fix(permission): aliases in Evaluate, base rules, fail-closed defaults (#543-#549)

- bash↔shell and list↔glob aliases applied in Evaluate/Ask
- Path/command Ask patterns derived from tool definitions
- SetBaseRules called in TUI/serve/ACP (matching run mode)
- Session deny→reject normalization; 400 on unknown action
- Path pattern parsing; todowrite under deny-edit rules
- Always = session-only scope (documented; warn if no store)
- Empty Patterns fail-closed; doom_loop/guardrail docs honest

Author: bobbyjohnstx

cmd/tinycode/acp.go

@@ -71,6 +71,7 @@ func runACP(args []string) {
 	}
 
 	toolReg, permSvc, toolCtx := initTooling(b, dir, cfg)
+	applyConfigPermissions(permSvc, toolReg, cfg)
 
 	lspMgr := initLSP(dir, cfg, toolReg)
 	defer lspMgr.Close()

cmd/tinycode/config.go

@@ -199,12 +199,7 @@ func initAgentRegistry(cfg *config.Info, directory string) *agent.Registry {
 	}
 	var userPerms permission.Ruleset
 	if cfg.Permission != nil {
-		for _, a := range cfg.Permission.Allow {
-			userPerms = append(userPerms, permission.Rule{Permission: a, Pattern: "*", Action: permission.ActionAllow})
-		}
-		for _, d := range cfg.Permission.Deny {
-			userPerms = append(userPerms, permission.Rule{Permission: d, Pattern: "*", Action: permission.ActionDeny})
-		}
+		userPerms = permission.FromConfig(cfg.Permission.Allow, cfg.Permission.Deny)
 	}
 
 	reg := agent.NewRegistry()
@@ -254,6 +249,18 @@ func initTooling(b *bus.Bus, directory string, cfg ...*config.Info) (*tool.Regis
 	return toolReg, permSvc, toolCtx
 }
 
+// applyConfigPermissions wires config allow/deny into the permission service
+// and disables tools that are globally denied. Shared by run, tui, serve, and acp.
+func applyConfigPermissions(permSvc *permission.Service, toolReg *tool.Registry, cfg *config.Info) {
+	if cfg == nil || cfg.Permission == nil {
+		return
+	}
+	configRules := permission.FromConfig(cfg.Permission.Allow, cfg.Permission.Deny)
+	permSvc.SetBaseRules(configRules)
+	disabled := permission.Disabled(toolReg.List(), configRules)
+	toolReg.SetDisabled(disabled)
+}
+
 func initLSP(dir string, cfg *config.Info, toolReg *tool.Registry) *lsp.Manager {
 	var lspCfg *lsp.Config
 	if cfg.LSP != nil {

cmd/tinycode/run.go

@@ -110,12 +110,7 @@ func runRun() {
 	lspMgr := initLSP(dir, cfg, toolReg)
 	defer lspMgr.Close()
 
-	if cfg.Permission != nil {
-		configRules := permission.FromConfig(cfg.Permission.Allow, cfg.Permission.Deny)
-		permSvc.SetBaseRules(configRules)
-		disabled := permission.Disabled(toolReg.List(), configRules)
-		toolReg.SetDisabled(disabled)
-	}
+	applyConfigPermissions(permSvc, toolReg, cfg)
 
 	permReplyCh := setupRunPermissions(b, permSvc, *skipPermsFlag, *interactiveFlag, *permsFlag)
 

cmd/tinycode/serve.go

@@ -44,6 +44,7 @@ func runServe() {
 	agentReg := initAgentRegistry(cfg, dir)
 
 	toolReg, permSvc, toolCtx := initTooling(b, dir, cfg)
+	applyConfigPermissions(permSvc, toolReg, cfg)
 
 	lspMgr := initLSP(dir, cfg, toolReg)
 	defer lspMgr.Close()
@@ -129,6 +130,7 @@ func runWeb() {
 	agentReg := initAgentRegistry(cfg, dir)
 
 	toolReg, permSvc, toolCtx := initTooling(b, dir, cfg)
+	applyConfigPermissions(permSvc, toolReg, cfg)
 
 	lspMgr := initLSP(dir, cfg, toolReg)
 	defer lspMgr.Close()

cmd/tinycode/tui.go

@@ -58,6 +58,7 @@ func runTUI(args []string) {
 	}
 
 	toolReg, permSvc, toolCtx := initTooling(b, dir, cfg)
+	applyConfigPermissions(permSvc, toolReg, cfg)
 
 	lspMgr := initLSP(dir, cfg, toolReg)
 	defer lspMgr.Close()

docs/spec/12-permissions.md

@@ -32,7 +32,11 @@ type Ruleset []Rule
 
 ### Edit Tool Normalization
 
-Tools `edit`, `write`, and `apply_patch` all map to the `"edit"` permission when checking disabled status via `Disabled()`. This ensures a single `deny edit *` rule blocks all file-writing tools.
+Tools `edit`, `write`, `apply_patch`, and `todowrite` all map to the `"edit"` permission when checking disabled status via `Disabled()`. This ensures a single `deny edit *` rule blocks all file-writing tools.
+
+### Permission Aliases
+
+`bash`↔`shell` and `list`↔`glob` are aliases. `Evaluate` and `Disabled` expand both sides so a rule written as `allow bash *` matches an Ask with permission `shell` (and vice versa).
 
 ## 12.2 Default Rules
 
@@ -41,13 +45,13 @@ var DefaultRules = Ruleset{
     {Permission: "read",               Pattern: "*",     Action: ActionAllow},
     {Permission: "read",               Pattern: ".env*", Action: ActionAsk},
     {Permission: "webfetch",           Pattern: "*",     Action: ActionAsk},
-    {Permission: "doom_loop",          Pattern: "*",     Action: ActionAsk},
-    {Permission: "guardrail",          Pattern: "*",     Action: ActionAsk},
     {Permission: "external_directory", Pattern: "*",     Action: ActionAsk},
 }
 ```
 
-DefaultRules are automatically prepended during evaluation. They establish the baseline: file reads are allowed, but `.env*` files, web fetches, doom loop overrides, guardrail bypasses, and external directory access all require user approval.
+DefaultRules are automatically prepended during evaluation. They establish the baseline: file reads are allowed, but `.env*` files, web fetches, and external directory access all require user approval.
+
+Doom-loop detection is a hard-stop in the session processor (`checkDoomLoop`), not a permission Ask. Destructive shell commands use the `destructive-shell` permission from the shell/monitor tools.
 
 ## 12.3 Evaluation
 
@@ -87,7 +91,7 @@ Concatenates multiple rulesets into a single flat slice. Order is preserved -- e
 func Disabled(tools []string, ruleset Ruleset) map[string]bool
 ```
 
-Returns the set of tool names that are globally denied (pattern `"*"`, action `"deny"`). For tools in the `editTools` map (`edit`, `write`, `apply_patch`), the permission is normalized to `"edit"` before checking.
+Returns the set of tool names that are globally denied (pattern `"*"`, action `"deny"`). For tools in the `editTools` map (`edit`, `write`, `apply_patch`, `todowrite`), the permission is normalized to `"edit"` before checking.
 
 ## 12.4 Wildcard Matching
 
@@ -199,23 +203,26 @@ type Service struct {
 ```
 1. Lock mutex
 2. If service is closed -> return ErrClosed
-3. For each pattern in input.Patterns:
+3. If Patterns is empty -> unlock, return ErrDenied (fail closed)
+4. For each pattern in input.Patterns:
    a. Evaluate(permission, pattern, baseRules, input.Ruleset, approved)
    b. If any rule -> deny: unlock, return DeniedError (with matching rules)
    c. If any rule -> ask: mark needsAsk = true
-4. If all rules -> allow: unlock, return nil
-5. Generate request ID (ascending sortable, "permission" prefix)
-6. Create pending entry with buffered reply channel (cap 1)
-7. Store in pending map
-8. Unlock mutex
-9. Publish "permission.asked" event on bus
-10. Select:
+5. If all rules -> allow: unlock, return nil
+6. Generate request ID (ascending sortable, "permission" prefix)
+7. Create pending entry with buffered reply channel (cap 1)
+8. Store in pending map
+9. Unlock mutex
+10. Publish "permission.asked" event on bus
+11. Select:
     - Reply received on channel -> return result.err
     - Context cancelled -> clean up pending entry, return ctx.Err()
 ```
 
 The ask is a blocking call -- the goroutine waits on a channel until either the user replies or the context is cancelled.
 
+Tool execution passes path or command strings as Patterns (via `askPatterns` in `internal/tool`), not just the tool name, so rules like `read .env*` match correctly.
+
 ## 12.7 Reply Flow
 
 `Service.RespondToAsk(input)` handles user replies.
@@ -258,10 +265,14 @@ type RuleStore interface {
 ### Lifecycle
 
 - `SetStore(store, projectID)` configures persistence and loads any previously saved rules into the `approved` list
-- "Always" approvals are saved on each `ReplyAlways` response
+- "Always" approvals are saved on each `ReplyAlways` response when a store is configured
 - Rules are scoped to a project (identified by `projectID`)
 - Persisted rules survive process restarts
 
+### Session-only "always" (current default)
+
+No `RuleStore` is wired in TUI/serve/ACP/run by default. In that case, `"always"` approvals live in the in-memory `approved` list for the lifetime of the process only — they do not survive restarts. `RespondToAsk` logs a warning when persisting without a store so this is not silent.
+
 ## 12.9 Config Integration
 
 ```go

docs/spec/15-security.md

@@ -184,22 +184,20 @@ See [12-permissions.md](12-permissions.md) for the full permission system specif
 
 ### Default Rules
 
-6 rules applied as the base layer for every session:
+4 rules applied as the base layer for every session:
 
 | Permission | Pattern | Action | Security Purpose |
 |------------|---------|--------|-----------------|
 | `read` | `*` | allow | Broad read access for tools |
 | `read` | `.env*` | ask | Protects secret files from silent reads |
 | `webfetch` | `*` | ask | Gates all external HTTP requests |
-| `doom_loop` | `*` | ask | User confirmation on loop detection |
-| `guardrail` | `*` | ask | Safety guardrail confirmation |
 | `external_directory` | `*` | ask | Protects paths outside project directory |
 
 ### Doom Loop Detection
 
-Source: `internal/session/processor_validation.go`
+Source: `internal/session/processor_validation.go`, `internal/session/processor_loop.go`
 
-`isDoomLoop()` detects when the last N tool calls have identical signatures (same tool name and arguments). Default threshold: 3 consecutive identical calls (`defaultDoomThreshold`). Triggers `permission.Ask()` with `"doom_loop"` permission.
+`isDoomLoop()` detects when the last N tool calls have identical signatures (same tool name and arguments). Default threshold: 3 consecutive identical calls (`defaultDoomThreshold`). This is a hard-stop in the processor (`checkDoomLoop` returns an error) — it does not go through `permission.Ask`.
 
 ### Consecutive Failure Tracking
 

internal/agent/agent.go

@@ -639,9 +639,10 @@ func permissionFromConfigMap(m map[string]any) permission.Ruleset {
 	for key, val := range m {
 		switch v := val.(type) {
 		case string:
+			perm, pattern := splitPermissionKey(key)
 			rules = append(rules, permission.Rule{
-				Permission: key,
-				Pattern:    "*",
+				Permission: perm,
+				Pattern:    pattern,
 				Action:     permission.Action(v),
 			})
 		case map[string]any:
@@ -660,3 +661,13 @@ func permissionFromConfigMap(m map[string]any) permission.Ruleset {
 	}
 	return rules
 }
+
+// splitPermissionKey splits "permission pattern" on the first space.
+// When no space is present, the pattern defaults to "*".
+func splitPermissionKey(s string) (permission, pattern string) {
+	idx := strings.IndexByte(s, ' ')
+	if idx < 0 {
+		return s, "*"
+	}
+	return s[:idx], s[idx+1:]
+}

internal/agent/agent_test.go

@@ -490,4 +490,41 @@ func TestNativeAgentPermissions(t *testing.T) {
 	if rule.Action != permission.ActionDeny {
 		t.Errorf("explore should deny edit via * deny, got %s", rule.Action)
 	}
+
+	// Explore allow bash * should match shell Ask (alias).
+	rule = permission.Evaluate("shell", "ls", explore.Permission)
+	if rule.Action != permission.ActionAllow {
+		t.Errorf("explore should allow shell via bash alias, got %s", rule.Action)
+	}
+}
+
+func TestPermissionFromConfigMap_PathPatterns(t *testing.T) {
+	rules := permissionFromConfigMap(map[string]any{
+		"read .env*": "ask",
+		"edit":       "deny",
+		"bash": map[string]any{
+			"rm *": "deny",
+		},
+	})
+
+	var foundEnv, foundEdit, foundBash bool
+	for _, r := range rules {
+		switch {
+		case r.Permission == "read" && r.Pattern == ".env*" && r.Action == permission.ActionAsk:
+			foundEnv = true
+		case r.Permission == "edit" && r.Pattern == "*" && r.Action == permission.ActionDeny:
+			foundEdit = true
+		case r.Permission == "bash" && r.Pattern == "rm *" && r.Action == permission.ActionDeny:
+			foundBash = true
+		}
+	}
+	if !foundEnv {
+		t.Error("expected read .env* ask from space-separated key")
+	}
+	if !foundEdit {
+		t.Error("expected edit * deny")
+	}
+	if !foundBash {
+		t.Error("expected bash rm * deny from nested map")
+	}
 }

internal/permission/defaults.go

@@ -2,12 +2,14 @@ package permission
 
 // DefaultRules provides a base ruleset applied before user or agent rules.
 // It allows read operations, and requires user approval for sensitive
-// patterns and safety-related permissions.
+// patterns and external directory access.
+//
+// Note: doom_loop is enforced as a hard-stop in the session processor
+// (checkDoomLoop), not via permission.Ask. Destructive shell commands use
+// the "destructive-shell" permission from the shell/monitor tools.
 var DefaultRules = Ruleset{
 	{Permission: "read", Pattern: "*", Action: ActionAllow},
 	{Permission: "read", Pattern: ".env*", Action: ActionAsk},
 	{Permission: "webfetch", Pattern: "*", Action: ActionAsk},
-	{Permission: "doom_loop", Pattern: "*", Action: ActionAsk},
-	{Permission: "guardrail", Pattern: "*", Action: ActionAsk},
 	{Permission: "external_directory", Pattern: "*", Action: ActionAsk},
 }