@dreb/coding-agent 2.40.2 → 2.41.0

package/dist/modes/rpc/rpc-mode.js

@@ -14,6 +14,7 @@ import * as crypto from "node:crypto";
 import { basename } from "node:path";
 import { isValidThinkingLevel, VALID_THINKING_LEVELS } from "../../cli/args.js";
 import { VERSION } from "../../config.js";
+import { canonicalizeTrustedRoots, matchContextTrust, validateTrustedContextFolder, validateTrustedContextFolders, } from "../../core/context-trust.js";
 import { DailyCostTracker } from "../../core/daily-cost-tracker.js";
 import { getGitBranch } from "../../core/git-branch.js";
 import { parseModelPattern } from "../../core/model-resolver.js";
@@ -152,11 +153,14 @@ export function listAgentTypesForRpc(cwd) {
 /**
  * Handle the `get_settings` RPC command: snapshot the persistent default settings.
  *
- * Reads the SettingsManager's merged (global + project) view — these are the values that
- * seed fresh runtimes, NOT the live session state (`get_state` reports that). Extracted
+ * Most fields read the SettingsManager's merged (global + project) view. Context trust
+ * fields intentionally read global settings only, so projects cannot expand the policy.
+ * These seed fresh runtimes, NOT the live session state (`get_state` reports that). Extracted
  * (like {@link deleteSessionForRpc}) so it is unit-testable without a live RPC session.
  */
 export function getSettingsForRpc(settingsManager) {
+    const contextTrust = settingsManager.getGlobalContextTrustPolicy();
+    const configuredTrustedFolders = settingsManager.getConfiguredTrustedContextFolders();
     return {
         defaultProvider: settingsManager.getDefaultProvider(),
         defaultModel: settingsManager.getDefaultModel(),
@@ -168,7 +172,9 @@ export function getSettingsForRpc(settingsManager) {
         imageAutoResize: settingsManager.getImageAutoResize(),
         blockImages: settingsManager.getBlockImages(),
         enableSkillCommands: settingsManager.getEnableSkillCommands(),
-        autoLoadNestedContext: settingsManager.getAutoLoadNestedContext(),
+        autoLoadNestedContext: contextTrust.unrestricted,
+        trustedContextFolders: configuredTrustedFolders,
+        effectiveTrustedContextRoots: canonicalizeTrustedRoots(contextTrust.trustedFolders),
         transport: settingsManager.getTransport(),
         hideThinkingBlock: settingsManager.getHideThinkingBlock(),
         agentModels: settingsManager.getAgentModels(),
@@ -186,6 +192,7 @@ const SETTINGS_UPDATE_KEYS = [
     "blockImages",
     "enableSkillCommands",
     "autoLoadNestedContext",
+    "trustedContextFolders",
     "transport",
     "hideThinkingBlock",
     "agentModels",
@@ -223,6 +230,28 @@ function validateAgentModels(value) {
     }
     return { ok: true };
 }
+/** Evaluate a strictly canonical, absolute directory through the core trust matcher. */
+export function evaluateContextTrustForRpc(settingsManager, path) {
+    let canonicalTarget;
+    try {
+        canonicalTarget = validateTrustedContextFolder(path);
+    }
+    catch (error) {
+        return { ok: false, error: `Invalid context trust path: ${error.message}` };
+    }
+    const policy = settingsManager.getGlobalContextTrustPolicy();
+    const match = matchContextTrust(policy, canonicalTarget);
+    if (!match) {
+        return { ok: true, evaluation: { canonicalTarget, state: "untrusted" } };
+    }
+    if (policy.unrestricted) {
+        return { ok: true, evaluation: { canonicalTarget, state: "unrestricted" } };
+    }
+    return {
+        ok: true,
+        evaluation: { canonicalTarget, state: "trusted-root", grantingRoot: match.trustedRoot },
+    };
+}
 /**
  * Simple promise-based mutex that serializes settings writes. RPC commands are dispatched
  * concurrently (`void handleInputLine(line)`) so two `set_settings` commands can overlap.
