2026-06-26 手搓 Agent：权限护栏与 Hook 系统学习笔记

工具要执行了
   │
闸门1 DENY_LIST ──命中──→ ⛔ 直接拒，连问都不问
   │ 没命中
闸门2 RULES ──命中──→ 闸门3 ask_user ──你按 N──→ 拒绝
   │ 没命中            └──你按 y──→ 放行
   │
  ✅ 执行

DENY_LIST = ["rm -rf /", "sudo", "shutdown", "reboot", "mkfs", "dd if=", "> /dev/sda"]

def check_deny_list(command: str) -> str | None:
    for pattern in DENY_LIST:
        if pattern in command:          # 字符串包含就算命中
            return f"Blocked: '{pattern}' is on the deny list"
    return None                         # 没命中 → None

PERMISSION_RULES = [
    {
        "tools": ["write_file", "edit_file"],
        "check": lambda args: escapes_workdir(args.get("path", "")),
        "message": "Writing outside workspace",
    },
    {
        "tools": ["bash"],
        "check": lambda args: any(kw in args.get("command", "")
                                  for kw in ["rm ", "> /etc/", "chmod 777"]),
        "message": "Potentially destructive command",
    },
]

def check_rules(tool_name: str, args: dict) -> str | None:
    for rule in PERMISSION_RULES:
        if tool_name in rule["tools"] and rule["check"](args):
            return rule["message"]
    return None

def check_permission(name: str, args: dict) -> bool:
    if name == "bash":                              # 闸门 1 只对 bash 查命令
        reason = check_deny_list(args.get("command", ""))
        if reason:
            print(f"⛔ {reason}")
            return False                            # 黑名单：直接拒，不问

    reason = check_rules(name, args)                # 闸门 2
    if reason:
        if ask_user(name, args, reason) == "deny":  # 闸门 3
            return False
    return True                                     # 全过 → 放行

if not check_permission(name, args):
    output = "Permission denied by user/policy."    # 拒绝：不执行，回一句话给模型
else:
    output = handler(**args)                         # 这下面全是原样

HOOKS = {"UserPromptSubmit": [], "PreToolUse": [], "PostToolUse": [], "Stop": []}

def register_hook(event: str, callback):
    HOOKS[event].append(callback)

def trigger_hooks(event: str, *args):
    for callback in HOOKS[event]:
        result = callback(*args)
        if result is not None:      # 非 None => hook 说"停/改"，立刻返回（短路）
            return result
    return None

def permission_hook(name, args):
    if name == "bash":
        for pattern in DENY_LIST:
            if pattern in args.get("command", ""):
                return f"Permission denied: '{pattern}' is on the deny list"
    # ... 写文件越界则 ask_user
    return None

register_hook("PreToolUse", permission_hook)
register_hook("PreToolUse", log_hook)        # 注意顺序！

blocked = trigger_hooks("PreToolUse", name, args)
if blocked:
    output = str(blocked)
else:
    output = handler(**args)
    trigger_hooks("PostToolUse", name, args, output)

test_commands = [
    "rm -rf /",          # 命中 → 拒
    "sudo ls",           # 命中 'sudo' → 拒
    "rm /tmp/foo.txt",   # 不含任何子串 → 放行(!)
    "RM -RF /",          # 大写 → ?
    "rm     -rf /",      # 多空格 → ?
    "s u d o",           # 拆字 → ?
]
for cmd in test_commands:
    result = trigger_hooks("PreToolUse", "bash", {"command": cmd})
    print(cmd, "→", "放行" if result is None else f"拒绝: {result}")