This is an automated email from the ASF dual-hosted git repository. hsluoyz pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/casbin-gateway.git
commit 286312710c8ec6d1ac641247ea608f061ee9f2d3 Author: Yang Luo <[email protected]> AuthorDate: Fri Sep 4 23:41:16 2026 +0800 feat(permissions): let cursor hooks refuse a file read and a subagent --- agenthook/cursor.go | 13 +++++++++---- agenthook/decide.go | 16 +++++++++++++--- agentpatch/cursor.go | 2 +- 3 files changed, 23 insertions(+), 8 deletions(-) diff --git a/agenthook/cursor.go b/agenthook/cursor.go index 60a8574..1f7e0d8 100644 --- a/agenthook/cursor.go +++ b/agenthook/cursor.go @@ -21,14 +21,19 @@ import ( "github.com/apache/casbin-gateway/auditutil" ) -// CursorEvents are the hook events Gateway installs. Cursor also reports every -// file read and every sentence the model produces; those say what the agent saw -// and thought rather than what it did, and arrive far too often to record. +// CursorEvents are the hook events Gateway installs. Every sentence the model +// produces is reported too; that is what the agent thought rather than what it +// did, and arrives far too often to record. +// +// beforeReadFile is the exception to that rule: a file read is also too often +// to record, and it is left out of NormalizeCursor for exactly that reason, but +// it is the only event that can refuse one, so it is installed to be decided +// and not to be reported. var CursorEvents = []string{ "sessionStart", "sessionEnd", "beforeSubmitPrompt", "stop", "preToolUse", "postToolUse", "postToolUseFailure", "beforeShellExecution", "afterShellExecution", - "beforeMCPExecution", "afterMCPExecution", + "beforeMCPExecution", "afterMCPExecution", "beforeReadFile", "afterFileEdit", "subagentStart", "subagentStop", "preCompact", } diff --git a/agenthook/decide.go b/agenthook/decide.go index 53c314f..bac63dd 100644 --- a/agenthook/decide.go +++ b/agenthook/decide.go @@ -47,9 +47,13 @@ var preToolEvents = map[string][]string{ "claude-code": {"PreToolUse"}, "qwen-code": {"PreToolUse"}, "gemini-cli": {"BeforeTool"}, - // Cursor asks separately for a shell command and an MCP call, and neither - // carries a tool name the general event would have given. - "cursor": {"preToolUse", "beforeShellExecution", "beforeMCPExecution"}, + // Cursor asks separately for a shell command, an MCP call, a file read and + // a subagent, and none of those carries a tool name the general event would + // have given. + "cursor": { + "preToolUse", "beforeShellExecution", "beforeMCPExecution", + "beforeReadFile", "subagentStart", + }, // Cascade names an action rather than a tool, and asks about each kind of // action separately. "windsurf": {"pre_run_command", "pre_write_code", "pre_mcp_tool_use"}, @@ -77,6 +81,12 @@ func preToolEvent(agentID string, event map[string]any) (string, bool) { // Only the command is carried, and running one is the whole of what // this event is. return "shell", true + case "beforeReadFile": + // Cursor asks this for every file whose content is about to enter the + // context, an attachment as much as a tool call. + return "Read", true + case "subagentStart": + return "Task", true case "pre_write_code": // Cascade edits a file in place, so this is the edit switch rather than // the one for creating a file. diff --git a/agentpatch/cursor.go b/agentpatch/cursor.go index c77fc00..4a62f3a 100644 --- a/agentpatch/cursor.go +++ b/agentpatch/cursor.go @@ -139,7 +139,7 @@ func (cursorPatcher) PatchNotice(patched bool) (string, string) { return "Removes Gateway's Cursor hooks. The editor and the CLI share them, so both stop reporting and stop being checked.", "Restart any Cursor session that is already running." } - return "Installs Gateway's Cursor hooks. They observe events, and refuse a shell command, an MCP call or a tool call this agent's permissions do not allow; the CLI reports fewer events than the editor, and an agent nobody has restricted is never held up.", + return "Installs Gateway's Cursor hooks. They observe events, and refuse a tool call, a shell command, an MCP call, a file read or a subagent this agent's permissions do not allow; the CLI reports fewer events than the editor, and an agent nobody has restricted is never held up.", "Restart any Cursor session that is already running." } --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
