(MOT-3873) feat: native code mode for the harness

approval-gate/src/config.rs

@@ -11,7 +11,7 @@ use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 use serde_json::{json, Value};
 
-use crate::permissions::{default_rule_specs, parse_rules_from_config, Permissions, RuleSpec};
+use crate::permissions::{parse_rules_from_config, Permissions, RuleSpec};
 use crate::types::PermissionMode;
 
 /// The shipped permission rules as a JSON array of shorthand strings — the
@@ -20,13 +20,7 @@ use crate::types::PermissionMode;
 /// [`crate::permissions::default_rule_specs`] so the in-memory defaults and
 /// the console-editable list never drift.
 pub fn default_rules_value() -> Vec<Value> {
-    default_rule_specs()
-        .into_iter()
-        .filter_map(|r| match r {
-            RuleSpec::Shorthand(s) => Some(Value::String(s)),
-            _ => None,
-        })
-        .collect()
+    crate::permissions::default_rules::default_rule_values()
 }
 
 fn default_rules() -> Vec<Value> {
@@ -50,8 +44,27 @@ fn rules_schema(_gen: &mut schemars::r#gen::SchemaGenerator) -> schemars::schema
         "type": "array",
         "description": "Permission rules for the gate hook (first match wins). Each entry is a string or object.\n\nString shorthands: bare id/glob → allow; prefix ! → deny; no match → hold.\n\nStructured objects: { \"function\": \"shell::*\", \"action\": \"allow\" | \"deny\", \"modes\": [\"auto\"] } — optional modes scope the rule to manual, auto, or full (omit for all modes). Use modes: [\"auto\"] on allow rules to seed the auto-mode trust list.\n\nExamples:\n• \"state::get\" — allow reads\n• \"shell::*\" — allow any shell worker call\n• \"!approval::*\" — deny the approval decision plane (shipped default)\n• { \"function\": \"web::fetch\", \"action\": \"allow\", \"modes\": [\"auto\"] } — auto-mode trust",
         "items": {
-            "type": "string",
-            "description": "Function id or glob. Allow: \"web::fetch\", \"coder::*\". Deny: \"!configuration::*\", \"!router::chat\"."
+            "oneOf": [
+                {
+                    "type": "string",
+                    "description": "Function id or glob. Allow: \"web::fetch\", \"coder::*\". Deny: \"!configuration::*\", \"!router::chat\"."
+                },
+                {
+                    "type": "object",
+                    "description": "Structured rule; optional modes scope it to session permission modes (auto-scoped allows also seed the auto-mode trust list).",
+                    "required": ["function", "action"],
+                    "properties": {
+                        "rule_id": { "type": "string" },
+                        "function": { "type": "string" },
+                        "action": { "type": "string", "enum": ["allow", "deny"] },
+                        "modes": {
+                            "type": "array",
+                            "items": { "type": "string", "enum": ["manual", "auto", "full"] }
+                        },
+                        "args": { "type": "object" }
+                    }
+                }
+            ]
         },
         "default": default_rules_value(),
     }))
@@ -198,7 +211,15 @@ mod tests {
         let cfg = WorkerConfig::default();
         assert_eq!(cfg.default_mode, PermissionMode::Manual);
         assert!(!cfg.rules.is_empty());
-        assert!(cfg.auto_allow_seed().is_empty());
+        // The shipped defaults seed auto-mode trust for the read-only
+        // coder surface (and nothing else).
+        assert_eq!(
+            cfg.auto_allow_seed(),
+            crate::permissions::default_rules::READ_ONLY_CODER
+                .iter()
+                .map(|s| s.to_string())
+                .collect::<Vec<_>>()
+        );
         assert_eq!(cfg.grant_reask_limit, 3);
     }
 

approval-gate/src/functions/gate.rs

@@ -15,7 +15,7 @@ use crate::denial::{gate_unavailable_envelope, human_only_denial, permissions_de
 use crate::error::ApprovalError;
 use crate::pending;
 use crate::permissions::Decision;
-use crate::redact::redact;
+use crate::redact::redact_for;
 use crate::session;
 use crate::settings;
 use crate::types::{
@@ -125,7 +125,7 @@ async fn hold(deps: &Deps, input: &HookInput, call: &HookCall) -> HookOutput {
         turn_id: input.turn_id.clone(),
         function_call_id: call.id.clone(),
         function_id: call.function_id.clone(),
-        arguments_excerpt: redact(&call.arguments),
+        arguments_excerpt: redact_for(&call.function_id, &call.arguments),
         pending_at,
         session_title,
         session_description,

