Method evaluate

src/security/permissions.ts:36–85

* Returns a non-asking decision based purely on policy. * Returns 'ask' when policy is undecided.

(req: PermissionRequest)

    this.denyPatterns = config.security.autoReject.map(p => new RegExp(p));
    this.alwaysAskPatterns = (config.security.alwaysAsk ?? []).map(p => new RegExp(p));
    this.denyRules = [...(config.security.denyRules ?? [])];
  }

  /**
   * Returns a non-asking decision based purely on policy.
   * Returns 'ask' when policy is undecided.
   */
  evaluate(req: PermissionRequest): PermissionDecision {
    // User deny rules outrank everything, including /auto and yolo — that is the point of
    // being able to write one.
    if (this.denyRules.length && matchDenyRule(req.operation, this.denyRules)) return 'deny';

    // Hard deny patterns next — even auto-approve mode can't bypass these.
    for (const p of this.denyPatterns) {
      if (p.test(req.operation)) return 'deny';
    }

    // Irreversible commands are confirmed EVERY time. No standing grant, no session
    // auto-approve, no yolo: rollback cannot undo `rm -rf` or a force push, so a blanket
    // yes must never reach one. Read-only tools are exempt (their operand is a path).
    const irreversible =
      !this.isReadOnlyTool(req.tool) && assessCommand(req.operation).tier === 'irreversible';
    if (irreversible) {
      const k = `${req.tool}:${req.operation}`;
      if (this.sessionDenies.has(k)) return 'deny';
      return 'ask';
    }

    // Always-ask patterns next — system-mutating commands (defaults write, sudo,
    // package installs, disk/network config). These OVERRIDE session auto-approve
    // and autoApprove patterns: silently running them risks destabilizing the
    // user's machine, so we force an explicit prompt every time. The only escape
    // is a per-pair/pattern decision the user themselves granted THIS session
    // (handled below), so a user who already said "always allow" for one specific
    // command isn't re-nagged — but `/auto on` alone never covers these.
    const isAlwaysAsk = this.alwaysAskPatterns.some(p => p.test(req.operation));
    if (isAlwaysAsk) {
      const key = `${req.tool}:${req.operation}`;
      if (this.sessionDenies.has(key)) return 'deny';
      if (this.sessionAllows.has(key)) return 'allow';
      if (this.commandGrants.has(normalizeCommand(req.operation))) return 'allow';
      if (this.alwaysAllowPatterns.some(p => p.test(req.operation))) return 'allow';
      return 'ask';
    }

    // Session-wide auto-approve overrides everything except hard denies and
    // always-ask (handled above).
    // Set by `/auto on`; cleared by `/auto off`.
    if (_autoApproveSession) return 'allow';

    // "Allow this tool for the whole session" — from gradient picker
    if (this.sessionToolAllows.has(req.tool)) return 'allow';