ApprovalEntry

ApprovalEntry = ShellApprovalEntry | ToolApprovalEntry | McpToolApprovalEntry

Defined in: core/dist/config/shell-policy.d.ts:383

EXT-71 §3.1 — one entry in allow, deny or escalate. All three lists take the same shape; the list an entry sits in decides only what a match DOES (deny over escalate over allow).

type, matcher and pattern are always required — no field is inferred and no entry reads two ways. The runtime validator is approvalEntrySchema in config/schema.ts, which is stricter than TypeScript can be: it rejects unknown fields, an empty or unknown-key hint pattern, and a regexp that does not compile or is over the length cap.