feat(agent): sandbox conversation analysis

src/routes/chatPermissionPolicy.ts

@@ -1,5 +1,5 @@
-import { lstatSync, readdirSync, realpathSync } from "node:fs";
-import { isAbsolute, relative, resolve, sep } from "node:path";
+import { existsSync, lstatSync, readdirSync, realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, relative, resolve, sep } from "node:path";
 
 export type ApprovalMode = "request" | "auto" | "always";
 
@@ -46,6 +46,14 @@ export const canAutoApprovePermission = (
     return isSafeWorkspaceSearch(normalized, context);
   }
 
+  if (normalized === "bash") {
+    return isConversationWorkspace(context.workspaceRoot);
+  }
+
+  if (normalized === "read" || normalized === "edit" || normalized === "write") {
+    return isSafeConversationFileAccess(context);
+  }
+
   if (lowRiskToolPermissions.has(normalized)) {
     return true;
   }
@@ -71,19 +79,6 @@ export const resolvePermissionApproval = (
     } as const;
   }
 
-  if (
-    approvalMode === "always" &&
-    normalizePermission(permission) === "bash" &&
-    containsPotentialRemoveCommand(context)
-  ) {
-    return {
-      autoApprove: false,
-      autoReject: false,
-      title: "等待删除命令确认",
-      detail: "删除命令不会由始终允许模式代为批准，请确认本次具体操作。",
-    } as const;
-  }
-
   if (approvalMode === "always") {
     return {
       autoApprove: true,
@@ -204,22 +199,6 @@ const isDirectRecursiveForceRemove = (
   });
 };
 
-const containsPotentialRemoveCommand = (
-  context: PermissionApprovalContext,
-): boolean => {
-  const command =
-    typeof context.metadata?.command === "string"
-      ? context.metadata.command
-      : context.patterns?.join("\n");
-  if (!command) {
-    return false;
-  }
-  const normalized = command
-    .replace(/\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*/gu, "")
-    .replace(/["'\\]/gu, "");
-  return /(^|[^A-Za-z0-9_])(?:[^\s/]+\/)*rm(?=$|[^A-Za-z0-9_])/iu.test(normalized);
-};
-
 const splitShellCommandSegments = (command: string): string[] =>
   command.split(/&&|\|\||[;|()\n]/u);
 
@@ -281,13 +260,14 @@ const isSafeWorkspaceSearch = (
         isAbsolute(expression) ||
         containsParentTraversal(expression) ||
         containsAmbiguousGlobSyntax(expression) ||
-        containsProtectedPath(expression),
+        containsProtectedPath(expression, isConversationWorkspace(root)),
     )
   ) {
     return false;
   }
 
-  if (!relativePath) {
+  const conversationWorkspace = isConversationWorkspace(root);
+  if (!relativePath && !conversationWorkspace) {
     if (permission !== "glob") {
       return false;
     }
@@ -304,16 +284,19 @@ const isSafeWorkspaceSearch = (
   }
 
   return (
-    relativePath !== "" &&
     relativePath !== ".." &&
     !relativePath.startsWith(`..${sep}`) &&
     !isAbsolute(relativePath) &&
-    !containsProtectedPath(relativePath) &&
-    isSafeSearchTarget(searchRoot, relativePath)
+    !containsProtectedPath(relativePath, conversationWorkspace) &&
+    isSafeSearchTarget(searchRoot, relativePath, conversationWorkspace)
   );
 };
 
-const isSafeSearchTarget = (searchRoot: string, relativePath: string): boolean => {
+const isSafeSearchTarget = (
+  searchRoot: string,
+  relativePath: string,
+  conversationWorkspace: boolean,
+): boolean => {
   try {
     const target = lstatSync(searchRoot);
     if (target.isFile()) {
@@ -323,7 +306,10 @@ const isSafeSearchTarget = (searchRoot: string, relativePath: string): boolean =
       return false;
     }
     const topLevelName = relativePath.split(sep)[0];
-    if (!topLevelName || !lowRiskSearchRootNames.has(topLevelName)) {
+    if (
+      !conversationWorkspace &&
+      (!topLevelName || !lowRiskSearchRootNames.has(topLevelName))
+    ) {
       return false;
     }
 
@@ -331,7 +317,10 @@ const isSafeSearchTarget = (searchRoot: string, relativePath: string): boolean =
     while (pending.length > 0) {
       const directory = pending.pop()!;
       for (const entry of readdirSync(directory, { withFileTypes: true })) {
-        if (entry.isSymbolicLink() || containsProtectedPath(entry.name)) {
+        if (
+          entry.isSymbolicLink() ||
+          containsProtectedPath(entry.name, conversationWorkspace)
+        ) {
           return false;
         }
         if (entry.isDirectory()) {
@@ -361,10 +350,71 @@ const containsParentTraversal = (value: string): boolean =>
 const containsAmbiguousGlobSyntax = (value: string): boolean =>
   /[?[\]{}()!+@\\]/.test(value);
 
-const containsProtectedPath = (value: string): boolean => {
+const containsProtectedPath = (
+  value: string,
+  conversationWorkspace = false,
+): boolean => {
   const normalized = value.replaceAll("\\", "/").toLowerCase();
   return (
     normalized.includes(".env") ||
-    /(?:^|[^a-z0-9_-])(?:data|logs)(?:$|[^a-z0-9_-])/.test(normalized)
+    (!conversationWorkspace &&
+      /(?:^|[^a-z0-9_-])(?:data|logs)(?:$|[^a-z0-9_-])/.test(normalized))
   );
 };
+
+const isConversationWorkspace = (workspaceRoot: string | undefined): boolean => {
+  if (!workspaceRoot?.trim()) return false;
+  try {
+    const root = realpathSync.native(resolve(workspaceRoot));
+    return (
+      basename(dirname(root)) === "conversation-workspaces" &&
+      basename(root).startsWith("conversation-") &&
+      lstatSync(root).isDirectory()
+    );
+  } catch {
+    return false;
+  }
+};
+
+const isSafeConversationFileAccess = (
+  context: PermissionApprovalContext,
+): boolean => {
+  if (!isConversationWorkspace(context.workspaceRoot)) return false;
+  const requestedPath = [
+    context.metadata?.path,
+    context.metadata?.file_path,
+    context.metadata?.filePath,
+    context.metadata?.filepath,
+    context.metadata?.file,
+    context.patterns?.[0],
+  ].find((value): value is string => typeof value === "string" && value.trim().length > 0);
+  if (!requestedPath || /[*?[\]{}]/.test(requestedPath)) return false;
+  try {
+    const root = realpathSync.native(resolve(context.workspaceRoot!));
+    const target = resolve(root, requestedPath);
+    let existingPath = target;
+    while (!existsSync(existingPath)) {
+      const parent = dirname(existingPath);
+      if (parent === existingPath) return false;
+      existingPath = parent;
+    }
+    const resolvedExistingPath = realpathSync.native(existingPath);
+    const relativeExisting = relative(root, resolvedExistingPath);
+    if (
+      relativeExisting === ".." ||
+      relativeExisting.startsWith(`..${sep}`) ||
+      isAbsolute(relativeExisting)
+    ) {
+      return false;
+    }
+    const relativeTarget = relative(root, target);
+    return (
+      relativeTarget !== ".." &&
+      !relativeTarget.startsWith(`..${sep}`) &&
+      !isAbsolute(relativeTarget) &&
+      !containsProtectedPath(relativeTarget, true)
+    );
+  } catch {
+    return false;
+  }
+};