From c52482368bae4ba04679a1299906695a0c0e9cc6 Mon Sep 17 00:00:00 2001
From: Mohamed Boudra <boudra.moha@gmail.com>
Date: Fri, 19 Jun 2026 10:45:28 +0700
Subject: [PATCH] Precompile Paseo Agent permission matchers

---
 .../paseo-agent/agent-permissions.ts          | 32 ++++++++++++++-----
 1 file changed, 24 insertions(+), 8 deletions(-)

diff --git a/packages/server/src/server/agent/providers/paseo-agent/agent-permissions.ts b/packages/server/src/server/agent/providers/paseo-agent/agent-permissions.ts
index 317244285..8549751b4 100644
--- a/packages/server/src/server/agent/providers/paseo-agent/agent-permissions.ts
+++ b/packages/server/src/server/agent/providers/paseo-agent/agent-permissions.ts
@@ -12,34 +12,50 @@ export const ToolPermissionRuleSchema = z
 export type ToolPermissionAction = z.infer<typeof ToolPermissionActionSchema>;
 export type ToolPermissionRule = z.infer<typeof ToolPermissionRuleSchema>;
 
+export interface CompiledToolPermissionRule {
+  rule: ToolPermissionRule;
+  matches(toolName: string): boolean;
+}
+
 export interface ToolPermissionPolicy {
   rules: ToolPermissionRule[];
+  compiledRules: CompiledToolPermissionRule[];
 }
 
 export function createToolPermissionPolicy(
   rules: ToolPermissionRule[] | undefined,
 ): ToolPermissionPolicy {
-  return { rules: rules ?? [] };
+  const normalizedRules = rules ?? [];
+  return {
+    rules: normalizedRules,
+    compiledRules: normalizedRules.map((rule) => ({
+      rule,
+      matches: compileToolPattern(rule.tool),
+    })),
+  };
 }
 
 export function evaluateToolPermission(
   policy: ToolPermissionPolicy | undefined,
   toolName: string,
 ): ToolPermissionAction {
-  for (const rule of policy?.rules ?? []) {
-    if (matchesToolPattern(rule.tool, toolName)) {
-      return rule.action;
+  for (const compiled of policy?.compiledRules ?? []) {
+    if (compiled.matches(toolName)) {
+      return compiled.rule.action;
     }
   }
   return "allow";
 }
 
-function matchesToolPattern(pattern: string, toolName: string): boolean {
-  if (pattern === toolName || pattern === "*") {
-    return true;
+function compileToolPattern(pattern: string): (toolName: string) => boolean {
+  if (pattern === "*") {
+    return () => true;
+  }
+  if (!pattern.includes("*")) {
+    return (toolName) => toolName === pattern;
   }
   const matcher = new RegExp(`^${wildcardPatternToRegExp(pattern)}$`);
-  return matcher.test(toolName);
+  return (toolName) => matcher.test(toolName);
 }
 
 function wildcardPatternToRegExp(pattern: string): string {