Something went wrong. Try again.
source dump of claude code forked from oppi.li/claude-code
Something went wrong. Try again.
53 kB · 1532 lines
TypeScript
at main
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533import { feature } from 'bun:bundle'import { relative } from 'path'import { getOriginalCwd, handleAutoModeTransition, handlePlanModeTransition, setHasExitedPlanMode, setNeedsAutoModeExitAttachment,} from '../../bootstrap/state.js'import type { ToolPermissionContext, ToolPermissionRulesBySource,} from '../../Tool.js'import { getCwd } from '../cwd.js'import { isEnvTruthy } from '../envUtils.js'import type { SettingSource } from '../settings/constants.js'import { SETTING_SOURCES } from '../settings/constants.js'import { getSettings_DEPRECATED, getSettingsFilePathForSource, getUseAutoModeDuringPlan, hasAutoModeOptIn,} from '../settings/settings.js'import { type PermissionMode, permissionModeFromString,} from './PermissionMode.js'import { applyPermissionRulesToPermissionContext } from './permissions.js'import { loadAllPermissionRulesFromDisk } from './permissionsLoader.js'
/* eslint-disable @typescript-eslint/no-require-imports */const autoModeStateModule = feature('TRANSCRIPT_CLASSIFIER') ? (require('./autoModeState.js') as typeof import('./autoModeState.js')) : null
import { resolve } from 'path'import { checkSecurityRestrictionGate, checkStatsigFeatureGate_CACHED_MAY_BE_STALE, getDynamicConfig_BLOCKS_ON_INIT, getFeatureValue_CACHED_MAY_BE_STALE,} from 'src/services/analytics/growthbook.js'import { addDirHelpMessage, validateDirectoryForWorkspace,} from '../../commands/add-dir/validation.js'import { type AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS, logEvent,} from '../../services/analytics/index.js'import { AGENT_TOOL_NAME } from '../../tools/AgentTool/constants.js'import { BASH_TOOL_NAME } from '../../tools/BashTool/toolName.js'/* eslint-enable @typescript-eslint/no-require-imports */import { POWERSHELL_TOOL_NAME } from '../../tools/PowerShellTool/toolName.js'import { getToolsForDefaultPreset, parseToolPreset } from '../../tools.js'import { getFsImplementation, safeResolvePath,} from '../../utils/fsOperations.js'import { modelSupportsAutoMode } from '../betas.js'import { logForDebugging } from '../debug.js'import { gracefulShutdown } from '../gracefulShutdown.js'import { getMainLoopModel } from '../model/model.js'import { CROSS_PLATFORM_CODE_EXEC, DANGEROUS_BASH_PATTERNS,} from './dangerousPatterns.js'import type { PermissionRule, PermissionRuleSource, PermissionRuleValue,} from './PermissionRule.js'import { type AdditionalWorkingDirectory, applyPermissionUpdate,} from './PermissionUpdate.js'import type { PermissionUpdateDestination } from './PermissionUpdateSchema.js'import { normalizeLegacyToolName, permissionRuleValueFromString, permissionRuleValueToString,} from './permissionRuleParser.js'
/** * Checks if a Bash permission rule is dangerous for auto mode. * A rule is dangerous if it would auto-allow commands that execute arbitrary code, * bypassing the classifier's safety evaluation. * * Dangerous patterns: * 1. Tool-level allow (Bash with no ruleContent) - allows ALL commands * 2. Prefix rules for script interpreters (python:*, node:*, etc.) * 3. Wildcard rules matching interpreters (python*, node*, etc.) */export function isDangerousBashPermission( toolName: string, ruleContent: string | undefined,): boolean { // Only check Bash rules if (toolName !== BASH_TOOL_NAME) { return false }
// Tool-level allow (Bash with no content, or Bash(*)) - allows ALL commands if (ruleContent === undefined || ruleContent === '') { return true }
const content = ruleContent.trim().toLowerCase()
// Standalone wildcard (*) matches everything if (content === '*') { return true }
// Check for dangerous patterns with prefix syntax (e.g., "python:*") // or wildcard syntax (e.g., "python*") for (const pattern of DANGEROUS_BASH_PATTERNS) { const lowerPattern = pattern.toLowerCase()
// Exact match to the pattern itself (e.g., "python" as a rule) if (content === lowerPattern) { return true }
// Prefix syntax: "python:*" allows any python command if (content === `${lowerPattern}:*`) { return true }
// Wildcard at end: "python*" matches python, python3, etc. if (content === `${lowerPattern}*`) { return true }
// Wildcard with space: "python *" would match "python script.py" if (content === `${lowerPattern} *`) { return true }
// Check for patterns like "python -*" which would match "python -c 'code'" if (content.startsWith(`${lowerPattern} -`) && content.endsWith('*')) { return true } }
return false}
/** * Checks if a PowerShell permission rule is dangerous for auto mode. * A rule is dangerous if it would auto-allow commands that execute arbitrary * code (nested shells, Invoke-Expression, Start-Process, etc.), bypassing the * classifier's safety evaluation. * * PowerShell is case-insensitive, so rule content is lowercased before matching. */export function isDangerousPowerShellPermission( toolName: string, ruleContent: string | undefined,): boolean { if (toolName !== POWERSHELL_TOOL_NAME) { return false }
// Tool-level allow (PowerShell with no content, or PowerShell(*)) - allows ALL commands if (ruleContent === undefined || ruleContent === '') { return true }
const content = ruleContent.trim().toLowerCase()
// Standalone wildcard (*) matches everything if (content === '*') { return true }
// PS-specific cmdlet names. CROSS_PLATFORM_CODE_EXEC is shared with bash. const patterns: readonly string[] = [ ...CROSS_PLATFORM_CODE_EXEC, // Nested PS + shells launchable from PS 'pwsh', 'powershell', 'cmd', 'wsl', // String/scriptblock evaluators 'iex', 'invoke-expression', 'icm', 'invoke-command', // Process spawners 'start-process', 'saps', 'start', 'start-job', 'sajb', 'start-threadjob', // bundled PS 6.1+; takes -ScriptBlock like Start-Job // Event/session code exec 'register-objectevent', 'register-engineevent', 'register-wmievent', 'register-scheduledjob', 'new-pssession', 'nsn', // alias 'enter-pssession', 'etsn', // alias // .NET escape hatches 'add-type', // Add-Type -TypeDefinition '<C#>' → P/Invoke 'new-object', // New-Object -ComObject WScript.Shell → .Run() ]
