Repository navigation
Workspace Grants: folder access UI and enforced PersonaBot file boundary #116
Description
Part of #114
2026-09-24 修订：Grant 作为默认安全模式的文件访问边界
Human QA 发现：撤销后 Orchestrator 仍可经 DSH 原生 bash/read 读取项目文件。DSH workspace-write 约束单一 cwd 的写入，但不隔离读取，且可能开放临时目录写入。经 Human 确认，目标权限为：
| Session | 可读 | 可写 |
|---|---|---|
| Orchestrator | 固定 Memory Repository + 当前所有有效 Grant 的项目目录 | Memory Repository |
| Assignment | 创建时选定的一个有效 Grant 目录 | 同一 Grant 目录 |
这是下一条 tracer 的验收边界。#233 当前草稿只证明 Grant admission / 默认写入，不证明目录读取隔离，不能以此合并或关闭 #116。原生 read/search 等可按路径核对的工具通过最终 Tool guard 按当前 Grant 校验；Shell、terminal 等无法从参数证明文件范围的调用，经 DSH 原生 approval seam 在 Bot Channel 显示完整输入并暂停，由 Human 对这一调用批准或拒绝。没有有效决定则 fail closed；批准是一次性越界例外，不宣传为目录隔离。撤销须阻断两个角色后续读写与该 Grant 的未来事项操作；正在执行的操作须明确定义取消/结算。重新授权产生新 Grant，不能复活旧 Session。Memory 是 Bot 内部固定目录，不作为可删除 Grant。
右侧授权区参考 Source folders：Human 可经 DSH Host 目录选择器添加已有路径、创建对应 Workspace/Grant，并撤销 Bot 对某个目录的访问。撤销不删除磁盘目录或 DSH Workspace；历史授权收折叠区。首条 E2E 同时证明授权目录可读、未授权目录的原生 read 拒绝、Orchestrator 项目写入拒绝、Assignment 单目录读写、撤销后拒绝、重新授权后新事项恢复；对 bash 验证未批准不执行、Channel 拒绝不执行、Human 仅批准当前调用后原 Session 继续。
Observable tracer bullet
交付PersonaBot对真实project目录的一次授权、多次复用，以及显式Human-owned permission preset：
- Human 通过 Host 目录选择器添加或选用 DSH Workspace，并为 PersonaBot 创建 durable Workspace Grant；
- 原生 DSH mode 默认 workspace-write；Orchestrator 永远以 Memory 为 cwd，但 BotHarness 的有效根集合须另由 Provider 强制执行；
- Orchestrator调用create_assignment时显式选择该Grant；
- Runtime创建owned independent root Assignment Session，primary cwd为Grant的单目录，并固化workspace-write permission snapshot；
- 第二个Assignment可复用同一Grant，无需重复授权；
5a. Orchestrator 可读取所有当前有效 Grant，项目写入只能由选择单个 Grant 的 Assignment 执行； - Human在PersonaBot设置中经过风险确认开启danger-full-access；
- 新建Assignment仍以同一Grant目录为primary cwd，但固化danger-full-access snapshot并持续显示风险警示；
- 已存在workspace-write Session不改变；
- Human撤销danger-full-access preset后，之后新建Assignment恢复workspace-write；已有danger-full-access Session不静默改变；
- restart后Grant、preset、审计与每个Assignment permission snapshot可恢复。
阶段验收先达到 grant once → Orchestrator 授权目录只读 → Assignment 单目录读写 → revoke 后原生 read 拒绝且旧 Assignment 的 bash 不可因批准而恢复 → 新 Grant 对应的新 Assignment 恢复；不透明工具逐次请求 Human，之后才扩展危险 preset。
Stable boundaries
- Workspace Grant 是 PersonaBot 级、durable、Human-owned、可撤销的 application-defined 文件访问 authority/provenance fact，存于 BotHarness operational database。
- Grant引用经过Host验证的DSH Workspace identity/locator；它不是Session ownership、cwd inference、Channel membership或Service Grant。
- PersonaBot Assignment access preset也是durable Human configuration：workspace-write（默认）或danger-full-access。
- Orchestrator 的 cwd 永远是 Memory Repository，原生 DSH mode 为 workspace-write；它只可写 Memory、可读所有有效 Grant，PersonaBot 危险 preset 只用于新建 Assignment。
- create_assignment payload、模型tool call与Assignment Agent不能选择或升级permission mode；Runtime从owning PersonaBot当前preset产生immutable Session permission snapshot。
- preset变化不修改、restart或迁移现有Session。UI必须同时展示“当前Bot默认值”和“此Session实际snapshot”。
- 每个Assignment Session恰好一个primary cwd；Assignment Directory记录Grant/Workspace/permission provenance。
- danger-full-access 是显式 Human opt-out，突破默认安全的 Grant 文件边界时必须明确告知；Grant 仍保留 primary target、ownership/provenance 与 UI anchor。
- Grant revoke 阻止未来 create/request/resume/wake 及两个角色后续的项目读写；执行中的调用需要明确取消/结算，而不是在 UI 声称立即失去访问却继续读取。历史 Session 快照不重写。
- 跨两个project使用两个Assignments；V1不把多个roots组合到一个Assignment。
- danger-full-access不是Composite Execution World、multi-cwd、overlay、container、remote或microVM Provider。
UX and audit requirements
- 开启danger-full-access前必须展示具体风险并要求显式确认，不能使用预选checkbox或模糊copy。
- PersonaBot设置在开启期间持续显示高风险状态与一键撤销入口。
- 每个danger-full-access Assignment row/detail持续显示不可忽略的badge/warning。
- enable/disable记录authenticated Human、PersonaBot、before/after、time与cause；Session create记录preset revision与permission snapshot。
- archive/recovery/restore后不自动扩大权限；恢复的desired preset与target-local readiness/confirmation分离，按后续portability contract处理。
Acceptance criteria
- Typert/API Gateway command 从 authenticated Human context 添加 Host 文件夹并创建、列出、撤销 Workspace Grant；撤销不删除文件或 DSH Workspace，payload 不能伪造 PersonaBot authority。
- Orchestrator 只写 Memory、可读有效 Grant；Assignment 只读写所选单一 Grant。native read/search 等按路径校验；bash/terminal 等不透明调用通过 DSH 审批 seam 在 Channel 请求本次 Human 决定，不批准不执行；卡片明确批准后可能访问目录之外。
- 撤销后两个角色后续文件调用都拒绝；重新授权不能复活旧 Grant 的 Session；运行调用的取消/结算和 UI 状态一致。
- 默认workspace-write；未进行Human确认时任何路径都不能写入danger-full-access。
- Orchestrator在任何PersonaBot preset下仍是workspace-write。
- create_assignment只接受owning PersonaBot当前有效Grant reference；raw path/cwd不能替代Grant。
- Assignment创建时固化permission snapshot与preset revision；改变设置后已有Session保持原值。
- 同一Grant可跨多个Assignments复用；每个Directory row只有一个primary Workspace/cwd provenance。
- danger-full-access Session可访问primary cwd外路径，但UI/Directory仍保留Grant与primary cwd，不宣传多cwd。
- revoke preset后下一Session恢复workspace-write；existing danger Session保持警示且需要显式stop。
- revoked/missing/unavailable Grant时未来create/request/resume/wake fail closed；不会迁移到Memory repo或其他Workspace。
- enable/disable与Session snapshot具备durable audit，restart后可查询。
- Human真实DSH验收覆盖默认、安全确认、持续警示、旧Session不变、撤销与新Session恢复safe default。
- lint、format、typecheck、tests、build全绿。
逐次原生工具批准（2026-09-24 补充）
- tools/pre-execute 暂停当前不透明调用；Bot Channel 以持久卡片展示 Session 角色、工具、工作目录与完整输入。approval/request 由 Channel 的 Human 决定回答，DSH 记录 approval/asked / approval/decided。批准仅消费于同一调用；拒绝、取消、无答复、请求过大无法完整展示均不执行。
- 最终 ctx.tools.guard() 在批准后重查 Session ownership、workspace-write/ask 策略与 Assignment 原 Grant；旧 Grant 已撤销仍拒绝。已开始执行的调用不能靠撤销倒回。
- Human QA 同时检查 Orchestrator 与 Assignment 的原生命令仍可用；批准前命令不执行、批准后仅这次继续、拒绝不会执行。run_code 等可选能力是否暴露由当前 DSH Agent preset / presentation 决定，不能把未安装的能力记作已验收。
Dependencies
- Foundation：operational database owner / writer lease / schema generation #79 operational database foundation（已完成）。
- Foundation：explicit Session ownership 与 DSH activity projection #80 explicit Session ownership/activity projection。
- Foundation：Assignment Runtime / Assignment Directory / Orchestrator tools #81 Assignment Runtime消费Grant与permission snapshot；不能以raw cwd或model-selected mode替代本contract。
- #75消费settings、warning与permission read models；#123消费Assignment activity projection。
Non-goals
- 一个Assignment多个cwd。
- 多 cwd Assignment 与多项目可写的 Orchestrator。实现默认安全读隔离所需的 Provider/Execution World 属本 issue 范围。
- 让Orchestrator使用danger-full-access。
- 让模型自行批准工具调用或选择 permission mode；逐次批准只能来自 Channel 中的 Human 决定。
- 把danger-full-access解释成Workspace Grant或filesystem confinement。
- portable authority自动继承；restore/import仍需Target Resolution与Human确认。
- 通用OS filesystem ACL设计。
Activity
[-]Foundation: PersonaBot Workspace Grant / one Assignment one cwd[/-][+]Foundation: Workspace Grant / Assignment permission preset / one cwd[/+]26 remaining items
fix: keep grant revocation cards in sync (refs #116)
DoodleBears commentedon Sep 25, 2026
Agent work outcome
codex/local/01a0cde3-1621-7382-96a1-852758cedfc0(not a DSH Session)58a65dc83d5443f2c45bc1ea7c2cdc5a60f55c1dRevoking an Assignment's Grant now expires a pending DSH native-tool approval and removes its Channel actions. A stale approval attempt cannot execute the tool. Already executing calls can finish, but subsequent access through the old Grant is denied. The Workspace Grants list renders independently of secondary sidebar data; a stalled operation no longer leaves the controls indefinitely busy.
Verification: real DSH/LLM Orchestrator → Assignment → pending native
bash pwd→ Human revoke; the Grant was durably revoked, the approval status becameexpired, and the Assignment ended blocked withoutpwdoutput. A separate real in-flight native command was allowed to finish and subsequent access was blocked. Human QA confirmed the Grant row and approval buttons disappear immediately, no timeout appears, and the state survives refresh. Full automated suite: 972 passed; typecheck, build, changed-file lint/format, and changelog checks passed.Remaining #116 work: complete and record the safe/danger preset, restart, old-Session, revoke/regrant, and other acceptance-matrix Human QA before closing this parent issue.
DoodleBears commentedon Sep 26, 2026
Agent work continuation — Codex task codex/local/01a0cde3-1621-7382-96a1-852758cedfc0. Real DSH safe → dangerous → safe Assignment matrix and restart checks passed. Found a remaining UI gap: the new #312 Sessions rows omit the persistent warning for dangerous Assignment permission snapshots. I am implementing that narrow Client projection and will return for Human QA before #116 closure.
docs: save PR 339 review outline
docs: record PR 339 validation results
DoodleBears commentedon Sep 26, 2026
#116 matrix progress for Codex task
codex/local/01a0cde3-1621-7382-96a1-852758cedfc0:#116 remains open while Human QA and the remaining acceptance audit are completed.
