Evaluate stored approvals through @intx/authz (#295)

Replace the homegrown glob matcher with matchPattern and route grant
checks through evaluateGrants, keeping exact-escaped command grants and
the TUI ask path in Corbits.

Author: TheGreatAxios

AGENTS.md

@@ -54,7 +54,7 @@ Interchange is the standard library for this repo, consumed as published `@intx/
 
 | Package | Covers |
 |---|---|
-| `@intx/authz` | Grant-based policy engine (allow/ask/deny) |
+| `@intx/authz` | Grant matching (`matchPattern`, `evaluateGrants`) for permission approvals; Corbits owns the gate, store, and TUI ask |
 | `@intx/inference` | Reactor loop, `createAuthzExtension`, `DefaultDirector` |
 | `@intx/agent` | Agent lifecycle, send queue, stream |
 | `@intx/tools-posix` | Shell, file read/write/edit, grep, search |

bun.lock

@@ -248,8 +248,9 @@ tool call
 - **command** — Splits chained commands for security classification and derives command-shape approval scopes. Multi-segment chains only offer an exact-command persist pattern (a prefix like `npm *` must not cover `npm i && rm -rf /` later).
 - **auto-shell-policy** — Constrains `run_shell` even when auto mode would otherwise rubber-stamp it. Before matching, `expandShellSubjects` peels `bash`/`sh`/`zsh -c`, `xargs` utility tails, and transparent prefixes (`env`, `nice`, `timeout`, …) so rules see the real payload; an unparseable wrapper (variable expansion or command substitution) sets an opaque flag that forces `ask`. Effects: `deny` blocks outright (file mutations through ad-hoc tooling — output redirection, `tee`, `sed -i`/`perl -i`, interpreter inline programs or heredocs — which must instead go through `write_file`/`edit_file`); `ask` declines to auto-allow and falls through to the operator prompt (recursive `rm`, dependency installs and remote runners: npm/yarn/pnpm/bun, pip, cargo, go, brew, npx/bunx, …, git worktree add/remove/prune, shell that references a sensitive path such as `.env` or a private key, and opaque wrappers). Deny beats ask when multiple subjects match. Quoted spans are stripped before pattern matching so a quoted `>` or install word in an argument is not flagged, and program names are matched only in command position. Adding a table category is a one-line rule append in `AUTO_SHELL_RULES`.
 - **gate** — Evaluates a call: `skipPermissions` allows everything; `allow`-tier passes; for `ask`-tier, checks persisted approvals, otherwise requests operator approval. Shell security classifies each chain segment (`||` / `&&` / `|` / `;` / newlines), but the operator is prompted once for the full command block — any unapproved segment fails the whole block, and execution always runs the unsplit original. Safe pipeline tails and pure shell no-ops (`true` / `false` / `:` and bare control-flow keywords stranded by chain-splitting) skip without a prompt. In a non-interactive run an unresolved `ask` becomes a denial. In auto mode: non-shell built-ins in `AUTO_ALLOWED_TOOLS` (writes/edits/deletes, `manage_tasks`, `task`, …) auto-allow when not path-restricted; for `run_shell` the gate consults the auto-shell policy — a `deny` rule fails the call, an `ask` rule skips the auto-allow shortcut and proceeds to the normal approval flow, and anything unmatched is auto-allowed. Paths outside the workspace and writes under `.agent-state` still ask. Mutating MCP and unknown built-ins are not blanket-allowed. Newly granted scopes are appended in memory and persisted.
-- **matcher** — Glob matching of an approval pattern against a request subject.
-- **store** — Loads/persists approvals scoped to the working directory.
+- **matcher** — Approval pattern matching via `@intx/authz` `matchPattern` (`*` wildcards). Exact-command grants store a backslash before each metacharacter; those patterns match by equality after unescape (the package has no escape syntax).
+- **authz-grants** — Maps stored approvals into `@intx/authz` `GrantRule`s and evaluates them with `evaluateGrants` (allow-only; Corbits cwd/provider-model filters applied first). Exact-escaped grants bypass the package path and use equality.
+- **store** — Loads/persists approvals scoped to the working directory (Corbits JSON layout; not the package GrantStore).
 
