feat(harness): wire the permission engine + make Plan Mode enforced

[TYRMars]

Why

Jarvis's permission and Plan-Mode layer was built on both ends but disconnected in the middle — the same "ported but never wired" shape as the earlier HITL work:

• RuleApprover / MemoryPermissionStore / modeDefault / the glob matcher were complete and unit-tested in packages/server/src/permissions-routes.ts and exported from @jarvis/server — but constructed nowhere. So JARVIS_PERMISSION_MODE was parsed, logged at startup, and reported in /v1/server/info while no approver ever read it: auto, bypass and plan all behaved exactly like ask, and /v1/permissions* always 503'd.
• ToolRegistry.specsFiltered was dead code and Tool.isTerminal was metadata the agent loop never read, so exit_plan did not end a turn.
• The web SPA already shipped ModeBadge, PlanModeBanner, PlanProposedCard, BypassBanner and DecisionSourceChip, and sent set_mode / accept_plan / refine_plan — the server answered unknown frame type.

Net effect before this change: an operator who set JARVIS_PERMISSION_MODE=plan got no protection at all, and one who set auto got no convenience.

Closes P1 item 5 of docs/proposals/opencode-borrow.zh-CN.md.

What changed

@jarvis/core

• New mode.ts — the AgentMode vocabulary plus an AsyncLocalStorage mode-signal channel shaped like the existing plan.ts / hitl.ts.
• AgentConfig.toolFilter is applied twice: once to build the request catalogue (specsFiltered), and again at dispatch in runOne. The second application is the load-bearing one — it's what makes Plan Mode a guard rather than a hint, since a write tool named from conversation history or hallucination is refused instead of run.
• Tool.isTerminal now ends the turn on both the blocking and streaming paths, skipping the rest of the batch and not returning to the model. A denied terminal call does not terminate, since it never ran.

@jarvis/server

• Each chat socket builds a SocketModeHandle (seeded from the store's persisted default_mode) and a RuleApprover wrapping its ChannelApprover.
• New frames in: set_mode / accept_plan / refine_plan. New frames out: permission_mode{mode,via?} / plan_proposed{plan}, plus HitSource attached to approval_decision.
• Turn frames go to the client and into the chatRuns reconnect replay buffer in the same shape, so a replaying client sees what a live one saw.
• PermissionMode becomes an alias of core's AgentMode so the two vocabularies can't drift.

packages/jarvis-app — constructs MemoryPermissionStore(config.permissionMode) onto AppState, so the env var gates real dispatch and the REST routes stop 503-ing.

Reviewer notes

Two judgement calls worth a look:

1. Auto-allowed calls still emit an approval_request card. Core yields the request event before awaiting the approver, so it can't know the approver will approve instantly. Suppressing it would make auto-allowed tool calls invisible in the audit trail, so provenance rides on the decision frame instead (source: {kind: "mode_default" | "rule" | "user_prompt"}) — which is exactly what the pre-existing DecisionSourceChip was built to render.
2. mode_changed is not forwarded raw. The WS applies it to its own mode handle and republishes as permission_mode{via:"tool"}, which is what the client actually listens for.

Behaviour change to be aware of: anyone currently running with JARVIS_PERMISSION_MODE=auto or bypass will now genuinely skip approval prompts. That is the documented intent of the flag, but it was inert until this commit.

Bugs fixed along the way

• @jarvis/core was the only one of 25 packages with a hand-listed test script instead of the src/*.test.ts glob, so hitl.test.ts from the P0 HITL work had never run in CI. Switched to the glob; core goes 32 → 50 tests, all passing.
• The WS test harness attached its message listener after awaiting open, silently dropping any frame the server sends on connect. Pre-existing latent flaw, exposed by the new permission_mode frame; fixed to match real browser client ordering.

Not in scope

• POST /v1/permissions/rules doesn't broadcast permission_rules_changed to live sockets — that needs a socket registry, and the web already works around it with a local version counter.
• The blocking /v1/chat/completions and SSE routes still call createAgent() with no approver, so gated tools run unconditionally there. That's the documented historical default rather than something this change introduces, but it does mean the permission engine covers the WS surface only.

Testing

make check clean — typecheck + eslint + 2161 tests, zero failures.

New coverage:

• packages/core/src/mode.test.ts (12): catalogue filtering; dispatch refusal on both paths; filtered tools never reaching the approver; isTerminal stopping the turn and skipping the rest of the batch on both paths; denied terminal tools not terminating; the mode channel (no-op without a sink, delivery, relay as mode_changed); isAgentMode boundaries.
• packages/server/src/server.test.ts (9 WS): mode announced on connect; set_mode echo + invalid-value error; auto resolving a gated tool with no operator input tagged mode_default; a deny rule blocking with source.kind=rule; plan refusing a write tool without prompting; exit_plan → plan_proposed → accept_plan switching mode and resuming; the model calling enter_plan_mode; refine_plan empty-feedback error; graceful degradation with no permission store.

Branch note

This branch sits 29 commits ahead of main; 28 of those are pre-existing unmerged work from earlier sessions (P8 Rust decommission, opencode-borrow P0, desktop shell polish). This session's change is the single commit dd3d63a — review that one if the rest has already been reviewed elsewhere.

🤖 Generated with Claude Code