lmin/zmo-cli
1
0
Fork 0
Code Issues Pull Requests Actions 6 Packages Projects Releases Wiki Activity

feat(core): add location-based permission service (#30287)

Browse Source
This commit is contained in:
Dax
2026-06-01 21:32:50 -04:00
committed by GitHub
parent acd620f411
commit 9b815bcbd2
65 changed files with 4970 additions and 552 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
packages/opencode/test/tool/external-directory.test.ts
View File

@@ -1,3 +1,4 @@
import { PermissionLegacy } from "@opencode-ai/core/permission/legacy"
import { describe, expect } from "bun:test"
import path from "path"
import { Effect } from "effect"
@@ -26,7 +27,7 @@ const glob = (p: string) =>
process.platform === "win32" ? Filesystem.normalizePathPattern(p) : p.replaceAll("\\", "/")
function makeCtx() {
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
const ctx: Tool.Context = {
...baseCtx,
ask: (req) =>

5
packages/opencode/test/tool/glob.test.ts
View File

@@ -1,3 +1,4 @@
import { PermissionLegacy } from "@opencode-ai/core/permission/legacy"
import { describe, expect } from "bun:test"
import path from "path"
import { Cause, Effect, Exit, Layer } from "effect"
@@ -52,12 +53,12 @@ const ctx = {
}
const asks = () => {
const items: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const items: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
return {
items,
next: {
...ctx,
ask: (req: Omit<Permission.Request, "id" | "sessionID" | "tool">) =>
ask: (req: Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">) =>
Effect.sync(() => {
items.push(req)
}),

5
packages/opencode/test/tool/grep.test.ts
View File

@@ -1,3 +1,4 @@
import { PermissionLegacy } from "@opencode-ai/core/permission/legacy"
import { describe, expect } from "bun:test"
import fs from "fs/promises"
import os from "os"
@@ -186,7 +187,7 @@ describe("tool.grep", () => {
[path.join(alias, "*")]: "allow",
},
})
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
const next: Tool.Context = {
...ctx,
ask: (req) =>
@@ -234,7 +235,7 @@ describe("tool.grep", () => {
yield* appfs.makeDirectory(remoteDir, { recursive: true }).pipe(Effect.orDie)
yield* git(remoteRoot, ["clone", "--bare", source, remoteRepo])
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
const next: Tool.Context = {
...ctx,
ask: (req) =>

5
packages/opencode/test/tool/lsp.test.ts
View File

@@ -1,3 +1,4 @@
import { PermissionLegacy } from "@opencode-ai/core/permission/legacy"
import { afterEach, describe, expect } from "bun:test"
import { Effect, Layer } from "effect"
import path from "path"
@@ -83,12 +84,12 @@ const put = Effect.fn("LspToolTest.put")(function* (file: string) {
})
const asks = () => {
const items: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const items: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
return {
items,
next: {
...ctx,
ask: (req: Omit<Permission.Request, "id" | "sessionID" | "tool">) =>
ask: (req: Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">) =>
Effect.sync(() => {
items.push(req)
}),

9
packages/opencode/test/tool/read.test.ts
View File

@@ -1,3 +1,4 @@
import { PermissionLegacy } from "@opencode-ai/core/permission/legacy"
import { afterEach, describe, expect } from "bun:test"
import { Cause, Effect, Exit, Layer, Stream } from "effect"
import path from "path"
@@ -140,12 +141,12 @@ const load = Effect.fn("ReadToolTest.load")(function* (p: string) {
return yield* fs.readFileString(p)
})
const asks = () => {
const items: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const items: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
return {
items,
next: {
...ctx,
ask: (req: Omit<Permission.Request, "id" | "sessionID" | "tool">) =>
ask: (req: Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">) =>
Effect.sync(() => {
items.push(req)
}),
@@ -328,7 +329,7 @@ describe("tool.read env file permissions", () => {
let asked = false
const next = {
...ctx,
ask: (req: Omit<Permission.Request, "id" | "sessionID" | "tool">) =>
ask: (req: Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">) =>
Effect.sync(() => {
for (const pattern of req.patterns) {
const rule = Permission.evaluate(req.permission, pattern, info.permission)
@@ -336,7 +337,7 @@ describe("tool.read env file permissions", () => {
asked = true
}
if (rule.action === "deny") {
throw new Permission.DeniedError({ ruleset: info.permission })
throw new PermissionLegacy.DeniedError({ ruleset: info.permission })
}
}
}),

65
packages/opencode/test/tool/shell.test.ts
View File

@@ -1,3 +1,4 @@
import { PermissionLegacy } from "@opencode-ai/core/permission/legacy"
import { describe, expect } from "bun:test"
import { Cause, Effect, Exit, Layer } from "effect"
import type * as Scope from "effect/Scope"
@@ -155,9 +156,9 @@ const each = (
}
}
const capture = (requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">>, stop?: Error) => ({
const capture = (requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">>, stop?: Error) => ({
...ctx,
ask: (req: Omit<Permission.Request, "id" | "sessionID" | "tool">) =>
ask: (req: Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">) =>
Effect.sync(() => {
requests.push(req)
if (stop) throw stop
@@ -222,7 +223,7 @@ describe("tool.shell permissions", () => {
yield* runIn(
tmp,
Effect.gen(function* () {
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
yield* run(
{
command: "echo hello",
@@ -244,7 +245,7 @@ describe("tool.shell permissions", () => {
yield* runIn(
tmp,
Effect.gen(function* () {
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
yield* run(
{
command: "echo foo && echo bar",
@@ -268,7 +269,7 @@ describe("tool.shell permissions", () => {
runIn(
projectRoot,
Effect.gen(function* () {
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
yield* run(
{
command: "Write-Host foo; if ($?) { Write-Host bar }",
@@ -297,7 +298,7 @@ describe("tool.shell permissions", () => {
tmp,
Effect.gen(function* () {
const err = new Error("stop after permission")
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
expect(
yield* fail(
{
@@ -323,7 +324,7 @@ describe("tool.shell permissions", () => {
projectRoot,
Effect.gen(function* () {
const err = new Error("stop after permission")
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
const file = process.platform === "win32" ? `${process.env.WINDIR!.replaceAll("\\", "/")}/*` : "/etc/*"
const want = process.platform === "win32" ? glob(path.join(process.env.WINDIR!, "*")) : "/etc/*"
expect(
@@ -354,7 +355,7 @@ describe("tool.shell permissions", () => {
projectRoot,
Effect.gen(function* () {
const file = path.join(outerTmp, "outside.txt").replaceAll("\\", "/")
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
yield* run(
{
command: `echo $(cat "${file}")`,
@@ -383,7 +384,7 @@ describe("tool.shell permissions", () => {
projectRoot,
Effect.gen(function* () {
const err = new Error("stop after permission")
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
expect(
yield* fail(
{
@@ -409,7 +410,7 @@ describe("tool.shell permissions", () => {
runIn(
projectRoot,
Effect.gen(function* () {
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
const file = `${process.env.WINDIR!.replaceAll("\\", "/")}/win.ini`
yield* run(
{
@@ -440,7 +441,7 @@ describe("tool.shell permissions", () => {
tmp,
Effect.gen(function* () {
const err = new Error("stop after permission")
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
expect(
yield* fail(
{
@@ -468,7 +469,7 @@ describe("tool.shell permissions", () => {
projectRoot,
Effect.gen(function* () {
const err = new Error("stop after permission")
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
expect(
yield* fail(
{
@@ -497,7 +498,7 @@ describe("tool.shell permissions", () => {
tmp,
Effect.gen(function* () {
const err = new Error("stop after permission")
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
expect(
yield* fail(
{
@@ -525,7 +526,7 @@ describe("tool.shell permissions", () => {
projectRoot,
Effect.gen(function* () {
const err = new Error("stop after permission")
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
expect(
yield* fail(
{
@@ -560,7 +561,7 @@ describe("tool.shell permissions", () => {
projectRoot,
Effect.gen(function* () {
const err = new Error("stop after permission")
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
const root = path.parse(process.env.WINDIR!).root.replace(/[\\/]+$/, "")
expect(
yield* fail(
@@ -593,7 +594,7 @@ describe("tool.shell permissions", () => {
runIn(
projectRoot,
Effect.gen(function* () {
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
yield* run(
{
command: "Get-Content $env:WINDIR/win.ini",
@@ -620,7 +621,7 @@ describe("tool.shell permissions", () => {
projectRoot,
Effect.gen(function* () {
const err = new Error("stop after permission")
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