DoodleBears commentedon Sep 27, 2026
Agent work resumed — #116 Session permission matrix
codex/local/01a0cde3-1621-7382-96a1-852758cedfc0(not a DSH Session)main, carry the immutable full-access Session warning through the current Sessions UI, then finish and record real DSH/Human acceptance for safe/danger snapshots, revocation/regrant, and restart.codex/116-session-access-warningMerge current main into Session access warning (#116)
DoodleBears commentedon Sep 27, 2026
#116 final matrix progress (Codex task
codex/local/01a0cde3-1621-7382-96a1-852758cedfc0)main(merge commit3510561); CodeRabbit succeeds and GitHub reports mergeable.botharness-82881c61-2f35-4ef0-8e56-cc98033d2793) ran nativebash pwdwithout a per-call approval. Turning the Bot default back to safe created a separateworkspace-write + askAssignment (botharness-c52b0794-a67e-40ab-97da-1f0f3a92dcb3) that readqa.txtthrough nativeread. After restarting the Host, the default remained safe (revision 2), both immutable snapshots remained distinct, and the old full-access row still showed its orange warning in Sessions → All.d5376d50-9bff-4a8c-947f-bfef76cf0b09and regranting the same Workspace produced new Grant80da1bbb-ca8d-4d1f-ab68-e08675cad604. The real Orchestrator actually calledcreate_assignmentwith the old ID and receivedWorkspace Grant is missing or revoked; the Assignment count stayed unchanged. A new safe Assignment (botharness-c65d3bc3-a57e-4242-9396-3651faffa0d5) with the new ID readqa.txtand reportedSAFE-GRANT-READ-116. The already-running-call settlement and pending-approval revocation tracer were previously delivered and Human-QA'd in PR Expire pending tool approval on Workspace Grant revoke #306.core.autocrlffixture mismatch; that test passed when rerun withcore.autocrlf=false, matching the Linux fixture semantics. New live UI screenshots are saved locally under.humanlayer/tasks/pr-339/qa-evidence/.Human QA of this final matrix is pending on the isolated QA page. #116 and PR #339 remain open/draft until that feedback is recorded.
docs: record #116 permission matrix QA
DoodleBears commentedon Sep 27, 2026
#116 Human QA and final live-session follow-up
Human confirmed all four checks on the isolated QA page: the old full-access Assignment keeps its orange warning after refresh; the revoked Grant is rejected; a new Grant can create an Assignment and read the file; and the resulting Channel and Session state persists after refresh.
I then used the live Orchestrator to call
send_assignment_requeston the old full-access Sessionbotharness-82881c61-2f35-4ef0-8e56-cc98033d2793after regranting the same folder. The tool returnedWorkspace Grant is missing or revokedfor the Session's original Grant, the request was not delivered, the Session stayed idle with its original report, and the Assignment count remained three. The new Grant only enabled a distinct new safe Session.On the merged PR commit, Linux checks passed: 1,078 tests in 129 files, build, typecheck, lint and all 12 changed-file format checks. Full-tree formatting still flags unrelated baseline files; no such file is in PR #339. The saved PR description and issue evidence are updated, and PR #339 is ready for review. #116 remains open until that PR is merged and its completion trace is recorded.
fix: show full-access Assignment warnings in Bot Sessions (#116) (#339)
DoodleBears commentedon Sep 27, 2026
Completed by merged PR #339 (245b095) and earlier #116 slices. Codex task codex/local/01a0cde3-1621-7382-96a1-852758cedfc0: real DSH safe/full-access/revocation/regrant/restart matrix and Human QA passed; 1,078 tests, build, typecheck, lint, changelog, and changed-file formatting passed. CodeRabbit completed with no actionable or merge-blocking comments. The full-tree formatter still reports unrelated baseline files, recorded separately from this PR.