langchain-agentx-python 0.5.2__tar.gz → 0.5.3__tar.gz

{langchain-agentx-python-0.5.2 → langchain-agentx-python-0.5.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: langchain-agentx-python
-Version: 0.5.2
+Version: 0.5.3
 Summary: LangChain/LangGraph-based agent utilities for CodeBaseX.
 Author-email: GoodMood2008 <GoodMood2008@users.noreply.github.com>
 License:                                  Apache License

{langchain-agentx-python-0.5.2 → langchain-agentx-python-0.5.3}/langchain_agentx/__init__.py

@@ -11,7 +11,7 @@ from langchain_agentx import create_loop_agent
 ```
 """
 
-__version__ = "0.5.2"
+__version__ = "0.5.3"
 
 from .loop import (  # noqa: F401
     create_loop_agent,

{langchain-agentx-python-0.5.2 → langchain-agentx-python-0.5.3}/langchain_agentx/tool_runtime/__init__.py

@@ -28,7 +28,9 @@ from .models import (
 from .identical_call_cache import IdenticalCallMemo
 from .loader import ToolRuntimeLoader
 from .pipeline import PermissionAskInterrupt, ToolExecutorPipeline, ToolOutputManager
+from .path_safety import PathSafetyConfig, PathSafetyEvaluator
 from .policy import DefaultPolicyEngine, PolicyEngine, ToolPolicyConfig
+from .read_ignore_patterns import ReadDenyPatternCollector, normalize_read_deny_pattern
 from .policy_decorator import PolicyEngineDecorator
 from .prompt import (
     CliInteractivePolicyEngine,
@@ -52,17 +54,23 @@ from .resolvers import (
     PermissionResolver,
     WorkflowPermissionResolver,
 )
+from .auto_mode.config import AutoModeConfig
+from .auto_mode.events import AutoModeDecisionEvent
 from .override import DenyOverrideManager, DenyOverrideRecord, enrich_blocked_deny_envelope
 from .permission_decision import (
     ENVELOPE_META_KEY_CAN_OVERRIDE,
     ENVELOPE_META_KEY_DENY_OVERRIDE,
     ENVELOPE_META_KEY_POLICY_ID,
     ENVELOPE_META_KEY_TOOL_CALL_ID,
+    POLICY_ID_DENY_OVERRIDE_CONSUMED,
 )
 from .session_store import AgentSessionStore, FileReadRecord, FileWriteRecord
 from .state_bridge import ToolStateBridge
 
 __all__ = [
+    # auto mode
+    "AutoModeConfig",
+    "AutoModeDecisionEvent",
     # models
     "ToolExecutionContext",
     "ToolResultEnvelope",
@@ -86,6 +94,10 @@ __all__ = [
     "PolicyEngine",
     "DefaultPolicyEngine",
     "PolicyEngineDecorator",
+    "PathSafetyConfig",
+    "PathSafetyEvaluator",
+    "ReadDenyPatternCollector",
+    "normalize_read_deny_pattern",
     # prompt (L3)
     "PermissionPromptHandler",
     "PermissionUpdate",
@@ -112,6 +124,7 @@ __all__ = [
     "ENVELOPE_META_KEY_TOOL_CALL_ID",
     "ENVELOPE_META_KEY_POLICY_ID",
     "ENVELOPE_META_KEY_DENY_OVERRIDE",
+    "POLICY_ID_DENY_OVERRIDE_CONSUMED",
     # pipeline
     "ToolOutputManager",
     "ToolExecutorPipeline",

{langchain-agentx-python-0.5.2 → langchain-agentx-python-0.5.3}/langchain_agentx/tool_runtime/loader.py

@@ -34,7 +34,9 @@ from .auto_mode.config_update import (
     merge_auto_mode_config,
 )
 from .auto_mode.state import get_auto_mode_state
+from .path_safety import PathSafetyConfig
 from .policy import DefaultPolicyEngine, PolicyEngine, ToolPolicyConfig
+from .read_ignore_patterns import ReadDenyPatternCollector
 from .registry import RuntimeToolRegistry
 from .prompt.handler import PermissionPromptHandler
 from .resolvers import PermissionResolver
@@ -126,6 +128,9 @@ class ToolRuntimeLoader:
         from langchain_agentx.tools.glob import GlobRuntimeTool
         from langchain_agentx.tools.grep import GrepRuntimeTool
         from langchain_agentx.tools.edit import EditRuntimeTool
+        from langchain_agentx.tools.edit.settings_validator import SettingsValidator
+        from langchain_agentx.tools.edit.staleness import StalenessChecker
+        from langchain_agentx.tools.edit.validator import EditStringValidator
         from langchain_agentx.tools.read import ReadRuntimeTool
         from langchain_agentx.tools.ripgrep_plugin_exclusions import PluginCacheGlobExclusions
         from langchain_agentx.tools.task_list.tool import TaskListRuntimeTool
@@ -138,6 +143,10 @@ class ToolRuntimeLoader:
 
         wr = Path(workspace_root).resolve()
         cfg = AgentWorkspaceConfig(workspace_root=wr, agent_home=agent_home)
+        self._inject_path_safety_policy(
+            workspace_root=str(wr),
+            agent_home_segment=cfg.agent_home_dir.name,
+        )
         plugin_ex = PluginCacheGlobExclusions(
             cache_root=str(cfg.plugin_cache_dir.resolve()),
         )
@@ -145,14 +154,30 @@ class ToolRuntimeLoader:
         # v0.2.0：创建共享 bridge，初始 cwd 为 workspace_root
         # Bash cd 后，Read/Write/Edit 自动感知新路径；Glob 存储摘要到同一 state
         shared_bridge = ToolStateBridge(initial_cwd=str(wr))
+        search_ignore_patterns = self._collect_search_ignore_patterns()
+
+        settings_validator = SettingsValidator(agent_home_segment=cfg.agent_home_dir.name)
+        edit_staleness = StalenessChecker(shared_bridge)
+        edit_string_validator = EditStringValidator(
+            state_bridge=shared_bridge,
+            staleness_checker=edit_staleness,
+            settings_validator=settings_validator,
+        )
 
         self.register(ReadRuntimeTool(state_bridge=shared_bridge))
         self.register(WriteRuntimeTool(state_bridge=shared_bridge))
-        self.register(EditRuntimeTool(state_bridge=shared_bridge))
+        self.register(
+            EditRuntimeTool(
+                state_bridge=shared_bridge,
+                string_validator=edit_string_validator,
+                staleness_checker=edit_staleness,
+            )
+        )
         self.register(
             GrepRuntimeTool(
                 workspace_root=str(wr),
                 plugin_cache_glob_exclusions=plugin_ex,
+                ignore_patterns=search_ignore_patterns or None,
             )
         )
         self.register(
@@ -160,6 +185,7 @@ class ToolRuntimeLoader:
                 workspace_root=str(wr),
                 plugin_cache_glob_exclusions=plugin_ex,
                 state_bridge=shared_bridge,
+                ignore_patterns=search_ignore_patterns or None,
             )
         )
         self.register(BashRuntimeTool(state_bridge=shared_bridge))
@@ -187,6 +213,32 @@ class ToolRuntimeLoader:
 
         return self
 
+    def _collect_search_ignore_patterns(self) -> list[str]:
+        """Read deny → Glob/Grep ``ignore_patterns``（CC getFileReadIgnorePatterns）。"""
+        cfg = self._policy_config
+        if cfg is None and isinstance(self._policy, DefaultPolicyEngine):
+            cfg = self._policy._config
+        return ReadDenyPatternCollector().collect(cfg)
+
+    def _inject_path_safety_policy(
+        self,
+        *,
+        workspace_root: str,
+        agent_home_segment: str,
+    ) -> None:
+        """为已装配的 DefaultPolicyEngine 注入 PathSafetyConfig（来自 workspace）。"""
+        path_cfg = PathSafetyConfig.from_workspace(
+            workspace_root=workspace_root,
+            agent_home_segment=agent_home_segment,
+        )
+        if self._policy_config is not None and self._policy_config.path_safety is None:
+            self._policy_config.path_safety = path_cfg
+        if isinstance(self._policy, DefaultPolicyEngine):
+            pc = self._policy._config
+            if pc.path_safety is None:
+                pc.path_safety = path_cfg
+                self._policy = DefaultPolicyEngine(pc)
+
     def create_session(self, session_id: str | None = None) -> AgentSessionStore:
         return AgentSessionStore(session_id=session_id)
 

langchain-agentx-python-0.5.3/langchain_agentx/tool_runtime/path_safety.py

@@ -0,0 +1,193 @@
+"""
+path_safety.py — 写路径安全评估（对齐 CC filesystem.ts）
+
+职责：
+    将 CC ``DANGEROUS_DIRECTORIES`` / ``DANGEROUS_FILES`` / ``isClaudeConfigFilePath``
+    映射为 SDK 的 ``AuthorizationDecision(behavior=ask)``；``agent_home`` 段名可配置。
+
+链路位置：
+    ``DefaultPolicyEngine.authorize`` / ``authorize_path`` 在 ask_globs 之后、roots 之前调用。
+
+当前裁剪范围：
+    不实现 session 级 ``/.claude/**`` allow 绕过、Windows 可疑路径全套、内部 plan/scratchpad 白名单。
+"""
+
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import TYPE_CHECKING
+
+from .models import AuthorizationDecision
+
+if TYPE_CHECKING:
+    pass
+
+# 与 CC DANGEROUS_DIRECTORIES 对齐（不含 agent_home，运行时注入）
+_DEFAULT_DANGEROUS_DIRECTORY_SEGMENTS: tuple[str, ...] = (
+    ".git",
+    ".vscode",
+    ".idea",
+)
+
+# 与 CC DANGEROUS_FILES 对齐（按文件名，大小写不敏感）
+_DANGEROUS_FILE_NAMES: frozenset[str] = frozenset(
+    {
+        ".gitconfig",
+        ".gitmodules",
+        ".bashrc",
+        ".bash_profile",
+        ".zshrc",
+        ".zprofile",
+        ".profile",
+        ".ripgreprc",
+        ".mcp.json",
+        ".claude.json",
+    }
+)
+
+_WORKTREES_SEGMENT = "worktrees"
+
+# agent_home 下需 ask 的子目录（对齐 isClaudeConfigFilePath 的 commands/agents/skills）
+_AGENT_CONFIG_SUBDIRS: tuple[str, ...] = ("commands", "agents", "skills")
+
+_IDE_SETTINGS_PARENTS: tuple[str, ...] = (".vscode", ".cursor")
+
+
+def _normalize_case(path: str) -> str:
+    return path.replace("\\", "/").lower()
+
+
+@dataclass
+class PathSafetyConfig:
+    """写路径安全配置。"""
+
+    agent_home_segment: str
+    workspace_root: str | None = None
+    enabled: bool = True
+    dangerous_directory_segments: tuple[str, ...] = field(
+        default_factory=lambda: _DEFAULT_DANGEROUS_DIRECTORY_SEGMENTS
+    )
+    worktrees_segment: str = _WORKTREES_SEGMENT
+
+    def __post_init__(self) -> None:
+        seg = (self.agent_home_segment or "").strip()
+        if not seg:
+            raise ValueError("agent_home_segment must be non-empty")
+        if not seg.startswith("."):
+            seg = f".{seg}"
+        object.__setattr__(self, "agent_home_segment", seg)
+
+    @classmethod
+    def from_workspace(
+        cls,
+        *,
+        workspace_root: str,
+        agent_home_segment: str,
+        enabled: bool = True,
+    ) -> PathSafetyConfig:
+        return cls(
+            agent_home_segment=agent_home_segment,
+            workspace_root=str(Path(workspace_root).resolve()),
+            enabled=enabled,
+        )
+
+
+class PathSafetyEvaluator:
+    """评估写操作目标路径是否需人工确认（CC checkPathSafetyForAutoEdit 子集）。"""
+
+    def __init__(self, config: PathSafetyConfig) -> None:
+        self._config = config
+        home = config.agent_home_segment.lower()
+        self._dangerous_segments = frozenset(
+            s.lower() for s in (*config.dangerous_directory_segments, config.agent_home_segment)
+        )
+        self._agent_home_lower = home
+        self._worktrees_lower = config.worktrees_segment.lower()
+
+    def evaluate_unc_path(self, path: str) -> AuthorizationDecision | None:
+        """UNC / extended-length 前缀：Read 与 Write 均先拦截（CC 对齐）。"""
+        if not self._config.enabled:
+            return None
+        raw = path.strip()
+        if raw.startswith("\\\\") or raw.startswith("//"):
+            return AuthorizationDecision(
+                behavior="ask",
+                message=(
+                    f"Permission required: path uses a UNC or extended-length prefix: {path}"
+                ),
+                policy_id="dangerous_unc_path",
+                metadata={"classifier_approvable": False},
+            )
+        return None
+
+    def evaluate_write_path(self, path: str) -> AuthorizationDecision | None:
+        """
+        若路径需保护则返回 ``ask`` 决策；否则返回 ``None``（继续后续 roots 检查）。
+        """
+        if not self._config.enabled:
+            return None
+
+        unc = self.evaluate_unc_path(path)
+        if unc is not None:
+            return unc
+
+        real = os.path.realpath(os.path.expanduser(path.strip()))
+        if self._is_agent_config_file_path(real):
+            return AuthorizationDecision(
+                behavior="ask",
+                message=(
+                    f"Permission required: editing agent configuration file: {real}"
+                ),
+                policy_id="agent_config_file",
+                metadata={"classifier_approvable": True},
+            )
+
+        if self._is_dangerous_path(real):
+            return AuthorizationDecision(
+                behavior="ask",
+                message=f"Permission required: sensitive path: {real}",
+                policy_id="dangerous_directory",
+                metadata={"classifier_approvable": True},
+            )
+
+        return None
+
+    def _is_dangerous_path(self, real_path: str) -> bool:
+        parts = Path(real_path).parts
+        for i, segment in enumerate(parts):
+            seg_lower = segment.lower()
+            if seg_lower not in self._dangerous_segments:
+                continue
+            if seg_lower == self._agent_home_lower:
+                next_part = parts[i + 1] if i + 1 < len(parts) else None
+                if next_part and next_part.lower() == self._worktrees_lower:
+                    continue
+            return True
+
+        file_name = parts[-1].lower() if parts else ""
+        if file_name in _DANGEROUS_FILE_NAMES:
+            return True
+        return False
+
+    def _is_agent_config_file_path(self, real_path: str) -> bool:
+        p = Path(real_path)
+        posix = _normalize_case(p.as_posix())
+        home = self._agent_home_lower
+
+        for sub in _AGENT_CONFIG_SUBDIRS:
+            marker = f"/{home}/{sub}/"
+            if marker in posix:
+                return True
+
+        if p.name.lower() != "settings.json":
+            return False
+
+        for parent in (*_IDE_SETTINGS_PARENTS, self._config.agent_home_segment):
+            pl = parent.lower()
+            if f"/{pl}/" in posix:
+                return True
+            if p.parent.name.lower() == pl.lstrip("."):
+                return True
+        return False

{langchain-agentx-python-0.5.2 → langchain-agentx-python-0.5.3}/langchain_agentx/tool_runtime/policy.py

@@ -50,7 +50,9 @@ from dataclasses import dataclass, field
 from typing import TYPE_CHECKING, Any
 
 from .models import AuthorizationDecision, ToolExecutionContext
+from .path_safety import PathSafetyConfig, PathSafetyEvaluator
 from .permission_context import get_active_auto_approved_tools
+from .read_permission import ReadPathAuthorizer
 from .permission_decision import (
     POLICY_ID_PREFIX_ALWAYS_ASK_TOOL,
     PermissionDecisionType,
@@ -81,6 +83,8 @@ class ToolPolicyConfig:
     deny_globs:         硬拒绝的 glob 模式列表，优先级高于 roots 检查。
                         对应 CC alwaysDenyRules。
                         示例：["**/secrets/**", "**/*.prod.env"]
+    read_deny_globs:    仅用于 Read 的 deny glob；同步隐藏于 Glob/Grep（CC getFileReadIgnorePatterns）。
+                        不参与 ``DefaultPolicyEngine`` 路径 fnmatch，除非重复写入 deny_globs。
     ask_globs:          需要人工确认的敏感路径 glob 模式列表。
                         对应 CC alwaysAskRules（路径规则）。
                         headless 模式下自动降级为 deny；交互模式下触发 HITL。
@@ -91,16 +95,21 @@ class ToolPolicyConfig:
     read_only_mode:     全局只读模式，is_destructive=True 的工具直接拒绝。
     enable_builtin_deny: 启用内置危险路径保护（.env/.ssh/*.key/credentials 等）。
                         生产环境建议保持 True。
+    enable_path_safety: 启用写路径 CC 对齐安全（危险目录 / agent 配置 / worktrees 例外）。
+    path_safety:        ``PathSafetyConfig``（含 ``agent_home_segment``）；为 None 时不评估。
     auto_mode:          Auto Mode 配置（可选，Phase 1）。
     """
 
     read_roots: list[str] = field(default_factory=list)
     write_roots: list[str] = field(default_factory=list)
     deny_globs: list[str] = field(default_factory=list)
+    read_deny_globs: list[str] = field(default_factory=list)
     ask_globs: list[str] = field(default_factory=list)
     always_ask_tools: frozenset[str] = field(default_factory=frozenset)
     read_only_mode: bool = False
     enable_builtin_deny: bool = True
+    enable_path_safety: bool = True
+    path_safety: PathSafetyConfig | None = None
     auto_mode: "AutoModeConfig | None" = None
 
     def __post_init__(self) -> None:
@@ -138,10 +147,13 @@ class ToolPolicyConfig:
             read_roots=new_read,
             write_roots=new_write,
             deny_globs=self.deny_globs,
+            read_deny_globs=self.read_deny_globs,
             ask_globs=self.ask_globs,
             always_ask_tools=self.always_ask_tools,
             read_only_mode=self.read_only_mode,
             enable_builtin_deny=self.enable_builtin_deny,
+            enable_path_safety=self.enable_path_safety,
+            path_safety=self.path_safety,
             auto_mode=self.auto_mode,
         )
 
@@ -228,9 +240,11 @@ class DefaultPolicyEngine(PolicyEngine):
         [4] enable_builtin_deny → BUILTIN_DENY_GLOBS → deny
         [5] deny_globs 命中 → deny
         [6] ask_globs 命中 → ask（headless 时 pipeline 降级为 deny）
+        [6.5] enable_path_safety + 写工具 → PathSafetyEvaluator → ask（CC checkPathSafetyForAutoEdit）
         [7] 读写分权：
-              is_read_only=True  → 检查 read_roots
-              is_read_only=False → 检查 write_roots
+              is_read_only=True  → ReadPathAuthorizer（read_deny → deny → builtin → ask
+                    → write_implies_read → read_roots；见 read_permission.py）
+              is_read_only=False → path_safety + write_roots
               roots 为空列表 → 跳过，视为不限制
         [8] 通过 → allow
 
@@ -238,6 +252,7 @@ class DefaultPolicyEngine(PolicyEngine):
         [1] ~ read_only_mode（全局禁止写操作）
         [2][3] ~ alwaysDenyRules（固定拒绝）
         [4] ~ alwaysAskRules（需确认）
+        [6.5] ~ DANGEROUS_DIRECTORIES / isClaudeConfigFilePath（写 ask）
         [5] ~ allWorkingDirectories（访问空间限制）
 
     工具读写标志来源：
@@ -289,6 +304,22 @@ class DefaultPolicyEngine(PolicyEngine):
         self._write_roots = [os.path.realpath(r) for r in config.write_roots]
         self._always_ask_tools = config.always_ask_tools
         self._auto_mode_hook = auto_mode_hook
+        self._path_safety: PathSafetyEvaluator | None = None
+        if config.enable_path_safety and config.path_safety is not None:
+            self._path_safety = PathSafetyEvaluator(config.path_safety)
+        self._read_authorizer = ReadPathAuthorizer(
+            config,
+            path_safety=self._path_safety,
+            check_deny_globs=self._check_deny_globs,
+            check_ask_globs=self._check_ask_globs,
+            check_builtin_deny=self._check_builtin_deny,
+            authorize_destructive_path=self._evaluate_write_allowance_for_implied_read,
+            authorize_read_roots=lambda real_path: self._authorize_path_roots(
+                real_path,
+                is_read_only_tool=True,
+            ),
+            with_decision_source=self._with_decision_source,
+        )
 
     def authorize(
         self,
@@ -368,7 +399,14 @@ class DefaultPolicyEngine(PolicyEngine):
 
         real_path = os.path.realpath(os.path.expanduser(path))
 
-        # [2] 用户自定义 deny_globs
