aegiscode 3.1.10 → 3.4.2

package/src/tools/execution/stages/ConfirmationStage.ts

@@ -1,203 +0,0 @@
-/**
- * Confirmation Stage - 用户确认阶段
- * 
- */
-
-import type {
-  PipelineStage,
-  ToolExecution,
-  ConfirmationDetails,
-} from '../types.js';
-
-export class ConfirmationStage implements PipelineStage {
-  readonly name = 'confirmation';
-
-  constructor(
-    private sessionApprovals: Set<string>,
-    private sessionDenials?: Set<string>
-  ) {}
-
-  async process(execution: ToolExecution): Promise<void> {
-    // 如果不需要确认，直接通
-    if (!execution._internal.needsConfirmation) {
-      return;
-    }
-
-    const forceConfirmation = execution._internal.forceConfirmation === true;
-
-    // 模型级设置：禁用确认提示时直接放行（除非该操作被标记为强制确认
-    if (!forceConfirmation && execution.context.requireConfirmation === false) {
-      return;
-    }
-
-    const tool = execution._internal.tool;
-    if (!tool) {
-      execution.abort('Tool not found in execution context');
-      return;
-    }
-
-    // 检查是否已在会话中拒绝
-    const signature = execution._internal.permissionSignature;
-    if (signature && this.sessionDenials?.has(signature)) {
-      execution.abort('Not executed: you tried this exact action earlier in this session and the user declined it. Choose a different approach.');
-      return;
-    }
-
-    // 检查是否已在会话中批准（强制确认的操作不允许通过"永远允许"跳过
-    if (!forceConfirmation && signature && this.sessionApprovals.has(signature)) {
-      return;
-    }
-
-    // 构建确认详
-    const confirmationDetails: ConfirmationDetails = {
-      title: `Permission Required: ${tool.name}`,
-      message: execution._internal.confirmationReason || 'This operation requires your confirmation',
-      details: this.generatePreview(execution),
-      risks: this.extractRisks(execution),
-      affectedFiles: this.getAffectedPaths(execution),
-    };
-
-    // 请求用户确
-    const handler = execution.context.confirmationHandler;
-    if (!handler) {
-      // 无确认处理器，默认拒
-      // Worded to avoid "permission/approval/dialog" vocabulary — this string becomes
-      // llmContent in a real tool_result, and re-using that vocabulary cluster is what
-      // lets the model later free-associate a hallucinated "blocked, click Allow" reply
-      // in an unrelated turn with no tool call at all.
-      execution.abort('Not executed: this session cannot ask the user a yes/no question right now. Retrying this exact action will not help — explain what you wanted to do in your text response instead, or ask the user directly.');
-      return;
-    }
-
-    const response = await handler.requestConfirmation(confirmationDetails);
-
-    if (!response.approved) {
-      // 如果用户选择"永远拒绝"，保存到会话拒绝列
-      if (response.scope === 'session' && signature && this.sessionDenials) {
-        this.sessionDenials.add(signature);
-      }
-      execution.abort(`Not executed: the user declined this action${response.reason ? ` — ${response.reason}` : ''}. Choose a different approach.`);
-      return;
-    }
-
-    // 如果用户选择"永远允许"，保存到会话批准列
-    if (response.scope === 'session' && signature) {
-      this.sessionApprovals.add(signature);
-    }
-  }
-
-  /**
-   * 
-   */
-  private generatePreview(execution: ToolExecution): string | undefined {
-    const { toolName, params } = execution;
-
-    switch (toolName) {
-      case 'Edit': {
-        const oldString = params.old_string as string;
-        const newString = params.new_string as string;
-        const filePath = params.file_path as string;
-
-        return `**File:** ${filePath}
-
-**Before:**
-\`\`\`
-${this.truncate(oldString, 10)}
-\`\`\`
-
-**After:**
-\`\`\`
-${this.truncate(newString, 10)}
-\`\`\``;
-      }
-
-      case 'Write': {
-        const content = params.contents as string;
-        const filePath = params.file_path as string;
-
-        return `**File:** ${filePath}
-
-**Content Preview:**
-\`\`\`
-${this.truncate(content, 20)}
-\`\`\``;
-      }
-
-      case 'Bash': {
-        const command = params.command as string;
-        const cwd = params.working_directory as string;
-
-        return `**Command:** \`${command}\`${cwd ? `\n**Directory:** ${cwd}` : ''}`;
-      }
-
-      default:
-        return undefined;
-    }
-  }
-
-  /**
-   * 
-   */
-  private extractRisks(execution: ToolExecution): string[] {
-    const risks: string[] = [];
-    const { toolName, params } = execution;
-    const tool = execution._internal.tool;
-
-    // 基于工具类型的风
-    if (tool?.kind === 'write') {
-      risks.push('This operation will modify files');
-    } else if (tool?.kind === 'execute') {
-      risks.push('This operation will execute system commands');
-    }
-
-    // 基于参数的风
-    if (toolName === 'Bash') {
-      const command = params.command as string;
-      if (command.includes('rm')) {
-        risks.push('Command may delete files');
-      }
-      if (command.includes('sudo')) {
-        risks.push('Command requires elevated privileges');
-      }
-      if (command.includes('|')) {
-        risks.push('Command uses piping');
-      }
-    }
-
-    // 检查敏感文
-    const confirmReason = execution._internal.confirmationReason || '';
-    if (confirmReason.includes('Sensitive file')) {
-      risks.push('Operation involves sensitive files');
-    }
-
-    return risks;
-  }
-
-  /**
-   * 
-   */
-  private getAffectedPaths(execution: ToolExecution): string[] {
-    const params = execution.params;
-    const pathKeys = ['file_path', 'path', 'target', 'destination'];
-    const paths: string[] = [];
-
-    for (const key of pathKeys) {
-      if (typeof params[key] === 'string') {
-        paths.push(params[key] as string);
-      }
-    }
-
-    return paths;
-  }
-
-  /**
-   * 
-   */
-  private truncate(text: string, maxLines: number = 10): string {
-    const lines = text.split('\n');
-    if (lines.length <= maxLines) {
-      return text;
-    }
-    return lines.slice(0, maxLines).join('\n') + `\n... (${lines.length - maxLines} more lines)`;
-  }
-}

package/src/tools/execution/stages/DiscoveryStage.ts

@@ -1,46 +0,0 @@
-/**
- * Discovery Stage - 工具发现阶段
- * 
- * Per-model allowedTools/disallowedTools filtering added here.
- */
-
-import type { PipelineStage, ToolExecution } from '../types.js';
-import type { ToolRegistry } from '../../registry.js';
-
-export class DiscoveryStage implements PipelineStage {
-  readonly name = 'discovery';
-
-  constructor(
-    private registry: ToolRegistry,
-    private allowedTools?: string[],
-    private disallowedTools?: string[],
-  ) {}
-
-  async process(execution: ToolExecution): Promise<void> {
-    // 1. Check per-model disallowed tools
-    if (this.disallowedTools?.includes(execution.toolName)) {
-      execution.abort(`Tool "${execution.toolName}" is disallowed for the current model`);
-      return;
-    }
-
-    // 2. Check per-model allowed tools (if set, only these are allowed)
-    if (this.allowedTools && this.allowedTools.length > 0) {
-      if (!this.allowedTools.includes(execution.toolName)) {
-        execution.abort(
-          `Tool "${execution.toolName}" is not in the allowed tools list for the current model`
-        );
-        return;
-      }
-    }
-
-    const tool = this.registry.get(execution.toolName);
-
-    if (!tool) {
-      execution.abort(`Tool "${execution.toolName}" not found in registry`);
-      return;
-    }
-
-    // 将工具实例附加到执行上下
-    execution._internal.tool = tool;
-  }
-}

package/src/tools/execution/stages/ExecutionStage.ts

@@ -1,48 +0,0 @@
-/**
- * Execution Stage - 实际执行阶段
- * 
- */
-
-import type { PipelineStage, ToolExecution } from '../types.js';
-import type { ExecutionContext } from '../../types.js';
-import type { CacheStage } from './CacheStage.js';
-
-export class ExecutionStage implements PipelineStage {
-  readonly name = 'execution';
-
-  constructor(private cacheStage?: CacheStage) {}
-
-  async process(execution: ToolExecution): Promise<void> {
-    // CacheStage already set the result on a cache hit — nothing to run.
-    if (execution.getResult()) return;
-
-    const tool = execution._internal.tool;
-
-    if (!tool) {
-      execution.abort('Tool not found in execution context');
-      return;
-    }
-
-    try {
-      // 构建执行上下
-      const context: ExecutionContext = {
-        sessionId: execution.context.sessionId,
-        signal: execution.context.signal,
-        cwd: execution.context.workspaceRoot,
-      };
-
-      // 执行工
-      const result = await tool.execute(execution.params, context);
-
-      // 设置结
-      execution.setResult(result);
-
-      const cacheKey = execution._internal.cacheKey;
-      if (cacheKey) this.cacheStage?.cacheResult(cacheKey, result);
-    } catch (error) {
-      // 处理执行错
-      const errorMessage = error instanceof Error ? error.message : String(error);
-      execution.abort(`Tool execution failed: ${errorMessage}`);
-    }
-  }
-}

package/src/tools/execution/stages/FormattingStage.ts

@@ -1,44 +0,0 @@
-/**
- * Formatting Stage - 结果格式化阶段
- * 
- */
-
-import type { PipelineStage, ToolExecution } from '../types.js';
-
-export class FormattingStage implements PipelineStage {
-  readonly name = 'formatting';
-
-  async process(execution: ToolExecution): Promise<void> {
-    const result = execution.getResult();
-
-    if (!result) {
-      // 没有结果（可能是被中止了），不处
-      return;
-    }
-
-    // 确保结果格式正
-    if (!result.llmContent) {
-      result.llmContent = result.success
-        ? 'Execution completed successfully'
-        : 'Execution failed';
-    }
-
-    if (!result.displayContent) {
-      result.displayContent = result.success
-        ? `✅ ${execution.toolName} completed`
-        : `❌ ${execution.toolName} failed`;
-    }
-
-    // 添加执行元数
-    result.metadata = {
-      ...result.metadata,
-      executionId: execution.context.sessionId,
-      toolName: execution.toolName,
-      timestamp: Date.now(),
-      permissionMode: execution.context.permissionMode,
-    };
-
-    // 更新结
-    execution.setResult(result);
-  }
-}

package/src/tools/execution/stages/HookStage.ts

@@ -1,72 +0,0 @@
-/**
- * Hook Stage (Pre) - PreToolUse Hooks 执行阶段
- * 
- */
-
-import { nanoid } from 'nanoid';
-import type { PipelineStage, ToolExecution } from '../types.js';
-import { onPreToolUse } from '../../../hooks/index.js';
-
-export class HookStage implements PipelineStage {
-  readonly name = 'hook';
-
-  async process(execution: ToolExecution): Promise<void> {
-    const tool = execution._internal.tool;
-    if (!tool) {
-      return;
-    }
-
-    // 生成唯一的 toolUseId（PostToolUse 阶段复
-    const toolUseId = execution.context.messageId || `tool_${nanoid()}`;
-    execution._internal.hookToolUseId = toolUseId;
-
-    // 执行 PreToolUse hooks（通
-    const result = await onPreToolUse(
-      tool.name,
-      toolUseId,
-      execution.params as Record<string, unknown>,
-      execution.context.sessionId || 'unknown',
-      execution.context.workspaceRoot || process.cwd(),
-      execution.context.permissionMode
-    );
-
-    // 处理 Hook 决
-    if (result.decision === 'deny') {
-      // 直接拒绝，中止执
-      execution.abort(result.reason || 'Hook blocked execution');
-      return;
-    }
-
-    if (result.decision === 'ask') {
-      // 标记需要用户确认（传递给 Confirmation 阶
-      execution._internal.needsConfirmation = true;
-      execution._internal.confirmationReason =
-        result.reason || 'Hook requires confirmation';
-      return;
-    }
-
-    // decision === 'allow'：应用修改后的输
-    if (result.modifiedInput) {
-      const newParams = { ...execution.params, ...result.modifiedInput };
-
-      // 重新验证修改后的参
-      if (tool.build) {
-        try {
-          tool.build(newParams);
-          // 更新参
-          execution.params = newParams;
-        } catch (err) {
-          execution.abort(
-            `Hook modified parameters are invalid: ${err instanceof Error ? err.message : String(err)}`
-          );
-          return;
-        }
-      }
-    }
-
-    // 输出警告信
-    if (result.warning) {
-      console.warn(`[Hook Warning] ${result.warning}`);
-    }
-  }
-}

