feat(permissions): 支持外部可写目录 - #3587
Conversation
Signed-off-by: Chris <4436110+zqchris@users.noreply.github.com>
|
| Filename | Overview |
|---|---|
| packages/maker-core/src/agents/pi/index.ts | 接入动态 writableRoots 与权限 generation，但新增可写根可通过符号链接将自动批准的写入导向授权范围外。 |
| packages/maker-core/src/agents/shared/auto-review.ts | 扩展 writableRoots 分类及审核上下文；文件写入边界仍采用不解析符号链接的词法判断。 |
| apps/desktop/src/main/maker-ipc/register.ts | 新增可写目录创建、更新、冲突排除和恢复链路，未发现独立阻断问题。 |
| apps/desktop/src/main/maker-ipc/extraDirsValidator.ts | 增加只读与可写授权冲突排除，但验证后仍保留原始路径，无法作为真实写入边界。 |
| apps/desktop/src/main/localDb/schema.ts | 为会话增加带空数组默认值的 writable_dirs 字段，与映射和迁移保持一致。 |
| apps/desktop/src/renderer/features/cc-agent/CCAgentSessionView.tsx | 为已有会话增加可写目录更新及实际接受子集的持久化处理。 |
| packages/device-link/src/allowlist.ts | 将新的会话级可写目录设置通道加入默认拒绝的远程调用白名单。 |
Sequence Diagram
sequenceDiagram
participant U as 用户
participant D as Desktop 授权
participant P as Pi 工具调用
participant R as Auto-review
participant F as 文件系统
U->>D: 授权外部 writableDir
D->>P: 传递 writableRoots
P->>R: write/edit 原始路径
R->>R: 词法判断路径位于 writableRoot
R-->>P: allow
P->>F: 沿符号链接写入真实目标
Prompt To Fix All With AI
### Issue 1
packages/maker-core/src/agents/pi/index.ts:4005-4006
**符号链接绕过可写边界**
当外部可写目录本身或其子项包含指向授权范围外的符号链接时，`write`/`edit` 的原始路径会通过词法包含检查并被静默允许，而执行前没有按解析后的真实目标重新检查系统、凭证及可写根边界，导致 Pi 可以修改用户未授权的文件。**验证方式：**已追踪原始 `input.path` 从新增 `writableRoots` 审核到 Pi 写工具执行的完整路径，并确认真实路径检查只覆盖 agent home、subagent run 和只读根。
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.Reviews (1): Last reviewed commit: "feat(permissions): 支持外部可写目录" | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2d8caf5823
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
@zqchris 👋 这个 PR 还有 5 条 review conversation 没 resolve(packages/maker-core/src/agents/pi/index.ts / apps/desktop/src/main/maker-ipc/register.ts / apps/desktop/src/main/maker-ipc/extraDirsValidator.ts / apps/desktop/src/renderer/features/cc-agent/CCAgentSessionView.tsx / apps/desktop/src/renderer/features/cc-agent/NewMakerDraftRoute.tsx),auto-review 因此暂时跳过、没法继续审查 / 合并。 如果你已经按评论改完或回应了,请到对应 thread 上点 Resolve conversation;全部 resolve 后,下一轮 auto-review 会自动重新审查这个 PR。 |
MagicLizi
added
status:ci-failed
Signed-off-by: Chris <4436110+zqchris@users.noreply.github.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8dfb311f91
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Signed-off-by: Chris <4436110+zqchris@users.noreply.github.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 27cd5715bf
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Signed-off-by: Chris <4436110+zqchris@users.noreply.github.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c701ce7194
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
@zqchris 👋 这个 PR 还有 6 条 review conversation 没 resolve(apps/desktop/src/main/maker-ipc/register.ts / apps/desktop/src/main/maker-ipc/extraDirsValidator.ts / apps/desktop/src/renderer/features/cc-agent/CCAgentSessionView.tsx / packages/maker-core/src/agents/claude-code/index.ts / packages/maker-core/src/agents/shared/auto-review.ts),auto-review 因此暂时跳过、没法继续审查 / 合并。 如果你已经按评论改完或回应了,请到对应 thread 上点 Resolve conversation;全部 resolve 后,下一轮 auto-review 会自动重新审查这个 PR。 |
Signed-off-by: Chris <4436110+zqchris@users.noreply.github.com>
MagicLizi
added
status:awaiting-bot-review
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2a656f56a1
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Signed-off-by: Chris <4436110+zqchris@users.noreply.github.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ea63d2602d
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Signed-off-by: Chris <4436110+zqchris@users.noreply.github.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4cd859e17d
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
@zqchris 👋 这个 PR 还有 8 条 review conversation 没 resolve(apps/desktop/src/main/maker-ipc/register.ts / packages/maker-core/src/agents/claude-code/index.ts / packages/maker-core/src/agents/shared/auto-review.ts / packages/maker-core/src/agents/codex/index.ts / packages/device-link/src/allowlist.ts 等),auto-review 因此暂时跳过、没法继续审查 / 合并。 如果你已经按评论改完或回应了,请到对应 thread 上点 Resolve conversation;全部 resolve 后,下一轮 auto-review 会自动重新审查这个 PR。 |
Signed-off-by: Chris <4436110+zqchris@users.noreply.github.com>
|
@zqchris 👋 这个 PR 还有 10 条 review conversation 没 resolve(apps/desktop/src/main/maker-ipc/register.ts / packages/device-link/src/allowlist.ts / packages/maker-core/src/agents/pi/index.ts / apps/desktop/src/renderer/components/new-chat/ChatInput.tsx / apps/desktop/src/main/maker-host/auto-permission-reviewer.ts 等),auto-review 因此暂时跳过、没法继续审查 / 合并。 如果你已经按评论改完或回应了,请到对应 thread 上点 Resolve conversation;全部 resolve 后,下一轮 auto-review 会自动重新审查这个 PR。 |
MagicLizi
added
status:awaiting-bot-review
Signed-off-by: Chris <4436110+zqchris@users.noreply.github.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: dcc11584a9
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Signed-off-by: Chris <4436110+zqchris@users.noreply.github.com>
Signed-off-by: Chris <4436110+zqchris@users.noreply.github.com>
|
@zqchris 👋 这个 PR 还有 8 条 review conversation 没 resolve(apps/desktop/src/main/maker-ipc/register.ts / packages/device-link/src/allowlist.ts / packages/maker-core/src/agents/pi/index.ts / apps/desktop/src/renderer/features/cc-agent/CCAgentSessionView.tsx / packages/maker-core/src/agents/shared/auto-review.ts),auto-review 因此暂时跳过、没法继续审查 / 合并。 如果你已经按评论改完或回应了,请到对应 thread 上点 Resolve conversation;全部 resolve 后,下一轮 auto-review 会自动重新审查这个 PR。 |
MagicLizi
added
status:ci-failed
Signed-off-by: Chris <4436110+zqchris@users.noreply.github.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a496b6757e
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
@zqchris 👋 这个 PR 还有 2 条 review conversation 没 resolve(apps/desktop/src/main/maker-ipc/makerSendTransaction.ts / apps/desktop/src/main/maker-ipc/register.ts),auto-review 因此暂时跳过、没法继续审查 / 合并。 如果你已经按评论改完或回应了,请到对应 thread 上点 Resolve conversation;全部 resolve 后,下一轮 auto-review 会自动重新审查这个 PR。 |
MagicLizi
added
status:awaiting-bot-review
|
命中 UI 路径(apps/desktop/src/renderer/components/layout/GlobalDropImportListener.tsx / apps/desktop/src/renderer/components/layout/MainLayout.tsx / apps/desktop/src/renderer/components/new-chat/AtMentionPanel.tsx 等)但 description 未附界面效果证据——建议补充改动后效果:截图/录屏,或改动后界面的 HTML 页面(```html 代码块、.html 附件或在线预览链接),便于确认界面符合 DESIGN.md 设计规范 缺证据不阻断合并。 |
Signed-off-by: Chris <4436110+zqchris@users.noreply.github.com>
MagicLizi
added
status:ci-failed
MagicLizi
left a comment
MagicLizi
left a comment
There was a problem hiding this comment.
审查未通过：当前 head 有 2 条 P1，请先修再推。
P1 apps/mobile/src/session/SessionMenuSheet.tsx:708
功能类改动（外部可写目录）未在 PR Description 写明 SSH / device-link / 手机入口三选一（docs/dev-rules/remote-and-mobile-adaptation.md）。当前手机侧只露出 extraDirs 只读根，没有对应的 writableDirs 入口，远程/手机无法完成这项能力。请在 Description 写清入口，并补上手机侧可写目录 UI，或明确声明本能力本轮不上手机并给出豁免理由。
P1 packages/maker-core/src/agents/pi/index.ts:2337
writePermissionFile 在磁盘 persist 完成前就递增 autoReviewDirectoryGeneration，而 mutableWritableDirs 要等 persist 成功且 generation 未变才更新。reviewAutoAction（约 2823 行）用当前 mutableWritableDirs 组 Auto-review 请求，再用 generation 比对决定是否沿用裁决。中间窗口里 Auto-review 可能按过期 writable roots 放行，persist 完成后 generation 对得上，于是把基于旧根的放行当成有效。请把 generation 递增与 mutableWritableDirs 更新绑在同一成功 persist 点上，或让 Auto-review 在 generation 已变、dirs 尚未跟上时一律 ask。
Signed-off-by: Chris <4436110+zqchris@users.noreply.github.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 48beafd931
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Signed-off-by: Chris <4436110+zqchris@users.noreply.github.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6c880f8939
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
MagicLizi
left a comment
MagicLizi
left a comment
There was a problem hiding this comment.
审查通过：可写目录 schema/IPC/preload/device-link allowlist 与 UI 对齐，migration 0099 与测试覆盖到位，未发现 P0/P1。
|
把外部可写目录从 schema 一路接到 IPC、preload 和 device-link allowlist，手机和桌面之后能用同一套权限边界。谢谢。 |
2 participants
这次改了什么
摘要
让用户在不启用“完全访问”的情况下，把工作区外的指定目录明确授权为可读写目录。该能力由 Cindy Core 统一持有，并接入 Claude Code、Codex 与 Pi 三套 harness；Auto-review 会区分主工作目录、只读引用目录和额外可写目录。
同时修复目录授权热更新期间的审核竞态：如果用户在审核器返回前替换或撤销目录授权，旧的自动允许结论会立即失效，本次操作回到用户确认，不会沿用过期权限。
变更类型
feat新功能fix缺陷修复refactor/perf重构或性能优化docs/test/chore文档、测试或工程维护范围
writableDirs。UI 变化
docs/design-rules/DESIGN.md§1 Visual Theme & Atmosphere、§2 Colors & Semantic Tokens、§4 Component Stylings。目录入口复用现有菜单、图标、间距和语义颜色，不新增平行组件或硬编码色值；Light/Dark 均沿用现有 token。怎么验证的
自动验证
手工验证
不涉及：本轮未启动 Cindy Desktop DEV/Electron；权限行为通过三套 harness 的真实审核入口测试和数据库 replay 验证。
未执行的验证
upstream/main上复现，属于独立主干问题。风险
风险分类
影响与回滚
0099只向sessions添加带默认值的writable_dirs；companion script 会先检查列是否存在，可安全 replay。回滚旧客户端时该列保留但不会被读取，不丢失其它会话数据。writableDirs为可选字段，未提供时等价于空数组；旧端仍保持原行为。提交前检查
git commit -s，见 DCO）Pi system prompt 行为确认