@@ -249,6 +278,122 @@ function settingsWriteLock(fn) {
     settingsWriteQueue = next.catch(() => { });
     return next;
 }
+async function persistContextTrustMutationForRpc(settingsManager, folders, targetPath, mutation) {
+    settingsManager.drainErrors();
+    if (settingsManager.hasGlobalSettingsLoadError()) {
+        return {
+            ok: false,
+            error: "Cannot write settings: the global settings file failed to load (fix or remove the corrupt settings.json first)",
+        };
+    }
+    try {
+        settingsManager.setTrustedContextFolders(folders);
+        await settingsManager.flush();
+    }
+    catch (error) {
+        // A security-policy mutation must not remain effective solely in memory when its
+        // durable write fails. Reload restores the last persisted global policy.
+        settingsManager.reload();
+        return { ok: false, error: `Failed to persist settings: ${error.message}` };
+    }
+    const writeErrors = settingsManager.drainErrors();
+    if (writeErrors.length > 0) {
+        const detail = writeErrors.map((e) => `${e.scope}: ${e.error.message}`).join("; ");
+        // SettingsManager records queued write failures rather than rejecting flush(). Its
+        // in-memory policy has already changed, so restore it from durable storage before
+        // reporting failure rather than leaving an undurable trusted root effective.
+        settingsManager.reload();
+        return { ok: false, error: `Failed to persist settings: ${detail}` };
+    }
+    const evaluated = evaluateContextTrustForRpc(settingsManager, targetPath);
+    if (!evaluated.ok)
+        return evaluated;
+    return {
+        ok: true,
+        result: { evaluation: evaluated.evaluation, settings: getSettingsForRpc(settingsManager), ...mutation },
+    };
+}
+/** Add a canonical directory to the global trusted roots and flush the change. */
+export async function trustContextFolderForRpc(settingsManager, path) {
+    return settingsWriteLock(async () => {
+        const evaluated = evaluateContextTrustForRpc(settingsManager, path);
+        if (!evaluated.ok)
+            return evaluated;
+        // Existing malformed entries are fail-closed. A trust mutation rewrites the configured
+        // list as the canonical configured roots plus this new canonical root.
+        const roots = canonicalizeTrustedRoots(settingsManager.getConfiguredTrustedContextFolders());
+        let folders;
+        try {
+            folders = validateTrustedContextFolders([...roots, evaluated.evaluation.canonicalTarget]);
+        }
+        catch (error) {
+            return { ok: false, error: error.message };
+        }
+        return persistContextTrustMutationForRpc(settingsManager, folders, evaluated.evaluation.canonicalTarget, {
+            ...(folders.includes(evaluated.evaluation.canonicalTarget)
+                ? { addedRoot: evaluated.evaluation.canonicalTarget }
+                : {}),
+        });
+    });
+}
+/** Remove the root actually granting a directory access, rather than the supplied descendant. */
+export async function untrustContextFolderForRpc(settingsManager, path) {
+    return settingsWriteLock(async () => {
+        const evaluated = evaluateContextTrustForRpc(settingsManager, path);
+        if (!evaluated.ok)
+            return evaluated;
+        if (evaluated.evaluation.state === "unrestricted") {
+            return {
+                ok: false,
+                error: "Cannot untrust a context folder while unrestricted nested context loading is enabled; disable autoLoadNestedContext first",
+            };
+        }
+        if (evaluated.evaluation.state === "untrusted") {
+            return {
+                ok: true,
+                result: { evaluation: evaluated.evaluation, settings: getSettingsForRpc(settingsManager) },
+            };
+        }
+        const removedRoot = evaluated.evaluation.grantingRoot;
+        const roots = canonicalizeTrustedRoots(settingsManager.getConfiguredTrustedContextFolders());
+        return persistContextTrustMutationForRpc(settingsManager, roots.filter((root) => root !== removedRoot), evaluated.evaluation.canonicalTarget, { removedRoot });
+    });
+}
+/** Remove a configured trusted-folder string exactly as stored and flush the change. */
+export async function removeTrustedContextFolderForRpc(settingsManager, path) {
+    return settingsWriteLock(async () => {
+        if (typeof path !== "string" || path.length === 0) {
+            return { ok: false, error: "remove_trusted_context_folder requires a non-empty string path" };
+        }
+        settingsManager.drainErrors();
+        if (settingsManager.hasGlobalSettingsLoadError()) {
+            return {
+                ok: false,
+                error: "Cannot write settings: the global settings file failed to load (fix or remove the corrupt settings.json first)",
+            };
+        }
+        try {
+            settingsManager.removeTrustedContextFolder(path);
+            await settingsManager.flush();
+        }
+        catch (error) {
+            // A security-policy mutation must not remain effective solely in memory when its
+            // durable write fails. Reload restores the last persisted global policy.
