feat(permissions): add unified permission controls across product surfaces#1663
Merged
Conversation
- Remove updated_input from tool confirmation requests and platform APIs - Delete backend task-argument mutation during tool confirmation - Stop Web UI and HarmonyOS clients from forwarding or rewriting tool input - Preserve existing confirm and reject behavior across all product surfaces - Update serialization, runtime, remote-connect, desktop, and frontend tests
- Add allow, ask, and deny permission rule contracts - Support ordered global, project, and agent rule merging - Implement wildcard matching with normalized path separators - Support case-insensitive Windows resource matching - Apply last-matching-rule and default-ask semantics - Add atomic multi-resource deny, ask, and allow evaluation - Cover serialization, wildcard, ordering, and multi-resource behavior with tests
- Add permission request, reply, grant, source, and audit contracts - Define grant, audit, and atomic reply persistence ports - Implement process-local pending request and waiting-channel management - Support once, always, reject, request cancellation, and session cancellation - Clear remaining session requests when a permission is rejected - Persist project-scoped remembered grants with unique action-resource keys - Commit always grants and reply audit records atomically - Keep pending requests unresolved when persistence fails - Verify restart persistence, project isolation, audit idempotency, and fail-closed behavior
- expose pending permission requests, lifecycle events, and respond_permission through the runtime SDK - wire the shared permission request manager into Desktop and CLI runtimes - add Desktop commands and Web UI for listing, presenting, and replying to permission requests - add interactive and non-interactive CLI permission handling - preserve the legacy tool confirmation gate and response APIs
- add provider-neutral permission intents for file tool preflight - enforce V2 rules and remembered grants before file side effects - migrate Read, Write, Edit, and Delete to read/edit resource policies - require external_directory permission for local paths outside the workspace - preserve atomic multi-resource decisions for file patch operations - isolate grants by local and remote project identity - support once, always, reject, cancellation, and permission audit flows - keep legacy confirmation APIs and gates for unmigrated tools
- enforce V2 permissions for Bash and ExecCommand using exact commands - prevent wildcard allow rules from authorizing compound shell commands - add normalized Git operation and argument permission resources - add permission intents for WebFetch, WebSearch, Skill, and Task tools - scope task follow-up and cancellation permissions to target sessions - migrate review-agent launches to task permission policies - bypass the legacy gate only when a tool emits V2 permission intents - retain legacy confirmation for unmigrated command control tools
- enforce permission V2 for MCP, custom tools, MiniApp, and Computer Use - isolate remote workspace identities and remembered grants - remove legacy confirmation gates, channels, APIs, and PermissionPort - migrate CLI, Desktop, Web, Server, and ACP surfaces to V2 responses - remove skip-confirmation and confirmation-timeout configuration - update boundary contracts and add extension, remote isolation, and ACP UI tests
- Register the shared V2 permission request manager in the Desktop tool pipeline. - Add optional toolCallId correlation to PermissionRequest and preserve it through the pipeline. - Match pending permission requests to tool cards by exact tool-call ID. - Move the permission panel above ChatInput and align it with the input width. - Add warning styling for permission panels and pending tool cards. - Preserve legacy pending_confirmation rendering while removing tool-name-based matching. - Add Rust contract, pipeline, and FlowToolCard coverage for the new correlation behavior.
- Add ask and full_access permission policy presets. - Add static policy, interaction, and root tool permission config DTOs. - Expand presets into ordinary wildcard rules without bypassing evaluation. - Add ordered product/global/project/agent/enforced policy resolution. - Keep auto_approve_ask separate from static permission policy. - Ignore legacy skip_tool_confirmation instead of migrating its behavior. - Expose the new contracts through runtime ports. - Add coverage for defaults, serialization, layer precedence, and enforced denies.
- load project permission rules from `.bitfun/config/tool_permissions.json` - support local and remote workspace permission configuration - inject workspace-scoped rules into tool execution resolution - retain global and agent profile permission layering - preserve agent permission rules during profile canonicalization - add project permission parsing and workspace path tests - align frontend permission configuration types
- inject auto approve interaction policy into tool execution options - reply to ask requests through the V2 permission manager - record once replies with the AutoApprove audit source - avoid remembered grants for automatically approved requests - preserve deny and cancellation enforcement - keep CLI auto approval invocation-scoped - remove duplicate CLI permission reply handling
- add shared web permission config service with safe defaults - expose ask and full_access modes in session permissions settings - require danger confirmation before enabling full access - add independent auto approve ask toggle - show dismissible Auto status in the ChatInput toolbar - keep ACP sessions outside native BitFun Auto mode - add localized settings and ChatInput labels - add permission config normalization and persistence tests
- add project-scoped grant listing, removal, and clearing APIs - expose paginated project permission audit records - derive permission project identity from validated workspace metadata - project grant commands through runtime SDK and Desktop adapters - declare remote workspace policies for grant management commands - add remembered grant management and audit views to permission settings - add localized confirmation flows and project isolation coverage
- inherit the user Auto preference in interactive TUI sessions - add session-scoped Auto enable, disable, reset, and status controls - prevent Auto mode changes while a turn is already processing - project permission requests, replies, grants, and audit through CLI Peer Host - resolve permission project identity on the execution-side workspace - fan out V2 permission lifecycle events through Desktop and CLI Peer transport - fail closed when the final controller disconnects or event continuity is lost - prioritize permission control commands on Peer Device transport
- add a persistent permission mode selector to the chat input status bar - support Ask, Auto Approve, Full Access, and ACP-controlled states - fix V2 permission request ID serialization and frontend state cleanup - handle auto-approved requests non-interactively to prevent permission prompt flashes - allow low-risk reads, browsing, Task, Skill, and read-only Git operations by default - keep file changes, commands, sensitive files, external directories, and unknown actions gated - update responsive styles, localized copy, and permission regression tests
- Add stable parent session, dialog turn, Task call, and subagent identity fields. - Re-export delegation metadata through runtime ports, the Agent Runtime SDK, and Web API types. - Preserve top-level and legacy request compatibility with optional-field serialization tests.
