feat: make PermissionsService async with pluggable prompt callback

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/unit/test_permissions.py

@@ -0,0 +1,51 @@
+"""Tests for async PermissionsService."""
+
+import asyncio
+
+import pytest
+
+from app.models.config import PermissionsConfig
+from app.services.permissions import PermissionsService
+
+
+class TestPermissionsService:
+    @pytest.mark.asyncio
+    async def test_auto_approve(self) -> None:
+        config = PermissionsConfig(auto_approve=["read_file"])
+        svc = PermissionsService(config)
+        assert await svc.check("read_file") is True
+
+    @pytest.mark.asyncio
+    async def test_deny(self) -> None:
+        config = PermissionsConfig(deny=["rm_file"])
+        svc = PermissionsService(config)
+        assert await svc.check("rm_file") is False
+
+    @pytest.mark.asyncio
+    async def test_prompt_callback_approve(self) -> None:
+        config = PermissionsConfig()
+        svc = PermissionsService(config)
+
+        async def approve_callback(tool_name: str, description: str) -> bool:
+            return True
+
+        svc.set_prompt_callback(approve_callback)
+        assert await svc.check("write_file", description="write something") is True
+
+    @pytest.mark.asyncio
+    async def test_prompt_callback_deny(self) -> None:
+        config = PermissionsConfig()
+        svc = PermissionsService(config)
+
+        async def deny_callback(tool_name: str, description: str) -> bool:
+            return False
+
+        svc.set_prompt_callback(deny_callback)
+        assert await svc.check("write_file") is False
+
+    @pytest.mark.asyncio
+    async def test_no_callback_defaults_to_deny(self) -> None:
+        """Without a callback set, unlisted tools are denied."""
+        config = PermissionsConfig()
+        svc = PermissionsService(config)
+        assert await svc.check("write_file") is False