Provider permissions: enforcement hook in permission system #167

Open
Open
Provider permissions: enforcement hook in permission system#167
Assignees
Rchari1
Labels
afkImplement + merge unattended

Description

@jeonghun-jj-lee
jeonghun-jj-lee
opened on Aug 10, 2026

Important

Decision Surface

Problem: The tier resolution engine exists but is not wired into actual tool-call gating. Tools still go through the global permission system regardless of model.

Approach: Insert a resolveProviderPermission() call in permission.ts BEFORE the existing assert(). If the provider layer returns "allow", suppress the ask prompt. If "deny", block immediately. If undefined (no opinion), fall through to existing behavior.

Scope: Wiring the resolution engine into the permission hot path. The LLM runner must pass the active model ID into tool dispatch.

Acceptance Criteria

  • Every tool call passes through provider permission resolution before the existing assert()
  • A tier "allow" for action+directory suppresses the normal permission ask prompt (user is never prompted)
  • A tier "deny" blocks the tool call immediately with a clear error message naming the tier and directory
  • A tier "ask" falls through to the existing permission system (user gets the normal prompt)
  • When no provider rule matches (undefined), the existing permission system handles it unchanged
  • The active model ID is available in the permission resolution context (passed from the LLM runner)
  • On model switch mid-session, subsequent tool calls resolve against the NEW model's tier immediately

Key Decisions

#DecisionRationale
1Provider layer runs first, is authoritative"Allow" means the user explicitly trusts this tier — double-prompting is noise
2Deny message names the tierUser understands WHY it was blocked and can reconfigure if needed
3Model ID threaded through tool dispatch contextMinimal coupling — one new field in the existing tool context, not a restructure

Testing Decisions

  • Test "allow" tier + directory → tool executes without prompt
  • Test "deny" tier + directory → tool blocked with error message
  • Test "ask" tier → falls through to existing permission (mock assert called)
  • Test undefined (unassigned model) → existing permission system handles it
  • Test model switch → next tool call uses new model's tier
  • Extends Provider permissions: tier resolution engine #165's test surface for integration

Constraints & Invariants

  • The provider permission check must not add measurable latency (it is a map lookup + glob match — no I/O)
  • Must not break existing behavior for users with no providerPermissions config (undefined → full fallthrough)

Source

Part of #163
Blocked by #164, #165

Metadata

Metadata

Assignees

Labels

afkImplement + merge unattended

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
     blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

    Skip to content
    Provider permissions: enforcement hook in permission system #167
    Open
    Open
    Provider permissions: enforcement hook in permission system#167
    Assignees
    Rchari1
    Labels
    afkImplement + merge unattended
    Description
    @jeonghun-jj-lee
    jeonghun-jj-lee
    opened on Aug 10, 2026
    Important
    Decision Surface
    Problem: The tier resolution engine exists but is not wired into actual tool-call gating. Tools still go through the global permission system regardless of model.
    Approach: Insert a resolveProviderPermission() call in permission.ts BEFORE the existing assert(). If the provider layer returns "allow", suppress the ask prompt. If "deny", block immediately. If undefined (no opinion), fall through to existing behavior.
    Scope: Wiring the resolution engine into the permission hot path. The LLM runner must pass the active model ID into tool dispatch.
    Acceptance Criteria
    •  Every tool call passes through provider permission resolution before the existing assert()
    •  A tier "allow" for action+directory suppresses the normal permission ask prompt (user is never prompted)
    •  A tier "deny" blocks the tool call immediately with a clear error message naming the tier and directory
    •  A tier "ask" falls through to the existing permission system (user gets the normal prompt)
    •  When no provider rule matches (undefined), the existing permission system handles it unchanged
    •  The active model ID is available in the permission resolution context (passed from the LLM runner)
    •  On model switch mid-session, subsequent tool calls resolve against the NEW model's tier immediately
    Key Decisions
    #DecisionRationale
    1Provider layer runs first, is authoritative"Allow" means the user explicitly trusts this tier — double-prompting is noise
    2Deny message names the tierUser understands WHY it was blocked and can reconfigure if needed
    3Model ID threaded through tool dispatch contextMinimal coupling — one new field in the existing tool context, not a restructure
    Testing Decisions
    • Test "allow" tier + directory → tool executes without prompt
    • Test "deny" tier + directory → tool blocked with error message
    • Test "ask" tier → falls through to existing permission (mock assert called)
    • Test undefined (unassigned model) → existing permission system handles it
    • Test model switch → next tool call uses new model's tier
    • Extends Provider permissions: tier resolution engine #165's test surface for integration
    Constraints & Invariants
    • The provider permission check must not add measurable latency (it is a map lookup + glob match — no I/O)
    • Must not break existing behavior for users with no providerPermissions config (undefined → full fallthrough)
    Source
    Part of #163
    