- Populate V2 permission requests from the existing subagent parent context. - Preserve registration order across pending snapshots, rejection, and session cancellation. - Add coverage for top-level, interactive, auto-approved, and cancelled subagent requests.
- Route delegated permission requests to their owning parent session while isolating unrelated sessions. - Highlight parent Task cards with delegation call IDs and clear waiting state on reply or cancellation. - Add localized subagent context and regression coverage for queues, session switches, and stale snapshots.
- Route delegated permission asks to the owning chat and queue parallel requests without loss. - Show child and parent lineage in TUI prompts while preserving reply and cancellation by request ID. - Reject owned child asks in non-interactive exec with lineage diagnostics while keeping auto approval backend-driven.
- add a validated permission runtime ceiling contract that rejects allow rules - derive child policies in global, project, profile, ceiling, and enforced order - propagate parent deny and external-directory restrictions into subagent execution - cover ceiling validation, policy precedence, and reused-session propagation
- forward invocation-scoped approval settings through an explicit context allowlist - preserve true, false, and unset semantics across foreground, background, forked, and resumed runs - route delegated permission requests through CLI Peer Host and ACP parent-session ownership - add regression coverage for non-interactive approval and cross-surface session isolation
- Stop cascading reject replies across pending requests in the same session. - Keep sibling tool permission requests pending for independent decisions. - Add manager contract coverage for isolated rejection behavior. - Add parallel tool pipeline coverage to verify rejected tools do not block siblings.
- Add required roundId and order metadata to V2 permission requests. - Propagate model tool-call order through the tool execution pipeline. - Order permission snapshots and Web/Desktop routing within each round. - Keep CLI/TUI single-request flows ordered by round metadata. - Add synthetic batches for non-BitFun permission fixtures and update contracts.
- Add atomic batch registration with ordered Asked events. - Pre-plan tool permissions before starting parallel execution. - Assign each tool a prepared permission gate for independent decisions. - Roll back pending requests when batch auditing or approval fails. - Preserve cancellation, rejection, auto-approval, and subagent behavior.
- Add atomic current-and-following permission replies scoped to one session round. - Expose batch responses through Desktop and Peer Device transports. - Aggregate ordered Web permission requests into a single round panel. - Add single and batch allow or reject controls with atomic frontend state updates. - Keep delegated rounds isolated and preserve the existing CLI/TUI confirmation flow. - Cover batch boundaries, persistence failures, grants, routing, and UI synchronization.
- Add user-presentable workspace paths to V2 permission requests. - Rework aggregated approvals with compact action and resource rows. - Localize permission action labels and simplify batch approval controls. - Improve rejection feedback focus styling and permission tooltips.
- allow permission delegation to omit unavailable parent dialog turn IDs - restore persisted subagent delegation independently from lifecycle context - preserve delegation across execution rounds and tool invocation - cover partial lineage routing and stable wire serialization
- persist remembered grants and bounded audit records in SQLite - expose static project rule APIs for local and remote workspaces - move project permission management from settings to the workspace menu - add a unified panel for remembered grants and static project rules - remove the legacy permission audit view
Rename internal permission modules, DTOs, feature gates, and UI request state to versionless names across runtime, desktop, CLI, ACP, and Web UI. Update boundary rules and contracts, and replace the stale legacy skipToolConfirmation serialization assertion.
- expose a global rule editor in permission settings - label external-directory permission requests clearly - add localized copy and permission UI coverage
Separate user feedback from internal rejection reasons and return a dedicated permission_denied result for policy-blocked tool calls.
wsp1911
marked this pull request as ready for review
July 21, 2026 12:34
- replace absolute workspace path examples in localized permission rules - simplify the agent capability permission predicate for web lint - update Write fallback coverage for deterministic tool call filenames - complete the historical chat test mock for permission request subscriptions
This was referenced Jul 21, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Introduce a unified permission system for tool execution across product surfaces.
Fixes #
Type and Areas
Type:
Feature / refactor / UI/UX
Areas:
Rust core and contracts, execution runtime, services, desktop/Tauri, web UI, CLI/TUI, server/relay, ACP, and HarmonyOS mobile.
Motivation / Impact
Permission behavior was previously fragmented across tool implementations and product surfaces. This PR centralizes policy evaluation, approval state, persisted grants, and UI/API projections.
Users can configure global or project-level rules, select permission modes, and respond to scoped or batched approval requests. Subagents inherit delegated constraints without bypassing parent-session policy.
Verification
pnpm run fmt:rscargo check -p bitfun-core --features product-fullcargo test -p bitfun-core background_subagent --libcargo test -p bitfun-agent-runtime scheduler --libBroad Web, desktop, CLI, mobile, and end-to-end suites were not run locally; rely on CI for those surfaces.
Reviewer Notes
Checklist