Update docs and tests to use 'when' field instead of 'match' for parameter matching

Author: wu-changxing

docs/features/permissions.md

@@ -47,7 +47,7 @@ permissions:
     allowed: true
     source: config
     reason: safe doc edits
-    match:
+    when:
       file_path: "*.md"
     expires:
       type: never
@@ -164,7 +164,7 @@ permissions:
     allowed: true
     source: config
     reason: safe documentation edits
-    match:
+    when:
       file_path: "*.md"
     expires:
       type: never
@@ -211,7 +211,7 @@ Matches any command starting with `git diff ` (e.g., `git diff HEAD`, `git diff
   allowed: true
   source: config
   reason: safe doc edits
-  match:
+  when:
     file_path: "*.md"
   expires:
     type: never
@@ -227,7 +227,7 @@ All permissions use the same structure:
   allowed: true|false          # Whether to allow
   source: config|user|skill|safe|default  # Where it came from
   reason: "description"        # Why it was granted (shown in logs)
-  match:                       # Optional: parameter-level matching
+  when:                       # Optional: parameter-level matching
     param_name: "pattern"
   expires:
     type: never|session_end|turn_end  # When it expires
@@ -250,7 +250,7 @@ When multiple permissions could match:
   allowed: true
   source: config
   reason: safe doc edits
-  match:
+  when:
     file_path: "docs/**/*.md"
   expires:
     type: never
@@ -262,7 +262,7 @@ When multiple permissions could match:
   allowed: true
   source: config
   reason: safe config edits
-  match:
+  when:
     file_path: "*.{yaml,yml,json}"
   expires:
     type: never
@@ -274,7 +274,7 @@ When multiple permissions could match:
   allowed: true
   source: config
   reason: safe short commands
-  match:
+  when:
     timeout: "30000"  # Exact match on timeout parameter
   expires:
     type: never
@@ -345,15 +345,15 @@ permissions:
     allowed: true
     source: config
     reason: doc updates
-    match:
+    when:
       file_path: "docs/**/*.md"
     expires:
       type: never
   "edit":
     allowed: true
     source: config
     reason: doc updates
-    match:
+    when:
       file_path: "docs/**/*.md"
     expires:
       type: never

docs/network/host-config.md

@@ -295,7 +295,7 @@ permissions:
     allowed: true
     source: config
     reason: safe documentation edits
-    match:
+    when:
       file_path: "*.md"
     expires:
       type: never
@@ -305,7 +305,7 @@ permissions:
     allowed: true
     source: config
     reason: safe to read docs
-    match:
+    when:
       file_path: "docs/**/*"
     expires:
       type: never
@@ -332,7 +332,7 @@ permissions:
     allowed: true
     source: config
     reason: safe documentation edits
-    match:
+    when:
       file_path: "*.md"
     expires:
       type: never
@@ -342,7 +342,7 @@ permissions:
     allowed: true
     source: config
     reason: safe doc edits
-    match:
+    when:
       file_path: "docs/**/*.md"
     expires:
       type: never
@@ -352,7 +352,7 @@ permissions:
     allowed: true
     source: config
     reason: safe short commands
-    match:
+    when:
       timeout: "30000"  # Exact match on timeout parameter
     expires:
       type: never
@@ -396,7 +396,7 @@ permissions:
     allowed: true
     source: config
     reason: safe doc edits
-    match:
+    when:
       file_path: "*.md"
     expires:
       type: never
@@ -442,15 +442,15 @@ permissions:
     allowed: true
     source: config
     reason: documentation updates
-    match:
+    when:
       file_path: "docs/**/*.md"
     expires:
       type: never
   "edit":
     allowed: true
     source: config
     reason: documentation updates
-    match:
+    when:
       file_path: "docs/**/*.md"
     expires:
       type: never

docs/useful_plugins/tool_approval.md

@@ -180,7 +180,7 @@ permissions:
     allowed: true
     source: config
     reason: safe doc edits
-    match:
+    when:
       file_path: "*.md"
     expires:
       type: never
@@ -224,7 +224,7 @@ permissions:
   allowed: true
   source: config
   reason: safe doc edits
-  match:
+  when:
     file_path: "*.md"  # Only matches write calls to *.md files
   expires:
     type: never
@@ -305,15 +305,15 @@ permissions:
     allowed: true
     source: config
     reason: doc updates
-    match:
+    when:
       file_path: "docs/**/*.md"
     expires:
       type: never
   "edit":
     allowed: true
     source: config
     reason: doc updates
-    match:
+    when:
       file_path: "docs/**/*.md"
     expires:
       type: never

tests/integration/test_config_permissions.py

@@ -260,7 +260,7 @@ def test_parameter_matching_with_match_field(tmp_path, monkeypatch):
                 'allowed': True,
                 'source': 'config',
                 'reason': 'safe doc edits',
-                'match': {
+                'when': {
                     'file_path': '*.md'
                 },
                 'expires': {'type': 'never'}
@@ -309,7 +309,7 @@ def test_parameter_matching_rejects_non_matching(tmp_path, monkeypatch):
                 'allowed': True,
                 'source': 'config',
                 'reason': 'safe doc edits',
-                'match': {
+                'when': {
                     'file_path': '*.md'
                 },
                 'expires': {'type': 'never'}
@@ -360,7 +360,7 @@ def test_glob_pattern_matching_in_match_field(tmp_path, monkeypatch):
                 'allowed': True,
                 'source': 'config',
                 'reason': 'safe doc edits',
-                'match': {
+                'when': {
                     'file_path': 'docs/**/*.md'
                 },
                 'expires': {'type': 'never'}