Summary

Adds a new remove_dir tool so the model can delete directories directly without escaping into run_command rm -rf. Two modes: non-recursive (permission-gated, safe single-empty-dir case) and recursive (always prompts regardless of permissions).

GitHub Issue

Closes #251

What Changed

New tool. remove_dir takes path + optional recursive (default false). Error ordering: path-is-file → suggest remove_file; path doesn't exist → error; non-recursive + non-empty → error suggesting recursive: true. formatCall returns path or path (recursive) so the collapsed tool header reflects the mode.

Two confirmation paths. Non-recursive uses the standard permission resolution against the new cwdRemoveDir / globalRemoveDir keys and only prompts when not pre-granted. Recursive always prompts regardless of permission state — the permission flag is not authorisation for arbitrary tree removal, only for the safe single-empty-dir case. Both modes use label "Remove directory?"; recursive adds (recursive) to the detail line so the prompt header visibly signals the bigger blast radius.

Schema. cwdRemoveDir / globalRemoveDir follow the optional-boolean pattern alongside the existing read/write/remove keys. removeDir joins toolsSchema with the field-level .default({ enabled: true }) pattern we standardised in #276, so adding this tool is non-breaking for existing configs.

PathOperation extended. The union already covered "read" | "write" | "remove"; now also "removeDir". The PERMISSION_KEYS map gets a new entry — no branching changes, uniform handling across all four operations. (FileOperation → PathOperation rename happened in the prep commit e0ce922.)

mock-fs upgrade. The test helper previously had no concept of an empty directory — directories were inferred from file prefixes, so isDirectory("/empty/dir") was always false unless files existed under it. That broke the non-recursive "removes empty dir" cases. Fixed by tracking explicit dirs in a Set<string> alongside the file map:

• ensureDir now registers paths instead of being a no-op.
• New optional second ctor arg initialDirs: string[] for test convenience.
• isDirectory returns true if path is in dirs OR has files under it.
• New removeDir spy enforces ENOENT (missing path) and ENOTEMPTY (non-empty non-recursive) semantics.
• New getDirs() helper on the returned state.

Settings UI. New "Remove Directory" entry in the tools toggle list and two "Remove directories (current directory / global)" entries in the permissions toggle list.

Docs. README tools table, permissions YAML example, new "recursive always prompts" callout explaining the non-authorisation semantics of the permission flag, and CONTRIBUTING's src/ tree comment.

Notes for Reviewers

• Two commits on this branch. First is a pure rename (FileOperation → PathOperation, checkFilePermission → checkPathPermission) to prep for the new "removeDir" operation, no behaviour change. Second is the feature itself. Happy to squash on merge either way.
• Recursive always prompts — verify this in remove-dir.ts:66-77. The if (parsed.recursive) branch unconditionally calls context.confirm before reaching the permission check. The permission matrix test "still prompts when cwdRemoveDir is granted" covers this explicitly.
• Error ordering matters. fileExists && !isDirectory → file → suggest remove_file (check first). Then !isDirectory → doesn't exist. If reordered, the file-path case would report "does not exist" instead.
• stub-context.ts default permissions now include cwdRemoveDir: true for happy-path test convenience. Permission-matrix tests still pin explicit values.
• Coverage is 100% on both remove-dir.ts and the updated mock-fs.ts.