appendSections进入 Pi 的appendSystemPrompt。writableRoots、系统目录、凭证路径及高风险命令规则审核；撤权后的旧运行时权限仍必须失效。Windows PowerShell pipeline 删除边界确认
Remove-Item等写 cmdlet 的目标由 pipeline 提供时，上游路径必须经过与普通 shell 写目标一致的最近存在祖先 realpath 检查。真实目标越出writableRoots、落入系统目录或凭证路径、远端执行端无法提供真实路径证据、目标或授权根解析失败时，一律prompt-each-time，不得由轻量审核静默批准。pipelineFedWriteTargetNeedsConsent已复用writeTargetNeedsConsent的 host realpath / unavailable fail-closed 链路；该实现由 commita496b675引入。Get-ChildItem ... | Remove-Item -Recurse删除、远端不可解析、系统/凭证/悬空链接、合法授权根内清理及 cwd 未知。fixture 在 Windows 使用 junction；当前 head 的 Windows unit shards 已通过。Chris 于 2026-08-29 明确批准本口径。Bootstrap writableDirs 授权来源确认
maker:create-session、携带 lazy-create 参数的maker:send及 active-Orca rehydrate，只允许激活 Main 已接受并写入 SQLite 的既有writableDirs子集。writableDirs不是授权来源。bootstrap 必须在 runtime 创建前以会话 SQLite 真值完整替换调用方值；无持久化授权时清空。过滤后需要收窄既有授权但持久化失败时，必须 fail closed，不得创建带分裂授权状态的 runtime。prepareDirectoryGrantsForBootstrap已在唯一bootstrapSession中、maker.createSession之前执行；direct create、lazy-send 与 rehydrate 均复用该入口。该边界由 commit68dccf27a落地。extraDirs的既有只读引用校验不在本裁决中升级为可写授权。Chris 于 2026-08-29 明确批准本口径。全部 Shell 写目标真实路径确认
cp／mv／install、tee、sed／perl -i、归档／下载落盘、PowerShell 写 cmdlet 与 pipeline。三套 harness 必须共用同一边界。writableRoots后，必须在实际执行主机同时解析目标与授权根的最近存在祖先 realpath。真实目标越出命中的授权根、落入系统目录或凭证路径、目标／授权根无法解析，或远端执行端无法提供真实路径证据时，一律prompt-each-time；普通词法区外写仍保持既有灰区，不得被真实路径反向洗绿。a496b675已让systemWriteTargetsInSegment和 PowerShell pipeline 将所有已提取目标统一交给writeTargetNeedsConsent；Pi、Claude、Codex 的远端入口均标记 unavailable 并复用共享reviewAction。echo >、cp、tee、sed -i、PowerShellSet-Content与 pipeline 越界，合法授权根内写保持既有判档；远端不可取证覆盖cpfail-closed，三 harness remote wiring 亦有回归。当前 head 的 maker-core、Linux 与 Windows CI 已通过。无法静态提取目标的解释器或自定义命令仍至少进入 reviewer 灰区，不会因本规则成为自动批准。Chris 于 2026-08-29 明确批准本口径。授权回滚失败安全关闭确认
extraDirs／writableDirs更新共用该语义，并在同一 session 锁内执行。关闭直接调用 Main 的maker.closeSession(sessionId)，不经会重入锁的 IPC。f5b7303a的applyRemoteDirectoryGrantUpdate已在 persistence rollback 与首次 runtime apply rollback 两个失败分支调用注入的terminate()；register.ts为本地和远端统一注入maker.closeSession(sessionId)，AggregateError 保留原始持久化、回滚及关闭错误。Main 签发 writable grant 授权模型确认
a496b675落地 Main picker grant、setter/create 消费与 DB update gate；commit68dccf27a补齐 bootstrap/持久化和远端边界。当前 head 已封住无 picker 的 raw-path 扩权。Mobile 控制面范围裁决
Pi 目录授权持久化窗口确认
悬空链接写目标 fail-closed 确认
本地只读／可写目录更新串行化确认