**Summary**
This PR makes “ApprovalDecision::AcceptForSession / don’t ask again this
session” actually work for `apply_patch` approvals by caching approvals
based on absolute file paths in codex-core, properly wiring it through
app-server v2, and exposing the choice in both TUI and TUI2.
- This brings `apply_patch` calls to be at feature-parity with general
shell commands, which also have a "Yes, and don't ask again" option.
- This also fixes VSCE's "Allow this session" button to actually work.
While we're at it, also split the app-server v2 protocol's
`ApprovalDecision` enum so execpolicy amendments are only available for
command execution approvals.
**Key changes**
- Core: per-session patch approval allowlist keyed by absolute file
paths
- Handles multi-file patches and renames/moves by recording both source
and destination paths for `Update { move_path: Some(...) }`.
- Extend the `Approvable` trait and `ApplyPatchRuntime` to work with
multiple keys, because an `apply_patch` tool call can modify multiple
files. For a request to be auto-approved, we will need to check that all
file paths have been approved previously.
- App-server v2: honor AcceptForSession for file changes
- File-change approval responses now map AcceptForSession to
ReviewDecision::ApprovedForSession (no longer downgraded to plain
Approved).
- Replace `ApprovalDecision` with two enums:
`CommandExecutionApprovalDecision` and `FileChangeApprovalDecision`
- TUI / TUI2: expose “don’t ask again for these files this session”
- Patch approval overlays now include a third option (“Yes, and don’t
ask again for these files this session (s)”).
- Snapshot updates for the approval modal.
**Tests added/updated**
- Core:
- Integration test that proves ApprovedForSession on a patch skips the
next patch prompt for the same file
- App-server:
- v2 integration test verifying
FileChangeApprovalDecision::AcceptForSession works properly
**User-visible behavior**
- When the user approves a patch “for session”, future patches touching
only those previously approved file(s) will no longer prompt gain during
that session (both via app-server v2 and TUI/TUI2).
**Manual testing**
Tested both TUI and TUI2 - see screenshots below.
TUI:
<img width="1082" height="355" alt="image"
src="https://github.com/user-attachments/assets/adcf45ad-d428-498d-92fc-1a0a420878d9"
/>
TUI2:
<img width="1089" height="438" alt="image"
src="https://github.com/user-attachments/assets/dd768b1a-2f5f-4bd6-98fd-e52c1d3abd9e"
/>
206 lines
6 KiB
Rust
206 lines
6 KiB
Rust
use path_absolutize::Absolutize;
|
|
use schemars::JsonSchema;
|
|
use serde::Deserialize;
|
|
use serde::Deserializer;
|
|
use serde::Serialize;
|
|
use serde::de::Error as SerdeError;
|
|
use std::cell::RefCell;
|
|
use std::path::Display;
|
|
use std::path::Path;
|
|
use std::path::PathBuf;
|
|
use ts_rs::TS;
|
|
|
|
/// A path that is guaranteed to be absolute and normalized (though it is not
|
|
/// guaranteed to be canonicalized or exist on the filesystem).
|
|
///
|
|
/// IMPORTANT: When deserializing an `AbsolutePathBuf`, a base path must be set
|
|
/// using [AbsolutePathBufGuard::new]. If no base path is set, the
|
|
/// deserialization will fail unless the path being deserialized is already
|
|
/// absolute.
|
|
#[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize, JsonSchema, TS)]
|
|
pub struct AbsolutePathBuf(PathBuf);
|
|
|
|
impl AbsolutePathBuf {
|
|
pub fn resolve_path_against_base<P: AsRef<Path>, B: AsRef<Path>>(
|
|
path: P,
|
|
base_path: B,
|
|
) -> std::io::Result<Self> {
|
|
let absolute_path = path.as_ref().absolutize_from(base_path.as_ref())?;
|
|
Ok(Self(absolute_path.into_owned()))
|
|
}
|
|
|
|
pub fn from_absolute_path<P: AsRef<Path>>(path: P) -> std::io::Result<Self> {
|
|
let absolute_path = path.as_ref().absolutize()?;
|
|
Ok(Self(absolute_path.into_owned()))
|
|
}
|
|
|
|
pub fn current_dir() -> std::io::Result<Self> {
|
|
let current_dir = std::env::current_dir()?;
|
|
Self::from_absolute_path(current_dir)
|
|
}
|
|
|
|
pub fn join<P: AsRef<Path>>(&self, path: P) -> std::io::Result<Self> {
|
|
Self::resolve_path_against_base(path, &self.0)
|
|
}
|
|
|
|
pub fn parent(&self) -> Option<Self> {
|
|
self.0.parent().map(|p| {
|
|
#[expect(clippy::expect_used)]
|
|
Self::from_absolute_path(p).expect("parent of AbsolutePathBuf must be absolute")
|
|
})
|
|
}
|
|
|
|
pub fn as_path(&self) -> &Path {
|
|
&self.0
|
|
}
|
|
|
|
pub fn into_path_buf(self) -> PathBuf {
|
|
self.0
|
|
}
|
|
|
|
pub fn to_path_buf(&self) -> PathBuf {
|
|
self.0.clone()
|
|
}
|
|
|
|
pub fn to_string_lossy(&self) -> std::borrow::Cow<'_, str> {
|
|
self.0.to_string_lossy()
|
|
}
|
|
|
|
pub fn display(&self) -> Display<'_> {
|
|
self.0.display()
|
|
}
|
|
}
|
|
|
|
impl AsRef<Path> for AbsolutePathBuf {
|
|
fn as_ref(&self) -> &Path {
|
|
&self.0
|
|
}
|
|
}
|
|
|
|
impl From<AbsolutePathBuf> for PathBuf {
|
|
fn from(path: AbsolutePathBuf) -> Self {
|
|
path.into_path_buf()
|
|
}
|
|
}
|
|
|
|
impl TryFrom<&Path> for AbsolutePathBuf {
|
|
type Error = std::io::Error;
|
|
|
|
fn try_from(value: &Path) -> Result<Self, Self::Error> {
|
|
Self::from_absolute_path(value)
|
|
}
|
|
}
|
|
|
|
impl TryFrom<PathBuf> for AbsolutePathBuf {
|
|
type Error = std::io::Error;
|
|
|
|
fn try_from(value: PathBuf) -> Result<Self, Self::Error> {
|
|
Self::from_absolute_path(value)
|
|
}
|
|
}
|
|
|
|
impl TryFrom<&str> for AbsolutePathBuf {
|
|
type Error = std::io::Error;
|
|
|
|
fn try_from(value: &str) -> Result<Self, Self::Error> {
|
|
Self::from_absolute_path(value)
|
|
}
|
|
}
|
|
|
|
impl TryFrom<String> for AbsolutePathBuf {
|
|
type Error = std::io::Error;
|
|
|
|
fn try_from(value: String) -> Result<Self, Self::Error> {
|
|
Self::from_absolute_path(value)
|
|
}
|
|
}
|
|
|
|
thread_local! {
|
|
static ABSOLUTE_PATH_BASE: RefCell<Option<PathBuf>> = const { RefCell::new(None) };
|
|
}
|
|
|
|
/// Ensure this guard is held while deserializing `AbsolutePathBuf` values to
|
|
/// provide a base path for resolving relative paths. Because this relies on
|
|
/// thread-local storage, the deserialization must be single-threaded and
|
|
/// occur on the same thread that created the guard.
|
|
pub struct AbsolutePathBufGuard;
|
|
|
|
impl AbsolutePathBufGuard {
|
|
pub fn new(base_path: &Path) -> Self {
|
|
ABSOLUTE_PATH_BASE.with(|cell| {
|
|
*cell.borrow_mut() = Some(base_path.to_path_buf());
|
|
});
|
|
Self
|
|
}
|
|
}
|
|
|
|
impl Drop for AbsolutePathBufGuard {
|
|
fn drop(&mut self) {
|
|
ABSOLUTE_PATH_BASE.with(|cell| {
|
|
*cell.borrow_mut() = None;
|
|
});
|
|
}
|
|
}
|
|
|
|
impl<'de> Deserialize<'de> for AbsolutePathBuf {
|
|
fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
|
|
where
|
|
D: Deserializer<'de>,
|
|
{
|
|
let path = PathBuf::deserialize(deserializer)?;
|
|
ABSOLUTE_PATH_BASE.with(|cell| match cell.borrow().as_deref() {
|
|
Some(base) => {
|
|
Ok(Self::resolve_path_against_base(path, base).map_err(SerdeError::custom)?)
|
|
}
|
|
None if path.is_absolute() => {
|
|
Self::from_absolute_path(path).map_err(SerdeError::custom)
|
|
}
|
|
None => Err(SerdeError::custom(
|
|
"AbsolutePathBuf deserialized without a base path",
|
|
)),
|
|
})
|
|
}
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
use tempfile::tempdir;
|
|
|
|
#[test]
|
|
fn create_with_absolute_path_ignores_base_path() {
|
|
let base_dir = tempdir().expect("base dir");
|
|
let absolute_dir = tempdir().expect("absolute dir");
|
|
let base_path = base_dir.path();
|
|
let absolute_path = absolute_dir.path().join("file.txt");
|
|
let abs_path_buf =
|
|
AbsolutePathBuf::resolve_path_against_base(absolute_path.clone(), base_path)
|
|
.expect("failed to create");
|
|
assert_eq!(abs_path_buf.as_path(), absolute_path.as_path());
|
|
}
|
|
|
|
#[test]
|
|
fn relative_path_is_resolved_against_base_path() {
|
|
let temp_dir = tempdir().expect("base dir");
|
|
let base_dir = temp_dir.path();
|
|
let abs_path_buf = AbsolutePathBuf::resolve_path_against_base("file.txt", base_dir)
|
|
.expect("failed to create");
|
|
assert_eq!(abs_path_buf.as_path(), base_dir.join("file.txt").as_path());
|
|
}
|
|
|
|
#[test]
|
|
fn guard_used_in_deserialization() {
|
|
let temp_dir = tempdir().expect("base dir");
|
|
let base_dir = temp_dir.path();
|
|
let relative_path = "subdir/file.txt";
|
|
let abs_path_buf = {
|
|
let _guard = AbsolutePathBufGuard::new(base_dir);
|
|
serde_json::from_str::<AbsolutePathBuf>(&format!(r#""{relative_path}""#))
|
|
.expect("failed to deserialize")
|
|
};
|
|
assert_eq!(
|
|
abs_path_buf.as_path(),
|
|
base_dir.join(relative_path).as_path()
|
|
);
|
|
}
|
|
}
|