Blocked by #164, #165
    Metadata
    Metadata
    Assignees
    Labels
    afkImplement + merge unattended
    Type
    No type
    Projects
    No projects
      Milestone
      No milestone
      Relationships
      None yet
      Development
      No branches or pull requests
      Issue actions
      
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

      Skip to content
      Provider permissions: enforcement hook in permission system #167
      Open
      Open
      Provider permissions: enforcement hook in permission system#167
      Assignees
      Rchari1
      Labels
      afkImplement + merge unattended
      Description
      @jeonghun-jj-lee
      jeonghun-jj-lee
      opened on Aug 10, 2026
      Important
      Decision Surface
      Problem: The tier resolution engine exists but is not wired into actual tool-call gating. Tools still go through the global permission system regardless of model.
      Approach: Insert a resolveProviderPermission() call in permission.ts BEFORE the existing assert(). If the provider layer returns "allow", suppress the ask prompt. If "deny", block immediately. If undefined (no opinion), fall through to existing behavior.
      Scope: Wiring the resolution engine into the permission hot path. The LLM runner must pass the active model ID into tool dispatch.
      Acceptance Criteria
      •  Every tool call passes through provider permission resolution before the existing assert()
      •  A tier "allow" for action+directory suppresses the normal permission ask prompt (user is never prompted)
      •  A tier "deny" blocks the tool call immediately with a clear error message naming the tier and directory
      •  A tier "ask" falls through to the existing permission system (user gets the normal prompt)
      •  When no provider rule matches (undefined), the existing permission system handles it unchanged
      •  The active model ID is available in the permission resolution context (passed from the LLM runner)
      •  On model switch mid-session, subsequent tool calls resolve against the NEW model's tier immediately
      Key Decisions
      #DecisionRationale
      1Provider layer runs first, is authoritative"Allow" means the user explicitly trusts this tier — double-prompting is noise
      2Deny message names the tierUser understands WHY it was blocked and can reconfigure if needed
      3Model ID threaded through tool dispatch contextMinimal coupling — one new field in the existing tool context, not a restructure
      Testing Decisions
      • Test "allow" tier + directory → tool executes without prompt
      • Test "deny" tier + directory → tool blocked with error message
      • Test "ask" tier → falls through to existing permission (mock assert called)
      • Test undefined (unassigned model) → existing permission system handles it
      • Test model switch → next tool call uses new model's tier
      • Extends Provider permissions: tier resolution engine #165's test surface for integration
      Constraints & Invariants
      • The provider permission check must not add measurable latency (it is a map lookup + glob match — no I/O)
      • Must not break existing behavior for users with no providerPermissions config (undefined → full fallthrough)
      Source
      Part of #163
      
Blocked by #164, #165
      Metadata
      Metadata
      Assignees
      Labels
      afkImplement + merge unattended
      Type
      No type
      Projects
      No projects
        Milestone
        No milestone
        Relationships
        None yet
        Development
        No branches or pull requests
        Issue actions
        
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

        Skip to content
        Provider permissions: enforcement hook in permission system #167
        Open
        Open
        Provider permissions: enforcement hook in permission system#167
        Assignees
        Rchari1
        Labels
        afkImplement + merge unattended
        Description
        @jeonghun-jj-lee
        jeonghun-jj-lee
        opened on Aug 10, 2026
        Important
        Decision Surface
        Problem: The tier resolution engine exists but is not wired into actual tool-call gating. Tools still go through the global permission system regardless of model.
        Approach: Insert a resolveProviderPermission() call in permission.ts BEFORE the existing assert(). If the provider layer returns "allow", suppress the ask prompt. If "deny", block immediately. If undefined (no opinion), fall through to existing behavior.
        Scope: Wiring the resolution engine into the permission hot path. The LLM runner must pass the active model ID into tool dispatch.
        Acceptance Criteria
        •  Every tool call passes through provider permission resolution before the existing assert()
        •  A tier "allow" for action+directory suppresses the normal permission ask prompt (user is never prompted)
        •  A tier "deny" blocks the tool call immediately with a clear error message naming the tier and directory
        •  A tier "ask" falls through to the existing permission system (user gets the normal prompt)
        •  When no provider rule matches (undefined), the existing permission system handles it unchanged
        •  The active model ID is available in the permission resolution context (passed from the LLM runner)
        •  On model switch mid-session, subsequent tool calls resolve against the NEW model's tier immediately
        Key Decisions
        #DecisionRationale
        1Provider layer runs first, is authoritative"Allow" means the user explicitly trusts this tier — double-prompting is noise
        2Deny message names the tierUser understands WHY it was blocked and can reconfigure if needed
        3Model ID threaded through tool dispatch contextMinimal coupling — one new field in the existing tool context, not a restructure
        Testing Decisions
        • Test "allow" tier + directory → tool executes without prompt
        • Test "deny" tier + directory → tool blocked with error message
        • Test "ask" tier → falls through to existing permission (mock assert called)
        • Test undefined (unassigned model) → existing permission system handles it
        • Test model switch → next tool call uses new model's tier
        • Extends Provider permissions: tier resolution engine #165's test surface for integration
        Constraints & Invariants
        • The provider permission check must not add measurable latency (it is a map lookup + glob match — no I/O)
        • Must not break existing behavior for users with no providerPermissions config (undefined → full fallthrough)
        Source
        Part of #163
        
Blocked by #164, #165
        Metadata
        Metadata
        Assignees
        Labels
        afkImplement + merge unattended
        Type
        No type
        Projects
        No projects
          Milestone
          No milestone
          Relationships
          None yet
          Development
          No branches or pull requests
          Issue actions
          
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

          Skip to content
          Provider permissions: enforcement hook in permission system #167
          Open
          Open
          Provider permissions: enforcement hook in permission system#167
          Assignees
          Rchari1
          Labels
          afkImplement + merge unattended
          Description
          @jeonghun-jj-lee
          jeonghun-jj-lee
          opened on Aug 10, 2026
          Important
          Decision Surface
          Problem: The tier resolution engine exists but is not wired into actual tool-call gating. Tools still go through the global permission system regardless of model.
          Approach: Insert a resolveProviderPermission() call in permission.ts BEFORE the existing assert(). If the provider layer returns "allow", suppress the ask prompt. If "deny", block immediately. If undefined (no opinion), fall through to existing behavior.
          Scope: Wiring the resolution engine into the permission hot path. The LLM runner must pass the active model ID into tool dispatch.
          Acceptance Criteria
          •  Every tool call passes through provider permission resolution before the existing assert()
          •  A tier "allow" for action+directory suppresses the normal permission ask prompt (user is never prompted)
          •  A tier "deny" blocks the tool call immediately with a clear error message naming the tier and directory
          •  A tier "ask" falls through to the existing permission system (user gets the normal prompt)
          •  When no provider rule matches (undefined), the existing permission system handles it unchanged
          •  The active model ID is available in the permission resolution context (passed from the LLM runner)
          •  On model switch mid-session, subsequent tool calls resolve against the NEW model's tier immediately
          Key Decisions
          #DecisionRationale
          1Provider layer runs first, is authoritative"Allow" means the user explicitly trusts this tier — double-prompting is noise
          2Deny message names the tierUser understands WHY it was blocked and can reconfigure if needed
          3Model ID threaded through tool dispatch contextMinimal coupling — one new field in the existing tool context, not a restructure
          Testing Decisions
          • Test "allow" tier + directory → tool executes without prompt
          • Test "deny" tier + directory → tool blocked with error message
          • Test "ask" tier → falls through to existing permission (mock assert called)
          • Test undefined (unassigned model) → existing permission system handles it
          • Test model switch → next tool call uses new model's tier
          • Extends Provider permissions: tier resolution engine #165's test surface for integration
          Constraints & Invariants
          • The provider permission check must not add measurable latency (it is a map lookup + glob match — no I/O)
          • Must not break existing behavior for users with no providerPermissions config (undefined → full fallthrough)
          Source
          Part of #163
          
