feat: add permission restricting in Plan Mode

Author: qorzj

packages/cli/src/tests/prompt-input-keys.test.ts

@@ -24,6 +24,7 @@ import {
   buildPromptDraftFromSessionMessage,
   extractProposedPlan,
   getImplementationPrompt,
+  getPlanImplementationChoice,
   disableTerminalExtendedKeys,
   enableTerminalExtendedKeys,
   EMPTY_BUFFER,
@@ -160,6 +161,10 @@ test("getImplementationPrompt uses Chinese only above five full-width punctuatio
   assert.equal(getImplementationPrompt("，、；。；。"), "实现此方案。");
 });
 
+test("getPlanImplementationChoice treats escape as staying in Plan Mode", () => {
+  assert.equal(getPlanImplementationChoice("", { escape: true, return: false }, 0), "stay");
+});
+
 test("prompt return key action submits on plain enter", () => {
   const { key } = parseTerminalInput("\r");
   assert.equal(getPromptReturnKeyAction(key), "submit");

packages/cli/src/ui/index.ts

@@ -19,6 +19,7 @@ export {
   PlanImplementationPrompt,
   extractProposedPlan,
   getImplementationPrompt,
+  getPlanImplementationChoice,
 } from "./views/PlanImplementationPrompt";
 export { MessageView } from "./components";
 export { parseDiffPreview } from "./components/MessageView/utils";

packages/cli/src/ui/views/PlanImplementationPrompt.tsx

@@ -1,6 +1,7 @@
 import React, { useEffect, useState } from "react";
 import { Box, Text } from "ink";
 import { useTerminalInput } from "../hooks";
+import type { InputKey } from "../hooks";
 
 type PlanImplementationChoice = "implement" | "stay" | "default";
 
@@ -28,6 +29,20 @@ export function getImplementationPrompt(plan: string): string {
   return fullWidthPunctuationCount > 5 ? "实现此方案。" : "Implement the plan.";
 }
 
+export function getPlanImplementationChoice(
+  input: string,
+  key: Pick<InputKey, "escape" | "return">,
+  cursor: number
+): PlanImplementationChoice | null {
+  if (key.escape) {
+    return "stay";
+  }
+  if (input && /^[1-3]$/.test(input)) {
+    return CHOICES[Number(input) - 1]!.value;
+  }
+  return key.return ? CHOICES[cursor]!.value : null;
+}
+
 export function PlanImplementationPrompt({ onSelect }: Props): React.ReactElement {
   const [cursor, setCursor] = useState(0);
 
@@ -36,6 +51,11 @@ export function PlanImplementationPrompt({ onSelect }: Props): React.ReactElemen
   }, []);
 
   useTerminalInput((input, key) => {
+    const choice = getPlanImplementationChoice(input, key, cursor);
+    if (choice) {
+      onSelect(choice);
+      return;
+    }
     if (key.upArrow) {
       setCursor((value) => Math.max(0, value - 1));
       return;
@@ -44,13 +64,6 @@ export function PlanImplementationPrompt({ onSelect }: Props): React.ReactElemen
       setCursor((value) => Math.min(CHOICES.length - 1, value + 1));
       return;
     }
-    if (input && /^[1-3]$/.test(input)) {
-      onSelect(CHOICES[Number(input) - 1]!.value);
-      return;
-    }
-    if (key.return) {
-      onSelect(CHOICES[cursor]!.value);
-    }
   });
 
   return (

packages/core/src/common/permissions.ts

@@ -60,6 +60,7 @@ export type ComputeToolCallPermissionsOptions = {
   projectRoot: string;
   toolCalls: unknown[];
   settings?: Required<PermissionSettings>;
+  forceAskScopes?: readonly PermissionScope[];
   readPermissionExemptPaths?: string[];
   resolveSnippetPath?: (sessionId: string, snippetId: string) => string | null | undefined;
 };
@@ -163,10 +164,18 @@ export function computeToolCallPermissions(options: ComputeToolCallPermissionsOp
       readPermissionExemptPaths: options.readPermissionExemptPaths,
       resolveSnippetPath: options.resolveSnippetPath,
     });
-    const permission = evaluatePermissionScopes(request.scopes, options.settings);
+    const evaluatedPermission = evaluatePermissionScopes(request.scopes, options.settings);
+    const forcedAskScopes =
+      evaluatedPermission === "deny"
+        ? []
+        : getAllowedForcedAskScopes(request.scopes, options.settings, options.forceAskScopes);
+    const permission = forcedAskScopes.length > 0 ? "ask" : evaluatedPermission;
     permissions.push({ toolCallId: toolCall.id, permission });
     if (permission === "ask") {
-      const askScopes = getPermissionScopesRequiringAsk(request.scopes, options.settings);
+      const askScopes = mergeAskScopes(
+        getPermissionScopesRequiringAsk(request.scopes, options.settings),
+        forcedAskScopes
+      );
       askPermissions.push({
         toolCallId: toolCall.id,
         scopes: askScopes.length > 0 ? askScopes : request.scopes,
@@ -180,6 +189,25 @@ export function computeToolCallPermissions(options: ComputeToolCallPermissionsOp
   return { permissions, askPermissions };
 }
 
