fix(agent): request approval for protected path access

tests/routes/chatPermissionPolicy.test.ts

@@ -124,10 +124,22 @@ describe("permission approval policy", () => {
     expect(resolvePermissionApproval("request", "show_chart").autoApprove).toBe(false);
     expect(resolvePermissionApproval("auto", "show_chart").autoApprove).toBe(true);
     expect(resolvePermissionApproval("auto", "bash").autoApprove).toBe(false);
+    expect(resolvePermissionApproval("auto", "external_directory")).toMatchObject({
+      autoApprove: false,
+      autoReject: false,
+    });
     expect(resolvePermissionApproval("always", "bash")).toMatchObject({
       autoApprove: true,
       title: "已按始终允许模式放行",
     });
+    expect(resolvePermissionApproval("always", "external_directory")).toMatchObject({
+      autoApprove: false,
+      autoReject: false,
+    });
+    expect(resolvePermissionApproval("always", "read")).toMatchObject({
+      autoApprove: false,
+      autoReject: false,
+    });
   });
 
   it("auto approves sandboxed shell and file access in a conversation workspace", async () => {
@@ -142,12 +154,40 @@ describe("permission approval policy", () => {
           metadata: { command: "python3 analysis.py" },
         }),
       ).toMatchObject({ autoApprove: true, autoReject: false });
+      for (const approvalMode of ["auto", "always"] as const) {
+        expect(
+          resolvePermissionApproval(approvalMode, "bash", {
+            workspaceRoot,
+            metadata: { command: "cat .env" },
+          }),
+        ).toMatchObject({ autoApprove: false, autoReject: false });
+      }
       expect(
         canAutoApprovePermission("edit", {
           workspaceRoot,
           metadata: { filePath: join(workspaceRoot, "result.json") },
         }),
       ).toBe(true);
+      expect(
+        resolvePermissionApproval("always", "edit", {
+          workspaceRoot,
+          metadata: { filePath: join(workspaceRoot, "result.json") },
+        }),
+      ).toMatchObject({ autoApprove: true, autoReject: false });
+      for (const filePath of [".env", "data/private.json", "logs/latest.log"]) {
+        expect(
+          resolvePermissionApproval("auto", "edit", {
+            workspaceRoot,
+            metadata: { filePath: join(workspaceRoot, filePath) },
+          }),
+        ).toMatchObject({ autoApprove: false, autoReject: false });
+        expect(
+          resolvePermissionApproval("always", "edit", {
+            workspaceRoot,
+            metadata: { filePath: join(workspaceRoot, filePath) },
+          }),
+        ).toMatchObject({ autoApprove: false, autoReject: false });
+      }
       expect(
         canAutoApprovePermission("glob", {
           workspaceRoot,
@@ -173,17 +213,19 @@ describe("permission approval policy", () => {
     "(rm -rf ./target)",
     "! rm -rf ./target",
     "npm test && rm --recursive --force ./target",
-  ])("rejects direct recursive force removal in always mode: %s", (command) => {
-    expect(
-      resolvePermissionApproval("always", "bash", {
-        metadata: { command },
-        patterns: [command],
-      }),
-    ).toMatchObject({
-      autoApprove: false,
-      autoReject: true,
-      title: "已拒绝递归强制删除",
-    });
+  ])("asks before recursive force removal in always mode: %s", (command) => {
+    for (const approvalMode of ["auto", "always"] as const) {
+      expect(
+        resolvePermissionApproval(approvalMode, "bash", {
+          metadata: { command },
+          patterns: [command],
+        }),
+      ).toMatchObject({
+        autoApprove: false,
+        autoReject: false,
+        title: "等待权限确认",
+      });
+    }
   });
 
   it.each(["rm tmp.txt", "rm -f tmp.txt", "rm -r tmp-dir", "echo 'rm -rf tmp'"])(