evolcore 0.0.13 → 0.0.15

package/dist/core/permission/approval-gateway.js

@@ -7,6 +7,7 @@ import { summarizeToolInput } from '../../utils/tool-summary.js';
 import { createRootCausation, deriveCausation, normalizeCausation } from '../causation/context.js';
 import { recordCausationSpan } from '../causation/audit.js';
 import { checkDangerousCommand } from './tool-policy.js';
+import { resolveProtectedCandidate } from '../protected-paths.js';
 export async function requestDangerousCommandPermission(gateway, sessionId, toolName, input, sendPrompt, context, grantScope = 'default', mode = 'request') {
     const dangerCheck = checkDangerousCommand(toolName, input);
     if (!dangerCheck.isDangerous) {
@@ -41,6 +42,76 @@ function stablePermissionInput(value) {
 function permissionInputFingerprint(input) {
     return createHash('sha256').update(stablePermissionInput(input)).digest('hex');
 }
+function collectExplicitFileChangeGrantPaths(record, output) {
+    const pathKeys = ['path', 'filePath', 'file_path', 'movePath', 'move_path', 'destinationPath', 'targetPath'];
+    const hasExplicitPath = pathKeys.some(key => typeof record[key] === 'string' && !!record[key]);
+    for (const key of pathKeys) {
+        const candidate = record[key];
+        if (typeof candidate === 'string' && candidate)
+            output.push(candidate);
+    }
+    if (record.kind && typeof record.kind === 'object' && !Array.isArray(record.kind)) {
+        collectExplicitFileChangeGrantPaths(record.kind, output);
+    }
+    return hasExplicitPath;
+}
+function collectFileChangeGrantPaths(value, output) {
+    if (Array.isArray(value)) {
+        for (const entry of value) {
+            if (entry && typeof entry === 'object' && !Array.isArray(entry)) {
+                collectExplicitFileChangeGrantPaths(entry, output);
+            }
+        }
+        return;
+    }
+    if (!value || typeof value !== 'object')
+        return;
+    const record = value;
+    const hasExplicitPath = collectExplicitFileChangeGrantPaths(record, output);
+    if (hasExplicitPath)
+        return;
+    // Some backends encode file changes as a map keyed by path. Do not treat
+    // metadata keys as paths, and still collect explicit move destinations.
+    for (const [filePath, change] of Object.entries(record)) {
+        if (filePath !== 'kind' && filePath !== 'type')
+            output.push(filePath);
+        if (change && typeof change === 'object' && !Array.isArray(change)) {
+            collectExplicitFileChangeGrantPaths(change, output);
+        }
+    }
+}
+function permissionGrantMatch(toolName, input, options) {
+    const fileChangeCwd = options?.fileChangeCwd?.trim();
+    // grantRoot is already a broad filesystem capability. Keep it exact rather
+    // than silently widening it through the concrete-file convenience scope.
+    if (toolName === 'FileChange' && fileChangeCwd && !input.grantRoot) {
+        const rawPaths = [];
+        collectFileChangeGrantPaths(input.fileChanges, rawPaths);
+        try {
+            const canonicalPaths = [...new Set(rawPaths.map(candidate => {
+                    const canonical = resolveProtectedCandidate(candidate, fileChangeCwd);
+                    return process.platform === 'win32' ? canonical.toLowerCase() : canonical;
+                }))].sort();
+            if (canonicalPaths.length > 0) {
+                return {
+                    inputFingerprint: permissionInputFingerprint({
+                        scope: 'file-change-paths-v1',
+                        paths: canonicalPaths,
+                    }),
+                    scope: 'file-change-paths',
+                };
+            }
+        }
+        catch {
+            // Invalid path input falls back to exact matching; policy checks still
+            // decide whether the request itself may be approved.
+        }
+    }
+    return {
+        inputFingerprint: permissionInputFingerprint(input),
+        scope: 'exact-operation',
+    };
+}
 function truncateApprovalDetail(value) {
     const trimmed = value.trim();
     return trimmed.length > APPROVAL_DETAIL_LIMIT
@@ -238,13 +309,14 @@ export class PermissionGateway {
                 this.temporaryGrants.delete(key);
         }
     }
-    hasTemporaryGrant(sessionId, toolName, toolInput, grantScope = 'default') {
-        return !!this.getTemporaryGrant(sessionId, toolName, toolInput, grantScope);
+    hasTemporaryGrant(sessionId, toolName, toolInput, grantScope = 'default', matchOptions) {
+        const match = permissionGrantMatch(toolName, toolInput, matchOptions);
+        return !!this.getTemporaryGrant(sessionId, toolName, match.inputFingerprint, grantScope);
     }
-    getTemporaryGrant(sessionId, toolName, toolInput, grantScope = 'default') {
+    getTemporaryGrant(sessionId, toolName, inputFingerprint, grantScope = 'default') {
         const now = Date.now();
         this.pruneTemporaryGrants(now);
-        const key = this.temporaryGrantKey(sessionId, toolName, permissionInputFingerprint(toolInput), grantScope);
+        const key = this.temporaryGrantKey(sessionId, toolName, inputFingerprint, grantScope);
         return this.temporaryGrants.get(key);
     }
     addTemporaryGrant(pending, causation) {
@@ -425,7 +497,7 @@ export class PermissionGateway {
         }
         return true;
     }
-    async requestCrossSessionPermission(sessionId, challenge, route, sendPrompt, context, grantScope, requestCausation) {
+    async requestCrossSessionPermission(sessionId, challenge, route, sendPrompt, context, grantScope, requestCausation, grantMatch) {
         const approval = context.approvalRouting;
