aegiscode 3.1.8 → 3.1.10

package/src/tools/execution/stages/PermissionStage.ts

@@ -0,0 +1,287 @@
+/**
+ * Permission Stage - 权限检查阶段
+ * 
+ */
+
+import { ToolKind } from '../../types.js';
+import {
+  PermissionMode,
+  PermissionResult,
+  type PipelineStage,
+  type ToolExecution,
+  type PermissionConfig,
+  type PermissionCheckResult,
+} from '../types.js';
+import { PermissionChecker } from '../../validation/PermissionChecker.js';
+import { SensitiveFileDetector, SensitivityLevel } from '../../validation/SensitiveFileDetector.js';
+import { onPermissionRequest } from '../../../hooks/index.js';
+
+export class PermissionStage implements PipelineStage {
+  readonly name = 'permission';
+  private permissionChecker: PermissionChecker;
+  private defaultMode: PermissionMode;
+
+  constructor(
+    config?: Partial<PermissionConfig>,
+    private sessionApprovals?: Set<string>,
+    private sessionDenials?: Set<string>,
+    defaultMode: PermissionMode = PermissionMode.DEFAULT
+  ) {
+    this.permissionChecker = new PermissionChecker(config);
+    this.defaultMode = defaultMode;
+  }
+
+  async process(execution: ToolExecution): Promise<void> {
+    const tool = execution._internal.tool;
+
+    if (!tool) {
+      execution.abort('Tool not found in execution context');
+      return;
+    }
+
+    // 1. 创建工具调用实例（含 Zod 验
+    try {
+      const invocation = tool.build(execution.params);
+      execution._internal.invocation = invocation;
+    } catch (error) {
+      execution.abort(
+        `Parameter validation failed: ${error instanceof Error ? error.message : String(error)}`
+      );
+      return;
+    }
+
+    // 2. 构建权限签
+    const signature = PermissionChecker.buildSignature({
+      toolName: tool.name,
+      params: execution.params,
+      tool,
+    });
+    execution._internal.permissionSignature = signature;
+
+    // 3. 检查会话拒绝列
+    if (this.sessionDenials?.has(signature)) {
+      // Phrased to avoid "permission/denied" vocabulary: this exact string becomes
+      // llmContent in a real tool_result, and the model can later free-associate a
+      // hallucinated continuation of it in an unrelated turn with no tool call.
+      execution.abort('Not executed: you tried this exact action earlier in this session and the user declined it. Choose a different approach.');
+      return;
+    }
+
+    // 4. 检查会话批准列
+    if (this.sessionApprovals?.has(signature)) {
+      // 已在会话中批准，跳过权限检
+      return;
+    }
+
+    // 5. 执行权限检
+    let checkResult = this.permissionChecker.check({
+      toolName: tool.name,
+      params: execution.params,
+      tool,
+    });
+
+    // 6. 应用权限模式覆
+    const currentMode = execution.context.permissionMode || this.defaultMode;
+    checkResult = this.applyModeOverrides(tool.kind, checkResult, currentMode);
+
+    // 7. 根据结果采取行
+    switch (checkResult.result) {
+      case PermissionResult.DENY:
+        execution.abort(checkResult.reason || 'Not executed: this action is not allowed under current settings. Choose a different approach.');
+        return;
+
+      case PermissionResult.ASK:
+        // 执
+        const hookDecision = await this.executePermissionHook(execution, tool.name);
+        if (hookDecision === 'approve') {
+          // Hook 批准，跳过确
+          break;
+        } else if (hookDecision === 'deny') {
+          // Hook 拒
+          execution.abort('Not executed: a configured hook excludes this action. Choose a different approach.');
+          return;
+        }
+        // Hook 返回 ask 或无 hook，继续标记需要确
+        execution._internal.needsConfirmation = true;
+        execution._internal.confirmationReason =
+          checkResult.reason || 'This operation requires confirmation';
+        break;
+
+      case PermissionResult.ALLOW:
+        // 继续执
+        break;
+    }
+
+    // 7. 额外安全检查：敏感文
+    this.checkSensitiveFiles(execution);
+
+    // 8. 额外安全检查：终端操纵（tmux/screen 注入按键到另一个会话
+    this.checkTerminalPiloting(execution);
+  }
+
+  /**
+   * Detects Bash commands that pilot another terminal session by injecting
+   * keystrokes (tmux send-keys, screen -X stuff, etc.). This is the same
+   * vector a model used to mutate ~/.aegiscode/config.json via a second
+   * live aegis instance while looping unattended — the injected keystrokes
+   * are indistinguishable from real user input to the receiving process, so
+   * the only place to catch this is here, before the command runs. Forces
+   * confirmation regardless of requireConfirmation or session approvals.
+   */
+  private checkTerminalPiloting(execution: ToolExecution): void {
+    const tool = execution._internal.tool;
+    if (!tool || tool.name !== 'Bash') return;
+
+    const command = execution.params.command;
+    if (typeof command !== 'string') return;
+
+    const PILOTING_PATTERNS = [
+      /\btmux\s+send-keys\b/,
+      /\btmux\s+(?:run-shell|wait-for)\b/,
+      /\bscreen\s+-S\s+\S+\s+-X\s+stuff\b/,
+      /\bexpect\s+-c\b/,
+    ];
+
+    if (PILOTING_PATTERNS.some((re) => re.test(command))) {
+      execution._internal.needsConfirmation = true;
+      execution._internal.forceConfirmation = true;
+      execution._internal.confirmationReason =
+        'This command injects input into another terminal session — it can mutate shared ' +
+        'config/files exactly like a real user typing, bypassing normal confirmation settings.';
+    }
+  }
+
+  /**
+   * 
+   */
+  private applyModeOverrides(
+    toolKind: ToolKind,
+    checkResult: PermissionCheckResult,
+    permissionMode: PermissionMode
+  ): PermissionCheckResult {
+    // 1. YOLO 模式：批准所有（最高优先
+    if (permissionMode === PermissionMode.YOLO) {
+      return {
+        result: PermissionResult.ALLOW,
+        matchedRule: 'mode:yolo',
+        reason: 'YOLO mode: auto-approve all operations',
+      };
+    }
+
+    // 2. PLAN 模式：拒绝非只读工
+    if (permissionMode === PermissionMode.PLAN) {
+      if (toolKind !== ToolKind.ReadOnly) {
+        return {
+          result: PermissionResult.DENY,
+          matchedRule: 'mode:plan',
+          reason: 'Plan mode: only read-only tools allowed',
+        };
+      }
+    }
+
+    // 3. 已被 deny 规则拒绝，不覆
+    if (checkResult.result === PermissionResult.DENY) {
+      return checkResult;
+    }
+
+    // 4. 已被 allow 规则批准，不覆
+    if (checkResult.result === PermissionResult.ALLOW) {
+      return checkResult;
+    }
+
+    // 5. 只读工具：所有模式下都批
+    if (toolKind === ToolKind.ReadOnly) {
+      return {
+        result: PermissionResult.ALLOW,
+        matchedRule: `mode:${permissionMode}:readonly`,
+        reason: 'Read-only tools are auto-approved',
+      };
+    }
+
+    // 6. AUTO_EDIT 模式：批准 Write 工
+    if (permissionMode === PermissionMode.AUTO_EDIT && toolKind === ToolKind.Write) {
+      return {
+        result: PermissionResult.ALLOW,
+        matchedRule: 'mode:autoEdit:write',
+        reason: 'AUTO_EDIT mode: auto-approve write tools',
+      };
+    }
+
+    // 7. 其他情况：保持原检查结果（通常
+    return checkResult;
+  }
+
+  /**
+   * 
+   */
+  private checkSensitiveFiles(execution: ToolExecution): void {
+    const tool = execution._internal.tool;
+    if (!tool) return;
+
+    // 只检查写入相关工
+    if (tool.kind === ToolKind.ReadOnly) return;
+
+    // 获取受影响的文件路
+    const affectedPaths = this.getAffectedPaths(execution);
+    if (affectedPaths.length === 0) return;
+
+    // 检查敏感文
+    const sensitiveFiles = SensitiveFileDetector.filterSensitive(
+      affectedPaths,
+      SensitivityLevel.MEDIUM
+    );
+
+    if (sensitiveFiles.length === 0) return;
+
+    // 高敏感文件直接拒
+    const highSensitive = sensitiveFiles.filter(
+      f => f.result.level === SensitivityLevel.HIGH
+    );
+
+    if (highSensitive.length > 0) {
+      const files = highSensitive.map(f => f.path).join(', ');
+      execution.abort(`Not executed: these files are excluded for safety — ${files}. Choose a different approach.`);
+      return;
+    }
+
+    // 中敏感文件需要确
+    execution._internal.needsConfirmation = true;
+    const reasons = sensitiveFiles.map(f => `${f.path}: ${f.result.reason}`);
+    execution._internal.confirmationReason = `Sensitive file access detected:\n${reasons.join('\n')}`;
+  }
+
+  /**
+   * 
+   */
+  private getAffectedPaths(execution: ToolExecution): string[] {
+    const params = execution.params;
+
+    // 从常见参数名中提取路
+    const pathKeys = ['file_path', 'path', 'target', 'destination'];
+    const paths: string[] = [];
+
+    for (const key of pathKeys) {
+      if (typeof params[key] === 'string') {
+        paths.push(params[key] as string);
+      }
+    }
+
+    return paths;
+  }
+
+  /**
+   * 
+   */
+  private async executePermissionHook(
+    execution: ToolExecution,
+    toolName: string
+  ): Promise<'approve' | 'deny' | 'ask'> {
+    return onPermissionRequest(
+      toolName,
+      execution.params as Record<string, unknown>,
+      execution.context.sessionId || 'unknown',
+      execution.context.workspaceRoot || process.cwd(),
+      execution.context.permissionMode
+    );
+  }
+}

package/src/tools/execution/stages/PostHookStage.ts

@@ -0,0 +1,71 @@
+/**
+ * Post Hook Stage - PostToolUse Hooks 执行阶段
+ * 
+ */
+
+import type { PipelineStage, ToolExecution } from '../types.js';
+import { onPostToolUse, onPostToolUseFailure } from '../../../hooks/index.js';
+
+export class PostHookStage implements PipelineStage {
+  readonly name = 'postHook';
+
+  async process(execution: ToolExecution): Promise<void> {
+    const result = execution.getResult();
+    if (!result) {
+      return;
+    }
+
+    const tool = execution._internal.tool;
+    if (!tool) {
+      return;
+    }
+
+    // 复用 PreToolUse 阶段生成
+    const toolUseId = execution._internal.hookToolUseId || `tool_post_${Date.now()}`;
+    const sessionId = execution.context.sessionId || 'unknown';
+    const projectDir = execution.context.workspaceRoot || process.cwd();
+    const permissionMode = execution.context.permissionMode;
+
+    // 根据执行成
+    if (result.success) {
+      // 执
+      const hookResult = await onPostToolUse(
+        tool.name,
+        toolUseId,
+        execution.params as Record<string, unknown>,
+        result,
+        sessionId,
+        projectDir,
+        permissionMode
+      );
+
+      // 处理 Hook 结果：添加额外上下
+      if (hookResult.additionalContext) {
+        // 将 Hook 注入的上下文追加
+        const currentResult = execution.getResult();
+        if (currentResult) {
+          currentResult.llmContent += `\n\n[Hook Context]\n${hookResult.additionalContext}`;
+        }
+      }
+
+      // 处理 Hook 结果：修改输
+      if (hookResult.modifiedOutput !== undefined) {
+        const currentResult = execution.getResult();
+        if (currentResult) {
+          currentResult.llmContent = String(hookResult.modifiedOutput);
+        }
+      }
+    } else {
+      // 执
+      await onPostToolUseFailure(
+        tool.name,
+        toolUseId,
+        execution.params as Record<string, unknown>,
+        result.error?.message || 'Unknown error',
+        sessionId,
+        projectDir,
+        permissionMode
+      );
+    }
+  }
+}

package/src/tools/execution/stages/index.ts

@@ -0,0 +1,12 @@
+/**
+ * 
+ */
+
+export { DiscoveryStage } from './DiscoveryStage.js';
+export { CacheStage } from './CacheStage.js';
+export { PermissionStage } from './PermissionStage.js';
+export { HookStage } from './HookStage.js';
+export { ConfirmationStage } from './ConfirmationStage.js';
+export { ExecutionStage } from './ExecutionStage.js';
+export { PostHookStage } from './PostHookStage.js';
+export { FormattingStage } from './FormattingStage.js';

package/src/tools/execution/test.ts

@@ -0,0 +1,266 @@
+/**
+ * 
+ * 
+ * 
+ */
+
+import { ExecutionPipeline, PermissionMode, type PipelineExecutionContext } from './index.js';
+import { ToolRegistry, createToolRegistry, getBuiltinTools } from '../index.js';
+import { PermissionChecker } from '../validation/PermissionChecker.js';
+import { SensitiveFileDetector, SensitivityLevel } from '../validation/SensitiveFileDetector.js';
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import * as os from 'os';
+
+// ========== 测试辅
+
+let testDir: string;
+
+async function setup() {
+  testDir = path.join(os.tmpdir(), `pipeline-test-${Date.now()}`);
+  await fs.mkdir(testDir, { recursive: true });
+  
+  // 创建测试文
+  await fs.writeFile(path.join(testDir, 'test.txt'), 'Hello, World!');
+  await fs.writeFile(path.join(testDir, 'config.json'), '{"key": "value"}');
+}
+
+async function cleanup() {
+  try {
+    await fs.rm(testDir, { recursive: true, force: true });
+  } catch {
+    // Ignore cleanup errors
+  }
+}
+
+function createTestContext(mode: PermissionMode = PermissionMode.DEFAULT): PipelineExecutionContext {
+  return {
+    sessionId: 'test-session',
+    workspaceRoot: testDir,
+    permissionMode: mode,
+  };
+}
+
+// ========== 测
+
+async function testPermissionChecker() {
+  console.log('\n1. 测试 PermissionChecker');
+  
+  const checker = new PermissionChecker({
+    allow: ['Bash(npm:*)'],
+    deny: ['Bash(rm -rf:*)'],
+  });
+  
+  // 测试 allow 规
+  const allowResult = checker.check({
+    toolName: 'Bash',
+    params: { command: 'npm test' },
+  });
+  console.log(`   npm test: ${allowResult.result} (expected: allow)`);
+  
+  // 测试 deny 规
+  const denyResult = checker.check({
+    toolName: 'Bash',
+    params: { command: 'rm -rf /' },
+  });
+  console.log(`   rm -rf: ${denyResult.result} (expected: deny)`);
+  
+  // 测试默
+  const askResult = checker.check({
+    toolName: 'Write',
+    params: { file_path: '/tmp/test.txt' },
+  });
+  console.log(`   Write: ${askResult.result} (expected: ask)`);
+}
+
+async function testSensitiveFileDetector() {
+  console.log('\n2. 测试 SensitiveFileDetector');
+  
+  // 高敏
+  const envResult = SensitiveFileDetector.check('.env');
+  console.log(`   .env: ${envResult.level} (expected: high)`);
+  
+  // 中敏
+  const logResult = SensitiveFileDetector.check('app.log');
+  console.log(`   app.log: ${logResult.level} (expected: medium)`);
+  
+  // 低敏
+  const configResult = SensitiveFileDetector.check('config.json');
+  console.log(`   config.json: ${configResult.level} (expected: low)`);
+  
+  // 非敏
+  const normalResult = SensitiveFileDetector.check('main.ts');
+  console.log(`   main.ts: sensitive=${normalResult.sensitive} (expected: false)`);
+  
+  // 危险路
+  const dangerous = SensitiveFileDetector.isDangerousPath('/etc/passwd');
+  console.log(`   /etc/passwd: dangerous=${dangerous} (expected: true)`);
+}
+
+async function testPipelineReadOnly() {
+  console.log('\n3. 测试只读工具执行');
+  
+  const registry = createToolRegistry();
+  const builtinTools = getBuiltinTools();
+  for (const tool of builtinTools) {
+    registry.register(tool);
+  }
+  
+  const pipeline = new ExecutionPipeline(registry);
+  const context = createTestContext();
+  
+  // 测试 Read 工
+  const testFile = path.join(testDir, 'test.txt');
+  const readResult = await pipeline.execute('Read', { file_path: testFile }, context);
+  console.log(`   Read: success=${readResult.success}, content includes 'Hello'=${readResult.llmContent.includes('Hello')}`);
+  
+  // 测试 Glob 工
+  const globResult = await pipeline.execute('Glob', { pattern: '*.txt', path: testDir }, context);
+  console.log(`   Glob: success=${globResult.success}, found files=${globResult.llmContent.includes('test.txt')}`);
+}
+
+async function testPermissionModes() {
+  console.log('\n4. 测试权限模式');
+  
+  const registry = createToolRegistry();
+  const builtinTools = getBuiltinTools();
+  for (const tool of builtinTools) {
+    registry.register(tool);
+  }
+  
+  const pipeline = new ExecutionPipeline(registry);
+  const testFile = path.join(testDir, 'write-test.txt');
+  
+  // PLAN 模式：Write 应该被拒
+  const planContext = createTestContext(PermissionMode.PLAN);
+  const planResult = await pipeline.execute(
+    'Write',
+    { file_path: testFile, contents: 'test' },
+    planContext
+  );
+  console.log(`   PLAN + Write: success=${planResult.success} (expected: false)`);
+  
+  // YOLO 模式：Write 应该自动批
+  const yoloContext = createTestContext(PermissionMode.YOLO);
+  const yoloResult = await pipeline.execute(
+    'Write',
+    { file_path: testFile, contents: 'YOLO test' },
+    yoloContext
+  );
+  console.log(`   YOLO + Write: success=${yoloResult.success} (expected: true)`);
+  
+  // 验证文件内
+  const content = await fs.readFile(testFile, 'utf8');
+  console.log(`   File content correct: ${content === 'YOLO test'}`);
+}
+
+async function testPipelineStages() {
+  console.log('\n5. 测试管道阶段事件');
+  
+  const registry = createToolRegistry();
+  const builtinTools = getBuiltinTools();
+  for (const tool of builtinTools) {
+    registry.register(tool);
+  }
+  
+  const pipeline = new ExecutionPipeline(registry);
+  const context = createTestContext(PermissionMode.YOLO);
+  
+  const stagesExecuted = pipeline.getStageNames();
+
+  const testFile = path.join(testDir, 'test.txt');
+  await pipeline.execute('Read', { file_path: testFile }, context);
+
+  console.log(`   Stages: ${stagesExecuted.join(' → ')}`);
+  console.log(`   All ${stagesExecuted.length} stages executed: ${stagesExecuted.length === 8}`);
+}
+
+async function testExecutionHistory() {
+  console.log('\n6. 测试执行历史');
+  
+  const registry = createToolRegistry();
+  const builtinTools = getBuiltinTools();
+  for (const tool of builtinTools) {
+    registry.register(tool);
+  }
+  
+  const pipeline = new ExecutionPipeline(registry);
+  const context = createTestContext(PermissionMode.YOLO);
+  
+  // 执行几个操
+  const testFile = path.join(testDir, 'test.txt');
+  await pipeline.execute('Read', { file_path: testFile }, context);
+  await pipeline.execute('Glob', { pattern: '*', path: testDir }, context);
+  
+  const history = pipeline.getHistory();
+  console.log(`   History entries: ${history.length} (expected: 2)`);
+  console.log(`   First entry tool: ${history[0]?.toolName} (expected: Read)`);
+}
+
+async function testSessionApprovals() {
+  console.log('\n7. 测试会话批准');
+  
+  const registry = createToolRegistry();
+  const builtinTools = getBuiltinTools();
+  for (const tool of builtinTools) {
+    registry.register(tool);
+  }
+  
+  const pipeline = new ExecutionPipeline(registry);
+  
+  // 手动添加会话批
+  pipeline.addSessionApproval('Write(/tmp/approved.txt)');
+  
+  console.log(`   Has approval: ${pipeline.hasSessionApproval('Write(/tmp/approved.txt)')} (expected: true)`);
+  console.log(`   No approval: ${pipeline.hasSessionApproval('Write(/tmp/other.txt)')} (expected: false)`);
+  
+  // 清
+  pipeline.clearSessionApprovals();
+  console.log(`   After clear: ${pipeline.hasSessionApproval('Write(/tmp/approved.txt)')} (expected: false)`);
+}
+
+async function testBashTool() {
+  console.log('\n8. 测试 Bash 工具');
+  
+  const registry = createToolRegistry();
+  const builtinTools = getBuiltinTools();
+  for (const tool of builtinTools) {
+    registry.register(tool);
+  }
+  
+  const pipeline = new ExecutionPipeline(registry);
+  const context = createTestContext(PermissionMode.YOLO);
+  
+  // 简单命
+  const echoResult = await pipeline.execute(
+    'Bash',
+    { command: 'echo "Pipeline Test"' },
+    context
+  );
+  console.log(`   echo: success=${echoResult.success}, output includes 'Pipeline Test'=${echoResult.llmContent.includes('Pipeline Test')}`);
+}
+
+// ========== 主函
+
+async function main() {
+  console.log('=== 执行管道测试 ===');
+  
+  try {
+    await setup();
+    
+    await testPermissionChecker();
+    await testSensitiveFileDetector();
+    await testPipelineReadOnly();
+    await testPermissionModes();
+    await testPipelineStages();
+    await testExecutionHistory();
+    await testSessionApprovals();
+    await testBashTool();
+    
+    console.log('\n=== 测试完成 ===');
+  } finally {
+    await cleanup();
+  }
+}
+
+main().catch(console.error);