+            settingsManager.reload();
+            return { ok: false, error: `Failed to persist settings: ${error.message}` };
+        }
+        const writeErrors = settingsManager.drainErrors();
+        if (writeErrors.length > 0) {
+            const detail = writeErrors.map((e) => `${e.scope}: ${e.error.message}`).join("; ");
+            // SettingsManager records queued write failures rather than rejecting flush(). Its
+            // in-memory policy has already changed, so restore it from durable storage before
+            // reporting failure rather than leaving an undurable trust removal effective.
+            settingsManager.reload();
+            return { ok: false, error: `Failed to persist settings: ${detail}` };
+        }
+        return { ok: true, result: { settings: getSettingsForRpc(settingsManager), removedFolder: path } };
+    });
+}
 /**
  * Handle the `set_settings` RPC command: validate and persist default settings.
  *
@@ -329,6 +474,15 @@ export async function setSettingsForRpc(settingsManager, modelRegistry, update)
             return validation;
         }
     }
+    let trustedContextFolders;
+    if (update.trustedContextFolders !== undefined) {
+        try {
+            trustedContextFolders = validateTrustedContextFolders(update.trustedContextFolders);
+        }
+        catch (error) {
+            return { ok: false, error: error.message };
+        }
+    }
     const hasProvider = update.defaultProvider !== undefined;
     const hasModel = update.defaultModel !== undefined;
     if (hasProvider !== hasModel) {
@@ -350,6 +504,7 @@ export async function setSettingsForRpc(settingsManager, modelRegistry, update)
             };
         }
     }
+    const updatesContextTrustPolicy = update.autoLoadNestedContext !== undefined || trustedContextFolders !== undefined;
     // Serialize the apply+flush+drain block so concurrent set_settings commands
     // cannot race on the shared error bucket. See settingsWriteLock doc.
