deepccc 0.1.2 → 0.1.3

package/README.md

@@ -132,6 +132,61 @@ deepccc --effort high
 
 可选值：`none` / `minimal` / `low` / `medium` / `high` / `xhigh` / `max`（留空则不传 `reasoning_effort` 请求字段）。
 
+## 权限机制
+
+`deepccc` 内置轻量权限机制，对标主流 agent 的审批体验：**只拦截有副作用的操作**（`run_command` 与文件写操作），只读工具（`read_file` / `list_dir` / `search_code`）永不拦截，常规文件编辑默认放行不打断工作流。
+
+默认模式（`ask`）下，只有**命中内置危险命令库**的高危命令才会询问，例如：
+
+- `rm -rf` / `rm -fr` / `del /s` / `rmdir /s` 等强制删除
+- `git push --force` / `git reset --hard` / `git clean -f` 等破坏性 git 操作
+- `format` / `diskpart` / `mkfs` / `dd of=设备` 等磁盘操作
+- `shutdown` / `reboot` 等系统操作
+- `drop table` / `truncate table` 等数据库操作
+- `npm publish` / `npm uninstall -g` / `pip uninstall` 等发布与全局卸载
+
+交互模式下，高危命令会暂停并询问：
+
+```text
+⚠️  高危操作需要确认
+运行命令: rm -rf node_modules
+允许一次(y) / 永远允许(a) / 拒绝(n) / 本会话允许所有(g) >
+```
+
+- `y` — 允许本次
+- `a` — 永远允许，写入 `~/.deepccc/allow.json`
+- `n` — 拒绝本次
+- `g` — 本会话内全部放行（不落盘）
+
+### 规则文件 `~/.deepccc/allow.json`
+
+规则格式为 `"<工具>:<模式>"`（`*` 为通配符，`*:` 匹配所有工具），支持相对/绝对路径：
+
+```json
+{
+  "allow": [
+    "run_command:git status*",
+    "run_command:git push --force origin release*"
+  ],
+  "deny": [
+    "edit_file:node_modules/**",
+    "run_command:npm publish*"
+  ]
+}
+```
+
+`deny` 命中永远拒绝，`allow` 命中永远放行（可覆盖高危判定）。文件变更后自动热加载，无需重启。
+
+### 非交互模式与 bypass
+
+`--stream-json` 或程序化调用（无终端可交互）时，高危命令**安全默认拒绝**。需要全自动场景可显式传入：
+
+```bash
+deepccc --dangerously-bypass-permissions
+```
+
+该参数与 `ChatSession` 的 `permissionMode: "bypass"` 等价，也是 chatccc 集成 deepccc 时使用的模式（对齐 chatccc 调用 Claude Code / Codex 的 bypass 方式）。
+
 ## 终端过程区块
 
 交互模式下，每轮回复渲染为固定"过程区块"：状态行（生成中/完成/已停止/异常结束）+ 折叠工具行 + 原地更新正文，不滚屏刷 JSON。生成中有心跳点号动画；完成/停止/异常后区块定型留在屏幕上。
@@ -168,9 +223,12 @@ echo "运行测试并解释失败原因" | deepccc --stream-json
 
 ## 在 ChatCCC 中使用
 
-ChatCCC 公有仓库：
+**ChatCCC 已内置 deepccc**：ChatCCC 的 "CCC Agent" 工具直接内嵌 deepccc 的代码（`src/builtin/`），以 `permissionMode: "bypass"` 全自动运行，无需单独安装或配置本仓库。
+
+ChatCCC 是一个把 Claude Code / Codex / Cursor / CCC Agent 聚合到飞书/企微等 IM 消息通道的本地机器人框架，提供会话管理、过程卡片、用量统计与隐私替换等能力。
 
-https://github.com/wzj998/ChatCCC
+- 公有仓库：https://github.com/wzj998/ChatCCC
+- npm 包：`chatccc`（`npm install -g chatccc`）
 
