feat: action-based policy API + auto-memory + safe-filter expansion (v1.5)

[brycehans]

Closes #7.

⚠ Breaking change (0.x → 1.x)

This is the major-version cut for toolgate. The policy authoring API changed: policies now declare action: "deny" | "allow" and handlers return string | boolean | void instead of VerdictResult. The engine partitions and runs all deny policies before any allow policies regardless of array order, so a safety-critical deny can't be accidentally overridden by an over-broad allow.

Legacy policies (no action field) still work in 1.x through a compat shim, but it will be removed in 2.0.

→ See docs/migration-1.x.md for the full migration guide (before/after examples, test migration via adaptHandler, renamed built-in policies, order semantics).

Summary

Three logical groups across 11 commits:

Action-based policy API (0.x → 1.0) — 7 commits

Policies now declare action: "deny" | "allow" and return string | boolean | void. The allow()/deny()/next() helpers and VerdictResult are now engine-internal — policy authors no longer touch them. All 63 built-in policies and the project config migrated.

Auto-memory plumbing + small policies — 1 commit (c23dd40)

• Allow writes under ~/.claude/projects/<encoded>/memory/<file> so the auto-memory system in global CLAUDE.md works
• allow-memory-crud: Read/Write/Edit/Update + rm <single-file> for memory paths
• allow-date: date and && chains for reading/formatting time (rejects --set)
• allow-toolgate-test: toolgate test ... (dry-run policy check, never executes)
• Broaden allow-ls-in-project → allow-ls: any path with no dot-prefixed segments
• Broaden allow-bash-find-in-project → allow-bash-find: any path under $HOME

Safe-filter expansion + perl steering — 1 commit (fcfc56c, v1.5)

• rg, sd, choose, xq, htmlq now auto-allowed as mid-pipeline filters with per-tool blocklists (rg --pre/--hostname-bin/-z/-f; choose -i; xq -i/--rawfile/--from-file/-L; htmlq -f/-o; path-like positional args for rg and xq)
• deny-perl-one-liners: catches perl -e/-E/-ne/-pe etc. anywhere in a pipeline/chain and returns a steering message naming the safe-by-design alternatives (rg --replace, sed -n, choose, sd, htmlq, xq, jq)
• allow-bash-grep-in-project tightened so dangerous rg flags don't slip through at head-of-pipeline
• .gitignore: add .DS_Store and tmp/
• Bump 1.0.0 → 1.5.0

Migration guide — 1 commit (6f521ff)

docs/migration-1.x.md covers the breaking change, mechanical migration patterns, test migration, order semantics, and renamed policies.

Test plan

• bun test (currently 1448 pass / 0 fail across 69 files)
• toolgate test Bash '{"command":"perl -ne ..."}' → DENY with steering text
• toolgate test Bash '{"command":"cat README.md | rg -oP ... --replace ... | sort -u"}' (single-quoted regex) → ALLOW
• toolgate test Bash '{"command":"cat README.md | xq -i /tmp/out.xml"}' → ASK (not auto-allowed)
• Verify auto-memory write end-to-end: trigger a memory save in a real Claude Code session and confirm no prompt for ~/.claude/projects/.../memory/*.md
• Spot-check toolgate list to confirm all built-in policies load post-refactor
• toolgate audit against an existing project's .claude/settings.local.json — should still produce a useful report
• Walk through docs/migration-1.x.md against a downstream project (if any) — confirm the recipe actually compiles

🤖 Generated with Claude Code