feat(security): DANGEROUS_SKIP explicit escape hatch + protocol & v17 migration support

core/config.py

@@ -272,7 +272,9 @@ class SecurityConfig(_Base):
       sandbox atomically; the environment gate remains for legacy callers.
     """
 
-    access_preset: Literal["ask", "read_only", "full_access"] | None = None
+    access_preset: (
+        Literal["ask", "read_only", "full_access", "dangerous_skip"] | None
+    ) = None
     permission_mode: str = "full_auto"
     permissions: dict[str, Any] = Field(default_factory=dict)
     sandbox: bool = True

core/domain/execution_security.py

@@ -11,11 +11,18 @@
 
 
 class ExecutionAccessPreset(StrEnum):
-    """User-facing access choices shared by every DeepCode client."""
+    """User-facing access choices shared by every DeepCode client.
+
+    借鉴 Claude Code ``--allow-dangerously-skip-permissions`` (2026-08-19):
+    危险操作必须"显式命名危险" —— 跳过全部权限校验的逃生通道叫
+    ``dangerous_skip`` 而不是沉默的 full_access, 让使用者与审计日志
+    都能一眼看到这是危险选择。
+    """
 
     ASK = "ask"
     READ_ONLY = "read_only"
     FULL_ACCESS = "full_access"
+    DANGEROUS_SKIP = "dangerous_skip"
 
 
 class FilesystemScope(StrEnum):
@@ -178,6 +185,15 @@ def _pattern_specificity(pattern: str) -> int:
         FilesystemScope.UNRESTRICTED,
         ApprovalPolicy.NEVER,
     ),
+    # 危险逃生通道: 显式命名 (借鉴 Claude Code --allow-dangerously-skip-permissions)。
+    # 与 FULL_ACCESS 同强度, 但名字自带"危险"警示, 供日志/UI 明确区分;
+    # 选择它等于明确声明"我知道这很危险, 仍要跳过全部权限校验"。
+    ExecutionAccessPreset.DANGEROUS_SKIP: (
+        ExecutionPermissionMode.FULL_AUTO,
+        False,
+        FilesystemScope.UNRESTRICTED,
+        ApprovalPolicy.NEVER,
+    ),
 }
 
 

core/persistence/migrations.py

@@ -1310,6 +1310,44 @@ class Migration:
 _REMOVE_WEB_ACCESS_POLICY_V16 = _DROP_WEB_ACCESS_POLICY_V15
 _RESTORE_WEB_ACCESS_POLICY_V16 = _WEB_ACCESS_POLICY_V15
 
+# v17: Widen the access_preset_override CHECK to accept 'dangerous_skip'
+# (借鉴 Claude Code --allow-dangerously-skip-permissions; 同强度但显式命名危险).
+# SQLite cannot ALTER CHECK in-place, so backup → drop column → re-add with
+# the widened constraint → restore values.
+_WIDEN_DANGEROUS_SKIP_V17 = r"""
+CREATE TABLE threads_preset_backup AS
+    SELECT id, access_preset_override FROM threads
+    WHERE access_preset_override IS NOT NULL;
+ALTER TABLE threads DROP COLUMN access_preset_override;
+ALTER TABLE threads ADD COLUMN access_preset_override TEXT CHECK (
+    access_preset_override IS NULL OR
+    access_preset_override IN ('ask', 'read_only', 'full_access', 'dangerous_skip')
+);
+UPDATE threads
+SET access_preset_override = (
+    SELECT access_preset_override FROM threads_preset_backup
+    WHERE threads_preset_backup.id = threads.id
+);
+DROP TABLE threads_preset_backup;
+"""
+_NARROW_DANGEROUS_SKIP_V17 = r"""
+CREATE TABLE threads_preset_backup AS
+    SELECT id, access_preset_override FROM threads
+    WHERE access_preset_override IS NOT NULL
+      AND access_preset_override <> 'dangerous_skip';
+ALTER TABLE threads DROP COLUMN access_preset_override;
+ALTER TABLE threads ADD COLUMN access_preset_override TEXT CHECK (
+    access_preset_override IS NULL OR
+    access_preset_override IN ('ask', 'read_only', 'full_access')
+);
+UPDATE threads
+SET access_preset_override = (
+    SELECT access_preset_override FROM threads_preset_backup
+    WHERE threads_preset_backup.id = threads.id
+);
+DROP TABLE threads_preset_backup;
+"""
+
 MIGRATIONS = (
     Migration(1, "initial_domain", _INITIAL_SCHEMA, _DROP_INITIAL_SCHEMA),
     Migration(
@@ -1402,6 +1440,12 @@ class Migration:
         _REMOVE_WEB_ACCESS_POLICY_V16,
         _RESTORE_WEB_ACCESS_POLICY_V16,
     ),
+    Migration(
+        17,
+        "widen_dangerous_skip_preset",
+        _WIDEN_DANGEROUS_SKIP_V17,
+        _NARROW_DANGEROUS_SKIP_V17,
+    ),
 )
 LATEST_SCHEMA_VERSION = MIGRATIONS[-1].version
 

desktop/src/generated/app-server.ts

@@ -38,7 +38,7 @@ export type ThreadMode = "code" | "paper" | "brief" | "review" | "goal";
 /**
  * User-facing tool access preset shared by Desktop and CLI.
  */
-export type ExecutionAccessPreset = "ask" | "read_only" | "full_access";
+export type ExecutionAccessPreset = "ask" | "read_only" | "full_access" | "dangerous_skip";
 export type ApprovalDecision = "approved_once" | "approved_session" | "denied";
 export type ExecutionPermissionMode = "default" | "plan" | "full_auto";
 export type AutomationStatus = "enabled" | "paused" | "retired";