{"version":3,"file":"schema.mjs","names":[],"sources":["../src/schema.ts"],"sourcesContent":["/**\n * Agent Permission Policy — Zod schema (source of truth).\n *\n * This file defines `.agents/permissions.json` and `.agents/permissions.local.json`. The compiled\n * JSON Schema (`agent-permissions.schema.json`) is generated via `z.toJSONSchema()` and submitted\n * to SchemaStore for IDE autocomplete/validation.\n *\n * Compile: pnpm build:schema\n */\n\nimport * as z from \"zod\";\nimport { PredicateNodeSchema } from \"trilean/tree\";\n\nimport { unsupportedPredicateKinds } from \"./predicate.ts\";\nimport { profileProblems } from \"./profiles.ts\";\n\n// ---------------------------------------------------------------------------\n// Permission modes\n// ---------------------------------------------------------------------------\n\n/**\n * Default permission mode when starting an agent session.\n *\n * Agent Permission Policy modes:\n *\n * - `standard`: Prompt for unsafe operations (default)\n * - `autonomous`: Auto-approve unless deny/ask rules match\n * - `restricted`: Prompt for all operations\n * - `readonly`: Only allow read-only tools\n *\n * Claude Code compatible modes (accepted for zero-translation migration):\n *\n * - `plan`: Plan-only mode (maps to `restricted`)\n * - `dontAsk`: Auto-approve (maps to `autonomous`)\n * - `acceptEdits`: Accept edits without prompt (maps to `standard`)\n * - `bypassPermissions`: Bypass all permission checks (maps to `autonomous`)\n * - `default`: Agent default behaviour (maps to `standard`)\n *\n * **Security note**: `autonomous`, `bypassPermissions`, and `dontAsk` are only trusted from\n * personal (`permissions.local.json`) or managed (enterprise) sources — NOT from committed\n * `permissions.json`.\n */\nexport const PermissionMode = z\n  .enum([\n    // APP modes\n    \"standard\",\n    \"autonomous\",\n    \"restricted\",\n    \"readonly\",\n    // Claude Code compatible modes\n    \"plan\",\n    \"dontAsk\",\n    \"acceptEdits\",\n    \"bypassPermissions\",\n    \"default\",\n    \"auto\",\n  ])\n  .meta({\n    description:\n      \"Default permission mode. Agent Permission Policy modes: standard, autonomous, restricted, readonly. \" +\n      \"Claude Code compatible modes: plan, dontAsk, acceptEdits, bypassPermissions, default.\",\n    default: \"standard\",\n  });\n\n// ---------------------------------------------------------------------------\n// Permission rule pattern\n// ---------------------------------------------------------------------------\n\n/**\n * A permission rule string.\n *\n * Syntax (compatible with Claude Code's permission rule format):\n *\n * | Pattern                        | Matches                             |\n * | ------------------------------ | ----------------------------------- |\n * | `Tool`                         | All invocations of the tool         |\n * | `Tool(exact command)`          | Exactly that command                |\n * | `Tool(prefix:*)`               | Commands starting with `prefix `    |\n * | `Tool(*suffix)`                | Commands ending with ` suffix`      |\n * | `Tool(pattern * middle *)`     | Commands containing both substrings |\n * | `Read(./path)`                 | File reads at that relative path    |\n * | `Read(./path/**)`              | File reads under that path (glob)   |\n * | `WebFetch(domain:example.com)` | Fetches to that domain              |\n * | `mcp__server`                  | All tools from an MCP server        |\n * | `mcp__server__tool`            | A specific MCP tool                 |\n */\nexport const PermissionRule = z.string();\n\n// ---------------------------------------------------------------------------\n// Permission tier lists\n// ---------------------------------------------------------------------------\n\nexport const PermissionTiers = z\n  .object({\n    /**\n     * Tools auto-approved without prompting. Evaluated after deny rules — if a deny matches, allow\n     * is never checked.\n     */\n    allow: z.array(PermissionRule).meta({\n      description:\n        \"Tools auto-approved without prompting. Evaluated after deny rules.