/**
+ * Policy engine v2 (P0.A) — per-command and per-path permission rules per
+ * agent, layered on top of the per-CATEGORY policy in toolPermissions.ts.
+ *
+ * Rules come from two USER-authored config files (same trust level as
+ * AGENTS.MD — deliberately NO trust subsystem here; the GLOBAL file is the
+ * user's personal floor, which the project file can NO LONGER relax):
+ *
+ *   <root>/.zelari/policy.json   — project rules
+ *   ~/.zelari/policy.json        — global rules
+ *
+ * Shape:
+ *   {
+ *     version?: 1,
+ *     agents: {
+ *       lead?    : { shell?: Rule[], edit?: Rule[] },
+ *       explore? : { shell?: Rule[], edit?: Rule[] },
+ *       general? : { shell?: Rule[], edit?: Rule[] },
+ *       verify?  : { shell?: Rule[], edit?: Rule[] }
+ *     }
+ *   }
+ *   Rule = { match: string, effect: 'allow' | 'ask' | 'deny', reason?: string }
+ *
+ * `match` is a GLOB-style prefix pattern: `git push*` matches any command
+ * starting with "git push"; `src/**` matches any path under src/; `*` alone
+ * matches everything. Within one LAYER's ordered rule list the FIRST match
+ * wins (P0.A): the two layers stay SEPARATE and combine RESTRICT-ONLY — every
+ * matching rule intersects with the category decision, most-restrictive-wins
+ * (deny > ask > allow), so a global deny can never be masked by the project.
+ * Escape hatch: ZELARI_POLICY_PRECEDENCE=legacy restores the v1 behavior
+ * (project rules concatenated before global ones, first-match overrides);
+ * the active mode is exposed as `PolicySet.precedence`.
+ *
+ * Fail-closed conventions (mirrors toolPermissions.ts): a missing file is
+ * silently empty; a broken file NEVER throws — the parse error is collected
+ * in `warnings` and the offending file/section is ignored. Opt out entirely
+ * with ZELARI_POLICY=0 (always the empty set).
+ *
+ * Hand-rolled validators on purpose: no zod, no new deps.
+ *
+ * @since v2.12.0 · restrict-only layers v2.13.0
+ */
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import path from 'node:path';
+/** The authoritative agent keys ('lead' = the main registry; the three
+ * sub-agent kinds mirror taskAgentToProfile in toolRegistry.ts). */
+export const POLICY_AGENTS = ['lead', 'explore', 'general', 'verify'];
+const KNOWN_AGENTS = new Set(POLICY_AGENTS);
+export const EMPTY_POLICY_RULE_SET = { shell: [], edit: [] };
+export const EMPTY_POLICY_LAYERS = {
+    global: EMPTY_POLICY_RULE_SET,
+    project: EMPTY_POLICY_RULE_SET,
+};
+export function emptyPolicySet() {
+    return { agents: new Map(), warnings: [], precedence: policyPrecedenceFromEnv() };
+}
+/** Raw layers for one agent; unknown/unlisted agents get the empty layers. */
+export function agentLayersFor(set, agent) {
+    return set.agents.get(agent) ?? EMPTY_POLICY_LAYERS;
+}
+/**
+ * COMPAT view (v1 shape): project rules then global rules in ONE list —
+ * first-match over this concatenation IS legacy precedence. Restrict-only
+ * consumers must use agentLayersFor + matchAgentPolicyRuleLayered instead.
+ */
+export function agentRulesFor(set, agent) {
+    const l = set.agents.get(agent);
+    if (!l)
+        return EMPTY_POLICY_RULE_SET;
+    return {
+        shell: [...l.project.shell, ...l.global.shell],
+        edit: [...l.project.edit, ...l.global.edit],
+    };
+}
+// ── Glob matching ──────────────────────────────────────────────────────────
+/**
+ * Compile a GLOB-style pattern into an ANCHORED RegExp (full match).
+ *
+ * Wildcard semantics: `*` and `**` are both "any characters, including path
+ * separators" — these are prefix patterns, not full minimatch; `src/**`
+ * means "anything under src/", `git push*` means "starts with git push",
+ * and a bare `*` is the catch-all. Consecutive stars collapse to one `.*`.
+ * Every other character is regex-escaped (`data.json` matches literally).
+ */
+export function globToRegExp(pattern) {
+    let src = '^';
+    for (let i = 0; i < pattern.length; i++) {
+        const ch = pattern[i];
+        if (ch === '*') {
+            while (pattern[i + 1] === '*')
+                i++;
+            src += '.*';
+        }
+        else if ('\\^$.|?+()[]{}'.includes(ch)) {
+            src += '\\' + ch;
+        }
+        else {
+            src += ch;
+        }
+    }
+    return new RegExp(src + '$');
+}
+/** Backslashes (Windows paths) normalize to `/` so `src/**` matches `src\x.ts`. */
+function normalizeForMatch(value) {
+    return value.replace(/\\/g, '/');
+}
+/**
+ * First match wins: return the FIRST rule whose pattern matches `value`,
+ * or null when nothing matches (caller keeps its category decision).
+ */
+export function resolvePolicyRule(rules, value) {
+    const v = normalizeForMatch(value);
+    for (const rule of rules) {
+        if (globToRegExp(normalizeForMatch(rule.match)).test(v))
+            return rule;
+    }
+    return null;
+}
+// ── Merge with the category decision ──────────────────────────────────────
+/** Shared lattice with policyLayers.ts intersectEffects: deny > ask > allow. */
+export const EFFECT_RANK = { allow: 0, ask: 1, deny: 2 };
+/**
+ * Merge a matched rule's effect into the category-level action under the
+ * same lattice as intersectPermissionPolicy: deny > ask > allow. A rule can
+ * only ADD restriction — an `allow` rule never un-asks or un-denies a
+ * category restriction (no privilege escalation via policy.json).
+ */
+export function mergeRuleEffect(base, rule) {
+    if (!rule)
+        return base;
+    return EFFECT_RANK[rule.effect] > EFFECT_RANK[base] ? rule.effect : base;
+}
+/**
+ * Path candidates to test against edit rules: the argument as passed, plus
+ * the root-relative form when the arg lives under `root` (so `src/**` works
+ * whether the model passed `src/x.ts` or `E:\repo\src\x.ts`). Root-relative
+ * first — it is what users write in policy.json.
+ */
+function pathCandidates(value, root) {
+    const norm = normalizeForMatch(value);
+    if (!root)
+        return [norm];
+    const prefix = normalizeForMatch(root).replace(/\/+$/, '') + '/';
+    const stripped = norm.toLowerCase().startsWith(prefix.toLowerCase())
+        ? norm.slice(prefix.length)
+        : null;
+    return stripped !== null ? [stripped, norm] : [norm];
+}
+/**
+ * Find the agent rule that applies to one tool invocation:
+ * - execute-category tools (bash, inspect_command): shell rules vs the
+ *   `command` string argument;
+ * - write-category tools (write_file / edit_file / apply_diff): edit rules
+ *   vs the primary path argument (`path`, falling back to `file_path`),
+ *   tried root-relative first (see pathCandidates).
+ * Tools without a usable argument (or no rules) match nothing → null.
+ */
+export function matchAgentPolicyRule(rules, required, args, root) {
+    if (!rules)
+        return null;
+    const a = (args !== null && typeof args === 'object' ? args : {});
+    if (required.includes('execute')) {
+        const cmd = a['command'];
+        if (typeof cmd === 'string' && cmd !== '') {
+            const hit = resolvePolicyRule(rules.shell, cmd);
+            if (hit)
+                return hit;
+        }
+    }
+    if (required.includes('write')) {
+        const p = typeof a['path'] === 'string' ? a['path'] : typeof a['file_path'] === 'string' ? a['file_path'] : '';
+        if (p !== '') {
+            for (const candidate of pathCandidates(p, root)) {
+                const hit = resolvePolicyRule(rules.edit, candidate);
+                if (hit)
+                    return hit;
+            }
+        }
+    }
+    return null;
+}
+// ── Loading & validation (fail-closed on files, never throws) ─────────────
+/** Env opt-out: ZELARI_POLICY=0 (also false/no/off) → always the empty set. */
+export function isPolicyEngineDisabled() {
+    const v = process.env.ZELARI_POLICY?.trim().toLowerCase();
+    return v === '0' || v === 'false' || v === 'no' || v === 'off';
+}
+/**
+ * P0.A escape hatch: ZELARI_POLICY_PRECEDENCE=legacy selects the v1
+ * project-overrides-global first-match behavior; any other value (unset
+ * included) selects the default restrict-only layering. Read at policy-load
+ * time and exposed as PolicySet.precedence so callers/tests can assert the
+ * active mode.
