lcode-cli 0.14.0__py3-none-any.whl → 0.15.0__py3-none-any.whl

lcode/__init__.py

@@ -1,3 +1,3 @@
 """lcode — a local-first terminal coding agent powered by open-weight models via Ollama."""
 
-__version__ = "0.14.0"
+__version__ = "0.15.0"

lcode/agent.py

@@ -216,6 +216,9 @@ class Agent:
         self.checkpoints = Checkpoints(self.console, settings.checkpoints)
         self.mcp: McpManager | None = None  # set by the CLI when MCP servers are configured
         self.lsp = None  # an lcode.lsp.Manager, set by the CLI when language servers are installed
+        from lcode.hooks import HookSet
+
+        self.hooks = HookSet()  # set by the CLI from the settings (lcode.hooks)
         self._repo_map: tuple[Path, repomap.RepoMap, str] | None = None
         self._code_index: tuple[Path, codesearch.Index | None] | None = None
         self.sandbox = (
@@ -722,6 +725,14 @@ class Agent:
             self._run_turn(user_text)
         finally:
             self.checkpoints.end_turn()
+            if self.hooks.hooks and self.allowed_tools is None:
+                payload = {"request": user_text[:2000], "cwd": str(self.cwd), "session": self.session_id}
+                for outcome in self.hooks.run("after_request", payload, self.cwd):
+                    style = "dim" if outcome.code == 0 else "yellow"
+                    if outcome.output or outcome.code:
+                        self.console.print(
+                            Text(f"  ⎿ after_request hook ({outcome.code}): {outcome.output[:500]}", style=style)
+                        )
 
     def sandbox_root(self) -> Path | None:
         """The folder the model is limited to while the sandbox is on (None when it's off)."""

lcode/cli.py

@@ -368,7 +368,16 @@ def cmd_doctor(args) -> None:
             line("", f"{n} × {slots[1]} context may not fit in memory here; {slots[0]} would", None)
         for problem in problems:
             line("", problem, None)
-    from lcode import codesearch, extensions, lsp
+    from lcode import codesearch, extensions, hooks, lsp
+
+    hook_set, rules = hooks.load(Path.cwd(), extensions.status(Path.cwd()) == "approved")
+    if hook_set.hooks or rules or hook_set.problems:
+        events = sorted({h.event for h in hook_set.hooks})
+        summary = f"{len(hook_set.hooks)} hook(s) ({', '.join(events)})" if hook_set.hooks else "no hooks"
+        summary += f", {len(rules.allow)} allow and {len(rules.deny)} deny rule(s)"
+        line("Hooks", summary, not hook_set.problems or None)
+        for problem in hook_set.problems:
+            line("", problem, None)
     from lcode.checkpoints import work_tree_for
 
     if cfg["embed_model"] == "off":
@@ -602,6 +611,13 @@ def cmd_chat(args) -> None:
     )
     agent = Agent(ollama, settings, cwd, console=console)
     agent.interactive = not args.prompt
+    from lcode import hooks
+
+    agent.hooks, agent.perms.rules = hooks.load(cwd, trust_project)
+    for problem in agent.hooks.problems:
+        console.print(f"[yellow]Settings: {problem}[/]")
+    if agent.hooks.for_event("notification"):
+        agent.perms.on_prompt = lambda title: agent.hooks.notify(f"lcode needs you: {title}", agent.cwd)
     if cfg["lsp"] == "auto":
         from lcode import lsp
         from lcode.checkpoints import work_tree_for

lcode/config.py

@@ -187,5 +187,10 @@ def save(updates: dict, path: Path | None = None, remove: tuple[str, ...] = ())
         if data.get(k) is not None:
             v = data[k]
             lines.append(f"{k} = {str(v).lower() if isinstance(v, bool) else json.dumps(v)}")
+    tables = ""  # [[hooks]], [permissions] and anything else after the settings stay as they were
+    if path.is_file():
+        text = path.read_text()
+        m = re.search(r"^\s*\[", text, re.M)
+        tables = text[m.start() :] if m else ""
     path.parent.mkdir(parents=True, exist_ok=True)
-    path.write_text("\n".join(lines) + "\n")
+    path.write_text("\n".join(lines) + "\n" + ("\n" + tables.rstrip() + "\n" if tables.strip() else ""))

