feat: add exec approvals allowlists

apps/macos/Sources/Clawdbot/MacNodeConfigFile.swift

@@ -38,39 +38,14 @@ enum MacNodeConfigFile {
         }
     }
 
-    static func systemRunPolicy() -> SystemRunPolicy? {
-        let root = self.loadDict()
-        let systemRun = root["systemRun"] as? [String: Any]
-        let raw = systemRun?["policy"] as? String
-        guard let raw, let policy = SystemRunPolicy(rawValue: raw) else { return nil }
-        return policy
+    private static func systemRunSection(from root: [String: Any]) -> [String: Any] {
+        root["systemRun"] as? [String: Any] ?? [:]
     }
 
-    static func setSystemRunPolicy(_ policy: SystemRunPolicy) {
+    private static func updateSystemRunSection(_ mutate: (inout [String: Any]) -> Void) {
         var root = self.loadDict()
-        var systemRun = root["systemRun"] as? [String: Any] ?? [:]
-        systemRun["policy"] = policy.rawValue
-        root["systemRun"] = systemRun
-        self.saveDict(root)
-    }
-
-    static func systemRunAllowlist() -> [String]? {
-        let root = self.loadDict()
-        let systemRun = root["systemRun"] as? [String: Any]
-        return systemRun?["allowlist"] as? [String]
-    }
-
-    static func setSystemRunAllowlist(_ allowlist: [String]) {
-        let cleaned = allowlist
-            .map { $0.trimmingCharacters(in: .whitespacesAndNewlines) }
-            .filter { !$0.isEmpty }
-        var root = self.loadDict()
-        var systemRun = root["systemRun"] as? [String: Any] ?? [:]
-        if cleaned.isEmpty {
-            systemRun.removeValue(forKey: "allowlist")
-        } else {
-            systemRun["allowlist"] = cleaned
-        }
+        var systemRun = self.systemRunSection(from: root)
+        mutate(&systemRun)
         if systemRun.isEmpty {
             root.removeValue(forKey: "systemRun")
         } else {
@@ -78,4 +53,147 @@ enum MacNodeConfigFile {
         }
         self.saveDict(root)
     }
+
+    private static func agentSection(_ systemRun: [String: Any], agentId: String) -> [String: Any]? {
+        let agents = systemRun["agents"] as? [String: Any]
+        return agents?[agentId] as? [String: Any]
+    }
+
+    private static func updateAgentSection(
+        _ systemRun: inout [String: Any],
+        agentId: String,
+        mutate: (inout [String: Any]) -> Void)
+    {
+        var agents = systemRun["agents"] as? [String: Any] ?? [:]
+        var entry = agents[agentId] as? [String: Any] ?? [:]
+        mutate(&entry)
+        if entry.isEmpty {
+            agents.removeValue(forKey: agentId)
+        } else {
+            agents[agentId] = entry
+        }
+        if agents.isEmpty {
+            systemRun.removeValue(forKey: "agents")
+        } else {
+            systemRun["agents"] = agents
+        }
+    }
+
+    static func systemRunPolicy(agentId: String? = nil) -> SystemRunPolicy? {
+        let root = self.loadDict()
+        let systemRun = self.systemRunSection(from: root)
+        if let agentId, let agent = self.agentSection(systemRun, agentId: agentId) {
+            let raw = agent["policy"] as? String
+            if let raw, let policy = SystemRunPolicy(rawValue: raw) { return policy }
+        }
+        let raw = systemRun["policy"] as? String
+        guard let raw, let policy = SystemRunPolicy(rawValue: raw) else { return nil }
+        return policy
+    }
+
+    static func setSystemRunPolicy(_ policy: SystemRunPolicy, agentId: String? = nil) {
+        self.updateSystemRunSection { systemRun in
+            if let agentId {
+                self.updateAgentSection(&systemRun, agentId: agentId) { entry in
+                    entry["policy"] = policy.rawValue
+                }
+                return
+            }
+            systemRun["policy"] = policy.rawValue
+        }
+    }
+
+    static func systemRunAutoAllowSkills(agentId: String?) -> Bool? {
+        let root = self.loadDict()
+        let systemRun = self.systemRunSection(from: root)
+        if let agentId, let agent = self.agentSection(systemRun, agentId: agentId) {
+            if let value = agent["autoAllowSkills"] as? Bool { return value }
+        }
+        return systemRun["autoAllowSkills"] as? Bool
+    }
+
+    static func setSystemRunAutoAllowSkills(_ enabled: Bool, agentId: String?) {
+        self.updateSystemRunSection { systemRun in
+            if let agentId {
+                self.updateAgentSection(&systemRun, agentId: agentId) { entry in
+                    entry["autoAllowSkills"] = enabled
+                }
+                return
+            }
+            systemRun["autoAllowSkills"] = enabled
+        }
+    }
+
+    static func systemRunAllowlist(agentId: String?) -> [SystemRunAllowlistEntry]? {
+        let root = self.loadDict()
+        let systemRun = self.systemRunSection(from: root)
+        let raw: [Any]? = {
+            if let agentId, let agent = self.agentSection(systemRun, agentId: agentId) {
+                return agent["allowlist"] as? [Any]
+            }
+            return systemRun["allowlist"] as? [Any]
+        }()
+        guard let raw else { return nil }
+
+        if raw.allSatisfy({ $0 is String }) {
+            let legacy = raw.compactMap { $0 as? String }
+            return legacy.compactMap { key in
+                let pattern = key.trimmingCharacters(in: .whitespacesAndNewlines)
+                guard !pattern.isEmpty else { return nil }
+                return SystemRunAllowlistEntry(
+                    pattern: pattern,
+                    enabled: true,
+                    matchKind: .argv,
+                    source: .manual)
+            }
+        }
+
+        return raw.compactMap { item in
+            guard let dict = item as? [String: Any] else { return nil }
+            return SystemRunAllowlistEntry(dict: dict)
+        }
+    }
+
+    static func setSystemRunAllowlist(_ allowlist: [SystemRunAllowlistEntry], agentId: String?) {
+        let cleaned = allowlist
+            .map { $0 }
+            .filter { !$0.pattern.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty }
+        let raw = cleaned.map { $0.asDict() }
+        self.updateSystemRunSection { systemRun in
+            if let agentId {
+                self.updateAgentSection(&systemRun, agentId: agentId) { entry in
+                    if raw.isEmpty {
+                        entry.removeValue(forKey: "allowlist")
+                    } else {
+                        entry["allowlist"] = raw
+                    }
+                }
+                return
+            }
+            if raw.isEmpty {
+                systemRun.removeValue(forKey: "allowlist")
+            } else {
+                systemRun["allowlist"] = raw
+            }
+        }
+    }
+
+    static func systemRunAllowlistStrings() -> [String]? {
+        let root = self.loadDict()
+        let systemRun = self.systemRunSection(from: root)
+        return systemRun["allowlist"] as? [String]
+    }
+
+    static func setSystemRunAllowlistStrings(_ allowlist: [String]) {
+        let cleaned = allowlist
+            .map { $0.trimmingCharacters(in: .whitespacesAndNewlines) }
+            .filter { !$0.isEmpty }
+        self.updateSystemRunSection { systemRun in
+            if cleaned.isEmpty {
+                systemRun.removeValue(forKey: "allowlist")
+            } else {
+                systemRun["allowlist"] = cleaned
+            }
+        }
+    }
 }