\",\n      examples: [\"Bash(git status)\", \"Bash(npm run test:*)\", \"Read\", \"Grep\"],\n    }),\n\n    /**\n     * Tools always denied — short-circuits before allow and ask. Deny rules from ALL sources are\n     * merged and checked first. A deny cannot be overridden by an allow in any other source.\n     */\n    deny: z.array(PermissionRule).meta({\n      description:\n        \"Tools always denied — short-circuits before allow and ask. A deny cannot be overridden by an allow in any other source.\",\n      examples: [\"Bash(sudo:*)\", \"Bash(rm -rf /)\", \"Read(./.env)\"],\n    }),\n\n    /** Tools that always prompt, even in autonomous mode. Evaluated after deny but before allow. */\n    ask: z.array(PermissionRule).meta({\n      description:\n        \"Tools that always prompt, even in autonomous mode. Evaluated after deny but before allow.\",\n      examples: [\"Bash(git push:*)\", \"Bash(npm publish:*)\"],\n    }),\n\n    /**\n     * Directories beyond project root that agents may access. Paths are relative to project root or\n     * absolute.\n     */\n    additionalDirectories: z.array(z.string()).meta({\n      description: \"Directories beyond project root that agents may access.\",\n      examples: [\"../shared-libs/\", \"/tmp/build-cache\"],\n    }),\n\n    /**\n     * Default permission mode. Also accepted at the top level. Included here for Claude Code\n     * compatibility — Claude Code places defaultMode inside the permissions object.\n     */\n    defaultMode: PermissionMode.meta({\n      description:\n        \"Default permission mode. Accepted here for Claude Code compatibility, \" +\n        \"or at the top level for the canonical placement.\",\n    }),\n  })\n  .partial()\n  .strict();\n\n// ---------------------------------------------------------------------------\n// Conditional rules\n// ---------------------------------------------------------------------------\n\n/**\n * A trilean predicate tree plus the check that it holds no node reading an unknown field as absent or empty. Typed as `unknown` on both sides: trilean's recursive `PredicateNode` type is rebuilt structurally at every use, and the compiler cannot compare those copies across the types derived from a rule. The tree is parsed with trilean's own schema when the rule is compiled, which is also what catches a policy built in code without going through this schema.\n */\nconst RulePredicate: z.ZodType = PredicateNodeSchema.superRefine(\n  (tree, ctx) => {\n    const unsupported = unsupportedPredicateKinds(tree);\n    if (unsupported.length > 0) {\n      ctx.addIssue({\n        code: \"custom\",\n        message: `A predicate cannot contain ${[...new Set(unsupported)].join(\", \")} nodes: they would read a field the host did not report as absent or empty, and so could grant on unknown.`,\n      });\n    }\n  },\n);\n\nexport const RuleCondition = z\n  .object({\n    /** Working directory pattern (glob). */\n    cwd: z.string().meta({ description: \"Working directory pattern (glob).\" }),\n\n    /** Git branch name pattern (glob). */\n    branch: z.string().meta({ description: \"Git branch name pattern (glob).\" }),\n\n    /** Environment variables that must each equal the given value. */\n    env: z.record(z.string(), z.string()).meta({\n      description:\n        \"Environment variables that must each equal the given value (AND logic).\",\n    }),\n\n    /** Actor pattern (glob): who is making the call, as the host says. */\n    actor: z.string().meta({\n      description:\n        \"Actor pattern (glob): who is making the call, as the host reports it. Unknown when the host reports none.\",\n    }),\n\n    /** Role pattern (glob): true when the actor holds a matching role. */\n    role: z.string().meta({\n      description:\n        \"Role pattern (glob): holds when the actor has a matching role, as the host reports the roles. Unknown when the host reports none.\",\n    }),\n\n    /** Git remote pattern (glob), matched against the remote as `host/path`, lower case. */\n    remote: z.string().meta({\n      description:\n        \"Git remote pattern (glob), matched against the origin as host/path in lower case, so git@github.com:Org/Repo.git and https://github.com/org/repo both match github.com/org/*.\",\n    }),\n\n    /** A trilean predicate tree over the context, for conditions the fields above cannot say: an OR of remotes, or \"unless this variable has this value\". */\n    predicate: RulePredicate.meta({\n      description:\n        \"A trilean predicate tree over the context. Reference keys name context fields: cwd, branch, actor, remote, env:NAME and role:NAME. An unknown field makes the result unknown, which restricts and never grants. Nodes that would read an unknown field as absent or empty (exists, some, every, fold) are not allowed.\",\n    }),\n  })\n  .partial()\n  // A key the schema does not know must be an error: dropped, a misspelled condition would leave the rule applying everywhere.\n  .strict();\n\nexport const Rule = z\n  .object({\n    /** Canonical tool name (e.g. \"Bash\", \"Read\", \"Write\"). */\n    tool: z.string().meta({\n      description: \"Canonical tool name.\",\n      examples: [\n        \"Bash\",\n        \"Read\",\n        \"Write\",\n        \"Edit\",\n        \"Grep\",\n        \"WebFetch\",\n        \"Agent\",\n        \"mcp__github__create_issue\",\n      ],\n    }),\n\n    /**\n     * Pattern to match against tool input. Same syntax as permission rules. When absent, matches\n     * any input for the tool (bare tool rule).\n     */\n    pattern: z\n      .string()\n      .optional()\n      .meta({\n        description:\n          \"Pattern to match against tool input. When absent, matches any input.\",\n        examples: [\"npm run *\", \"./config/**\", \"git push --force:*\"],\n      }),\n\n    /** Permission tier to apply when this rule matches. */\n    tier: z.enum([\"allow\", \"deny\", \"ask\"]).meta({\n      description: \"Permission tier to apply when this rule matches.\",\n    }),\n\n    /**\n     * On an ask rule: who may resolve the request. Holding the permission does not make an actor an\n     * approver; only being named here does.\n     */\n    approvers: z\n      .object({\n        roles: z.array(z.string()).meta({\n          description: \"Roles whose holders may approve the request.\",\n        }),\n        actors: z.array(z.string()).meta({\n          description:\n            \"Actors who may approve the request. The requester is never one of them.\",\n        }),\n        timeoutSeconds: z.number().int().positive().meta({\n          description:\n            \"How long the request may stay unresolved. An unresolved request expires as a deny.\",\n        }),\n      })\n      .partial()\n      .strict()\n      .optional()\n      .meta({\n        description:\n          \"On an ask rule: the roles and actors who may approve the request, and how long it may wait. An unresolved request expires as a deny.\",\n      }),\n\n    /**\n     * A deny rule that also asks the host to leave the tool out of the agent's tool list. The call\n     * is refused exactly as a plain deny is.\n     */\n    hidden: z.literal(true).optional().meta({\n      description:\n        \"On a deny rule: also leave the tool out of the agent's tool list. The call is refused as a plain deny is. Only a rule with no pattern hides the whole tool.\",\n    }),\n\n    /** Optional conditions. All must match for the rule to apply (AND logic). */\n    when: RuleCondition.optional().meta({\n      description:\n        \"Optional conditions. All must match for the rule to apply (AND logic).\",\n    }),\n  })\n  // A key the schema does not know must be an error: dropped, a misspelled `when` would leave the rule applying everywhere.\n  .strict()\n  .refine((rule) => rule.hidden !== true || rule.tier === \"deny\", {\n    message: \"`hidden` is only valid on a deny rule\",\n    path: [\"hidden\"],\n  })\n  .refine((rule) => rule.approvers === undefined || rule.tier === \"ask\", {\n    message: \"`approvers` is only valid on an ask rule\",\n    path: [\"approvers\"],\n  })\n  .refine(\n    (rule) =>\n      rule.approvers === undefined ||\n      (rule.approvers.roles?.length ?? 0) +\n        (rule.approvers.actors?.length ?? 0) >\n        0,\n    {\n      message: \"`approvers` must name at least one role or actor\",\n      path: [\"approvers\"],\n    },\n  )\n  .meta({\n    description:\n      \"Permission rule. Evaluated deny-first: all deny rules, then ask, then allow.\",\n  });\n\n// ---------------------------------------------------------------------------\n// Delegation controls\n// ---------------------------------------------------------------------------\n\nexport const Delegation = z\n  .object({\n    /**\n     * Maximum depth of agent nesting. 