+        if is_read_only_tool:
+            return self._read_authorizer.authorize(
+                real_path,
+                tool_name=tool_name,
+                active_auto_approved_tools_lower=active_auto_approved_tools_lower,
+            )
+
+        # [2] 用户自定义 deny_globs（写工具）
         deny_result = self._check_deny_globs(real_path)
         if deny_result is not None:
             return self._with_decision_source(
@@ -376,18 +414,9 @@ class DefaultPolicyEngine(PolicyEngine):
                 matched_rule=deny_result.policy_id,
             )
 
-        # [3] 内置危险路径黑名单
-        if self._config.enable_builtin_deny:
-            for pattern in self.BUILTIN_DENY_GLOBS:
-                if fnmatch.fnmatch(real_path, pattern):
-                    return self._with_decision_source(
-                        AuthorizationDecision(
-                            behavior="deny",
-                            message="Permission denied: access to this path is not allowed.",
-                            policy_id="builtin_deny",
-                        ),
-                        matched_rule="builtin_deny",
-                    )
+        builtin = self._check_builtin_deny(real_path)
+        if builtin is not None:
+            return self._with_decision_source(builtin, matched_rule="builtin_deny")
 
         # [4] ask_globs：敏感路径需要人工确认
         # headless 模式下 pipeline 会将 ask 自动降级为 deny；交互模式触发 HITL
@@ -421,23 +450,7 @@ class DefaultPolicyEngine(PolicyEngine):
                 matched_rule=ask_result.policy_id,
             )
 
-        # [5] 读写分权根目录检查
-        roots = self._read_roots if is_read_only_tool else self._write_roots
-        if roots:
-            if not any(self._within_root(real_path, r) for r in roots):
-                return self._with_decision_source(
-                    AuthorizationDecision(
-                        behavior="deny",
-                        message="Permission denied: path is outside the allowed workspace.",
-                        policy_id="read_roots" if is_read_only_tool else "write_roots",
-                    ),
-                    matched_rule="read_roots" if is_read_only_tool else "write_roots",
-                )
-
-        return self._with_decision_source(
-            AuthorizationDecision(behavior="allow"),
-            matched_rule="default_allow",
-        )
+        return self._authorize_destructive_path(real_path)
 
     async def aauthorize(
         self,
@@ -497,6 +510,13 @@ class DefaultPolicyEngine(PolicyEngine):
         """
         real_path = os.path.realpath(os.path.expanduser(path))
 
+        if not is_write:
+            return self._read_authorizer.authorize(
+                real_path,
+                tool_name="read",
+                active_auto_approved_tools_lower=set(),
+            )
+
         if self._config.read_only_mode and is_write:
             return self._with_decision_source(
                 AuthorizationDecision(
@@ -514,17 +534,9 @@ class DefaultPolicyEngine(PolicyEngine):
                 matched_rule=deny_result.policy_id,
             )
 
-        if self._config.enable_builtin_deny:
-            for pattern in self.BUILTIN_DENY_GLOBS:
-                if fnmatch.fnmatch(real_path, pattern):
-                    return self._with_decision_source(
-                        AuthorizationDecision(
-                        behavior="deny",
-                        message="Permission denied: access to this path is not allowed.",
-                        policy_id="builtin_deny",
-                        ),
-                        matched_rule="builtin_deny",
-                    )
+        builtin = self._check_builtin_deny(real_path)
+        if builtin is not None:
