Module permissions 

Rule-based permission engine.

PermissionEngine evaluates an ordered list of PermissionRules against a tool call. Rules are matched on tool name (with optional * wildcard suffix), a command prefix (for shell-style tools), and a cwd prefix. The result of the last matching rule wins — order rules from general to specific.

Structs

PermissionEngine

Ordered list of permission rules consulted by the executor before every tool call.

PermissionRule

A single permission rule. Use the constructor / builder methods to build one.

Enums

RuleDecision

Outcome of a permission check for a tool call.

ShellKind

Shell dialect used for command-prefix extraction and matching.