fix(mcode-island): correct README drift and lock PermissionRequest decision

Two follow-up changes in response to the hetaoBackend review on
PR #21 ("Request changes"):

1. README.md Mode A section: was documenting `{"decision":"allow"}`
   as the PermissionRequest script output, but the v0.3.0 script
   emits `{"decision":"ask"}` (the observer opt-in value added by
   PR #20 commit 28aa5f4). The v0.2.1 -> v0.3.0 transition flipped
   the decision but the README was not updated. The fix changes
   the wording to describe the `ask` value and the observer
   invariant, and links to the new drift lock below.

2. scripts/smoke.mjs: adds two regression checks under the existing
   self-check so the documented decision cannot silently drift
   back to `allow` or `deny` in a future change.

   - 5b. Reads permission-request.ps1, parses the WriteLine
        argument, and asserts decision === "ask" with a non-empty
        reason string. Exits 1 on FAIL. Verified locally: a
        mutation that flips "ask" -> "allow" produces
        `1 fail` with the message
        "decision is "allow", expected "ask" (observer opt-in,
         per PR #20)".
   - 5c. Reads README.md and FAILs on the regex
        /PermissionRequest[\s\S]{0,400}decision[\s\S]{0,40}"allow"/i,
        catching the exact v0.2.1 wording that was in the
        previously-merged docstring.

   Smoke is now 42 pass / 7 warn (the same 7 forward events from
   PR #20) / 0 fail. The two new checks are PASS by default and
   only trip on actual drift.

Out of scope: no change to the Hook scripts themselves, no change
to the portable spec (PR #20), no change to the test event
payload fixtures used by the e2e smoke (which is a separate
PowerShell script in the local dev tree, not the PR).

Refs: MiniMax-Code-Plugins PR #21 review at 2026-08-26T01:14:52Z
"PermissionRequest returns {\"decision\":\"allow\"} ... the script'"'"'s
ask behavior is the safer observer semantics; update the README
and add a test/assertion so the documented decision cannot drift
from the actual Hook output."

Author: antianqi

plugins/antianqi/mcode-island/README.md

@@ -52,10 +52,18 @@ the runtime spawns a script from this plugin for every matching event:
 
 The agent does not need to remember to push state — the runtime fires the
 right script at the right time. `PermissionRequest` is the only
-decision-bearing event here; the script returns `{"decision":"allow"}` so the
-runtime's fail-closed default does not auto-deny. The widget just shows
+decision-bearing event here; the script returns `{"decision":"ask"}` so the
+plugin remains a pure observer (it does not auto-allow or auto-deny).
+The runtime's fail-closed default is bypassed only because the script
+opts the Hook into the "ask the user" path, so the TUI prompt still
+appears and the user can approve or deny. The widget just shows
 `waiting` so the user knows to act.
 
+> **Drift lock**: `scripts/smoke.mjs` reads `permission-request.ps1`
+> directly and asserts the `decision` field is exactly `ask`. A
+> future change that flips the value back to `allow` or `deny` will
+> fail the smoke before the PR can be submitted.
+
 Until the registry validator accepts the namespace, the `io.minimax.mcode/`
 directory is dormant and the plugin falls through to Mode B.
 

plugins/antianqi/mcode-island/scripts/smoke.mjs

@@ -270,6 +270,57 @@ const main = async () => {
         out('PASS', '_lib.ps1: shared helper present');
     }
 
+    // 5b. Drift lock: permission-request.ps1 must emit `{"decision":"ask"}`,
+    // not `allow` or `deny`. The 0.2.4 Runtime default for PermissionRequest
+    // is fail-closed; an observer Hook that returns `allow` or `deny`
+    // would silently change the user-facing permission flow. The portable
+    // spec (PR #20) added `ask` exactly so observers can opt into
+    // "ask the user" without becoming the permission owner. This lock
+    // prevents a future change from regressing that invariant.
+    const permReqPath = join(PLUGIN_ROOT, 'io.minimax.mcode', 'hooks', 'scripts', 'permission-request.ps1');
+    if (!(await exists(permReqPath))) {
+        out('FAIL', 'permission-request.ps1 missing (drift lock skipped)');
+    } else {
+        const permReq = await readFile(permReqPath, 'utf8');
+        const decisionMatch = permReq.match(/WriteLine\(\s*'([^']*\{[^']*\})'\s*\)/);
+        if (!decisionMatch) {
+            out('FAIL', 'permission-request.ps1: cannot locate WriteLine decision JSON');
+        } else {
+            const decisionJson = decisionMatch[1];
+            let parsed;
+            try { parsed = JSON.parse(decisionJson); }
+            catch (e) {
+                out('FAIL', `permission-request.ps1: decision JSON is not valid JSON: ${e.message}`);
+            }
+            if (parsed) {
+                if (parsed.decision !== 'ask') {
+                    out('FAIL', `permission-request.ps1: decision is "${parsed.decision}", expected "ask" (observer opt-in, per PR #20). Returning "allow" or "deny" from an observer Hook silently changes the user-facing permission flow.`);
+                } else {
+                    out('PASS', `permission-request.ps1: decision is locked to "ask" (observer opt-in)`);
+                }
+                if (!parsed.reason || typeof parsed.reason !== 'string') {
+                    out('FAIL', 'permission-request.ps1: missing or non-string `reason` field');
+                } else {
+                    out('PASS', 'permission-request.ps1: reason field present');
+                }
+            }
+        }
+    }
+
+    // 5c. Drift lock: README must not say `{"decision":"allow"}` for
+    // PermissionRequest. The v0.2.1 baseline docstring is the most
+    // common place this regresses, since the script changed from
+    // `allow` to `ask` between v0.2.1 and v0.3.0.
+    const readmePath = join(PLUGIN_ROOT, 'README.md');
+    if (await exists(readmePath)) {
+        const readme = await readFile(readmePath, 'utf8');
+        if (/PermissionRequest[\s\S]{0,400}decision[\s\S]{0,40}"allow"/i.test(readme)) {
+            out('FAIL', 'README.md: contains "decision":"allow" near PermissionRequest (the v0.3.0 spec uses "ask")');
+        } else {
+            out('PASS', 'README.md: no stale "decision":"allow" near PermissionRequest');
+        }
+    }
+
     // 6. cross-platform: scan all .ps1 files for hardcoded paths
     console.log('-'.repeat(60));
     console.log('cross-platform scan:');