程序包 io.agentscope.core.permission

类 PermissionEngine

java.lang.Object
io.agentscope.core.permission.PermissionEngine
public final class PermissionEngine extends Object
Evaluates tool execution requests against configured permission rules.

Evaluation order:

  1. Tool-level deny rules (highest priority).
  2. Tool-level ask rules.
  3. Tool-specific checks (bypass-immune): EXPLORE/ACCEPT_EDITS read-only handling, dangerous path checks, plus whatever the tool's own ToolBase.checkPermissions(java.util.Map<java.lang.String, java.lang.Object>, io.agentscope.core.permission.PermissionContextState) returns.
  4. Tool-level allow rules.
  5. PermissionMode.BYPASS fallback.
  6. Default ASK (converted to DENY under PermissionMode.DONT_ASK).

The engine snapshots rules from the supplied PermissionContextState into its own mutable tables on construction; the original context is never mutated. Use addRule(io.agentscope.core.permission.PermissionRule) to extend the engine's rule set at runtime.

  • 构造器详细资料

    • PermissionEngine

      public PermissionEngine(PermissionContextState context)
      Creates an engine seeded from the given context's rules and mode.
      参数:
      context - permission context providing mode, working directories, and initial rules

  • 方法详细资料

    • getContext

      public PermissionContextState getContext()
      Returns the underlying context (mode and working directories are read from it).
      返回:
      the immutable context this engine was constructed with

    • addRule

      public void addRule(PermissionRule rule)
      Adds a rule to the engine's internal rule set.

      The rule is routed by its PermissionRule.behavior(): ALLOW/DENY/ASK rules are appended to the engine's allow/deny/ask tables; PASSTHROUGH rules are ignored.

      参数:
      rule - the rule to add; must be non-null

    • getAllowRules

      public Map<String,List<PermissionRule>> getAllowRules()
      Read-only view of the engine's current allow-rule table.

    • getDenyRules

      public Map<String,List<PermissionRule>> getDenyRules()
      Read-only view of the engine's current deny-rule table.

    • getAskRules

      public Map<String,List<PermissionRule>> getAskRules()
      Read-only view of the engine's current ask-rule table.

    • checkPermission

      public reactor.core.publisher.Mono<PermissionDecision> checkPermission(ToolBase tool, Map<String,Object> toolInput)
      Resolves a permission decision for the given tool invocation.
      参数:
      tool - the tool being called
      toolInput - the input map the tool will receive
      返回:
      a Mono emitting the resolved PermissionDecision