@dieulc/workflow 0.10.0 → 0.11.1

package/edit-policy.ts

@@ -33,13 +33,22 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import type { ArgumentCompletion } from "./utils.ts";
-import { joinArgumentValue, suppressExactArgumentMatch } from "./utils.ts";
+import {
+  joinArgumentValue,
+  suppressExactArgumentMatch,
+  translateForeignPath,
+} from "./utils.ts";
 import {
   COMMIT_CONFIG_DIR,
   WORKFLOW_SETTINGS_KEY,
   type JsonObject,
 } from "./commit-policy.ts";
 import { analyzeCommand } from "./permissions.ts";
+import {
+  isInsidePolicyPath,
+  normalizePolicyPath,
+  type FolderGateDecision,
+} from "./folder-policy.ts";
 
 /** Nested key under WORKFLOW_SETTINGS_KEY. */
 export const WRITE_POLICY_KEY = "writePolicy";
@@ -193,9 +202,11 @@ export function writePolicyConfigPaths(
   cwd: string,
   agentDir: string,
 ): WritePolicyConfigPaths {
+  const nativeCwd = translateForeignPath(cwd).path || cwd;
+  const nativeAgentDir = translateForeignPath(agentDir).path || agentDir;
   return {
-    global: path.join(agentDir, "settings.json"),
-    project: path.join(cwd, COMMIT_CONFIG_DIR, "settings.json"),
+    global: path.join(nativeAgentDir, "settings.json"),
+    project: path.join(nativeCwd, COMMIT_CONFIG_DIR, "settings.json"),
   };
 }
 
@@ -250,22 +261,33 @@ export interface ResolvedWritePolicy {
  * Resolve the effective Write Policy config from disk.
  * Never throws — a corrupt or missing file falls back to defaults.
  */
+export interface WritePolicyReadOptions {
+  /** Project settings are ignored unless explicitly trusted. */
+  trusted?: boolean;
+}
+
 export function readWritePolicyConfig(
   cwd: string,
   agentDir: string,
+  options: WritePolicyReadOptions = {},
 ): ResolvedWritePolicy {
   const paths = writePolicyConfigPaths(cwd, agentDir);
   const globalSettings = readJsonSafe(paths.global);
   const projectSettings = readJsonSafe(paths.project);
   const globalRaw = extractWritePolicyRaw(globalSettings);
   const projectRaw = extractWritePolicyRaw(projectSettings);
-  const config = mergeWritePolicyConfig(globalRaw, projectRaw);
+  // Trust is fail-closed for callers that do not say otherwise. The long-lived
+  // gate passes ctx.isProjectTrusted(); tests that exercise project settings
+  // explicitly opt in.
+  const trusted = options.trusted === true;
+  const effectiveProjectRaw = trusted ? projectRaw : undefined;
+  const config = mergeWritePolicyConfig(globalRaw, effectiveProjectRaw);
   return {
     config,
     sources: {
       global: globalRaw !== undefined,
       project: projectRaw !== undefined,
-      mode: writePolicyModeSourceOf(globalRaw, projectRaw),
+      mode: writePolicyModeSourceOf(globalRaw, effectiveProjectRaw),
     },
   };
 }
@@ -288,6 +310,9 @@ export function writeWritePolicyConfig(
 ): { path: string; ok: boolean; error?: string } {
   const paths = writePolicyConfigPaths(cwd, agentDir);
   const fp = scope === "project" ? paths.project : paths.global;
+  if (process.env.PI_FOLDER_POLICY_LOCKED === "1") {
+    return { path: fp, ok: false, error: "write policy is locked for this subagent" };
+  }
   try {
     const existing = readJsonSafe(fp);
     const root: JsonObject = existing ? { ...existing } : {};
@@ -342,25 +367,7 @@ export function writeWritePolicyConfig(
  * its own path compare equal; the filesystem root keeps its slash.
  */
 export function normalizeWritePath(p: unknown, cwd: string): string {
-  if (typeof p !== "string") return "";
-  const raw = p.trim();
-  if (!raw) return "";
-  const base = cwd && cwd.trim() ? cwd : process.cwd();
-  let resolved: string;
-  try {
-    resolved = path.resolve(base, raw);
-  } catch {
-    resolved = raw;
-  }
-  let normalized = resolved.replace(/\\/g, "/").toLowerCase();
-  while (
-    normalized.length > 1 &&
-    normalized.endsWith("/") &&
-    !/^[a-z]:\/$/.test(normalized)
-  ) {
-    normalized = normalized.slice(0, -1);
-  }
-  return normalized;
+  return normalizePolicyPath(p, cwd);
 }
 
 /**
@@ -380,8 +387,7 @@ export function isPathAllowed(
   for (const entry of allowedPaths) {
     const normalizedEntry = normalizeWritePath(entry, cwd);
     if (!normalizedEntry) continue;
-    if (normalizedTarget === normalizedEntry) return true;
-    if (normalizedTarget.startsWith(`${normalizedEntry}/`)) return true;
+    if (isInsidePolicyPath(normalizedTarget, normalizedEntry)) return true;
   }
   return false;
 }
@@ -591,6 +597,8 @@ export interface WriteGateInput {
   mutating: boolean;
   /** The call is already covered by a persistent grant. */
   allowed: boolean;
+  /** The shared folder floor's verdict (default allow for legacy callers). */
+  folder?: FolderGateDecision;
 }
 
 /**
@@ -607,8 +615,11 @@ export interface WriteGateInput {
  */
 export function decideWriteGate(input: WriteGateInput): WriteGateDecision {
   if (!input.mutating) return "allow";
-  if (input.mode === "allow") return "allow";
+  const folder = input.folder ?? "allow";
+  if (folder === "block") return "block";
   if (input.mode === "never") return "block";
+  if (input.mode === "allow") return folder === "ask" ? "ask" : "allow";
+  if (folder === "ask") return "ask";
   return input.allowed ? "allow" : "ask";
 }
 
@@ -708,10 +719,11 @@ export function sanitizeWriteInstruction(raw: unknown): string {
  */
 export function writeGateOptions(
   kind: WriteGateOptionKind,
+  opts: { allowAlways?: boolean } = {},
 ): readonly string[] {
   return [
     "Allow once (this turn)",
-    writeGateAlwaysLabel(kind),
+    ...(opts.allowAlways !== false ? [writeGateAlwaysLabel(kind)] : []),
     "Deny",
     WRITE_DENY_WITH_INSTRUCTIONS_LABEL,
   ];
@@ -729,6 +741,10 @@ export function writeGateAlwaysLabel(kind: WriteGateOptionKind): string {
       return "Always allow this path";
     case "paths":
       return "Always allow these paths";
+    case "folder":
+      return "Always allow this folder";
+    case "folders":
+      return "Always allow these folders";
     case "command":
       return "Always allow this command";
     case "commands":
@@ -772,6 +788,10 @@ export interface WriteDenyReasonInput {
   why?: string;
   /** The user's instruction; sanitized here. Empty → a plain denial. */
   instruction?: string;
+  /** Which policy asked; a folder refusal must not blame the write policy. */
+  source?: WriteGateSource;
+  /** Base folder for a folder-sourced denial. */
+  outside?: string;
 }
 
 /**
@@ -787,16 +807,23 @@ export interface WriteDenyReasonInput {
 export function buildWriteDenyReason(input: WriteDenyReasonInput): string {
   const target = String(input.target ?? "").trim() || "the requested write";
   const why = input.why ? ` (${input.why})` : "";
+  const policyName =
+    input.source === "folder"
+      ? "Folder policy 'ask'"
+      : input.source === "mixed"
+        ? "Permission policy 'ask'"
+        : "Write policy 'ask'";
+  const outside = input.outside ? ` outside ${input.outside}` : "";
   const instruction = sanitizeWriteInstruction(input.instruction);
   if (!instruction) {
     return (
-      `Write policy 'ask': the user declined this write${why}. Do not retry it. ` +
+      `${policyName}: the user declined this write${outside}${why}. Do not retry it. ` +
       "Propose the change (a diff or the exact edit) and let the user apply it, or ask whether to continue another way. " +
       `Target: ${target}`
     );
   }
   return (
-    `Write policy 'ask': the user denied this write${why} and gave this instruction:\n\n` +
+    `${policyName}: the user denied this write${outside}${why} and gave this instruction:\n\n` +
     `${instruction}\n\n` +
     "Do not retry this write. Follow the instruction above. If it cannot be followed, say so and stop. " +
     `Target: ${target}`
@@ -853,20 +880,29 @@ export interface WriteGateItem {
   key: string;
   /** Path grants "always allow" would persist for this item. */
   grantPaths?: string[];
+  /** Whether those path grants cover files or an outside folder. */
+  grantKind?: "file" | "folder";
   /** Command (or tool) grant "always allow" would persist for this item. */
   grantCommand?: string;
 }
 
+/** Which policy produced the ask: the write mode, the folder floor, or both. */
+export type WriteGateSource = "write" | "folder" | "mixed";
+
 /**
  * Which "always allow" label fits a set of items.
  *
- * "path"/"paths" — every item writes files; "command"/"commands" — every
- * item runs a command (or a path-less tool, whose grant is stored in the
- * command list); "mixed" — both in one turn.
+ * "path"/"paths" — every item writes files; "folder"/"folders" — every
+ * path grant comes from the shared folder floor and covers a folder;
+ * "command"/"commands" — every item runs a command (or a path-less tool,
+ * whose grant is stored in the command list); "mixed" — more than one kind
+ * in one turn.
  */
 export type WriteGateOptionKind =
   | "path"
   | "paths"
+  | "folder"
+  | "folders"
   | "command"
   | "commands"
   | "mixed";
@@ -917,8 +953,10 @@ export function writeGateItemFromClassification(
     why: classification.reason,
     key: writeGateTargetKey(tool, classification, cwd),
   };
-  if (grantPaths.length > 0) item.grantPaths = grantPaths;
-  else if (classification.key) item.grantCommand = classification.key;
+  if (grantPaths.length > 0) {
+    item.grantPaths = grantPaths;
+    item.grantKind = "file";
+  } else if (classification.key) item.grantCommand = classification.key;
   return item;
 }
 
@@ -929,7 +967,12 @@ export function writeGateItemsKind(
   const paths = items.filter((i) => (i.grantPaths?.length ?? 0) > 0);
   const commands = items.filter((i) => Boolean(i.grantCommand));
   if (paths.length > 0 && commands.length > 0) return "mixed";
-  if (paths.length > 0) return paths.length === 1 ? "path" : "paths";
+  if (paths.length > 0) {
+    if (paths.every((i) => i.grantKind === "folder")) {
+      return paths.length === 1 ? "folder" : "folders";
+    }
+    return paths.length === 1 ? "path" : "paths";
+  }
   if (commands.length > 0) return commands.length === 1 ? "command" : "commands";
   return "path";
 }
@@ -966,19 +1009,52 @@ export function writeGateTargetsLabel(
 /**
  * The dialog title.
  *
- * One write keeps today's wording verbatim; several writes are listed, so
- * the user sees exactly what the answer covers.
+ * The source is the policy that actually produced the ask: a folder-floor
+ * prompt must not claim the write policy asked (that confusion is what made
+ * the in-repo toolchain regression look like a write-policy bug). One write
+ * keeps today's wording verbatim; several writes are listed.
  */
-export function writeGateTitle(items: readonly WriteGateItem[]): string {
+export function writeGateTitle(
+  items: readonly WriteGateItem[],
+  source: WriteGateSource = "write",
+  base?: string,
+  opts: { grantBlockedReason?: string } = {},
+): string {
+  const outside =
+    source === "folder" && base ? `\nOutside: ${base}` : "";
+  const blocked = opts.grantBlockedReason
+    ? `\nGrant not available: ${opts.grantBlockedReason}`
+    : "";
+  const header =
+    source === "folder"
+      ? "Folder policy 'ask': allow this write outside the permitted folders?"
+      : source === "mixed"
+        ? "Permission required: allow this write? (write policy and folder policy are 'ask')"
+        : "Write policy 'ask': allow this write?";
   if (items.length <= 1) {
     const only = items[0];
-    const why = only?.why ? ` (${only.why})` : "";
-    return `Write policy 'ask': allow this write${why}?`;
+    const target = String(only?.target ?? "").trim();
+    const reason = String(only?.why ?? "").trim();
+    return (
+      header +
+      outside +
+      (target ? `\nTarget: ${target}` : "") +
+      (reason && reason !== target ? `\nReason: ${reason}` : "") +
+      blocked
+    );
   }
-  return (
-    `Write policy 'ask': allow these ${items.length} writes? ` +
-    `(${describeWriteGateItems(items)})`
-  );
+  const lines = items
+    .slice(0, 5)
+    .map((item) => `  • ${String(item.target ?? "").trim()}`)
+    .filter((line) => line.trim().length > 3);
+  if (items.length > 5) lines.push(`  … and ${items.length - 5} more`);
+  const many =
+    source === "folder"
+      ? `Folder policy 'ask': allow these ${items.length} writes outside the permitted folders?`
+      : source === "mixed"
+        ? `Permission required: allow these ${items.length} writes? (write policy and folder policy are 'ask')`
+        : `Write policy 'ask': allow these ${items.length} writes?`;
+  return `${many}${outside}\n${lines.join("\n")}${blocked}`;
 }
 
 // ── Argument completions (/write-policy) ────────────────────────────