0 = no subagents allowed.\n     *\n     * @default 2\n     */\n    maxDepth: z.number().int().min(0).meta({\n      description: \"Maximum depth of agent nesting. 0 = no subagents allowed.\",\n      default: 2,\n    }),\n\n    /** Tools that cannot be delegated to subagents. Uses the same permission rule syntax. */\n    nonDelegable: z.array(PermissionRule).meta({\n      description:\n        \"Tools that cannot be delegated to subagents. Uses the same rule syntax.\",\n      examples: [\"Bash(sudo:*)\", \"Write(./.agents/**)\"],\n    }),\n\n    /**\n     * Whether subagents can request elevated permissions from their parent.\n     *\n     * @default true\n     */\n    bubbleUp: z.boolean().meta({\n      description:\n        \"Whether subagents can request elevated permissions from their parent.\",\n      default: true,\n    }),\n\n    /**\n     * Per-agent permission overrides. Keys are agent names or glob patterns matching agent\n     * identifiers. Values are inline permission tiers that replace (not merge with) the parent\n     * policy for that agent.\n     *\n     * Maps to OpenCode's per-agent markdown frontmatter and Codex's `apps.<name>.tools` config.\n     */\n    agents: z.record(z.string(), PermissionTiers).meta({\n      description:\n        \"Per-agent permission overrides. Keys are agent names or glob patterns. \" +\n        \"Values replace (not merge with) the parent policy for that agent.\",\n      examples: [\n        {\n          review: { deny: [\"Write\", \"Edit\", \"Bash\"], allow: [\"Read\", \"Grep\"] },\n          docs: { allow: [\"Read\", \"Write(./docs/**)\", \"Bash(mdbook build:*)\"] },\n        },\n      ],\n    }),\n  })\n  .partial();\n\n// ---------------------------------------------------------------------------\n// Top-level schema\n// ---------------------------------------------------------------------------\n\n// ---------------------------------------------------------------------------\n// Sandbox configuration\n// ---------------------------------------------------------------------------\n\n/**\n * Sandbox mode — OS-level isolation for agent tool execution.\n *\n * When set, the agent harness should enforce filesystem and network boundaries at the OS level\n * (sandbox, container, namespace, etc). This is orthogonal to permission rules — rules control what\n * the agent _asks_ to do; sandbox controls what the OS _allows_ it to do.\n *\n * Maps to Codex's `sandbox_mode` field.\n */\nexport const SandboxMode = z\n  .enum([\"readonly\", \"workspace-write\", \"full-access\"])\n  .meta({\n    description:\n      \"OS-level sandbox isolation mode. \" +\n      \"readonly: filesystem is read-only. \" +\n      \"workspace-write: writes confined to project directory + writableRoots. \" +\n      \"full-access: no OS-level restrictions.\",\n    default: \"workspace-write\",\n  });\n\nexport const Sandbox = z\n  .object({\n    /** Sandbox isolation mode. */\n    mode: SandboxMode.meta({\n      description: \"Sandbox isolation mode.\",\n    }),\n\n    /**\n     * Additional paths the agent may write to (beyond project root). Only meaningful when mode is\n     * `workspace-write`.\n     */\n    writableRoots: z.array(z.string()).meta({\n      description:\n        \"Additional paths the agent may write to (beyond project root). \" +\n        \"Only meaningful when mode is `workspace-write`.\",\n      examples: [\"/tmp/build-cache\", \"../shared-libs\"],\n    }),\n\n    /**\n     * Whether the agent may make network requests from within the sandbox. When false, network\n     * access is blocked at the OS level. Maps to Codex's `sandbox_workspace_write.network_access`.\n     */\n    networkAccess: z.boolean().meta({\n      description:\n        \"Whether the agent may make network requests from within the sandbox. \" +\n        \"When false, network access is blocked at the OS level.\",\n      default: true,\n    }),\n  })\n  .partial()\n  .strict()\n  .meta({\n    description:\n      \"OS-level sandbox configuration. Controls filesystem and network \" +\n      \"isolation for agent tool execution, enforced by the harness runtime.\",\n  });\n\n// ---------------------------------------------------------------------------\n// Named profiles\n// ---------------------------------------------------------------------------\n\n/**\n * Named permission profiles that can be selected at session start.\n *\n * Maps to Codex's `permissions.<name>` + `default_permissions` fields. Agents that don't support\n * named profiles should use the profile specified by `activeProfile` (or `\"default\"` if unset).\n */\n/** What a role may do: the permission tiers that apply to actors holding it. */\nexport const RoleTiers = PermissionTiers.pick({\n  allow: true,\n  deny: true,\n  ask: true,\n});\n\n/** A profile: permission tiers, optionally extending other profiles by name. */\nexport const ProfileTiers = PermissionTiers.extend({\n  /** Profiles this one builds on; their rules come first, then this profile's own. */\n  extends: z.array(z.string()).meta({\n    description:\n      \"Names of profiles this one extends. Their rules come first, then this profile's own; extending only adds.\",\n    examples: [[\"base\"]],\n  }),\n}).partial();\n\nexport const Profiles = z.record(z.string(), ProfileTiers).meta({\n  description:\n    \"Named permission profiles. Each profile is a complete set of permission tiers. \" +\n    \"Select one at session start via `activeProfile`.\",\n  examples: [\n    {\n      strict: { deny: [\"Write\", \"Edit\", \"Bash\"], allow: [\"Read\", \"Grep\"] },\n      relaxed: {\n        allow: [\"Read\", \"Write\", \"Edit\", \"Bash(git:*)\", \"Bash(npm:*)\"],\n      },\n    },\n  ],\n});\n\n// ---------------------------------------------------------------------------\n// Network controls\n// ---------------------------------------------------------------------------\n\nexport const Network = z\n  .object({\n    /**\n     * Whether network access is permitted at all. When false, WebFetch and WebSearch are denied\n     * regardless of allow rules.\n     */\n    enabled: z.boolean().meta({\n      description:\n        \"Whether network access is permitted at all. When false, \" +\n        \"WebFetch and WebSearch are denied regardless of allow rules.\",\n      default: true,\n    }),\n\n    /**\n     * Domain-level allow/deny rules for HTTP(S) requests. Maps to both Codex's `network.domains`\n     * and Claude Code's `WebFetch(domain:...)` rules.\n     */\n    domains: z.record(z.string(), z.enum([\"allow\", \"deny\"])).meta({\n      description:\n        \"Domain-level allow/deny rules for HTTP(S) requests. \" +\n        \"Supplements the WebFetch(domain:...) permission rules.\",\n      examples: [{ \"api.example.com\": \"allow\", \"evil.com\": \"deny\" }],\n    }),\n  })\n  .partial()\n  .strict()\n  .meta({\n    description: \"Network access controls.\",\n  });\n\n// ---------------------------------------------------------------------------\n// Top-level schema\n// ---------------------------------------------------------------------------\n\nexport const AgentPermissionPolicy = z\n  .object({\n    /** JSON Schema URI for editor validation and autocomplete. */\n    $schema: z.string().meta({\n      description: \"JSON Schema URI for editor validation and autocomplete.\",\n    }),\n\n    /** Default permission mode when starting a session. */\n    defaultMode: PermissionMode,\n\n    /**\n     * Marks this file's layer as a ceiling: what it allows bounds what layers loaded after it (deeper\n     * directories, local overrides) can allow. They can still add deny and ask rules.\n     */\n    ceiling: z.boolean().meta({\n      description:\n        \"Marks this layer as a ceiling: the allow rules of deeper layers only take effect where this layer also allows. Deeper layers can still add deny and ask rules, and cannot loosen the default mode.\",\n    }),\n\n    /** Name of the active profile from `profiles`. */\n    activeProfile: z.string().meta({\n      description:\n        \"Name of the active profile from `profiles`. If unset, use the \" +\n        \"top-level permission tiers directly.\",\n    }),\n\n    /** Tool permission rules — evaluated in deny → ask → allow order. */\n    permissions: PermissionTiers.meta({\n      description:\n        \"Tool permission rules — evaluated in deny → ask → allow order.