for (const pattern of patterns) { // patterns stored lowercase; content lowercased above if (content === pattern) return true if (content === `${pattern}:*`) return true if (content === `${pattern}*`) return true if (content === `${pattern} *`) return true if (content.startsWith(`${pattern} -`) && content.endsWith('*')) return true // .exe — goes on the FIRST word. `python` → `python.exe`. // `npm run` → `npm.exe run` (npm.exe is the real Windows binary name). // A rule like `PowerShell(npm.exe run:*)` needs to match `npm run`. const sp = pattern.indexOf(' ') const exe = sp === -1 ? `${pattern}.exe` : `${pattern.slice(0, sp)}.exe${pattern.slice(sp)}` if (content === exe) return true if (content === `${exe}:*`) return true if (content === `${exe}*`) return true if (content === `${exe} *`) return true if (content.startsWith(`${exe} -`) && content.endsWith('*')) return true } return false}
/** * Checks if an Agent (sub-agent) permission rule is dangerous for auto mode. * Any Agent allow rule would auto-approve sub-agent spawns before the auto mode classifier * can evaluate the sub-agent's prompt, defeating delegation attack prevention. */export function isDangerousTaskPermission( toolName: string, _ruleContent: string | undefined,): boolean { return normalizeLegacyToolName(toolName) === AGENT_TOOL_NAME}
function formatPermissionSource(source: PermissionRuleSource): string { if ((SETTING_SOURCES as readonly string[]).includes(source)) { const filePath = getSettingsFilePathForSource(source as SettingSource) if (filePath) { const relativePath = relative(getCwd(), filePath) return relativePath.length < filePath.length ? relativePath : filePath } } return source}
export type DangerousPermissionInfo = { ruleValue: PermissionRuleValue source: PermissionRuleSource /** The permission rule formatted for display, e.g. "Bash(*)" or "Bash(python:*)" */ ruleDisplay: string /** The source formatted for display, e.g. a file path or "--allowed-tools" */ sourceDisplay: string}
/** * Checks if a permission rule is dangerous for auto mode. * A rule is dangerous if it would auto-allow actions before the auto mode classifier * can evaluate them, bypassing safety checks. */function isDangerousClassifierPermission( toolName: string, ruleContent: string | undefined,): boolean { if (process.env.USER_TYPE === 'ant') { // Tmux send-keys executes arbitrary shell, bypassing the classifier same as Bash(*) if (toolName === 'Tmux') return true } return ( isDangerousBashPermission(toolName, ruleContent) || isDangerousPowerShellPermission(toolName, ruleContent) || isDangerousTaskPermission(toolName, ruleContent) )}
/** * Finds all dangerous permissions from rules loaded from disk and CLI arguments. * Returns structured info about each dangerous permission found. * * Checks Bash permissions (wildcard/interpreter patterns), PowerShell permissions * (wildcard/iex/Start-Process patterns), and Agent permissions (any allow rule * bypasses the classifier's sub-agent evaluation). */export function findDangerousClassifierPermissions( rules: PermissionRule[], cliAllowedTools: string[],): DangerousPermissionInfo[] { const dangerous: DangerousPermissionInfo[] = []
// Check rules loaded from settings for (const rule of rules) { if ( rule.ruleBehavior === 'allow' && isDangerousClassifierPermission( rule.ruleValue.toolName, rule.ruleValue.ruleContent, ) ) { const ruleString = rule.ruleValue.ruleContent ? `${rule.ruleValue.toolName}(${rule.ruleValue.ruleContent})` : `${rule.ruleValue.toolName}(*)` dangerous.push({ ruleValue: rule.ruleValue, source: rule.source, ruleDisplay: ruleString, sourceDisplay: formatPermissionSource(rule.source), }) } }
// Check CLI --allowed-tools arguments for (const toolSpec of cliAllowedTools) { // Parse tool spec: "Bash" or "Bash(pattern)" or "Agent" or "Agent(subagent_type)" const match = toolSpec.match(/^([^(]+)(?:\(([^)]*)\))?$/) if (match) { const toolName = match[1]!.trim() const ruleContent = match[2]?.trim()
if (isDangerousClassifierPermission(toolName, ruleContent)) { dangerous.push({ ruleValue: { toolName, ruleContent }, source: 'cliArg', ruleDisplay: ruleContent ? toolSpec : `${toolName}(*)`, sourceDisplay: '--allowed-tools', }) } } }
return dangerous}
/** * Checks if a Bash allow rule is overly broad (equivalent to YOLO mode). * Returns true for tool-level Bash allow rules with no content restriction, * which auto-allow every bash command. * * Matches: Bash, Bash(*), Bash() — all parse to { toolName: 'Bash' } with no ruleContent. */export function isOverlyBroadBashAllowRule( ruleValue: PermissionRuleValue,): boolean { return ( ruleValue.toolName === BASH_TOOL_NAME && ruleValue.ruleContent === undefined )}
/** * PowerShell equivalent of isOverlyBroadBashAllowRule. * * Matches: PowerShell, PowerShell(*), PowerShell() — all parse to * { toolName: 'PowerShell' } with no ruleContent. */export function isOverlyBroadPowerShellAllowRule( ruleValue: PermissionRuleValue,): boolean { return ( ruleValue.toolName === POWERSHELL_TOOL_NAME && ruleValue.ruleContent === undefined )}
/** * Finds all overly broad Bash allow rules from settings and CLI arguments. * An overly broad rule allows ALL bash commands (e.g., Bash or Bash(*)), * which is effectively equivalent to YOLO/bypass-permissions mode. */export function findOverlyBroadBashPermissions( rules: PermissionRule[], cliAllowedTools: string[],): DangerousPermissionInfo[] { const overlyBroad: DangerousPermissionInfo[] = []
for (const rule of rules) { if ( rule.ruleBehavior === 'allow' && isOverlyBroadBashAllowRule(rule.ruleValue) ) { overlyBroad.push({ ruleValue: rule.ruleValue, source: rule.source, ruleDisplay: `${BASH_TOOL_NAME}(*)`, sourceDisplay: formatPermissionSource(rule.source), }) } }
for (const toolSpec of cliAllowedTools) { const parsed = permissionRuleValueFromString(toolSpec) if (isOverlyBroadBashAllowRule(parsed)) { overlyBroad.push({ ruleValue: parsed, source: 'cliArg', ruleDisplay: `${BASH_TOOL_NAME}(*)`, sourceDisplay: '--allowed-tools', }) } }
return overlyBroad}
/** * PowerShell equivalent of findOverlyBroadBashPermissions. */export function findOverlyBroadPowerShellPermissions( rules: PermissionRule[], cliAllowedTools: string[],): DangerousPermissionInfo[] { const overlyBroad: DangerousPermissionInfo[] = []
for (const rule of rules) { if ( rule.ruleBehavior === 'allow' && isOverlyBroadPowerShellAllowRule(rule.ruleValue) ) { overlyBroad.push({ ruleValue: rule.ruleValue, source: rule.source, ruleDisplay: `${POWERSHELL_TOOL_NAME}(*)`, sourceDisplay: formatPermissionSource(rule.source), }) } }
for (const toolSpec of cliAllowedTools) { const parsed = permissionRuleValueFromString(toolSpec) if (isOverlyBroadPowerShellAllowRule(parsed)) { overlyBroad.push({ ruleValue: parsed, source: 'cliArg', ruleDisplay: `${POWERSHELL_TOOL_NAME}(*)`, sourceDisplay: '--allowed-tools', }) } }
return overlyBroad}
/** * Type guard to check if a PermissionRuleSource is a valid PermissionUpdateDestination. * Sources like 'flagSettings', 'policySettings', and 'command' are not valid destinations. */function isPermissionUpdateDestination( source: PermissionRuleSource,): source is PermissionUpdateDestination { return [ 'userSettings', 'projectSettings', 'localSettings', 'session', 'cliArg', ].includes(source)}
/** * Removes dangerous permissions from the in-memory context, and optionally * persists the removal to settings files on disk. */export function removeDangerousPermissions( context: ToolPermissionContext, dangerousPermissions: DangerousPermissionInfo[],): ToolPermissionContext { // Group dangerous rules by their source (destination for updates) const rulesBySource = new Map< PermissionUpdateDestination, PermissionRuleValue[] >() for (const perm of dangerousPermissions) { // Skip sources that can't be persisted (flagSettings, policySettings, command) if (!isPermissionUpdateDestination(perm.source)) { continue } const destination = perm.source const existing = rulesBySource.get(destination) || [] existing.push(perm.ruleValue) rulesBySource.set(destination, existing) }
let updatedContext = context for (const [destination, rules] of rulesBySource) { updatedContext = applyPermissionUpdate(updatedContext, { type: 'removeRules' as const, rules, behavior: 'allow' as const, destination, }) }
return updatedContext}
/** * Prepares a ToolPermissionContext for auto mode by stripping * dangerous permissions that would bypass the classifier. * Returns the cleaned context (with mode unchanged — caller sets the mode). */export function stripDangerousPermissionsForAutoMode( context: ToolPermissionContext,): ToolPermissionContext { const rules: PermissionRule[] = [] for (const [source, ruleStrings] of Object.entries( context.alwaysAllowRules, )) { if (!ruleStrings) { continue } for (const ruleString of ruleStrings) { const ruleValue = permissionRuleValueFromString(ruleString) rules.push({ source: source as PermissionRuleSource, ruleBehavior: 'allow', ruleValue, }) } } const dangerousPermissions = findDangerousClassifierPermissions(rules, []) if (dangerousPermissions.length === 0) { return { ...context, strippedDangerousRules: context.strippedDangerousRules ?? {}, } } for (const permission of dangerousPermissions) { logForDebugging( `Ignoring dangerous permission ${permission.ruleDisplay} from ${permission.sourceDisplay} (bypasses classifier)`, ) } // Mirror removeDangerousPermissions' source filter so stash == what was actually removed. const stripped: ToolPermissionRulesBySource = {} for (const perm of dangerousPermissions) { if (!isPermissionUpdateDestination(perm.source)) continue ;(stripped[perm.source] ??= []).push( permissionRuleValueToString(perm.ruleValue), ) } return { ...removeDangerousPermissions(context, dangerousPermissions), strippedDangerousRules: stripped, }}
/** * Restores dangerous allow rules previously stashed by * stripDangerousPermissionsForAutoMode. Called when leaving auto mode so that * the user's Bash(python:*), Agent(*), etc. rules work again in default mode. * Clears the stash so a second exit is a no-op. */export function restoreDangerousPermissions( context: ToolPermissionContext,): ToolPermissionContext { const stash = context.strippedDangerousRules if (!stash) { return context } let result = context for (const [source, ruleStrings] of Object.entries(stash)) { if (!ruleStrings || ruleStrings.length === 0) continue result = applyPermissionUpdate(result, { type: 'addRules', rules: ruleStrings.map(permissionRuleValueFromString), behavior: 'allow', destination: source as PermissionUpdateDestination, }) } return { ...result, strippedDangerousRules: undefined }}
/** * Handles all state transitions when switching permission modes. * Centralises side-effects so that every activation path (CLI Shift+Tab, * SDK control messages, etc.) behaves identically. * * Currently handles: * - Plan mode enter/exit attachments (via handlePlanModeTransition) * - Auto mode activation: setAutoModeActive, stripDangerousPermissionsForAutoMode * * Returns the (possibly modified) context. Caller is responsible for setting * the mode on the returned context. * * @param fromMode The current permission mode * @param toMode The target permission mode * @param context The current tool permission context */export function transitionPermissionMode( fromMode: string, toMode: string, context: ToolPermissionContext,): ToolPermissionContext { // plan→plan (SDK set_permission_mode) would wrongly hit the leave branch below if (fromMode === toMode) return context
handlePlanModeTransition(fromMode, toMode) handleAutoModeTransition(fromMode, toMode)
if (fromMode === 'plan' && toMode !== 'plan') { setHasExitedPlanMode(true) }
if (feature('TRANSCRIPT_CLASSIFIER')) { if (toMode === 'plan' && fromMode !== 'plan') { return prepareContextForPlanMode(context) }
// Plan with auto active counts as using the classifier (for the leaving side). // isAutoModeActive() is the authoritative signal — prePlanMode/strippedDangerousRules // are unreliable proxies because auto can be deactivated mid-plan (non-opt-in // entry, transitionPlanAutoMode) while those fields remain set/unset. const fromUsesClassifier = fromMode === 'auto' || (fromMode === 'plan' && (autoModeStateModule?.isAutoModeActive() ?? false)) const toUsesClassifier = toMode === 'auto' // plan entry handled above