+function getAllowedForcedAskScopes(
+  scopes: AskPermissionScope[],
+  settings: Required<PermissionSettings> | undefined,
+  forceAskScopes: readonly PermissionScope[] | undefined
+): PermissionScope[] {
+  if (!forceAskScopes?.length) {
+    return [];
+  }
+
+  return scopes.filter(
+    (scope): scope is PermissionScope =>
+      scope !== "unknown" && forceAskScopes.includes(scope) && evaluatePermissionScopes([scope], settings) === "allow"
+  );
+}
+
+function mergeAskScopes(existing: AskPermissionScope[], forced: PermissionScope[]): AskPermissionScope[] {
+  return [...existing, ...forced.filter((scope) => !existing.includes(scope))];
+}
+
 export function describeToolPermissionRequest(options: {
   sessionId: string;
   projectRoot: string;

packages/core/src/session.ts

@@ -69,6 +69,13 @@ const DEFAULT_COMPACT_PROMPT_TOKEN_THRESHOLD = 128 * 1024;
 const DEEPSEEK_V4_COMPACT_PROMPT_TOKEN_THRESHOLD = 512 * 1024;
 const PLAN_MODE_ON_STATUS_MESSAGE = "  └ Set Plan Mode on. Awaiting <proposed_plan>.";
 const PLAN_MODE_OFF_STATUS_MESSAGE = "  └ Set Plan Mode off.";
+const PLAN_MODE_FORCE_ASK_SCOPES = [
+  "write-in-cwd",
+  "write-out-cwd",
+  "delete-in-cwd",
+  "delete-out-cwd",
+  "mutate-git-log",
+] as const satisfies readonly PermissionScope[];
 
 type ChatCompletionDebugOptions = {
   enabled?: boolean;
@@ -1416,6 +1423,7 @@ ${agentInstructions}
               projectRoot: this.projectRoot,
               toolCalls,
               settings: this.getResolvedSettings().permissions,
+              forceAskScopes: this.getSession(sessionId)?.planMode ? PLAN_MODE_FORCE_ASK_SCOPES : undefined,
               readPermissionExemptPaths: this.getSkillScanRoots().map((entry) => entry.root),
               resolveSnippetPath: (id, snippetId) => getSnippet(id, snippetId)?.filePath,
             })

packages/core/src/tests/permissions.test.ts

@@ -170,6 +170,103 @@ test("computeToolCallPermissions only asks for scopes not already allowed", () =
   );
 });
 
+test("computeToolCallPermissions temporarily upgrades allowed forced scopes to ask", () => {
+  const projectRoot = createTempDir("deepcode-permissions-force-ask-workspace-");
+  const forcedScopes: PermissionScope[] = [
+    "write-in-cwd",
+    "write-out-cwd",
+    "delete-in-cwd",
+    "delete-out-cwd",
+    "mutate-git-log",
+  ];
+  const plan = computeToolCallPermissions({
+    sessionId: "session-1",
+    projectRoot,
+    forceAskScopes: forcedScopes,
+    settings: {
+      allow: ["write-in-cwd", "write-out-cwd", "delete-out-cwd", "mutate-git-log"] as PermissionScope[],
+      deny: ["delete-in-cwd"] as PermissionScope[],
+      ask: [] as PermissionScope[],
+      defaultMode: "allowAll" as const,
+    },
+    toolCalls: [
+      {
+        id: "call-write-in",
+        type: "function",
+        function: { name: "write", arguments: JSON.stringify({ file_path: path.join(projectRoot, "file.txt") }) },
+      },
+      {
+        id: "call-write-out",
+        type: "function",
+        function: { name: "write", arguments: JSON.stringify({ file_path: "/tmp/file.txt" }) },
+      },
+      {
+        id: "call-delete-out",
+        type: "function",
+        function: {
+          name: "bash",
+          arguments: JSON.stringify({
+            command: "rm /tmp/file.txt",
+            sideEffects: ["delete-out-cwd"],
+          }),
+        },
+      },
+      {
+        id: "call-mutate-git",
+        type: "function",
+        function: {
+          name: "bash",
+          arguments: JSON.stringify({ command: "git commit --allow-empty -m test", sideEffects: ["mutate-git-log"] }),
+        },
+      },
+      {
+        id: "call-delete-in",
+        type: "function",
+        function: {
+          name: "bash",
+          arguments: JSON.stringify({ command: "rm file.txt", sideEffects: ["delete-in-cwd"] }),
+        },
+      },
+    ],
+  });
+
+  assert.deepEqual(plan.permissions, [
+    { toolCallId: "call-write-in", permission: "ask" },
+    { toolCallId: "call-write-out", permission: "ask" },
+    { toolCallId: "call-delete-out", permission: "ask" },
+    { toolCallId: "call-mutate-git", permission: "ask" },
+    { toolCallId: "call-delete-in", permission: "deny" },
+  ]);
+  assert.deepEqual(
+    plan.askPermissions.map((item) => ({ id: item.toolCallId, scopes: item.scopes })),
+    [
+      { id: "call-write-in", scopes: ["write-in-cwd"] },
+      { id: "call-write-out", scopes: ["write-out-cwd"] },
+      { id: "call-delete-out", scopes: ["delete-out-cwd"] },
+      { id: "call-mutate-git", scopes: ["mutate-git-log"] },
+    ]
+  );
+
+  const defaultPlan = computeToolCallPermissions({
+    sessionId: "session-1",
+    projectRoot,
+    settings: {
+      allow: ["write-in-cwd"] as PermissionScope[],
+      deny: [] as PermissionScope[],
+      ask: [] as PermissionScope[],
+      defaultMode: "allowAll" as const,
+    },
+    toolCalls: [
+      {
+        id: "call-default",
+        type: "function",
+        function: { name: "write", arguments: JSON.stringify({ file_path: path.join(projectRoot, "file.txt") }) },
+      },
+    ],
+  });
+  assert.deepEqual(defaultPlan.permissions, [{ toolCallId: "call-default", permission: "allow" }]);
+});
+
 test("computeToolCallPermissions allows read tool calls under skill scan paths", () => {
   const projectRoot = createTempDir("deepcode-permissions-skill-read-workspace-");
   const home = createTempDir("deepcode-permissions-skill-read-home-");

packages/core/src/tests/session.test.ts

@@ -2294,6 +2294,54 @@ test("activateSession pauses for permission when a tool call requires ask", asyn
   );
 });
 
+test("activateSession temporarily asks before allowed writes in Plan Mode", async () => {
+  const workspace = createTempDir("deepcode-plan-permission-workspace-");
+  const home = createTempDir("deepcode-plan-permission-home-");
+  setHomeDir(home);
+
+  const manager = createPermissionSessionManager(
+    workspace,
+    [
+      {
+        choices: [
+          {
+            message: {
+              content: "",
+              tool_calls: [
+                {
+                  id: "call-write",
+                  type: "function",
+                  function: {
+                    name: "write",
+                    arguments: JSON.stringify({ file_path: path.join(workspace, "plan.txt"), content: "planned" }),
+                  },
+                },
+              ],
+            },
+          },
+        ],
+        usage: { prompt_tokens: 1, completion_tokens: 1, total_tokens: 2 },
+      },
+    ],
+    {
+      allow: ["write-in-cwd"],
+      deny: [],
+      ask: [],
+      defaultMode: "allowAll",
+    }
+  );
+
+  const sessionId = await manager.createSession({ text: "Plan this change", planMode: true });
+  const session = manager.getSession(sessionId);
+  const assistant = manager
+    .listSessionMessages(sessionId)
+    .find((message) => message.role === "assistant" && (message.messageParams as any)?.tool_calls);
+
+  assert.equal(session?.status, "ask_permission");
+  assert.deepEqual(session?.askPermissions?.[0]?.scopes, ["write-in-cwd"]);
+  assert.deepEqual(assistant?.meta?.permissions, [{ toolCallId: "call-write", permission: "ask" }]);
+});
+
 test("SessionManager preserves permission_denied status when sessions are reloaded", async () => {
   const workspace = createTempDir("deepcode-permission-denied-workspace-");
   const home = createTempDir("deepcode-permission-denied-home-");