\",\n    }),\n\n    /** Permission rules — unified deny-first evaluation. */\n    rules: z.array(Rule).meta({\n      description:\n        \"Permission rules. Evaluated deny-first: all deny rules checked, then ask, then allow. \" +\n        \"Falls back to defaultMode when no rule matches.\",\n    }),\n\n    /**\n     * Rules by role. Each rule applies to actors holding the role, as if it carried\n     * `when: { role }`. Who holds a role is not in the policy; the host says.\n     */\n    roles: z\n      .record(\n        z.string().regex(/^[A-Za-z0-9_.-]+$/, {\n          message:\n            \"a role name uses letters, digits, dots, dashes and underscores\",\n        }),\n        RoleTiers,\n      )\n      .meta({\n        description:\n          \"Permission tiers by role. Each rule applies to actors holding the role, as if it carried `when: { role }`.\",\n        examples: [\n          {\n            maintainer: { allow: [\"Bash(git push:*)\"] },\n            contractor: { deny: [\"Bash(git push:*)\"] },\n          },\n        ],\n      }),\n\n    /** Named permission profiles — selectable at session start. */\n    profiles: Profiles.meta({\n      description: \"Named permission profiles.\",\n    }),\n\n    /** Agent delegation controls — what subagents may do. */\n    delegation: Delegation.meta({\n      description: \"Agent delegation controls — what subagents may do.\",\n    }),\n\n    /** OS-level sandbox configuration. */\n    sandbox: Sandbox.meta({\n      description: \"OS-level sandbox configuration.\",\n    }),\n\n    /** Network access controls. */\n    network: Network.meta({\n      description: \"Network access controls.\",\n    }),\n\n    /** Environment variables injected into all agent sessions. */\n    env: z.record(z.string(), z.string()).meta({\n      description: \"Environment variables injected into all agent sessions.\",\n      examples: [{ NODE_ENV: \"development\", DISABLE_TELEMETRY: \"1\" }],\n    }),\n\n    /**\n     * Agent configs to include when loading. When set, only these agent configs are read (plus\n     * canonical). Mutually exclusive with `without`.\n     */\n    with: z\n      .array(z.enum([\"claude-code\", \"codex\", \"kiro\", \"opencode\", \"crush\"]))\n      .meta({\n        description:\n          \"Agent configs to include when loading. Only these native configs \" +\n          \"are read (plus canonical). Mutually exclusive with `without`.\",\n        examples: [[\"claude-code\", \"opencode\"]],\n      }),\n\n    /** Agent configs to exclude when loading. Mutually exclusive with `with`. */\n    without: z\n      .array(z.enum([\"claude-code\", \"codex\", \"kiro\", \"opencode\", \"crush\"]))\n      .meta({\n        description:\n          \"Agent configs to exclude when loading. Mutually exclusive with `with`.\",\n        examples: [[\"codex\"]],\n      }),\n\n    /**\n     * How far to walk up the directory tree when loading configs. `\"all\"` walks to the filesystem\n     * root. A number limits parent directories (0 = cwd only). Controls both canonical and native\n     * config discovery.\n     */\n    up: z.union([z.enum([\"all\"]), z.number().int().min(0)]).meta({\n      description:\n        \"How far to walk up the directory tree when loading configs. \" +\n        \"'all' walks to the filesystem root. A number limits parent directories (0 = cwd only).\",\n      default: \"all\",\n      examples: [\"all\", 0, 3, 5],\n    }),\n\n    /** Sync configuration for the MCP server and CLI sync command. */\n    sync: z\n      .object({\n        /**\n         * Sync mode.\n         *\n         * - `\"sync\"`: One-shot sync at startup, then exit.\n         * - `\"watch\"`: Continuous sync via filesystem watching.\n         * - `false`: No sync (MCP server is passive).\n         */\n        mode: z.union([z.enum([\"sync\", \"watch\"]), z.literal(false)]).meta({\n          description:\n            \"Sync mode. 'sync' = one-shot at startup. 'watch' = continuous via fs.watch. false = disabled.\",\n          default: false,\n        }),\n\n        /** Write .bak files before overwriting. */\n        backup: z.boolean().meta({\n          description: \"Write .bak files before overwriting.\",\n          default: false,\n        }),\n      })\n      .partial()\n      .meta({\n        description:\n          \"Sync configuration for the MCP server and CLI sync command.