@naarang/ccc 1.0.12 → 1.0.13

package/dist/hooks/permissions_hook.js

@@ -123,6 +123,68 @@ function getPermissionModeForSession(sessionId) {
   }
 }
 
+/**
+ * Reads the current working directory for a session from session-config.json
+ * Returns the cwd or null if not found
+ */
+function getCwdForSession(sessionId) {
+  try {
+    if (!fs.existsSync(SESSION_CONFIG_FILE)) {
+      log('Session config file not found, no cwd available', { path: SESSION_CONFIG_FILE });
+      return null;
+    }
+
+    const data = fs.readFileSync(SESSION_CONFIG_FILE, 'utf8');
+    const config = JSON.parse(data);
+
+    if (config[sessionId] && config[sessionId].cwd) {
+      const cwd = config[sessionId].cwd;
+      log('Found cwd for session', { sessionId, cwd });
+      return cwd;
+    }
+
+    log('No cwd found for session', { sessionId });
+    return null;
+
+  } catch (error) {
+    log('Error reading cwd from session config', { error: error.message });
+    return null;
+  }
+}
+
+/**
+ * Checks if a file path is outside the project's current working directory
+ * Returns true if the file is outside the project directory
+ */
+function isFileOutsideProjectDirectory(filePath, projectCwd) {
+  try {
+    if (!filePath || !projectCwd) {
+      return false;
+    }
+
+    // Resolve both paths to absolute paths
+    const absoluteFilePath = path.resolve(filePath);
+    const absoluteProjectCwd = path.resolve(projectCwd);
+
+    // Check if the file path starts with the project cwd
+    const isInside = absoluteFilePath.startsWith(absoluteProjectCwd + path.sep) ||
+                     absoluteFilePath === absoluteProjectCwd;
+
+    log('Checking if file is outside project directory', {
+      filePath: absoluteFilePath,
+      projectCwd: absoluteProjectCwd,
+      isOutside: !isInside
+    });
+
+    return !isInside;
+
+  } catch (error) {
+    log('Error checking file path', { error: error.message });
+    // On error, be conservative and ask for permission
+    return true;
+  }
+}
+
 /**
  * Reads JSON input from stdin
  */
@@ -537,6 +599,26 @@ async function main() {
       // For now, ask user normally
     }
 
+    // Special handling for Read tool - check if file is outside project directory
+    if (toolName === 'Read') {
+      const projectCwd = getCwdForSession(hookInput.session_id);
+      const filePath = hookInput.tool_input?.file_path;
+
+      if (projectCwd && filePath) {
+        const isOutside = isFileOutsideProjectDirectory(filePath, projectCwd);
+
+        if (!isOutside) {
+          // File is inside project directory, auto-approve
+          log('Auto-approving Read (file inside project directory)', { filePath, projectCwd });
+          outputDecision('allow', 'File is within project directory');
+          process.exit(0);
+        } else {
+          // File is outside project directory, will ask user below
+          log('Read operation outside project directory, will ask user', { filePath, projectCwd });
+        }
+      }
+    }
+
     // Check if this specific tool+command is in allowed list
     if (checkAllowedTools(toolName, hookInput.tool_input)) {
       log('Auto-approving (found in allowed list)');