@botconnector/bccli 0.4.0-beta.9 → 0.4.0

package/dist/{chunk-ELML4KVQ.js → chunk-O7M3TGIW.js}

@@ -6,10 +6,36 @@ var MODE_ORDER = ["default", "acceptEdits", "plan", "allowAll"];
 function nextMode(mode) {
   return MODE_ORDER[(MODE_ORDER.indexOf(mode) + 1) % MODE_ORDER.length];
 }
-var TWO_WORD = /* @__PURE__ */ new Set(["npm", "npx", "pnpm", "yarn", "bun", "git", "cargo", "go", "docker", "python", "python3", "uv", "make"]);
+var ALWAYS_ASK_COMMANDS = /* @__PURE__ */ new Set(["sudo", "sh", "bash", "zsh", "su"]);
+function isAlwaysAsk(segment) {
+  const words = segment.trim().split(/\s+/);
+  const first = words[0] ?? "";
+  if (ALWAYS_ASK_COMMANDS.has(first)) return true;
+  const flags = words.slice(1).filter((w) => w.startsWith("-"));
+  if (first === "rm" && flags.some((w) => w.includes("r"))) return true;
+  if (first === "chmod" && flags.some((w) => w.includes("R"))) return true;
+  if (first === "kill" && words.slice(1).includes("-9")) return true;
+  if (first === "git" && words[1] === "push") {
+    return words.slice(2).some((w) => w === "-f" || w === "--force" || w.startsWith("--force="));
+  }
+  return false;
+}
 function commandKey(segment) {
   const words = segment.trim().split(/\s+/);
-  return TWO_WORD.has(words[0]) && words[1] ? `${words[0]} ${words[1]}` : words[0];
+  return words[1] ? `${words[0]} ${words[1]}` : words[0];
+}
+function requiresSensitiveToolApproval(req) {
+  const target = req.target.trim();
+  if (req.kind === "read" || req.kind === "edit") {
+    return /(?:^|[/\\])(?:\.env(?:\..*)?|\.ssh|\.aws|\.config\/gcloud|secrets?|credentials?)(?:[/\\]|$)/i.test(target) || /(?:id_rsa|id_ed25519|\.pem|\.p12|\.key)$/i.test(target);
+  }
+  if (req.kind === "bash") {
+    return /\b(?:rm\s+-[a-z]*r[a-z]*f[a-z]*\s|rm\s+-[a-z]*f[a-z]*r[a-z]*\s|mkfs(?:\.|\s)|wipefs\b|shred\s|git\s+push\s+(?:--force|-f)\b|docker\s+(?:system\s+prune|volume\s+rm)|kubectl\s+delete\b|drop\s+(?:database|table)|npm\s+publish\b)/i.test(target) || /\b(?:deploy-service\.sh|aws\s+secretsmanager|cat\s+[^;&|]*\.env\b)/i.test(target);
+  }
+  if (req.kind === "mcp") {
+    return /(?:delete|remove|revoke|transfer|send_email|publish|deploy|execute_command|run_command|read_secret)/i.test(req.tool);
+  }
+  return false;
 }
 var Permissions = class {
   constructor(mode, rules = [], cwd = process.cwd()) {
@@ -30,6 +56,8 @@ var Permissions = class {
   }
   /** Rules that "[a] allow for this session" would add; undefined when it must always be asked. */
   rulesFor(req) {
+    if (requiresSensitiveToolApproval(req) && (req.kind === "read" || process.env.BC_TOOL_POLICY_ENFORCE === "true"))
+      return void 0;
     if (req.kind === "edit") return this.editInProject(req.target) ? ["edit(project)"] : void 0;
     if (req.kind === "fetch") {
       try {
@@ -42,12 +70,16 @@ var Permissions = class {
       if (/`|\$\(|[<>]|^\s*[({]/.test(req.target)) return void 0;
       const segments = req.target.split(/&&|\|\||[;&|\n]/).map((s) => s.trim()).filter(Boolean);
       if (!segments.length) return void 0;
+      if (segments.some(isAlwaysAsk)) return void 0;
       return [...new Set(segments.map((s) => `bash(${commandKey(s)})`))];
     }
     if (req.kind === "mcp") return [`mcp(${req.tool})`];
     return [];
   }
   check(req) {
+    if (this.mode === "plan" && req.kind !== "read") return "deny";
+    if (req.kind === "read" && this.mode !== "allowAll" && requiresSensitiveToolApproval(req)) return "ask";
+    if (process.env.BC_TOOL_POLICY_ENFORCE === "true" && requiresSensitiveToolApproval(req)) return "ask";
     if (req.kind === "read") return "allow";
     if (this.mode === "allowAll") return "allow";
     if (this.mode === "plan") return "deny";

package/dist/chunk-PSO7R5AD.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+
+// src/tools/types.ts
+function defineTool(tool) {
+  return tool;
+}
+
+export {
+  defineTool
+};