Blocked by #164, #165
          Metadata
          Metadata
          Assignees
          Labels
          afkImplement + merge unattended
          Type
          No type
          Projects
          No projects
            Milestone
            No milestone
            Relationships
            None yet
            Development
            No branches or pull requests
            Issue actions
            
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

            Skip to content
            Provider permissions: enforcement hook in permission system #167
            Open
            Open
            Provider permissions: enforcement hook in permission system#167
            Assignees
            Rchari1
            Labels
            afkImplement + merge unattended
            Description
            @jeonghun-jj-lee
            jeonghun-jj-lee
            opened on Aug 10, 2026
            Important
            Decision Surface
            Problem: The tier resolution engine exists but is not wired into actual tool-call gating. Tools still go through the global permission system regardless of model.
            Approach: Insert a resolveProviderPermission() call in permission.ts BEFORE the existing assert(). If the provider layer returns "allow", suppress the ask prompt. If "deny", block immediately. If undefined (no opinion), fall through to existing behavior.
            Scope: Wiring the resolution engine into the permission hot path. The LLM runner must pass the active model ID into tool dispatch.
            Acceptance Criteria
            •  Every tool call passes through provider permission resolution before the existing assert()
            •  A tier "allow" for action+directory suppresses the normal permission ask prompt (user is never prompted)
            •  A tier "deny" blocks the tool call immediately with a clear error message naming the tier and directory
            •  A tier "ask" falls through to the existing permission system (user gets the normal prompt)
            •  When no provider rule matches (undefined), the existing permission system handles it unchanged
            •  The active model ID is available in the permission resolution context (passed from the LLM runner)
            •  On model switch mid-session, subsequent tool calls resolve against the NEW model's tier immediately
            Key Decisions
            #DecisionRationale
            1Provider layer runs first, is authoritative"Allow" means the user explicitly trusts this tier — double-prompting is noise
            2Deny message names the tierUser understands WHY it was blocked and can reconfigure if needed
            3Model ID threaded through tool dispatch contextMinimal coupling — one new field in the existing tool context, not a restructure
            Testing Decisions
            • Test "allow" tier + directory → tool executes without prompt
            • Test "deny" tier + directory → tool blocked with error message
            • Test "ask" tier → falls through to existing permission (mock assert called)
            • Test undefined (unassigned model) → existing permission system handles it
            • Test model switch → next tool call uses new model's tier
            • Extends Provider permissions: tier resolution engine #165's test surface for integration
            Constraints & Invariants
            • The provider permission check must not add measurable latency (it is a map lookup + glob match — no I/O)
            • Must not break existing behavior for users with no providerPermissions config (undefined → full fallthrough)
            Source
            Part of #163
            
Blocked by #164, #165
            Metadata
            Metadata
            Assignees
            Labels
            afkImplement + merge unattended
            Type
            No type
            Projects
            No projects
              Milestone
              No milestone
              Relationships
              None yet
              Development
              No branches or pull requests
              Issue actions
              
