feat: add getScopeRiskColor function for permission scope risk mapping

Author: qorzj

src/common/permissions.ts

@@ -164,9 +164,10 @@ export function computeToolCallPermissions(options: ComputeToolCallPermissionsOp
     const permission = evaluatePermissionScopes(request.scopes, options.settings);
     permissions.push({ toolCallId: toolCall.id, permission });
     if (permission === "ask") {
+      const askScopes = getPermissionScopesRequiringAsk(request.scopes, options.settings);
       askPermissions.push({
         toolCallId: toolCall.id,
-        scopes: request.scopes,
+        scopes: askScopes.length > 0 ? askScopes : request.scopes,
         name: request.name,
         command: request.command,
         description: request.description,
@@ -285,6 +286,38 @@ export function evaluatePermissionScopes(
   return settings.defaultMode === "askAll" ? "ask" : "allow";
 }
 
+export function getPermissionScopesRequiringAsk(
+  scopes: AskPermissionScope[],
+  settings: Required<PermissionSettings> = {
+    allow: [],
+    deny: [],
+    ask: [],
+    defaultMode: "allowAll",
+  }
+): AskPermissionScope[] {
+  const result: AskPermissionScope[] = [];
+  for (const scope of scopes) {
+    if (scope === "unknown") {
+      result.push(scope);
+      continue;
+    }
+    if (settings.deny.includes(scope)) {
+      continue;
+    }
+    if (settings.ask.includes(scope)) {
+      result.push(scope);
+      continue;
+    }
+    if (settings.allow.includes(scope)) {
+      continue;
+    }
+    if (settings.defaultMode === "askAll") {
+      result.push(scope);
+    }
+  }
+  return result;
+}
+
 export function parseBashSideEffects(value: unknown): AskPermissionScope[] {
   const validScopes = new Set<AskPermissionScope>([
     "read-in-cwd",

src/tests/permission-prompt.test.ts

@@ -0,0 +1,19 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { getScopeRiskColor } from "../ui/PermissionPrompt";
+
+test("getScopeRiskColor maps permission scopes by risk", () => {
+  assert.equal(getScopeRiskColor("read-in-cwd"), "#22c55e");
+  assert.equal(getScopeRiskColor("query-git-log"), "#22c55e");
+
+  assert.equal(getScopeRiskColor("read-out-cwd"), "#f59e0b");
+  assert.equal(getScopeRiskColor("write-in-cwd"), "#f59e0b");
+  assert.equal(getScopeRiskColor("network"), "#f59e0b");
+  assert.equal(getScopeRiskColor("mcp"), "#f59e0b");
+
+  assert.equal(getScopeRiskColor("write-out-cwd"), "#ef4444");
+  assert.equal(getScopeRiskColor("delete-in-cwd"), "#ef4444");
+  assert.equal(getScopeRiskColor("delete-out-cwd"), "#ef4444");
+  assert.equal(getScopeRiskColor("mutate-git-log"), "#ef4444");
+  assert.equal(getScopeRiskColor("unknown"), "#ef4444");
+});

src/tests/permissions.test.ts

@@ -93,6 +93,39 @@ test("computeToolCallPermissions maps tool calls to permission requests", () =>
   );
 });
 
+test("computeToolCallPermissions only asks for scopes not already allowed", () => {
+  const projectRoot = createTempDir("deepcode-permissions-filter-workspace-");
+  const plan = computeToolCallPermissions({
+    sessionId: "session-1",
+    projectRoot,
+    settings: {
+      allow: ["read-in-cwd"],
+      deny: [],
+      ask: [],
+      defaultMode: "askAll",
+    },
+    toolCalls: [
+      {
+        id: "call-bash",
+        type: "function",
+        function: {
+          name: "bash",
+          arguments: JSON.stringify({
+            command: "curl -s http://localhost:8899/ && ls index.html",
+            sideEffects: ["network", "read-in-cwd"],
+          }),
+        },
+      },
+    ],
+  });
+
+  assert.deepEqual(plan.permissions, [{ toolCallId: "call-bash", permission: "ask" }]);
+  assert.deepEqual(
+    plan.askPermissions.map((item) => ({ id: item.toolCallId, scopes: item.scopes })),
+    [{ id: "call-bash", scopes: ["network"] }]
+  );
+});
+
 test("appendProjectPermissionAllows writes unique project-level allow scopes", () => {
   const projectRoot = createTempDir("deepcode-permission-settings-");
   const settingsPath = path.join(projectRoot, ".deepcode", "settings.json");

src/ui/PermissionPrompt.tsx

@@ -20,6 +20,13 @@ type ScopePrompt = {
   scope: AskPermissionScope;
 };
 
+type PromptOption = {
+  kind: "allow" | "always" | "deny";
+  label: string;
+  scopeDescription?: string;
+  scopeColor?: string;
+};
+
 const ALWAYS_ALLOWED_SCOPES = new Set<AskPermissionScope>([
   "read-in-cwd",
   "read-out-cwd",
@@ -138,7 +145,7 @@ export function PermissionPrompt({ requests, onSubmit, onCancel }: Props): React
         {options.map((option, optionIndex) => (
           <Text key={option.kind} color={optionIndex === cursor ? "cyanBright" : undefined}>
             {optionIndex === cursor ? "> " : "  "}
-            {optionIndex + 1}. {option.label}
+            {optionIndex + 1}. {renderOptionLabel(option)}
           </Text>
         ))}
       </Box>
@@ -149,6 +156,18 @@ export function PermissionPrompt({ requests, onSubmit, onCancel }: Props): React
   );
 }
 
+function renderOptionLabel(option: PromptOption): React.ReactNode {
+  if (option.scopeDescription && option.scopeColor) {
+    return (
+      <>
+        {option.label}
+        <Text color={option.scopeColor}>{option.scopeDescription}</Text>
+      </>
+    );
+  }
+  return option.label;
+}
+
 function buildScopePrompts(requests: AskPermissionRequest[]): ScopePrompt[] {
   const prompts: ScopePrompt[] = [];
   for (const request of requests) {
@@ -159,10 +178,15 @@ function buildScopePrompts(requests: AskPermissionRequest[]): ScopePrompt[] {
   return prompts;
 }
 
-function buildOptions(scope: AskPermissionScope): Array<{ kind: "allow" | "always" | "deny"; label: string }> {
-  const options: Array<{ kind: "allow" | "always" | "deny"; label: string }> = [{ kind: "allow", label: "Yes" }];
+function buildOptions(scope: AskPermissionScope): PromptOption[] {
+  const options: PromptOption[] = [{ kind: "allow", label: "Yes" }];
   if (isAlwaysAllowedScope(scope)) {
-    options.push({ kind: "always", label: `Yes, and always allow ${describeScope(scope)}` });
+    options.push({
+      kind: "always",
+      label: "Yes, and always allow ",
+      scopeDescription: describeScope(scope),
+      scopeColor: getScopeRiskColor(scope),
+    });
   }
   options.push({ kind: "deny", label: "No" });
   return options;
@@ -201,6 +225,27 @@ function isAlwaysAllowedScope(scope: AskPermissionScope): scope is PermissionSco
   return ALWAYS_ALLOWED_SCOPES.has(scope);
 }
 
+export function getScopeRiskColor(scope: AskPermissionScope): string {
+  switch (scope) {
+    case "read-in-cwd":
+    case "query-git-log":
+      return "#22c55e";
+    case "read-out-cwd":
+    case "write-in-cwd":
+    case "network":
+    case "mcp":
+      return "#f59e0b";
+    case "write-out-cwd":
+    case "delete-in-cwd":
+    case "delete-out-cwd":
+    case "mutate-git-log":
+    case "unknown":
+      return "#ef4444";
+    default:
+      return "#ef4444";
+  }
+}
+
 function describeScope(scope: PermissionScope): string {
   switch (scope) {
     case "read-in-cwd":