agent-from-zero 0.39.1 → 0.39.2

package/README.md

@@ -97,6 +97,18 @@ auto 模式下，改当前项目、其他 git 仓库或临时目录里的文件
 
 也可以在确认弹窗里选 "Yes, and trust …/ for this session"，只对本次会话有效。家目录本身和 `/` 不能被信任，`settings.json` 本身永远要你确认。
 
+### prod 保护（permissions.ask）
+
+`permissions.ask` 里列的文字，只要出现在命令或文件路径里，就一定要你确认（不区分大小写，按子串匹配）。auto 审核和 `--dangerously-skip-permissions` 都不能替你放行：
+
+```json
+{
+  "permissions": { "ask": ["--context prod", "cipherowl-aws-prod", "terraform apply"] }
+}
+```
+
+排查 prod 问题时，往往一连串命令都带着同一个标记（比如每条查询都用 `AWS_PROFILE=cipherowl-aws-prod`）。auto 模式下，确认弹窗里可以选 "Yes, and let auto review handle … commands this session"：本次会话里，命中这些规则的命令不再强制找你，改为交给 auto 审核逐条判断。只读的直接执行，删除、部署这类做了就回不去的仍然会问你。这个放行只在 auto 模式下有效，关掉 auto 或用 `--dangerously-skip-permissions` 运行时都会恢复每次确认。
+
 ### 换别的模型
 
 和 API key 放在同一个地方，设置这三个变量就行，各家的 base URL 写在 [.env.example](.env.example) 里：

package/dist/agent.js

@@ -442,7 +442,7 @@ async function main() {
     // Fail closed: in a non-interactive session nobody can say yes, so the
     // answer is no. MINI_AGENT_AUTO_APPROVE=1 bypasses the QUESTION, but hard
     // denies were already enforced in permissions.ts before we get here.
-    const confirm = async (question, toolName, trustDir) => {
+    const confirm = async (question, toolName, offer) => {
         console.log(chalk.yellow(`\n⚠ approval needed — ${question}`)); // always show what is being asked
         if (!autoMode.enabled && process.env.MINI_AGENT_AUTO_APPROVE === "1") {
             console.log(chalk.dim("  auto-approved (MINI_AGENT_AUTO_APPROVE=1)")); // bypass mode — say so out loud
@@ -454,8 +454,8 @@ async function main() {
         }
         // Selecting beats typing: ↑/↓ + Enter instead of "type y/N". The middle
         // option lets the user stop being asked about this tool (or, in auto mode,
-        // this outside directory) for the session.
-        const menu = approvalMenu(autoMode.enabled, toolName, trustDir);
+        // this outside directory or these prod-guard rules) for the session.
+        const menu = approvalMenu(autoMode.enabled, toolName, offer);
         const { approved, granted } = menu.choose(await select(menu.options));
         if (granted)
             console.log(chalk.dim(`  ${granted}`));

package/dist/ink/app.js

@@ -279,8 +279,8 @@ export function App({ session, runTurn, clipboard }) {
         const hooks = {
             images: attachments,
             output: sink,
-            confirm: (question, toolName, trustDir) => new Promise((resolve) => {
-                const menu = approvalMenu(autoMode.enabled, toolName, trustDir); // same choices and session grants as the readline REPL
+            confirm: (question, toolName, offer) => new Promise((resolve) => {
+                const menu = approvalMenu(autoMode.enabled, toolName, offer); // same choices and session grants as the readline REPL
                 openSelect(`⚠ approval needed — ${question}`, menu.options, (i) => {
                     const { approved, granted } = menu.choose(i);
                     note(`${chalk.yellow("⚠ approval")} — ${question.split("\n")[0]} → ${approved ? chalk.green("✓ approved") : chalk.yellow("✗ declined")}${granted ? chalk.dim(` (${granted})`) : ""}`);

package/dist/loop.js

@@ -772,7 +772,7 @@ async function authorizeCall(call, opts) {
             if (preview)
                 sink(opts).note(preview.replace(/^/gm, agentIndent(opts)));
         }
-        const ok = autoAllowed || (!(auto && opts.canPrompt === false) && await opts.confirm(`${call.name} (${v.reason}):\n   ${v.summary}${reviewReason ? `\n   ${reviewReason}` : ""}`, call.name, v.trustDir));
+        const ok = autoAllowed || (!(auto && opts.canPrompt === false) && await opts.confirm(`${call.name} (${v.reason}):\n   ${v.summary}${reviewReason ? `\n   ${reviewReason}` : ""}`, call.name, { trustDir: v.trustDir, guardRules: v.guardRules }));
         // Every human prompt in auto mode is an interruption worth counting, with
         // where it came from: the reviewer asked ("review", joinable by reviewId),
         // a doubt outlived the agent's retries ("escalated"), or a rule required a

package/dist/permissions.js

@@ -468,14 +468,27 @@ export function recoverableShell(command) {
 // Text that always needs a human: a prod context, a deployment verb, a prod
 // path. Checked BEFORE auto review and BEFORE the bypass rewrite, so neither
 // can approve it. Case-insensitive substring, on the whole command or the path.
-function guardHit(text) {
+//
+// Investigating prod means many commands carrying the same marker (every query
+// under AWS_PROFILE=cipherowl-aws-prod), so in auto mode the human may release
+// the rules a command matched, for the rest of the session. A released rule no
+// longer forces a human: its commands go to auto review one by one, which
+// still asks for anything irreversible. Only auto mode honours a release: the
+// default mode has no reviewer behind it, and bypass has nothing at all.
+const releasedGuards = new Set();
+export function releaseGuards(rules) {
+    for (const rule of rules)
+        releasedGuards.add(rule.toLowerCase());
+    emit("agent_guard_released", { rules: rules.join(",") });
+}
+// Every rule the text matches that still needs a human (all of them, so one
+// approval can release them together rather than one prompt per rule).
+function guardHits(text, auto) {
     const haystack = text.toLowerCase();
-    for (const rule of CONFIG.permissions.ask ?? []) {
-        if (rule && haystack.includes(rule.toLowerCase()))
-            return rule;
-    }
-    return null;
+    const honourReleases = auto && !CONFIG.bypassPermissions;
+    return (CONFIG.permissions.ask ?? []).filter((rule) => rule && haystack.includes(rule.toLowerCase()) && !(honourReleases && releasedGuards.has(rule.toLowerCase())));
 }
+const guardVerdict = (rules, summary) => ({ decision: "ask", requiresHuman: true, reason: `prod guard: ${rules.map((r) => `"${r}"`).join(", ")}`, summary, guardRules: rules });
 // Decide what a bash command deserves: deny, ask, or allow.
 function checkBash(command, auto = false) {
     const summary = command.trim(); // what the user will see in the prompt
@@ -492,9 +505,9 @@ function checkBash(command, auto = false) {
     for (const d of user.deny)
         if (command.toLowerCase().includes(d.toLowerCase()))
             return { decision: "deny", reason: `denied by your settings ("${d}")`, summary };
-    const guard = guardHit(command);
-    if (guard)
-        return { decision: "ask", requiresHuman: true, reason: `prod guard: "${guard}"`, summary };
+    const guards = guardHits(command, auto);
+    if (guards.length)
+        return guardVerdict(guards, summary);
     // node/npm/npx, git aliases and tool-wide grants can run arbitrary code.
     // Auto mode must inspect the actual command, including background commands.
     if (auto) {
@@ -690,9 +703,9 @@ function basePermission(toolName, argsJson, auto) {
             const hit = noFlyHit(p); // is it in the no-fly zone?
             if (hit)
                 return { decision: "deny", reason: hit, summary: p }; // hard stop — deny always wins
-            const guard = guardHit(p); // the user's prod guard, applied to the path
-            if (guard)
-                return { decision: "ask", requiresHuman: true, reason: `prod guard: "${guard}"`, summary: p };
+            const guards = guardHits(p, auto); // the user's prod guard, applied to the path
+            if (guards.length)
+                return guardVerdict(guards, p);
             // The user may pre-approve write tools ("tool:edit_file") to skip the
             // prompt — note this runs AFTER the no-fly check, so it widens "ask",
             // never "deny".
@@ -717,7 +730,8 @@ function basePermission(toolName, argsJson, auto) {
             // upgrades an ASK to ALLOW — but a hard DENY (rm -rf /, .git, .env…) always
             // stands. Convenience never overrides the no-fly rules. A grant for either
             // shell tool covers the other: the command is what was vouched for.
-            if (!auto && verdict.decision === "ask" && (CONFIG.permissions.allow.includes(`tool:${toolName}`) || CONFIG.permissions.allow.includes("tool:run_bash"))) {
+            // Nor a prod-guard ask: that one needs a human every time, grant or not.
+            if (!auto && verdict.decision === "ask" && !verdict.requiresHuman && (CONFIG.permissions.allow.includes(`tool:${toolName}`) || CONFIG.permissions.allow.includes("tool:run_bash"))) {
                 return { decision: "allow", reason: "bash pre-approved for this session", summary: verdict.summary };
             }
             return verdict;
@@ -772,15 +786,11 @@ function resolveFileTarget(target) {
     }
     return path.join(fs.realpathSync(current), ...missing);
 }
-// ---- The approval menu ----------------------------------------------------------
-// Both frontends (readline and Ink) offer the same choices and apply the same
-// session grant, so the menu lives next to the rules it widens. Outside auto
-// mode the grant is "don't ask again for this tool"; in auto mode it is "trust
-// this directory", offered only for an outside write. The last option is always
-// "No", and so is -1 (Esc). `granted` is the note to show after a grant.
-export function approvalMenu(auto, toolName, trustDir) {
+export function approvalMenu(auto, toolName, offer = {}) {
+    const { trustDir, guardRules } = offer;
+    const rules = guardRules?.map((r) => `"${r}"`).join(", ");
     const grant = auto
-        ? (trustDir ? `Yes, and trust ${trustDir}/ for this session` : null)
+        ? (trustDir ? `Yes, and trust ${trustDir}/ for this session` : rules ? `Yes, and let auto review handle ${rules} commands this session` : null)
         : (toolName ? `Yes, and don't ask again for ${toolName} this session` : "Yes, and don't ask again this session");
     const options = [auto ? "Yes, once" : "Yes", ...(grant ? [grant] : []), "No — let me tell the agent what to do instead"];
     const choose = (i) => {
@@ -792,6 +802,10 @@ export function approvalMenu(auto, toolName, trustDir) {
             CONFIG.autoMode.trustedDirs.push(trustDir);
             return { approved: true, granted: `trusting ${trustDir}/ for this session` };
         }
+        if (auto && guardRules?.length) {
+            releaseGuards(guardRules);
+            return { approved: true, granted: `${rules} commands go to auto review for the rest of this session` };
+        }
         if (!toolName)
             return { approved: true };
         CONFIG.permissions.allow.push(`tool:${toolName}`); // "don't ask again" → session allowlist

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-from-zero",
-  "version": "0.39.1",
+  "version": "0.39.2",
   "type": "module",
   "bin": {
     "mini-agent": "dist/agent.js"