fix(agent): isolate conversation workspaces

src/routes/chatPermissionPolicy.ts

@@ -62,9 +62,32 @@ export const resolvePermissionApproval = (
   permission: string,
   context: PermissionApprovalContext = {},
 ) => {
+  if (isDirectRecursiveForceRemove(permission, context)) {
+    return {
+      autoApprove: false,
+      autoReject: true,
+      title: "已拒绝递归强制删除",
+      detail: "当前安全策略禁止直接执行带 recursive 和 force 参数的 rm 命令。",
+    } as const;
+  }
+
+  if (
+    approvalMode === "always" &&
+    normalizePermission(permission) === "bash" &&
+    containsPotentialRemoveCommand(context)
+  ) {
+    return {
+      autoApprove: false,
+      autoReject: false,
+      title: "等待删除命令确认",
+      detail: "删除命令不会由始终允许模式代为批准，请确认本次具体操作。",
+    } as const;
+  }
+
   if (approvalMode === "always") {
     return {
       autoApprove: true,
+      autoReject: false,
       title: "已按始终允许模式放行",
       detail:
         "当前会话处于始终允许模式，已放行本次权限请求；明确禁止的权限仍由 OpenCode 拒绝。",
@@ -74,6 +97,7 @@ export const resolvePermissionApproval = (
   if (approvalMode === "auto" && canAutoApprovePermission(permission, context)) {
     return {
       autoApprove: true,
+      autoReject: false,
       title: "已自动批准低风险权限",
       detail: "当前批准模式允许自动执行低风险工具，已放行本次请求。",
     } as const;
@@ -81,11 +105,135 @@ export const resolvePermissionApproval = (
 
   return {
     autoApprove: false,
+    autoReject: false,
     title: "等待权限确认",
     detail: undefined,
   } as const;
 };
 
+const isDirectRecursiveForceRemove = (
+  permission: string,
+  context: PermissionApprovalContext,
+): boolean => {
+  if (normalizePermission(permission) !== "bash") {
+    return false;
+  }
+  const command =
+    typeof context.metadata?.command === "string"
+      ? context.metadata.command
+      : context.patterns?.join("\n");
+  if (!command) {
+    return false;
+  }
+
+  return splitShellCommandSegments(command).some((segment) => {
+    const words = tokenizeShellSegment(segment);
+    let commandIndex = 0;
+    while (commandIndex < words.length) {
+      const word = words[commandIndex]!;
+      const executable = word.split("/").at(-1)?.toLowerCase();
+      if (word === "!" || /^[A-Za-z_][A-Za-z0-9_]*=/.test(word)) {
+        commandIndex += 1;
+        continue;
+      }
+      if (executable === "command") {
+        commandIndex += 1;
+        while (words[commandIndex]?.startsWith("-") && words[commandIndex] !== "--") {
+          commandIndex += 1;
+        }
+        if (words[commandIndex] === "--") commandIndex += 1;
+        continue;
+      }
+      if (executable === "env") {
+        commandIndex += 1;
+        while (commandIndex < words.length) {
+          const envWord = words[commandIndex]!;
+          if (envWord === "--") {
+            commandIndex += 1;
+            break;
+          }
+          if (envWord === "-u" || envWord === "--unset") {
+            commandIndex += 2;
+            continue;
+          }
+          if (
+            envWord.startsWith("-") ||
+            /^[A-Za-z_][A-Za-z0-9_]*=/.test(envWord)
+          ) {
+            commandIndex += 1;
+            continue;
+          }
+          break;
+        }
+        continue;
+      }
+      if (executable === "sudo" || executable === "doas") {
+        commandIndex += 1;
+        while (words[commandIndex]?.startsWith("-")) {
+          commandIndex += 1;
+        }
+        continue;
+      }
+      if (executable === "busybox" && words[commandIndex + 1] === "rm") {
+        commandIndex += 1;
+      }
+      break;
+    }
+
+    const executable = words[commandIndex]?.split("/").at(-1)?.toLowerCase();
+    if (executable !== "rm") {
+      return false;
+    }
+
+    let recursive = false;
+    let force = false;
+    for (const word of words.slice(commandIndex + 1)) {
+      if (word === "--") {
+        break;
+      }
+      if (word === "--recursive") {
+        recursive = true;
+      } else if (word === "--force") {
+        force = true;
+      } else if (/^-[^-]/.test(word)) {
+        recursive ||= /[rR]/.test(word.slice(1));
+        force ||= word.slice(1).includes("f");
+      }
+    }
+    return recursive && force;
+  });
+};
+
+const containsPotentialRemoveCommand = (
+  context: PermissionApprovalContext,
+): boolean => {
+  const command =
+    typeof context.metadata?.command === "string"
+      ? context.metadata.command
+      : context.patterns?.join("\n");
+  if (!command) {
+    return false;
+  }
+  const normalized = command
+    .replace(/\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*/gu, "")
+    .replace(/["'\\]/gu, "");
+  return /(^|[^A-Za-z0-9_])(?:[^\s/]+\/)*rm(?=$|[^A-Za-z0-9_])/iu.test(normalized);
+};
+
+const splitShellCommandSegments = (command: string): string[] =>
+  command.split(/&&|\|\||[;|()\n]/u);
+
+const tokenizeShellSegment = (segment: string): string[] =>
+  (segment.match(/(?:[^\s"'\\]+|"(?:\\.|[^"])*"|'[^']*')+/gu) ?? []).map(
+    (word) => {
+      const quoted = word.match(/^(?:"([\s\S]*)"|'([\s\S]*)')$/u);
+      return (quoted ? (quoted[1] ?? quoted[2] ?? "") : word).replace(
+        /(["'])|\\(.)/gu,
+        "$2",
+      );
+    },
+  );
+
 const isSafeWorkspaceSearch = (
   permission: "glob" | "grep",
   context: PermissionApprovalContext,