openclaw/dist/session-permission-exec-mode-CJHB47SR.js

Multi-channel AI gateway with extensible messaging integrations

import { S as resolveExecPolicyForMode, a as maxAsk, o as minSecurity } from "./exec-approvals-policy-CCFUzTzd.js";
//#region src/agents/session-permission-exec-mode.ts
const EXEC_MODE_BY_PERMISSION_MODE = {
	"read-only": "deny",
	guarded: "ask",
	workspace: "auto",
	full: "full"
};
const SESSION_PERMISSION_BY_EXEC_MODE = {
	deny: "read-only",
	allowlist: "guarded",
	ask: "guarded",
	auto: "workspace",
	full: "full"
};
function resolveSessionPermissionCoreToolPolicy(policy) {
	const workspaceOnly = policy.mode !== "full";
	return {
		workspaceOnly,
		readOnly: policy.mode === "read-only",
		applyPatchWorkspaceOnly: workspaceOnly,
		execMode: EXEC_MODE_BY_PERMISSION_MODE[policy.mode],
		bypassHostApprovalFloors: policy.mode === "full"
	};
}
function resolveSessionPermissionExecMode(policy) {
	return resolveSessionPermissionCoreToolPolicy(policy).execMode;
}
function resolveSessionPermissionExecPolicy(policy, overrides) {
	const mode = resolveSessionPermissionExecMode(policy);
	const base = resolveExecPolicyForMode(mode);
	const override = overrides?.mode ? resolveExecPolicyForMode(overrides.mode) : base;
	const security = minSecurity(base.security, minSecurity(override.security, overrides?.security ?? "full"));
	const ask = maxAsk(base.ask, maxAsk(override.ask, overrides?.ask ?? "off"));
	return {
		mode: security === base.security && ask === base.ask ? mode : void 0,
		security,
		ask
	};
}
//#endregion
export { resolveSessionPermissionExecPolicy as i, resolveSessionPermissionCoreToolPolicy as n, resolveSessionPermissionExecMode as r, SESSION_PERMISSION_BY_EXEC_MODE as t };