package/src/tools/execution/stages/PermissionStage.ts

@@ -1,287 +0,0 @@
-/**
- * Permission Stage - 权限检查阶段
- * 
- */
-
-import { ToolKind } from '../../types.js';
-import {
-  PermissionMode,
-  PermissionResult,
-  type PipelineStage,
-  type ToolExecution,
-  type PermissionConfig,
-  type PermissionCheckResult,
-} from '../types.js';
-import { PermissionChecker } from '../../validation/PermissionChecker.js';
-import { SensitiveFileDetector, SensitivityLevel } from '../../validation/SensitiveFileDetector.js';
-import { onPermissionRequest } from '../../../hooks/index.js';
-
-export class PermissionStage implements PipelineStage {
-  readonly name = 'permission';
-  private permissionChecker: PermissionChecker;
-  private defaultMode: PermissionMode;
-
-  constructor(
-    config?: Partial<PermissionConfig>,
-    private sessionApprovals?: Set<string>,
-    private sessionDenials?: Set<string>,
-    defaultMode: PermissionMode = PermissionMode.DEFAULT
-  ) {
-    this.permissionChecker = new PermissionChecker(config);
-    this.defaultMode = defaultMode;
-  }
-
-  async process(execution: ToolExecution): Promise<void> {
-    const tool = execution._internal.tool;
-
-    if (!tool) {
-      execution.abort('Tool not found in execution context');
-      return;
-    }
-
-    // 1. 创建工具调用实例（含 Zod 验
-    try {
-      const invocation = tool.build(execution.params);
-      execution._internal.invocation = invocation;
-    } catch (error) {
-      execution.abort(
-        `Parameter validation failed: ${error instanceof Error ? error.message : String(error)}`
-      );
-      return;
-    }
-
-    // 2. 构建权限签
-    const signature = PermissionChecker.buildSignature({
-      toolName: tool.name,
-      params: execution.params,
-      tool,
-    });
-    execution._internal.permissionSignature = signature;
-
-    // 3. 检查会话拒绝列
-    if (this.sessionDenials?.has(signature)) {
-      // Phrased to avoid "permission/denied" vocabulary: this exact string becomes
-      // llmContent in a real tool_result, and the model can later free-associate a
-      // hallucinated continuation of it in an unrelated turn with no tool call.
-      execution.abort('Not executed: you tried this exact action earlier in this session and the user declined it. Choose a different approach.');
-      return;
-    }
-
-    // 4. 检查会话批准列
-    if (this.sessionApprovals?.has(signature)) {
-      // 已在会话中批准，跳过权限检
-      return;
-    }
-
-    // 5. 执行权限检
-    let checkResult = this.permissionChecker.check({
-      toolName: tool.name,
-      params: execution.params,
-      tool,
-    });
-
-    // 6. 应用权限模式覆
-    const currentMode = execution.context.permissionMode || this.defaultMode;
-    checkResult = this.applyModeOverrides(tool.kind, checkResult, currentMode);
-
-    // 7. 根据结果采取行
-    switch (checkResult.result) {
-      case PermissionResult.DENY:
-        execution.abort(checkResult.reason || 'Not executed: this action is not allowed under current settings. Choose a different approach.');
-        return;
-
-      case PermissionResult.ASK:
-        // 执
-        const hookDecision = await this.executePermissionHook(execution, tool.name);
-        if (hookDecision === 'approve') {
-          // Hook 批准，跳过确
-          break;
-        } else if (hookDecision === 'deny') {
-          // Hook 拒
-          execution.abort('Not executed: a configured hook excludes this action. Choose a different approach.');
-          return;
-        }
-        // Hook 返回 ask 或无 hook，继续标记需要确
-        execution._internal.needsConfirmation = true;
-        execution._internal.confirmationReason =
-          checkResult.reason || 'This operation requires confirmation';
-        break;
-
-      case PermissionResult.ALLOW:
-        // 继续执
-        break;
-    }
-
-    // 7. 额外安全检查：敏感文
-    this.checkSensitiveFiles(execution);
-
-    // 8. 额外安全检查：终端操纵（tmux/screen 注入按键到另一个会话
-    this.checkTerminalPiloting(execution);
-  }
-
-  /**
-   * Detects Bash commands that pilot another terminal session by injecting
-   * keystrokes (tmux send-keys, screen -X stuff, etc.). This is the same
-   * vector a model used to mutate ~/.aegiscode/config.json via a second
-   * live aegis instance while looping unattended — the injected keystrokes
-   * are indistinguishable from real user input to the receiving process, so
-   * the only place to catch this is here, before the command runs. Forces
-   * confirmation regardless of requireConfirmation or session approvals.
-   */
