Method isReadOnlyTool

src/security/permissions.ts:113–139

* Check if a tool is read-only. Uses the registry callback if available * (so new tools are automatically recognized via their `isReadOnly` property). * Falls back to a hardcoded list for back-compat.

(tool: string)

  }

  /**
   * Persist a decision. Scopes:
   *   - 'once'        — just for this call (no-op here; caller acts)
   *   - 'session'     — until QodeX restart, for THIS exact tool:operation pair
   *   - 'pattern'     — until QodeX restart, for anything matching the command prefix
   *   - 'tool'        — until QodeX restart, ALL invocations of this tool name
   */
  rememberDecision(req: PermissionRequest, decision: 'allow' | 'deny', scope: 'once' | 'session' | 'pattern' | 'tool'): void {
    const key = `${req.tool}:${req.operation}`;
    if (scope === 'session') {
      if (decision === 'allow') this.sessionAllows.add(key);
      else this.sessionDenies.add(key);
    } else if (scope === 'pattern' && decision === 'allow') {
      // A grant binds to the EXACT command, not to its first word. The old behaviour built
      // `^git( |$)` from `git status`, which then auto-approved `git push --force`; and
      // `^rm( |$)` from `rm -rf /tmp/x`, which auto-approved `rm -rf /`. That is the one
      // failure mode rollback cannot undo — the journal covers file writes, not shell
      // commands — so "always" now means "this command", nothing broader.
      if (canGrantAlways(req.operation).allowed) {
        this.commandGrants.add(normalizeCommand(req.operation));
      }
      // Irreversible commands deliberately get NO standing grant: they are asked every time.
    } else if (scope === 'tool' && decision === 'allow') {
      this.sessionToolAllows.add(req.tool);
    }
  }

  /** Why a standing grant was refused, for the UI to explain instead of silently not saving. */
  grantRefusalReason(operation: string): string | null {
    return canGrantAlways(operation).reason ?? null;