feat: add conversation-bound permission modes and tool approval flow

config/limits.py

@@ -41,6 +41,45 @@ READ_TOOL_MAX_MATCHES = 50
 PROJECT_MAX_STORAGE_MB = int(os.environ.get("PROJECT_MAX_STORAGE_MB", "2048"))
 PROJECT_MAX_STORAGE_BYTES = PROJECT_MAX_STORAGE_MB * 1024 * 1024
 
+# 只读权限模式：run_command 白名单配置
+READONLY_RUN_COMMAND_ALLOWED = (
+    "grep",
+    "find",
+    "ls",
+    "pwd",
+    "tree",
+    "cat",
+    "head",
+    "tail",
+    "less",
+    "rg",
+    "wc",
+    "du",
+    "stat",
+    "file",
+    "sed",
+    "awk",
+    "git",
+)
+READONLY_RUN_COMMAND_ALLOWED_GIT_SUBCOMMANDS = (
+    "status",
+    "log",
+    "diff",
+    "show",
+    "branch",
+    "rev-parse",
+)
+READONLY_RUN_COMMAND_BLOCKED_TOKENS = (
+    "&&",
+    "||",
+    ";",
+    "|",
+    ">",
+    "<",
+    "$(",
+    "`",
+)
+
 __all__ = [
     "MAX_CONTEXT_SIZE",
     "MAX_FILE_SIZE",
@@ -70,4 +109,7 @@ __all__ = [
     "READ_TOOL_MAX_MATCHES",
     "PROJECT_MAX_STORAGE_MB",
     "PROJECT_MAX_STORAGE_BYTES",
+    "READONLY_RUN_COMMAND_ALLOWED",
+    "READONLY_RUN_COMMAND_ALLOWED_GIT_SUBCOMMANDS",
+    "READONLY_RUN_COMMAND_BLOCKED_TOKENS",
 ]

core/main_terminal.py

@@ -176,6 +176,8 @@ class MainTerminal(MainTerminalCommandMixin, MainTerminalContextMixin, MainTermi
             self.skill_strict_sub_agent_enabled: bool = False
             self.skill_strict_run_command_foreground_enabled: bool = False
             self.skill_strict_run_command_background_enabled: bool = False
+            self.default_permission_mode: str = "unrestricted"
+            self.current_permission_mode: str = "unrestricted"
             # 当前生效的启用 skills（用于强约束判定）
             self.enabled_skill_ids: Set[str] = set()
             self.apply_personalization_preferences()
@@ -283,6 +285,9 @@ class MainTerminal(MainTerminalCommandMixin, MainTerminalContextMixin, MainTermi
             conversation_id = self.context_manager.start_new_conversation(
                 project_path=self.project_path,
                 thinking_mode=self.thinking_mode,
-                run_mode=self.run_mode
+                run_mode=self.run_mode,
+                metadata_overrides={
+                    "permission_mode": self.default_permission_mode or "unrestricted"
+                },
             )
             print(f"{OUTPUT_FORMATS['info']} 新建对话: {conversation_id}")

core/main_terminal_parts/context.py

@@ -19,6 +19,8 @@ try:
         TERMINAL_SANDBOX_MEMORY,
         PROJECT_MAX_STORAGE_MB,
         CUSTOM_TOOLS_ENABLED,
+        READONLY_RUN_COMMAND_ALLOWED,
+        READONLY_RUN_COMMAND_ALLOWED_GIT_SUBCOMMANDS,
     )
 except ImportError:
     import sys
@@ -39,6 +41,8 @@ except ImportError:
         TERMINAL_SANDBOX_MEMORY,
         PROJECT_MAX_STORAGE_MB,
         CUSTOM_TOOLS_ENABLED,
+        READONLY_RUN_COMMAND_ALLOWED,
+        READONLY_RUN_COMMAND_ALLOWED_GIT_SUBCOMMANDS,
     )
 
 from modules.file_manager import FileManager
@@ -295,6 +299,43 @@ class MainTerminalContextMixin:
                     "role": "system",
                     "content": disabled_notice
                 })
+            permission_mode = "unrestricted"
+            try:
+                permission_mode = self.get_permission_mode()
+            except Exception:
+                permission_mode = str(getattr(self, "current_permission_mode", "unrestricted") or "unrestricted")
+            permission_label_map = {
+                "readonly": "只读",
+                "approval": "批准",
+                "unrestricted": "无限制",
+            }
+            permission_rules_map = {
+                "readonly": "",
+                "approval": "可调用全部工具，但对工作区文件进行修改的工具需经用户批准后执行；若 run_command/terminal_input 属于只读白名单命令则可直接执行；若用户拒绝，工具循环会停止。",
+                "unrestricted": "工具按常规流程执行，不额外拦截。",
+            }
+            readonly_cmds = [cmd for cmd in (READONLY_RUN_COMMAND_ALLOWED or ()) if cmd not in {"git"}]
+            readonly_cmds_text = "/".join(readonly_cmds) if readonly_cmds else "grep/find"
+            git_readonly_text = "/".join(READONLY_RUN_COMMAND_ALLOWED_GIT_SUBCOMMANDS or ())
+            permission_rules_map["readonly"] = (
+                "只允许读取/检索类工具；修改工作区的工具将被拒绝。"
+                f"run_command 仅允许只读命令（{readonly_cmds_text}，"
+                f"以及 git {git_readonly_text}），且禁止多指令拼接。"
+            )
+            permission_prompt = self.load_prompt("permission_mode")
+            if permission_prompt:
+                try:
+                    rendered_permission = permission_prompt.format(
+                        permission_mode=permission_mode,
+                        permission_mode_label=permission_label_map.get(permission_mode, permission_mode),
+                        permission_rules=permission_rules_map.get(permission_mode, permission_rules_map["unrestricted"]),
+                    )
+                    messages.append({
+                        "role": "system",
+                        "content": rendered_permission,
+                    })
+                except Exception:
+                    pass
             if shallow_replace_enabled:
                 print(f"[ContextCompression] build_messages 替换tool占位符: {replaced_tool_count} 条")
             return messages