+ */
+export function policyPrecedenceFromEnv() {
+    const v = process.env.ZELARI_POLICY_PRECEDENCE?.trim().toLowerCase();
+    return v === 'legacy' ? 'legacy' : 'restrict-only';
+}
+function isPlainObject(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+function parseRuleList(raw, origin, warnings) {
+    if (raw === undefined)
+        return [];
+    if (!Array.isArray(raw)) {
+        warnings.push(`${origin}: expected an array of rules, got ${typeof raw} — section ignored.`);
+        return [];
+    }
+    const out = [];
+    raw.forEach((item, i) => {
+        const where = `${origin}[${i}]`;
+        if (!isPlainObject(item)) {
+            warnings.push(`${where}: rule is not an object — skipped.`);
+            return;
+        }
+        const match = item['match'];
+        const effect = item['effect'];
+        const reason = item['reason'];
+        if (typeof match !== 'string' || match.trim() === '') {
+            warnings.push(`${where}: missing or empty "match" — skipped.`);
+            return;
+        }
+        if (effect !== 'allow' && effect !== 'ask' && effect !== 'deny') {
+            warnings.push(`${where} ("${match}"): "effect" must be allow|ask|deny — skipped.`);
+            return;
+        }
+        out.push(typeof reason === 'string' && reason.trim() !== '' ? { match, effect, reason } : { match, effect });
+    });
+    return out;
+}
+/** Returns null when the WHOLE file must be ignored (bad shape / version). */
+function parsePolicyFile(raw, origin, warnings) {
+    if (!isPlainObject(raw)) {
+        warnings.push(`${origin}: policy file is not a JSON object — file ignored.`);
+        return null;
+    }
+    const version = raw['version'];
+    if (version !== undefined && version !== 1) {
+        warnings.push(`${origin}: unsupported "version" ${JSON.stringify(version)} (expected 1) — file ignored.`);
+        return null;
+    }
+    const agentsRaw = raw['agents'];
+    if (agentsRaw === undefined) {
+        warnings.push(`${origin}: no "agents" key — file ignored.`);
+        return null;
+    }
+    if (!isPlainObject(agentsRaw)) {
+        warnings.push(`${origin}: "agents" is not an object — file ignored.`);
+        return null;
+    }
+    const out = new Map();
+    for (const [key, val] of Object.entries(agentsRaw)) {
+        const agent = key.trim().toLowerCase();
+        if (!KNOWN_AGENTS.has(agent)) {
+            warnings.push(`${origin}: unknown agent "${key}" (known: ${POLICY_AGENTS.join(' | ')}) — ignored.`);
+            continue;
+        }
+        if (!isPlainObject(val)) {
+            warnings.push(`${origin}: agents.${key} is not an object — ignored.`);
+            continue;
+        }
+        const shell = parseRuleList(val['shell'], `${origin} agents.${key}.shell`, warnings);
+        const edit = parseRuleList(val['edit'], `${origin} agents.${key}.edit`, warnings);
+        out.set(agent, { shell, edit });
+    }
+    return out;
+}
+function readPolicyFile(file, warnings) {
+    let text;
+    try {
+        text = readFileSync(file, 'utf8');
+    }
+    catch {
+        // Missing file is the common case (most repos/users have none) — not a
+        // warning, just no rules from this source.
+        return new Map();
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (err) {
+        warnings.push(`${file}: invalid JSON (${err instanceof Error ? err.message : String(err)}) — file ignored.`);
+        return new Map();
+    }
+    return parsePolicyFile(parsed, file, warnings) ?? new Map();
+}
+/**
+ * Load the project (`<root>/.zelari/policy.json`) and global
+ * (`~/.zelari/policy.json`) rule sets into DISTINCT layers (P0.A): the two
+ * sources are NEVER concatenated at load time — evaluation intersects them
+ * restrict-only (matchAgentPolicyRuleLayered in policyLayers.ts) unless
+ * ZELARI_POLICY_PRECEDENCE=legacy restores the v1 concat view. NEVER
+ * throws: broken files yield warnings + whatever parsed cleanly. Pass
+ * `homeDir` to override the global-file location (tests).
