feat: vendor permission system source

2026-08-28 08:35:57 +00:00 · 2026-08-19 14:35:19 +08:00
parent 198584daf8
commit 410c50a3e5
809 changed files with 157793 additions and 139 deletions
@@ -0,0 +1,42 @@
+---
+issue: 45
+issue_title: "Add \"approve for this session\" option to permission prompts"
+---
+
+# Retro: #45 — Add "approve for this session" option to permission prompts
+
+## Final Retrospective (2026-05-03T15:30:00Z)
+
+### Session summary
+
+Implemented session-scoped approvals for the `external_directory` permission surface across plan, TDD, ship, and release (v3.4.0).
+Four feat commits added `SessionApprovalCache`, extended the permission dialog with a fourth option, wired the cache into both file-tool and bash external-directory gates, and documented the feature.
+The TDD cycle caught a `deriveApprovalPrefix` edge case (trailing-separator paths) on the first red pass.
+
+### Observations
+
+#### What went well
+
+- TDD red→green cycle was clean across all three feature steps.
+  The `deriveApprovalPrefix` trailing-separator bug (`dirname("/other/project/src/")` strips the slash and returns the parent) was caught immediately by a failing test — fixed in seconds, no rework.
+- Plan-to-implementation fidelity was high.
+  The plan's `SessionApprovalCache` design, dialog extension, and `index.ts` wiring mapped 1:1 to the implementation with no structural surprises.
+- The `applyPermissionGate` abstraction (from #41) made the wiring step straightforward — wrapping `promptForApproval` to capture the decision state was a clean seam.
+- Ship and release were fully automated: CI green, release-please PR merged, v3.4.0 tagged.
+
+#### What caused friction (agent side)
+
+- `missing-context` — After committing the docs update, I did not proactively confirm that all plan-flagged documents were aligned.
+  The user had to ask "All our documents are up to date?"
+  to trigger verification.
+  Impact: one extra user round-trip, no rework needed (docs were actually complete).
+- `other` (tool fragility) — A multi-edit `Edit` call on `README.md` failed on the second edit due to an `oldText` mismatch with Unicode `→` characters in the architecture tree.
+  The first edit (session-scoped approvals section) was silently lost.
+  Caught during post-commit verification and fixed by amending the commit.
+  Impact: minor rework (re-applied the edit and amended), ~1 minute.
+
+#### What caused friction (user side)
+
+- The "All our documents are up to date?"
+  prompt was mechanical oversight — the agent should have provided a verification summary unprompted after the docs commit.
+  No user-side change needed; this is an agent salience issue.