权限声明

场景需要在 scenario.json 中声明所需的权限，运行时系统会校验权限是否满足。

权限列表

工作区权限

权限标识	说明
workspace:read	读取工作区文件
workspace:write	写入工作区文件
workspace:execute	执行工作区文件

网络权限

权限标识	说明
web:search	搜索互联网
web:fetch	获取网页内容
web:api	调用外部 API

系统权限

权限标识	说明
system:shell	执行 Shell 命令
system:url	打开外部 URL
system:notification	发送系统通知
system:clipboard	读写剪贴板

内存权限

权限标识	说明
memory:read	读取记忆
memory:write	写入记忆

数据权限

权限标识	说明
database:read	读取数据库
database:write	写入数据库

声明方式

{
  "permissions": [
    "workspace:read",
    "workspace:write",
    "web:search",
    "web:fetch",
    "memory:read",
    "memory:write",
    "database:read",
    "database:write"
  ]
}

权限校验

运行时，每个工具执行前都会进行权限校验：

// 内置工具权限映射
const TOOL_PERMISSION_MAP = {
  'read_file': 'workspace:read',
  'write_file': 'workspace:write',
  'list_files': 'workspace:read',
  'delete_file': 'workspace:write',
  'search_files': 'workspace:read',
  'web_search': 'web:search',
  'web_fetch': 'web:fetch',
  'execute_command': 'system:shell',
  'open_url': 'system:url',
  'remember': 'memory:write',
  'recall': 'memory:read',
  'forget': 'memory:write',
}

如果场景未声明对应权限，工具调用将返回权限拒绝错误。

权限组

为方便声明，提供了预定义的权限组：

权限组	包含权限
workspace:full	workspace:read, workspace:write, workspace:execute
web:full	web:search, web:fetch, web:api
memory:full	memory:read, memory:write
database:full	database:read, database:write
system:basic	system:url, system:notification, system:clipboard

最小权限原则

建议遵循最小权限原则，只声明场景实际需要的权限：

// ✅ 好的做法：只声明需要的权限
{
  "permissions": ["workspace:read", "web:search"]
}

// ❌ 不好的做法：声明过多不需要的权限
{
  "permissions": [
    "workspace:read", "workspace:write", "workspace:execute",
    "web:search", "web:fetch", "web:api",
    "system:shell", "system:url", "system:notification",
    "memory:read", "memory:write",
    "database:read", "database:write"
  ]
}

权限审核

当场景发布到市场时，管理员会审核权限声明是否合理。如果场景声明了过多不必要的权限，可能会被拒绝上架。