feat: add bypass permission feature #6
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Reviewer's GuideThis PR introduces a new “bypassPermissions” mode by adding a default configuration setting, propagating it through initialization and transport layers, extending the UI and session logic to support it, enabling the dangerous skip flag in the SDK service, and updating the ignore list. Sequence diagram for session initialization with initialPermissionModesequenceDiagram
participant User
participant VSCode
participant Webview
participant Session
participant ClaudeSdkService
User->>VSCode: Open new session
VSCode->>Webview: Pass initialPermissionMode config
Webview->>Session: Initialize session
Session->>ClaudeSdkService: Launch Claude with permissionMode
ClaudeSdkService->>Session: Session ready (permissions mode applied)
Session->>User: Session starts with selected permission mode
Entity relationship diagram for permission mode configurationerDiagram
PACKAGE_JSON ||--o| SESSION : "sets initialPermissionMode"
SESSION ||--o| CLAUDE_SDK_SERVICE : "passes permissionMode"
SESSION ||--o| INIT_RESPONSE : "receives initialPermissionMode"
INIT_RESPONSE {
string modelSetting
string platform
string thinkingLevel
string initialPermissionMode
}
Class diagram for updated Session and InitResponse typesclassDiagram
class Session {
- hasExplicitlySetPermissionMode: boolean
+ setPermissionMode(mode: PermissionMode, applyToConnection: boolean): Promise<boolean>
}
class InitResponse {
+ modelSetting: string
+ platform: string
+ thinkingLevel: string
+ initialPermissionMode: PermissionMode
}
Session --> InitResponse : uses initialPermissionMode
Class diagram for updated ClaudeSdkServiceclassDiagram
class ClaudeSdkService {
+ allowDangerouslySkipPermissions: boolean
}
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey there - I've reviewed your changes and found some issues that need to be addressed.
- In ClaudeSdkService, tie allowDangerouslySkipPermissions to the active permissionMode instead of unconditionally enabling it to avoid unintended bypassing.
- Centralize permission mode constants into a shared enum and generate UI options/toggle order from it to reduce string duplication and improve maintainability.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- In ClaudeSdkService, tie allowDangerouslySkipPermissions to the active permissionMode instead of unconditionally enabling it to avoid unintended bypassing.
- Centralize permission mode constants into a shared enum and generate UI options/toggle order from it to reduce string duplication and improve maintainability.
## Individual Comments
### Comment 1
<location> `src/services/claude/ClaudeSdkService.ts:129` </location>
<code_context>
model: modelParam,
permissionMode: permissionModeParam,
maxThinkingTokens: maxThinkingTokens,
+ allowDangerouslySkipPermissions: true,
// CanUseTool 回调
</code_context>
<issue_to_address>
**🚨 issue (security):** Hardcoding 'allowDangerouslySkipPermissions: true' may introduce security risks.
Link this flag to the relevant permission mode or configuration to prevent unintended permission bypass.
</issue_to_address>
### Comment 2
<location> `src/webview/src/pages/ChatPage.vue:286` </location>
<code_context>
const s = session.value;
if (!s) return;
- const order: PermissionMode[] = ['default', 'acceptEdits', 'plan'];
+ const order: PermissionMode[] = ['default', 'acceptEdits', 'plan', 'bypassPermissions'];
const cur = (s.permissionMode.value as PermissionMode) ?? 'default';
const idx = Math.max(0, order.indexOf(cur));
</code_context>
<issue_to_address>
**suggestion (bug_risk):** Including 'bypassPermissions' in the toggle order may lead to accidental selection.
Consider adding a confirmation prompt or removing 'bypassPermissions' from the toggle sequence to reduce the risk of accidental activation.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary / 摘要
This PR wires a new "Bypass Permission" mode that allows Claude to execute tools and apply edits without requesting user confirmation.
此 PR 连接了"绕过权限"模式，允许 Claude 在不请求用户确认的情况下执行工具和应用编辑。
Changes / 变更内容
Configuration: Added
claudix.initialPermissionModesetting to allow users to set their preferred default permission modePermission Modes: Extended permission mode options to include
bypassPermissionsUI Updates: Added "Bypass" mode button with warning icon in the mode selector dropdown
Session Management: Implemented automatic application of initial permission mode for new sessions
Service Layer: Enabled
allowDangerouslySkipPermissionsflag in Claude SDK serviceGit Ignore: Added
.augment/directory to.gitignore配置选项：添加
claudix.initialPermissionMode设置，允许用户设置首选的默认权限模式权限模式：扩展权限模式选项，包含
bypassPermissionsUI 更新：在模式选择下拉菜单中添加带警告图标的"Bypass"模式按钮
会话管理：为新会话实现初始权限模式的自动应用
服务层：在 Claude SDK 服务中启用
allowDangerouslySkipPermissions标志Git 忽略：将
.augment/目录添加到.gitignoreModified Files / 修改的文件
.augment/**to ignore listclaudix.initialPermissionModeconfigurationInitResponseinterfaceUsage / 使用方法
Ctrl+,orCmd+,)default: Ask for permission on each tool useacceptEdits: Automatically accept edit operationsplan: Plan mode for task planningbypassPermissions:Toggle between modes using the mode selector in the chat interface.
Ctrl+,或Cmd+,)default: 每次工具使用时请求权限acceptEdits: 自动接受编辑操作plan: 任务规划的计划模式bypassPermissions:在聊天界面中使用模式选择器在模式之间切换。
Summary by Sourcery
Enable a new bypass permission feature by adding a configurable initialPermissionMode setting, updating session initialization, service, and transport layers, and enhancing the UI to support a warning-enabled Bypass mode that skips all confirmation prompts
New Features:
Enhancements:
Chores: