components C1: multi-option permission flow wired to the rule engine - #292
Merged
Conversation
Replace the binary Allow/Deny permission surface with the TS PermissionPrompt option set — allow once / allow always (persisted rule) / deny / deny with feedback — and un-sever the engine: - PermissionAskRequest/Reply protocol replaces the legacy 3-arg handler on all four producers (TUI bridge, REPL console menu, headless auto-deny, subagent share); real tool_input now reaches the modal so per-tool previews render - registry applies chosen updates to the live context and persists via the new settings_paths resolver; setup_permissions is wired into all three entrypoints so persisted rules load at startup - bash "don't ask again" suggestions ported from TS heuristics (2-word prefix, heredoc, safe env vars; no LLM extractor) - engine fixes: multi-word prefix rules now match (TS bashPermissions.ts:879-882 semantics); new quote-aware chaining guard stops prefix/wildcard rules from auto-allowing compound commands (documented divergence — Python matches whole strings) Suite at the verified main-0fa986f baseline (12 pre-existing failures); +31 new tests incl. the persist→reload→auto-allow restart round-trip. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Typing y/n/a/d into the focused feedback Input must reach the Input, not the screen bindings — pilot-verified, now regression-locked. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- no-wildcard rules now match exact-or-word-boundary, closing the last-token elongation hole the new exact suggestions activated - multiline/compound derivation can no longer mint dead rules (chained first line -> 2-word prefix or nothing) or bare-shell prefixes; heredoc at index 0 yields nothing - chaining scanner: lone & detected as a separator (redirections >&, <&, &> skipped); ANSI-C quoting documented as a non-goal - env-assign regex pinned to ASCII (JS \w parity); import hoisted out of the matcher hot path; __all__ completed; +13 tests locking the above incl. the accepted basename-normalization trade-off Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
- Read "don't ask again" suggestions removed: the engine consults
content rules only for Bash, so the persisted Read(<dir>/**) rule
could never match — re-asking right after promising not to is
worse than no option (path-rule matcher = parked follow-up)
- project/local permission settings move to .clawcodex/ — the
.claude/settings{,.local}.json names are owned by the real Claude
Code harness; sharing them would read AND mutate the harness's
live rules (this worktree's own .claude/settings.local.json
proved the collision)
- registry apply/persist failures now logged (incl. per-update
persist result); subagent rebind divergence documented at the
rebind site; _with_default_suggestions returns a replace() copy
instead of mutating tool-owned decisions
- protocol surfaces properly typed (TYPE_CHECKING imports); dead
_preview_tool_input removed; stale doc-gate comment corrected;
chosen_updates None-safe; defaultMode write-only asymmetry noted
- tests: REPL menu mapping (always/feedback rows, enable-row
numbering shift, no-cache-on-always, rebind-target identity),
headless PRODUCTION setup block loads persisted rules, autouse
user-settings isolation fixture (hermeticity)
Suite re-verified at the main-0fa986f baseline (12, identical set).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
singlaamitesh
pushed a commit
to singlaamitesh/clawcodex
that referenced
this pull request
Jul 7, 2026
…-permission-options components C1: multi-option permission flow wired to the rule engine
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
src/permissions/engine end-to-end:PermissionAskRequest/Replyprotocol replaces the legacy 3-arg handler on all four producers (TUI bridge, REPL, headless auto-deny, subagent share); realtool_inputnow reaches the modal so per-tool previews render.clawcodex/settings resolver;setup_permissionswired into all three entrypoints so persisted rules load at startup (restart round-trip tested).clawcodex/(.claude/settings*.jsonis the real harness's file — cross-tool collision), word-boundary matching for exact rules, lone-&detection, persist-failure logging, typed protocol, hermetic test fixtureTest plan
🤖 Generated with Claude Code