approval-gate/src/permissions/default_rules.rs

@@ -2,15 +2,52 @@
 //! `approval-gate` configuration entry omits `rules` (or they fail to
 //! compile). First match wins; no match → **hold**.
 //!
-//! The shipped defaults deny **only this worker's `approval::*` surface**
-//! (the 12 registered functions — see `functions::catalog`). Every
-//! other function_id holds until the operator adds custom `rules`.
+//! The shipped defaults:
+//! - deny **only this worker's `approval::*` surface** (the registered
+//!   functions — see `functions::catalog`);
+//! - allow the READ-ONLY coder surface in **auto mode only** (context /
+//!   info / read-file / search / tree / list-folder), so an auto-mode
+//!   coding session prompts on writes and exec, not on every read.
+//!   These auto-scoped allows also feed `auto_allow_seed`. Manual mode
+//!   is unaffected — mode-scoped rules do not match there.
+//!
+//! Every other function_id holds until the operator adds custom `rules`.
+
+use serde_json::{json, Value};
+
+/// The read-only coder functions trusted in auto mode by default.
+pub const READ_ONLY_CODER: [&str; 6] = [
+    "coder::context",
+    "coder::info",
+    "coder::read-file",
+    "coder::search",
+    "coder::tree",
+    "coder::list-folder",
+];
 
 /// Shorthand rule strings compiled into [`super::default_permissions`].
 pub fn default_rule_strings() -> Vec<&'static str> {
     vec!["!approval::*"]
 }
 
+/// The full default `rules` array as configuration JSON values:
+/// shorthands plus the structured auto-scoped read-only coder allows.
+pub fn default_rule_values() -> Vec<Value> {
+    let mut out: Vec<Value> = default_rule_strings()
+        .into_iter()
+        .map(|s| Value::String(s.to_string()))
+        .collect();
+    for fid in READ_ONLY_CODER {
+        out.push(json!({
+            "rule_id": format!("seed-auto-{}", fid.replace("::", "-")),
+            "function": fid,
+            "action": "allow",
+            "modes": ["auto"],
+        }));
+    }
+    out
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -27,6 +64,51 @@ mod tests {
         assert_eq!(default_rule_strings(), ["!approval::*"]);
     }
 
+    #[test]
+    fn default_values_add_auto_scoped_read_only_coder_allows() {
+        let values = default_rule_values();
+        assert_eq!(values.len(), 1 + READ_ONLY_CODER.len());
+        for v in &values[1..] {
+            assert_eq!(v["action"], "allow");
+            assert_eq!(v["modes"], json!(["auto"]));
+        }
+    }
+
+    #[test]
+    fn read_only_coder_allows_in_auto_hold_in_manual() {
+        use crate::permissions::{parse_rules_from_config, Permissions};
+        let p = Permissions::compile(&parse_rules_from_config(&Value::Array(
+            default_rule_values(),
+        )))
+        .unwrap();
+        for fid in READ_ONLY_CODER {
+            assert!(
+                matches!(
+                    p.check(fid, &json!({}), PermissionMode::Auto),
+                    Decision::Allow { .. }
+                ),
+                "{fid} should allow in auto"
+            );
+            assert!(
+                matches!(
+                    p.check(fid, &json!({}), PermissionMode::Manual),
+                    Decision::NeedsApproval
+                ),
+                "{fid} should still hold in manual"
+            );
+        }
+        // Writes and exec stay gated even in auto.
+        for fid in ["coder::update-file", "coder::apply-patch", "shell::exec"] {
+            assert!(
+                matches!(
+                    p.check(fid, &json!({}), PermissionMode::Auto),
+                    Decision::NeedsApproval
+                ),
+                "{fid} should hold in auto"
+            );
+        }
+    }
+
     #[test]
     fn default_rules_deny_every_registered_function() {
         let p = default_permissions();

approval-gate/src/permissions/mod.rs

@@ -2,7 +2,7 @@
 //! Rules live in the `approval-gate` configuration entry (`GateDefaults::rules`).
 
 mod compile;
-mod default_rules;
+pub mod default_rules;
 mod types;
 
 pub use compile::{
@@ -171,10 +171,7 @@ pub fn parse_rules_from_config(value: &Value) -> Vec<RuleSpec> {
 }
 
 pub fn default_rule_specs() -> Vec<RuleSpec> {
-    default_rules::default_rule_strings()
-        .into_iter()
-        .map(|s| RuleSpec::Shorthand(s.to_string()))
-        .collect()
+    parse_rules_from_config(&Value::Array(default_rules::default_rule_values()))
 }
 
 pub fn default_permissions() -> Permissions {

approval-gate/src/redact.rs

@@ -53,28 +53,62 @@ pub fn clip(s: &str) -> String {
     }
 }
 
+/// Coder write functions whose arguments must reach approval UIs intact —
+/// a clipped patch or content op can't render as a diff preview. Secret-key
+/// redaction still applies; `FULL_PAYLOAD_BUDGET_BYTES` guards notification
+/// channels against unbounded records.
+const FULL_PAYLOAD_FUNCTIONS: [&str; 5] = [
+    "coder::update-file",
+    "coder::create-file",
+    "coder::apply-patch",
+    "coder::move-file",
+    "coder::delete-file",
+];
+
+pub const FULL_PAYLOAD_BUDGET_BYTES: usize = 64 * 1024;
+
+/// Function-aware excerpt: coder writes keep their payload unclipped (up to
+/// the budget) so approval cards can show real diffs; everything else gets
+/// the classic clipped excerpt.
+pub fn redact_for(function_id: &str, value: &Value) -> Value {
+    if FULL_PAYLOAD_FUNCTIONS.contains(&function_id) {
+        let full = redact_at(value, 0, false);
+        let within_budget = serde_json::to_string(&full)
+            .map(|s| s.len() <= FULL_PAYLOAD_BUDGET_BYTES)
+            .unwrap_or(false);
+        if within_budget {
+            return full;
+        }
+    }
+    redact(value)
+}
+
 /// Walk the value tree, redacting secret-keyed values and clipping long
 /// strings. Returns a brand-new tree.
 pub fn redact(value: &Value) -> Value {
-    redact_at(value, 0)
+    redact_at(value, 0, true)
 }
 
-fn redact_at(value: &Value, depth: usize) -> Value {
+fn redact_at(value: &Value, depth: usize, clip_strings: bool) -> Value {
     match value {
-        Value::String(s) => Value::String(clip(s)),
+        Value::String(s) if clip_strings => Value::String(clip(s)),
+        Value::String(s) => Value::String(s.clone()),
         Value::Array(_) | Value::Object(_) if depth >= MAX_REDACT_DEPTH => {
             Value::String(MAX_DEPTH_SENTINEL.to_string())
         }
-        Value::Array(items) => {
-            Value::Array(items.iter().map(|v| redact_at(v, depth + 1)).collect())
-        }
+        Value::Array(items) => Value::Array(
+            items
+                .iter()
+                .map(|v| redact_at(v, depth + 1, clip_strings))
+                .collect(),
+        ),
         Value::Object(map) => Value::Object(
             map.iter()
                 .map(|(k, v)| {
                     let redacted = if is_secret_key(k) {
                         Value::String(REDACTED.to_string())
                     } else {
-                        redact_at(v, depth + 1)
+                        redact_at(v, depth + 1, clip_strings)
                     };
                     (k.clone(), redacted)
                 })
@@ -161,6 +195,39 @@ mod tests {
         assert_eq!(depth, MAX_REDACT_DEPTH);
     }
 
+    #[test]
+    fn coder_writes_keep_payload_unclipped() {
+        let patch = "x".repeat(5000);
+        let out = redact_for("coder::apply-patch", &json!({ "patch": patch }));
+        assert_eq!(out["patch"].as_str().unwrap().len(), 5000);
+        // Secrets still redact in full mode.
+        let out = redact_for(
+            "coder::create-file",
+            &json!({ "content": "c".repeat(400), "api_key": "sk" }),
+        );
+        assert_eq!(out["api_key"], json!("<redacted>"));
+        assert_eq!(out["content"].as_str().unwrap().len(), 400);
+    }
+
+    #[test]
+    fn non_coder_functions_still_clip() {
+        let out = redact_for("shell::exec", &json!({ "cmd": "y".repeat(300) }));
+        assert_eq!(
+            out["cmd"].as_str().unwrap().chars().count(),
+            ARGS_EXCERPT_LEN_CAP + 1
+        );
+    }
+
+    #[test]
+    fn full_payload_budget_falls_back_to_clipping() {
+        let huge = "z".repeat(FULL_PAYLOAD_BUDGET_BYTES + 1024);
+        let out = redact_for("coder::apply-patch", &json!({ "patch": huge }));
+        assert_eq!(
+            out["patch"].as_str().unwrap().chars().count(),
+            ARGS_EXCERPT_LEN_CAP + 1
+        );
+    }
+
     #[test]
     fn never_mutates_input() {
         let input = json!({ "password": "x", "nested": { "api_key": "y" } });