Add RequestPermissionsTool and turn-scoped permission allowlist

[myzie]

Summary

• Adds permission.RequestPermissionsTool(manager, handler, scope...) — a built-in request_permissions tool the model can call to ask the host for elevated access with a model-authored rationale
• Handler is host-defined (prompt user, evaluate policy, or auto-deny)
• GrantScopeTurn (default): grants apply until Manager.ClearTurnAllowlist() is called (e.g. in a PreGenerationHook at the start of each turn)
• GrantScopeSession: grants persist for the lifetime of the session, using the existing session allowlist
• Manager gains AllowForTurn(key), IsTurnAllowed(key), and ClearTurnAllowlist() methods
• EvaluateToolUse now checks both session and turn allowlists

Test plan

• Handler receives correct PermissionRequest fields (tools + reason)
• Turn-scoped grant allows tool access; does NOT add to session allowlist
• Handler denial returns a denial result without modifying allowlists
• ClearTurnAllowlist revokes turn grants
• Session-scoped grant adds to session allowlist; does NOT add to turn allowlist
• Handler error surfaces as an error ToolResult (non-fatal to the agent)
• EvaluateToolUse allows a tool after turn grant (ModeDontAsk baseline)
• Full permission test suite passes without regressions

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 6ec1ce9f-cd2a-4cdc-a942-0eb17dedd615

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch worktree-feat+model-driven-permissions

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}