one-code-extension 0.4.0 → 0.5.0

package/extensions/permissions/settings.ts

@@ -18,14 +18,11 @@
  * Unknown keys in the files are preserved on write.
  */
 
-import { managedSettingsPaths } from "../auto-mode/config.ts";
-import { readSettingsFile as readClaudeSettingsFile, settingsPaths } from "../lib/claude-settings.ts";
-import {
-	oneCodeProjectSettingsPath,
-	oneCodeSettingsPath,
-	readSettingsForWrite,
-	writeSettings,
-} from "../lib/one-code-settings.ts";
+import { readSettingsFile as readClaudeSettingsFile, type SettingsSource, settingsPaths, settingsSources } from "../lib/claude-settings.ts";
+import { readSettingsForWrite, writeSettings } from "../lib/one-code-settings.ts";
+import { resolve } from "node:path";
+import { claudeSourcesOn } from "../lib/config-mode.ts";
+import { expandTilde } from "../lib/paths.ts";
 import type { PermissionMode } from "./matcher.ts";
 
 export { settingsPaths };
@@ -51,6 +48,12 @@ export interface PermissionSettings {
 	 * may set it — the repo included.
 	 */
 	disableBypassPermissionsMode?: boolean;
+	/**
+	 * Claude Code's `permissions.blockReadsOutsideWorkingDirectories: true` seen
+	 * in any source: the read tools refuse a path outside the working
+	 * directories, in every mode. A restriction, so every scope may set it.
+	 */
+	blockReadsOutsideWorkingDirectories?: boolean;
 }
 
 interface ClaudeSettingsFile {
@@ -58,8 +61,10 @@ interface ClaudeSettingsFile {
 		allow?: string[];
 		deny?: string[];
 		ask?: string[];
+		additionalDirectories?: string[];
 		defaultMode?: string;
 		disableBypassPermissionsMode?: string;
+		blockReadsOutsideWorkingDirectories?: boolean;
 	};
 	[key: string]: unknown;
 }
@@ -101,34 +106,28 @@ function readSettingsFile(path: string): ClaudeSettingsFile | undefined {
 }
 
 export function loadPermissionSettings(cwd: string, home: string): PermissionSettings {
-	const paths = settingsPaths(cwd, home);
 	const merged: PermissionSettings = { allow: [], projectAllow: [], deny: [], ask: [] };
-
-	// One Code writes the rules it records (via /allow, the auto-mode setup) to its
-	// own files, never into Claude Code's — so its own files are read alongside the
-	// borrowed `.claude` ladder. They contribute allow/deny/ask rules only;
-	// `defaultMode` stays sourced from the `.claude` files (nothing here writes it,
-	// and keeping the auto-mode reasoning to one place avoids a second `auto` path).
-	const oneCodeGlobal = oneCodeSettingsPath(home);
-	const oneCodeProject = oneCodeProjectSettingsPath(cwd, home);
-
-	// Managed settings last: Claude Code's organisation policy outranks every
-	// user/project file, for rules and for defaultMode alike (review P14).
-	const managed = managedSettingsPaths();
-	for (const path of [paths.user, oneCodeGlobal, paths.project, paths.local, oneCodeProject, ...managed]) {
+	// `defaultMode` comes from the user-scope file Claude Code's keys live in
+	// (`~/.claude/settings.json`, or One Code's own in independent mode,
+	// lib/config-mode.ts), project files and managed settings. One Code's other
+	// file only adds the rules it records (via /allow, the auto-mode setup),
+	// keeping the auto-mode reasoning to one place.
+	const userScope = claudeSourcesOn() ? "claude-user" : "onecode-user";
+	for (const [source, path] of settingsSources(cwd, home)) {
 		const file = readSettingsFile(path);
 		const perms = file?.permissions;
 		if (!perms) continue;
-		const allowTarget = path === paths.project || path === paths.local ? merged.projectAllow : merged.allow;
+		const fromProject = source === "project" || source === "project-local";
+		const allowTarget = fromProject ? merged.projectAllow : merged.allow;
 		if (Array.isArray(perms.allow)) allowTarget.push(...perms.allow.filter((r) => typeof r === "string"));
 		if (Array.isArray(perms.deny)) merged.deny.push(...perms.deny.filter((r) => typeof r === "string"));
 		if (Array.isArray(perms.ask)) merged.ask.push(...perms.ask.filter((r) => typeof r === "string"));
 		if (perms.disableBypassPermissionsMode === "disable") merged.disableBypassPermissionsMode = true;
-		if (path === oneCodeGlobal || path === oneCodeProject) continue;
+		if (perms.blockReadsOutsideWorkingDirectories === true) merged.blockReadsOutsideWorkingDirectories = true;
+		if (source.startsWith("onecode-") && source !== userScope) continue;
 		const defaultMode = normalizePermissionMode(perms.defaultMode);
 		// The modes a repo may not grant itself (MODES_NEVER_FROM_PROJECT) are
 		// honoured from user and managed scope only.
-		const fromProject = path === paths.project || path === paths.local;
 		if (defaultMode && !(fromProject && MODES_NEVER_FROM_PROJECT.has(defaultMode))) {
 			merged.defaultMode = defaultMode;
 		}
@@ -162,16 +161,152 @@ export function resolveStartupMode(
 	return { bypassRefused };
 }
 
+export type RuleBehavior = "allow" | "ask" | "deny";
+
+/** Where a permission rule was read from, for the `/permissions` panel. */
+export type RuleSource = SettingsSource;
+
+export interface SourcedRule {
+	behavior: RuleBehavior;
+	raw: string;
+	source: RuleSource;
+	/** The settings file the rule is in. */
+	path: string;
+}
+
+export interface SourcedDirectory {
+	/** As written in the settings file. */
+	raw: string;
+	/** Absolute: `~` expanded, a relative entry resolved against the working directory. */
+	path: string;
+	source: RuleSource;
+	/** The settings file it is in. */
+	settingsPath: string;
+}
+
+/**
+ * Claude Code's `permissions.additionalDirectories`, from every source, with
+ * the file each came from. The caller decides which sources are trusted: a
+ * repository's own files are applied only after the user trusts them.
+ */
+export function listWorkspaceDirectories(cwd: string, home: string): SourcedDirectory[] {
+	const dirs: SourcedDirectory[] = [];
+	for (const [source, settingsPath] of settingsSources(cwd, home)) {
+		const list = readSettingsFile(settingsPath)?.permissions?.additionalDirectories;
+		if (!Array.isArray(list)) continue;
+		for (const raw of list) {
+			if (typeof raw !== "string" || !raw.trim()) continue;
+			dirs.push({ raw, path: resolve(cwd, expandTilde(raw.trim(), home)), source, settingsPath });
+		}
+	}
+	return dirs;
+}
+
+/** Add a directory to a One Code settings file's `permissions.additionalDirectories`. */
+export function persistWorkspaceDirectory(dir: string, filePath: string): void {
+	addToPermissionsList("additionalDirectories", dir, filePath);
+}
+
+/** Remove a directory, as written, from a One Code settings file. False when it is not there. */
+export function removeWorkspaceDirectory(raw: string, filePath: string): boolean {
+	return removeFromPermissionsList("additionalDirectories", raw, filePath);
+}
+
+/**
+ * Every permission rule with the file it came from, in load order (the order
+ * `loadPermissionSettings` merges them). The panel lists them and can delete a
+ * rule from One Code's own files only: One Code never edits Claude Code's
+ * files, the repository's or managed policy.
+ */
+export function listPermissionRules(cwd: string, home: string): SourcedRule[] {
+	const rules: SourcedRule[] = [];
+	for (const [source, path] of settingsSources(cwd, home)) {
+		const perms = readSettingsFile(path)?.permissions;
+		if (!perms) continue;
+		for (const behavior of ["allow", "ask", "deny"] as const) {
+			const list = perms[behavior];
+			if (!Array.isArray(list)) continue;
+			for (const raw of list) if (typeof raw === "string") rules.push({ behavior, raw, source, path });
+		}
+	}
+	return rules;
+}
+
 /**
- * Append an allow rule to a One Code settings file, creating it if needed.
+ * Append a rule to a One Code settings file, creating it if needed.
  * Strict read + atomic write, like the other `~/.onecode` writers: a malformed
- * file is not silently clobbered (it may also hold classifierModel/subagentModel),
- * and a half-written file is never visible to a concurrent reader.
+ * file is not silently clobbered (it may also hold a subagent model setting),
+ * and a half-written file is never visible to a concurrent reader. Returns
+ * false, writing nothing, when the file already holds the rule.
  */
+export function persistPermissionRule(behavior: RuleBehavior, rule: string, filePath: string): boolean {
+	return addToPermissionsList(behavior, rule, filePath);
+}
+
+/** `persistPermissionRule` for an allow rule (`/allow`). */
 export function persistAllowRule(rule: string, filePath: string): void {
+	persistPermissionRule("allow", rule, filePath);
+}
+
+/**
+ * Remove every copy of a rule from a One Code settings file. Returns false,
+ * writing nothing, when the file does not hold it. An emptied list is kept as
+ * `[]`, and the file's other keys are preserved.
+ */
+export function removePermissionRule(behavior: RuleBehavior, rule: string, filePath: string): boolean {
+	return removeFromPermissionsList(behavior, rule, filePath);
+}
+
+/**
+ * The "Block" answer to the first outside-read prompt: Claude Code writes
+ * `permissions.blockReadsOutsideWorkingDirectories: true` to its user
+ * settings; One Code writes it to its own (`filePath`, the One Code global
+ * file), since it never writes `~/.claude`.
+ */
+export function persistBlockOutsideReads(filePath: string): void {
+	const file = readSettingsForWrite(filePath) as ClaudeSettingsFile;
+	(file.permissions ??= {}).blockReadsOutsideWorkingDirectories = true;
+	writeSettings(filePath, file as Record<string, unknown>);
+}
+
+/**
+ * Whether the first outside-read prompt was answered on this machine: One
+ * Code's own flag in its global settings, or Claude Code's
+ * `hasSeenAutoModeOutsideReadPrompt` in `~/.claude.json` (read only), so a
+ * user who answered it in Claude Code is not asked again.
+ */
+/** Whether the first outside-read prompt was answered; `claudeJson` is undefined in independent mode. */
+export function outsideReadPromptSeen(oneCodeSettings: string, claudeJson: string | undefined): boolean {
+	const seen = (path: string) => (readClaudeSettingsFile(path) as { hasSeenAutoModeOutsideReadPrompt?: unknown } | undefined)?.hasSeenAutoModeOutsideReadPrompt === true;
+	return seen(oneCodeSettings) || (claudeJson !== undefined && seen(claudeJson));
+}
+
+/** Record that the first outside-read prompt was answered (Claude Code's key, in One Code's file). */
+export function markOutsideReadPromptSeen(oneCodeSettings: string): void {
+	const file = readSettingsForWrite(oneCodeSettings);
+	if (file.hasSeenAutoModeOutsideReadPrompt === true) return;
+	file.hasSeenAutoModeOutsideReadPrompt = true;
+	writeSettings(oneCodeSettings, file);
+}
+
+/** A string list under `permissions` that One Code edits in its own files. */
+type PermissionsList = RuleBehavior | "additionalDirectories";
+
+/** False, writing nothing, when the list already holds `value`. */
+function addToPermissionsList(field: PermissionsList, value: string, filePath: string): boolean {
+	const file = readSettingsForWrite(filePath) as ClaudeSettingsFile;
+	const list = ((file.permissions ??= {})[field] ??= []);
+	if (list.includes(value)) return false;
+	list.push(value);
+	writeSettings(filePath, file as Record<string, unknown>);
+	return true;
+}
+
+function removeFromPermissionsList(field: PermissionsList, value: string, filePath: string): boolean {
 	const file = readSettingsForWrite(filePath) as ClaudeSettingsFile;
-	const permissions = (file.permissions ??= {});
-	const allow = (permissions.allow ??= []);
-	if (!allow.includes(rule)) allow.push(rule);
+	const list = file.permissions?.[field];
+	if (!Array.isArray(list) || !list.includes(value)) return false;
+	file.permissions![field] = list.filter((entry) => entry !== value);
 	writeSettings(filePath, file as Record<string, unknown>);
+	return true;
 }

package/extensions/permissions/subagent-gate.ts

@@ -19,6 +19,7 @@
  * same shape as `MCP_TOOLS_CHANNEL` sharing tool definitions).
  */
 
+import type { Api, Model } from "@earendil-works/pi-ai";
 import { type BridgeWatchApi, watchBridge } from "../lib/bridge-watch.ts";
 
 export const SUBAGENT_GATE_CHANNEL = "one-code:subagent-permission-gate";
@@ -37,8 +38,21 @@ export interface ChildToolCall {
 	signal?: AbortSignal;
 	/** The child session's id (what the gate can see); the runner maps it to `agent`. */
 	sessionId?: string;
+	/**
+	 * The child's own model (its session state, never the model's to write). The
+	 * gate judges a child's call by this model's tier, not the parent's.
+	 */
+	model?: Model<Api>;
 	/** The run name of the asking agent, for the prompt title — set by the runner, not the gate. */
 	agent?: string;
+	/**
+	 * The main session's tool call that started the asking child's current turn
+	 * (its Agent call, or a later SendMessage), set by the runner from its own
+	 * state, never from tool input. The classifier reads the main session as far
+	 * as that call, not the rest of a batch still in flight
+	 * (auto-mode/history.ts childHistoryCursor).
+	 */
+	parentToolCallId?: string;
 }
 