+ */
+export function loadPolicySet(root, opts = {}) {
+    if (isPolicyEngineDisabled())
+        return emptyPolicySet();
+    const warnings = [];
+    const precedence = policyPrecedenceFromEnv();
+    const project = readPolicyFile(path.join(root, '.zelari', 'policy.json'), warnings);
+    const global = readPolicyFile(path.join(opts.homeDir ?? homedir(), '.zelari', 'policy.json'), warnings);
+    const agents = new Map();
+    for (const [agent, p] of project) {
+        agents.set(agent, { project: p, global: EMPTY_POLICY_RULE_SET });
+    }
+    for (const [agent, g] of global) {
+        const l = agents.get(agent);
+        agents.set(agent, l ? { ...l, global: g } : { project: EMPTY_POLICY_RULE_SET, global: g });
+    }
+    return { agents, warnings, precedence };
+}
+//# sourceMappingURL=policyEngine.js.map

package/dist/cli/safety/policyEngine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyEngine.js","sourceRoot":"","sources":["../../../src/cli/safety/policyEngine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAgD7B;oEACoE;AACpE,MAAM,CAAC,MAAM,aAAa,GAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AACzF,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,qBAAqB,GAAkB,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AAC5E,MAAM,CAAC,MAAM,mBAAmB,GAAyB;IACvD,MAAM,EAAE,qBAAqB;IAC7B,OAAO,EAAE,qBAAqB;CAC/B,CAAC;AAEF,MAAM,UAAU,cAAc;IAC5B,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE,EAAE,CAAC;AACpF,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,GAAc,EAAE,KAAa;IAC1D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,mBAAmB,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAc,EAAE,KAAa;IACzD,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC;QAAE,OAAO,qBAAqB,CAAC;IACrC,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC9C,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAC;YACnC,GAAG,IAAI,IAAI,CAAC;QACd,CAAC;aAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACzC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,mFAAmF;AACnF,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAA4B,EAAE,KAAa;IAC3E,MAAM,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,YAAY,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6EAA6E;AAE7E,gFAAgF;AAChF,MAAM,CAAC,MAAM,WAAW,GAAiC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAEvF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAsB,EAAE,IAAuB;IAC7E,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3E,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,KAAa,EAAE,IAAa;IAClD,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAClE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;QAC3B,CAAC,CAAC,IAAI,CAAC;IACT,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAgC,EAChC,QAAmC,EACnC,IAAa,EACb,IAAa;IAEb,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;IAC7F,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YAC1C,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;QACtB,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/G,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACb,KAAK,MAAM,SAAS,IAAI,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;gBAChD,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACrD,IAAI,GAAG;oBAAE,OAAO,GAAG,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6EAA6E;AAE7E,+EAA+E;AAC/E,MAAM,UAAU,sBAAsB;IACpC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1D,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrE,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC;AACrD,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,aAAa,CAAC,GAAY,EAAE,MAAc,EAAE,QAAkB;IACrE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,qCAAqC,OAAO,GAAG,qBAAqB,CAAC,CAAC;QAC7F,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,KAAK,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,uCAAuC,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QACD,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAChE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,MAAM,KAAK,gDAAgD,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,CACN,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CACnG,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,SAAS,eAAe,CACtB,GAAY,EACZ,MAAc,EACd,QAAkB;IAElB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,oDAAoD,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAC3C,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,2BAA2B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;QAC1G,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,mCAAmC,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,6CAA6C,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACvC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,oBAAoB,GAAG,aAAa,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;YACpG,SAAS;QACX,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,YAAY,GAAG,8BAA8B,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,WAAW,GAAG,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACrF,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,WAAW,GAAG,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClF,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,QAAkB;IACtD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,2CAA2C;QAC3C,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CACX,GAAG,IAAI,mBAAmB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAC9F,CAAC;QACF,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAA6B,EAAE;IACzE,IAAI,sBAAsB,EAAE;QAAE,OAAO,cAAc,EAAE,CAAC;IACtD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,UAAU,GAAG,uBAAuB,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,QAAQ,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,QAAQ,CAAC,CAAC;IACxG,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgC,CAAC;IACvD,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AAC1C,CAAC"}

package/dist/cli/safety/policyLayers.js

@@ -0,0 +1,55 @@
+import { EFFECT_RANK, matchAgentPolicyRule, } from './policyEngine.js';
+/**
+ * Intersect candidate effects into ONE effect: deny > ask > allow. Absent
+ * matches arrive as `undefined` and simply do not constrain the result; with
+ * NO constraint at all the slot is unconstrained (`allow`). Feed this the
+ * category decision plus every layer's matched effect and the result is the
+ * effective action — no operand can ever RELAX another.
+ */
+export function intersectEffects(...effects) {
+    let best;
+    for (const effect of effects) {
+        if (effect === undefined)
+            continue;
+        if (best === undefined || EFFECT_RANK[effect] > EFFECT_RANK[best])
+            best = effect;
+    }
+    return best ?? 'allow';
+}
+/**
+ * Resolve THIS agent's policy contribution across BOTH layers for one tool
+ * invocation:
+ *
+ * - `restrict-only` (default): each layer matches independently and the
+ *   STRICTER effect wins; equal ranks surface the project rule (it is the
+ *   more specific intent).
+ * - `legacy`: v1 semantics — project rules concatenated before global ones,
+ *   FIRST match wins (a project match masks the global rule entirely).
+ *
+ * Either way a single rule carries the effect the caller must intersect into
+ * the category decision (see intersectEffects and wrapWithPermissions in
+ * toolRegistry.ts). Tools with no usable argument match nothing in both
+ * layers → null, leaving the category decision untouched.
+ */
+export function matchAgentPolicyRuleLayered(layers, precedence, required, args, root) {
+    if (!layers)
+        return null;
+    if (precedence === 'legacy') {
+        // v1: ONE concatenated list — project rules first, first-match-wins.
+        return matchAgentPolicyRule({
+            shell: [...layers.project.shell, ...layers.global.shell],
+            edit: [...layers.project.edit, ...layers.global.edit],
+        }, required, args, root);
+    }
+    // Default restrict-only: independent matches, stricter effect wins (ties
+    // keep the project rule as the surfaced representative).
+    const g = matchAgentPolicyRule(layers.global, required, args, root);
+    const p = matchAgentPolicyRule(layers.project, required, args, root);
+    if (!g)
+        return p;
+    if (!p)
+        return g;
+    const win = intersectEffects(p.effect, g.effect);
+    return p.effect === win ? p : g;
+}
+//# sourceMappingURL=policyLayers.js.map

package/dist/cli/safety/policyLayers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policyLayers.js","sourceRoot":"","sources":["../../../src/cli/safety/policyLayers.ts"],"names":[],"mappings":"AAsBA,OAAO,EACL,WAAW,EACX,oBAAoB,GAIrB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAG,OAA4C;IAC9E,IAAI,IAAkC,CAAC;IACvC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,IAAI,IAAI,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC;YAAE,IAAI,GAAG,MAAM,CAAC;IACnF,CAAC;IACD,OAAO,IAAI,IAAI,OAAO,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAwC,EACxC,UAA4B,EAC5B,QAAmC,EACnC,IAAa,EACb,IAAa;IAEb,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,qEAAqE;QACrE,OAAO,oBAAoB,CACzB;YACE,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YACxD,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;SACtD,EACD,QAAQ,EACR,IAAI,EACJ,IAAI,CACL,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,yDAAyD;IACzD,MAAM,CAAC,GAAG,oBAAoB,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACpE,MAAM,CAAC,GAAG,oBAAoB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrE,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC"}

package/dist/cli/safety/toolPermissions.js

@@ -66,6 +66,44 @@ export function defaultPermissionPolicy(overrides) {
         ...overrides,
     };
 }
+/**
+ * Restrictiveness lattice for {@link PermissionAction}: deny > ask > allow
+ * (most restrictive wins).
+ */
+const ACTION_RANK = { allow: 0, ask: 1, deny: 2 };
+function moreRestrictive(a, b) {
+    return ACTION_RANK[a] >= ACTION_RANK[b] ? a : b;
+}
+/**
+ * Capability inheritance (P0.4): a Kraken tentacle (sub-agent spawned via
+ * the `task` tool) must NEVER hold more permission than its parent. The
+ * sub-agent's effective policy is the intersection of the parent's policy
+ * and the sub-agent profile's own policy, merged per category with the most
+ * restrictive action winning (deny > ask > allow). A category restricted in
+ * only ONE of the two policies keeps that restriction.
+ *
+ * `auto` (ask resolves as allow without UI) intersects as the AND of both:
+ * silently auto-allowing a category the parent would have had to ask about
+ * would itself be an escalation.
+ *
+ * If the intersection downgrades a category to `ask` while the sub-agent
+ * context has no interactive ask handler, resolution must FAIL CLOSED
+ * (deny). That behavior already lives in `wrapWithPermissions`
+ * (toolRegistry.ts): `ask` without `onPermissionAsk` returns a typedErr, so
+ * the escalation path stays closed with no extra handling here.
+ *
+ * Pure function, no I/O.
+ */
+export function intersectPermissionPolicy(parent, child) {
+    return {
+        read: moreRestrictive(parent.read, child.read),
+        write: moreRestrictive(parent.write, child.write),
+        execute: moreRestrictive(parent.execute, child.execute),
+        network: moreRestrictive(parent.network, child.network),
+        ui: moreRestrictive(parent.ui, child.ui),
+        auto: parent.auto && child.auto,
+    };
+}
 /**
  * Resolve effective action for a tool given its required permission tags.
  * Empty permissions → allow. Most restrictive action wins: deny > ask > allow.

package/dist/cli/safety/toolPermissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"toolPermissions.js","sourceRoot":"","sources":["../../../src/cli/safety/toolPermissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAwBH,8EAA8E;AAE9E,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;AAC5C,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAExD,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC;QAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAmB;IACtD,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,4BAA4B;IAC1C,iBAAiB,CAAC,KAAK,EAAE,CAAC;IAC1B,qBAAqB,CAAC,KAAK,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,2BAA2B;IAIzC,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,EAAE;QACpC,UAAU,EAAE,CAAC,GAAG,qBAAqB,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,QAAmC;IAEnC,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACnC,8EAA8E;IAC9E,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,WAAW,CAAC,GAAuB,EAAE,QAA0B;IACtE,MAAM,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC;IAC3D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxD,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC;AAChE,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,uBAAuB,CACrC,SAAqC;IAErC,OAAO;QACL,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,OAAO,CAAC;QAC9D,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,OAAO,CAAC;QAChE,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,OAAO,CAAC;QACpE,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,OAAO,CAAC;QACpE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,iBAAiB,EAAE;QACzB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,QAAmC,EACnC,MAAwB;IAExB,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACzD,CAAC;IAED,+EAA+E;IAC/E,gCAAgC;IAEhC,IAAI,KAAK,GAAqB,OAAO,CAAC;IACtC,MAAM,GAAG,GAAqB,EAAE,CAAC;IAEjC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,CAAC,GACL,GAAG,KAAK,MAAM;YACZ,CAAC,CAAC,MAAM,CAAC,IAAI;YACb,CAAC,CAAC,GAAG,KAAK,OAAO;gBACf,CAAC,CAAC,MAAM,CAAC,KAAK;gBACd,CAAC,CAAC,GAAG,KAAK,SAAS;oBACjB,CAAC,CAAC,MAAM,CAAC,OAAO;oBAChB,CAAC,CAAC,GAAG,KAAK,SAAS;wBACjB,CAAC,CAAC,MAAM,CAAC,OAAO;wBAChB,CAAC,CAAC,GAAG,KAAK,IAAI;4BACZ,CAAC,CAAC,MAAM,CAAC,EAAE;4BACX,CAAC,CAAC,OAAO,CAAC;QACtB,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;YACjB,KAAK,GAAG,MAAM,CAAC;YACf,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;aAAM,IAAI,CAAC,KAAK,KAAK,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YAC3C,KAAK,GAAG,KAAK,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAED,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,+BAA+B,QAAQ,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC;YACnG,UAAU,EAAE,GAAG;SAChB,CAAC;IACJ,CAAC;IAED,qDAAqD;IACrD,IAAI,MAAM,CAAC,IAAI,IAAI,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACzD,CAAC;IAED,OAAO;QACL,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,SAAS,QAAQ,wBAAwB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QACnE,UAAU,EAAE,GAAG;KAChB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"toolPermissions.js","sourceRoot":"","sources":["../../../src/cli/safety/toolPermissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAwBH,8EAA8E;AAE9E,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;AAC5C,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAExD,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC;QAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAmB;IACtD,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,4BAA4B;IAC1C,iBAAiB,CAAC,KAAK,EAAE,CAAC;IAC1B,qBAAqB,CAAC,KAAK,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,2BAA2B;IAIzC,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,EAAE;QACpC,UAAU,EAAE,CAAC,GAAG,qBAAqB,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,QAAmC;IAEnC,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACnC,8EAA8E;IAC9E,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,WAAW,CAAC,GAAuB,EAAE,QAA0B;IACtE,MAAM,CAAC,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC;IAC3D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxD,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC;AAChE,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,uBAAuB,CACrC,SAAqC;IAErC,OAAO;QACL,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,OAAO,CAAC;QAC9D,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,OAAO,CAAC;QAChE,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,OAAO,CAAC;QACpE,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,OAAO,CAAC;QACpE,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,iBAAiB,EAAE;QACzB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,WAAW,GAAqC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAEpF,SAAS,eAAe,CAAC,CAAmB,EAAE,CAAmB;IAC/D,OAAO,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAwB,EACxB,KAAuB;IAEvB,OAAO;QACL,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;QAC9C,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;QACjD,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC;QACvD,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC;QACvD,EAAE,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC;QACxC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI;KAChC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,QAAmC,EACnC,MAAwB;IAExB,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACzD,CAAC;IAED,+EAA+E;IAC/E,gCAAgC;IAEhC,IAAI,KAAK,GAAqB,OAAO,CAAC;IACtC,MAAM,GAAG,GAAqB,EAAE,CAAC;IAEjC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,CAAC,GACL,GAAG,KAAK,MAAM;YACZ,CAAC,CAAC,MAAM,CAAC,IAAI;YACb,CAAC,CAAC,GAAG,KAAK,OAAO;gBACf,CAAC,CAAC,MAAM,CAAC,KAAK;gBACd,CAAC,CAAC,GAAG,KAAK,SAAS;oBACjB,CAAC,CAAC,MAAM,CAAC,OAAO;oBAChB,CAAC,CAAC,GAAG,KAAK,SAAS;wBACjB,CAAC,CAAC,MAAM,CAAC,OAAO;wBAChB,CAAC,CAAC,GAAG,KAAK,IAAI;4BACZ,CAAC,CAAC,MAAM,CAAC,EAAE;4BACX,CAAC,CAAC,OAAO,CAAC;QACtB,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;YACjB,KAAK,GAAG,MAAM,CAAC;YACf,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;aAAM,IAAI,CAAC,KAAK,KAAK,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YAC3C,KAAK,GAAG,KAAK,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAED,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,+BAA+B,QAAQ,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC;YACnG,UAAU,EAAE,GAAG;SAChB,CAAC;IACJ,CAAC;IAED,qDAAqD;IACrD,IAAI,MAAM,CAAC,IAAI,IAAI,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACzD,CAAC;IAED,OAAO;QACL,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,SAAS,QAAQ,wBAAwB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QACnE,UAAU,EAAE,GAAG;KAChB,CAAC;AACJ,CAAC"}

package/dist/cli/toolRegistry.js

@@ -43,8 +43,10 @@ import { createWorldModelTools } from './workspace/worldModel.js';
 import { providerFromEnv, providerConfigFor, } from './provider/openai-compatible.js';
 import { buildProviderStream } from './provider/resolveStream.js';
 import { getKrakenVerifierOverride } from './providerConfig.js';
-import { defaultPermissionPolicy, resolveToolPermission, } from './safety/toolPermissions.js';
+import { defaultPermissionPolicy, intersectPermissionPolicy, resolveToolPermission, } from './safety/toolPermissions.js';
 import { createDefaultLifecycleHooks } from './safety/lifecycleHooks.js';
+import { agentLayersFor, loadPolicySet, mergeRuleEffect, } from './safety/policyEngine.js';
+import { matchAgentPolicyRuleLayered } from './safety/policyLayers.js';
 import { withResultCache } from './toolResultCache.js';
 import { typedErr } from '@zelari/core/harness/tools/toolTypes';
 import { cliToolToEnhanced, registerCustomTool } from '@zelari/core/skills';
@@ -105,7 +107,15 @@ export function createBuiltinToolRegistry(options = {}) {
     const allowMutators = !readOnly && !verifyMode && !gauntletParent;
     const allowBash = (allowMutators || verifyMode) && !gauntletParent;
     const permPolicy = options.permissionPolicy ?? defaultPermissionPolicy();
-    const withPerm = (t) => wrapWithPermissions(t, permPolicy, options.onPermissionAsk);
+    // P0.A layered policy engine: per-command/per-path rules for THIS agent
+    // identity with global and project kept as DISTINCT layers. Default
+    // evaluation is restrict-only (a global deny/ask can never be relaxed by the
+    // project file); ZELARI_POLICY_PRECEDENCE=legacy restores the v1
+    // project-first override. Loaded once per registry build; empty when
+    // absent/invalid/disabled (ZELARI_POLICY=0).
+    const agentPolicySet = loadPolicySet(root);
+    const agentPolicyLayers = agentLayersFor(agentPolicySet, options.policyAgent ?? 'lead');
+    const withPerm = (t) => wrapWithPermissions(t, permPolicy, options.onPermissionAsk, agentPolicyLayers, agentPolicySet.precedence, root);
     // Observe tools — always registered.
     registry.register(withPerm(safeReadFile));
     registry.register(withPerm(safeGrepContent));
@@ -300,6 +310,10 @@ export function createBuiltinToolRegistry(options = {}) {
                 root,
                 audit,
                 sessionId,
+                // P0.4 capability inheritance: tentacles intersect THIS
+                // registry's own policy (permPolicy above) — they can never
+                // exceed it.
