feat: enhance appendProjectPermissionAllows to support inherited permissions

Author: qorzj

.gitignore

@@ -5,3 +5,4 @@ dist/
 .vscode/
 *.tgz
 *.log
+.deepcode/settings.json

src/common/permissions.ts

@@ -360,7 +360,11 @@ export function hasUserPermissionReplies(value: { permissions?: unknown; alwaysA
   );
 }
 
-export function appendProjectPermissionAllows(projectRoot: string, scopes: PermissionScope[] | undefined): void {
+export function appendProjectPermissionAllows(
+  projectRoot: string,
+  scopes: PermissionScope[] | undefined,
+  options: { inheritedPermissions?: Required<PermissionSettings> } = {}
+): void {
   if (!Array.isArray(scopes) || scopes.length === 0) {
     return;
   }
@@ -392,14 +396,35 @@ export function appendProjectPermissionAllows(projectRoot: string, scopes: Permi
   } catch {
     settings = {};
   }
-  const currentAllow = Array.isArray(settings.permissions?.allow) ? settings.permissions.allow : [];
+
+  const existingPermissions = settings.permissions;
+  const permissions: PermissionSettings = existingPermissions
+    ? { ...existingPermissions }
+    : options.inheritedPermissions
+      ? {
+          allow: [...options.inheritedPermissions.allow],
+          deny: [...options.inheritedPermissions.deny],
+          ask: [...options.inheritedPermissions.ask],
+          defaultMode: options.inheritedPermissions.defaultMode,
+        }
+      : {};
+
+  const currentAllow = Array.isArray(permissions.allow) ? permissions.allow : [];
   const allow = [...currentAllow];
   for (const scope of nextScopes) {
     if (!allow.includes(scope)) {
       allow.push(scope);
     }
   }
-  if (allow.length === currentAllow.length) {
+  const currentDeny = Array.isArray(permissions.deny) ? permissions.deny : undefined;
+  const currentAsk = Array.isArray(permissions.ask) ? permissions.ask : undefined;
+  const deny = currentDeny ? currentDeny.filter((scope) => !nextScopes.includes(scope)) : permissions.deny;
+  const ask = currentAsk ? currentAsk.filter((scope) => !nextScopes.includes(scope)) : permissions.ask;
+  const changed =
+    allow.length !== currentAllow.length ||
+    (currentDeny ? (deny as PermissionScope[]).length !== currentDeny.length : false) ||
+    (currentAsk ? (ask as PermissionScope[]).length !== currentAsk.length : false);
+  if (existingPermissions && !changed) {
     return;
   }
   fs.mkdirSync(path.dirname(settingsPath), { recursive: true });
@@ -409,7 +434,9 @@ export function appendProjectPermissionAllows(projectRoot: string, scopes: Permi
       {
         ...settings,
         permissions: {
-          ...(settings.permissions ?? {}),
+          ...permissions,
+          deny,
+          ask,
           allow,
         },
       },

src/session.ts

@@ -1045,7 +1045,9 @@ ${skillMd}
   async replySession(sessionId: string, userPrompt: UserPromptContent, controller?: AbortController): Promise<void> {
     const signal = controller?.signal;
     this.throwIfAborted(signal);
-    appendProjectPermissionAllows(this.projectRoot, userPrompt.alwaysAllows);
+    appendProjectPermissionAllows(this.projectRoot, userPrompt.alwaysAllows, {
+      inheritedPermissions: this.getResolvedSettings().permissions,
+    });
     const now = new Date().toISOString();
     const updated = this.updateSessionEntry(sessionId, (entry) => ({
       ...entry,

src/tests/permissions.test.ts

@@ -106,6 +106,126 @@ test("appendProjectPermissionAllows writes unique project-level allow scopes", (
   assert.deepEqual(settings.permissions.allow, ["read-in-cwd", "write-in-cwd"]);
 });
 
+test("appendProjectPermissionAllows seeds inherited permissions before adding allow scopes", () => {
+  const projectRoot = createTempDir("deepcode-permission-settings-default-");
+
+  appendProjectPermissionAllows(projectRoot, ["query-git-log"], {
+    inheritedPermissions: {
+      allow: ["read-in-cwd"],
+      deny: ["write-out-cwd"],
+      ask: ["network"],
+      defaultMode: "askAll",
+    },
+  });
+
+  const settingsPath = path.join(projectRoot, ".deepcode", "settings.json");
+  const settings = JSON.parse(fs.readFileSync(settingsPath, "utf8"));
+  assert.deepEqual(settings.permissions, {
+    allow: ["read-in-cwd", "query-git-log"],
+    deny: ["write-out-cwd"],
+    ask: ["network"],
+    defaultMode: "askAll",
+  });
+});
+
+test("appendProjectPermissionAllows moves inherited ask and deny scopes into allow", () => {
+  const projectRoot = createTempDir("deepcode-permission-settings-move-inherited-");
+
+  appendProjectPermissionAllows(projectRoot, ["network", "write-out-cwd"], {
+    inheritedPermissions: {
+      allow: ["read-in-cwd"],
+      deny: ["write-out-cwd"],
+      ask: ["network", "mcp"],
+      defaultMode: "askAll",
+    },
+  });
+
+  const settingsPath = path.join(projectRoot, ".deepcode", "settings.json");
+  const settings = JSON.parse(fs.readFileSync(settingsPath, "utf8"));
+  assert.deepEqual(settings.permissions, {
+    allow: ["read-in-cwd", "network", "write-out-cwd"],
+    deny: [],
+    ask: ["mcp"],
+    defaultMode: "askAll",
+  });
+});
+
+test("appendProjectPermissionAllows writes inherited permissions even when scope is already allowed", () => {
+  const projectRoot = createTempDir("deepcode-permission-settings-inherited-existing-");
+
+  appendProjectPermissionAllows(projectRoot, ["read-in-cwd"], {
+    inheritedPermissions: {
+      allow: ["read-in-cwd"],
+      deny: [],
+      ask: ["network"],
+      defaultMode: "askAll",
+    },
+  });
+
+  const settingsPath = path.join(projectRoot, ".deepcode", "settings.json");
+  const settings = JSON.parse(fs.readFileSync(settingsPath, "utf8"));
+  assert.deepEqual(settings.permissions, {
+    allow: ["read-in-cwd"],
+    deny: [],
+    ask: ["network"],
+    defaultMode: "askAll",
+  });
+});
+
+test("appendProjectPermissionAllows preserves existing project permissions", () => {
+  const projectRoot = createTempDir("deepcode-permission-settings-explicit-default-");
+  const settingsPath = path.join(projectRoot, ".deepcode", "settings.json");
+  fs.mkdirSync(path.dirname(settingsPath), { recursive: true });
+  fs.writeFileSync(
+    settingsPath,
+    JSON.stringify({ permissions: { allow: ["read-in-cwd"], defaultMode: "allowAll" } }),
+    "utf8"
+  );
+
+  appendProjectPermissionAllows(projectRoot, ["query-git-log"], {
+    inheritedPermissions: {
+      allow: ["write-in-cwd"],
+      deny: ["write-out-cwd"],
+      ask: ["network"],
+      defaultMode: "askAll",
+    },
+  });
+
+  const settings = JSON.parse(fs.readFileSync(settingsPath, "utf8"));
+  assert.deepEqual(settings.permissions, {
+    allow: ["read-in-cwd", "query-git-log"],
+    defaultMode: "allowAll",
+  });
+});
+
+test("appendProjectPermissionAllows removes existing ask and deny conflicts", () => {
+  const projectRoot = createTempDir("deepcode-permission-settings-existing-conflict-");
+  const settingsPath = path.join(projectRoot, ".deepcode", "settings.json");
+  fs.mkdirSync(path.dirname(settingsPath), { recursive: true });
+  fs.writeFileSync(
+    settingsPath,
+    JSON.stringify({
+      permissions: {
+        allow: ["read-in-cwd"],
+        deny: ["network", "write-out-cwd"],
+        ask: ["network", "mcp"],
+        defaultMode: "askAll",
+      },
+    }),
+    "utf8"
+  );
+
+  appendProjectPermissionAllows(projectRoot, ["network"]);
+
+  const settings = JSON.parse(fs.readFileSync(settingsPath, "utf8"));
+  assert.deepEqual(settings.permissions, {
+    allow: ["read-in-cwd", "network"],
+    deny: ["write-out-cwd"],
+    ask: ["mcp"],
+    defaultMode: "askAll",
+  });
+});
+
 test("hasUserPermissionReplies detects permission reply payloads", () => {
   assert.equal(hasUserPermissionReplies({}), false);
   assert.equal(hasUserPermissionReplies({ permissions: [] }), false);