@link-assistant/agent 0.22.10 → 0.24.0

package/src/tool/edit.ts

@@ -13,6 +13,7 @@ import { Bus } from '../bus';
 import { FileTime } from '../file/time';
 import { Instance } from '../project/instance';
 import { Snapshot } from '../snapshot';
+import { Permission } from '../permission';
 
 function normalizeLineEndings(text: string): string {
   return text.replaceAll('\r\n', '\n');
@@ -42,11 +43,21 @@ export const EditTool = Tool.define('edit', {
       throw new Error('oldString and newString must be different');
     }
 
-    // No restrictions - unrestricted file editing
     const filePath = path.isAbsolute(params.filePath)
       ? params.filePath
       : path.join(Instance.directory, params.filePath);
 
+    // Permission enforcement (issue #271). `auto` mode allows immediately;
+    // plan/readonly modes deny; `ask` mode emits a JSON permission request.
+    await Permission.check({
+      type: 'edit',
+      title: filePath,
+      sessionID: ctx.sessionID,
+      messageID: ctx.messageID,
+      callID: ctx.callID,
+      metadata: { filePath },
+    });
+
     let diff = '';
     let contentOld = '';
     let contentNew = '';

package/src/tool/patch.ts

@@ -8,6 +8,7 @@ import { FileWatcher } from '../file/watcher';
 import { Instance } from '../project/instance';
 import { Patch } from '../patch';
 import { Filesystem } from '../util/filesystem';
+import { Permission } from '../permission';
 import { createTwoFilesPatch } from 'diff';
 
 const PatchParams = z.object({
@@ -141,7 +142,24 @@ export const PatchTool = Tool.define('patch', {
       }
     }
 
-    // No restrictions - apply changes directly
+    // Permission enforcement (issue #271). Patching mutates the filesystem and
+    // is governed by the `edit` policy. `auto` allows; plan/readonly deny;
+    // `ask` emits a JSON permission request per affected file.
+    for (const change of fileChanges) {
+      await Permission.check({
+        type: 'edit',
+        title: change.movePath ?? change.filePath,
+        sessionID: ctx.sessionID,
+        messageID: ctx.messageID,
+        callID: ctx.callID,
+        metadata: {
+          filePath: change.filePath,
+          movePath: change.movePath,
+          changeType: change.type,
+        },
+      });
+    }
+
     // Apply the changes
     const changedFiles: string[] = [];
 

package/src/tool/registry.ts

@@ -16,8 +16,44 @@ import { Instance } from '../project/instance';
 import { Config } from '../config/file-config';
 import { WebSearchTool } from './websearch';
 import { CodeSearchTool } from './codesearch';
+import { config } from '../config/config';
 
 export namespace ToolRegistry {
+  /**
+   * Tools that can mutate the filesystem or execute shell commands.
+   * These are disabled when read-only / planning mode is active so that the
+   * agent can only read, search and plan. This is the native, enforceable
+   * counterpart of agent-commander's `--read-only` flag (issue #271).
+   */
+  export const READ_ONLY_DENIED_TOOLS = [
+    'bash',
+    'edit',
+    'write',
+    'multiedit',
+    'patch',
+  ] as const;
+
+  /**
+   * Resolve the set of tool ids that must be denied for the current run.
+   *
+   * Combines the read-only/planning preset (`config.readOnly`) with any
+   * explicit `--disable-tools a,b,c` list. The result is enforced both when
+   * exposing tools to the model and when tools are invoked indirectly via the
+   * `batch` tool, so the restriction cannot be bypassed.
+   */
+  export function deniedTools(): Set<string> {
+    const denied = new Set<string>();
+    if (config.readOnly) {
+      for (const id of READ_ONLY_DENIED_TOOLS) denied.add(id);
+    }
+    const list = config.disableTools ?? '';
+    for (const raw of list.split(',')) {
+      const id = raw.trim().toLowerCase();
+      if (id) denied.add(id);
+    }
+    return denied;
+  }
+
   export const state = Instance.state(async () => {
     const custom = [] as Tool.Info[];
     return { custom };

package/src/tool/webfetch.ts

@@ -3,6 +3,7 @@ import { Tool } from './tool';
 import TurndownService from 'turndown';
 import DESCRIPTION from './webfetch.txt';
 import { createVerboseFetch } from '../util/verbose-fetch';
+import { Permission } from '../permission';
 
 const verboseFetch = createVerboseFetch(fetch, { caller: 'webfetch' });
 
@@ -33,7 +34,17 @@ export const WebFetchTool = Tool.define('webfetch', {
       throw new Error('URL must start with http:// or https://');
     }
 
-    // No restrictions - unrestricted web fetch
+    // Permission enforcement (issue #271). `auto` allows; plan/readonly allow
+    // (webfetch is read-only); `ask` emits a JSON permission request.
+    await Permission.check({
+      type: 'webfetch',
+      title: params.url,
+      sessionID: ctx.sessionID,
+      messageID: ctx.messageID,
+      callID: ctx.callID,
+      metadata: { url: params.url },
+    });
+
     const timeout = Math.min(
       (params.timeout ?? DEFAULT_TIMEOUT / 1000) * 1000,
       MAX_TIMEOUT

package/src/tool/write.ts

@@ -3,6 +3,7 @@ import * as path from 'path';
 import { Tool } from './tool';
 import DESCRIPTION from './write.txt';
 import { Instance } from '../project/instance';
+import { Permission } from '../permission';
 
 export const WriteTool = Tool.define('write', {
   description: DESCRIPTION,
@@ -15,11 +16,22 @@ export const WriteTool = Tool.define('write', {
       ),
   }),
   async execute(params, ctx) {
-    // No restrictions - unrestricted file system access
     const filepath = path.isAbsolute(params.filePath)
       ? params.filePath
       : path.join(Instance.directory, params.filePath);
 
+    // Permission enforcement (issue #271). Writing is governed by the same
+    // `edit` policy as the edit tool: `auto` allows, plan/readonly deny,
+    // `ask` emits a JSON permission request.
+    await Permission.check({
+      type: 'edit',
+      title: filepath,
+      sessionID: ctx.sessionID,
+      messageID: ctx.messageID,
+      callID: ctx.callID,
+      metadata: { filePath: filepath },
+    });
+
     const file = Bun.file(filepath);
     const exists = await file.exists();