lcode/extensions.py

@@ -286,7 +286,7 @@ def approvals_path() -> Path:
 def project_files(cwd: Path) -> tuple[Path, list[Path]]:
     """The repository's root and the files of its commands, skills and agents."""
     root = work_tree_for(cwd)
-    files: list[Path] = []
+    files: list[Path] = [root / ".lcode" / "settings.toml"] if (root / ".lcode" / "settings.toml").is_file() else []
     for folder in PROJECT_FOLDERS:
         base = root / folder
         if not base.is_dir():
@@ -359,6 +359,21 @@ def describe(cwd: Path) -> list[str]:
         lines.append(f"skills: {', '.join(project_skills)}")
     if agents:
         lines.append(f"agents: {', '.join(agents)}")
+    settings = root / ".lcode" / "settings.toml"
+    if settings.is_file():
+        from lcode.hooks import HookError, HookSet, Rules, read_toml
+
+        try:
+            data = read_toml(settings)
+            hook_set, rules = HookSet(), Rules()
+            hook_set.add(data, "")
+            rules.add(data, "")
+            commands = sorted({h.command.split()[0] for h in hook_set.hooks if h.command.split()})
+            parts = [f"{len(hook_set.hooks)} hook(s) running {', '.join(commands)}" if hook_set.hooks else ""]
+            parts.append(f"{len(rules.allow)} allow and {len(rules.deny)} deny rule(s)" if rules else "")
+            lines.append("settings: " + "; ".join(p for p in parts if p) if any(parts) else "settings: (empty)")
+        except HookError as e:
+            lines.append(f"settings: {e}")
     return lines
 
 
@@ -378,8 +393,8 @@ def trust_project(cwd: Path, console: Console, interactive: bool) -> bool:
     for line in describe(cwd) or ["(files in " + ", ".join(PROJECT_FOLDERS) + ")"]:
         console.print(f"  {escape(line)}")
     console.print(
-        "[dim]They can steer the model and include scripts it may run (commands still ask first, unless "
-        "you allow them).[/]"
+        "[dim]They can steer the model and include scripts it may run, and its settings can run hooks "
+        "(shell commands) on lcode's events.[/]"
     )
     try:
         answer = input("  Use them? [y/N] ").strip().lower()