 **Tool wall-clock budget vs. permission prompts.** Each tool `run()` is wrapped by an outer execution watchdog (`src/tui/tool-execution-watchdog.ts`, defaults ~11 min). By default (`tools.waitForApproval`, Settings → Tools, **On**), that budget freezes while the operator is deciding on a permission prompt, so a late approve still runs the tool and the agent waits for the decision instead of timing out under the modal. When **Off**, the budget keeps ticking during the prompt; if it expires first the tool is skipped and the permission modal is dismissed via the budget AbortSignal (auto-deny with a timeout message). The TUI permission queue (`use-gates`) attaches that signal so ghost prompts cannot outlive an already-aborted tool.
 - **types** — `Approval`, `ApprovalScope`, `PermissionRequest`, `ApprovalOutcome`.

docs/ARCHITECTURE.md

@@ -57,6 +57,7 @@
   },
   "dependencies": {
     "@intx/agent": "0.2.2",
+    "@intx/authz": "0.2.2",
     "@intx/inference": "workspace:*",
     "@intx/log": "0.2.2",
     "@intx/storage-isogit": "0.2.2",

package.json

@@ -0,0 +1,64 @@
+import { evaluateGrants, type GrantRule } from "@intx/authz";
+
+import type { Approval } from "./types.js";
+import { matchesPattern } from "./matcher.js";
+
+// Exact-escaped patterns (backslash before metacharacters) cannot round-trip
+// through @intx/authz matchPattern, so those grants are filtered out of the
+// package call and handled by the exact-equality path in matcher.ts.
+function isPackageCompatiblePattern(pattern: string): boolean {
+  return !pattern.includes("\\");
+}
+
+export function approvalToGrantRule(approval: Approval, index: number): GrantRule {
+  return {
+    id: `corbits-approval-${index}`,
+    principalId: null,
+    roleId: null,
+    effect: "allow",
+    origin: "invoker",
+    // resource = subject pattern (command or path); action = tool name.
+    resource: approval.pattern,
+    action: approval.tool,
+    conditions: null,
+    expiresAt: null,
+  };
+}
+
+export type EvaluateApprovalsInput = {
+  tool: string;
+  subject: string;
+  approvals: readonly Approval[];
+  activeProviderModel?: string | undefined;
+  requestCwd?: string | undefined;
+};
+
+// Grant-store evaluation via @intx/authz. Filters provider-model and cwd the
+// same way isApproved does, then asks evaluateGrants for the highest-specificity
+// allow among package-compatible grants. Exact-escaped grants are checked with
+// matchesPattern (equality after unescape) first so a stored exact command is
+// never lost.
+export async function evaluateApprovals(input: EvaluateApprovalsInput): Promise<boolean> {
+  const { tool, subject, approvals, activeProviderModel, requestCwd } = input;
+  const scoped = approvals.filter(
+    (a) =>
+      a.tool === tool &&
+      (a.providerModel === undefined || a.providerModel === activeProviderModel) &&
+      (a.cwd === undefined || a.cwd === requestCwd),
+  );
+  if (scoped.length === 0) return false;
+
+  for (const a of scoped) {
+    if (!isPackageCompatiblePattern(a.pattern) && matchesPattern(subject, a.pattern)) {
+      return true;
+    }
+  }
+
+  const grants = scoped
+    .filter((a) => isPackageCompatiblePattern(a.pattern))
+    .map((a, i) => approvalToGrantRule(a, i));
+  if (grants.length === 0) return false;
+
+  const decision = await evaluateGrants(grants, subject, tool);
+  return decision.effect === "allow";
+}

src/permission/authz-grants.ts

@@ -13,7 +13,8 @@ import {
 import { autoShellRuleForCall } from "./auto-shell-policy.js";
 import { commandReferencesSensitivePath } from "../plugins/secret-guard-plugin.js";
 import { runShellAuthzBlockReason } from "../shell/run-shell-authz.js";
-import { isApproved, matchesPattern, escapeGlobLiteral } from "./matcher.js";
+import { matchesPattern, escapeGlobLiteral } from "./matcher.js";
+import { evaluateApprovals } from "./authz-grants.js";
 import { splitChainedCommand, tokenize, isShellCommentOnly, stripCommentLines } from "./command.js";
 import { createPathRestriction } from "./path-restriction.js";
 import { createWorktreeRootsProvider, type RootsProvider } from "./worktree-roots.js";
@@ -421,7 +422,15 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
             needsOperator = true;
             continue;
           }
-          if (isApproved(request.tool, segment, approvals, activeProviderModel, effectiveCwd)) {
+          if (
+            await evaluateApprovals({
+              tool: request.tool,
+              subject: segment,
+              approvals,
+              activeProviderModel,
+              requestCwd: effectiveCwd,
+            })
+          ) {
             continue;
           }
           // Safe pipeline tails (`| sort`) and pure no-ops (`|| true`) skip.
@@ -467,10 +476,15 @@ export function createPermissionGate(options: PermissionGateOptions): Permission
         continue;
       }
 
-      const alreadyApproved =
-        // Path-arg tools already drop to ask via callTargetsRestricted; grants
-        // match on the path subject the same as before.
-        isApproved(request.tool, request.subject, approvals, activeProviderModel, effectiveCwd);
+      // Path-arg tools already drop to ask via callTargetsRestricted; grants
+      // match on the path subject the same as before.
+      const alreadyApproved = await evaluateApprovals({
+        tool: request.tool,
+        subject: request.subject,
+        approvals,
+        activeProviderModel,
+        requestCwd: effectiveCwd,
+      });
       if (alreadyApproved) {
         continue;
       }

src/permission/gate.ts

@@ -1,38 +1,42 @@
+import { matchPattern } from "@intx/authz";
+
 import type { Approval } from "./types.js";
 
-// Translate a shell-style glob (opencode semantics: `*` = zero or more chars,
-// `?` = exactly one char, `\x` = literal `x` even when `x` is `*`, `?`, or `\`,
-// everything else literal) into an anchored RegExp.
-export function globToRegExp(pattern: string): RegExp {
-  let out = "^";
+// Exact-command grants (see escapeGlobLiteral) store a backslash before every
+// glob metacharacter so a command like `rm -rf build/*` never becomes the
+// wildcard `rm -rf build/*`. @intx/authz's matchPattern has no escape syntax —
+// `*` always wildcards — so escaped patterns are exact-only: strip one level of
+// backslash escapes and require string equality. Unescaped patterns use the
+// package matcher (* wildcards only; no `?`).
+function unescapeExactPattern(pattern: string): string {
+  let out = "";
   for (let i = 0; i < pattern.length; i++) {
     const ch = pattern[i] as string;
     if (ch === "\\" && i + 1 < pattern.length) {
-      const escaped = pattern[++i] as string;
-      out += escaped.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      out += pattern[++i] as string;
       continue;
     }
-    if (ch === "*") {
-      out += ".*";
-    } else if (ch === "?") {
-      out += ".";
-    } else {
-      out += ch.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    }
+    out += ch;
   }
-  out += "$";
-  return new RegExp(out);
+  return out;
 }
 
-// Escape a literal string so it matches only itself when interpreted by
-// globToRegExp, even when it contains `*`, `?`, or `\`. Used when a grant must
-// cover an exact command rather than a pattern.
+function isExactEscapedPattern(pattern: string): boolean {
+  return pattern.includes("\\");
+}
+
+// Escape a literal string so it matches only itself under matchesPattern, even
+// when it contains `*`, `?`, or `\`. Used when a grant must cover an exact
+// command rather than a wildcard pattern.
 export function escapeGlobLiteral(text: string): string {
   return text.replace(/[\\*?]/g, "\\$&");
 }
 
 export function matchesPattern(subject: string, pattern: string): boolean {
-  return globToRegExp(pattern).test(subject);
+  if (isExactEscapedPattern(pattern)) {
+    return subject === unescapeExactPattern(pattern);
+  }
+  return matchPattern(pattern, subject);
 }
 
 // True when any stored approval for this tool matches the subject. The subject

src/permission/matcher.ts

@@ -12,7 +12,8 @@ import {
   isShellNoOp,
   stripCommentLines,
 } from "./command.js";
-import { globToRegExp, matchesPattern, isApproved, escapeGlobLiteral } from "./matcher.js";
+import { matchesPattern, isApproved, escapeGlobLiteral } from "./matcher.js";
+import { evaluateApprovals } from "./authz-grants.js";
 import { classifyTool, buildRequests, isAutoAllowedShellCall } from "./classify.js";
 import { createPermissionGate } from "./gate.js";
 import { createMcpToolPermissionRegistry, registerMcpClientTools } from "../mcp/tool-permissions.js";
@@ -212,20 +213,20 @@ describe("deriveCommandScopes", () => {
   });
 });
 
-describe("globToRegExp / matchesPattern", () => {
-  test("* matches zero or more, ? matches exactly one", () => {
+describe("matchesPattern (@intx/authz + exact escapes)", () => {
+  test("* matches zero or more characters via @intx/authz", () => {
     expect(matchesPattern("npm exec vite", "npm *")).toBe(true);
     expect(matchesPattern("npm", "npm *")).toBe(false);
-    expect(matchesPattern("ab", "a?")).toBe(true);
-    expect(matchesPattern("abc", "a?")).toBe(false);
+    expect(matchesPattern("src/a.ts", "src/*")).toBe(true);
+    expect(matchesPattern("lib/a.ts", "src/*")).toBe(false);
   });
 
-  test("escapes regex metacharacters in literals", () => {
-    expect(globToRegExp("a.b").test("axb")).toBe(false);
+  test("literal patterns match only themselves", () => {
     expect(matchesPattern("a.b", "a.b")).toBe(true);
+    expect(matchesPattern("axb", "a.b")).toBe(false);
   });
 
-  test("a backslash escapes the following char, turning it into a literal", () => {
+  test("a backslash-escaped pattern is exact-only (package has no escape syntax)", () => {
     expect(matchesPattern("echo *", "echo \\*")).toBe(true);
     expect(matchesPattern("echo anything", "echo \\*")).toBe(false);
     expect(matchesPattern("a?b", "a\\?b")).toBe(true);
@@ -253,6 +254,82 @@ describe("isApproved", () => {
   });
 });
 
+describe("evaluateApprovals (@intx/authz evaluateGrants)", () => {
+  const approvals: Approval[] = [
+    { tool: "run_shell", pattern: "npm *" },
+    { tool: "write_file", pattern: "src/*" },
+    { tool: "run_shell", pattern: "rm -rf build/\\*" },
+  ];
+
+  test("allows package-compatible wildcard grants", async () => {
+    expect(
+      await evaluateApprovals({ tool: "run_shell", subject: "npm test", approvals }),
+    ).toBe(true);
+    expect(
+      await evaluateApprovals({ tool: "run_shell", subject: "curl x", approvals }),
+    ).toBe(false);
+    expect(
+      await evaluateApprovals({ tool: "write_file", subject: "src/a.ts", approvals }),
+    ).toBe(true);
+  });
+
+  test("allows exact-escaped grants without treating * as a wildcard", async () => {
+    expect(
+      await evaluateApprovals({
+        tool: "run_shell",
+        subject: "rm -rf build/*",
+        approvals,
+      }),
+    ).toBe(true);
+    expect(
+      await evaluateApprovals({
+        tool: "run_shell",
+        subject: "rm -rf build/../../etc",
+        approvals,
+      }),
+    ).toBe(false);
+  });
+
+  test("respects providerModel and cwd filters", async () => {
+    const scoped: Approval[] = [
+      { tool: "run_shell", pattern: "npm *", providerModel: "openai:gpt-4o" },
+      { tool: "run_shell", pattern: "git *", cwd: "/repo-a" },
+    ];
+    expect(
+      await evaluateApprovals({
+        tool: "run_shell",
+        subject: "npm test",
+        approvals: scoped,
+        activeProviderModel: "openai:gpt-4o",
+      }),
+    ).toBe(true);
+    expect(
+      await evaluateApprovals({
+        tool: "run_shell",
+        subject: "npm test",
+        approvals: scoped,
+        activeProviderModel: "anthropic:opus",
+      }),
+    ).toBe(false);
+    expect(
+      await evaluateApprovals({
+        tool: "run_shell",
+        subject: "git status",
+        approvals: scoped,
+        requestCwd: "/repo-a",
+      }),
+    ).toBe(true);
+    expect(
+      await evaluateApprovals({
+        tool: "run_shell",
+        subject: "git status",
+        approvals: scoped,
+        requestCwd: "/repo-b",
+      }),
+    ).toBe(false);
+  });
+});
+
 describe("classifyTool", () => {
   test("read-only tools allow, side-effecting tools ask", () => {
     expect(classifyTool("read_file")).toBe("allow");