expect(
yield* fail(
{
@@ -649,7 +650,7 @@ describe("tool.shell permissions", () => {
projectRoot,
Effect.gen(function* () {
const err = new Error("stop after permission")
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
expect(
yield* fail(
{
@@ -677,7 +678,7 @@ describe("tool.shell permissions", () => {
runIn(
projectRoot,
Effect.gen(function* () {
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
yield* run(
{
command: "Set-Location C:/Windows",
@@ -705,7 +706,7 @@ describe("tool.shell permissions", () => {
runIn(
projectRoot,
Effect.gen(function* () {
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
yield* run(
{
command: "Write-Output ('a' * 3)",
@@ -731,7 +732,7 @@ describe("tool.shell permissions", () => {
runIn(
projectRoot,
Effect.gen(function* () {
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
yield* run(
{
command: `TYPE "${path.join(process.env.WINDIR!, "win.ini")}"`,
@@ -755,7 +756,7 @@ describe("tool.shell permissions", () => {
tmp,
Effect.gen(function* () {
const err = new Error("stop after permission")
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
expect(
yield* fail(
{
@@ -779,7 +780,7 @@ describe("tool.shell permissions", () => {
tmp,
Effect.gen(function* () {
const err = new Error("stop after permission")
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
expect(
yield* fail(
{
@@ -810,7 +811,7 @@ describe("tool.shell permissions", () => {
const want = Filesystem.normalizePathPattern(path.join(outerTmp, "*"))
for (const dir of forms(outerTmp)) {
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
expect(
yield* fail(
{
@@ -842,7 +843,7 @@ describe("tool.shell permissions", () => {
projectRoot,
Effect.gen(function* () {
const err = new Error("stop after permission")
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
const want = glob(path.join(os.tmpdir(), "*"))
expect(
yield* fail(
@@ -871,7 +872,7 @@ describe("tool.shell permissions", () => {
projectRoot,
Effect.gen(function* () {
const err = new Error("stop after permission")
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
const want = glob(path.join(os.tmpdir(), "*"))
expect(
yield* fail(
@@ -903,7 +904,7 @@ describe("tool.shell permissions", () => {
tmp,
Effect.gen(function* () {
const err = new Error("stop after permission")
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
const filepath = path.join(outerTmp, "outside.txt")
expect(
yield* fail(
@@ -931,7 +932,7 @@ describe("tool.shell permissions", () => {
yield* runIn(
tmp,
Effect.gen(function* () {
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
yield* run(
{
command: `rm -rf ${path.join(tmp, "nested")}`,
@@ -952,7 +953,7 @@ describe("tool.shell permissions", () => {
yield* runIn(
tmp,
Effect.gen(function* () {
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
yield* run(
{
command: "git log --oneline -5",
@@ -974,7 +975,7 @@ describe("tool.shell permissions", () => {
yield* runIn(
tmp,
Effect.gen(function* () {
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
yield* run(
{
command: "cd .",
@@ -996,7 +997,7 @@ describe("tool.shell permissions", () => {
tmp,
Effect.gen(function* () {
const err = new Error("stop after permission")
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
expect(
yield* fail(
{ command: "echo test > output.txt", description: "Redirect test output" },
@@ -1017,7 +1018,7 @@ describe("tool.shell permissions", () => {
yield* runIn(
tmp,
Effect.gen(function* () {
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
yield* run({ command: "ls -la", description: "List" }, capture(requests))
const bashReq = requests.find((r) => r.permission === "bash")
expect(bashReq).toBeDefined()

3
packages/opencode/test/tool/skill.test.ts
View File

@@ -1,3 +1,4 @@
import { PermissionLegacy } from "@opencode-ai/core/permission/legacy"
import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner"
import { Cause, Effect, Exit, Layer } from "effect"
import { afterEach, describe, expect } from "bun:test"
@@ -67,7 +68,7 @@ Use this skill.
})).find((tool) => tool.id === SkillTool.id)
if (!tool) throw new Error("Skill tool not found")
const requests: Array<Omit<Permission.Request, "id" | "sessionID" | "tool">> = []
const requests: Array<Omit<PermissionLegacy.Request, "id" | "sessionID" | "tool">> = []
const ctx: Tool.Context = {
...baseCtx,
ask: (req) =>