a3s_code_core/permissions/
mod.rs

1//! Permission system for tool execution control
2//!
3//! Implements a declarative permission system similar to Claude Code's permissions.
4//! Supports pattern matching with wildcards and three-tier evaluation:
5//! 1. Deny rules - checked first, any match = immediate denial
6//! 2. Allow rules - checked second, any match = auto-approval
7//! 3. Ask rules - checked third, forces confirmation prompt
8//! 4. Default behavior - falls back to HITL policy
9
10mod interactive;
11mod manager;
12mod policy;
13mod risk;
14mod rule;
15
16#[cfg(test)]
17mod tests;
18
19use serde::{Deserialize, Serialize};
20use std::sync::Arc;
21
22pub use interactive::{InteractiveApprovalMode, InteractiveToolGuardrail};
23pub use manager::{MatchingRules, PermissionManager};
24pub use policy::PermissionPolicy;
25pub use risk::{
26    EnvironmentSensitivity, ImpactScope, OperationTarget, Reversibility, ToolRiskAction,
27    ToolRiskAssessment, ToolRiskDimensions, ToolRiskLevel, ToolRiskReason, ToolRiskType,
28};
29pub use rule::PermissionRule;
30
31/// Trait for checking tool execution permissions.
32///
33/// Implement this trait to provide custom permission logic.
34/// The built-in `PermissionPolicy` implements this trait using
35/// declarative allow/deny/ask rules with pattern matching.
36pub trait PermissionChecker: Send + Sync {
37    /// Freeze any mutable host policy for one agent run.
38    ///
39    /// Stateless checkers can keep the default and will be shared as-is.
40    /// Interactive hosts whose policy changes between turns should return an
41    /// immutable checker here so an in-flight or background child cannot gain
42    /// or lose authority when the next turn selects a different mode.
43    fn snapshot_for_run(&self) -> Option<Arc<dyn PermissionChecker>> {
44        None
45    }
46
47    /// Whether a tool definition should be exposed to the model.
48    ///
49    /// This controls model-visible capabilities only. [`Self::check`] remains
50    /// the authoritative execution-time decision for any tool invocation.
51    /// Existing checkers expose every tool unless they explicitly override
52    /// this method.
53    fn expose_to_model(&self, _tool_name: &str) -> bool {
54        true
55    }
56
57    /// Check whether a tool invocation is allowed, denied, or requires confirmation.
58    fn check(&self, tool_name: &str, args: &serde_json::Value) -> PermissionDecision;
59}
60
61/// Permission decision result
62#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
63#[serde(rename_all = "snake_case")]
64pub enum PermissionDecision {
65    /// Automatically allow without user confirmation
66    Allow,
67    /// Deny execution
68    Deny,
69    /// Ask user for confirmation
70    Ask,
71}
a3s_code_core/permissions/mod.rs

a3s_code_core/permissions/
mod.rs
