Fix read-only Agent Mode permissions

[AnthonyRonning]

Status

Ready for testing.

Closes #619.

Summary

• Replace the broad Goose developer defaults with Maple-owned Pi-style read, shell, edit, and write tools, plus read_image.
• Keep Goose on its public permission path while Maple applies the selected policy at every tool boundary, including policy changes during an active response.
• In Read only, automatically allow bounded local file reads and shell commands that the LLM classifier identifies as read-only. Ambiguous, mutating, executable, or dangerous commands fall back to the normal approval card.
• Support remote HTTP(S) images through read_image; remote images still require approval in Read only.
• Bound file/image/edit work and shell output. Cancellation, timeout, and output overflow terminate the complete process tree on Unix and Windows while successful background jobs keep Pi/Goose behavior.

User-visible behavior

• Common read commands and chains such as pwd && grep ... | head ... no longer show an unnecessary approval card in Read only.
• Switching to Allow all takes effect immediately, including pending approval cards.
• Switching to Read only becomes visible only after the restrictive backend boundary is active. An already-running tool continues; subsequent tool requests use Read only.
• The classifier fails closed: any denial, malformed response, timeout, or uncertainty goes to manual approval.

Validation

• cargo test --all-targets — 93 passed
• bun test — 72 passed
• bun run build
• just rust-lint — formatting and Clippy passed
• bun run lint — 0 errors; 12 pre-existing warnings
• macOS GUI: read-only shell chain ran without a card
• macOS GUI: switched from Allow all to Read only during a running shell; the next write required approval and was denied
• macOS GUI: unbounded shell output stopped at the 50 KB safety limit
• focused process-tree tests for background jobs, cancellation, timeout, and late output overflow
• independent permission-race, tool-safety, and final-diff reviews found no high/critical issues

Testing notes

The Windows Job Object path is implemented and its dependency features resolve correctly, but it was not runtime-tested on the macOS development host. Remote read_image fetches succeed; a separate provider-specific GLM image-history follow-up can still return a 500 on a later model turn and is outside this PR.

---

Summary by CodeRabbit

• New Features

  • Added session-level Agent Mode permission controls that can be changed while a session is running.
  • Added developer tools for reading, editing, writing, running shell commands, and viewing images.
  • Added automatic handling for eligible read-only requests in Smart Approve mode.
  • Added safeguards for command execution, file access, cancellation, timeouts, and output limits.

• Bug Fixes

  • Prevented outdated permission settings from overriding newer selections.
  • Improved permission updates, session restoration, and approval handling consistency.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: aa193b86-f51a-4e30-8f60-490004b07c8c

📥 Commits

Reviewing files that changed from the base of the PR and between deedf8f and 46c83e7.

⛔ Files ignored due to path filters (1)

• frontend/src-tauri/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (7)

• frontend/src-tauri/Cargo.toml
• frontend/src-tauri/src/agent.rs
• frontend/src-tauri/src/agent/developer_tools.rs
• frontend/src-tauri/src/agent/shell_permission.rs
• frontend/src-tauri/src/lib.rs
• frontend/src/components/AgentMode.tsx
• frontend/src/services/agentRuntimeService.ts

---

📝 Walkthrough

Walkthrough

Agent Mode now uses session-scoped, mutable permission modes. Maple provides bounded developer tools, classifies eligible read-only requests, enforces routing through Maple-owned policies, and synchronizes frontend mode changes with runtime state.

Changes

Agent permission control

Layer / File(s)	Summary
Permission contracts and classification frontend/src-tauri/Cargo.toml, frontend/src-tauri/src/agent/shell_permission.rs, frontend/src-tauri/src/agent.rs	Adds read-only request eligibility, model-based classification, permission outcomes, and platform dependencies.
Bounded developer tool client frontend/src-tauri/src/agent/developer_tools.rs, frontend/src-tauri/src/agent.rs	Adds MCP-backed read, edit, write, shell, and image tools with bounds, cancellation, staging, process control, and tests.
Session runtime enforcement frontend/src-tauri/src/agent.rs, frontend/src-tauri/src/lib.rs	Stores session modes, adds the permission-mode command, keeps Goose routing fixed, persists extension state, and updates streaming permission handling.
Frontend mode synchronization frontend/src/components/AgentMode.tsx, frontend/src/services/agentRuntimeService.ts	Synchronizes selected and committed modes, handles asynchronous updates and rollback, and prevents stale modes from being sent.

Estimated code review effort: 5 (Critical) | ~120 minutes

Poem

I’m a bunny with tools in a Maple-grown tray,
Reading bright files without delay.
Modes hop safely from screen into run,
Shells ask when needed, reads greet the sun.
With locks, little carrots, and policies tight,
The agent bounds onward through day and night.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	Clear, concise title that matches the main change: read-only Agent Mode permission handling.
Linked Issues check	✅ Passed	The changes auto-allow read-only tool calls like local reads and grep-style shell commands under the configured read-only policy.
Out of Scope Changes check	✅ Passed	All major changes support read-only permission routing and live policy updates; no unrelated code changes stand out.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex-maple-agent-read-permissions-maple

---

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

Deploying maple with    Cloudflare Pages

Latest commit:	46c83e7
Status:	✅  Deploy successful!
Preview URL:	https://62a9beda.maple-ca8.pages.dev
Branch Preview URL:	https://codex-maple-agent-read-permi.maple-ca8.pages.dev

View logs

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.