# Add tool permission evaluation logic \(\#46155\) · gitcafe/zed

[View on GitCafe](https://git.cafe/gitcafe/zed/commit/274b1f3ac950b275b30777fdae0bfb01178d9352)

Repository: [gitcafe/zed](https://git.cafe/gitcafe/zed)

Visibility: public

Requested revision: 274b1f3ac950b275b30777fdae0bfb01178d9352

Requested commit: 274b1f3ac950b275b30777fdae0bfb01178d9352

Commit: 274b1f3ac950b275b30777fdae0bfb01178d9352

Tree: 772a6260b85749302f19ae45f84504ba6caf0ab2

Author: Richard Feldman

Committer: GitHub

## Message

```
Add tool permission evaluation logic (#46155)

This builds on https://github.com/zed-industries/zed/pull/46112 (which
should be merged first) and adds the permission evaluation logic and
integrates it with the terminal tool as part of the tool permissions
feature. This is a separate PR for [stacked
diffs](https://newsletter.pragmaticengineer.com/p/stacked-diffs) to make
review easier.

## Changes

- **Add `tool_permissions.rs`** with `decide_permission()` function that
implements:
  - `deny > confirm > allow` precedence hierarchy (security-critical)
  - Case-sensitive and case-insensitive regex matching
  - Integration with existing `always_allow_tool_actions` setting
  - Comprehensive unit tests (15 tests)

- **Integrate with terminal tool**:
  - Commands matching deny rules are blocked immediately with an error
  - Commands matching allow rules proceed without confirmation dialog
  - Commands requiring confirmation show the dialog as before
  - Added integration tests for deny and allow rule scenarios

Co-Authored-By: Claude Opus 4.5

Release Notes:

- N/A

---------

Co-authored-by: Amp <amp@ampcode.com>
```

## Parents

- [b4d69db5240c51c2c5c38b28ef0588508ab28463](https://git.cafe/gitcafe/zed/commit/b4d69db5240c51c2c5c38b28ef0588508ab28463?format=markdown)

[Source at this commit](https://git.cafe/gitcafe/zed/tree/274b1f3ac950b275b30777fdae0bfb01178d9352?format=markdown)