feat(agent-bff): fork the permission evaluator with a drift gate

[Tonours]

fixes PRD-682

Problem

The BFF needs its own permission evaluator for PRD-683, but the evaluator in forestadmin-client is private. A local fork is required, with a guard against semantic drift.

Fix

• Fork CRUD and custom-action permission evaluation into agent-bff.
• Preserve role-based checks, action identifiers, conditions, and the four custom-action events.
• Add a contract test comparing the fork with forestadmin-client transformations and verdicts.
• Make the drift gate cover SelfApprove and malformed permission descriptors.
• Use a typed options object for custom-action checks.

Scope and safety

• Changes are limited to packages/agent-bff.
• No change to forestadmin-client.
• No public export is added.
• The evaluator is not wired to a route in this PR; PRD-683 will consume it.

How to test

yarn workspace @forestadmin/forestadmin-client build
yarn workspace @forestadmin/agent-bff test

Verified: 737 tests passing across 56 suites, including a deliberate SelfApprove drift mutation that fails the gate.

Definition of Done

General

• Write an explicit title for the Pull Request, following Conventional Commits specification
• Test manually the implemented changes
• Validate the code quality (indentation, syntax, style, simplicity, readability)

Security

• Consider the security impact of the changes made

[linear-code]

PRD-682

[qltysh]

2 new issues

Tool	Category	Rule	Count
qlty	Duplication	Found 29 lines of similar code in 2 locations (mass = 130)	1
qlty	Structure	Function with many parameters (count = 4): canRolePerformCollectionAction	1

[qltysh]

Coverage Impact

This PR will not change total coverage.

Modified Files with Diff Coverage (2)

Rating	File	% Diff	Uncovered Line #s
	packages/agent-bff/src/permissions/action-identifiers.ts	100.0%
	packages/agent-bff/src/permissions/action-permissions.ts	100.0%
	Total	100.0%

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.