core/main_terminal_parts/tools_execution.py

@@ -20,6 +20,9 @@ try:
         TERMINAL_SANDBOX_MEMORY,
         PROJECT_MAX_STORAGE_MB,
         CUSTOM_TOOLS_ENABLED,
+        READONLY_RUN_COMMAND_ALLOWED,
+        READONLY_RUN_COMMAND_ALLOWED_GIT_SUBCOMMANDS,
+        READONLY_RUN_COMMAND_BLOCKED_TOKENS,
     )
 except ImportError:
     import sys
@@ -40,6 +43,9 @@ except ImportError:
         TERMINAL_SANDBOX_MEMORY,
         PROJECT_MAX_STORAGE_MB,
         CUSTOM_TOOLS_ENABLED,
+        READONLY_RUN_COMMAND_ALLOWED,
+        READONLY_RUN_COMMAND_ALLOWED_GIT_SUBCOMMANDS,
+        READONLY_RUN_COMMAND_BLOCKED_TOKENS,
     )
 
 from modules.file_manager import FileManager
@@ -98,6 +104,33 @@ class MainTerminalToolsExecutionMixin:
         "terminate_sub_agent",
         "get_sub_agent_status",
     }
+    _READONLY_ALLOWED_TOOLS = {
+        "web_search",
+        "extract_webpage",
+        "read_file",
+        "view_image",
+        "view_video",
+        "vlm_analyze",
+        "ocr_image",
+        "update_memory",
+        "todo_create",
+        "todo_update_task",
+        "todo_get",
+        "sleep",
+    }
+    _APPROVAL_REQUIRED_TOOLS = {
+        "run_command",
+        "run_python",
+        "terminal_input",
+        "write_file",
+        "edit_file",
+        "create_file",
+        "create_folder",
+        "delete_file",
+        "rename_file",
+        "save_webpage",
+        "terminal_session",
+    }
 
     def _record_sub_agent_message(self, message: Optional[str], task_id: Optional[str] = None, inline: bool = False):
                 """以 system 消息记录子智能体状态。"""
@@ -119,6 +152,79 @@ class MainTerminalToolsExecutionMixin:
                 self.context_manager.add_conversation("system", message, metadata=metadata)
                 print(f"{OUTPUT_FORMATS['info']} {message}")
 
+    def _is_readonly_run_command_allowed(self, command: Any) -> bool:
+                cmd = str(command or "").strip()
+                if not cmd:
+                    return False
+                lowered = cmd.lower()
+                forbidden = list(READONLY_RUN_COMMAND_BLOCKED_TOKENS)
+                if any(token in cmd for token in forbidden):
+                    return False
+                parts = cmd.split()
+                if not parts:
+                    return False
+
+                executable = parts[0].lower()
+                basic_allowed = set(READONLY_RUN_COMMAND_ALLOWED or ())
+                if executable in basic_allowed and executable not in {"git", "sed", "awk"}:
+                    return True
+
+                if executable == "git":
+                    if len(parts) < 2:
+                        return False
+                    git_sub = parts[1].lower()
+                    return git_sub in set(READONLY_RUN_COMMAND_ALLOWED_GIT_SUBCOMMANDS or ())
+
+                if executable == "sed":
+                    return len(parts) >= 2 and parts[1] == "-n"
+
+                if executable == "awk":
+                    # 只读模式下允许基础文本处理，但拒绝 awk 的命令执行能力
+                    return "system(" not in lowered
+
+                return False
+
+    def evaluate_tool_permission(self, tool_name: str, arguments: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
+                mode = "unrestricted"
+                try:
+                    mode = self.get_permission_mode()
+                except Exception:
+                    mode = str(getattr(self, "current_permission_mode", "unrestricted") or "unrestricted")
+                args = arguments or {}
+
+                if mode == "readonly":
+                    if tool_name == "run_command":
+                        if self._is_readonly_run_command_allowed(args.get("command")):
+                            return {"allowed": True, "mode": mode}
+                        return {
+                            "allowed": False,
+                            "mode": mode,
+                            "code": "readonly_denied",
+                            "message": (
+                                "当前处于只读模式：run_command 仅允许只读命令"
+                                "（grep/find/ls/cat/rg/git status 等）且禁止多指令拼接。"
+                            )
+                        }
+                    if tool_name not in self._READONLY_ALLOWED_TOOLS:
+                        return {
+                            "allowed": False,
+                            "mode": mode,
+                            "code": "readonly_denied",
+                            "message": "当前处于只读模式，已拒绝会修改工作区或执行高风险操作的工具调用。"
+                        }
+                    return {"allowed": True, "mode": mode}
+
+                if mode == "approval":
+                    if tool_name in {"run_command", "terminal_input"}:
+                        command_text = args.get("command") or args.get("input")
+                        if self._is_readonly_run_command_allowed(command_text):
+                            return {"allowed": True, "mode": mode, "requires_approval": False}
+                    if tool_name in self._APPROVAL_REQUIRED_TOOLS:
+                        return {"allowed": True, "mode": mode, "requires_approval": True}
+                    return {"allowed": True, "mode": mode}
+
+                return {"allowed": True, "mode": mode}
+
     @staticmethod
     def _skill_meta_key(skill_id: str) -> str:
                 return f"skill_read::{skill_id}"
@@ -664,6 +770,10 @@ class MainTerminalToolsExecutionMixin:
                             path=arguments["path"],
                             file_type=arguments["file_type"]
                         )
+                        if isinstance(result, dict) and result.get("success"):
+                            # create_file 新建文件后，视为当前会话已“接触”该文件，
+                            # 避免后续 write_file/edit_file 被“先 read_file 再编辑”误拦截。
+                            self._mark_file_as_read_visited(result.get("path") or arguments.get("path"))
                         # 添加备注
                         if result["success"] and arguments.get("annotation"):
                             self.context_manager.update_annotation(

core/main_terminal_parts/tools_policy.py

@@ -83,6 +83,7 @@ from config.model_profiles import (
 
 logger = setup_logger(__name__)
 DISABLE_LENGTH_CHECK = True
+PERMISSION_MODES = {"readonly", "approval", "unrestricted"}
 
 class MainTerminalToolsPolicyMixin:
     def apply_personalization_preferences(self, config: Optional[Dict[str, Any]] = None):
@@ -160,6 +161,40 @@ class MainTerminalToolsPolicyMixin:
 
                 # 静默禁用工具提示
                 self.silent_tool_disable = bool(effective_config.get("silent_tool_disable"))
+                permission_mode = effective_config.get("default_permission_mode")
+                if isinstance(permission_mode, str) and permission_mode in PERMISSION_MODES:
+                    self.default_permission_mode = permission_mode
+                else:
+                    self.default_permission_mode = "unrestricted"
+                if not getattr(self, "current_permission_mode", None):
+                    self.current_permission_mode = self.default_permission_mode
+
+    def get_permission_mode(self) -> str:
+                mode = str(getattr(self, "current_permission_mode", "unrestricted") or "unrestricted")
+                if mode not in PERMISSION_MODES:
+                    return "unrestricted"
+                return mode
+
+    def set_permission_mode(self, mode: str, *, persist: bool = True, conversation_id: Optional[str] = None) -> str:
+                normalized = str(mode or "").strip().lower()
+                if normalized not in PERMISSION_MODES:
+                    raise ValueError("无效权限模式，仅支持 readonly / approval / unrestricted")
+                self.current_permission_mode = normalized
+                if not persist:
+                    return normalized
+
+                conv_id = conversation_id or getattr(getattr(self, "context_manager", None), "current_conversation_id", None)
+                if conv_id and getattr(self, "context_manager", None):
+                    try:
+                        self.context_manager.conversation_manager.update_conversation_metadata(
+                            conv_id,
+                            {"permission_mode": normalized},
+                        )
+                        if self.context_manager.current_conversation_id == conv_id:
+                            self.context_manager.conversation_metadata["permission_mode"] = normalized
+                    except Exception:
+                        pass
+                return normalized
 
     def set_tool_category_enabled(self, category: str, enabled: bool) -> None:
                 """设置工具类别的启用状态 / Toggle tool category enablement."""

core/web_terminal.py

@@ -130,6 +130,7 @@ class WebTerminal(MainTerminal):
                 logger.warning("忽略无效默认模型 %s: %s", preferred_model, exc)
 
             preferred_mode = prefs.get("default_run_mode")
+            preferred_permission_mode = prefs.get("default_permission_mode") or "unrestricted"
             if isinstance(preferred_mode, str) and preferred_mode.lower() in {"fast", "thinking", "deep"}:
                 try:
                     self.set_run_mode(preferred_mode.lower())
@@ -138,6 +139,10 @@ class WebTerminal(MainTerminal):
             else:
                 # 未配置默认模式时回到快速模式
                 self.set_run_mode("fast")
+            try:
+                self.set_permission_mode(preferred_permission_mode, persist=False)
+            except Exception:
+                self.set_permission_mode("unrestricted", persist=False)
             thinking_mode = self.thinking_mode
 
         if isinstance(run_mode, str):
@@ -160,7 +165,10 @@ class WebTerminal(MainTerminal):
             conversation_id = self.context_manager.start_new_conversation(
                 project_path=self.project_path,
                 thinking_mode=thinking_mode,
-                run_mode=self.run_mode
+                run_mode=self.run_mode,
+                metadata_overrides={
+                    "permission_mode": self.get_permission_mode(),
+                },
             )
 
             # 重置相关状态
@@ -320,6 +328,7 @@ class WebTerminal(MainTerminal):
             "thinking_status": self.get_thinking_mode_status(),
             "run_mode": self.run_mode,
             "model_key": getattr(self, "model_key", None),
+            "permission_mode": self.get_permission_mode() if hasattr(self, "get_permission_mode") else "unrestricted",
             "has_images": getattr(self.context_manager, "has_images", False),
             "has_videos": getattr(self.context_manager, "has_videos", False),
             "context": {

modules/personalization_manager.py

@@ -16,6 +16,7 @@ from core.tool_config import TOOL_CATEGORIES
 from config.model_profiles import get_registered_model_keys
 
 ALLOWED_RUN_MODES = {"fast", "thinking", "deep"}
+ALLOWED_PERMISSION_MODES = {"readonly", "approval", "unrestricted"}
 
 PERSONALIZATION_FILENAME = "personalization.json"
 MAX_SHORT_FIELD_LENGTH = 20
@@ -51,6 +52,7 @@ DEFAULT_PERSONALIZATION_CONFIG: Dict[str, Any] = {
     "enabled_skills": None,
     "skills_catalog_snapshot": None,
     "default_run_mode": None,
+    "default_permission_mode": "unrestricted",
     "auto_generate_title": True,
     "tool_intent_enabled": True,
     "skill_hints_enabled": False,  # Skill 提示系统开关（默认关闭）
@@ -83,6 +85,7 @@ __all__ = [
     "sanitize_personalization_payload",
     "resolve_context_compression_settings",
     "validate_context_compression_settings",
+    "ALLOWED_PERMISSION_MODES",
 ]
 
 
@@ -224,6 +227,12 @@ def sanitize_personalization_payload(
     else:
         base["default_run_mode"] = _sanitize_run_mode(base.get("default_run_mode"))
 
+    permission_mode = data.get("default_permission_mode", base.get("default_permission_mode"))
+    if isinstance(permission_mode, str) and permission_mode in ALLOWED_PERMISSION_MODES:
+        base["default_permission_mode"] = permission_mode
+    elif base.get("default_permission_mode") not in ALLOWED_PERMISSION_MODES:
+        base["default_permission_mode"] = "unrestricted"
+
     # 默认模型
     chosen_model = data.get("default_model", base.get("default_model"))
     if isinstance(chosen_model, str) and chosen_model in allowed_models:

modules/tool_approval_manager.py

@@ -0,0 +1,79 @@
+from __future__ import annotations
+
+import threading
+import time
+import uuid
+from typing import Any, Dict, List, Optional
+
+
+class ToolApprovalManager:
+    def __init__(self):
+        self._items: Dict[str, Dict[str, Any]] = {}
+        self._lock = threading.Lock()
+
+    def create_request(
+        self,
+        *,
+        username: str,
+        conversation_id: Optional[str],
+        task_id: Optional[str],
+        tool_call_id: Optional[str],
+        tool_name: str,
+        arguments: Dict[str, Any],
+        preview: Dict[str, Any],
+    ) -> Dict[str, Any]:
+        approval_id = f"approval_{uuid.uuid4().hex}"
+        item = {
+            "approval_id": approval_id,
+            "username": username,
+            "conversation_id": conversation_id,
+            "task_id": task_id,
+            "tool_call_id": tool_call_id,
+            "tool_name": tool_name,
+            "arguments": arguments or {},
+            "preview": preview or {},
+            "status": "pending",
+            "created_at": time.time(),
+            "decided_at": None,
+            "decision": None,
+        }
+        with self._lock:
+            self._items[approval_id] = item
+        return dict(item)
+
+    def get(self, approval_id: str) -> Optional[Dict[str, Any]]:
+        with self._lock:
+            item = self._items.get(approval_id)
+            return dict(item) if item else None
+
+    def list_pending(self, username: str, conversation_id: Optional[str] = None) -> List[Dict[str, Any]]:
+        with self._lock:
+            rows = []
+            for item in self._items.values():
+                if item.get("username") != username:
+                    continue
+                if item.get("status") != "pending":
+                    continue
+                if conversation_id and item.get("conversation_id") != conversation_id:
+                    continue
+                rows.append(dict(item))
+            rows.sort(key=lambda x: x.get("created_at", 0.0))
+            return rows
+
+    def decide(self, approval_id: str, username: str, decision: str) -> Dict[str, Any]:
+        normalized = str(decision or "").strip().lower()
+        if normalized not in {"approved", "rejected"}:
+            raise ValueError("decision 仅支持 approved / rejected")
+        with self._lock:
+            item = self._items.get(approval_id)
+            if not item:
+                raise KeyError("审批请求不存在")
+            if item.get("username") != username:
+                raise PermissionError("无权限操作该审批请求")
+            if item.get("status") != "pending":
+                return dict(item)
+            item["status"] = normalized
+            item["decision"] = normalized
+            item["decided_at"] = time.time()
+            return dict(item)
+

prompts/permission_mode.txt

@@ -0,0 +1,4 @@
+## 权限模式约束（始终生效）
+- 当前权限模式：{permission_mode_label}（{permission_mode}）
+- 执行规则：{permission_rules}
+- 注意：工具始终可见；若超出权限，调用会返回拒绝或等待批准结果。

server/chat.py

@@ -33,6 +33,7 @@ from .context import with_terminal, get_gui_manager, get_upload_guard, build_upl
 from .security import rate_limited, prune_socket_tokens
 from .utils_common import debug_log
 from .state import PROJECT_MAX_STORAGE_MB, THINKING_FAILURE_KEYWORDS, pending_socket_tokens, SOCKET_TOKEN_TTL_SECONDS
+from .state import tool_approval_manager
 from .extensions import socketio
 from .monitor import get_cached_monitor_snapshot
 from .files import sanitize_filename_preserve_unicode
@@ -41,6 +42,8 @@ UPLOAD_FOLDER_NAME = "user_upload"
 
 chat_bp = Blueprint('chat', __name__)
 
+PERMISSION_MODE_OPTIONS = ["readonly", "approval", "unrestricted"]
+
 @chat_bp.route('/api/thinking-mode', methods=['POST'])
 @api_login_required
 @with_terminal
@@ -584,6 +587,94 @@ def tool_settings(terminal: WebTerminal, workspace: UserWorkspace, username: str
             "error": str(exc)
         }), 400
 
+
+@chat_bp.route('/api/permission-mode', methods=['GET'])
+@api_login_required
+@with_terminal
+def get_permission_mode(terminal: WebTerminal, workspace: UserWorkspace, username: str):
+    """获取当前权限模式。"""
+    current_conversation_id = getattr(terminal.context_manager, "current_conversation_id", None)
+    return jsonify({
+        "success": True,
+        "mode": terminal.get_permission_mode() if hasattr(terminal, "get_permission_mode") else "unrestricted",
+        "options": PERMISSION_MODE_OPTIONS,
+        "conversation_id": current_conversation_id,
+    })
+
+
+@chat_bp.route('/api/permission-mode', methods=['POST'])
+@api_login_required
+@with_terminal
+@rate_limited("permission_mode_switch", 30, 60, scope="user")
+def update_permission_mode(terminal: WebTerminal, workspace: UserWorkspace, username: str):
+    """更新当前对话权限模式。"""
+    data = request.get_json() or {}
+    target_mode = str(data.get("mode") or "").strip().lower()
+    if target_mode not in PERMISSION_MODE_OPTIONS:
+        return jsonify({
+            "success": False,
+            "error": "无效权限模式，仅支持 readonly / approval / unrestricted"
+        }), 400
+    try:
+        applied_mode = terminal.set_permission_mode(target_mode, persist=True)
+    except Exception as exc:
+        return jsonify({
+            "success": False,
+            "error": str(exc),
+            "message": "切换权限模式失败"
+        }), 500
+
+    session["permission_mode"] = applied_mode
+    status = terminal.get_status()
+    socketio.emit('status_update', status, room=f"user_{username}")
+    return jsonify({
+        "success": True,
+        "mode": applied_mode,
+        "options": PERMISSION_MODE_OPTIONS,
+        "conversation_id": getattr(terminal.context_manager, "current_conversation_id", None),
+    })
+
+
+@chat_bp.route('/api/tool-approvals/pending', methods=['GET'])
+@api_login_required
+@with_terminal
+def list_pending_tool_approvals(terminal: WebTerminal, workspace: UserWorkspace, username: str):
+    """获取当前用户待审批工具列表。"""
+    requested_conv_id = (request.args.get("conversation_id") or "").strip() or None
+    if requested_conv_id is None:
+        requested_conv_id = getattr(terminal.context_manager, "current_conversation_id", None)
+    items = tool_approval_manager.list_pending(username=username, conversation_id=requested_conv_id)
+    return jsonify({
+        "success": True,
+        "items": items,
+        "conversation_id": requested_conv_id,
+    })
+
+
+@chat_bp.route('/api/tool-approvals/<approval_id>/decision', methods=['POST'])
+@api_login_required
+@with_terminal
+@rate_limited("tool_approval_decision", 60, 60, scope="user")
+def decide_tool_approval(terminal: WebTerminal, workspace: UserWorkspace, username: str, approval_id: str):
+    """提交工具审批决策。"""
+    data = request.get_json() or {}
+    decision = str(data.get("decision") or "").strip().lower()
+    try:
+        item = tool_approval_manager.decide(approval_id=approval_id, username=username, decision=decision)
+    except ValueError as exc:
+        return jsonify({"success": False, "error": str(exc)}), 400
+    except KeyError:
+        return jsonify({"success": False, "error": "审批请求不存在"}), 404
+    except PermissionError as exc:
+        return jsonify({"success": False, "error": str(exc)}), 403
+    except Exception as exc:
+        return jsonify({"success": False, "error": str(exc)}), 500
+
+    return jsonify({
+        "success": True,
+        "item": item,
+    })
+
 @chat_bp.route('/api/terminals')
 @api_login_required
 @with_terminal

server/chat_flow_task_main.py

@@ -1102,6 +1102,14 @@ async def handle_task_with_sender(terminal: WebTerminal, workspace: UserWorkspac
         if tool_loop_result.get("stopped"):
             finalize_user_work_timer()
             return
+        if tool_loop_result.get("approval_rejected"):
+            sender('task_stopped', {
+                'message': tool_loop_result.get("approval_message") or '操作被用户拒绝',
+                'reason': 'approval_rejected',
+                'conversation_id': conversation_id
+            })
+            finalize_user_work_timer()
+            return
         if tool_loop_result.get("deep_compressed"):
             deep_result = tool_loop_result.get("deep_result") or {}
             guide_message = (deep_result.get("guide_message") or "").strip()

server/chat_flow_tool_loop.py

@@ -3,10 +3,12 @@ from __future__ import annotations
 import asyncio
 import json
 import time
-from typing import Optional
+from pathlib import Path
+from typing import Optional, Dict, Any, List
 
 from .utils_common import debug_log, brief_log
 from .state import MONITOR_FILE_TOOLS, MONITOR_MEMORY_TOOLS, MONITOR_SNAPSHOT_CHAR_LIMIT, MONITOR_MEMORY_ENTRY_LIMIT
+from .state import tool_approval_manager
 from .monitor import cache_monitor_snapshot
 from .security import compact_web_search_result
 from .chat_flow_helpers import detect_tool_failure
@@ -18,6 +20,124 @@ from modules.personalization_manager import load_personalization_config, resolve
 from .deep_compression import run_deep_compression
 
 
+def _format_numbered_lines(lines: List[str], start_line_no: int) -> List[Dict[str, Any]]:
+    return [
+        {
+            "line_no": start_line_no + idx,
+            "content": line.rstrip("\n"),
+        }
+        for idx, line in enumerate(lines)
+    ]
+
+
+def _build_tool_approval_preview(web_terminal, function_name: str, arguments: Dict[str, Any]) -> Dict[str, Any]:
+    args = arguments or {}
+    preview: Dict[str, Any] = {
+        "type": function_name,
+        "tool_name": function_name,
+        "arguments": args,
+    }
+
+    if function_name == "edit_file":
+        file_path = args.get("file_path")
+        old_string = args.get("old_string")
+        new_string = args.get("new_string")
+        preview["file_path"] = file_path
+        if not file_path:
+            preview["summary"] = "缺少 file_path"
+            return preview
+        try:
+            valid, err, full_path = web_terminal.file_manager._validate_path(str(file_path))
+            if not valid or full_path is None:
+                preview["summary"] = err or "路径校验失败"
+                return preview
+            resolved_path = str(Path(full_path))
+            preview["resolved_path"] = resolved_path
+            if not full_path.exists() or not full_path.is_file():
+                preview["summary"] = "目标文件不存在，无法生成上下文预览"
+                return preview
+            content = full_path.read_text(encoding="utf-8", errors="ignore")
+            old_text = str(old_string or "")
+            new_text = str(new_string or "")
+            old_lines = old_text.splitlines()
+            new_lines = new_text.splitlines()
+            idx = content.find(old_text) if old_text else -1
+            if idx >= 0:
+                prefix = content[:idx]
+                start_line_no = prefix.count("\n") + 1
+                end_line_no = start_line_no + max(1, len(old_lines)) - 1
+                all_lines = content.splitlines()
+                before_start = max(1, start_line_no - 3)
+                before = all_lines[before_start - 1:start_line_no - 1]
+                after_end = min(len(all_lines), end_line_no + 3)
+                after = all_lines[end_line_no:after_end]
+                preview["edit_context"] = {
+                    "before": _format_numbered_lines(before, before_start),
+                    "old": _format_numbered_lines(old_lines or [""], start_line_no),
+                    "new": _format_numbered_lines(new_lines or [""], start_line_no),
+                    "after": _format_numbered_lines(after, end_line_no + 1),
+                    "old_start_line": start_line_no,
+                    "old_end_line": end_line_no,
+                }
+                preview["summary"] = f"编辑 {file_path} 第 {start_line_no}-{end_line_no} 行"
+            else:
+                preview["edit_context"] = {
+                    "before": [],
+                    "old": _format_numbered_lines(old_lines or [""], 1),
+                    "new": _format_numbered_lines(new_lines or [""], 1),
+                    "after": [],
+                    "old_start_line": None,
+                    "old_end_line": None,
+                }
+                preview["summary"] = "未在文件中定位到 old_string，显示原始替换内容"
+        except Exception as exc:
+            preview["summary"] = f"生成编辑预览失败: {exc}"
+        return preview
+
+    if function_name in {"run_command", "terminal_input"}:
+        preview["command"] = args.get("command")
+        preview["summary"] = f"执行命令: {args.get('command') or ''}"
+        return preview
+
+    if function_name in {"create_file", "create_folder", "delete_file"}:
+        preview["path"] = args.get("path")
+        preview["summary"] = f"{function_name}: {args.get('path') or ''}"
+        return preview
+
+    if function_name == "rename_file":
+        preview["old_path"] = args.get("old_path")
+        preview["new_path"] = args.get("new_path")
+        preview["summary"] = f"rename_file: {args.get('old_path') or ''} -> {args.get('new_path') or ''}"
+        return preview
+
+    if function_name == "write_file":
+        content = str(args.get("content") or "")
+        preview["file_path"] = args.get("file_path")
+        preview["append"] = bool(args.get("append", False))
+        preview["content_preview"] = content[:4000]
+        preview["content_length"] = len(content)
+        preview["summary"] = f"write_file: {args.get('file_path') or ''} ({'append' if preview['append'] else 'overwrite'})"
+        return preview
+
+    return preview
+
+
+async def _wait_for_tool_approval(*, approval_id: str, username: str, timeout_seconds: float = 3600.0) -> Dict[str, Any]:
+    started = time.time()
+    while True:
+        row = tool_approval_manager.get(approval_id)
+        if not row:
+            return {"decision": "rejected", "reason": "审批请求不存在"}
+        if row.get("username") != username:
+            return {"decision": "rejected", "reason": "审批请求用户不匹配"}
+        status = row.get("status")
+        if status in {"approved", "rejected"}:
+            return {"decision": status, "item": row}
+        if (time.time() - started) >= timeout_seconds:
+            return {"decision": "rejected", "reason": "审批超时"}
+        await asyncio.sleep(0.2)
+
+
 async def execute_tool_calls(*, web_terminal, tool_calls, sender, messages, client_sid: str, username: str, iteration: int, conversation_id: Optional[str], last_tool_call_time: float, process_sub_agent_updates, process_background_command_updates, maybe_mark_failure_from_message, mark_force_thinking, get_stop_flag, clear_stop_flag, workspace=None):
     previous_tool_loop_active = getattr(web_terminal, "_tool_loop_active", False)
     web_terminal._tool_loop_active = True
@@ -182,6 +302,115 @@ async def execute_tool_calls(*, web_terminal, tool_calls, sender, messages, clie
 
         debug_log(f"执行工具: {function_name} (ID: {tool_call_id})")
 
+        permission_eval = web_terminal.evaluate_tool_permission(function_name, arguments)
+        if not permission_eval.get("allowed", True):
+            denied_message = permission_eval.get("message") or "当前权限模式不允许执行该工具。"
+            denied_payload = {
+                "success": False,
+                "status": "denied",
+                "code": permission_eval.get("code") or "permission_denied",
+                "tool": function_name,
+                "mode": permission_eval.get("mode"),
+                "message": denied_message,
+            }
+            sender('update_action', {
+                'preparing_id': tool_call_id,
+                'status': 'completed',
+                'result': denied_payload,
+                'message': denied_message,
+                'conversation_id': conversation_id
+            })
+            denied_content = json.dumps(denied_payload, ensure_ascii=False)
+            web_terminal.context_manager.add_conversation(
+                "tool",
+                denied_content,
+                tool_call_id=tool_call_id,
+                name=function_name
+            )
+            messages.append({
+                "role": "tool",
+                "tool_call_id": tool_call_id,
+                "name": function_name,
+                "content": denied_content
+            })
+            continue
+
+        if permission_eval.get("requires_approval"):
+            approval_preview = _build_tool_approval_preview(web_terminal, function_name, arguments)
+            approval_item = tool_approval_manager.create_request(
+                username=username,
+                conversation_id=conversation_id,
+                task_id=getattr(web_terminal, "task_id", None),
+                tool_call_id=tool_call_id,
+                tool_name=function_name,
+                arguments=arguments,
+                preview=approval_preview,
+            )
+            sender('tool_approval_required', {
+                'approval': approval_item,
+                'conversation_id': conversation_id,
+            })
+            sender('update_action', {
+                'preparing_id': tool_call_id,
+                'status': 'awaiting_approval',
+                'result': {
+                    "success": False,
+                    "status": "awaiting_approval",
+                    "approval_id": approval_item.get("approval_id"),
+                    "message": "等待用户审批"
+                },
+                'message': '等待用户审批',
+                'conversation_id': conversation_id
+            })
+            wait_result = await _wait_for_tool_approval(
+                approval_id=approval_item.get("approval_id"),
+                username=username,
+            )
+            sender('tool_approval_resolved', {
+                'approval_id': approval_item.get("approval_id"),
+                'decision': wait_result.get("decision"),
+                'conversation_id': conversation_id,
+            })
+            if wait_result.get("decision") != "approved":
+                reject_message = "操作被用户拒绝"
+                if wait_result.get("reason") == "审批超时":
+                    reject_message = "审批超时，操作未执行"
+                reject_payload = {
+                    "success": False,
+                    "status": "rejected",
+                    "code": "approval_rejected",
+                    "tool": function_name,
+                    "message": reject_message,
+                    "approval_id": approval_item.get("approval_id"),
+                }
+                sender('update_action', {
+                    'preparing_id': tool_call_id,
+                    'status': 'completed',
+                    'result': reject_payload,
+                    'message': reject_message,
+                    'conversation_id': conversation_id
+                })
+                reject_content = json.dumps(reject_payload, ensure_ascii=False)
+                web_terminal.context_manager.add_conversation(
+                    "tool",
+                    reject_content,
+                    tool_call_id=tool_call_id,
+                    name=function_name
+                )
+                messages.append({
+                    "role": "tool",
+                    "tool_call_id": tool_call_id,
+                    "name": function_name,
+                    "content": reject_content
+                })
+                web_terminal._tool_loop_active = previous_tool_loop_active
+                return {
+                    "stopped": False,
+                    "approval_rejected": True,
+                    "approval_message": reject_message,
+                    "last_tool_call_time": last_tool_call_time
+                }
+
         # 发送工具开始事件
         tool_display_id = f"tool_{iteration}_{function_name}_{time.time()}"
         monitor_snapshot = None

server/state.py

@@ -13,6 +13,7 @@ from modules.usage_tracker import UsageTracker
 from modules.user_container_manager import UserContainerManager
 from modules.user_manager import UserManager
 from modules.api_user_manager import ApiUserManager
+from modules.tool_approval_manager import ToolApprovalManager
 
 # 全局实例
 user_manager = UserManager()
@@ -26,6 +27,7 @@ RECENT_UPLOAD_EVENT_LIMIT = 150
 RECENT_UPLOAD_FEED_LIMIT = 60
 stop_flags: Dict[str, Dict[str, Any]] = {}
 active_polling_tasks: Dict[str, bool] = {}  # conversation_id -> is_polling
+tool_approval_manager = ToolApprovalManager()
 
 # 监控/限流/用量
 MONITOR_FILE_TOOLS = {'write_file', 'edit_file'}
@@ -88,6 +90,7 @@ __all__ = [
     "pending_socket_tokens",
     "usage_trackers",
     "active_login_nonces",
+    "tool_approval_manager",
     "MONITOR_SNAPSHOT_CACHE",
     "MONITOR_SNAPSHOT_CACHE_LIMIT",
     "PROJECT_STORAGE_CACHE",

utils/context_manager.py

@@ -683,7 +683,13 @@ class ContextManager:
     # 新增：对话持久化相关方法
     # ===========================================
     
-    def start_new_conversation(self, project_path: str = None, thinking_mode: bool = False, run_mode: Optional[str] = None) -> str:
+    def start_new_conversation(
+        self,
+        project_path: str = None,
+        thinking_mode: bool = False,
+        run_mode: Optional[str] = None,
+        metadata_overrides: Optional[Dict[str, Any]] = None,
+    ) -> str:
         """
         开始新对话
         
@@ -721,7 +727,8 @@ class ContextManager:
             initial_messages=[],
             model_key=getattr(self.main_terminal, "model_key", None),
             has_images=False,
-            has_videos=False
+            has_videos=False,
+            metadata_overrides=metadata_overrides,
         )
         
         # 重置当前状态
@@ -791,6 +798,7 @@ class ContextManager:
         self.project_path = resolved_project_path
         
         run_mode = metadata.get("run_mode")
+        permission_mode = metadata.get("permission_mode")
         model_key = metadata.get("model_key")
         self.has_images = metadata.get("has_images", False)
         self.has_videos = metadata.get("has_videos", False)
@@ -822,6 +830,11 @@ class ContextManager:
                     self.main_terminal.set_run_mode("fast")
             except Exception:
                 pass
+            try:
+                fallback_mode = getattr(self.main_terminal, "default_permission_mode", "unrestricted")
+                self.main_terminal.set_permission_mode(permission_mode or fallback_mode, persist=False)
+            except Exception:
+                pass
         
         print(f"📖 加载对话: {conversation_id} - {conversation_data.get('title', '未知标题')}")
         print(f"📊 包含 {len(self.conversation_history)} 条消息")
@@ -1153,7 +1166,10 @@ class ContextManager:
             run_mode=run_mode,
             initial_messages=[system_message],
             model_key=model_key,
-            has_images=has_images
+            has_images=has_images,
+            metadata_overrides={
+                "permission_mode": metadata.get("permission_mode", "unrestricted"),
+            },
         )
 
         # 设置压缩后的对话标题
@@ -1197,7 +1213,10 @@ class ContextManager:
             run_mode=run_mode,
             initial_messages=original_messages,
             model_key=model_key,
-            has_images=has_images
+            has_images=has_images,
+            metadata_overrides={
+                "permission_mode": metadata.get("permission_mode", "unrestricted"),
+            },
         )
 
         token_stats = conversation_data.get("token_statistics")

utils/conversation_manager.py

@@ -374,6 +374,7 @@ class ConversationManager:
             "thinking_mode": thinking_mode,
             "run_mode": normalized_mode,
             "model_key": model_key,
+            "permission_mode": "unrestricted",
             "has_images": has_images,
             "has_videos": has_videos,
             # 首次对话尚未生成文件树快照，待首次用户消息时填充