Tool system: Reactive permission policy from tool results

[Delqhi]

Problem

The permission engine only inspects tool name + args before execution. It cannot react to outcomes (e.g., a sin_bash command that unexpectedly deleted files, or sin_http_get returning a secret). SOTA systems use result-based policy.

What to do

1. internal/permission/result_policy.go:
   • Scan tool result string for patterns:
     • deletion confirmations ("deleted", "removed")
     • secret leakage (AWS keys, JWT, tokens)
     • network egress ("curl", "wget", "fetch")
   • Adjust policy for subsequent calls
2. If result contains secret pattern → auto-deny future sin_write until user confirms
3. If result contains destructive confirmation → require confirmation for next destructive action
4. Hook: tool.post receives result and can escalate
5. sin-code permission result-log — show policy adjustments

Acceptance criteria

• Result scanning works
• Secret detection in tool output
• Destructive action detection
• Policy adjustments logged
• Hook integration