     return settingsWriteLock(async () => {
@@ -367,69 +522,95 @@ export async function setSettingsForRpc(settingsManager, modelRegistry, update)
                 error: "Cannot write settings: the global settings file failed to load (fix or remove the corrupt settings.json first)",
             };
         }
-        // --- Apply (validated) ---
-        if (update.defaultProvider !== undefined && update.defaultModel !== undefined) {
-            settingsManager.setDefaultModelAndProvider(update.defaultProvider, update.defaultModel);
-        }
-        if (update.defaultThinkingLevel !== undefined) {
-            settingsManager.setDefaultThinkingLevel(update.defaultThinkingLevel);
-        }
-        if (update.steeringMode !== undefined) {
-            settingsManager.setSteeringMode(update.steeringMode);
-        }
-        if (update.followUpMode !== undefined) {
-            settingsManager.setFollowUpMode(update.followUpMode);
-        }
-        if (update.compactionEnabled !== undefined) {
-            settingsManager.setCompactionEnabled(update.compactionEnabled);
-        }
-        if (update.retryEnabled !== undefined) {
-            settingsManager.setRetryEnabled(update.retryEnabled);
-        }
-        if (update.imageAutoResize !== undefined) {
-            settingsManager.setImageAutoResize(update.imageAutoResize);
-        }
-        if (update.blockImages !== undefined) {
-            settingsManager.setBlockImages(update.blockImages);
-        }
-        if (update.enableSkillCommands !== undefined) {
-            settingsManager.setEnableSkillCommands(update.enableSkillCommands);
-        }
-        if (update.autoLoadNestedContext !== undefined) {
-            settingsManager.setAutoLoadNestedContext(update.autoLoadNestedContext);
-        }
-        if (update.transport !== undefined) {
-            settingsManager.setTransport(update.transport);
-        }
-        if (update.hideThinkingBlock !== undefined) {
-            settingsManager.setHideThinkingBlock(update.hideThinkingBlock);
-        }
-        const warnings = [];
-        if (update.agentModels !== undefined) {
-            for (const [agentName, models] of Object.entries(update.agentModels)) {
-                if (settingsManager.hasProjectAgentModelOverride(agentName)) {
-                    warnings.push(`A project-level agentModels override for ${JSON.stringify(agentName)} (.dreb/settings.json) ` +
-                        "takes precedence — this change to global settings will have no effect. " +
-                        "Edit the project settings file to change it.");
-                }
-                if (models.length > 0) {
-                    settingsManager.setAgentModelsForAgent(agentName, models);
+        try {
+            // Phase 1: durably persist every ordinary setting before touching the
+            // security-sensitive context trust policy.
+            if (update.defaultProvider !== undefined && update.defaultModel !== undefined) {
+                settingsManager.setDefaultModelAndProvider(update.defaultProvider, update.defaultModel);
+            }
+            if (update.defaultThinkingLevel !== undefined) {
+                settingsManager.setDefaultThinkingLevel(update.defaultThinkingLevel);
+            }
+            if (update.steeringMode !== undefined) {
+                settingsManager.setSteeringMode(update.steeringMode);
+            }
+            if (update.followUpMode !== undefined) {
+                settingsManager.setFollowUpMode(update.followUpMode);
+            }
+            if (update.compactionEnabled !== undefined) {
+                settingsManager.setCompactionEnabled(update.compactionEnabled);
+            }
+            if (update.retryEnabled !== undefined) {
+                settingsManager.setRetryEnabled(update.retryEnabled);
+            }
+            if (update.imageAutoResize !== undefined) {
+                settingsManager.setImageAutoResize(update.imageAutoResize);
+            }
+            if (update.blockImages !== undefined) {
+                settingsManager.setBlockImages(update.blockImages);
+            }
+            if (update.enableSkillCommands !== undefined) {
+                settingsManager.setEnableSkillCommands(update.enableSkillCommands);
+            }
+            if (update.transport !== undefined) {
+                settingsManager.setTransport(update.transport);
+            }
+            if (update.hideThinkingBlock !== undefined) {
+                settingsManager.setHideThinkingBlock(update.hideThinkingBlock);
+            }
+            const warnings = [];
+            if (update.agentModels !== undefined) {
+                for (const [agentName, models] of Object.entries(update.agentModels)) {
+                    if (settingsManager.hasProjectAgentModelOverride(agentName)) {
+                        warnings.push(`A project-level agentModels override for ${JSON.stringify(agentName)} (.dreb/settings.json) ` +
+                            "takes precedence — this change to global settings will have no effect. " +
+                            "Edit the project settings file to change it.");
+                    }
+                    if (models.length > 0) {
+                        settingsManager.setAgentModelsForAgent(agentName, models);
+                    }
+                    else {
+                        settingsManager.removeAgentModelsForAgent(agentName);
+                    }
                 }
-                else {
-                    settingsManager.removeAgentModelsForAgent(agentName);
+            }
+            await settingsManager.flush();
+            const writeErrors = settingsManager.drainErrors();
+            if (writeErrors.length > 0) {
+                const detail = writeErrors.map((e) => `${e.scope}: ${e.error.message}`).join("; ");
+                // Context trust has not yet been modified, so do not reload: doing so
+                // could discard unrelated pending in-memory state.
