权限系统

// utils/permissions/hasPermissionsToUseTool.ts — 简化版

export type PermissionDecision = {
  allowed: boolean
  reason: PermissionDecisionReason
  message?: string
}

export type PermissionDecisionReason =
  | 'classifier'
  | 'hook'
  | 'rule'
  | 'subcommandResults'
  | 'mode'
  | 'sandboxOverride'
  | 'workingDir'
  | 'safetyCheck'

export async function hasPermissionsToUseTool(
  tool: Tool,
  input: unknown,
  context: ToolPermissionContext
): Promise<PermissionDecision> {
  // ===== 第 1 层：全局拒绝规则 =====
  const blanketDeny = checkBlanketDenyRules(tool, input)
  if (blanketDeny) {
    return {
      allowed: false,
      reason: 'safetyCheck',
      message: blanketDeny.message,
    }
  }

  // ===== 第 2 层：始终允许规则 =====
  if (context.alwaysAllowRules.length > 0) {
    const allowMatch = matchPermissionRule(
      tool, input, context.alwaysAllowRules
    )
    if (allowMatch) {
      return { allowed: true, reason: 'rule' }
    }
  }

  // ===== 第 3 层：始终拒绝规则 =====
  if (context.alwaysDenyRules.length > 0) {
    const denyMatch = matchPermissionRule(
      tool, input, context.alwaysDenyRules
    )
    if (denyMatch) {
      return {
        allowed: false,
        reason: 'rule',
        message: '被拒绝规则阻止: ' + denyMatch.pattern,
      }
    }
  }

  // ===== 第 4 层：工具自身权限检查 =====
  const toolPermResult = await tool.checkPermissions(input, context)
  if (toolPermResult.decided) {
    return {
      allowed: toolPermResult.allowed,
      reason: toolPermResult.reason,
      message: toolPermResult.message,
    }
  }

  // ===== 第 5 层：根据模式决定 =====
  switch (context.mode) {
    case 'plan':
      // 计划模式：只读工具允许，其余拒绝
      return tool.isReadOnly()
        ? { allowed: true, reason: 'mode' }
        : { allowed: false, reason: 'mode', message: '计划模式下不允许写操作' }

    case 'bypassPermissions':
      return { allowed: true, reason: 'mode' }

    case 'auto':
      // 自动模式：使用分类器
      return classifyForAutoMode(tool, input, context)

    case 'default':
    default:
      // 默认模式：需要用户确认
      return {
        allowed: false,
        reason: 'classifier',
        message: 'needsUserConfirmation',
      }
  }
}

function checkBlanketDenyRules(
  tool: Tool,
  input: unknown
): { message: string } | null {
  // 硬编码的绝对禁止规则
  if (tool.name === 'Bash') {
    const cmd = (input as { command: string }).command
    if (cmd.includes('rm -rf /') && !cmd.includes('rm -rf /tmp')) {
      return { message: '禁止执行可能删除根目录的命令' }
    }
  }
  return null
}

// bashClassifier.ts — Bash 命令安全分类
export interface BashClassification {
  riskLevel: 'safe' | 'moderate' | 'dangerous'
  category: string
  requiresConfirmation: boolean
  explanation: string
}

export function classifyBashCommand(
  command: string,
  astAnalysis: CommandAnalysis
): BashClassification {
  // 已知安全命令
  if (astAnalysis.isReadOnly && !astAnalysis.hasRedirection) {
    return {
      riskLevel: 'safe',
      category: 'read-only',
      requiresConfirmation: false,
      explanation: '只读命令，无副作用',
    }
  }

  // 已知危险命令模式
  const dangerousPatterns = [
    { pattern: /rms+(-rf?|--recursive)/, category: 'destructive-delete' },
    { pattern: /chmods+777/, category: 'insecure-permissions' },
    { pattern: />s*/etc//, category: 'system-file-write' },
    { pattern: /curl.*|s*(bash|sh)/, category: 'remote-code-execution' },
    { pattern: /gits+pushs+.*--force/, category: 'force-push' },
  ]

  for (const { pattern, category } of dangerousPatterns) {
    if (pattern.test(command)) {
      return {
        riskLevel: 'dangerous',
        category,
        requiresConfirmation: true,
        explanation: '检测到高风险操作: ' + category,
      }
    }
  }

  // 有写操作但不是已知危险的
  if (!astAnalysis.isReadOnly || astAnalysis.hasRedirection) {
    return {
      riskLevel: 'moderate',
      category: 'write-operation',
      requiresConfirmation: true,
      explanation: '命令可能修改文件系统',
    }
  }

  return {
    riskLevel: 'safe',
    category: 'unknown-safe',
    requiresConfirmation: false,
    explanation: '未检测到风险',
  }
}

// yoloClassifier.ts — 自动模式分类
export async function classifyForAutoMode(
  tool: Tool,
  input: unknown,
  context: ToolPermissionContext
): Promise<PermissionDecision> {
  // 只读工具：始终允许
  if (tool.isReadOnly()) {
    return { allowed: true, reason: 'classifier' }
  }

  // Bash 命令：使用专用分类器
  if (tool.name === 'Bash') {
    const cmd = (input as { command: string }).command
    const analysis = analyzeCommand(cmd)
    const classification = classifyBashCommand(cmd, analysis)

    if (classification.riskLevel === 'dangerous') {
      return {
        allowed: false,
        reason: 'classifier',
        message: classification.explanation,
      }
    }

    // 中等风险：检查拒绝追踪
    if (classification.riskLevel === 'moderate') {
      if (shouldFallbackToPrompting(tool.name, context)) {
        return {
          allowed: false,
          reason: 'classifier',
          message: 'needsUserConfirmation',
        }
      }
      return { allowed: true, reason: 'classifier' }
    }
  }

  // 文件写操作：检查是否在工作目录内
  if (tool.name === 'Edit' || tool.name === 'Write') {
    const filePath = (input as { file_path: string }).file_path
    if (isWithinWorkingDir(filePath, context)) {
      return { allowed: true, reason: 'workingDir' }
    }
    return {
      allowed: false,
      reason: 'workingDir',
      message: '文件不在工作目录内',
    }
  }

  // 默认：允许
  return { allowed: true, reason: 'classifier' }
}

// 权限规则匹配系统

interface PermissionRule {
  pattern: string // "Bash(git *)", "Read", "Edit"
}

export function matchPermissionRule(
  tool: Tool,
  input: unknown,
  rules: PermissionRule[]
): PermissionRule | null {
  for (const rule of rules) {
    if (matchSingleRule(tool, input, rule)) {
      return rule
    }
  }
  return null
}

function matchSingleRule(
  tool: Tool,
  input: unknown,
  rule: PermissionRule
): boolean {
  // 简单工具名匹配: "Read", "Glob"
  if (!rule.pattern.includes('(')) {
    return tool.name === rule.pattern
  }

  // 带参数的匹配: "Bash(npm test*)"
  const match = rule.pattern.match(/^(\w+)\((.+)\)$/)
  if (!match) return false

  const [, toolName, commandPattern] = match
  if (tool.name !== toolName) return false

  // 对 Bash 工具，匹配命令内容
  if (toolName === 'Bash') {
    const command = (input as { command: string }).command
    return globMatch(command.trim(), commandPattern)
  }

  // 对文件工具，匹配文件路径
  if (toolName === 'Read' || toolName === 'Edit' || toolName === 'Write') {
    const filePath = (input as { file_path: string }).file_path
    return globMatch(filePath, commandPattern)
  }

  return false
}

// glob 匹配：* 匹配任意字符序列
function globMatch(text: string, pattern: string): boolean {
  // 转义正则特殊字符，然后将 glob 通配符转换为正则
  const escaped = escapeRegExp(pattern)
  const regexStr = '^' + escaped
    .replace(/\\\*/g, '.*')  // glob * → regex .*
    .replace(/\\\?/g, '.')   // glob ? → regex .
    + '$'
  return new RegExp(regexStr).test(text)
}

function escapeRegExp(str: string): string {
  return str.replace(/[.*+?^$\\|()\[\]]/g, '\\$&')
}

// 拒绝追踪与回退
const denialCounts = new Map<string, number>()

export function shouldFallbackToPrompting(
  toolName: string,
  context: ToolPermissionContext
): boolean {
  const key = toolName
  const count = denialCounts.get(key) ?? 0
  return count >= 3 // 连续拒绝 3 次后回退到用户确认
}

export function trackDenial(toolName: string): void {
  const count = denialCounts.get(toolName) ?? 0
  denialCounts.set(toolName, count + 1)
}

export function resetDenials(toolName: string): void {
  denialCounts.delete(toolName)
}

// useCanUseTool — React Hook (简化版)
export function useCanUseTool(toolCall: ToolUseBlock) {
  const [decision, setDecision] = useState<PermissionDecision | null>(null)
  const [showDialog, setShowDialog] = useState(false)

  useEffect(() => {
    async function check() {
      const result = await hasPermissionsToUseTool(
        toolCall.tool, toolCall.input, getPermissionContext()
      )

      if (result.message === 'needsUserConfirmation') {
        setShowDialog(true) // 弹出确认对话框
      } else {
        setDecision(result)
      }
    }
    check()
  }, [toolCall])

  const handleUserDecision = (
    allowed: boolean,
    alwaysAllow: boolean
  ) => {
    setDecision({ allowed, reason: 'classifier' })
    if (alwaysAllow) {
      // 将规则添加到 always-allow 列表
      addAlwaysAllowRule(toolCall.tool.name, toolCall.input)
    }
    setShowDialog(false)
  }

  return { decision, showDialog, handleUserDecision }
}