| 1 | //! Normalization for Runtime mode and permission-posture wires. |
| 2 | //! |
| 3 | //! Older clients can still send mode aliases and the legacy `auto_approve` |
| 4 | //! bit. New callers send a named posture. Keep those inputs readable, but |
| 5 | //! persist and execute one contract: Plan / Act / Operate plus Ask / |
| 6 | //! Auto-Review / Full Access. |
| 7 | |
| 8 | use anyhow::{Result, bail}; |
| 9 | |
| 10 | use crate::tui::app::AppMode; |
| 11 | use crate::tui::approval::ApprovalMode; |
| 12 | |
| 13 | #[derive(Debug, Clone, Copy, PartialEq, Eq)] |
| 14 | pub(crate) struct RuntimePolicyProjection { |
| 15 | pub(crate) mode: AppMode, |
| 16 | pub(crate) permission: ApprovalMode, |
| 17 | } |
| 18 | |
| 19 | impl RuntimePolicyProjection { |
| 20 | /// Read a persisted compatibility shape. Unknown historical values fail |
| 21 | /// closed to Act + Ask unless the old bypass bit is explicitly present. |
| 22 | #[must_use] |
| 23 | pub(crate) fn from_persisted( |
| 24 | mode: &str, |
| 25 | permission_posture: Option<&str>, |
| 26 | auto_approve: bool, |
| 27 | ) -> Self { |
| 28 | let parsed_mode = parse_runtime_mode(mode).unwrap_or(AppMode::Agent); |
| 29 | let permission = permission_posture |
| 30 | .and_then(ApprovalMode::from_config_value) |
| 31 | .filter(|permission| *permission != ApprovalMode::Never) |
| 32 | .unwrap_or_else(|| { |
| 33 | if parsed_mode == AppMode::Yolo || auto_approve { |
| 34 | ApprovalMode::Bypass |
| 35 | } else { |
| 36 | ApprovalMode::Suggest |
| 37 | } |
| 38 | }); |
| 39 | Self { |
| 40 | mode: visible_mode(parsed_mode), |
| 41 | permission, |
| 42 | } |
| 43 | } |
| 44 | |
| 45 | /// Validate and normalize a new Runtime request. Legacy aliases are |
| 46 | /// accepted as one-way inputs, but only current values are persisted. |
| 47 | pub(crate) fn from_request( |
| 48 | mode: &str, |
| 49 | permission_posture: Option<&str>, |
| 50 | auto_approve: Option<bool>, |
| 51 | ) -> Result<Self> { |
| 52 | let parsed_mode = parse_runtime_mode(mode).ok_or_else(|| { |
| 53 | anyhow::anyhow!("unsupported Runtime mode {mode:?}; expected plan, act, or operate") |
| 54 | })?; |
| 55 | let permission = match permission_posture { |
| 56 | Some(value) => ApprovalMode::from_config_value(value).ok_or_else(|| { |
| 57 | anyhow::anyhow!( |
| 58 | "unsupported permission posture {value:?}; expected ask, auto-review, or full-access" |
| 59 | ) |
| 60 | })?, |
| 61 | None if parsed_mode == AppMode::Yolo || auto_approve.unwrap_or(false) => { |
| 62 | ApprovalMode::Bypass |
| 63 | } |
| 64 | None => ApprovalMode::Suggest, |
| 65 | }; |
| 66 | if permission == ApprovalMode::Never { |
| 67 | bail!("permission posture 'never' is not part of the Runtime product contract"); |
| 68 | } |
| 69 | Ok(Self { |
| 70 | mode: visible_mode(parsed_mode), |
| 71 | permission, |
| 72 | }) |
| 73 | } |
| 74 | |
| 75 | #[must_use] |
| 76 | pub(crate) fn mode_setting(self) -> &'static str { |
| 77 | self.mode.as_setting() |
| 78 | } |
| 79 | |
| 80 | #[must_use] |
| 81 | pub(crate) fn permission_wire(self) -> &'static str { |
| 82 | match self.permission { |
| 83 | ApprovalMode::Suggest => "ask", |
| 84 | ApprovalMode::Auto => "auto_review", |
| 85 | ApprovalMode::Bypass => "full_access", |
| 86 | ApprovalMode::Never => "ask", |
| 87 | } |
| 88 | } |
| 89 | |
| 90 | #[must_use] |
| 91 | pub(crate) fn auto_approve(self) -> bool { |
| 92 | self.permission == ApprovalMode::Bypass |
| 93 | } |
| 94 | } |
| 95 | |
| 96 | #[must_use] |
| 97 | pub(crate) fn parse_runtime_mode(value: &str) -> Option<AppMode> { |
| 98 | match value.trim().to_ascii_lowercase().as_str() { |
| 99 | "normal" => Some(AppMode::Agent), |
| 100 | other => AppMode::parse(other), |
| 101 | } |
| 102 | } |
| 103 | |
| 104 | #[must_use] |
| 105 | fn visible_mode(mode: AppMode) -> AppMode { |
| 106 | match mode { |
| 107 | AppMode::Auto | AppMode::Yolo => AppMode::Agent, |
| 108 | other => other, |
| 109 | } |
| 110 | } |
| 111 | |
| 112 | #[cfg(test)] |
| 113 | mod tests { |
| 114 | use super::*; |
| 115 | |
| 116 | #[test] |
| 117 | fn legacy_inputs_project_to_current_mode_and_permission_wires() { |
| 118 | for alias in ["normal", "agent", "auto"] { |
| 119 | let policy = RuntimePolicyProjection::from_persisted(alias, None, false); |
| 120 | assert_eq!(policy.mode_setting(), "agent", "{alias}"); |
| 121 | assert_eq!(policy.permission_wire(), "ask", "{alias}"); |
| 122 | } |
| 123 | for alias in ["yolo", "bypass"] { |
| 124 | let policy = RuntimePolicyProjection::from_persisted(alias, None, false); |
| 125 | assert_eq!(policy.mode_setting(), "agent", "{alias}"); |
| 126 | assert_eq!(policy.permission_wire(), "full_access", "{alias}"); |
| 127 | } |
| 128 | } |
| 129 | |
| 130 | #[test] |
| 131 | fn named_posture_is_normalized_and_authoritative() { |
| 132 | let auto = RuntimePolicyProjection::from_request("operate", Some("auto-review"), None) |
| 133 | .expect("compat permission"); |
| 134 | assert_eq!(auto.mode_setting(), "operate"); |
| 135 | assert_eq!(auto.permission_wire(), "auto_review"); |
| 136 | assert_eq!(auto.permission, ApprovalMode::Auto); |
| 137 | assert!(!auto.auto_approve()); |
| 138 | |
| 139 | let full = RuntimePolicyProjection::from_request("act", Some("full_access"), None) |
| 140 | .expect("current permission wire"); |
| 141 | assert_eq!(full.permission_wire(), "full_access"); |
| 142 | assert_eq!(full.permission, ApprovalMode::Bypass); |
| 143 | assert!(full.auto_approve()); |
| 144 | |
| 145 | let ask = RuntimePolicyProjection::from_request("yolo", Some("ask"), Some(true)) |
| 146 | .expect("named posture overrides legacy flags"); |
| 147 | assert_eq!(ask.mode_setting(), "agent"); |
| 148 | assert_eq!(ask.permission_wire(), "ask"); |
| 149 | assert_eq!(ask.permission, ApprovalMode::Suggest); |
| 150 | assert!(!ask.auto_approve()); |
| 151 | } |
| 152 | |
| 153 | #[test] |
| 154 | fn invalid_or_never_postures_are_rejected() { |
| 155 | assert!(RuntimePolicyProjection::from_request("act", Some("owner"), None).is_err()); |
| 156 | assert!(RuntimePolicyProjection::from_request("act", Some("never"), None).is_err()); |
| 157 | } |
| 158 | } |
| 159 |