[Colafornia]

English

Summary

When the Host refuses requested file or process access before execution, service wrappers can reduce the error to a message. Callers then lose the refusal reason and requested target.

Return permission_denied business results from the JSON file methods and process service. Preserve the reason, requested permissions, optional command and message, with executionState: not_started. Reasons distinguish disabled requests, user denial, protected boundaries, insufficient approval and expired grants. Regenerate the SDK contracts from these service schemas.

Existing JSON results and operation receipts carry the response through the generic tool projection. The change adds no special permission-error decoding to Code Mode or the Agent journal. Process exit evidence and unknown-operation receipts keep their existing paths; stderr is not used to infer a permission refusal.

readImage retains its existing image error protocol and still returns a string error for a refusal. Its protocol is outside this change.

Verification

• Rebased onto 83fd321171dbffaad0d77cf1e9a616196da36687 (rust-preview). Reviewed head: 0e5358f83.
• cargo test -p maka-agent-native -p maka-agent-facts --lib: 32 Native and 29 Facts tests passed on the rebased head.
• node packages/plugin-sdk/scripts/generate.mjs check: five runtime declaration files verified on the rebased head.
• Changed-crate cargo fmt checks and git diff --check passed.
• Not run: real Host service invocation, real approval/grant lifecycle, standalone TypeScript typecheck, or complete just check.

Before rebasing, the temporary ablation experiment serialized an actual ProcessResult::PermissionDenied into the existing operation-receipt snapshot test. The result survived generic JSON/operation value conversion, durable output, projection and snapshot transfer after removing the special consumer paths. The temporary fixture was then restored. This verifies consumers, not a real Files/Processes Handler invocation.

Remaining validation

• Add a focused Host-level Files/Processes refusal regression that checks the returned reason and target through the actual service Handler.

This PR remains a draft pending that behavior test. The earlier injected-ToolError tests were removed because no current service entry sends that typed error directly to the Agent consumers.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex implemented the change, ran the ablation experiments and checks, and wrote the documentation and PR description. Preserve the Generated-by: Codex trailer when squashing.

Checklist

• Tests cover the change and fail without it
• Format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

中文

概述

当 Host 在执行前拒绝文件或进程的权限申请时，服务封装可能只保留错误说明，调用方会丢失拒绝原因和申请目标。

让返回 JSON 的文件方法与进程服务返回 permission_denied 业务结果，保留原因、申请权限、可选命令和错误说明，并标记 executionState: not_started。原因区分禁止申请、用户拒绝、保护边界、批准不足和授权失效。SDK 契约由服务结果的模式定义重新生成。

结果通过现有 JSON 及操作回执进入通用工具投影。本次不为 Code Mode 或 Agent 日志新增权限错误的特殊解码。进程退出证据及未知操作回执继续使用既有路径，不根据标准错误输出推断权限拒绝。

readImage 保留现有图片错误协议，权限拒绝仍返回字符串错误；本次不修改该协议。

验证

• 已变基到 83fd321171dbffaad0d77cf1e9a616196da36687（rust-preview），检查的提交为 0e5358f83。
• cargo test -p maka-agent-native -p maka-agent-facts --lib：变基后的提交通过 32 项 Native 测试和 29 项 Facts 测试。
• node packages/plugin-sdk/scripts/generate.mjs check：变基后的提交通过 5 个运行时声明文件校验。
• 受影响 crate 的 cargo fmt 检查及 git diff --check 通过。
• 未运行真实 Host 服务调用、真实审批／授权生命周期、独立 TypeScript 类型检查或完整 just check。

变基前的临时消融实验把真实的 ProcessResult::PermissionDenied 序列化结果放入既有操作回执快照测试。在删除特殊消费路径后，结果仍完整通过通用 JSON／操作值转换、持久化输出、投影和快照迁移。实验结束后已恢复临时夹具。这验证了消费路径，没有执行真实 Files／Processes 服务处理器调用。

待完成验证

• 增加聚焦的 Host 层文件／进程权限拒绝回归测试，通过真实服务处理器检查返回的原因和目标。

此 PR 保持草稿状态，等待上述行为测试。原先注入 ToolError 的测试已删除，因为当前服务入口不会把该类型的错误直接送入 Agent 消费路径。

AI 使用情况

• 生成式工具未作出实质贡献
• 生成式工具作出了实质贡献

工具及范围：OpenAI Codex 完成实现、消融实验、检查、文档和 PR 说明。合并压缩提交时请保留 Generated-by: Codex 标记。

检查清单

• 测试覆盖本次改动，且移除相关实现后会失败
• 格式、类型检查及受影响套件均已在本地通过

本 PR 是否改变行为？

• 是，已在上方概述中说明
• 否