if (toUsesClassifier && !fromUsesClassifier) { if (!isAutoModeGateEnabled()) { throw new Error('Cannot transition to auto mode: gate is not enabled') } autoModeStateModule?.setAutoModeActive(true) context = stripDangerousPermissionsForAutoMode(context) } else if (fromUsesClassifier && !toUsesClassifier) { autoModeStateModule?.setAutoModeActive(false) setNeedsAutoModeExitAttachment(true) context = restoreDangerousPermissions(context) } }
// Only spread if there's something to clear (preserves ref equality) if (fromMode === 'plan' && toMode !== 'plan' && context.prePlanMode) { return { ...context, prePlanMode: undefined } }
return context}
/** * Parse base tools specification from CLI * Handles both preset names (default, none) and custom tool lists */export function parseBaseToolsFromCLI(baseTools: string[]): string[] { // Join all array elements and check if it's a single preset name const joinedInput = baseTools.join(' ').trim() const preset = parseToolPreset(joinedInput)
if (preset) { return getToolsForDefaultPreset() }
// Parse as a custom tool list using the same parsing logic as allowedTools/disallowedTools const parsedTools = parseToolListFromCLI(baseTools)
return parsedTools}
/** * Check if processPwd is a symlink that resolves to originalCwd */function isSymlinkTo({ processPwd, originalCwd,}: { processPwd: string originalCwd: string}): boolean { // Use safeResolvePath to check if processPwd is a symlink and get its resolved path const { resolvedPath: resolvedProcessPwd, isSymlink: isProcessPwdSymlink } = safeResolvePath(getFsImplementation(), processPwd)
return isProcessPwdSymlink ? resolvedProcessPwd === resolve(originalCwd) : false}
/** * Safely convert CLI flags to a PermissionMode */export function initialPermissionModeFromCLI({ permissionModeCli, dangerouslySkipPermissions,}: { permissionModeCli: string | undefined dangerouslySkipPermissions: boolean | undefined}): { mode: PermissionMode; notification?: string } { const settings = getSettings_DEPRECATED() || {}
// Check GrowthBook gate first - highest precedence const growthBookDisableBypassPermissionsMode = checkStatsigFeatureGate_CACHED_MAY_BE_STALE( 'tengu_disable_bypass_permissions_mode', )
// Then check settings - lower precedence const settingsDisableBypassPermissionsMode = settings.permissions?.disableBypassPermissionsMode === 'disable'
// Statsig gate takes precedence over settings const disableBypassPermissionsMode = growthBookDisableBypassPermissionsMode || settingsDisableBypassPermissionsMode
// Sync circuit-breaker check (cached GB read). Prevents the // AutoModeOptInDialog from showing in showSetupScreens() when auto can't // actually be entered. autoModeFlagCli still carries intent through to // verifyAutoModeGateAccess, which notifies the user why. const autoModeCircuitBrokenSync = feature('TRANSCRIPT_CLASSIFIER') ? getAutoModeEnabledStateIfCached() === 'disabled' : false
// Modes in order of priority const orderedModes: PermissionMode[] = [] let notification: string | undefined
if (dangerouslySkipPermissions) { orderedModes.push('bypassPermissions') } if (permissionModeCli) { const parsedMode = permissionModeFromString(permissionModeCli) if (feature('TRANSCRIPT_CLASSIFIER') && parsedMode === 'auto') { if (autoModeCircuitBrokenSync) { logForDebugging( 'auto mode circuit breaker active (cached) — falling back to default', { level: 'warn' }, ) } else { orderedModes.push('auto') } } else { orderedModes.push(parsedMode) } } if (settings.permissions?.defaultMode) { const settingsMode = settings.permissions.defaultMode as PermissionMode // CCR only supports acceptEdits and plan — ignore other defaultModes from // settings (e.g. bypassPermissions would otherwise silently grant full // access in a remote environment). if ( isEnvTruthy(process.env.CLAUDE_CODE_REMOTE) && !['acceptEdits', 'plan', 'default'].includes(settingsMode) ) { logForDebugging( `settings defaultMode "${settingsMode}" is not supported in CLAUDE_CODE_REMOTE — only acceptEdits and plan are allowed`, { level: 'warn' }, ) logEvent('tengu_ccr_unsupported_default_mode_ignored', { mode: settingsMode as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS, }) } // auto from settings requires the same gate check as from CLI else if (feature('TRANSCRIPT_CLASSIFIER') && settingsMode === 'auto') { if (autoModeCircuitBrokenSync) { logForDebugging( 'auto mode circuit breaker active (cached) — falling back to default', { level: 'warn' }, ) } else { orderedModes.push('auto') } } else { orderedModes.push(settingsMode) } }
let result: { mode: PermissionMode; notification?: string } | undefined
for (const mode of orderedModes) { if (mode === 'bypassPermissions' && disableBypassPermissionsMode) { if (growthBookDisableBypassPermissionsMode) { logForDebugging('bypassPermissions mode is disabled by Statsig gate', { level: 'warn', }) notification = 'Bypass permissions mode was disabled by your organization policy' } else { logForDebugging('bypassPermissions mode is disabled by settings', { level: 'warn', }) notification = 'Bypass permissions mode was disabled by settings' } continue // Skip this mode if it's disabled }
result = { mode, notification } // Use the first valid mode break }
if (!result) { result = { mode: 'default', notification } }
if (!result) { result = { mode: 'default', notification } }
if (feature('TRANSCRIPT_CLASSIFIER') && result.mode === 'auto') { autoModeStateModule?.setAutoModeActive(true) }
return result}
export function parseToolListFromCLI(tools: string[]): string[] { if (tools.length === 0) { return [] }
const result: string[] = []
// Process each string in the array for (const toolString of tools) { if (!toolString) continue
let current = '' let isInParens = false
// Parse each character in the string for (const char of toolString) { switch (char) { case '(': isInParens = true current += char break case ')': isInParens = false current += char break case ',': if (isInParens) { current += char } else { // Comma separator - push current tool and start new one if (current.trim()) { result.push(current.trim()) } current = '' } break case ' ': if (isInParens) { current += char } else if (current.trim()) { // Space separator - push current tool and start new one result.push(current.trim()) current = '' } break default: current += char } }
// Push any remaining tool if (current.trim()) { result.push(current.trim()) } }
return result}
export async function initializeToolPermissionContext({ allowedToolsCli, disallowedToolsCli, baseToolsCli, permissionMode, allowDangerouslySkipPermissions, addDirs,}: { allowedToolsCli: string[] disallowedToolsCli: string[] baseToolsCli?: string[] permissionMode: PermissionMode allowDangerouslySkipPermissions: boolean addDirs: string[]}): Promise<{ toolPermissionContext: ToolPermissionContext warnings: string[] dangerousPermissions: DangerousPermissionInfo[] overlyBroadBashPermissions: DangerousPermissionInfo[]}> { // Parse comma-separated allowed and disallowed tools if provided // Normalize legacy tool names (e.g., 'Task' → 'Agent') so that in-memory // rule removal in stripDangerousPermissionsForAutoMode matches correctly. const parsedAllowedToolsCli = parseToolListFromCLI(allowedToolsCli).map( rule => permissionRuleValueToString(permissionRuleValueFromString(rule)), ) let parsedDisallowedToolsCli = parseToolListFromCLI(disallowedToolsCli)
// If base tools are specified, automatically deny all tools NOT in the base set // We need to check if base tools were explicitly provided (not just empty default) if (baseToolsCli && baseToolsCli.length > 0) { const baseToolsResult = parseBaseToolsFromCLI(baseToolsCli) // Normalize legacy tool names (e.g., 'Task' → 'Agent') so user-provided // base tool lists using old names still match canonical names. const baseToolsSet = new Set(baseToolsResult.map(normalizeLegacyToolName)) const allToolNames = getToolsForDefaultPreset() const toolsToDisallow = allToolNames.filter(tool => !baseToolsSet.has(tool)) parsedDisallowedToolsCli = [...parsedDisallowedToolsCli, ...toolsToDisallow] }
const warnings: string[] = [] const additionalWorkingDirectories = new Map< string, AdditionalWorkingDirectory >() // process.env.PWD may be a symlink, while getOriginalCwd() uses the real path const processPwd = process.env.PWD if ( processPwd && processPwd !== getOriginalCwd() && isSymlinkTo({ originalCwd: getOriginalCwd(), processPwd }) ) { additionalWorkingDirectories.set(processPwd, { path: processPwd, source: 'session', }) }
// Check if bypassPermissions mode is available (not disabled by Statsig gate or settings) // Use cached values to avoid blocking on startup const growthBookDisableBypassPermissionsMode = checkStatsigFeatureGate_CACHED_MAY_BE_STALE( 'tengu_disable_bypass_permissions_mode', ) const settings = getSettings_DEPRECATED() || {} const settingsDisableBypassPermissionsMode = settings.permissions?.disableBypassPermissionsMode === 'disable' const isBypassPermissionsModeAvailable = (permissionMode === 'bypassPermissions' || allowDangerouslySkipPermissions) && !growthBookDisableBypassPermissionsMode && !settingsDisableBypassPermissionsMode
// Load all permission rules from disk const rulesFromDisk = loadAllPermissionRulesFromDisk()
// Ant-only: Detect overly broad shell allow rules for all modes. // Bash(*) or PowerShell(*) are equivalent to YOLO mode for that shell. // Skip in CCR/BYOC where --allowed-tools is the intended pre-approval mechanism. // Variable name kept for return-field compat; contains both shells. let overlyBroadBashPermissions: DangerousPermissionInfo[] = [] if ( process.env.USER_TYPE === 'ant' && !isEnvTruthy(process.env.CLAUDE_CODE_REMOTE) && process.env.CLAUDE_CODE_ENTRYPOINT !== 'local-agent' ) { overlyBroadBashPermissions = [ ...findOverlyBroadBashPermissions(rulesFromDisk, parsedAllowedToolsCli), ...findOverlyBroadPowerShellPermissions( rulesFromDisk, parsedAllowedToolsCli, ), ] }
// Ant-only: Detect dangerous shell permissions for auto mode // Dangerous permissions (like Bash(*), Bash(python:*), PowerShell(iex:*)) would auto-allow // before the classifier can evaluate them, defeating the purpose of safer YOLO mode let dangerousPermissions: DangerousPermissionInfo[] = [] if (feature('TRANSCRIPT_CLASSIFIER') && permissionMode === 'auto') { dangerousPermissions = findDangerousClassifierPermissions( rulesFromDisk, parsedAllowedToolsCli, ) }
let toolPermissionContext = applyPermissionRulesToPermissionContext( { mode: permissionMode, additionalWorkingDirectories, alwaysAllowRules: { cliArg: parsedAllowedToolsCli }, alwaysDenyRules: { cliArg: parsedDisallowedToolsCli }, alwaysAskRules: {}, isBypassPermissionsModeAvailable, ...(feature('TRANSCRIPT_CLASSIFIER') ? { isAutoModeAvailable: isAutoModeGateEnabled() } : {}), }, rulesFromDisk, )
// Add directories from settings and --add-dir const allAdditionalDirectories = [ ...(settings.permissions?.additionalDirectories || []), ...addDirs, ] // Parallelize fs validation; apply updates serially (cumulative context). // validateDirectoryForWorkspace only reads permissionContext to check if the // dir is already covered — behavioral difference from parallelizing is benign // (two overlapping --add-dirs both succeed instead of one being flagged // alreadyInWorkingDirectory, which was silently skipped anyway). const validationResults = await Promise.all( allAdditionalDirectories.map(dir => validateDirectoryForWorkspace(dir, toolPermissionContext), ), ) for (const result of validationResults) { if (result.resultType === 'success') { toolPermissionContext = applyPermissionUpdate(toolPermissionContext, { type: 'addDirectories', directories: [result.absolutePath], destination: 'cliArg', }) } else if ( result.resultType !== 'alreadyInWorkingDirectory' && result.resultType !== 'pathNotFound' ) { // Warn for actual config mistakes (e.g. specifying a file instead of a // directory). But if the directory doesn't exist anymore (e.g. someone // was working under /tmp and it got cleared), silently skip. They'll get // prompted again if they try to access it later. warnings.push(addDirHelpMessage(result)) } }
return { toolPermissionContext, warnings, dangerousPermissions, overlyBroadBashPermissions, }}
export type AutoModeGateCheckResult = { // Transform function (not a pre-computed context) so callers can apply it // inside setAppState(prev => ...) against the CURRENT context. Pre-computing // the context here captured a stale snapshot: the async GrowthBook await // below can be outrun by a mid-turn shift-tab, and returning // { ...currentContext, ... } would overwrite the user's mode change. updateContext: (ctx: ToolPermissionContext) => ToolPermissionContext notification?: string}
export type AutoModeUnavailableReason = 'settings' | 'circuit-breaker' | 'model'
export function getAutoModeUnavailableNotification( reason: AutoModeUnavailableReason,): string { let base: string switch (reason) { case 'settings': base = 'auto mode disabled by settings' break case 'circuit-breaker': base = 'auto mode is unavailable for your plan' break case 'model': base = 'auto mode unavailable for this model' break } return process.env.USER_TYPE === 'ant' ? `${base} · #claude-code-feedback` : base}
/** * Async check of auto mode availability. * * Returns a transform function (not a pre-computed context) that callers * apply inside setAppState(prev => ...) against the CURRENT context. This * prevents the async GrowthBook await from clobbering mid-turn mode changes * (e.g., user shift-tabs to acceptEdits while this check is in flight). * * The transform re-checks mode/prePlanMode against the fresh ctx to avoid * kicking the user out of a mode they've already left during the await. */export async function verifyAutoModeGateAccess( currentContext: ToolPermissionContext, // Runtime AppState.fastMode — passed from callers with AppState access so // the disableFastMode circuit breaker reads current state, not stale // settings.fastMode (which is intentionally sticky across /model auto- // downgrades). Optional for callers without AppState (e.g. SDK init paths). fastMode?: boolean,): Promise<AutoModeGateCheckResult> { // Auto-mode config — runs in ALL builds (circuit breaker, carousel, kick-out) // Fresh read of tengu_auto_mode_config.enabled — this async check runs once // after GrowthBook initialization and is the authoritative source for // isAutoModeAvailable. The sync startup path uses stale cache; this // corrects it. Circuit breaker (enabled==='disabled') takes effect here. const autoModeConfig = await getDynamicConfig_BLOCKS_ON_INIT<{ enabled?: AutoModeEnabledState disableFastMode?: boolean }>('tengu_auto_mode_config', {}) const enabledState = parseAutoModeEnabledState(autoModeConfig?.enabled) const disabledBySettings = isAutoModeDisabledBySettings() // Treat settings-disable the same as GrowthBook 'disabled' for circuit-breaker // semantics — blocks SDK/explicit re-entry via isAutoModeGateEnabled(). autoModeStateModule?.setAutoModeCircuitBroken( enabledState === 'disabled' || disabledBySettings, )
// Carousel availability: not circuit-broken, not disabled-by-settings, // model supports it, disableFastMode breaker not firing, and (enabled or opted-in) const mainModel = getMainLoopModel() // Temp circuit breaker: tengu_auto_mode_config.disableFastMode blocks auto // mode when fast mode is on. Checks runtime AppState.fastMode (if provided) // and, for ants, model name '-fast' substring (ant-internal fast models // like capybara-v2-fast[1m] encode speed in the model ID itself). // Remove once auto+fast mode interaction is validated. const disableFastModeBreakerFires = !!autoModeConfig?.disableFastMode && (!!fastMode || (process.env.USER_TYPE === 'ant' && mainModel.toLowerCase().includes('-fast'))) const modelSupported = modelSupportsAutoMode(mainModel) && !disableFastModeBreakerFires let carouselAvailable = false if (enabledState !== 'disabled' && !disabledBySettings && modelSupported) { carouselAvailable = enabledState === 'enabled' || hasAutoModeOptInAnySource() } // canEnterAuto gates explicit entry (--permission-mode auto, defaultMode: auto) // — explicit entry IS an opt-in, so we only block on circuit breaker + settings + model const canEnterAuto = enabledState !== 'disabled' && !disabledBySettings && modelSupported logForDebugging( `[auto-mode] verifyAutoModeGateAccess: enabledState=${enabledState} disabledBySettings=${disabledBySettings} model=${mainModel} modelSupported=${modelSupported} disableFastModeBreakerFires=${disableFastModeBreakerFires} carouselAvailable=${carouselAvailable} canEnterAuto=${canEnterAuto}`, )
// Capture CLI-flag intent now (doesn't depend on context). const autoModeFlagCli = autoModeStateModule?.getAutoModeFlagCli() ?? false
// Return a transform function that re-evaluates context-dependent conditions // against the CURRENT context at setAppState time. The async GrowthBook // results above (canEnterAuto, carouselAvailable, enabledState, reason) are // closure-captured — those don't depend on context. But mode, prePlanMode, // and isAutoModeAvailable checks MUST use the fresh ctx or a mid-await // shift-tab gets reverted (or worse, the user stays in auto despite the // circuit breaker if they entered auto DURING the await — which is possible // because setAutoModeCircuitBroken above runs AFTER the await). const setAvailable = ( ctx: ToolPermissionContext, available: boolean, ): ToolPermissionContext => { if (ctx.isAutoModeAvailable !== available) { logForDebugging( `[auto-mode] verifyAutoModeGateAccess setAvailable: ${ctx.isAutoModeAvailable} -> ${available}`, ) } return ctx.isAutoModeAvailable === available ? ctx : { ...ctx, isAutoModeAvailable: available } }
if (canEnterAuto) { return { updateContext: ctx => setAvailable(ctx, carouselAvailable) } }
// Gate is off or circuit-broken — determine reason (context-independent). let reason: AutoModeUnavailableReason if (disabledBySettings) { reason = 'settings' logForDebugging('auto mode disabled: disableAutoMode in settings', { level: 'warn', }) } else if (enabledState === 'disabled') { reason = 'circuit-breaker' logForDebugging( 'auto mode disabled: tengu_auto_mode_config.enabled === "disabled" (circuit breaker)', { level: 'warn' }, ) } else { reason = 'model' logForDebugging( `auto mode disabled: model ${getMainLoopModel()} does not support auto mode`, { level: 'warn' }, ) } const notification = getAutoModeUnavailableNotification(reason)
