@cosmicstack/mercury-agent 0.2.5 → 0.2.6

package/dist/index.js

@@ -2304,6 +2304,7 @@ var PermissionManager = class {
   elevatedCommands = /* @__PURE__ */ new Set();
   pendingApprovals = /* @__PURE__ */ new Set();
   currentChannelType = "cli";
+  tempScopes = [];
   constructor() {
     this.cwd = process.cwd();
     this.manifest = this.load();
@@ -2394,12 +2395,18 @@ var PermissionManager = class {
     }
     const resolved = resolve(path3);
     const scope = this.findScope(resolved);
+    const tempScope = this.findTempScope(resolved);
     if (scope) {
       if (mode === "read" && scope.read) return { allowed: true };
       if (mode === "write" && scope.write) return { allowed: true };
       return { allowed: false, reason: `Permission denied: ${mode} access to ${path3} (scope has ${mode}=false)` };
     }
-    return await this.requestScope(resolved, mode);
+    if (tempScope) {
+      if (mode === "read" && tempScope.read) return { allowed: true };
+      if (mode === "write" && tempScope.write) return { allowed: true };
+      return { allowed: false, reason: `Permission denied: ${mode} access to ${path3}` };
+    }
+    return { allowed: false, reason: `Permission denied for ${mode} access to ${path3}` };
   }
   async checkShellCommand(command) {
     if (this.autoApproveAll) {
@@ -2430,7 +2437,7 @@ var PermissionManager = class {
       if (hasPathTraversal) {
         const scopeCheck = await this.checkFsAccess(hasPathTraversal, "write");
         if (!scopeCheck.allowed) {
-          return { allowed: false, reason: scopeCheck.reason, needsApproval: true };
+          return { allowed: false, reason: `No permission to access ${hasPathTraversal}. Use approve_scope tool with path="${hasPathTraversal}" and mode="write" to request access.`, needsApproval: false };
         }
       }
     }
@@ -2502,9 +2509,6 @@ var PermissionManager = class {
     return void 0;
   }
   async requestScopeExternal(path3, mode) {
-    return this.requestScope(path3, mode);
-  }
-  async requestScope(path3, mode) {
     if (!this.askHandler) {
       return { allowed: false, reason: `Permission denied for ${mode} access to ${path3}` };
     }
@@ -2517,11 +2521,26 @@ Allow access?`;
       this.addScope(path3, mode === "read", mode === "write");
       return { allowed: true };
     }
-    if (response === "yes" || response === "y") {
+    if (response === "yes") {
+      this.addTempScope(path3, mode === "read", mode === "write");
       return { allowed: true };
     }
     return { allowed: false, reason: `Permission denied for ${mode} access to ${path3}` };
   }
+  addTempScope(path3, read, write) {
+    const resolved = resolve(path3);
+    this.tempScopes.push({ path: resolved, read, write });
+    logger.info({ path: resolved, read, write }, "Temp permission scope added (session only)");
+  }
+  findTempScope(resolvedPath) {
+    for (const scope of this.tempScopes) {
+      const scopeResolved = resolve(scope.path.replace(/^~/, homedir2()));
+      if (resolvedPath === scopeResolved || resolvedPath.startsWith(scopeResolved + sep)) {
+        return scope;
+      }
+    }
+    return void 0;
+  }
   matchPattern(command, pattern) {
     const regexStr = "^" + pattern.replace(/\*/g, ".*").replace(/\?/g, ".") + "$";
     try {
@@ -2861,18 +2880,18 @@ import { z as z8 } from "zod";
 import { resolve as resolve9 } from "path";
 function createApproveScopeTool(permissions) {
   return tool8({
-    description: "Request user approval to add a directory to the allowed filesystem scopes. Use this when a file operation fails due to scope permissions. The user will see an approval prompt (inline keyboard on Telegram, readline on CLI). If approved, the scope is added permanently.",
+    description: 'Request user approval to access a directory outside current scopes. Use this when a file tool returns a permission denied error. The user gets an approval prompt (Allow/Always/Deny buttons on Telegram, yes/always/no on CLI). "Allow" grants session-only access. "Always" persists to disk. After approval, retry the original file operation.',
     parameters: z8.object({
-      path: z8.string().describe("The directory path to add to allowed scopes"),
+      path: z8.string().describe("The directory path to request access to"),
       mode: z8.enum(["read", "write"]).describe("The access mode needed")
     }),
     execute: async ({ path: path3, mode }) => {
       const resolved = resolve9(path3);
       const result = await permissions.requestScopeExternal(resolved, mode);
       if (result.allowed) {
-        return `Access approved for ${mode} access to ${resolved}`;
+        return `Access approved for ${mode} access to ${resolved}. You can now retry the file operation.`;
       }
-      return `Access denied for ${mode} access to ${resolved}`;
+      return `Access denied for ${mode} access to ${resolved}. The user did not approve scope access.`;
     }
   });
 }