Simplify Galaxy permissions and preserve explicit user authorization

AGENTS.md

@@ -216,13 +216,17 @@ Key invariants:
 - `StartAgentWaitPolicy` follows child execution ownership, not parent `run_id`: grouped local children use `LocalStartup`, legacy local completion waits retain `Completion`, and hosted children use `Startup` with the hosted timeout. Direct-provider `start_agent` is normalized to a one-child `RunAgents` group. Cancelling or replacing a parent turn must not cancel independently running children or erase their group membership.
 - Hosted `RunAgents` startup timeouts detach the exact `StartAgentRequestId`; late launch callbacks must not register the child after the timeout result, while children linked before cancellation remain independently running
 
-### Galaxy Decides Permissions
+### Profile Permissions
 
-- `GalaxyDecides` is an execution-profile permission for Galaxy-owned files, commands, PTY input, MCP, computer use, and agent coordination. External CLI agents retain their own permission flows. Legacy `AgentDecides` profile values deserialize as `GalaxyDecides`; new profiles use it for file reads, file edits, and MCP.
-- `app/src/ai/blocklist/action_model/risk_review.rs` assesses the exact pending action with the active terminal-use model in a separate, tool-free request, falling back to the base model when the terminal-use model is unconfigured. Risk 0–3 permits automatic execution; 4–5 requires user approval. Existing denylist/protected-path/organization restrictions still require confirmation.
-- Invalid, unavailable, oversized, or timed-out assessments never grant execution. Assessment calls are bounded to 30 seconds; approval requests expire after 60 seconds and return a correlated denial telling the agent to choose another approach.
-- Reviews are scoped to conversation, action contents, and provider execution identity. Cancellation, replacement, and conversation cleanup invalidate them and cancel the reviewer request. Never treat a late callback or expired approval click as authorization.
-- Output polling and user-question behavior retain their existing policies. Risk assessment must not add another model call for each command-output poll.
+- Profiles expose exactly one `PermissionMode`: `ReadOnly`, `AskFirst`, or `GalaxyDecides`. Legacy per-tool fields are compatibility projections, not independent settings, and are omitted from persisted profile JSON. Existing profiles migrate from their command permission; unknown modes become Read Only. Command and MCP denylists remain effective.
+- Read Only advertises and executes only file/skill/document inspection, code search, grep, and file discovery. Shell commands, mutations, MCP calls, computer use, and delegation are rejected at the action boundary, even if a stale client advertises them.
+- Ask First confirms actions through the existing approval pane. Exact shell-command approvals are persisted as bounded digests scoped to the profile, working directory, host, session type, and shell. Changed command text or environment requires approval again. Explicit restrictions cannot be bypassed by remembered commands. Changing modes clears remembered approvals. Approval requests expire after 60 seconds with a correlated denial.
+- `app/src/ai/blocklist/action_model/risk_review.rs` assesses Galaxy Decides actions using the terminal-use model in a separate, tool-free request, falling back to the base model when unconfigured. Risk 0–3 runs; risk 4–5 and denylist/protected-path/workspace restrictions deny automatically. Galaxy Decides never requests human permission. Denials return reasons so the agent can revise its scope/justification or choose a safer approach.
+- Risk reviews carry chronological available recorded user requests, including intermediate restrictions; oversized review context denies rather than discarding revocations, separate from agent rationale/delegated scenarios. Worker reviews inherit root-conversation authorization; agent claims never establish permission. Later revocations take precedence. An explicitly requested ordinary non-force push within the stated/established remote and branch may be risk 3; external visibility alone is not risk 4. Force/deletion/out-of-scope pushes, secrets, and production changes remain stricter.
+- Invalid, unavailable, oversized, or timed-out assessments never grant execution. Assessment calls are bounded to 30 seconds. Reviews bind conversation, action contents, execution identity, profile mode and environment. Cancellation, replacement and cleanup invalidate callbacks; stale approval clicks are not authorization.
+- Approval of a running agent command covers subsequent output monitoring and PTY input for that same conversation-owned active block while the agent retains control. Validate block and launch-action identity; never extend PTY writes to a finished command, another conversation, or a fresh shell prompt. A finished owning block may return its final snapshot without additional permission.
+- Galaxy Decides risk assessment appears only as a transient “Checking permissions…” status above the input, not a per-tool permission pane. Ask First keeps its actionable approval panes. `PermissionReviewChanged` refreshes the owning conversation’s status bar.
+- Safe inspection and output polling do not add risk-review model calls. A narrow shell fast path accepts validated `pwd`, `ls`, Git version, and hardened Git status/diff forms; shell expansion, chaining, redirects, unknown flags and unhardened Git commands still require review. Explicit restrictions are checked before fast approval. Galaxy Decides skips user-question pauses. External ACP/CLI agents retain their own protocol permission flows; unstructured ACP requests must not grant Galaxy terminal mutations.
 
 ### Platform Setup
 - `./script/bootstrap` - Platform-specific setup plus common agent skill installation from `skills-lock.json`; prompts for project/global when an install or update is needed unless a target flag or environment override is provided.