+                parentPolicy: permPolicy,
                 ...(options.subAgentProvider ? { provider: options.subAgentProvider } : {}),
                 ...(options.subAgentModel ? { model: options.subAgentModel } : {}),
             }),
@@ -468,7 +482,7 @@ function taskAgentToProfile(agent) {
  * (F6) — can build a `TaskToolDeps` without duplicating this wiring.
  */
 export function createKrakenSubAgentContextFactory(opts) {
-    const { root, audit, sessionId, provider: providerOverride, model: modelOverride } = opts;
+    const { root, audit, sessionId, provider: providerOverride, model: modelOverride, parentPolicy } = opts;
     return async ({ agent, cwd: subCwd }) => {
         const cfg = providerOverride
             ? await providerConfigFor(providerOverride)
@@ -496,6 +510,18 @@ export function createKrakenSubAgentContextFactory(opts) {
         const subCfg = { ...effCfg, model };
         const subProfile = taskAgentToProfile(agent);
         const subRoot = subCwd || root;
+        // P0.4 capability inheritance: a tentacle NEVER holds more permission
+        // than its parent. The sub-profile policy this factory builds is
+        // headless-style auto-allow (a tentacle has no interactive prompt to
+        // ask at); the effective policy is its intersection with the parent
+        // policy — deny > ask > allow per category, `auto` is the AND of both.
+        // If the intersection downgrades a category to `ask`, resolution must
+        // FAIL CLOSED: the sub-agent context has no interactive ask handler, and
+        // `wrapWithPermissions` already returns typedErr for `ask` without
+        // `onPermissionAsk`, so that guarantee is reused as-is here (no extra
+        // handling needed).
+        const agentPolicyForSubProfile = defaultPermissionPolicy({ auto: true });
+        const effectiveSubPolicy = intersectPermissionPolicy(parentPolicy ?? agentPolicyForSubProfile, agentPolicyForSubProfile);
         const { registry: subRegistry } = createBuiltinToolRegistry({
             root: subRoot,
             audit,
@@ -505,7 +531,9 @@ export function createKrakenSubAgentContextFactory(opts) {
             enableSkill: agent === 'general',
             diagnostics: false,
             lspProvider: null,
-            permissionPolicy: defaultPermissionPolicy({ auto: true }),
+            permissionPolicy: effectiveSubPolicy,
+            // P0.5: the tentacle's agent identity drives per-agent policy rules.
+            policyAgent: agent,
         });
         return {
             providerStream: buildProviderStream(subCfg),
@@ -525,7 +553,7 @@ export function createKrakenSubAgentContextFactory(opts) {
 /**
  * Gate tool execution with allow/ask/deny policy (OpenCode-style permissions).
  */
-function wrapWithPermissions(original, policy, onAsk) {
+function wrapWithPermissions(original, policy, onAsk, agentLayers, precedence = 'restrict-only', root) {
     const required = (original.permissions ?? []);
     // Pure read tools under allow policy — no wrap overhead.
     const decisionProbe = resolveToolPermission(original.name, required, policy);
@@ -537,12 +565,24 @@ function wrapWithPermissions(original, policy, onAsk) {
         ...original,
         execute: async (input, ctx) => {
             const decision = resolveToolPermission(original.name, required, policy);
-            if (decision.action === 'deny') {
-                return typedErr(`[permission] ${decision.reason}`);
+            // P0.A: resolve this agent's rule across the global+project layers —
+            // restrict-only by default (deny > ask > allow; a global deny/ask can
+            // never be relaxed by the project file; legacy precedence restores the
+            // v1 project-first override). The survivor only ever ADDS restriction
+            // to the category decision (mergeRuleEffect).
+            const rule = agentLayers
+                ? matchAgentPolicyRuleLayered(agentLayers, precedence, required, (input ?? {}), root ?? process.cwd())
+                : null;
+            const action = mergeRuleEffect(decision.action, rule);
+            const rulePrefix = rule
+                ? `[policy] rule '${rule.match}'${rule.reason ? ` — ${rule.reason}` : ''}`
+                : '';
+            if (action === 'deny') {
+                return typedErr(`[permission] ${rulePrefix || decision.reason}`);
             }
-            if (decision.action === 'ask') {
+            if (action === 'ask') {
                 if (!onAsk) {
-                    return typedErr(`[permission] ${decision.reason} No interactive approval available ` +
+                    return typedErr(`[permission] ${rulePrefix ? `${rulePrefix} ` : ''}${decision.reason} No interactive approval available ` +
                         `(set ZELARI_AUTO=1 to auto-allow, or configure onPermissionAsk).`);
                 }
                 try {