evolcore 0.0.35 → 0.0.37

package/dist/core/permission/approval-gateway.js

@@ -10,6 +10,23 @@ import { checkDangerousCommand } from './tool-policy.js';
 import { resolveProtectedCandidate } from './protected-paths.js';
 import { auditPermissionDecision, auditPermissionLifecycle } from '../auth/authorization-audit.js';
 import { ConfigTarget, onConfigWrite } from '../../config/config-manager.js';
+import { fileChangeApprovalScope, permissionApprovalScope, filesystemScopeContains, } from './filesystem-approval-scope.js';
+export function parsePermissionApprovalDecision(value) {
+    if (value === 'approve_once')
+        return 'allow';
+    if (value === 'approve_session_30m')
+        return 'always';
+    if (value === 'approve_file_60m')
+        return 'file_60m';
+    if (value === 'approve_directory_60m')
+        return 'directory_60m';
+    if (value === 'approve_all_directories_60m')
+        return 'all_directories_60m';
+    if (['allow', 'always', 'deny', 'file_60m', 'directory_60m', 'all_directories_60m'].includes(value)) {
+        return value;
+    }
+    return undefined;
+}
 export async function requestDangerousCommandPermission(gateway, sessionId, toolName, input, sendPrompt, context, grantScope = 'default', mode = 'request') {
     const dangerCheck = checkDangerousCommand(toolName, input);
     if (!dangerCheck.isDangerous) {
@@ -40,6 +57,7 @@ export async function requestDangerousCommandPermission(gateway, sessionId, tool
     return { matched: true, decision };
 }
 const SESSION_GRANT_TTL_MS = 30 * 60 * 1000;
+const FILESYSTEM_GRANT_TTL_MS = 60 * 60 * 1000;
 const LOCAL_APPROVAL_TTL_MS = 20 * 60 * 1000;
 const MANAGEMENT_APPROVAL_REVALIDATION_INTERVAL_MS = 5_000;
 const APPROVAL_DETAIL_LIMIT = 800;
@@ -98,11 +116,19 @@ function collectFileChangeGrantPaths(value, output) {
 }
 function permissionGrantMatch(toolName, input, options) {
     const fileChangeCwd = options?.fileChangeCwd?.trim();
+    const fileOnly = !['permissions', 'additionalPermissions', 'networkApprovalContext', 'proposedNetworkPolicyAmendments']
+        .some(key => input[key] !== undefined);
+    const rawPaths = [];
+    if (toolName === 'FileChange')
+        collectFileChangeGrantPaths(input.fileChanges, rawPaths);
+    const filesystem = toolName === 'FileChange' && fileChangeCwd && fileOnly
+        ? fileChangeApprovalScope(rawPaths, fileChangeCwd, input.grantRoot)
+        : toolName === 'PermissionGrant' && options?.filesystemCwd && options.workspacePath
+            ? permissionApprovalScope(input, options.filesystemCwd, options.workspacePath)
+            : undefined;
     // grantRoot is already a broad filesystem capability. Keep it exact rather
     // than silently widening it through the concrete-file convenience scope.
-    if (toolName === 'FileChange' && fileChangeCwd && !input.grantRoot) {
-        const rawPaths = [];
-        collectFileChangeGrantPaths(input.fileChanges, rawPaths);
+    if (toolName === 'FileChange' && fileChangeCwd && fileOnly && !input.grantRoot) {
         try {
             const canonicalPaths = [...new Set(rawPaths.map(candidate => {
                     const canonical = resolveProtectedCandidate(candidate, fileChangeCwd);
@@ -115,6 +141,7 @@ function permissionGrantMatch(toolName, input, options) {
                         paths: canonicalPaths,
                     }),
                     scope: 'file-change-paths',
+                    filesystem,
                 };
             }
         }
@@ -126,8 +153,73 @@ function permissionGrantMatch(toolName, input, options) {
     return {
         inputFingerprint: permissionInputFingerprint(input),
         scope: 'exact-operation',
+        filesystem,
     };
 }
+function permissionGrantContextKey(context, approverPolicy) {
+    return permissionInputFingerprint({
+        selfAid: context.selfAid ?? context.approvalRouting?.selfAid,
+        userId: context.userId,
+        principalId: context.actor?.principalId,
+        channelKey: context.actor?.operatorChannelKey ?? context.channel,
+        role: context.role,
+        permissionMode: context.permissionMode,
+        originPrincipalId: context.approvalRouting?.originPrincipalId,
+        originAuthRevision: context.approvalRouting?.originAuthRevision,
+        approverPolicy,
+    });
+}
+function approvalButtons(match, route, context) {
+    const handoff = route.kind === 'handoff';
+    const buttons = [
+        { key: handoff ? 'approve_once' : 'allow', label: handoff ? '批准本次' : '✓ 允许本次', style: 'primary' },
+    ];
+    const offeredDecisions = ['allow', 'deny'];
+    if (match.scope === 'file-change-paths' && match.filesystem) {
+        buttons.push({ key: 'approve_file_60m', label: '同文件 60 分钟', style: 'default' });
+        offeredDecisions.push('file_60m');
+    }
+    else {
+        buttons.push({ key: handoff ? 'approve_session_30m' : 'always', label: handoff ? '本会话 30 分钟' : '同操作 30 分钟', style: 'default' });
+        offeredDecisions.push('always');
+    }
+    const scope = match.filesystem;
+    if (scope?.directory) {
+        buttons.push({ key: 'approve_directory_60m', label: '当前目录 60 分钟', style: 'default' });
+        offeredDecisions.push('directory_60m');
+    }
+    // A broad directory grant must be issued by an actual owner, including an
+    // owner answering a manager handoff. Never offer it to an admin/requester.
+    const agentAndHostOwner = !!route.approverPrincipalId
+        && context.approvalRouting?.owners?.includes(route.approverPrincipalId) === true
+        && context.approvalRouting.hostOwners?.includes(route.approverPrincipalId) === true;
+    const owner = !!route.approverPrincipalId && !!route.approverChannelKey
+        && !!context.approvalRouting?.reauthorizeApproval
+        && agentAndHostOwner;
+    if (scope && owner) {
+        buttons.push({ key: 'approve_all_directories_60m', label: '所有普通目录 60 分钟', style: 'default' });
+        offeredDecisions.push('all_directories_60m');
+    }
+    // Without matching Agent and host owners, keep the filesystem choices to
+    // the one-shot, per-file, and deny actions. Recursive directory grants are
+    // deliberately withheld from an owner that is not also the host Owner.
+    if (scope && !owner) {
+        const filtered = buttons.filter(button => button.key !== 'approve_directory_60m');
+        buttons.length = 0;
+        buttons.push(...filtered);
+        const filteredDecisions = offeredDecisions.filter(decision => decision !== 'directory_60m');
+        offeredDecisions.length = 0;
+        offeredDecisions.push(...filteredDecisions);
+    }
+    buttons.push({ key: 'deny', label: '✗ 拒绝', style: 'danger' });
+    const detail = scope ? [
+        ...(scope.directory ? [`目录授权范围（含子目录）：${scope.directory}`] : []),
+        ...(owner ? ['“所有普通目录 60 分钟”覆盖当前会话内所有非受保护目录。'] : []),
+        `临时文件权限：${scope.access === 'write' ? '读写' : '只读'}；仅当前会话和权限上下文有效。`,
+        '受保护路径和其他会话临时目录仍按现有策略校验；不授权 Shell 命令、网络或系统管理权限。',
+    ].join('\n') : '';
+    return { buttons, offeredDecisions, detail };
+}
 function truncateApprovalDetail(value) {
     const trimmed = value.trim();
     return trimmed.length > APPROVAL_DETAIL_LIMIT
@@ -372,20 +464,60 @@ export class PermissionGateway {
     }
     hasTemporaryGrant(sessionId, toolName, toolInput, grantScope = 'default', matchOptions) {
         const match = permissionGrantMatch(toolName, toolInput, matchOptions);
-        return !!this.getTemporaryGrant(sessionId, toolName, match.inputFingerprint, grantScope);
+        return !!this.getTemporaryGrant(sessionId, toolName, match, grantScope);
     }
-    getTemporaryGrant(sessionId, toolName, inputFingerprint, grantScope = 'default') {
+    getTemporaryGrant(sessionId, toolName, match, grantScope = 'default', grantContextKey) {
         const now = Date.now();
         this.pruneTemporaryGrants(now);
-        const key = this.temporaryGrantKey(sessionId, toolName, inputFingerprint, grantScope);
-        return this.temporaryGrants.get(key);
+        for (const [key, grant] of this.temporaryGrants) {
+            if (grant.sessionId !== sessionId || grant.toolName !== toolName || grant.grantScope !== grantScope
+                || (grantContextKey !== undefined && grant.grantContextKey !== grantContextKey))
+                continue;
+            const target = grant.target;
+            const matches = target.kind === 'operation'
+                ? target.inputFingerprint === match.inputFingerprint
+                : !!match.filesystem && filesystemScopeContains(target, match.filesystem);
+            if (!matches)
+                continue;
+            const authorization = this.authorizePendingResponse(grant.authorization, grant.authorization.approverOperatorId, grant.authorization.approverChannelKey);
+            if (authorization.status !== 'authorized') {
+                this.temporaryGrants.delete(key);
+                continue;
+            }
+            return grant;
+        }
+        return undefined;
     }
-    addTemporaryGrant(pending, causation) {
+    addTemporaryGrant(pending, decision, causation) {
         const now = Date.now();
         this.pruneTemporaryGrants(now);
-        const expiresAt = now + SESSION_GRANT_TTL_MS;
-        const key = this.temporaryGrantKey(pending.sessionId, pending.toolName, pending.inputFingerprint, pending.grantScope);
-        this.temporaryGrants.set(key, { expiresAt, causation: normalizeCausation(causation) });
+        const filesystem = pending.grantMatch.filesystem;
+        const target = decision === 'directory_60m' && filesystem?.directory
+            ? { kind: 'directory', directory: filesystem.directory, access: filesystem.access }
+            : decision === 'all_directories_60m' && filesystem
+                ? { kind: 'all-directories', access: filesystem.access }
+                : { kind: 'operation', inputFingerprint: pending.inputFingerprint };
+        const expiresAt = now + (decision === 'always' ? SESSION_GRANT_TTL_MS : FILESYSTEM_GRANT_TTL_MS);
+        const fingerprint = target.kind === 'operation'
+            ? target.inputFingerprint : permissionInputFingerprint(target);
+        const key = this.temporaryGrantKey(pending.sessionId, pending.toolName, fingerprint, pending.grantScope);
+        const authorization = {
+            approverPolicy: decision === 'all_directories_60m' ? 'agent_owner' : pending.approverPolicy,
+            requiredApproverRole: decision === 'all_directories_60m' ? 'owner' : pending.requiredApproverRole,
+            approverOperatorId: pending.approverOperatorId,
+            approverChannelKey: pending.approverChannelKey,
+            approverPrincipalId: pending.approverPrincipalId,
+            selfAid: pending.selfAid,
+            originPrincipalId: pending.originPrincipalId,
+            originAuthRevision: pending.originAuthRevision,
+            reauthorizeApproval: pending.reauthorizeApproval,
+            requireHostOwner: decision === 'all_directories_60m',
+        };
+        this.temporaryGrants.set(key, {
+            sessionId: pending.sessionId, toolName: pending.toolName, grantScope: pending.grantScope,
+            grantContextKey: pending.grantContextKey, authorization, target,
+            expiresAt, causation: normalizeCausation(causation),
+        });
         return expiresAt;
     }
     authorizePendingResponse(pending, operatorId, channelKey) {
@@ -455,6 +587,9 @@ export class PermissionGateway {
                 reason: stillAssigned ? 'approver_role_changed' : 'approver_revoked',
             };
         }
+        if (pending.requireHostOwner && !result.hostOwners?.includes(actor.principalId)) {
+            return { status: 'revoked', reason: 'approver_not_host_owner' };
+        }
         if (pending.originPrincipalId !== undefined
             && result.originPrincipalId !== pending.originPrincipalId) {
             return { status: 'revoked', reason: 'origin_authorization_changed' };
@@ -465,6 +600,20 @@ export class PermissionGateway {
         }
         return { status: 'authorized' };
     }
+    pendingDecision(pending, action) {
+        const decision = parsePermissionApprovalDecision(action);
+        if (!decision)
+            return undefined;
+        // Old /perm always links keep their historical 30-minute exact-file grant.
+        if (decision === 'always' && pending.offeredDecisions.includes('file_60m'))
+            return decision;
+        return pending.offeredDecisions.includes(decision) ? decision : undefined;
+    }
+    decisionAuthorization(pending, decision) {
+        return decision === 'all_directories_60m'
+            ? { ...pending, requiredApproverRole: 'owner', approverPolicy: 'agent_owner', requireHostOwner: true }
+            : pending;
+    }
     /** Legacy diagnostics alias. Grants are no longer tool-wide or permanent. */
     getAlwaysAllowList() {
         this.pruneTemporaryGrants(Date.now());
@@ -474,7 +623,10 @@ export class PermissionGateway {
         const pending = this.crossSessionPending.get(requestId);
         if (!pending || pending.sessionId !== sessionId)
             return false;
-        const authorization = this.authorizePendingResponse(pending, operatorId, channelKey);
+        const selectedDecision = this.pendingDecision(pending, action);
+        if (!selectedDecision)
+            return false;
+        const authorization = this.authorizePendingResponse(this.decisionAuthorization(pending, selectedDecision), operatorId, channelKey);
         if (authorization.status === 'identity_mismatch')
             return false;
         if (authorization.status === 'revoked') {
@@ -486,12 +638,12 @@ export class PermissionGateway {
         pending.interactionRouter?.cancel(requestId);
         this.crossSessionPending.delete(requestId);
         this.syncManagementRevalidationTimer();
-        const sessionGrant = action === 'approve_session_30m';
-        const approved = action === 'approve_once' || sessionGrant || action === 'allow';
+        const sessionGrant = selectedDecision !== 'allow' && selectedDecision !== 'deny';
+        const approved = selectedDecision !== 'deny';
         const decision = approved ? 'allow' : 'deny';
         const decisionCausation = deriveCausation(pending.causation);
         if (sessionGrant)
-            this.addTemporaryGrant(pending, decisionCausation);
+            this.addTemporaryGrant(pending, selectedDecision, decisionCausation);
         pending.resolve(decision);
         auditPermissionLifecycle({
             phase: 'response',
@@ -695,6 +847,7 @@ export class PermissionGateway {
             : undefined;
         const approvalDeadline = new Date(expiresAt).toLocaleString('zh-CN', { hour12: false });
         const target = formatApprovalTarget(toolName, toolInput);
+        const choices = approvalButtons(grantMatch, route, context);
         const body = [
             '**申请信息**',
             '',
@@ -715,6 +868,7 @@ export class PermissionGateway {
             '',
             '- **风险：中** · 跨会话临时授权，请核对目标和参数',
             `- **审批截止**：${escapeApprovalMarkdown(approvalDeadline)}（约 ${Math.round(ttlMs / 60000)} 分钟）`,
+            ...(choices.detail ? ['', approvalCodeBlock(choices.detail)] : []),
         ].join('\n');
         const interaction = {
             type: 'interaction',
@@ -724,15 +878,7 @@ export class PermissionGateway {
                 title: '临时授权申请',
                 body,
                 bodyFormat: 'markdown',
-                buttons: [
-                    { key: 'approve_once', label: '批准本次', style: 'primary' },
-                    {
-                        key: 'approve_session_30m',
-                        label: grantMatch.scope === 'file-change-paths' ? '同文件 30 分钟' : '本会话 30 分钟',
-                        style: 'default',
-                    },
-                    { key: 'deny', label: '拒绝', style: 'danger' },
-                ],
+                buttons: choices.buttons,
             },
             channelId: route.approverOperatorId,
             sessionId,
@@ -740,11 +886,9 @@ export class PermissionGateway {
             expiresAt,
             fallback: {
                 command: 'perm',
-                buttonArgMap: {
-                    approve_once: `${requestId} allow`,
-                    approve_session_30m: `${requestId} always`,