 在 ChatCCC 会话里可以使用隐藏指令创建 `deepccc` Agent 会话：
 
@@ -180,6 +238,8 @@ https://github.com/wzj998/ChatCCC
 
 这种方式适合已经在 ChatCCC 里协作的场景：ChatCCC 负责会话入口和消息通道，`deepccc` 负责本地编程 Agent 能力，包括读取项目提示词、运行命令、编辑文件和输出流式结果。
 
+如果希望让 ChatCCC 使用本仓库（deepccc-agent）最新的独立版本能力，也可以把 `src/builtin/` 与本仓库 `src/` 同步后构建。
+
 ## 项目提示词自动注入
 
 会话启动时，`deepccc` 会从当前工作目录读取这些文件，如果存在就注入为项目级提示词：

package/dist/cli.js

@@ -87,6 +87,10 @@ function parseArgs(argv = process.argv.slice(2)) {
         else if (arg === "--plain") {
             plain = true;
         }
+        else if (arg === "--dangerously-bypass-permissions") {
+            // 仅保留一个 bypass 入口（对齐 chatccc 调 claude/codex 的 bypass 模式）
+            options.permissionMode = "bypass";
+        }
         else if (arg === "--help" || arg === "-h") {
             help = true;
         }
@@ -118,8 +122,16 @@ function printHelp(appConfig) {
         "  --stream-json        One-shot mode: write JSONL events to stdout",
         "  --prompt <text>      Prompt text for --stream-json",
         "  --plain              Force plain streaming output (no progress block renderer)",
+        "  --dangerously-bypass-permissions  Skip all permission prompts (aligns with chatccc's bypass mode)",
         "  --help, -h           Show help",
         "",
+        "Permissions:",
+        "  Default mode asks before high-risk commands (rm -rf, git push --force, ...).",
+        "  Answer y = allow once, a = allow always (saved to ~/.deepccc/allow.json),",
+        "  n = deny, g = allow all for this session. Read-only tools and normal file",
+        "  edits never prompt. In non-interactive mode (--stream-json) high-risk",
+        "  commands are denied unless --dangerously-bypass-permissions is passed.",
+        "",
         "Default config source:",
         "  ~/.deepccc/config.json, DEEPCCC_* environment variables, or DEEPSEEK_* aliases",
         "",
@@ -338,6 +350,37 @@ async function runRepl(args) {
     if (process.stdout.isTTY === true && !args.plain) {
         muteConsoleLogToFile(setupFileLogging(defaultLogDir(), "index").logPath);
     }
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout,
+        prompt: `${C.green}>${C.reset} `,
+    });
+    // 权限交互：暂停过程区块渲染（恢复光标）→ readline 提问 → 恢复渲染。
+    // activeRenderer/activeView 由每轮 line 处理器维护，resolver 只在工具
+    // 执行期间被调用，此时当前轮的区块正处于运行中。
+    let activeRenderer = null;
+    let activeView = null;
+    const permissionResolver = async (request) => {
+        const renderer = activeRenderer;
+        const view = activeView;
+        if (renderer)
+            renderer.dispose();
+        process.stdout.write(`\n${C.yellow}⚠️  高危操作需要确认${C.reset}\n`);
+        process.stdout.write(`${C.dim}${request.detail}${C.reset}\n`);
+        const answer = await new Promise((resolve) => {
+            rl.question(`${C.green}允许一次(y) / 永远允许(a) / 拒绝(n) / 本会话允许所有(g) >${C.reset} `, resolve);
+        });
+        if (renderer && view)
+            renderer.begin(view);
+        const v = answer.trim().toLowerCase();
+        if (v === "y")
+            return "allow";
+        if (v === "a")
+            return "allow-always";
+        if (v === "g")
+            return "allow-session";
+        return "deny";
+    };
     let session;
     try {
         session = new ChatSession(args.config, {
@@ -345,17 +388,13 @@ async function runRepl(args) {
             cwd,
             persist: true,
             sessionId: resolvedSession.sessionId,
+            permissionResolver,
         });
     }
     catch (err) {
         console.error(`${C.yellow}${err.message}${C.reset}`);
         process.exit(1);
     }
-    const rl = readline.createInterface({
-        input: process.stdin,
-        output: process.stdout,
-        prompt: `${C.green}>${C.reset} `,
-    });
     let currentAbort = null;
     const ctrlCState = createCtrlCState();
     rl.prompt();
@@ -391,6 +430,8 @@ async function runRepl(args) {
         let view = null;
         if (renderer) {
             view = progressView({ headerTitle: "生成中..." });
+            activeRenderer = renderer;
+            activeView = view;
             // 先回行首换行再 begin：让过程区块从输入行下方开始，避免首帧 \r\x1b[2K
             // 清掉用户刚输入的问题行（历史文本不被刷掉）。\r\n 兼容 readline
             // 行提交后光标仍停在输入行行尾的情况。
@@ -446,6 +487,8 @@ async function runRepl(args) {
             console.error(`\n${C.yellow}[error] ${err.message}${C.reset}`);
         }
         finally {
+            activeRenderer = null;
+            activeView = null;
             if (renderer && view && !rendererEnded) {
                 // 定型终态区块（完成/已停止/异常结束）留在屏幕上，恢复光标
                 renderer.end(view);

