fix(permission): close symlink, protected-path, and glob bypasses

[hakula139]

Summary

The permission gate introduced in #95 could be bypassed with symlinks, spelling variants, and broad globs. A call that the gate resolved to one path could also end up writing to another. This PR closes those gaps, protects repository metadata and configuration files, and makes the approval modal show the full call before accepting an answer.

• Path resolution:
  • GateTarget::for_path walks the path one component at a time, as the kernel does. It follows every symlink, including dangling ones, and resolves .. from the walk's current position. A path whose location cannot be determined is never auto-allowed.
  • check_permission pins the path field to the resolved path before previewing and running the call.
  • read and edit recheck the opened file. On Unix, file tools open files with O_NOFOLLOW, and reads also use O_NONBLOCK. The write tool creates new files with create_new.
• Deny rules:
  • Each deny rule matches both the resolved path and the path as written in the call, with names normalized for case, Unicode compatibility, default-ignorable code points, and trailing dots and spaces.
  • A rule whose literal prefix is a symlink also matches the prefix's resolved location.
  • Allow rules still match exactly, so only deny rules can over-match.
• Protected paths:
  • Edits under .git/hooks, editor and devcontainer configuration, .envrc, shell rc files, .cargo/config.toml, rust-toolchain, .claude/ settings and hooks, ox.toml, and oxide-code's own directories always require approval, even under edit(**).
  • In-cwd auto-allow is disabled when cwd is /, $HOME, or an ancestor of $HOME, and on Unix for files with a second hard link.
• Rule grammar:
  • Globs use a literal separator, so * stops at /. ~/ expands.
  • Rules address permission classes (read, edit, bash), so a read(.env) deny also covers grep and glob. An unknown class makes configuration loading fail.
  • yolo retains user and project deny rules.
• Approval modal:
  • Rows wrap, and long bodies scroll with a position line.
  • Control and zero-width characters render as escapes, and unusual whitespace in commands is shown visibly.
  • Approval requires an explicit y key press. Keys received within 300 ms of the previous key are dropped, preventing type-ahead or a pasted burst from approving the call.
• Docs: the permission design doc describes the current pipeline and its remaining gaps: intermediate-directory swaps, Windows 8.3 names, hard links and final-component swaps, and anything bash touches. The configuration guide gains a [permission] section.

Test plan

• cargo fmt --all --check and cargo clippy --all-targets -- -D warnings passed at the tip and on each commit.
• cargo test: 2244 passed. Agent-turn tests cover a deny rule, mid-turn approval, and a write through a dangling symlink.
• cargo llvm-cov changed lines: 1954 / 1961. The 7 misses are test-only panic arms and a root-user skip.
• Targeted mutants that disable each fix all fail the suite.
• pnpm lint and pnpm spellcheck passed.
• Windows behavior was not exercised. The gaps listed above remain open.

[codecov]

Codecov Report

❌ Patch coverage is 99.63712% with 7 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/oxide-code/src/agent.rs	99.09%	2 Missing ⚠️
crates/oxide-code/src/permission.rs	99.71%	2 Missing ⚠️
crates/oxide-code/src/tool/write.rs	97.53%	2 Missing ⚠️
crates/oxide-code/src/tool.rs	99.50%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!