-                    deny: `${requestId} deny`,
-                },
+                buttonArgMap: Object.fromEntries(choices.buttons.map(button => [
+                    button.key, `${requestId} ${parsePermissionApprovalDecision(button.key)}`,
+                ])),
             },
         };
         // Register before delivery. Some adapters can surface a user response as
@@ -760,6 +904,9 @@ export class PermissionGateway {
                 resolve,
                 inputFingerprint: grantMatch.inputFingerprint,
                 grantScope,
+                grantMatch,
+                grantContextKey: permissionGrantContextKey(context, challenge.approverPolicy),
+                offeredDecisions: choices.offeredDecisions,
                 approverPolicy: challenge.approverPolicy,
                 approvalRouteKind: route.kind,
                 requiredApproverRole: requiredApproverRole(challenge.approverPolicy),
@@ -999,7 +1146,8 @@ export class PermissionGateway {
             return 'deny';
         }
         const grantMatch = permissionGrantMatch(toolName, toolInput, matchOptions);
-        const temporaryGrant = this.getTemporaryGrant(sessionId, toolName, grantMatch.inputFingerprint, grantScope);
+        const grantContextKey = permissionGrantContextKey(context, effectiveApproverPolicy);
+        const temporaryGrant = this.getTemporaryGrant(sessionId, toolName, grantMatch, grantScope, grantContextKey);
         if (temporaryGrant) {
             const consumeCausation = deriveCausation(normalizeCausation(temporaryGrant.causation)
                 ?? normalizeCausation(context?.causation)
@@ -1007,7 +1155,7 @@ export class PermissionGateway {
             recordCausationSpan(consumeCausation, 'permission.consume', {
                 status: 'completed',
                 refs: { taskId: context?.taskId, sessionId },
-                reason: 'temporary_grant',
+                reason: `temporary_grant:${temporaryGrant.target.kind}:expires=${temporaryGrant.expiresAt}`,
             });
             return 'allow';
         }
@@ -1107,6 +1255,7 @@ export class PermissionGateway {
         if (route.kind === 'handoff') {
             return this.requestCrossSessionPermission(sessionId, challenge, route, sendPrompt, context, grantScope, requestCausation, grantMatch);
         }
+        const choices = approvalButtons(grantMatch, route, context);
         // 构造 ActionInteraction
         const interaction = {
             type: 'interaction',
@@ -1114,16 +1263,8 @@ export class PermissionGateway {
             kind: {
                 kind: 'action',
                 title: '🔐 权限请求',
-                body: `工具：${toolName}\n操作：${displaySummary}${reasonLine}`,
-                buttons: [
-                    { key: 'allow', label: '✅ 允许本次', style: 'primary' },
-                    {
-                        key: 'always',
-                        label: grantMatch.scope === 'file-change-paths' ? '⏱ 同文件 30 分钟' : '⏱ 同操作 30 分钟',
-                        style: 'default',
-                    },
-                    { key: 'deny', label: '❌ 拒绝', style: 'danger' },
-                ],
+                body: `工具：${toolName}\n操作：${displaySummary}${reasonLine}${choices.detail ? `\n\n${choices.detail}` : ''}`,
+                buttons: choices.buttons,
             },
             channelId: context?.channelId || '',
             sessionId,
@@ -1131,11 +1272,9 @@ export class PermissionGateway {
             expiresAt: Date.now() + LOCAL_APPROVAL_TTL_MS,
             fallback: {
                 command: 'perm',
-                buttonArgMap: {
-                    allow: `${requestId} allow`,
-                    always: `${requestId} always`,
-                    deny: `${requestId} deny`,
-                },
+                buttonArgMap: Object.fromEntries(choices.buttons.map(button => [
+                    button.key, `${requestId} ${parsePermissionApprovalDecision(button.key)}`,
+                ])),
             },
