From e06f74ed5e88335122c6941532920ddbb0fd1e8c Mon Sep 17 00:00:00 2001
From: Sienna Meridian Satterwhite <sienna@sunbeam.pt>
Date: Mon, 23 Mar 2026 21:24:33 +0000
Subject: [PATCH] feat(config): permission_for() + upgrade_to_always()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

LoadedConfig gains methods for tool approval policy:
- permission_for(tool_name) → "always" | "ask" | "never"
- upgrade_to_always(tool_name) — session-only override
---
 sunbeam/src/code/config.rs | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/sunbeam/src/code/config.rs b/sunbeam/src/code/config.rs
index 8ebea15..69d59ec 100644
--- a/sunbeam/src/code/config.rs
+++ b/sunbeam/src/code/config.rs
@@ -55,6 +55,35 @@ impl Default for LoadedConfig {
     }
 }
 
+impl LoadedConfig {
+    /// Get the permission level for a tool. Returns "always", "ask", or "never".
+    pub fn permission_for(&self, tool_name: &str) -> &str {
+        match tool_name {
+            "file_read" => &self.file_read_perm,
+            "file_write" => &self.file_write_perm,
+            "search_replace" => &self.search_replace_perm,
+            "grep" => &self.grep_perm,
+            "bash" => &self.bash_perm,
+            "list_directory" => &self.list_directory_perm,
+            _ => "ask", // unknown tools default to ask
+        }
+    }
+
+    /// Upgrade a tool's permission to "always" for this session (in-memory only).
+    pub fn upgrade_to_always(&mut self, tool_name: &str) {
+        let target = match tool_name {
+            "file_read" => &mut self.file_read_perm,
+            "file_write" => &mut self.file_write_perm,
+            "search_replace" => &mut self.search_replace_perm,
+            "grep" => &mut self.grep_perm,
+            "bash" => &mut self.bash_perm,
+            "list_directory" => &mut self.list_directory_perm,
+            _ => return,
+        };
+        *target = "always".into();
+    }
+}
+
 /// Load project config from .sunbeam/config.toml.
 pub fn load_project_config(project_path: &str) -> LoadedConfig {
     let config_path = std::path::Path::new(project_path)