// Unified kick-out transform. Re-checks the FRESH ctx and only fires // side effects (setAutoModeActive(false), setNeedsAutoModeExitAttachment) // when the kick-out actually applies. This keeps autoModeActive in sync // with toolPermissionContext.mode even if the user changed modes during // the await: if they already left auto on their own, handleCycleMode // already deactivated the classifier and we don't fire again; if they // ENTERED auto during the await (possible before setAutoModeCircuitBroken // landed), we kick them out here. const kickOutOfAutoIfNeeded = ( ctx: ToolPermissionContext, ): ToolPermissionContext => { const inAuto = ctx.mode === 'auto' logForDebugging( `[auto-mode] kickOutOfAutoIfNeeded applying: ctx.mode=${ctx.mode} ctx.prePlanMode=${ctx.prePlanMode} reason=${reason}`, ) // Plan mode with auto active: either from prePlanMode='auto' (entered // from auto) or from opt-in (strippedDangerousRules present). const inPlanWithAutoActive = ctx.mode === 'plan' && (ctx.prePlanMode === 'auto' || !!ctx.strippedDangerousRules) if (!inAuto && !inPlanWithAutoActive) { return setAvailable(ctx, false) } if (inAuto) { autoModeStateModule?.setAutoModeActive(false) setNeedsAutoModeExitAttachment(true) return { ...applyPermissionUpdate(restoreDangerousPermissions(ctx), { type: 'setMode', mode: 'default', destination: 'session', }), isAutoModeAvailable: false, } } // Plan with auto active: deactivate auto, restore permissions, defuse // prePlanMode so ExitPlanMode goes to default. autoModeStateModule?.setAutoModeActive(false) setNeedsAutoModeExitAttachment(true) return { ...restoreDangerousPermissions(ctx), prePlanMode: ctx.prePlanMode === 'auto' ? 'default' : ctx.prePlanMode, isAutoModeAvailable: false, } }
// Notification decisions use the stale context — that's OK: we're deciding // WHETHER to notify based on what the user WAS doing when this check started. // (Side effects and mode mutation are decided inside the transform above, // against the fresh ctx.) const wasInAuto = currentContext.mode === 'auto' // Auto was used during plan: entered from auto or opt-in auto active const autoActiveDuringPlan = currentContext.mode === 'plan' && (currentContext.prePlanMode === 'auto' || !!currentContext.strippedDangerousRules) const wantedAuto = wasInAuto || autoActiveDuringPlan || autoModeFlagCli
if (!wantedAuto) { // User didn't want auto at call time — no notification. But still apply // the full kick-out transform: if they shift-tabbed INTO auto during the // await (before setAutoModeCircuitBroken landed), we need to evict them. return { updateContext: kickOutOfAutoIfNeeded } }
if (wasInAuto || autoActiveDuringPlan) { // User was in auto or had auto active during plan — kick out + notify. return { updateContext: kickOutOfAutoIfNeeded, notification } }
// autoModeFlagCli only: defaultMode was auto but sync check rejected it. // Suppress notification if isAutoModeAvailable is already false (already // notified on a prior check; prevents repeat notifications on successive // unsupported-model switches). return { updateContext: kickOutOfAutoIfNeeded, notification: currentContext.isAutoModeAvailable ? notification : undefined, }}
/** * Core logic to check if bypassPermissions should be disabled based on Statsig gate */export function shouldDisableBypassPermissions(): Promise<boolean> { return checkSecurityRestrictionGate('tengu_disable_bypass_permissions_mode')}
function isAutoModeDisabledBySettings(): boolean { const settings = getSettings_DEPRECATED() || {} return ( (settings as { disableAutoMode?: 'disable' }).disableAutoMode === 'disable' || (settings.permissions as { disableAutoMode?: 'disable' } | undefined) ?.disableAutoMode === 'disable' )}
/** * Checks if auto mode can be entered: circuit breaker is not active and settings * have not disabled it. Synchronous. */export function isAutoModeGateEnabled(): boolean { if (autoModeStateModule?.isAutoModeCircuitBroken() ?? false) return false if (isAutoModeDisabledBySettings()) return false if (!modelSupportsAutoMode(getMainLoopModel())) return false return true}
/** * Returns the reason auto mode is currently unavailable, or null if available. * Synchronous — uses state populated by verifyAutoModeGateAccess. */export function getAutoModeUnavailableReason(): AutoModeUnavailableReason | null { if (isAutoModeDisabledBySettings()) return 'settings' if (autoModeStateModule?.isAutoModeCircuitBroken() ?? false) { return 'circuit-breaker' } if (!modelSupportsAutoMode(getMainLoopModel())) return 'model' return null}
/** * The `enabled` field in the tengu_auto_mode_config GrowthBook JSON config. * Controls auto mode availability in UI surfaces (CLI, IDE, Desktop). * - 'enabled': auto mode is available in the shift-tab carousel (or equivalent) * - 'disabled': auto mode is fully unavailable — circuit breaker for incident response * - 'opt-in': auto mode is available only if the user has explicitly opted in * (via --enable-auto-mode in CLI, or a settings toggle in IDE/Desktop) */export type AutoModeEnabledState = 'enabled' | 'disabled' | 'opt-in'
const AUTO_MODE_ENABLED_DEFAULT: AutoModeEnabledState = 'disabled'
function parseAutoModeEnabledState(value: unknown): AutoModeEnabledState { if (value === 'enabled' || value === 'disabled' || value === 'opt-in') { return value } return AUTO_MODE_ENABLED_DEFAULT}
/** * Reads the `enabled` field from tengu_auto_mode_config (cached, may be stale). * Defaults to 'disabled' if GrowthBook is unavailable or the field is unset. * Other surfaces (IDE, Desktop) should call this to decide whether to surface * auto mode in their mode pickers. */export function getAutoModeEnabledState(): AutoModeEnabledState { const config = getFeatureValue_CACHED_MAY_BE_STALE<{ enabled?: AutoModeEnabledState }>('tengu_auto_mode_config', {}) return parseAutoModeEnabledState(config?.enabled)}
const NO_CACHED_AUTO_MODE_CONFIG = Symbol('no-cached-auto-mode-config')
/** * Like getAutoModeEnabledState but returns undefined when no cached value * exists (cold start, before GrowthBook init). Used by the sync * circuit-breaker check in initialPermissionModeFromCLI, which must not * conflate "not yet fetched" with "fetched and disabled" — the former * defers to verifyAutoModeGateAccess, the latter blocks immediately. */export function getAutoModeEnabledStateIfCached(): | AutoModeEnabledState | undefined { const config = getFeatureValue_CACHED_MAY_BE_STALE< { enabled?: AutoModeEnabledState } | typeof NO_CACHED_AUTO_MODE_CONFIG >('tengu_auto_mode_config', NO_CACHED_AUTO_MODE_CONFIG) if (config === NO_CACHED_AUTO_MODE_CONFIG) return undefined return parseAutoModeEnabledState(config?.enabled)}
/** * Returns true if the user has opted in to auto mode via any trusted mechanism: * - CLI flag (--enable-auto-mode / --permission-mode auto) — session-scoped * availability request; the startup dialog in showSetupScreens enforces * persistent consent before the REPL renders. * - skipAutoPermissionPrompt setting (persistent; set by accepting the opt-in * dialog or by IDE/Desktop settings toggle) */export function hasAutoModeOptInAnySource(): boolean { if (autoModeStateModule?.getAutoModeFlagCli() ?? false) return true return hasAutoModeOptIn()}
/** * Checks if bypassPermissions mode is currently disabled by Statsig gate or settings. * This is a synchronous version that uses cached Statsig values. */export function isBypassPermissionsModeDisabled(): boolean { const growthBookDisableBypassPermissionsMode = checkStatsigFeatureGate_CACHED_MAY_BE_STALE( 'tengu_disable_bypass_permissions_mode', ) const settings = getSettings_DEPRECATED() || {} const settingsDisableBypassPermissionsMode = settings.permissions?.disableBypassPermissionsMode === 'disable'
return ( growthBookDisableBypassPermissionsMode || settingsDisableBypassPermissionsMode )}
/** * Creates an updated context with bypassPermissions disabled */export function createDisabledBypassPermissionsContext( currentContext: ToolPermissionContext,): ToolPermissionContext { let updatedContext = currentContext if (currentContext.mode === 'bypassPermissions') { updatedContext = applyPermissionUpdate(currentContext, { type: 'setMode', mode: 'default', destination: 'session', }) }
return { ...updatedContext, isBypassPermissionsModeAvailable: false, }}
/** * Asynchronously checks if the bypassPermissions mode should be disabled based on Statsig gate * and returns an updated toolPermissionContext if needed */export async function checkAndDisableBypassPermissions( currentContext: ToolPermissionContext,): Promise<void> { // Only proceed if bypassPermissions mode is available if (!currentContext.isBypassPermissionsModeAvailable) { return }
const shouldDisable = await shouldDisableBypassPermissions() if (!shouldDisable) { return }
// Gate is enabled, need to disable bypassPermissions mode logForDebugging( 'bypassPermissions mode is being disabled by Statsig gate (async check)', { level: 'warn' }, )
void gracefulShutdown(1, 'bypass_permissions_disabled')}
export function isDefaultPermissionModeAuto(): boolean { if (feature('TRANSCRIPT_CLASSIFIER')) { const settings = getSettings_DEPRECATED() || {} return settings.permissions?.defaultMode === 'auto' } return false}
/** * Whether plan mode should use auto mode semantics (classifier runs during * plan). True when the user has opted in to auto mode and the gate is enabled. * Evaluated at permission-check time so it's reactive to config changes. */export function shouldPlanUseAutoMode(): boolean { if (feature('TRANSCRIPT_CLASSIFIER')) { return ( hasAutoModeOptIn() && isAutoModeGateEnabled() && getUseAutoModeDuringPlan() ) } return false}
/** * Centralized plan-mode entry. Stashes the current mode as prePlanMode so * ExitPlanMode can restore it. When the user has opted in to auto mode, * auto semantics stay active during plan mode. */export function prepareContextForPlanMode( context: ToolPermissionContext,): ToolPermissionContext { const currentMode = context.mode if (currentMode === 'plan') return context if (feature('TRANSCRIPT_CLASSIFIER')) { const planAutoMode = shouldPlanUseAutoMode() if (currentMode === 'auto') { if (planAutoMode) { return { ...context, prePlanMode: 'auto' } } autoModeStateModule?.setAutoModeActive(false) setNeedsAutoModeExitAttachment(true) return { ...restoreDangerousPermissions(context), prePlanMode: 'auto', } } if (planAutoMode && currentMode !== 'bypassPermissions') { autoModeStateModule?.setAutoModeActive(true) return { ...stripDangerousPermissionsForAutoMode(context), prePlanMode: currentMode, } } } logForDebugging( `[prepareContextForPlanMode] plain plan entry, prePlanMode=${currentMode}`, { level: 'info' }, ) return { ...context, prePlanMode: currentMode }}
/** * Reconciles auto-mode state during plan mode after a settings change. * Compares desired state (shouldPlanUseAutoMode) against actual state * (isAutoModeActive) and activates/deactivates auto accordingly. No-op when * not in plan mode. Called from applySettingsChange so that toggling * useAutoModeDuringPlan mid-plan takes effect immediately. */export function transitionPlanAutoMode( context: ToolPermissionContext,): ToolPermissionContext { if (!feature('TRANSCRIPT_CLASSIFIER')) return context if (context.mode !== 'plan') return context // Mirror prepareContextForPlanMode's entry-time exclusion — never activate // auto mid-plan when the user entered from a dangerous mode. if (context.prePlanMode === 'bypassPermissions') { return context }
const want = shouldPlanUseAutoMode() const have = autoModeStateModule?.isAutoModeActive() ?? false
if (want && have) { // syncPermissionRulesFromDisk (called before us in applySettingsChange) // re-adds dangerous rules from disk without touching strippedDangerousRules. // Re-strip so the classifier isn't bypassed by prefix-rule allow matches. return stripDangerousPermissionsForAutoMode(context) } if (!want && !have) return context
if (want) { autoModeStateModule?.setAutoModeActive(true) setNeedsAutoModeExitAttachment(false) return stripDangerousPermissionsForAutoMode(context) } autoModeStateModule?.setAutoModeActive(false) setNeedsAutoModeExitAttachment(true) return restoreDangerousPermissions(context)}