-  private checkTerminalPiloting(execution: ToolExecution): void {
-    const tool = execution._internal.tool;
-    if (!tool || tool.name !== 'Bash') return;
-
-    const command = execution.params.command;
-    if (typeof command !== 'string') return;
-
-    const PILOTING_PATTERNS = [
-      /\btmux\s+send-keys\b/,
-      /\btmux\s+(?:run-shell|wait-for)\b/,
-      /\bscreen\s+-S\s+\S+\s+-X\s+stuff\b/,
-      /\bexpect\s+-c\b/,
-    ];
-
-    if (PILOTING_PATTERNS.some((re) => re.test(command))) {
-      execution._internal.needsConfirmation = true;
-      execution._internal.forceConfirmation = true;
-      execution._internal.confirmationReason =
-        'This command injects input into another terminal session — it can mutate shared ' +
-        'config/files exactly like a real user typing, bypassing normal confirmation settings.';
-    }
-  }
-
-  /**
-   * 
-   */
-  private applyModeOverrides(
-    toolKind: ToolKind,
-    checkResult: PermissionCheckResult,
-    permissionMode: PermissionMode
-  ): PermissionCheckResult {
-    // 1. YOLO 模式：批准所有（最高优先
-    if (permissionMode === PermissionMode.YOLO) {
-      return {
-        result: PermissionResult.ALLOW,
-        matchedRule: 'mode:yolo',
-        reason: 'YOLO mode: auto-approve all operations',
-      };
-    }
-
-    // 2. PLAN 模式：拒绝非只读工
-    if (permissionMode === PermissionMode.PLAN) {
-      if (toolKind !== ToolKind.ReadOnly) {
-        return {
-          result: PermissionResult.DENY,
-          matchedRule: 'mode:plan',
-          reason: 'Plan mode: only read-only tools allowed',
-        };
-      }
-    }
-
-    // 3. 已被 deny 规则拒绝，不覆
-    if (checkResult.result === PermissionResult.DENY) {
-      return checkResult;
-    }
-
-    // 4. 已被 allow 规则批准，不覆
-    if (checkResult.result === PermissionResult.ALLOW) {
-      return checkResult;
-    }
-
-    // 5. 只读工具：所有模式下都批
-    if (toolKind === ToolKind.ReadOnly) {
-      return {
-        result: PermissionResult.ALLOW,
-        matchedRule: `mode:${permissionMode}:readonly`,
-        reason: 'Read-only tools are auto-approved',
-      };
-    }
-
-    // 6. AUTO_EDIT 模式：批准 Write 工
-    if (permissionMode === PermissionMode.AUTO_EDIT && toolKind === ToolKind.Write) {
-      return {
-        result: PermissionResult.ALLOW,
-        matchedRule: 'mode:autoEdit:write',
-        reason: 'AUTO_EDIT mode: auto-approve write tools',
-      };
-    }
-
-    // 7. 其他情况：保持原检查结果（通常
-    return checkResult;
-  }
-
-  /**
-   * 
-   */
-  private checkSensitiveFiles(execution: ToolExecution): void {
-    const tool = execution._internal.tool;
-    if (!tool) return;
-
-    // 只检查写入相关工
-    if (tool.kind === ToolKind.ReadOnly) return;
-
-    // 获取受影响的文件路
-    const affectedPaths = this.getAffectedPaths(execution);
-    if (affectedPaths.length === 0) return;
-
-    // 检查敏感文
-    const sensitiveFiles = SensitiveFileDetector.filterSensitive(
-      affectedPaths,
-      SensitivityLevel.MEDIUM
-    );
-
-    if (sensitiveFiles.length === 0) return;
-
-    // 高敏感文件直接拒
-    const highSensitive = sensitiveFiles.filter(
-      f => f.result.level === SensitivityLevel.HIGH
-    );
-
-    if (highSensitive.length > 0) {
-      const files = highSensitive.map(f => f.path).join(', ');
-      execution.abort(`Not executed: these files are excluded for safety — ${files}. Choose a different approach.`);
-      return;
-    }
-
-    // 中敏感文件需要确
-    execution._internal.needsConfirmation = true;
-    const reasons = sensitiveFiles.map(f => `${f.path}: ${f.result.reason}`);
-    execution._internal.confirmationReason = `Sensitive file access detected:\n${reasons.join('\n')}`;
-  }
-
-  /**
-   * 
-   */
-  private getAffectedPaths(execution: ToolExecution): string[] {
-    const params = execution.params;
-
-    // 从常见参数名中提取路
-    const pathKeys = ['file_path', 'path', 'target', 'destination'];
-    const paths: string[] = [];
-
-    for (const key of pathKeys) {
-      if (typeof params[key] === 'string') {
-        paths.push(params[key] as string);
-      }
-    }
-
-    return paths;
-  }
-
-  /**
-   * 
-   */
-  private async executePermissionHook(
-    execution: ToolExecution,
-    toolName: string
-  ): Promise<'approve' | 'deny' | 'ask'> {
-    return onPermissionRequest(
-      toolName,
-      execution.params as Record<string, unknown>,
-      execution.context.sessionId || 'unknown',
-      execution.context.workspaceRoot || process.cwd(),
-      execution.context.permissionMode
-    );
-  }
-}