         };
         // Register before delivery so an immediate card/text response cannot beat
@@ -1147,6 +1286,9 @@ export class PermissionGateway {
                 toolName,
                 inputFingerprint: grantMatch.inputFingerprint,
                 grantScope,
+                grantMatch,
+                grantContextKey,
+                offeredDecisions: choices.offeredDecisions,
                 approverPolicy: challenge.approverPolicy,
                 approvalRouteKind: route.kind,
                 requiredApproverRole: requiredApproverRole(challenge.approverPolicy),
@@ -1222,10 +1364,7 @@ export class PermissionGateway {
                     replyContext: context.replyContext,
                     causation: requestCausation,
                 });
-                const temporaryGrantLabel = grantMatch.scope === 'file-change-paths'
-                    ? '同文件授权 30 分钟'
-                    : '同操作授权 30 分钟';
-                const fallbackText = `🔐 权限请求 - ${toolName}\n${displaySummary}${reasonLine}\n回复 /perm ${requestId} allow 允许本次 / /perm ${requestId} always ${temporaryGrantLabel} / /perm ${requestId} deny 拒绝`;
+                const fallbackText = renderActionAsText(interaction);
                 const result = await sendInteractionPayload(context.adapter, envelope, interaction, fallbackText, context.replyContext);
                 interactionSent = isInteractionSendAccepted(result);
             }
@@ -1254,7 +1393,10 @@ export class PermissionGateway {
         const pending = this.pending.get(requestId);
         if (!pending || pending.sessionId !== sessionId)
             return false;
-        const authorization = this.authorizePendingResponse(pending, operatorId, channelKey);
+        const normalizedDecision = this.pendingDecision(pending, decision);
+        if (!normalizedDecision)
+            return false;
+        const authorization = this.authorizePendingResponse(this.decisionAuthorization(pending, normalizedDecision), operatorId, channelKey);
         if (authorization.status === 'identity_mismatch')
             return false;
         if (authorization.status === 'revoked') {
@@ -1262,9 +1404,6 @@ export class PermissionGateway {
             this.failPendingPermission(sessionId, requestId, authorization.reason);
             return false;
         }
-        const normalizedDecision = decision === 'allow' || decision === 'always'
-            ? decision
-            : 'deny';
         // The backend receives a one-shot allow. Future requests must return
         // through this gateway so the selected match scope and TTL are checked.
         this.clearPendingResources(pending);
@@ -1307,8 +1446,8 @@ export class PermissionGateway {
             response: normalizedDecision,
         });
         const decisionCausation = deriveCausation(pending.causation);
-        if (normalizedDecision === 'always') {
-            this.addTemporaryGrant(pending, decisionCausation);
+        if (normalizedDecision !== 'allow' && normalizedDecision !== 'deny') {
+            this.addTemporaryGrant(pending, normalizedDecision, decisionCausation);
         }
         recordCausationSpan(decisionCausation, 'permission.decision', {
             status: normalizedDecision === 'deny' ? 'failed' : 'completed',
@@ -1333,12 +1472,7 @@ export class PermissionGateway {
         const crossSession = this.crossSessionPending.get(requestId);
         if (!crossSession)
             return false;
-        const action = decision === 'always'
-            ? 'approve_session_30m'
-            : decision === 'allow'
-                ? 'approve_once'
-                : 'deny';
-        return this.resolveCrossSessionPermission(crossSession.sessionId, requestId, action, undefined, operatorId, channelKey);
+        return this.resolveCrossSessionPermission(crossSession.sessionId, requestId, decision, undefined, operatorId, channelKey);
     }
     /**
      * Proactively cancel management approvals after an identity or Agent config