feat: MCP permission model + unified policy enforcement + settings UI (Phase 4)

package.json

@@ -94,6 +94,7 @@
     "pinia-plugin-persistedstate": "^4.7.1",
     "radix-vue": "^1.9.17",
     "sql-formatter": "^15.8.1",
+    "tailwind-merge": "^3.6.0",
     "ulidx": "^2.4.1",
     "unocss-preset-animations": "^1.3.0",
     "vue": "^3.5.13",

src-tauri/Cargo.toml

@@ -77,8 +77,6 @@ rust_xlsxwriter = "0.64"
 calamine = "0.22"
 
 # Agent / LLM dependencies
-# data-studio-agent: local checkout for active development.
-# Revert to release when ready: { git = "https://github.com/geek-fun/data-studio-agent.git", tag = "v0.1.2" }
 reqwest = { version = "0.12", default-features = false, features = [
   "json",
   "rustls-tls",
@@ -89,7 +87,8 @@ http = "1"
 log = "0.4"
 futures = "0.3"
 rand = "0.8"
-data-studio-agent = { git = "https://github.com/geek-fun/data-studio-agent.git", branch = "feat/unified-capability-types" }
+# data-studio-agent: pinned to latest release tag.
+data-studio-agent = { git = "https://github.com/geek-fun/data-studio-agent.git", tag = "v0.1.5" }
 
 # Archive extraction (JRE downloads)
 flate2 = "1.0"

src-tauri/src/agent_adapters.rs

@@ -7,6 +7,7 @@
 use std::collections::HashMap;
 use std::sync::Arc;
 
+use crate::mcp_bridge::McpConfig;
 use data_studio_agent as lib;
 use data_studio_agent::storage;
 use data_studio_agent::traits::{CancelMap, ConfirmMap, EventEmitter};
@@ -64,6 +65,31 @@ pub async fn run_agent_loop(
             .unwrap_or(false)
     };
 
+    let app_data_dir = app.path().app_data_dir().map_err(|e| e.to_string())?;
+    let should_deny = move |tool_name: &str, conn_id: Option<&str>| -> bool {
+        // Reload per call so permission changes made in Settings apply to the
+        // next tool call instead of being snapshotted for the whole run.
+        let policy = McpConfig::load(&app_data_dir).policy;
+        match data_studio_agent::capabilities::registry::registry().get(tool_name) {
+            Some(cap) => {
+                // Allowlist set but no connection specified: a DB capability would
+                // fall back to the default connection, bypassing the allowlist.
+                // AppLocal tools (list_connections etc.) need no connection.
+                if !policy.allowed_connection_ids.is_empty()
+                    && conn_id.is_none()
+                    && !matches!(
+                        cap.source_kind,
+                        data_studio_agent::capabilities::types::SourceKind::AppLocal
+                    )
+                {
+                    return true;
+                }
+                !policy.allows(cap.risk_level, conn_id)
+            }
+            None => false,
+        }
+    };
+
     lib::loop_runner::run_agent_loop(
         &session_id,
         &user_message,
@@ -76,6 +102,7 @@ pub async fn run_agent_loop(
         &confirm_map,
         &cancel_map,
         &is_parallel_ok,
+        &should_deny,
     )
     .await
 }

src-tauri/src/capabilities/sql.rs

@@ -9,7 +9,9 @@ use crate::database::{DatabaseAdapter, QueryResult};
 use crate::state::{ActiveConnection, ServerConfig};
 
 use data_studio_agent::capabilities::registry::CapabilityRegistry;
-use data_studio_agent::capabilities::types::{Capability, CapabilityHandler, RiskLevel, SourceKind};
+use data_studio_agent::capabilities::types::{
+    Capability, CapabilityHandler, RiskLevel, SourceKind,
+};
 
 fn app_handle() -> AppHandle {
     crate::APP_HANDLE

src-tauri/src/capabilities/sqlkit.rs

@@ -4,7 +4,9 @@ use serde_json::Value;
 use tauri_plugin_store::StoreExt;
 
 use data_studio_agent::capabilities::registry::CapabilityRegistry;
-use data_studio_agent::capabilities::types::{Capability, CapabilityHandler, RiskLevel, SourceKind};
+use data_studio_agent::capabilities::types::{
+    Capability, CapabilityHandler, RiskLevel, SourceKind,
+};
 
 // ---------------------------------------------------------------------------
 // Connection store abstraction (testable via mockall)