security(policy): HTTP 形态无人工审批闭环——permission hook 零接线、无权限规则时隐式放行
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- rust
- Domain
- authorization, backend-api-design, security
Research direction
Start with src/tools/policy_domain/permission_pipeline.rs:271-285 and the PermissionHook trait in src/tools/registry.rs:406, then inspect HTTP and CLI production paths for hook calls. Verify how exit_plan_mode handles REST confirmation and how the default policy and RECURSIVE_SANDBOX=policy affect tool execution. Done means HTTP has a server-enforced approval path or forced plan confirmation, with restrictive defaults and deployment guidance for unsafe configurations.
Written by the indexing model from the issue text.
Description
场景 gap 单（okguitar 提报）· 优先级 P0 · 依赖：无
基线 HEAD = 9165b9a0。
Summary
- 权限管线在「非 Strict 且无显式规则」时隐式放行（仅 tracing::warn）：
src/tools/policy_domain/permission_pipeline.rs:271-285；运维未配[permissions]时整个规则检查跳过，只剩保护路径检查（.git/.ssh）。 - 交互式人审的载体
with_permission_hook在 http/cli 生产路径零调用（全仓命中仅 trait 定义src/tools/registry.rs:406与#[cfg(test)]测试）。 - HTTP 下唯一的审批门是 exit_plan_mode 的 plan 确认（REST confirm/reject），但是否进 plan mode 由模型自主决定；
run_shell/Write/WebFetch外发在默认部署（无沙箱 + 无权限配置）下没有任何「人批一下」环节，run_shell在 host 直接执行且带全网出口。 - L1 deny 模式（rm -rf/mkfs/dd 等）只在
RECURSIVE_SANDBOX=policy档挂载，默认档无。
影响
办公场景：员工经前端下达的目标可让 agent 在服务器上直接执行任意 shell / 改工作区文件 / 公网外发；一份带注入的网页或文档即可驱动这一切。这是办公智能体底座最基本的人审闭环缺失。
建议
- http 模式提供服务端强制的审批通道：per-tool webhook 审批（复用 PermissionHook trait 对接企业审批流）或强制 plan-confirm 档位。
- 默认档至少挂
PolicyConfig::default_restrictive()；部署文档把「无沙箱 + 无权限配置」标记为不可用于生产。
- Dominant language
- Rust
- Stars
- 4
- Forks
- 0
- Avg merge
- 5h 32m
- Merged PRs (30d)
- 7
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from jeffkit/recursive
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 66/100
Maintainers usually reply within 1 day
-
Difficulty 5/5 Over a week Newbie friendliness 20/100
jeffkit/recursive#134 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 5/5 Over a week Newbie friendliness 30/100
Maintainers usually reply within 1 day
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
jeffkit/recursive#131 · 1 comment ·
Maintainers usually reply within 1 day
All issues in jeffkit/recursive
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
check: a failed re-read of the model file before binding is labelled E_THETA_LEVEL_BINDING on [parameters]Possibly taken @TeunP claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 80/100
Devolutions/picky-rs#546 · 1 comment ·
Maintainers usually reply within 3 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
Maintainers usually reply within 1 day