新增: AI 工具意图识别层 + 文件访问权限模型 Phase B+C

会话意图识别层(intent.rs / df-ai crate):
- Intent 枚举 11 态 + recognize 规则识别(关键词+权重+优先级)+ tool_subset_for 工具子集映射
- 模态接口预留 None,独立模块待接入 loop,36 单测

文件访问权限模型 Phase B+C(F-260619-03):
- Phase B 会话临时白名单 + 循环挂起 + DirAuthDialog 弹窗(仅本次/未来都允许/拒绝)
- Phase C 系统目录黑名单(Win System32/Program Files;Unix /etc /usr...)分段匹配 + 写操作约束
- 已审 CR-260619-09 ✅ PASS

src/components/AiChat.vue

@@ -58,6 +58,8 @@
         </div>
         <!-- 第五批抽离至 ai/MaxRoundsCard.vue(F-260616-03 达 max_iterations 暂停态操作卡,零行为变更,store 单例 + pendingMaxRounds 模块级 ref 共享,toast 经 emit 转父) -->
         <MaxRoundsCard @toast="(p) => showToast(p.msg, p.type)" />
+        <!-- F-260619-03 Phase B: 路径授权弹窗(LLM 访问白名单外目录挂起,三选项 once/always/deny) -->
+        <DirAuthDialog @toast="(p) => showToast(p.msg, p.type)" />
         <!-- 待发送队列（生成中排队的消息，完成后自动续发） -->
         <div v-if="store.state.queue.length > 0" class="ai-queue" :class="{ 'ai-queue--timeout': queueTimedOut }">
           <div class="ai-queue-head">
@@ -131,6 +133,7 @@ import ChatInput from './ai/ChatInput.vue'
 import TopBar from './ai/TopBar.vue'
 import MessageList from './ai/MessageList.vue'
 import MaxRoundsCard from './ai/MaxRoundsCard.vue'
+import DirAuthDialog from './ai/DirAuthDialog.vue'
 import { useConfirm } from '../composables/useConfirm'
 import { useProjectStore } from '../stores/project'
 import type { AiMessage } from '../api/types'

src/components/ai/DirAuthDialog.vue

@@ -0,0 +1,142 @@
+<template>
+  <!-- F-260619-03 Phase B: 路径授权弹窗(LLM 想访问白名单外目录,后端挂起 loop 等用户决定)。
+       条件:pendingDirAuth(AiDirAuthRequired 事件置)+ 当前视图正在生成(防切走后误显)。
+       点"仅本次" → ai_authorize_dir(decision=once, 写会话临时授权)→ 后端执行工具 + try_continue。
+       点"未来都允许" → ai_authorize_dir(decision=always, 写持久化 Settings KV)→ 执行 + 续 loop。
+       点"拒绝" → ai_authorize_dir(decision=deny, 工具返 Err)→ 续 loop。
+       store 单例共享(state/aiApi),pendingDirAuth 模块级 ref(useAiEvents)直接导入。
+       toast 经 emit 转父(保持单一 toast 源)。 -->
+  <div v-if="showDirAuthCard" class="ai-dir-auth">
+    <span class="ai-dir-auth-text">{{ $t('aiChat.dirAuthRequired') }}</span>
+    <span class="ai-dir-auth-hint">
+      {{ $t('aiChat.dirAuthHint', { tool: pendingDirAuth?.tool, path: pendingDirAuth?.path }) }}
+    </span>
+    <div class="ai-dir-auth-actions">
+      <button
+        class="ai-dir-auth-btn ai-dir-auth-btn--once"
+        :disabled="dirAuthActing"
+        @click="handleAuthorize('once')"
+      >{{ $t('aiChat.dirAuthOnce') }}</button>
+      <button
+        class="ai-dir-auth-btn ai-dir-auth-btn--always"
+        :disabled="dirAuthActing"
+        @click="handleAuthorize('always')"
+      >{{ $t('aiChat.dirAuthAlways') }}</button>
+      <button
+        class="ai-dir-auth-btn ai-dir-auth-btn--deny"
+        :disabled="dirAuthActing"
+        @click="handleAuthorize('deny')"
+      >{{ $t('aiChat.dirAuthDeny') }}</button>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, computed, watch } from 'vue'
+import { useI18n } from 'vue-i18n'
+import { useAiStore } from '../../stores/ai'
+import { pendingDirAuth } from '../../composables/ai/useAiEvents'
+import { aiApi } from '../../api'
+
+const emit = defineEmits<{
+  (e: 'toast', payload: { msg: string; type: 'error' | 'warning' | 'info' }): void
+}>()
+
+const store = useAiStore()
+const { t } = useI18n()
+
+// 当前视图是否正在生成(切走后台生成时光标不显示,与 MaxRoundsCard 一致守卫)
+const isViewingGenerating = computed(() =>
+  store.state.streaming && store.state.generatingConvId === store.state.activeConversationId,
+)
+
+// pendingDirAuth(AiDirAuthRequired 事件置)+ 当前视图正在生成(防切走后误显)双重守卫。
+const dirAuthActing = ref(false)
+const showDirAuthCard = computed(() =>
+  pendingDirAuth.value !== null && isViewingGenerating.value,
+)
+
+/** 点三选项之一:调 ai_authorize_dir。后端 remove pending → 写授权/拒 → execute → try_continue。
+ *  不主动清 pendingDirAuth——由后端 AiApprovalResult/AiCompleted/AiError 在 useAiEvents 内清。
+ *  IPC 失败回滚 acting 让用户可重试。 */
+async function handleAuthorize(decision: 'once' | 'always' | 'deny'): Promise<void> {
+  const id = pendingDirAuth.value?.id
+  if (!id) return
+  dirAuthActing.value = true
+  try {
+    await aiApi.authorizeDir(id, decision)
+  } catch (e) {
+    dirAuthActing.value = false
+    const msg = e instanceof Error ? e.message : String(e)
+    emit('toast', { msg: t('aiChat.dirAuthFailed', { msg }), type: 'error' })
+  }
+}
+
+/** pendingDirAuth 离开挂起态(后端事件已清)时复位 acting,允许下次再操作 */
+watch(() => pendingDirAuth.value, (v) => {
+  if (!v) dirAuthActing.value = false
+})
+</script>
+
+<style scoped>
+.ai-dir-auth {
+  display: flex;
+  flex-direction: column;
+  gap: 3px;
+  margin-bottom: 6px;
+  padding: 6px 8px;
+  background: color-mix(in srgb, var(--df-warning) 10%, transparent);
+  border: 0.5px solid color-mix(in srgb, var(--df-warning) 40%, transparent);
+  border-radius: var(--df-radius);
+}
+.ai-dir-auth-text {
+  font-size: 11.5px;
+  font-weight: 600;
+  color: var(--df-warning);
+}
+.ai-dir-auth-hint {
+  font-size: 10.5px;
+  color: var(--df-text-dim);
+  opacity: 0.9;
+  word-break: break-all;
+}
+.ai-dir-auth-actions {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  margin-top: 2px;
+  flex-wrap: wrap;
+}
+.ai-dir-auth-btn {
+  border: none;
+  cursor: pointer;
+  font-size: 11px;
+  font-weight: 600;
+  padding: 3px 10px;
+  border-radius: calc(var(--df-radius) - 2px);
+  transition: filter 0.15s var(--df-ease);
+}
+.ai-dir-auth-btn:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+.ai-dir-auth-btn--once {
+  background: var(--df-accent);
+  color: #fff;
+}
+.ai-dir-auth-btn--once:hover:not(:disabled) { filter: brightness(1.1); }
+.ai-dir-auth-btn--always {
+  background: var(--df-warning);
+  color: #000;
+}
+.ai-dir-auth-btn--always:hover:not(:disabled) { filter: brightness(1.1); }
+.ai-dir-auth-btn--deny {
+  background: transparent;
+  color: var(--df-text-dim);
+  border: 0.5px solid var(--df-border);
+}
+.ai-dir-auth-btn--deny:hover:not(:disabled) {
+  color: var(--df-text);
+  border-color: var(--df-text-dim);
+}
+</style>