intentdna 1.4.6 → 1.4.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/hooks/enforce.js
CHANGED
|
@@ -14,6 +14,7 @@
|
|
|
14
14
|
* Step checkpoints are handled by the CLI, not here.
|
|
15
15
|
*/
|
|
16
16
|
import { allowOutput, blockOutput, escalateOutput, silentOutput } from "./protocol.js";
|
|
17
|
+
import { relative } from "node:path";
|
|
17
18
|
// ── PreToolUse Enforcement ─────────────────────────────────
|
|
18
19
|
/**
|
|
19
20
|
* Enforce PreToolUse constraints.
|
|
@@ -319,6 +320,9 @@ function enforceRoleScope(rolesScopeMap, input) {
|
|
|
319
320
|
const filePath = extractFilePath(input);
|
|
320
321
|
if (!filePath)
|
|
321
322
|
return null;
|
|
323
|
+
// Convert absolute path to relative for glob matching
|
|
324
|
+
const cwd = input.cwd;
|
|
325
|
+
const relativePath = cwd && filePath.startsWith("/") ? relative(cwd, filePath) : filePath;
|
|
322
326
|
for (const entry of rolesScopeMap) {
|
|
323
327
|
const agentTypeName = `dna-${toKebabCase(entry.role_name)}`;
|
|
324
328
|
if (input.agent_type !== agentTypeName)
|
|
@@ -327,7 +331,7 @@ function enforceRoleScope(rolesScopeMap, input) {
|
|
|
327
331
|
if (writeGlobs.length === 0) {
|
|
328
332
|
return blockOutput(`[Intent DNA]: Role '${entry.role_name}' has no write permission (path: ${filePath})`);
|
|
329
333
|
}
|
|
330
|
-
if (!checkWriteAllowed(
|
|
334
|
+
if (!checkWriteAllowed(relativePath, writeGlobs)) {
|
|
331
335
|
return blockOutput(`[Intent DNA]: Role '${entry.role_name}' cannot write to '${filePath}' (allowed: ${writeGlobs.join(", ")})`);
|
|
332
336
|
}
|
|
333
337
|
return null; // Role matched, write allowed
|