\",\n      }),\n  })\n  .partial()\n  .strict()\n  .check((ctx) => {\n    for (const problem of profileProblems(ctx.value.profiles)) {\n      ctx.issues.push({\n        code: \"custom\",\n        input: ctx.value,\n        message: problem.message,\n        path: [\"profiles\", problem.profile, \"extends\"],\n      });\n    }\n    if (ctx.value.with !== undefined && ctx.value.without !== undefined) {\n      ctx.issues.push({\n        code: \"custom\",\n        input: ctx.value,\n        message: \"'with' and 'without' are mutually exclusive.\",\n        path: [\"with\"],\n      });\n    }\n  })\n  .meta({\n    title: \"Agent Permission Policy\",\n    description:\n      \"Cross-agent permission policy for AI coding agents. Defines what tools agents may use, under what conditions, and how subagents are constrained. \" +\n      \"The `with`/`without`/`up` fields control which native agent configs are \" +\n      \"discovered and merged during walk-up loading. \" +\n      \"Placed at .agents/permissions.json (team, committed) or .agents/permissions.local.json (personal, gitignored).\",\n  });\n\n// ---------------------------------------------------------------------------\n// Inferred types\n// ---------------------------------------------------------------------------\n\nexport type AgentPermissionPolicy = z.infer<typeof AgentPermissionPolicy>;\nexport type PermissionTiers = z.infer<typeof PermissionTiers>;\nexport type Rule = z.infer<typeof Rule>;\nexport type RuleCondition = z.infer<typeof RuleCondition>;\nexport type Delegation = z.infer<typeof Delegation>;\nexport type PermissionMode = z.infer<typeof PermissionMode>;\nexport type SandboxMode = z.infer<typeof SandboxMode>;\nexport type Sandbox = z.infer<typeof Sandbox>;\nexport type Profiles = z.infer<typeof Profiles>;\nexport type Network = z.infer<typeof Network>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0CA,MAAa,iBAAiB,EAC3B,KAAK;CAEJ;CACA;CACA;CACA;CAEA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,CACD,KAAK;CACJ,aACE;CAEF,SAAS;AACX,CAAC;;;;;;;;;;;;;;;;;;;AAwBH,MAAa,iBAAiB,EAAE,OAAO;AAMvC,MAAa,kBAAkB,EAC5B,OAAO;;;;;CAKN,OAAO,EAAE,MAAM,cAAc,CAAC,CAAC,KAAK;EAClC,aACE;EACF,UAAU;GAAC;GAAoB;GAAwB;GAAQ;EAAM;CACvE,CAAC;;;;;CAMD,MAAM,EAAE,MAAM,cAAc,CAAC,CAAC,KAAK;EACjC,aACE;EACF,UAAU;GAAC;GAAgB;GAAkB;EAAc;CAC7D,CAAC;;CAGD,KAAK,EAAE,MAAM,cAAc,CAAC,CAAC,KAAK;EAChC,aACE;EACF,UAAU,CAAC,oBAAoB,qBAAqB;CACtD,CAAC;;;;;CAMD,uBAAuB,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK;EAC9C,aAAa;EACb,UAAU,CAAC,mBAAmB,kBAAkB;CAClD,CAAC;;;;;CAMD,aAAa,eAAe,KAAK,EAC/B,aACE,yHAEJ,CAAC;AACH,CAAC,CAAC,CACD,QAAQ,CAAC,CACT,OAAO;;;;AASV,MAAM,gBAA2B,oBAAoB,aAClD,MAAM,QAAQ;CACb,MAAM,cAAc,0BAA0B,IAAI;CAClD,IAAI,YAAY,SAAS,GACvB,IAAI,SAAS;EACX,MAAM;EACN,SAAS,8BAA8B,CAAC,GAAG,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE;CAC9E,CAAC;AAEL,CACF;AAEA,MAAa,gBAAgB,EAC1B,OAAO;;CAEN,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,EAAE,aAAa,oCAAoC,CAAC;;CAGzE,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,EAAE,aAAa,kCAAkC,CAAC;;CAG1E,KAAK,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,EACzC,aACE,0EACJ,CAAC;;CAGD,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,EACrB,aACE,4GACJ,CAAC;;CAGD,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,EACpB,aACE,oIACJ,CAAC;;CAGD,QAAQ,EAAE,OAAO,CAAC,CAAC,KAAK,EACtB,aACE,gLACJ,CAAC;;CAGD,WAAW,cAAc,KAAK,EAC5B,aACE,yTACJ,CAAC;AACH,CAAC,CAAC,CACD,QAAQ,CAAC,CAET,OAAO;AAEV,MAAa,OAAO,EACjB,OAAO;;CAEN,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK;EACpB,aAAa;EACb,UAAU;GACR;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACF;CACF,CAAC;;;;;CAMD,SAAS,EACN,OAAO,CAAC,CACR,SAAS,CAAC,CACV,KAAK;EACJ,aACE;EACF,UAAU;GAAC;GAAa;GAAe;EAAoB;CAC7D,CAAC;;CAGH,MAAM,EAAE,KAAK;EAAC;EAAS;EAAQ;CAAK,CAAC,CAAC,CAAC,KAAK,EAC1C,aAAa,mDACf,CAAC;;;;;CAMD,WAAW,EACR,OAAO;EACN,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,EAC9B,aAAa,+CACf,CAAC;EACD,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,EAC/B,aACE,0EACJ,CAAC;EACD,gBAAgB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,EAC/C,aACE,qFACJ,CAAC;CACH,CAAC,CAAC,CACD,QAAQ,CAAC,CACT,OAAO,CAAC,CACR,SAAS,CAAC,CACV,KAAK,EACJ,aACE,uIACJ,CAAC;;;;;CAMH,QAAQ,EAAE,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,EACtC,aACE,8JACJ,CAAC;;CAGD,MAAM,cAAc,SAAS,CAAC,CAAC,KAAK,EAClC,aACE,yEACJ,CAAC;AACH,CAAC,CAAC,CAED,OAAO,CAAC,CACR,QAAQ,SAAS,KAAK,WAAW,QAAQ,KAAK,SAAS,QAAQ;CAC9D,SAAS;CACT,MAAM,CAAC,QAAQ;AACjB,CAAC,CAAC,CACD,QAAQ,SAAS,KAAK,cAAc,UAAa,KAAK,SAAS,OAAO;CACrE,SAAS;CACT,MAAM,CAAC,WAAW;AACpB,CAAC,CAAC,CACD,QACE,SACC,KAAK,cAAc,WAClB,KAAK,UAAU,OAAO,UAAU,MAC9B,KAAK,UAAU,QAAQ,UAAU,KAClC,GACJ;CACE,SAAS;CACT,MAAM,CAAC,WAAW;AACpB,CACF,CAAC,CACA,KAAK,EACJ,aACE,+EACJ,CAAC;AAMH,MAAa,aAAa,EACvB,OAAO;;;;;;CAMN,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;EACrC,aAAa;EACb,SAAS;CACX,CAAC;;CAGD,cAAc,EAAE,MAAM,cAAc,CAAC,CAAC,KAAK;EACzC,aACE;EACF,UAAU,CAAC,gBAAgB,qBAAqB;CAClD,CAAC;;;;;;CAOD,UAAU,EAAE,QAAQ,CAAC,CAAC,KAAK;EACzB,aACE;EACF,SAAS;CACX,CAAC;;;;;;;;CASD,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,eAAe,CAAC,CAAC,KAAK;EACjD,aACE;EAEF,UAAU,CACR;GACE,QAAQ;IAAE,MAAM;KAAC;KAAS;KAAQ;IAAM;IAAG,OAAO,CAAC,QAAQ,MAAM;GAAE;GACnE,MAAM,EAAE,OAAO;IAAC;IAAQ;IAAoB;GAAsB,EAAE;EACtE,CACF;CACF,CAAC;AACH,CAAC,CAAC,CACD,QAAQ;;;;;;;;;;AAmBX,MAAa,cAAc,EACxB,KAAK;CAAC;CAAY;CAAmB;AAAa,CAAC,CAAC,CACpD,KAAK;CACJ,aACE;CAIF,SAAS;AACX,CAAC;AAEH,MAAa,UAAU,EACpB,OAAO;;CAEN,MAAM,YAAY,KAAK,EACrB,aAAa,0BACf,CAAC;;;;;CAMD,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK;EACtC,aACE;EAEF,UAAU,CAAC,oBAAoB,gBAAgB;CACjD,CAAC;;;;;CAMD,eAAe,EAAE,QAAQ,CAAC,CAAC,KAAK;EAC9B,aACE;EAEF,SAAS;CACX,CAAC;AACH,CAAC,CAAC,CACD,QAAQ,CAAC,CACT,OAAO,CAAC,CACR,KAAK,EACJ,aACE,uIAEJ,CAAC;;;;;;;;AAaH,MAAa,YAAY,gBAAgB,KAAK;CAC5C,OAAO;CACP,MAAM;CACN,KAAK;AACP,CAAC;;AAGD,MAAa,eAAe,gBAAgB,OAAO;;AAEjD,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK;CAChC,aACE;CACF,UAAU,CAAC,CAAC,MAAM,CAAC;AACrB,CAAC,EACH,CAAC,CAAC,CAAC,QAAQ;AAEX,MAAa,WAAW,EAAE,OAAO,EAAE,OAAO,GAAG,YAAY,CAAC,CAAC,KAAK;CAC9D,aACE;CAEF,UAAU,CACR;EACE,QAAQ;GAAE,MAAM;IAAC;IAAS;IAAQ;GAAM;GAAG,OAAO,CAAC,QAAQ,MAAM;EAAE;EACnE,SAAS,EACP,OAAO;GAAC;GAAQ;GAAS;GAAQ;GAAe;EAAa,EAC/D;CACF,CACF;AACF,CAAC;AAMD,MAAa,UAAU,EACpB,OAAO;;;;;CAKN,SAAS,EAAE,QAAQ,CAAC,CAAC,KAAK;EACxB,aACE;EAEF,SAAS;CACX,CAAC;;;;;CAMD,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,KAAK,CAAC,SAAS,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK;EAC5D,aACE;EAEF,UAAU,CAAC;GAAE,mBAAmB;GAAS,YAAY;EAAO,CAAC;CAC/D,CAAC;AACH,CAAC,CAAC,CACD,QAAQ,CAAC,CACT,OAAO,CAAC,CACR,KAAK,EACJ,aAAa,2BACf,CAAC;AAMH,MAAa,wBAAwB,EAClC,OAAO;;CAEN,SAAS,EAAE,OAAO,CAAC,CAAC,KAAK,EACvB,aAAa,0DACf,CAAC;;CAGD,aAAa;;;;;CAMb,SAAS,EAAE,QAAQ,CAAC,CAAC,KAAK,EACxB,aACE,qMACJ,CAAC;;CAGD,eAAe,EAAE,OAAO,CAAC,CAAC,KAAK,EAC7B,aACE,qGAEJ,CAAC;;CAGD,aAAa,gBAAgB,KAAK,EAChC,aACE,iEACJ,CAAC;;CAGD,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,KAAK,EACxB,aACE,wIAEJ,CAAC;;;;;CAMD,OAAO,EACJ,OACC,EAAE,OAAO,CAAC,CAAC,MAAM,qBAAqB,EACpC,SACE,iEACJ,CAAC,GACD,SACF,CAAC,CACA,KAAK;EACJ,aACE;EACF,UAAU,CACR;GACE,YAAY,EAAE,OAAO,CAAC,kBAAkB,EAAE;GAC1C,YAAY,EAAE,MAAM,CAAC,kBAAkB,EAAE;EAC3C,CACF;CACF,CAAC;;CAGH,UAAU,SAAS,KAAK,EACtB,aAAa,6BACf,CAAC;;CAGD,YAAY,WAAW,KAAK,EAC1B,aAAa,qDACf,CAAC;;CAGD,SAAS,QAAQ,KAAK,EACpB,aAAa,kCACf,CAAC;;CAGD,SAAS,QAAQ,KAAK,EACpB,aAAa,2BACf,CAAC;;CAGD,KAAK,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK;EACzC,aAAa;EACb,UAAU,CAAC;GAAE,UAAU;GAAe,mBAAmB;EAAI,CAAC;CAChE,CAAC;;;;;CAMD,MAAM,EACH,MAAM,EAAE,KAAK;EAAC;EAAe;EAAS;EAAQ;EAAY;CAAO,CAAC,CAAC,CAAC,CACpE,KAAK;EACJ,aACE;EAEF,UAAU,CAAC,CAAC,eAAe,UAAU,CAAC;CACxC,CAAC;;CAGH,SAAS,EACN,MAAM,EAAE,KAAK;EAAC;EAAe;EAAS;EAAQ;EAAY;CAAO,CAAC,CAAC,CAAC,CACpE,KAAK;EACJ,aACE;EACF,UAAU,CAAC,CAAC,OAAO,CAAC;CACtB,CAAC;;;;;;CAOH,IAAI,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK;EAC3D,aACE;EAEF,SAAS;EACT,UAAU;GAAC;GAAO;GAAG;GAAG;EAAC;CAC3B,CAAC;;CAGD,MAAM,EACH,OAAO;;;;;;;;EAQN,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC,GAAG,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK;GAChE,aACE;GACF,SAAS;EACX,CAAC;;EAGD,QAAQ,EAAE,QAAQ,CAAC,CAAC,KAAK;GACvB,aAAa;GACb,SAAS;EACX,CAAC;CACH,CAAC,CAAC,CACD,QAAQ,CAAC,CACT,KAAK,EACJ,aACE,8DACJ,CAAC;AACL,CAAC,CAAC,CACD,QAAQ,CAAC,CACT,OAAO,CAAC,CACR,OAAO,QAAQ;CACd,KAAK,MAAM,WAAW,gBAAgB,IAAI,MAAM,QAAQ,GACtD,IAAI,OAAO,KAAK;EACd,MAAM;EACN,OAAO,IAAI;EACX,SAAS,QAAQ;EACjB,MAAM;GAAC;GAAY,QAAQ;GAAS;EAAS;CAC/C,CAAC;CAEH,IAAI,IAAI,MAAM,SAAS,UAAa,IAAI,MAAM,YAAY,QACxD,IAAI,OAAO,KAAK;EACd,MAAM;EACN,OAAO,IAAI;EACX,SAAS;EACT,MAAM,CAAC,MAAM;CACf,CAAC;AAEL,CAAC,CAAC,CACD,KAAK;CACJ,OAAO;CACP,aACE;AAIJ,CAAC"}