package/dist/file-tools.d.ts

@@ -1,4 +1,5 @@
 import { type ToolSet } from "ai";
+import { type PermissionGate } from "./permissions.js";
 export interface ReadFileInput {
     path: string;
     startLine?: number;
@@ -140,4 +141,8 @@ export declare function createFileForTool(cwd: string, input: CreateFileInput):
 export declare function deleteFileForTool(cwd: string, input: DeleteFileInput): Promise<DeleteFileOutput>;
 export declare function moveFileForTool(cwd: string, input: MoveFileInput): Promise<MoveFileOutput>;
 export declare function applyPatchForTool(cwd: string, input: ApplyPatchInput): Promise<ApplyPatchOutput>;
-export declare function createBuiltinFileTools(cwd: string): ToolSet;
+export interface BuiltinFileToolsOptions {
+    /** 权限门控：副作用工具（run_command/文件写操作）执行前会先经过 gate.check */
+    permissionGate?: PermissionGate;
+}
+export declare function createBuiltinFileTools(cwd: string, options?: BuiltinFileToolsOptions): ToolSet;

package/dist/file-tools.js

@@ -6,6 +6,7 @@ import { createRequire } from "node:module";
 import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { createInterface } from "node:readline";
 import { jsonSchema, tool } from "ai";
+import { isDangerousCommand } from "./permissions.js";
 import { killProcessTree } from "./proc-tree-kill.js";
 const MAX_READ_BYTES = 1024 * 1024;
 const MAX_LIST_ENTRIES = 200;
@@ -919,7 +920,29 @@ export async function applyPatchForTool(cwd, input) {
     }
     return { changedFiles };
 }
-export function createBuiltinFileTools(cwd) {
+export function createBuiltinFileTools(cwd, options = {}) {
+    const gate = options.permissionGate;
+    /** 文件路径的候选匹配键：原始路径 + 绝对路径 + 相对 cwd 路径（正/反斜杠双版本，规则可任选其一） */
+    const pathKeys = (p) => {
+        const abs = resolveToolPath(cwd, p);
+        const rel = relative(cwd, abs);
+        return [
+            p,
+            abs,
+            rel,
+            rel.split(sep).join("/"),
+            abs.split(sep).join("/"),
+        ];
+    };
+    /** 副作用工具执行前的权限守卫：gate 拒绝时抛错，工具不会真正执行 */
+    const guard = async (request) => {
+        if (!gate)
+            return;
+        const decision = await gate.check(request);
+        if (decision === "deny") {
+            throw new Error(`权限拒绝：${request.detail}（已按规则或用户选择拦截；如需放行请调整 ~/.deepccc/allow.json，或使用 --dangerously-bypass-permissions）`);
+        }
+    };
     return {
         read_file: tool({
             description: "Read a UTF-8 text file from the local filesystem. Use line ranges for large files.",
@@ -973,7 +996,15 @@ export function createBuiltinFileTools(cwd) {
                 },
                 required: ["command"],
             }),
-            execute: (input, options) => runCommandForTool(cwd, input, options.abortSignal),
+            execute: async (input, options) => {
+                await guard({
+                    tool: "run_command",
+                    action: input.command,
+                    reason: isDangerousCommand(input.command) ? "high-risk" : "rule",
+                    detail: `运行命令: ${input.command}`,
+                });
+                return runCommandForTool(cwd, input, options.abortSignal);
+            },
         }),
         edit_file: tool({
             description: "Edit an existing UTF-8 text file by applying exact oldText -> newText replacements. Uses optional SHA-256 precondition to avoid overwriting concurrent edits.",
@@ -1000,7 +1031,16 @@ export function createBuiltinFileTools(cwd) {
                 },
                 required: ["path", "edits"],
             }),
-            execute: (input) => editFileForTool(cwd, input),
+            execute: async (input) => {
+                await guard({
+                    tool: "edit_file",
+                    action: input.path,
+                    altKeys: pathKeys(input.path),
+                    reason: "rule",
+                    detail: `编辑文件: ${input.path}`,
+                });
+                return editFileForTool(cwd, input);
+            },
         }),
         create_file: tool({
             description: "Create a UTF-8 text file, or overwrite an existing one when overwrite=true.",
@@ -1015,7 +1055,16 @@ export function createBuiltinFileTools(cwd) {
                 },
                 required: ["path", "content"],
             }),
-            execute: (input) => createFileForTool(cwd, input),
+            execute: async (input) => {
+                await guard({
+                    tool: "create_file",
+                    action: input.path,
+                    altKeys: pathKeys(input.path),
+                    reason: "rule",
+                    detail: `创建/覆盖文件: ${input.path}`,
+                });
+                return createFileForTool(cwd, input);
+            },
         }),
         delete_file: tool({
             description: "Delete an existing text file. Use expectedSha256 to avoid deleting a file that changed after reading.",
@@ -1028,7 +1077,16 @@ export function createBuiltinFileTools(cwd) {
                 },
                 required: ["path"],
             }),
-            execute: (input) => deleteFileForTool(cwd, input),
+            execute: async (input) => {
+                await guard({
+                    tool: "delete_file",
+                    action: input.path,
+                    altKeys: pathKeys(input.path),
+                    reason: "rule",
+                    detail: `删除文件: ${input.path}`,
+                });
+                return deleteFileForTool(cwd, input);
+            },
         }),
         move_file: tool({
             description: "Move or rename an existing text file. Can overwrite an existing destination only when overwrite=true.",
@@ -1044,7 +1102,16 @@ export function createBuiltinFileTools(cwd) {
                 },
                 required: ["sourcePath", "destinationPath"],
             }),
-            execute: (input) => moveFileForTool(cwd, input),
+            execute: async (input) => {
+                await guard({
+                    tool: "move_file",
+                    action: input.sourcePath,
+                    altKeys: pathKeys(input.sourcePath),
+                    reason: "rule",
+                    detail: `移动/重命名文件: ${input.sourcePath} → ${input.destinationPath}`,
+                });
+                return moveFileForTool(cwd, input);
+            },
         }),
         apply_patch: tool({
             description: "Apply a unified diff patch to one or more UTF-8 text files. Prefer edit_file for small targeted edits.",
@@ -1061,7 +1128,15 @@ export function createBuiltinFileTools(cwd) {
                 },
                 required: ["patch"],
             }),
-            execute: (input) => applyPatchForTool(cwd, input),
+            execute: async (input) => {
+                await guard({
+                    tool: "apply_patch",
+                    action: "patch",
+                    reason: "rule",
+                    detail: "应用 unified diff patch",
+                });
+                return applyPatchForTool(cwd, input);
+            },
         }),
     };
 }