+                return { ok: false, error: `Failed to persist settings: ${detail}` };
+            }
+            // Phase 2: apply both context fields in one queued, atomic write only after
+            // phase 1 is durably successful.
+            if (updatesContextTrustPolicy) {
+                settingsManager.setContextTrust({
+                    ...(update.autoLoadNestedContext !== undefined ? { autoLoadNested: update.autoLoadNestedContext } : {}),
+                    ...(trustedContextFolders !== undefined ? { trustedFolders: trustedContextFolders } : {}),
+                });
+                await settingsManager.flush();
+                const ctxErrors = settingsManager.drainErrors();
+                if (ctxErrors.length > 0) {
+                    const detail = ctxErrors.map((e) => `${e.scope}: ${e.error.message}`).join("; ");
+                    // The context write failed, so durable storage retains its previous,
+                    // fail-closed policy. Restore that policy in memory before returning.
+                    settingsManager.reload();
+                    return { ok: false, error: `Failed to persist settings: ${detail}` };
                 }
             }
+            return warnings.length > 0
+                ? { ok: true, settings: getSettingsForRpc(settingsManager), warnings }
+                : { ok: true, settings: getSettingsForRpc(settingsManager) };
         }
-        // Ensure durability and surface write errors instead of losing them.
-        await settingsManager.flush();
-        const writeErrors = settingsManager.drainErrors();
-        if (writeErrors.length > 0) {
-            const detail = writeErrors.map((e) => `${e.scope}: ${e.error.message}`).join("; ");
-            return { ok: false, error: `Failed to persist settings: ${detail}` };
+        catch (error) {
+            if (updatesContextTrustPolicy) {
+                // Setters and flush() can also fail synchronously. The same fail-closed
+                // rollback is required before returning that persistence failure.
+                settingsManager.reload();
+            }
+            return { ok: false, error: `Failed to persist settings: ${error.message}` };
         }
-        return warnings.length > 0
-            ? { ok: true, settings: getSettingsForRpc(settingsManager), warnings }
-            : { ok: true, settings: getSettingsForRpc(settingsManager) };
     });
 }
 function normalizePreview(text) {
@@ -1128,6 +1309,30 @@ export async function runRpcMode(session, modelFallbackMessage) {
                     ? { ...result.settings, warnings: result.warnings }
                     : result.settings);
             }
+            case "evaluate_context_trust": {
+                const result = evaluateContextTrustForRpc(session.settingsManager, command.path);
+                return result.ok
+                    ? success(id, "evaluate_context_trust", result.evaluation)
+                    : error(id, "evaluate_context_trust", result.error);
+            }
+            case "trust_context_folder": {
+                const result = await trustContextFolderForRpc(session.settingsManager, command.path);
+                return result.ok
+                    ? success(id, "trust_context_folder", result.result)
+                    : error(id, "trust_context_folder", result.error);
+            }
+            case "untrust_context_folder": {
+                const result = await untrustContextFolderForRpc(session.settingsManager, command.path);
+                return result.ok
+                    ? success(id, "untrust_context_folder", result.result)
+                    : error(id, "untrust_context_folder", result.error);
+            }
+            case "remove_trusted_context_folder": {
+                const result = await removeTrustedContextFolderForRpc(session.settingsManager, command.path);
+                return result.ok
+                    ? success(id, "remove_trusted_context_folder", result.result)
+                    : error(id, "remove_trusted_context_folder", result.error);
+            }
             // =================================================================
             // Version
             // =================================================================