Drop native model tiers; HITL vs free-reign Auto; project path grants

[TheGreatAxios]

Summary

Product simplification for CL-5479 (landed in slices on this branch):

1. Project path grants (this commit) — @ files and dirs outside the workspace become read-only sources; persisted in global settings keyed by project identity.
2. HITL vs Auto — not yet — HITL = current ask behavior; Auto = free reign (no permission prompts).
3. Drop native model tiers — not yet — providers + default/favorite only (related: CL-5192, CL-5200, CL-5196).

Slice A — path grants (04a971c)

• @path outside the workspace mints a read-only grant (file = that file; dir = that tree)
• Stored in global settings as projectPathGrants[projectKey] — no repo-local grant file
• Under HITL: reads under granted paths auto-allow; writes still ask
• Sensitive/secret paths remain hard-blocked
• Live grant list + path-restriction cache invalidate on new grants
• Unit tests: path-grants, path-restriction grant coverage, at-mention resolution

Plan: docs/plans/hitl-auto-path-grants.md

Test plan

• Path grants: file + dir @ outside workspace auto-allow reads; secret paths still blocked; no repo-local grant file
• Unit tests: path-grants.test.ts, path-restriction.test.ts, at-mention-resolution.test.ts (29 pass)
• Auto: no permission prompts for tools; UX warning when enabling
• HITL: existing secret dump-lock / OOM hard-denies / workspace asks preserved under rename
• Tiers: settings load with legacy tiers key; no product surface for fast/standard/clever
• Docs: PRODUCT / ARCHITECTURE updated when remaining slices land

Partial progress toward CL-5479 (path grants only; HITL/Auto + tiers still open).

[linear-code]

CL-5479

[TheGreatAxios]

This branch is not mergeable against current main. It predates the OpenTUI cutover by 51 commits, and three of the files it modifies no longer exist:

• src/tui/app.tsx — deleted
• src/tui/hooks/use-gates.ts — deleted
• src/tui/hooks/use-message-pipeline.ts — deleted

A merge trial produces modify/delete conflicts on all three, plus content conflicts in src/config/settings.ts and src/tui/runner.ts. Resolving them would reintroduce the deleted Ink modules.

The permission work is unaffected and worth keeping — src/permission/path-grants.ts, path-restriction.ts, admin.ts, gate.ts and their tests are all in files that still exist. That portion is being rebuilt against current main with the gate wired to the OpenTUI surface.

The tier-removal plan in docs/plans/hitl-auto-path-grants.md is superseded by in-flight work on the model surface.

[TheGreatAxios]

Now fully superseded.

The tier removal landed in main via #363, built against current code — ProviderTier, TierConfig, settings.tiers, resolveTier, tierProviderRefs, /fast /standard /clever, task(tier=), and profile.tier are all gone, with a verified settings migration and net -279 lines.

The path-grant half is being rescoped on a separate branch. A security review found the durable grant unsafe in this shape: a directory mention minted a recursive subtree read grant, grants persisted to global settings permanently with no revoke path and no visibility in /permissions, and they were consulted by unattended exec runs — so interactive consent widened what a later headless run could read. The mention already inlines file content, so the grant bought nothing for the actual request. What survives is the mention-resolution improvement alone.

Nothing in this branch remains to merge.

[TheGreatAxios]

Closing — everything in this branch has shipped by another route, and it cannot be merged as-is.

Tier removal landed via #363, rebuilt against current code: ProviderTier, TierConfig, settings.tiers, resolveTier, tierProviderRefs, /fast /standard /clever, task(tier=), and profile.tier are all gone, with a verified settings migration and net -279 lines.

Path grants were rescoped after a security review and shipped as the mention-inlining half only. The durable grant was dropped: a directory mention minted a recursive subtree read grant, grants persisted permanently to global settings with no revoke path and no visibility in /permissions, and exec consulted them — so an interactive mention widened what a later unattended run could read. A working TOCTOU was also demonstrated: replacing a granted directory with a symlink made the grant follow it. Since the mention already inlines file content, the grant only ever authorized reads nobody asked for.

This branch cannot merge regardless. It predates the OpenTUI cutover by 51 commits and modifies three files deleted in it — src/tui/app.tsx, src/tui/hooks/use-gates.ts, src/tui/hooks/use-message-pipeline.ts — producing modify/delete conflicts that could only be resolved by reintroducing dead Ink modules.

Reopen if something here was missed.