smelt.permissions¶

Tier: Mixed - Contains both Host and UiHost functions; each function below lists its exact tier.

Classification: Supported - Primary alpha facade for user config and plugins.

Inspect, revoke, and extend permission policy state, or synchronize live session and persisted grants.

smelt.permissions.check¶

fun(mode_str: string, bucket: string, value: string): string

Tier: Host - Available in every runtime, including headless mode.

Decide a tool-specific pattern bucket (e.g. ("normal", "bash", "git status")) against the current policy. Returns "allow", "ask", or "deny"; defaults to "ask" when no app context is available.

smelt.permissions.check_tool¶

fun(mode_str: string, name: string): string

Tier: Host - Available in every runtime, including headless mode.

Decision primitives for tool decide callbacks. Returns "allow"/"ask"/"deny".

smelt.permissions.extend¶

fun(spec: smelt.permissions.PolicySpec): nil

Types: smelt.permissions.PolicySpec

Tier: Host - Available in every runtime, including headless mode.

Extend the generated permission policy with user rules. Supports tools, effects, and patterns sections under default or any mode name.

smelt.permissions.grant_session¶

fun(grant: smelt.permissions.SessionPathGrant): nil

Types: smelt.permissions.SessionPathGrant

Tier: UiHost - Requires a terminal UI; calling these from headless mode raises.

Add one session-scoped grant. Currently supports { kind = "path", mode?, tool, access = "read"|"write", path_prefix } for tool-specific path access. Omit mode for mode-independent path trust; set mode to scope the grant to one mode.

smelt.permissions.list¶

fun(): smelt.permissions.ListResult

Types: smelt.permissions.ListResult

Tier: Host - Available in every runtime, including headless mode.

Return current permission rules and persisted scope revisions. Pass workspace_revision or repository_revision back as the matching scope replacement revision in smelt.permissions.sync().

smelt.permissions.revoke¶

fun(spec: smelt.permissions.RevokeSpec): boolean

Types: smelt.permissions.RevokeSpec

Tier: UiHost - Requires a terminal UI; calling these from headless mode raises.

Remove one exact session, workspace, or repository permission entry transactionally. Returns false when the entry no longer exists.

smelt.permissions.sync¶

fun(spec: smelt.permissions.SyncSpec): nil

Types: smelt.permissions.SyncSpec

Tier: UiHost - Requires a terminal UI; calling these from headless mode raises.

Replace selected permission entries. Omitted fields are unchanged. Persisted replacements require the revision from smelt.permissions.list() and a call may replace only one of workspace or repository, so a stale snapshot cannot discard concurrent grants.