         const interactionRouter = context.interactionRouter;
         if (!approval || !interactionRouter) {
@@ -480,7 +552,11 @@ export class PermissionGateway {
                 bodyFormat: 'markdown',
                 buttons: [
                     { key: 'approve_once', label: '批准本次', style: 'primary' },
-                    { key: 'approve_session_30m', label: '本会话 30 分钟', style: 'default' },
+                    {
+                        key: 'approve_session_30m',
+                        label: grantMatch.scope === 'file-change-paths' ? '同文件 30 分钟' : '本会话 30 分钟',
+                        style: 'default',
+                    },
                     { key: 'deny', label: '拒绝', style: 'danger' },
                 ],
             },
@@ -508,7 +584,7 @@ export class PermissionGateway {
                 displaySummary,
                 reason,
                 resolve,
-                inputFingerprint: permissionInputFingerprint(toolInput),
+                inputFingerprint: grantMatch.inputFingerprint,
                 grantScope,
                 approverPolicy: challenge.approverPolicy,
                 approvalRouteKind: route.kind,
@@ -644,7 +720,7 @@ export class PermissionGateway {
     /**
      * 请求人工审批。返回三态决策。
      */
-    async requestPermission(sessionId, toolName, toolInput, sendPrompt, context, summary, reason, grantScope = 'default', approverPolicy) {
+    async requestPermission(sessionId, toolName, toolInput, sendPrompt, context, summary, reason, grantScope = 'default', approverPolicy, matchOptions) {
         const effectiveApproverPolicy = approverPolicy
             ?? context?.approvalRouting?.approverPolicy
             ?? 'requester';
@@ -672,7 +748,8 @@ export class PermissionGateway {
             await sendPrompt('当前操作需要授权，但无法验证申请人身份。');
             return 'deny';
         }
-        const temporaryGrant = this.getTemporaryGrant(sessionId, toolName, toolInput, grantScope);
+        const grantMatch = permissionGrantMatch(toolName, toolInput, matchOptions);
+        const temporaryGrant = this.getTemporaryGrant(sessionId, toolName, grantMatch.inputFingerprint, grantScope);
         if (temporaryGrant) {
             const consumeCausation = deriveCausation(normalizeCausation(temporaryGrant.causation)
                 ?? normalizeCausation(context?.causation)
@@ -731,7 +808,7 @@ export class PermissionGateway {
             return 'deny';
         }
         if (route.kind === 'handoff') {
-            return this.requestCrossSessionPermission(sessionId, challenge, route, sendPrompt, context, grantScope, requestCausation);
+            return this.requestCrossSessionPermission(sessionId, challenge, route, sendPrompt, context, grantScope, requestCausation, grantMatch);
         }
         // 构造 ActionInteraction
         const interaction = {
@@ -743,7 +820,11 @@ export class PermissionGateway {
                 body: `工具：${toolName}\n操作：${displaySummary}${reasonLine}`,
                 buttons: [
                     { key: 'allow', label: '✅ 允许本次', style: 'primary' },
-                    { key: 'always', label: '⏱ 同操作 30 分钟', style: 'default' },
+                    {
+                        key: 'always',
+                        label: grantMatch.scope === 'file-change-paths' ? '⏱ 同文件 30 分钟' : '⏱ 同操作 30 分钟',
+                        style: 'default',
+                    },
                     { key: 'deny', label: '❌ 拒绝', style: 'danger' },
                 ],
             },
@@ -767,7 +848,7 @@ export class PermissionGateway {
             const pending = {
                 sessionId,
                 toolName,
-                inputFingerprint: permissionInputFingerprint(toolInput),
+                inputFingerprint: grantMatch.inputFingerprint,
                 grantScope,
                 approverPolicy: challenge.approverPolicy,
                 approvalRouteKind: route.kind,
@@ -839,7 +920,10 @@ export class PermissionGateway {
                     replyContext: context.replyContext,
                     causation: requestCausation,
                 });
-                const fallbackText = `🔐 权限请求 - ${toolName}\n${displaySummary}${reasonLine}\n回复 /perm ${requestId} allow 允许本次 / /perm ${requestId} always 同操作授权 30 分钟 / /perm ${requestId} deny 拒绝`;
+                const temporaryGrantLabel = grantMatch.scope === 'file-change-paths'
+                    ? '同文件授权 30 分钟'
+                    : '同操作授权 30 分钟';
+                const fallbackText = `🔐 权限请求 - ${toolName}\n${displaySummary}${reasonLine}\n回复 /perm ${requestId} allow 允许本次 / /perm ${requestId} always ${temporaryGrantLabel} / /perm ${requestId} deny 拒绝`;
                 const result = await sendInteractionPayload(context.adapter, envelope, interaction, fallbackText, context.replyContext);
                 interactionSent = !!result;
             }
@@ -879,9 +963,8 @@ export class PermissionGateway {
         const normalizedDecision = decision === 'allow' || decision === 'always'
             ? decision
             : 'deny';
-        // Legacy "always" now means this exact operation in this session for 30 minutes.
-        // The backend receives a one-shot allow. Future identical operations must
-        // return through this gateway so the exact fingerprint and TTL are checked.
+        // The backend receives a one-shot allow. Future requests must return
+        // through this gateway so the selected match scope and TTL are checked.
         this.clearPendingResources(pending);
         pending.interactionRouter?.cancel(requestId);
         pending.resolve(normalizedDecision === 'deny' ? 'deny' : 'allow');