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

              Skip to content
              Provider permissions: enforcement hook in permission system #167
              Open
              Open
              Provider permissions: enforcement hook in permission system#167
              Assignees
              Rchari1
              Labels
              afkImplement + merge unattended
              Description
              @jeonghun-jj-lee
              jeonghun-jj-lee
              opened on Aug 10, 2026
              Important
              Decision Surface
              Problem: The tier resolution engine exists but is not wired into actual tool-call gating. Tools still go through the global permission system regardless of model.
              Approach: Insert a resolveProviderPermission() call in permission.ts BEFORE the existing assert(). If the provider layer returns "allow", suppress the ask prompt. If "deny", block immediately. If undefined (no opinion), fall through to existing behavior.
              Scope: Wiring the resolution engine into the permission hot path. The LLM runner must pass the active model ID into tool dispatch.
              Acceptance Criteria
              •  Every tool call passes through provider permission resolution before the existing assert()
              •  A tier "allow" for action+directory suppresses the normal permission ask prompt (user is never prompted)
              •  A tier "deny" blocks the tool call immediately with a clear error message naming the tier and directory
              •  A tier "ask" falls through to the existing permission system (user gets the normal prompt)
              •  When no provider rule matches (undefined), the existing permission system handles it unchanged
              •  The active model ID is available in the permission resolution context (passed from the LLM runner)
              •  On model switch mid-session, subsequent tool calls resolve against the NEW model's tier immediately
              Key Decisions
              #DecisionRationale
              1Provider layer runs first, is authoritative"Allow" means the user explicitly trusts this tier — double-prompting is noise
              2Deny message names the tierUser understands WHY it was blocked and can reconfigure if needed
              3Model ID threaded through tool dispatch contextMinimal coupling — one new field in the existing tool context, not a restructure
              Testing Decisions
              • Test "allow" tier + directory → tool executes without prompt
              • Test "deny" tier + directory → tool blocked with error message
              • Test "ask" tier → falls through to existing permission (mock assert called)
              • Test undefined (unassigned model) → existing permission system handles it
              • Test model switch → next tool call uses new model's tier
              • Extends Provider permissions: tier resolution engine #165's test surface for integration
              Constraints & Invariants
              • The provider permission check must not add measurable latency (it is a map lookup + glob match — no I/O)
              • Must not break existing behavior for users with no providerPermissions config (undefined → full fallthrough)
              Source
              Part of #163
              
Blocked by #164, #165
              Metadata
              Metadata
              Assignees
              Labels
              afkImplement + merge unattended
              Type
              No type
              Projects
              No projects
                Milestone
                No milestone
                Relationships
                None yet
                Development
                No branches or pull requests
                Issue actions
                
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

                Skip to content
                Provider permissions: enforcement hook in permission system #167
                Open
                Open
                Provider permissions: enforcement hook in permission system#167
                Assignees
                Rchari1
                Labels
                afkImplement + merge unattended
                Description
                @jeonghun-jj-lee
                jeonghun-jj-lee
                opened on Aug 10, 2026
                Important
                Decision Surface
                Problem: The tier resolution engine exists but is not wired into actual tool-call gating. Tools still go through the global permission system regardless of model.
                Approach: Insert a resolveProviderPermission() call in permission.ts BEFORE the existing assert(). If the provider layer returns "allow", suppress the ask prompt. If "deny", block immediately. If undefined (no opinion), fall through to existing behavior.
                Scope: Wiring the resolution engine into the permission hot path. The LLM runner must pass the active model ID into tool dispatch.
                Acceptance Criteria
                •  Every tool call passes through provider permission resolution before the existing assert()
                •  A tier "allow" for action+directory suppresses the normal permission ask prompt (user is never prompted)
                •  A tier "deny" blocks the tool call immediately with a clear error message naming the tier and directory
                •  A tier "ask" falls through to the existing permission system (user gets the normal prompt)
                •  When no provider rule matches (undefined), the existing permission system handles it unchanged
                •  The active model ID is available in the permission resolution context (passed from the LLM runner)
                •  On model switch mid-session, subsequent tool calls resolve against the NEW model's tier immediately
                Key Decisions
                #DecisionRationale
                1Provider layer runs first, is authoritative"Allow" means the user explicitly trusts this tier — double-prompting is noise
                2Deny message names the tierUser understands WHY it was blocked and can reconfigure if needed
                3Model ID threaded through tool dispatch contextMinimal coupling — one new field in the existing tool context, not a restructure
                Testing Decisions
                • Test "allow" tier + directory → tool executes without prompt
                • Test "deny" tier + directory → tool blocked with error message
                • Test "ask" tier → falls through to existing permission (mock assert called)
                • Test undefined (unassigned model) → existing permission system handles it
                • Test model switch → next tool call uses new model's tier
                • Extends Provider permissions: tier resolution engine #165's test surface for integration
                Constraints & Invariants
                • The provider permission check must not add measurable latency (it is a map lookup + glob match — no I/O)
                • Must not break existing behavior for users with no providerPermissions config (undefined → full fallthrough)
                Source
                Part of #163
                
Blocked by #164, #165
                Metadata
                Metadata
                Assignees
                Labels
                afkImplement + merge unattended
                Type
                No type
                Projects
                No projects
                  Milestone
                  No milestone
                  Relationships
                  None yet
                  Development
                  No branches or pull requests
                  Issue actions