Function main

tutorials/04_permission_system.py:245–331

()

# ============================================================

def main():
    print("=" * 60)
    print("Tutorial 04: Permission System 权限系统演示")
    print("=" * 60)

    # 创建一个 WorkspaceWrite 模式的策略
    # 并设置每个工具的权限要求
    policy = (
        PermissionPolicy(PermissionMode.WORKSPACE_WRITE)
        .with_tool_requirement("read_file", PermissionMode.READ_ONLY)
        .with_tool_requirement("write_file", PermissionMode.WORKSPACE_WRITE)
        .with_tool_requirement("bash", PermissionMode.DANGER_FULL_ACCESS)
        .with_tool_requirement("grep", PermissionMode.READ_ONLY)
    )

    # 准备不同的 Prompter
    auto_allow = AlwaysAllowPrompter()
    auto_deny = AlwaysDenyPrompter()

    print("\n--- 场景 1: 权限足够的工具 ---")
    for tool in ["read_file", "write_file", "grep"]:
        allowed, reason = policy.authorize(tool, '{"path": "test.py"}')
        print(f"  {tool}: {'ALLOW' if allowed else 'DENY'} — {reason}")

    print("\n--- 场景 2: 权限不够，没有 Prompter ---")
    allowed, reason = policy.authorize("bash", '{"command": "rm -rf /"}')
    print(f"  bash: {'ALLOW' if allowed else 'DENY'} — {reason}")

    print("\n--- 场景 3: 权限不够，用 AlwaysAllow Prompter 自动批准 ---")
    allowed, reason = policy.authorize("bash", '{"command": "echo hello"}', auto_allow)
    print(f"  bash: {'ALLOW' if allowed else 'DENY'} — {reason}")

    print("\n--- 场景 4: 权限不够，用 AlwaysDeny Prompter 自动拒绝 ---")
    allowed, reason = policy.authorize("bash", '{"command": "echo hello"}', auto_deny)
    print(f"  bash: {'ALLOW' if allowed else 'DENY'} — {reason}")

    print("\n--- 场景 5: Allow 模式（全部放行）---")
    allow_policy = PermissionPolicy(ALLOW_MODE)
    allowed, reason = allow_policy.authorize("bash", '{"command": "rm -rf /"}')
    print(f"  bash (allow mode): {'ALLOW' if allowed else 'DENY'} — {reason}")

    print("\n--- 场景 6: ReadOnly 模式（最严格）---")
    readonly_policy = (
        PermissionPolicy(PermissionMode.READ_ONLY)
        .with_tool_requirement("read_file", PermissionMode.READ_ONLY)
        .with_tool_requirement("bash", PermissionMode.DANGER_FULL_ACCESS)
    )
    allowed, reason = readonly_policy.authorize("read_file", '{"path": "test.py"}')
    print(f"  read_file: {'ALLOW' if allowed else 'DENY'} — {reason}")
    allowed, reason = readonly_policy.authorize("bash", '{"command": "ls"}')
    print(f"  bash: {'ALLOW' if allowed else 'DENY'} — {reason}")

    # 解说
    print("\n" + "=" * 60)
    print("关键理解要点：")
    print("=" * 60)
    print("""
    1. 权限等级（从低到高）: