新增: F-260619-03 PhaseA AI工具文件访问动态权限白名单

- state.rs: AllowedDirs(persistent HashSet + is_authorized workspace_root+starts_with + canonicalize) + AppState allowed_dirs Arc + reload/set/get Settings KV
- tool_registry.rs: resolve_workspace_path 多目录白名单双校验(词法+canonicalize) + handler闭包引入AllowedDirs Arc(9文件工具) + run_command不走白名单
- commands/config.rs: ai_get/set_allowed_dirs IPC + lib.rs注册
- 前端: api/ai.ts + AllowedDirsPanel.vue(Settings授权目录UI) + i18n
- 测试: 5 AllowedDirs单测 + 基线适配(29工具不变)
workspace_root始终授权(零回归); Phase A仅持久化(不含B弹窗/C写约束)
主代兜底: cargo check devflow 0 + test 129 + vue-tsc 0

src/i18n/en/settings.ts

@@ -109,6 +109,16 @@ export default {
     labelAgentMaxRetries: 'Stream failure retries',
     descAgentMaxRetries: 'Auto-retry count on stream failure (0-10, default 3); only retries pre-stream failures (no token output yet); mid-stream failures are abandoned',
 
+    // ===== F-260619-03 Phase A: AI tool allowed dirs panel =====
+    panelAllowedDirs: '📁 AI Tool Allowed Dirs',
+    descAllowedDirs: 'AI file tools (read/write/list/patch/search) can only access the following authorized directories. The project root (workspace_root) is always implicitly authorized and need not be added. Access to directories not in the list will be rejected.',
+    allowedDirsLoading: 'Loading…',
+    allowedDirsEmpty: 'No extra authorized directories (only project root is authorized by default)',
+    allowedDirsInputPlaceholder: 'Enter absolute path, e.g. E:/wk-lab/u-abc',
+    allowedDirsAdd: 'Add',
+    allowedDirsSave: 'Save',
+    allowedDirsReload: 'Reload',
+
     // ===== Knowledge base panel =====
     panelKnowledge: '📚 Knowledge base',
     labelAutoExtract: 'Auto-distill knowledge',

src/i18n/zh-CN/settings.ts

@@ -109,6 +109,16 @@ export default {
     labelAgentMaxRetries: '流式失败重试次数',
     descAgentMaxRetries: '流式对话失败时自动重试次数（0-10，默认 3）；只重试未输出任何 token 的流前失败，已输出文本的失败直接放弃',
 
+    // ===== F-260619-03 Phase A: AI 工具授权目录面板 =====
+    panelAllowedDirs: '📁 AI 工具授权目录',
+    descAllowedDirs: 'AI 文件工具(读/写/列/改/搜等)仅可访问以下授权目录。项目根目录(workspace_root)始终隐式授权,无需在此添加。未在列表内的目录访问将被拒绝。',
+    allowedDirsLoading: '加载中…',
+    allowedDirsEmpty: '暂无额外授权目录(仅项目根目录默认授权)',
+    allowedDirsInputPlaceholder: '输入授权目录绝对路径,如 E:/wk-lab/u-abc',
+    allowedDirsAdd: '添加',
+    allowedDirsSave: '保存',
+    allowedDirsReload: '重载',
+
     // ===== 知识库面板 =====
     panelKnowledge: '📚 知识库',
     labelAutoExtract: '自动提炼知识',