Provider permissions: enforcement hook in permission system

[jeonghun-jj-lee]

Important

Decision Surface

Problem: The tier resolution engine exists but is not wired into actual tool-call gating. Tools still go through the global permission system regardless of model.

Approach: Insert a resolveProviderPermission() call in permission.ts BEFORE the existing assert(). If the provider layer returns "allow", suppress the ask prompt. If "deny", block immediately. If undefined (no opinion), fall through to existing behavior.

Scope: Wiring the resolution engine into the permission hot path. The LLM runner must pass the active model ID into tool dispatch.

---

Acceptance Criteria

• Every tool call passes through provider permission resolution before the existing assert()
• A tier "allow" for action+directory suppresses the normal permission ask prompt (user is never prompted)
• A tier "deny" blocks the tool call immediately with a clear error message naming the tier and directory
• A tier "ask" falls through to the existing permission system (user gets the normal prompt)
• When no provider rule matches (undefined), the existing permission system handles it unchanged
• The active model ID is available in the permission resolution context (passed from the LLM runner)
• On model switch mid-session, subsequent tool calls resolve against the NEW model's tier immediately

Key Decisions

#	Decision	Rationale
1	Provider layer runs first, is authoritative	"Allow" means the user explicitly trusts this tier — double-prompting is noise
2	Deny message names the tier	User understands WHY it was blocked and can reconfigure if needed
3	Model ID threaded through tool dispatch context	Minimal coupling — one new field in the existing tool context, not a restructure

Testing Decisions

• Test "allow" tier + directory → tool executes without prompt
• Test "deny" tier + directory → tool blocked with error message
• Test "ask" tier → falls through to existing permission (mock assert called)
• Test undefined (unassigned model) → existing permission system handles it
• Test model switch → next tool call uses new model's tier
• Extends Provider permissions: tier resolution engine #165's test surface for integration

Constraints & Invariants

• The provider permission check must not add measurable latency (it is a map lookup + glob match — no I/O)
• Must not break existing behavior for users with no providerPermissions config (undefined → full fallthrough)

Source

Part of #163
Blocked by #164, #165