lcode/hooks.py

@@ -0,0 +1,241 @@
+"""Hooks and permission rules: what should always happen, whatever the model does.
+
+Hooks are shell commands that run on lcode's events, set in `~/.config/lcode/config.toml` or, per
+repository, in `.lcode/settings.toml` (used once you approve it, like the repository's commands):
+
+    [[hooks]]
+    event = "after_tool"              # before_tool | after_tool | after_request | session_start | notification
+    tools = ["edit_file", "write_file"]
+    paths = ["*.py"]
+    command = "ruff format {path} && ruff check --fix {path}"
+
+The event comes as JSON on stdin (and `{path}`, `{tool}` in the command are replaced, quoted). A
+`before_tool` hook that exits with code 2 blocks the call, and what it printed tells the model why.
+An `after_tool` hook's output reaches the model when it fails, or always with `feedback = true`.
+
+Permission rules are checked before lcode asks, and deny always wins, even in yolo mode:
+
+    [permissions]
+    allow = ["bash:pytest *", "bash:npm test", "edit:src/**"]
+    deny = ["bash:git push --force*", "edit:.env"]
+"""
+
+from __future__ import annotations
+
+import fnmatch
+import json
+import os
+import re
+import shlex
+import subprocess
+import sys
+import threading
+from dataclasses import dataclass, field
+from pathlib import Path
+
+if sys.version_info >= (3, 11):
+    import tomllib
+else:  # pragma: no cover
+    import tomli as tomllib
+
+from lcode import config
+from lcode.checkpoints import work_tree_for
+
+EVENTS = ("before_tool", "after_tool", "after_request", "session_start", "notification")
+BLOCK = 2  # exit code of a before_tool hook that blocks the call
+MAX_OUTPUT = 4000
+FILE_TOOLS = {"read_file", "write_file", "edit_file", "view_image", "list_dir"}
+
+
+class HookError(ValueError):
+    pass
+
+
+def project_settings(cwd: Path) -> Path:
+    return work_tree_for(cwd) / ".lcode" / "settings.toml"
+
+
+def read_toml(path: Path) -> dict:
+    try:
+        return tomllib.loads(path.read_text())
+    except OSError:
+        return {}
+    except tomllib.TOMLDecodeError as e:
+        raise HookError(f"{path} isn't valid TOML: {e}") from e
+
+
+# ----------------------------------------------------------------------------- permission rules
+
+
+def strip_cd(command: str) -> str:
+    return re.sub(r"^\s*(cd\s+\S+\s*&&\s*)+", "", command).strip()
+
+
+def matches_path(pattern: str, path: str) -> bool:
+    """gitignore-like: a pattern without a slash matches the file name anywhere."""
+    if "/" not in pattern.rstrip("/"):
+        return fnmatch.fnmatch(Path(path).name, pattern) or fnmatch.fnmatch(path, pattern)
+    pattern = pattern.removeprefix("./").removeprefix("/")
+    return fnmatch.fnmatch(path, pattern) or (pattern.startswith("**/") and fnmatch.fnmatch(path, pattern[3:]))
+
+
+@dataclass
+class Rules:
+    allow: list[tuple[str, str]] = field(default_factory=list)  # (rule, where it's from)
+    deny: list[tuple[str, str]] = field(default_factory=list)
+
+    def add(self, data: dict, source: str) -> None:
+        section = data.get("permissions") or {}
+        for kind in ("allow", "deny"):
+            values = section.get(kind) or []
+            if not isinstance(values, list) or not all(isinstance(v, str) and ":" in v for v in values):
+                raise HookError(f'{source}: permissions.{kind} must be a list of rules like "bash:pytest *"')
+            getattr(self, kind).extend((v, source) for v in values)
+
+    def _matches(self, rule: str, kind: str, target: str) -> bool:
+        rule_kind, _, pattern = rule.partition(":")
+        if rule_kind != kind or not target:
+            return False
+        if kind == "bash":
+            return fnmatch.fnmatch(strip_cd(target), pattern)
+        if kind == "edit":
+            return matches_path(pattern, target)
+        return fnmatch.fnmatch(target, pattern)
+
+    def check(self, kind: str, target: str) -> tuple[str | None, str]:
+        """("deny" or "allow", the rule and where it's from), or (None, "")."""
+        if kind == "bash":  # a denied command stays denied inside a chain: git add . && git push --force
+            parts = [p for p in re.split(r"\s*(?:&&|\|\||;|\|)\s*", strip_cd(target)) if p]
+            for rule, source in self.deny:
+                if any(self._matches(rule, kind, part) for part in [target, *parts]):
+                    return "deny", f"{rule} ({source})"
+            for rule, source in self.allow:
+                if self._matches(rule, kind, target):
+                    return "allow", f"{rule} ({source})"
+            if parts and all(any(self._matches(r, kind, part) for r, _ in self.allow) for part in parts):
+                return "allow", "every part of the command is allowed"
+            return None, ""
+        for rule, source in self.deny:
+            if self._matches(rule, kind, target):
+                return "deny", f"{rule} ({source})"
+        for rule, source in self.allow:
+            if self._matches(rule, kind, target):
+                return "allow", f"{rule} ({source})"
+        return None, ""
+
+    def __bool__(self) -> bool:
+        return bool(self.allow or self.deny)
+
+
+# ----------------------------------------------------------------------------- hooks
+
+
+@dataclass
+class Hook:
+    event: str
+    command: str
+    source: str
+    tools: list[str] = field(default_factory=list)
+    paths: list[str] = field(default_factory=list)
+    timeout: float = 60.0
+    feedback: bool = False
+
+    def applies(self, tool: str = "", path: str = "") -> bool:
+        if self.tools and not any(fnmatch.fnmatch(tool, t) for t in self.tools):
+            return False
+        return not self.paths or bool(path and any(matches_path(p, path) for p in self.paths))
+
+
+@dataclass
+class Outcome:
+    hook: Hook
+    code: int
+    output: str
+
+
+@dataclass
+class HookSet:
+    hooks: list[Hook] = field(default_factory=list)
+    problems: list[str] = field(default_factory=list)
+
+    def add(self, data: dict, source: str) -> None:
+        entries = data.get("hooks") or []
+        if not isinstance(entries, list):
+            raise HookError(f"{source}: hooks must be [[hooks]] tables")
+        for entry in entries:
+            event, command = entry.get("event"), entry.get("command")
+            if event not in EVENTS or not isinstance(command, str) or not command.strip():
+                self.problems.append(f"{source}: a hook needs an event ({', '.join(EVENTS)}) and a command")
+                continue
+            self.hooks.append(
+                Hook(
+                    event=event,
+                    command=command,
+                    source=source,
+                    tools=list(entry.get("tools") or []),
+                    paths=list(entry.get("paths") or []),
+                    timeout=float(entry.get("timeout") or 60),
+                    feedback=bool(entry.get("feedback", False)),
+                )
+            )
+
+    def for_event(self, event: str, tool: str = "", path: str = "") -> list[Hook]:
+        return [h for h in self.hooks if h.event == event and h.applies(tool, path)]
+
+    def run(self, event: str, payload: dict, cwd: Path, tool: str = "", path: str = "") -> list[Outcome]:
+        outcomes = []
+        for hook in self.for_event(event, tool, path):
+            outcomes.append(run_hook(hook, {"event": event, **payload}, cwd, tool, path))
+        return outcomes
+
+    def notify(self, message: str, cwd: Path) -> None:
+        """Notification hooks, in the background: lcode doesn't wait for them."""
+        hooks = self.for_event("notification")
+        if hooks:
+
+            def go() -> None:
+                for hook in hooks:
+                    run_hook(hook, {"event": "notification", "message": message}, cwd, "", "")
+
+            threading.Thread(target=go, daemon=True).start()
+
+
+def run_hook(hook: Hook, payload: dict, cwd: Path, tool: str, path: str) -> Outcome:
+    command = hook.command.replace("{path}", shlex.quote(path) if path else "").replace("{tool}", shlex.quote(tool))
+    env = {**os.environ, "LCODE_EVENT": payload.get("event", ""), "LCODE_TOOL": tool, "LCODE_PATH": path}
+    try:
+        r = subprocess.run(
+            ["bash", "-c", command],
+            input=json.dumps(payload, default=str),
+            capture_output=True,
+            text=True,
+            timeout=hook.timeout,
+            cwd=cwd,
+            env=env,
+        )
+    except subprocess.TimeoutExpired:
+        return Outcome(hook, 124, f"the hook took longer than {hook.timeout:.0f}s and was stopped")
+    except OSError as e:
+        return Outcome(hook, 127, str(e))
+    output = (r.stdout + ("\n" if r.stdout and r.stderr else "") + r.stderr).strip()
+    return Outcome(hook, r.returncode, output[:MAX_OUTPUT])
+
+
+# ----------------------------------------------------------------------------- loading
+
+
+def load(cwd: Path, trust_project: bool) -> tuple[HookSet, Rules]:
+    """The user's hooks and rules, plus the repository's when its settings are approved."""
+    hooks, rules = HookSet(), Rules()
+    sources = [(config.CONFIG_PATH, str(config.CONFIG_PATH))]
+    if trust_project:
+        project = project_settings(cwd)
+        sources.append((project, str(project)))
+    for path, label in sources:
+        try:
+            data = read_toml(path)
+            hooks.add(data, label)
+            rules.add(data, label)
+        except HookError as e:
+            hooks.problems.append(str(e))
+    return hooks, rules

lcode/permissions.py

@@ -64,9 +64,22 @@ def is_read_only(command: str) -> bool:
 
 class Permissions:
     def __init__(self, console: Console, mode: str = "ask"):
+        from lcode.hooks import Rules
+
         self.console = console
         self.mode = mode
         self.always: set[str] = set()
+        self.rules = Rules()  # allow and deny lists from the settings (lcode.hooks)
+        self.on_prompt = None  # called with the title before lcode asks the user (notification hooks)
+
+    def rule(self, kind: str, target: str) -> tuple[bool, str] | None:
+        """A rule's verdict on an action: (allowed, message for the model), or None when no rule matches."""
+        verdict, which = self.rules.check(kind, target) if target else (None, "")
+        if verdict == "deny":
+            return False, f"A deny rule blocks this: {which}. Don't try it another way; tell the user if it's needed."
+        if verdict == "allow":
+            return True, ""
+        return None
 
     def cycle(self) -> None:
         self.mode = PERMISSION_MODES[(PERMISSION_MODES.index(self.mode) + 1) % len(PERMISSION_MODES)]
@@ -76,13 +89,18 @@ class Permissions:
             return False
         return not (kind == "edit" and self.mode == "auto-edit")
 
-    def request(self, key: str, kind: str, title: str, body: RenderableType) -> tuple[bool, str]:
+    def request(self, key: str, kind: str, title: str, body: RenderableType, target: str = "") -> tuple[bool, str]:
         """Ask the user. kind is 'edit', 'bash', 'web', 'mcp' or 'memory'. Returns (allowed, message for the model).
 
         Memory notes follow the memory setting rather than the mode: with `memory = ask`, even yolo asks.
         """
+        verdict = self.rule(kind, target)
+        if verdict is not None:
+            return verdict
         if not self.needs_prompt(key, kind):
             return True, ""
+        if self.on_prompt:
+            self.on_prompt(title)
         self.console.print(Panel(body, title=title, title_align="left", border_style="yellow"))
         scope = {"edit": "file edits", "memory": "memory notes"}.get(kind) or key.split(":", 1)[-1]
         if kind == "mcp":

lcode/repl.py

@@ -10,6 +10,7 @@ import shlex
 import shutil
 import subprocess
 import threading
+import time
 from pathlib import Path
 
 from prompt_toolkit import PromptSession
@@ -755,7 +756,11 @@ def web_status(agent: Agent) -> str:
     return f"{agent.settings.web} · {search}"
 
 
+LONG_REQUEST = 30  # seconds: a request this long sends a notification when it's done (notification hooks)
+
+
 def run_safely(agent: Agent, text: str) -> None:
+    started = time.monotonic()
     try:
         agent.run_turn(text)
     except KeyboardInterrupt:
@@ -764,6 +769,17 @@ def run_safely(agent: Agent, text: str) -> None:
         agent.console.print(f"[red]{e}[/]")
     finally:
         agent.save()
+        if time.monotonic() - started > LONG_REQUEST:
+            agent.hooks.notify(f"lcode finished: {sessions.title_from([{'role': 'user', 'content': text}])}", agent.cwd)
+
+
+def session_start(agent: Agent) -> None:
+    """session_start hooks: their output is shown, and with feedback = true also given to the model."""
+    for outcome in agent.hooks.run("session_start", {"cwd": str(agent.cwd), "session": agent.session_id}, agent.cwd):
+        if outcome.output:
+            agent.console.print(Text(f"session_start hook: {outcome.output[:1000]}", style="dim"))
+        if outcome.hook.feedback and outcome.output:
+            agent.messages[0]["content"] += f"\n# From a session_start hook\n{outcome.output}\n"
 
 
 def handle_command(agent: Agent, line: str, hardware: Hardware) -> bool:
@@ -1000,6 +1016,7 @@ def repl(agent: Agent, prompt: str | None, hardware: Hardware, cont: bool = Fals
         info = choose_session(agent, resume)
         if info:
             resume_session(agent, info)
+    session_start(agent)
     if prompt:
         run_safely(agent, prompt)
         return

lcode/subagents.py

@@ -368,14 +368,24 @@ class Relay:
     def mode(self) -> str:
         return self.perms.mode
 
-    def request(self, key: str, kind: str, title: str, body) -> tuple[bool, str]:
+    @property
+    def rules(self):
+        return self.perms.rules
+
+    def rule(self, kind: str, target: str):
+        return self.perms.rule(kind, target)
+
+    def request(self, key: str, kind: str, title: str, body, target: str = "") -> tuple[bool, str]:
+        verdict = self.perms.rule(kind, target)
+        if verdict is not None:
+            return verdict
         if not self.perms.needs_prompt(key, kind):
             return True, ""
         title = f"{self.label} › {title}"
         if self.broker and threading.current_thread() is not threading.main_thread():
-            return self.broker.ask(key, kind, title, body)
+            return self.broker.ask(key, kind, title, body, target)
         with self.pause():
-            return self.perms.request(key, kind, title, body)
+            return self.perms.request(key, kind, title, body, target)
 
 
 # ----------------------------------------------------------------------------- one subagent
@@ -543,7 +553,8 @@ class Run:
         shown = patch if len(patch) <= 12_000 else patch[:12_000] + "\n... (diff truncated for display)\n"
         body = Syntax(shown, "diff", theme="monokai", word_wrap=True)
         title = f"Apply the {self.kind.name} agent's changes to {len(files)} file{'' if len(files) == 1 else 's'}"
-        ok, feedback = parent.perms.request("edit", "edit", title, body)
+        targets = " ".join(files)
+        ok, feedback = parent.perms.request("edit", "edit", title, body, targets)
         if not ok:
             return f"[Its changes were NOT applied. {feedback}]"
         parent.checkpoint()

lcode/tools.py

@@ -393,6 +393,15 @@ class Toolbox:
             raise ToolError(f"{path} is outside the project ({root}); with the sandbox on, that's all you can use")
         return p
 
+    def project_rel(self, p: Path) -> str:
+        """A path relative to the repository's root, as permission rules and hooks see it."""
+        from lcode.checkpoints import work_tree_for
+
+        try:
+            return p.resolve().relative_to(work_tree_for(self.agent.cwd)).as_posix()
+        except ValueError:
+            return str(p)
+
     def rel(self, p: Path) -> str:
         try:
             return str(p.relative_to(self.agent.cwd)) or "."
@@ -400,6 +409,32 @@ class Toolbox:
             return str(p)
 
     def run(self, name: str, args: dict) -> str:
+        hooks = self.agent.hooks
+        if not hooks.hooks:
+            return self._run(name, args)
+        path = str(self.resolve(args["path"])) if isinstance(args.get("path"), str) and args.get("path") else ""
+        payload = {"tool": name, "arguments": args, "path": path, "cwd": str(self.agent.cwd)}
+        for outcome in hooks.run("before_tool", payload, self.agent.cwd, name, path):
+            if outcome.code == 2:  # the hook blocks the call
+                self.console.print(Text(f"  ⎿ blocked by a hook: {outcome.output[:200]}", style="yellow"))
+                return f"Error: a hook blocked this {name} call: {outcome.output or 'no reason given'}"
+            if outcome.code != 0:
+                self.console.print(
+                    Text(f"  ⎿ a before_tool hook failed ({outcome.code}): {outcome.output[:200]}", style="yellow")
+                )
+        result = self._run(name, args)
+        notes = []
+        for outcome in hooks.run("after_tool", {**payload, "result": result[:4000]}, self.agent.cwd, name, path):
+            if outcome.code != 0 or outcome.hook.feedback:
+                status = "" if outcome.code == 0 else f", exit code {outcome.code}"
+                notes.append(
+                    f"[A hook ran after this ({outcome.hook.command[:60]}{status}):\n{outcome.output or '(no output)'}]"
+                )
+            if outcome.code != 0:
+                self.console.print(Text(f"  ⎿ hook exit code {outcome.code}: {outcome.output[:200]}", style="yellow"))
+        return result + "".join("\n" + n for n in notes)
+
+    def _run(self, name: str, args: dict) -> str:
         allowed = self.agent.allowed_tools
         if allowed is not None and name not in allowed:
             return f"Error: {name} isn't available to you. Available: {', '.join(sorted(allowed))}"
@@ -540,7 +575,8 @@ class Toolbox:
         if not mcp.allowed(state, tool):
             body = Syntax(json.dumps(arguments, indent=2, ensure_ascii=False), "json", theme="monokai", word_wrap=True)
             title = f"Use {state.name} › {tool['name']}"
-            ok, feedback = self.agent.perms.request(f"mcp:{state.name}:{tool['name']}", "mcp", title, body)
+            key = f"mcp:{state.name}:{tool['name']}"
+            ok, feedback = self.agent.perms.request(key, "mcp", title, body, f"{state.name}:{tool['name']}")
             if not ok:
                 return feedback
         if mcp.needs_gpu(state, tool):
@@ -682,7 +718,7 @@ class Toolbox:
             preview = "\n".join(lines[:60]) + (f"\n... ({len(lines) - 60} more lines)" if len(lines) > 60 else "")
             body = Syntax(preview, Syntax.guess_lexer(str(p), content), theme="monokai", line_numbers=True)
         verb = "Overwrite" if exists else "Create"
-        ok, feedback = self.agent.perms.request("edit", "edit", f"{verb} {self.rel(p)}", body)
+        ok, feedback = self.agent.perms.request("edit", "edit", f"{verb} {self.rel(p)}", body, self.project_rel(p))
         if not ok:
             return feedback
         before = p.read_text(errors="replace") if exists else None
@@ -718,7 +754,8 @@ class Toolbox:
             )
         else:
             new_text = text.replace(old_string, new_string) if replace_all else text.replace(old_string, new_string, 1)
-        ok, feedback = self.agent.perms.request("edit", "edit", f"Edit {self.rel(p)}", self._diff(p, text, new_text))
+        diff = self._diff(p, text, new_text)
+        ok, feedback = self.agent.perms.request("edit", "edit", f"Edit {self.rel(p)}", diff, self.project_rel(p))
         if not ok:
             return feedback
         self.agent.checkpoint()
@@ -745,10 +782,13 @@ class Toolbox:
                 "you can only run read-only commands (such as ls, cat, grep, find, git log, git diff), one at a "
                 "time without pipes into other programs, redirection or chaining"
             )
-        if not is_read_only(command) and not (sandbox and self.agent.perms.mode == "auto-edit"):
+        verdict = self.agent.perms.rule("bash", command)
+        if verdict is not None and not verdict[0]:  # deny rules apply to read-only commands too
+            return verdict[1]
+        if not is_read_only(command) and not (sandbox and self.agent.perms.mode == "auto-edit") and verdict is None:
             body = Syntax(command, "bash", theme="monokai", word_wrap=True)
             where = "in the sandbox" if sandbox else f"in {self.agent.cwd}"
-            ok, feedback = self.agent.perms.request(bash_key(command), "bash", f"Run command ({where})", body)
+            ok, feedback = self.agent.perms.request(bash_key(command), "bash", f"Run command ({where})", body, command)
             if not ok:
                 return feedback
         if not is_read_only(command):
@@ -842,7 +882,7 @@ class Toolbox:
         if settings.web == "off":
             return False, "Web access is turned off (web = off)."
         if settings.web == "ask":
-            return self.agent.perms.request(key, "web", title, Text(detail))
+            return self.agent.perms.request(key, "web", title, Text(detail), key.removeprefix("web:"))
         return True, ""
 
     def t_web_search(self, query: str, max_results: int = 5) -> str:

{lcode_cli-0.14.0.dist-info → lcode_cli-0.15.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: lcode-cli
-Version: 0.14.0
+Version: 0.15.0
 Summary: A local-first terminal coding agent powered by open-weight models on your own GPU or Mac, via Ollama.
 Project-URL: Homepage, https://nasser1941.github.io/lcode/
 Project-URL: Documentation, https://nasser1941.github.io/lcode/
@@ -89,6 +89,8 @@ through [Ollama](https://ollama.com), and when it needs current information it c
   and sees the errors an edit introduced right away.
 - **Commands and skills.** Your own `/commands` as prompt templates, and skills in the
   [Agent Skills](https://agentskills.io) format that the model loads only when a task needs them.
+- **Hooks and rules.** Format every edited file, block force-pushes, run the tests after each
+  request: shell hooks on lcode's events, and allow and deny lists that hold even in `yolo` mode.
 - **Plan mode.** `/plan <request>` or Shift+Tab: the model explores read-only and presents a plan;
   you approve, edit or send it back before anything changes.
 - **Undo.** lcode saves a checkpoint before the model changes files; `/undo` takes back the last
@@ -206,7 +208,8 @@ fills up. Details: [How it works](https://nasser1941.github.io/lcode/how-it-work
 
 See the pinned [Roadmap issue](https://github.com/nasser1941/lcode/issues/10). Next up:
 
-- [Hooks and permission rules](https://github.com/nasser1941/lcode/issues/43)
+- [More local backends: LM Studio, llama.cpp, vLLM and MLX](https://github.com/nasser1941/lcode/issues/47)
+- [Git workflow: /commit, /review, /pr and parallel worktrees](https://github.com/nasser1941/lcode/issues/50)
 - More models in the catalog, and test reports from your hardware ([report one](https://github.com/nasser1941/lcode/issues/new?template=model_request.yml))
 
 ## Contributing

{lcode_cli-0.14.0.dist-info → lcode_cli-0.15.0.dist-info}/RECORD

@@ -1,31 +1,32 @@
-lcode/__init__.py,sha256=wYa3zAlm3RPawB49b0i_I_WUqgewgwXMs6xEVHHHG64,118
+lcode/__init__.py,sha256=nt1m5TjCnM-J0wx2xHbNb3L4c1vNJmM3nIma1bcOi5E,118
 lcode/__main__.py,sha256=s5N5pryX2FAu93GGZ3FxUrIXHWGzxz66lKUoaV_h8Ws,35
-lcode/agent.py,sha256=T6MZmAW5yEGOOU29SdyYRi5veJxDDPWEKvobxglhuzs,45428
+lcode/agent.py,sha256=7eWmKnxRAYEvGYGkukmd2EGfWg_LYhEQdBJQljMK_Uk,46113
 lcode/bench.py,sha256=7XHJZmRVUt3JYYEyIIMX9fcqOFIvfKB9Iy-2aPo00VU,40406
 lcode/bench_backend.py,sha256=X2fo-zRX92Xp3KMxSsFlWioc2vRupBTtowj5kLME8mw,14287
 lcode/catalog.py,sha256=pZ1azX9OH2r4JE2c6E5OfwywpgS39-W2oXzoCHJhmtM,4141
 lcode/checkpoints.py,sha256=eqPtmPe44-aweWqc2H21ROogwzIt3NpvcUobsaCHoGY,18354
-lcode/cli.py,sha256=q-sHK0WbX-wcQ0yU4RBVL7NERgM04roUlR7anVlEQFA,36204
+lcode/cli.py,sha256=bcASJ0qpSbAi-rmqqLqpySHtckf6rQ777CjB82ll8C0,37091
 lcode/codesearch.py,sha256=_Z7D_Snpl0NwfXk6P4yUJ0VmwLKCy74YLc52DjUUdTU,10510
-lcode/config.py,sha256=Epm5Zh6b1fUYtI6zdvRqvnWMD4u3rCJ0tyhbqEIjG5E,8883
+lcode/config.py,sha256=5JdLA04cxB7gEf6JGJYbIlqIgjo9tNNiT26osEdJ9zI,9190
 lcode/context.py,sha256=qJymLE3eYeaF6qVOzlUwDURqlky__8cskl_6vXeU3AA,10701
-lcode/extensions.py,sha256=1MkCmfvQvcJt1XaqIEOYUruCTsrfQVI5TXOTWBkkJtI,15882
+lcode/extensions.py,sha256=W0HFDl0BvROzr7i_qtabHdIbacBgP5o5qIJLzoM2oNE,16806
 lcode/frontmatter.py,sha256=Bx0n4vLPhp7ZCWx-g7xqzqNy5VoKBxyeeikh5UFB_gA,2441
 lcode/hardware.py,sha256=2VbknZCxTZJwJUD8YWdQ7ryEQo_LcjtoOBOHOU9Y0fw,3085
+lcode/hooks.py,sha256=K0itOiAuH4rxndJ9gne_uCrqby6oWAzFPRrfB3tCq-E,9324
 lcode/limits.py,sha256=oJzVQoMyTZ0_Fkpu5t3qxrf9v7Hv9S8U8BRQR5M1aKA,1237
 lcode/lsp.py,sha256=NtSW7xapv7fg2HAQLuYK1nwIqT7nG0LK1hiTpOmla_4,26086
 lcode/memory.py,sha256=WZEHTp-lVxAwS-yyLQR2xB3TMZ9sejmX2Ivg7T-tl3w,21949
 lcode/models.toml,sha256=lt2G64zzo_Ryxv2ISRSNZoVD_JqCqYqsM01n8WoXGs8,4098
 lcode/ollama.py,sha256=edSckfbtK0iSH-Pm-IpUHO_73nPaRokh7cHiDBSKvWU,7594
-lcode/permissions.py,sha256=m8YNtCladVAmXB20ca8AwyfEOzHKS557B0SOvx1oHeM,4528
+lcode/permissions.py,sha256=bSDpkSzq1tozC3LgzAzXmJX_DGRxoY9a3Kdx-AFQ3nI,5426
 lcode/planning.py,sha256=hZjVka7i9TswJrXLbjbZJ0PBc6zHpmO64JqMiaFYnMQ,6110
 lcode/render.py,sha256=gMvf4W3qkLUJ4Vot3az_hP_zRDAItJC9pP-68dHFkfA,1375
-lcode/repl.py,sha256=Dnm4H0FGbD-LbXUYhF13tL4WTTVf_rzDIuj-Gse9vdU,44647
+lcode/repl.py,sha256=l3LHCNRZD7Kk03k5hk6GJKrm62ToQT9FPjKtW3xwsAc,45540
 lcode/repomap.py,sha256=1GRJgEUjBl9XHSXsF7tSGXBCEgsY-3CzwMohaTudZ_M,13969
 lcode/sandbox.py,sha256=u_pkrVRXhCGhh-wFDPwuZ3jGG7UeXxXRAeBNsm37ZvE,8608
 lcode/sessions.py,sha256=wOR-J0EHgJxLSPboKPHnvBcp5VTUYTj3tZWgpsa6-K4,4013
-lcode/subagents.py,sha256=QYt5kzUF1lB45dn2oaTBkOUaOJrcyC0hvo5g7DARcSA,28471
-lcode/tools.py,sha256=rwH0V9uMQSqpb6eo1B5gVSwhw-uPJ_1ksBShvsoItfE,39584
+lcode/subagents.py,sha256=kfDICxAYd4i9LtBFxTO9tdvbAB5JzF_iQXUUK9i6yc4,28813
+lcode/tools.py,sha256=ris8gXJ2phFY9Fr4UnUVkuyqjMRWMWONZc7onO7O-9c,41904
 lcode/vision.py,sha256=w33QPmdGwP33wM4mvmAH4amFDZ1xzeXhEsSLJ-STSHY,4243
 lcode/web.py,sha256=vyxKbSRJTl1Lj3hj7Yd_NwTgbv0Xi6dup2YfUXjqp-Y,14579
 lcode/mcp/__init__.py,sha256=XujtAmRoXW9S0uq1XPf_CAeCkHh_UvA8FCmoAKP9j1Y,171
@@ -43,8 +44,8 @@ lcode/mcp/stdio.py,sha256=kC6KHwzMMDjBr-yCZLmyVKS7PZXU299WpZdYRoX5eRQ,6292
 lcode/servers/__init__.py,sha256=qrIhxEodEB8cjKEQ4Cicc0GsQhE2OH-9qlVHzr3-tq8,77
 lcode/servers/encord.py,sha256=WSauawL1UKYZCUAG1oalcKL_An3DVof-JM6xIgFyQSE,12769
 lcode/servers/valohai.py,sha256=e5xZGIoa4cja4f5i85q1GpL9c7cglUjV8jN2co1CFMY,14430
-lcode_cli-0.14.0.dist-info/METADATA,sha256=I9bhdO3mQPt6M3vAvy6xYNGjbPed7BveoyIl1n1eohc,11709
-lcode_cli-0.14.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-lcode_cli-0.14.0.dist-info/entry_points.txt,sha256=pMz2Byj2QRyt-ZZQYZvmWUtmKPCeE7f8iCvu-sjZPIo,133
-lcode_cli-0.14.0.dist-info/licenses/LICENSE,sha256=JWjmoL7nNIC1XUa-dZm2hwLUgjUQMFo6k8APb0idNzs,1074
-lcode_cli-0.14.0.dist-info/RECORD,,
+lcode_cli-0.15.0.dist-info/METADATA,sha256=BSaWKw3B8zJZ55eweihAEyScAXH3KT3fHgfBTdTQJQk,12040
+lcode_cli-0.15.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+lcode_cli-0.15.0.dist-info/entry_points.txt,sha256=pMz2Byj2QRyt-ZZQYZvmWUtmKPCeE7f8iCvu-sjZPIo,133
+lcode_cli-0.15.0.dist-info/licenses/LICENSE,sha256=JWjmoL7nNIC1XUa-dZm2hwLUgjUQMFo6k8APb0idNzs,1074
+lcode_cli-0.15.0.dist-info/RECORD,,