+            return self._with_decision_source(builtin, matched_rule="builtin_deny")
 
         ask_result = self._check_ask_globs(real_path)
         if ask_result is not None:
@@ -533,16 +545,73 @@ class DefaultPolicyEngine(PolicyEngine):
                 matched_rule=ask_result.policy_id,
             )
 
-        roots = self._write_roots if is_write else self._read_roots
+        return self._authorize_destructive_path(real_path)
+
+    # ---- 内部辅助 ----
+
+    def _authorize_destructive_path(self, real_path: str) -> AuthorizationDecision:
+        """写工具路径尾部：path_safety + write_roots（deny/builtin/ask 已由 authorize 处理）。"""
+        return self._authorize_path_roots(
+            real_path,
+            is_read_only_tool=False,
+        )
+
+    def _evaluate_write_allowance_for_implied_read(
+        self,
+        real_path: str,
+    ) -> AuthorizationDecision:
+        """CC Write allow ⇒ Read allow：复用写链（无 skill ask 绕过）。"""
+        deny_result = self._check_deny_globs(real_path)
+        if deny_result is not None:
+            return deny_result
+        builtin = self._check_builtin_deny(real_path)
+        if builtin is not None:
+            return builtin
+        ask_result = self._check_ask_globs(real_path)
+        if ask_result is not None:
+            return ask_result
+        return self._authorize_path_roots(
+            real_path,
+            is_read_only_tool=False,
+        )
+
+    def _check_builtin_deny(self, real_path: str) -> AuthorizationDecision | None:
+        if not self._config.enable_builtin_deny:
+            return None
+        for pattern in self.BUILTIN_DENY_GLOBS:
+            if fnmatch.fnmatch(real_path, pattern):
+                return AuthorizationDecision(
+                    behavior="deny",
+                    message="Permission denied: access to this path is not allowed.",
+                    policy_id="builtin_deny",
+                )
+        return None
+
+    def _authorize_path_roots(
+        self,
+        real_path: str,
+        *,
+        is_read_only_tool: bool,
+    ) -> AuthorizationDecision:
+        """ask_globs 之后：写路径安全 + read/write_roots。"""
+        if not is_read_only_tool and self._path_safety is not None:
+            safety = self._path_safety.evaluate_write_path(real_path)
+            if safety is not None:
+                return self._with_decision_source(
+                    safety,
+                    matched_rule=safety.policy_id or "path_safety",
+                )
+
+        roots = self._read_roots if is_read_only_tool else self._write_roots
         if roots:
-            if not any(self._within_root(real_path, root) for root in roots):
+            if not any(self._within_root(real_path, r) for r in roots):
                 return self._with_decision_source(
                     AuthorizationDecision(
                         behavior="deny",
                         message="Permission denied: path is outside the allowed workspace.",
-                        policy_id="write_roots" if is_write else "read_roots",
+                        policy_id="read_roots" if is_read_only_tool else "write_roots",
                     ),
-                    matched_rule="write_roots" if is_write else "read_roots",
+                    matched_rule="read_roots" if is_read_only_tool else "write_roots",
                 )
 
         return self._with_decision_source(
@@ -550,8 +619,6 @@ class DefaultPolicyEngine(PolicyEngine):
             matched_rule="default_allow",
         )
 
-    # ---- 内部辅助 ----
-
     def _check_always_ask_tool(self, tool_name: str) -> AuthorizationDecision | None:
         """工具级 always ask（CC getAskRuleForTool 工具名维度）。"""
         if tool_name.lower() not in self._always_ask_tools: