@bridge4dev/runner 0.30.0 → 0.33.0

package/dist/policy.js

@@ -1,6 +1,18 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
+/** What the product did before any of this was configurable. */
+const DEFAULT_PROTECTED_BRANCHES = ['main', 'master'];
+function resolveGitPolicy(ctx) {
+    return {
+        // `!== false`: silence refuses. See the field comment above.
+        pushBanned: ctx.agentPushBan !== false,
+        // `?? `, never `||`: an empty array is «nothing is protected», not «unset».
+        protectedBranches: ctx.agentProtectedBranches ?? DEFAULT_PROTECTED_BRANCHES,
+        allowForcePush: ctx.agentAllowForcePush === true,
+        allowDestructiveGit: ctx.agentAllowDestructiveGit === true,
+    };
+}
 // ─── Secret masking (plan §8.7) ──────────────────────────────────────
 const SECRET_PATTERNS = [
     {
@@ -238,53 +250,14 @@ const DENIED_COMMAND_PATTERNS = [
     // rule that only looked for a word boundary in front (found in QA-108).
     { reason: 'sudo is not allowed', re: /(^|[\s;&|`(])(?:[\w./\\-]*\/)?\\?sudo\b/ },
     { reason: 'sudo is not allowed', re: /(^|[\s;&|`(])(?:doas|pkexec)\b/ },
-    // The two specific push rules stay ahead of the blanket one purely so the
-    // agent is told the most useful thing when it tries the worst version.
-    {
-        reason: 'force-push is not allowed',
-        re: new RegExp(`${GIT_PUSH}[^;&|]*(\\s--force\\b|\\s-f\\b|\\s\\+\\S+)`),
-    },
-    // `[\s:]main` also matches refspec form `git push origin HEAD:main`.
-    {
-        reason: 'push to a protected branch is not allowed',
-        re: new RegExp(`${GIT_PUSH}[^;&|]*[\\s:](main|master)\\b`),
-    },
-    // Session 13, owner's decision 2026-07-27: agents never push, at all.
+    // Session 18: the four git rules that used to live here — force-push,
+    // push-to-a-protected-branch, the blanket push ban, and `git clean` /
+    // `git reset --hard` — have moved into `evaluateGitPolicy` below. They are
+    // the PROJECT's decision now, and a table of regexes has nowhere to read a
+    // decision from. They are still evaluated before any trust mode, in the same
+    // place and the same order; only their source changed.
     //
-    // Until now only force-push and push-to-main were denied, and a plain
-    // `git push` was not on the NORMAL-mode safe list — which reads like a
-    // refusal but is not one: under AUTO trust the Bash branch returns `allow`
-    // before the safe list is ever consulted, so an ordinary push went out
-    // silently. Pushing is an outgoing write to somebody else's repository; it
-    // belongs to the human who owns the credentials, behind a button.
-    {
-        reason: 'git push is not allowed — a human presses «Push» in the Git panel',
-        re: new RegExp(GIT_PUSH),
-    },
-    /**
-     * The two git commands that destroy work nobody has committed (session 16).
-     *
-     * This became urgent the day a session's working folder stopped being a
-     * private worktree and became the PERSON'S OWN project folder. In there,
-     * `git clean -fd` deletes their untracked files — the planning documents that
-     * went that way on 2026-07-28 existed nowhere else — and `git reset --hard`
-     * throws away every uncommitted edit in the tree, theirs included.
-     *
-     * Denied outright rather than left to a permission card, because under AUTO
-     * trust there is no card: Bash is allowed before the safe list is consulted,
-     * exactly as with `git push`. An agent that needs to remove build output can
-     * name the paths; an agent that wants to undo its own work has `git checkout
-     * -- <file>`, and the person has «Discard» in the Git panel with a
-     * confirmation that says how many files it is about to delete.
-     */
-    {
-        reason: 'git clean is not allowed — it deletes files git is not tracking, and that folder may be somebody else’s. Remove the paths you mean by name.',
-        re: new RegExp(String.raw `\bgit\s+${FLAGS}clean\b`),
-    },
-    {
-        reason: 'git reset --hard is not allowed — it throws away every uncommitted change in the folder, including the human’s. Use «Discard» in the Git panel, or `git checkout -- <file>`.',
-        re: new RegExp(String.raw `\bgit\s+${FLAGS}reset\b[^;&|]*--hard\b`),
-    },
+    // The rules that remain here are the ones no project may lift.
     {
         reason: 'service control is not allowed',
         re: /\b(systemctl|service)\s+(stop|disable|mask|restart|kill)\b/,
@@ -342,19 +315,341 @@ const DENIED_COMMAND_PATTERNS = [
         re: new RegExp(`\\bpodman(?:-compose)?\\s+${FLAGS}(?:${DOCKER_OBJECT})?(?:${DOCKER_VERB}|down)\\b`),
     },
     /**
-     * An inline git alias is a `push` with a different name.
+     * An inline git alias is any forbidden command with a different name.
      *
-     * `git -c alias.p=push p origin main` runs a push while containing no
-     * `push` subcommand for the rule above to find — and the rule above is
-     * absolute («agents never push»), so a rule that a rename defeats is not
-     * the rule it claims to be. Nothing the agent legitimately does needs to
-     * define an alias, so the whole construct is refused rather than parsed.
+     * `git -c alias.p=push p origin main` runs a push while containing no `push`
+     * subcommand for the parser to find. Stays UNCONDITIONAL in session 18 —
+     * deliberately, and it is the one git rule a project cannot switch off. The
+     * rules that moved out of this table are now the project's choice, which
+     * makes this the guard that keeps them meaning what they say: a protected
+     * branch a rename defeats is not protected. Nothing an agent legitimately
+     * does needs an inline alias, so the construct is refused rather than parsed.
      */
     {
-        reason: 'git aliases are not allowed — they can rename a forbidden command; a human presses «Push» in the Git panel',
+        reason: 'git aliases are not allowed — they can rename a command this project refuses. Run the command by its real name.',
         re: /\bgit\s[^;&|]*\balias\./i,
     },
 ];
+// ─── The project's git policy (session 18) ───────────────────────────
+//
+// What used to be four entries in the table above. They are evaluated in the
+// same place and before any trust mode, so nothing about WHEN they run changed;
+// what changed is that they read a decision instead of being one.
+//
+// The bar here is higher than it was for the old regexes, and for a concrete
+// reason: while `git push` was refused outright, the protected-branch rule was
+// dead weight sitting behind an absolute ban, and it was never hardened. The
+// moment a project can switch the ban off, that rule becomes the ONLY thing
+// standing between an agent and `main` — and the old pattern
+// (`git push … [\s:](main|master)\b`) missed `--all`, `--mirror`,
+// `git push origin :main`, `--delete main` and `feature:refs/heads/main`. Four
+// of those five delete or overwrite a protected branch.
+/**
+ * One segment of a shell command — deny rules must not read across a separator.
+ *
+ * `\n` is in the class, and leaving it out was QA-134 BLOCKER-2. A newline ends
+ * a command exactly as `;` does, and agents write multi-line Bash constantly.
+ * Without it the whole script arrived as ONE segment, `parsePush` found the
+ * FIRST `push` and swallowed the second command's arguments as its own
+ * refspecs — so `git push origin feature` ⏎ `git push` was allowed, because the
+ * bare push on line two no longer looked bare. Any allowed push plus a newline
+ * was a way past the rule.
+ */
+function commandSegments(command) {
+    return command.split(/[;&|\n]+/);
+}
+/**
+ * Split a segment into shell-ish words.
+ *
+ * Deliberately naive: quoting has already been dealt with by the caller, which
+ * tests both the raw string and `dequote(command)`. What this must not do is
+ * allocate or backtrack — it runs on every Bash call the agent proposes.
+ */
+function words(segment) {
+    return segment.trim().split(/\s+/).filter(Boolean);
+}
+/**
+ * Characters that mean «the shell decides what this word is».
+ *
+ * A refspec containing one of them is not a branch name, it is a promise to
+ * produce one later — and a rule that reads it literally would compare
+ * `$BRANCH` against `main`, find no match, and allow the push that the shell
+ * then sends to `main`.
+ */
+const SHELL_EXPANSION = /[$`\\*?[\]{}~!]/;
+/**
+ * What a `git push …` segment would actually do to which branches.
+ *
+ * Returns null when the segment is not a push. Parsed rather than pattern
+ * matched because the question «which branch does this write to» has no regex
+ * answer: it lives in the last colon-separated field of an operand that may or
+ * may not be there, and half the dangerous forms have no branch name in them
+ * at all.
+ */
+function parsePush(segment) {
+    if (!new RegExp(GIT_PUSH).test(segment))
+        return null;
+    const tokens = words(segment);
+    const pushAt = tokens.findIndex((t) => t === 'push');
+    if (pushAt === -1) {
+        // `git -c x=y push` matched the regex but the word is hidden by a form
+        // this tokenizer does not model. Report the most dangerous reading — the
+        // caller's job is to refuse what it cannot understand, not to guess.
+        return {
+            branches: [],
+            force: true,
+            deletes: true,
+            everyBranch: true,
+            implicit: true,
+            opaque: true,
+            remoteExec: true,
+        };
+    }
+    const rest = tokens.slice(pushAt + 1);
+    let force = false;
+    let deletes = false;
+    let everyBranch = false;
+    let tagsOnly = false;
+    let remoteExec = false;
+    const operands = [];
+    for (const token of rest) {
+        if (token === '--')
+            continue;
+        if (token.startsWith('--')) {
+            const name = token.split('=')[0] ?? token;
+            if (name === '--force' || name === '--force-with-lease' || name === '--force-if-includes') {
+                force = true;
+            }
+            else if (name === '--delete')
+                deletes = true;
+            else if (name === '--all' || name === '--mirror')
+                everyBranch = true;
+            // `--tags` with no refspec sends refs/tags and NOTHING else — no branch
+            // travels, so there is nothing for the protected list to be about.
+            // `--follow-tags` is deliberately absent from this line: it sends tags IN
+            // ADDITION to the current branch, so it stays an implicit branch push.
+            else if (name === '--tags')
+                tagsOnly = true;
+            /**
+             * QA-134 MAJOR-1. These two do not change which branch is written — they
+             * change WHAT RUNS ON THE OTHER MACHINE.
+             *
+             * `--receive-pack=<cmd>` (and its synonym `--exec`) tells git to run that
+             * string on the remote host over ssh instead of `git-receive-pack`. On a
+             * self-hosted forge, or a bare `git@host:repo.git`, that is code
+             * execution on the git server as the ssh account the developer owns —
+             * from a push to a branch nobody protects. GitHub and GitLab.com ignore
+             * it; the machines a dev runner is actually pointed at often do not.
+             */ else if (name === '--receive-pack' || name === '--exec')
+                remoteExec = true;
+            // `--repo=<url>`, `--set-upstream`, `--follow-tags`, `--atomic`,
+            // `--porcelain`, … — none of them change WHICH branch is written.
+            continue;
+        }
+        if (token.startsWith('-') && token.length > 1) {
+            // A short-option cluster: `git push -fu origin x` is `-f -u`.
+            for (const letter of token.slice(1)) {
+                if (letter === 'f')
+                    force = true;
+                if (letter === 'd')
+                    deletes = true;
+            }
+            continue;
+        }
+        operands.push(token);
+    }
+    // The first operand is the remote (`origin`, a URL, a path); everything after
+    // it is a refspec. A push with no operands at all names no remote either.
+    const refspecs = operands.slice(1);
+    const branches = [];
+    // A remote that is itself an expansion (`git push $R main`) shifts nothing —
+    // `main` is still in refspec position — but a remote spelled `$(…)` could be
+    // hiding a whole argument list, so the whole command is unresolvable.
+    let opaque = operands.some((o) => SHELL_EXPANSION.test(o));
+    for (const spec of refspecs) {
+        let ref = spec;
+        if (ref.startsWith('+')) {
+            // `git push origin +feature:main` is a force-push of one refspec.
+            force = true;
+            ref = ref.slice(1);
+        }
+        const colon = ref.lastIndexOf(':');
+        if (colon !== -1) {
+            const source = ref.slice(0, colon);
+            const dest = ref.slice(colon + 1);
+            // `git push origin :main` — an empty source deletes the destination.
+            if (source === '')
+                deletes = true;
+            ref = dest;
+        }
+        // `refs/heads/main`, `heads/main` and `main` are the same branch.
+        const named = ref.replace(/^refs\/heads\//, '').replace(/^heads\//, '');
+        /**
+         * QA-134 BLOCKER-1: `HEAD` is not a branch name, it is «whichever branch
+         * this folder is on» — the exact thing the bare-push rule below refuses to
+         * guess at.
+         *
+         * `git push origin HEAD` sends the current branch under its own name on the
+         * remote. In a DIRECT session started on `main` — the arrangement this very
+         * release made possible — that IS a push to `main`, and comparing the
+         * literal string `HEAD` against `['main','master']` finds nothing and
+         * allows it. With `agentAllowForcePush` on it allowed a FORCE-push to
+         * `main`, contradicting the «the two rules are AND-ed» invariant this file,
+         * the schema and the settings form all state as fact.
+         *
+         * `@` is git's own synonym for `HEAD`; `HEAD~1` / `@^` are revisions, not
+         * branches; a bare sha pushes a detached commit to a name we cannot see.
+         * All of them are «unknown destination», which is what `opaque` means.
+         */
+        if (/^(HEAD|@)([~^].*)?$/.test(named) || /^[0-9a-f]{7,40}$/i.test(named)) {
+            opaque = true;
+            continue;
+        }
+        branches.push(named);
+    }
+    return {
+        branches: branches.filter(Boolean),
+        force,
+        deletes,
+        everyBranch,
+        implicit: branches.length === 0 && !everyBranch && !tagsOnly,
+        opaque,
+        remoteExec,
+    };
+}
+/**
+ * The project's git rules, applied to one Bash command.
+ *
+ * Returns a refusal, or null when the command has nothing to do with them.
+ * Every branch of this function is reachable only when the project has
+ * DELIBERATELY switched something on — with the shipped defaults the first
+ * check refuses every push and the rest never run, which is byte for byte the
+ * behaviour of the four regexes it replaces.
+ */
+export function evaluateGitPolicy(command, ctx) {
+    const policy = resolveGitPolicy(ctx);
+    for (const segment of commandSegments(command)) {
+        if (!policy.allowDestructiveGit) {
+            /**
+             * The two git commands that destroy work nobody has committed (16).
+             *
+             * Urgent since a session's working folder stopped being a private
+             * worktree and became the PERSON'S OWN project folder. In there,
+             * `git clean -fd` deletes their untracked files — the planning documents
+             * that went that way on 2026-07-28 existed nowhere else — and
+             * `git reset --hard` throws away every uncommitted edit in the tree.
+             *
+             * Denied rather than turned into a permission card, because under AUTO
+             * trust there is no card: Bash is allowed before the safe list is
+             * consulted. An agent that needs to remove build output can name the
+             * paths; one that wants to undo its own work has `git checkout -- <file>`.
+             */
+            if (new RegExp(String.raw `\bgit\s+${FLAGS}clean\b`).test(segment)) {
+                return {
+                    decision: 'deny',
+                    reason: 'git clean is not allowed for this project — it deletes files git is not tracking, and that folder may be somebody else’s. Remove the paths you mean by name.',
+                };
+            }
+            if (new RegExp(String.raw `\bgit\s+${FLAGS}reset\b[^;&|]*--hard\b`).test(segment)) {
+                return {
+                    decision: 'deny',
+                    reason: 'git reset --hard is not allowed for this project — it throws away every uncommitted change in the folder, including the human’s. Use «Discard» in the Git panel, or `git checkout -- <file>`.',
+                };
+            }
+        }
+        const push = parsePush(segment);
+        if (!push)
+            continue;
+        const guarded = policy.protectedBranches;
+        /**
+         * Refused whatever the project allows (QA-134 MAJOR-1) — the one push rule
+         * with no switch, for the same reason as the inline-alias rule: nothing an
+         * agent legitimately does needs to choose which program runs on somebody
+         * else's server.
+         */
+        if (push.remoteExec) {
+            return {
+                decision: 'deny',
+                reason: '`--receive-pack` / `--exec` are not allowed — they run a command of your choosing on the REMOTE machine, which is not what pushing a branch is for',
+            };
+        }
+        // The two SPECIFIC refusals come before the blanket one, exactly as the old
+        // table ordered them, and for the reason it recorded: when the agent tries
+        // the worst variant it should be told what is worst about it. «git push is
+        // not allowed» in answer to `git push --force origin main` is true and
+        // useless.
+        if (push.force && (policy.pushBanned || !policy.allowForcePush)) {
+            return {
+                decision: 'deny',
+                reason: 'force-push is not allowed for this project — it can destroy commits on the remote that nobody has a copy of',
+            };
+        }
+        const hit = guarded.length > 0 ? push.branches.find((b) => guarded.includes(b)) : undefined;
+        if (hit) {
+            return {
+                decision: 'deny',
+                reason: push.deletes
+                    ? `deleting ${hit} on the remote is not allowed — ${hit} is a protected branch in this project`
+                    : `push to ${hit} is not allowed — ${hit} is a protected branch in this project. A human presses «Push» in the Git panel.`,
+            };
+        }
+        if (policy.pushBanned) {
+            return {
+                decision: 'deny',
+                reason: 'git push is not allowed — a human presses «Push» in the Git panel. (This project has «Принудительно запретить push» switched on.)',
+            };
+        }
+        // Everything below exists only once pushing is permitted. With the shipped
+        // defaults the ban above has already returned and these never run.
+        if (guarded.length > 0) {
+            // `--all` / `--mirror` name no branch and write every one of them, so
+            // they reach the protected ones by definition. `--mirror` also DELETES
+            // remote refs that are absent locally.
+            if (push.everyBranch) {
+                return {
+                    decision: 'deny',
+                    reason: `pushing every branch at once is not allowed while this project protects ${guarded.join(', ')} — push one named branch at a time`,
+                };
+            }
+            /**
+             * A push that names no destination goes to whatever the folder is checked
+             * out on — which this function cannot see, and must not guess.
+             *
+             * Refused rather than resolved with a `git rev-parse`: this runs
+             * synchronously inside the permission bridge for every Bash call on the
+             * machine, and a child process there is the same class of mistake as the
+             * regex that once froze it (see `GIT_PUSH` above). Naming the branch
+             * costs the agent four words and makes the rule decidable.
+             *
+             * Only when something IS protected. A project that cleared the list has
+             * said nothing is off-limits, and there a bare `git push` is fine.
+             */
+            if (push.implicit) {
+                return {
+                    decision: 'deny',
+                    reason: `name the branch you are pushing — this project protects ${guarded.join(', ')}, and a bare \`git push\` does not say where it goes. Use \`git push <remote> <branch>\`.`,
+                };
+            }
+            /**
+             * `git push origin $BRANCH` — the shell knows the target, this does not.
+             *
+             * The same refusal as the bare push above and for the same reason: a rule
+             * that compared `$BRANCH` against `main` literally would find no match
+             * and allow exactly the push it exists to stop. Written as a separate
+             * branch rather than folded into `implicit` so the sentence can say what
+             * is actually wrong — «name the branch» is confusing advice to somebody
+             * who thinks they did.
+             */
+            if (push.opaque) {
+                return {
+                    decision: 'deny',
+                    reason: `write the branch name out — this project protects ${guarded.join(', ')}, and a target the shell has to expand cannot be checked against that list. Use a literal \`git push <remote> <branch>\`.`,
+                };
+            }
+        }
+    }
+    return null;
+}
 // Commands considered safe enough to run without asking under NORMAL trust.
 // Interpreters (node/python/…) and find (-exec) are NOT here: they execute
 // arbitrary code. `env` is not here: it dumps the environment (QA-96 F12).
@@ -517,6 +812,34 @@ function namesDockerProject(command, project) {
  */
 export function evaluateRecipeCommand(command, ctx = {}) {
     for (const variant of [command, dequote(command)]) {
+        /**
+         * Session 18: a recipe keeps the STRICTEST git rules, whatever the project
+         * allowed its agent.
+         *
+         * `evaluateGitPolicy` is called with an empty context on purpose, so every
+         * «unset» resolves the safe way: no push, no force-push, `main`/`master`
+         * protected, no `git clean` / `git reset --hard`. That is byte for byte the
+         * behaviour recipes had before this release, and it is not an oversight
+         * that the project's switches do not reach here.
+         *
+         * A recipe is a BUILD. It runs with no agent turn around it, nobody to ask,
+         * and it is approved once and then reused for months — so «the project let
+         * its agent push» is not an argument that its build script may push. If a
+         * deploy step is ever wanted, that is a separate decision with its own
+         * approval screen, not a side effect of this one.
+         */
+        const git = evaluateGitPolicy(variant, { trustMode: 'STRICT', worktreePath: '' });
+        if (git) {
+            // The sentence is rewritten, not passed through (QA-134 MINOR-2). The
+            // generic one says «this project has «Принудительно запретить push»
+            // switched on» — and a project that switched it OFF would be sent to look
+            // at a setting that already says what they want. The refusal here is
+            // about recipes, not about the project.
+            const reason = /git push is not allowed/.test(git.reason)
+                ? 'a build recipe may not push, whatever the project allows its agent — it runs with nobody to ask and is approved once for months'
+                : git.reason;
+            return { allowed: false, reason };
+        }
         for (const { id, re, reason } of DENIED_COMMAND_PATTERNS) {
             if (!re.test(variant))
                 continue;
@@ -672,6 +995,17 @@ export function evaluateToolUse(toolName, input, ctx) {
                 }
             }
         }
+        // Session 18: push, force-push, protected branches and destructive git.
+        // Same position as the block above and the deny table before it — BEFORE
+        // the trust branches, because under AUTO the Bash branch returns `allow`
+        // and nothing after this line is consulted. That is exactly how «agents
+        // never push» quietly failed for a whole release (session 13), and it is
+        // the reason these rules did not simply move onto the safe list.
+        for (const variant of [command, dequote(command)]) {
+            const git = evaluateGitPolicy(variant, ctx);
+            if (git)
+                return git;
+        }
         if (trust === 'STRICT')
             return { decision: 'ask', reason: 'strict mode' };
         if (trust === 'AUTO')
@@ -706,6 +1040,17 @@ export function evaluateToolUse(toolName, input, ctx) {
         if (WRITE_TOOLS.has(toolName) && !isInsideWorktree(resolved, ctx.worktreePath)) {
             return { decision: 'deny', reason: 'writes outside the session worktree are not allowed' };
         }
+        // The project's own prompt file — the same rule as `.git` above, for the
+        // same reason: what is written here is not data, it is the instructions the
+        // next process of this session will be started with.
+        if (WRITE_TOOLS.has(toolName) &&
+            ctx.agentPromptFile &&
+            resolved === path.resolve(ctx.agentPromptFile)) {
+            return {
+                decision: 'deny',
+                reason: 'this file is the system prompt of this session — a human edits it, not the agent it instructs',
+            };
+        }
         if (trust === 'STRICT')
             return { decision: 'ask', reason: 'strict mode' };
         if (READ_TOOLS.has(toolName) && !isInsideWorktree(resolved, ctx.worktreePath)) {