 /** A permission decision: `undefined` = allow; otherwise block with a model-facing reason. */
@@ -47,6 +61,17 @@ export type ChildGateDecision = { block: true; reason: string } | undefined;
 /** The parent's decision closure, threaded into a child's permission gate. */
 export type PermissionBridge = (call: ChildToolCall) => Promise<ChildGateDecision>;
 
+/** Bind a bridge to one parent session; neither stopped children nor stale approvals may run. */
+export function sessionPermissionBridge(evaluate: PermissionBridge, parentSignal: AbortSignal): PermissionBridge {
+	return async (call) => {
+		const signal = call.signal ? AbortSignal.any([parentSignal, call.signal]) : parentSignal;
+		const stopped: ChildGateDecision = { block: true, reason: "The agent or its parent permission session has stopped; denied to fail safe." };
+		if (signal.aborted) return stopped;
+		const result = await evaluate({ ...call, signal });
+		return signal.aborted ? stopped : result;
+	};
+}
+
 export interface SubagentGatePayload {
 	decide: PermissionBridge;
 }

package/extensions/permissions/workspace.ts

@@ -0,0 +1,78 @@
+/**
+ * Workspace directories: Claude Code's additional working directories
+ * (`permissions.additionalDirectories`, `--add-dir`, `/add-dir`, the
+ * /permissions Workspace tab). Pure apart from the filesystem check in
+ * `validateWorkspaceDirectory`.
+ *
+ * What one grants here (working-docs/decisions/modes.md, "Workspace
+ * directories"): reads inside it are working-space reads in every mode, and
+ * acceptEdits may write inside it. Auto mode's unclassified writes and
+ * deletions stay confined to the working directory, a credential path inside
+ * one is never a working-space read, and a directory from the repository's
+ * own settings applies only after the user trusts the repository.
+ */
+
+import { statSync } from "node:fs";
+import { delimiter, parse, resolve } from "node:path";
+import { expandTilde, tryRealpath } from "../lib/paths.ts";
+import { isWithin } from "../auto-mode/paths.ts";
+
+export type ValidatedDirectory = { path: string } | { error: string };
+
+/**
+ * Check a directory the user wants to add, as Claude Code's
+ * `validateDirectoryForWorkspace` does: it must exist and be a directory, and
+ * must not already be covered by the working directory or another workspace
+ * directory. One Code also refuses the filesystem root and the home directory
+ * itself, which would make almost every read on the machine a working-space
+ * read. `existing` holds the directories already in the workspace.
+ */
+export function validateWorkspaceDirectory(input: string, cwd: string, home: string, existing: readonly string[]): ValidatedDirectory {
+	const trimmed = input.trim();
+	if (!trimmed) return { error: "Enter a directory path." };
+	const spelled = resolve(cwd, expandTilde(trimmed, home));
+	// Compared where it resolves: the workspace list holds resolved paths, and on
+	// macOS /var is /private/var.
+	const path = tryRealpath(spelled) ?? spelled;
+	let isDirectory = false;
+	try {
+		isDirectory = statSync(path).isDirectory();
+	} catch {
+		return { error: `${path} does not exist.` };
+	}
+	if (!isDirectory) return { error: `${path} is not a directory.` };
+	const tooBroad = tooBroadForWorkspace(path, home);
+	if (tooBroad) return { error: tooBroad };
+	if (isWithin(tryRealpath(cwd) ?? resolve(cwd), path)) return { error: `${path} is already inside the working directory.` };
+	const covering = existing.find((dir) => isWithin(dir, path));
+	if (covering) return { error: `${path} is already in the workspace (${covering}).` };
+	return { path };
+}
+
+/**
+ * Why a directory is too broad to be a workspace directory, or undefined: the
+ * filesystem root, the home directory and any directory above it would make
+ * almost every read on the machine a working-space read. Every source is checked, settings files
+ * included. `path` is judged as given, so resolve it first.
+ */
+export function tooBroadForWorkspace(path: string, home: string): string | undefined {
+	if (parse(path).root === path) return "The filesystem root cannot be a workspace directory. Add a narrower directory.";
+	// The home directory itself, or a directory above it (`/Users`, `C:\Users`).
+	if (isWithin(path, tryRealpath(home) ?? resolve(home))) {
+		return "Your home directory, or a directory that contains it, cannot be a workspace directory. Add a narrower directory.";
+	}
+	return undefined;
+}
+
+/**
+ * `--add-dir` takes one string (pi flags are single-valued), so several
+ * directories are separated like PATH entries: `:` on macOS and Linux, `;` on
+ * Windows.
+ */
+export function parseAddDirFlag(value: string | undefined): string[] {
+	if (!value) return [];
+	return value
+		.split(delimiter)
+		.map((part) => part.trim())
+		.filter(Boolean);
+}