package/dist/index.d.ts

@@ -3,6 +3,7 @@
  *
  * ChatSession 是程序化入口，既可以被 CLI 调用，也可以被其他模块调用。
  */
+import { type PermissionMode, type PermissionResolver } from "./permissions.js";
 export interface ChatSessionConfig {
     /** OpenAI-compatible service base URL. Defaults to DEEPCCC_BASE_URL/config. */
     baseURL?: string;
@@ -38,6 +39,16 @@ export interface ChatSessionOptions {
      * Defaults to ~/.codex/skills, ~/.agents/skills, <cwd>/.codex/skills.
      */
     skillsDirs?: string[];
+    /**
+     * 权限模式：ask（默认，高危命令询问）/ bypass（全部放行，等价
+     * --dangerously-bypass-permissions；chatccc 等无终端环境集成时使用）。
+     */
+    permissionMode?: PermissionMode;
+    /**
+     * ask 模式下高危操作的交互确认回调；缺省时非交互环境（JSONL / 程序化
+     * 调用）自动拒绝高危命令，常规文件操作与低危命令不受影响。
+     */
+    permissionResolver?: PermissionResolver;
 }
 /**
  * 流式响应事件
@@ -81,6 +92,7 @@ export declare class ChatSession {
     private context;
     private maxSteps?;
     private effort;
+    private permissionGate;
     constructor(overrides?: ChatSessionConfig, options?: ChatSessionOptions);
     chat(userMessage: string, signal?: AbortSignal): AsyncIterable<ChatEvent>;
     /** 返回当前的会话历史（只读） */

package/dist/index.js

@@ -11,6 +11,7 @@ import { config as appConfig, RAW_STREAM_LOGS_DIR } from "./config.js";
 import { createRawStreamLog, } from "./raw-stream-log.js";
 import { BuiltinContextManager, buildSummaryPrompt, defaultBuiltinSessionId, } from "./context.js";
 import { createBuiltinFileTools } from "./file-tools.js";
+import { PermissionGate } from "./permissions.js";
 import { buildDefaultSkillDirs, buildSkillsIndexPrompt, scanSkillsDirs } from "./skills.js";
 import { applyPrivacy, applyPrivacyToJson } from "./privacy.js";
 // ---------------------------------------------------------------------------
@@ -86,6 +87,7 @@ export class ChatSession {
     context;
     maxSteps;
     effort;
+    permissionGate;
     constructor(overrides = {}, options = {}) {
         const apiKey = overrides.apiKey ?? appConfig.apiKey;
         if (!apiKey) {
@@ -127,6 +129,7 @@ export class ChatSession {
             compactAtTokens: options.compactAtTokens,
             keepRecentMessages: options.keepRecentMessages,
         });
+        this.permissionGate = new PermissionGate(options.permissionMode ?? "ask", options.permissionResolver);
     }
     async *chat(userMessage, signal) {
         this.context.appendMessage({ role: "user", content: userMessage });
@@ -160,7 +163,7 @@ export class ChatSession {
                 model: this.model,
                 system: this.systemPrompt,
                 messages: this.context.buildModelMessages(),
-                tools: createBuiltinFileTools(this.cwd),
+                tools: createBuiltinFileTools(this.cwd, { permissionGate: this.permissionGate }),
                 stopWhen: maxSteps !== undefined ? stepCountIs(maxSteps) : isLoopFinished(),
                 abortSignal: signal,
                 // DeepSeek OpenAI 兼容接口：providerOptions.deepseek.reasoningEffort

package/dist/permissions.d.ts

@@ -0,0 +1,42 @@
+export type PermissionMode = "ask" | "bypass";
+export type PermissionReason = "high-risk" | "rule";
+export type PermissionAnswer = "allow" | "allow-always" | "allow-session" | "deny";
+export type PermissionDecision = "allow" | "deny";
+export interface PermissionRequest {
+    /** 工具名：run_command / edit_file / create_file / delete_file / move_file / apply_patch */
+    tool: string;
+    /** 具体操作：命令全文或文件路径 */
+    action: string;
+    /** high-risk = 命中内置危险命令库，需要询问；rule = 仅受 allow/deny 规则管控 */
+    reason: PermissionReason;
+    /** 展示给用户的说明 */
+    detail: string;
+    /** 额外匹配键（如文件相对路径），allow/deny 规则命中任一即生效 */
+    altKeys?: string[];
+}
+/** ask 模式下高危操作的交互确认回调（由 CLI 注入 readline 实现） */
+export type PermissionResolver = (request: PermissionRequest) => Promise<PermissionAnswer>;
+export interface AllowRules {
+    /** 永远允许的规则，格式 "<tool>:<pattern>" 或 "*:<pattern>"，pattern 中 * 为通配符 */
+    allow: string[];
+    /** 永远拒绝的规则，格式同上 */
+    deny: string[];
+}
+export declare function isDangerousCommand(command: string): boolean;
+export declare function getAllowRules(): AllowRules;
+export declare function reloadAllowRules(): void;
+/** 把"永远允许"的规则追加写入 allow.json 并热加载 */
+export declare function appendAllowRule(rule: string): void;
+/**
+ * 规则匹配。规则格式 "<tool>:<pattern>" 或 "*:<pattern>"；
+ * pattern 中的 * 为通配符，其余字符按字面量匹配。
+ */
+export declare function matchRule(rule: string, key: string): boolean;
+export declare class PermissionGate {
+    private readonly mode;
+    private readonly resolver?;
+    private sessionAllowAll;
+    constructor(mode?: PermissionMode, resolver?: PermissionResolver);
+    getMode(): PermissionMode;
+    check(request: PermissionRequest): Promise<PermissionDecision>;
+}

package/dist/permissions.js

@@ -0,0 +1,170 @@
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { DEEPCCC_HOME } from "./config.js";
+const RULES_FILE = join(DEEPCCC_HOME, "allow.json");
+const EMPTY_RULES = { allow: [], deny: [] };
+/**
+ * 内置危险命令库（命中即进入询问流程；allow 规则可覆盖）。
+ * 覆盖 Windows 与 Unix 常见破坏性操作：强制删除、强制推送、磁盘/分区、
+ * 关机重启、设备覆写、数据库 DROP、fork bomb、全局卸载、发布等。
+ */
+const DANGEROUS_COMMAND_PATTERNS = [
+    /^\s*rm\s+-[a-zA-Z]*r[a-zA-Z]*f[a-zA-Z]*\b/i, // rm -rf / rm -fr
+    /^\s*rm\s+-[a-zA-Z]*f[a-zA-Z]*r[a-zA-Z]*\b/i,
+    /^\s*rmdir\s+\/s/i, // Windows rmdir /s
+    /^\s*(del|erase)\s+\/s/i, // Windows del /s
+    /^\s*git\s+(push|fetch|pull)\s+.*(--force|-f\b)/i, // git push --force
+    /^\s*git\s+reset\s+--hard/i,
+    /^\s*git\s+clean\s+(-[a-z]*f)/i,
+    /^\s*format\s+[a-z]:/i,
+    /^\s*diskpart\b/i,
+    /^\s*(shutdown|reboot)\b/i,
+    /^\s*mkfs\b/i,
+    /^\s*fdisk\b/i,
+    /^\s*dd\s+.*\bof=/i,
+    /^\s*sudo\s+(rm|shutdown|mkfs|dd|fdisk|diskpart)/i,
+    /^\s*Remove-Item\s+-Recurse/i,
+    /^\s*:\(\)\s*\{.*\}\s*;/i, // fork bomb
+    /^\s*(drop|truncate)\s+table/i,
+    /^\s*npm\s+(publish|unpublish)\b/i,
+    /^\s*npm\s+uninstall\s+-g/i,
+    /^\s*pip\s+uninstall\b/i,
+];
+export function isDangerousCommand(command) {
+    return DANGEROUS_COMMAND_PATTERNS.some((re) => re.test(command));
+}
+// ---------------------------------------------------------------------------
+// 规则加载（~/.deepccc/allow.json，热加载）
+// ---------------------------------------------------------------------------
+let rulesCache = null;
+let rulesStamp;
+function rulesFileStamp() {
+    if (!existsSync(RULES_FILE))
+        return null;
+    try {
+        const s = statSync(RULES_FILE);
+        return `${s.mtimeMs}:${s.size}`;
+    }
+    catch {
+        return null;
+    }
+}
+function sanitizeRuleList(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    return raw.filter((item) => typeof item === "string" && item.trim().length > 0);
+}
+function loadRules() {
+    if (!existsSync(RULES_FILE))
+        return EMPTY_RULES;
+    try {
+        const raw = readFileSync(RULES_FILE, "utf-8").replace(/^\uFEFF/, "");
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+            return EMPTY_RULES;
+        return {
+            allow: sanitizeRuleList(parsed.allow),
+            deny: sanitizeRuleList(parsed.deny),
+        };
+    }
+    catch (err) {
+        console.error(`[PERMISSIONS] failed to read allow.json: ${err.message}`);
+        return EMPTY_RULES;
+    }
+}
+export function getAllowRules() {
+    const stamp = rulesFileStamp();
+    if (!rulesCache || stamp !== rulesStamp) {
+        rulesCache = loadRules();
+        rulesStamp = stamp;
+    }
+    return rulesCache;
+}
+export function reloadAllowRules() {
+    rulesCache = null;
+    rulesStamp = undefined;
+}
+/** 把"永远允许"的规则追加写入 allow.json 并热加载 */
+export function appendAllowRule(rule) {
+    const rules = getAllowRules();
+    if (rules.allow.includes(rule))
+        return;
+    const next = { allow: [...rules.allow, rule], deny: rules.deny };
+    try {
+        mkdirSync(dirname(RULES_FILE), { recursive: true });
+        writeFileSync(RULES_FILE, `${JSON.stringify(next, null, 2)}\n`, "utf-8");
+        reloadAllowRules();
+    }
+    catch (err) {
+        console.error(`[PERMISSIONS] failed to write allow.json: ${err.message}`);
+    }
+}
+function escapeRegex(s) {
+    return s.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+ * 规则匹配。规则格式 "<tool>:<pattern>" 或 "*:<pattern>"；
+ * pattern 中的 * 为通配符，其余字符按字面量匹配。
+ */
+export function matchRule(rule, key) {
+    const ruleColon = rule.indexOf(":");
+    if (ruleColon === -1)
+        return false;
+    const toolPart = rule.slice(0, ruleColon);
+    const pattern = rule.slice(ruleColon + 1);
+    const keyColon = key.indexOf(":");
+    if (keyColon === -1)
+        return false;
+    const keyTool = key.slice(0, keyColon);
+    const keyAction = key.slice(keyColon + 1);
+    if (toolPart !== "*" && toolPart !== keyTool)
+        return false;
+    const re = new RegExp(`^${pattern.split("*").map(escapeRegex).join(".*")}$`);
+    return re.test(keyAction);
+}
+// ---------------------------------------------------------------------------
+// PermissionGate
+// ---------------------------------------------------------------------------
+export class PermissionGate {
+    mode;
+    resolver;
+    sessionAllowAll = false;
+    constructor(mode = "ask", resolver) {
+        this.mode = mode;
+        this.resolver = resolver;
+    }
+    getMode() {
+        return this.mode;
+    }
+    async check(request) {
+        if (this.mode === "bypass" || this.sessionAllowAll)
+            return "allow";
+        const key = `${request.tool}:${request.action}`;
+        const keys = [key, ...(request.altKeys ?? []).map((k) => `${request.tool}:${k}`)];
+        const rules = getAllowRules();
+        if (rules.deny.some((r) => keys.some((k) => matchRule(r, k))))
+            return "deny";
+        if (rules.allow.some((r) => keys.some((k) => matchRule(r, k))))
+            return "allow";
+        // 只有命中内置危险命令库的 run_command 才询问；文件编辑等常规操作默认放行
+        if (request.reason !== "high-risk")
+            return "allow";
+        // 高危且无交互能力（非 TTY / JSONL / 程序化调用）→ 安全默认拒绝
+        if (!this.resolver)
+            return "deny";
+        const answer = await this.resolver(request);
+        switch (answer) {
+            case "allow":
+                return "allow";
+            case "allow-session":
+                this.sessionAllowAll = true;
+                return "allow";
+            case "allow-always":
+                appendAllowRule(key);
+                return "allow";
+            case "deny":
+            default:
+                return "deny";
+        }
+    }
+}

package/package.json

@@ -1,61 +1,61 @@
-{
-  "name": "deepccc",
-  "version": "0.1.2",
-  "description": "A lightweight DeepSeek-optimized coding agent with OpenAI-compatible model support.",
-  "license": "Apache-2.0",
-  "keywords": [
-    "agent",
-    "deepseek",
-    "coding-agent",
-    "openai-compatible",
-    "cli"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/wzj998/deepccc-agent.git"
-  },
-  "bugs": {
-    "url": "https://github.com/wzj998/deepccc-agent/issues"
-  },
-  "homepage": "https://github.com/wzj998/deepccc-agent#readme",
-  "type": "module",
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
-    }
-  },
-  "bin": {
-    "deepccc": "bin/deepccc.mjs"
-  },
-  "files": [
-    "dist/",
-    "bin/",
-    "package.json",
-    "README.md",
-    "LICENSE"
-  ],
-  "scripts": {
-    "build": "node node_modules/typescript/bin/tsc -p tsconfig.build.json",
-    "prepack": "node node_modules/typescript/bin/tsc -p tsconfig.build.json",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "typecheck": "node node_modules/typescript/bin/tsc --noEmit"
-  },
-  "dependencies": {
-    "@ai-sdk/openai-compatible": "^2.0.47",
-    "@vscode/ripgrep": "^1.18.0",
-    "ai": "^6.0.184"
-  },
-  "devDependencies": {
-    "@types/node": "^20.0.0",
-    "tsx": "^4.0.0",
-    "typescript": "^5.0.0",
-    "vitest": "^3.2.4"
-  },
-  "engines": {
-    "node": ">=20"
-  }
-}
+{
+  "name": "deepccc",
+  "version": "0.1.3",
+  "description": "A lightweight DeepSeek-optimized coding agent with OpenAI-compatible model support.",
+  "license": "Apache-2.0",
+  "keywords": [
+    "agent",
+    "deepseek",
+    "coding-agent",
+    "openai-compatible",
+    "cli"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/wzj998/deepccc-agent.git"
+  },
+  "bugs": {
+    "url": "https://github.com/wzj998/deepccc-agent/issues"
+  },
+  "homepage": "https://github.com/wzj998/deepccc-agent#readme",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "bin": {
+    "deepccc": "bin/deepccc.mjs"
+  },
+  "files": [
+    "dist/",
+    "bin/",
+    "package.json",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "node node_modules/typescript/bin/tsc -p tsconfig.build.json",
+    "prepack": "node node_modules/typescript/bin/tsc -p tsconfig.build.json",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "node node_modules/typescript/bin/tsc --noEmit"
+  },
+  "dependencies": {
+    "@ai-sdk/openai-compatible": "^2.0.47",
+    "@vscode/ripgrep": "^1.18.0",
+    "ai": "^6.0.184"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "tsx": "^4.0.0",
+    "typescript": "^5.0.0",
+    "vitest": "^3.2.4"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}