@czottmann/pi-automode 1.11.0 → 1.13.0

package/extensions/auto-mode/hard-deny.ts

@@ -1,4 +1,11 @@
+import { statSync } from "node:fs";
 import { resolve } from "node:path";
+import {
+  analyzeBash,
+  type BashAnalysis,
+  type BashCommandAnalysis,
+  type EffectiveCommand,
+} from "./bash.ts";
 import { HOME } from "./constants.ts";
 import {
   isProfileOrAuthorizedKeysPath,
@@ -8,152 +15,66 @@ import {
   shellPathTokenToPath,
 } from "./paths.ts";
 
-type ShellSegment = {
-  text: string;
-  words: string[];
-  redirectTargets: string[];
-};
-
-function splitShellSegments(command: string): string[] {
-  const segments: string[] = [];
-  let current = "";
-  let quote: "'" | '"' | "`" | undefined;
-  let escaped = false;
-
-  for (let i = 0; i < command.length; i += 1) {
-    const char = command[i] ?? "";
-    const next = command[i + 1] ?? "";
-    if (escaped) {
-      current += char;
-      escaped = false;
-      continue;
-    }
-    if (char === "\\" && quote !== "'") {
-      current += char;
-      escaped = true;
-      continue;
-    }
-    if (quote) {
-      current += char;
-      if (char === quote) quote = undefined;
-      continue;
-    }
-    if (char === "'" || char === '"' || char === "`") {
-      quote = char;
-      current += char;
-      continue;
-    }
-    if (
-      char === ";" ||
-      char === "\n" ||
-      char === "|" ||
-      (char === "&" && next === "&") ||
-      (char === "|" && next === "|")
-    ) {
-      if (current.trim()) segments.push(current.trim());
-      current = "";
-      if ((char === "&" && next === "&") || (char === "|" && next === "|")) {
-        i += 1;
-      }
-      continue;
-    }
-    current += char;
-  }
-  if (current.trim()) segments.push(current.trim());
-  return segments;
+function isRecursiveRmArg(arg: string): boolean {
+  return (
+    (arg.length > 2 && arg.startsWith("--") && "--recursive".startsWith(arg)) ||
+    /^-[A-Za-z]*r[A-Za-z]*f?[A-Za-z]*$/i.test(arg) ||
+    /^-[A-Za-z]*f[A-Za-z]*r[A-Za-z]*$/i.test(arg)
+  );
 }
 
-function tokenizeShellSegment(text: string): string[] {
-  const tokens: string[] = [];
-  let current = "";
-  let quote: "'" | '"' | "`" | undefined;
-  let escaped = false;
+export type RmInvocation = {
+  recursive: boolean;
+  operands: Array<{ value: string; text: string; tildeExpansion: boolean }>;
+};
 
-  for (let i = 0; i < text.length; i += 1) {
-    const char = text[i] ?? "";
-    if (escaped) {
-      current += char;
-      escaped = false;
-      continue;
-    }
-    if (char === "\\" && quote !== "'") {
-      escaped = true;
-      continue;
-    }
-    if (quote) {
-      if (char === quote) quote = undefined;
-      else current += char;
-      continue;
-    }
-    if (char === "'" || char === '"' || char === "`") {
-      quote = char;
+export function parseRmInvocation(command: EffectiveCommand): RmInvocation {
+  let recursive = false;
+  let optionsEnded = false;
+  const operands: RmInvocation["operands"] = [];
+
+  for (const [index, value] of command.args.entries()) {
+    const text = command.argTexts[index] ?? value;
+    const tildeExpansion = command.argTildeExpansions[index] ?? false;
+    if (!optionsEnded && value === "--") {
+      optionsEnded = true;
       continue;
     }
-    if (/\s/.test(char)) {
-      if (current) tokens.push(current);
-      current = "";
+    if (!optionsEnded && value !== "-" && value.startsWith("-")) {
+      if (isRecursiveRmArg(value)) recursive = true;
       continue;
     }
-    if (char === ">" || char === "<") {
-      let op = char;
-      if (/^\d+$/.test(current)) {
-        op = current + char;
-      } else if (current) {
-        tokens.push(current);
-      }
-      if (text[i + 1] === ">" || text[i + 1] === "&") {
-        op += text[i + 1];
-        i += 1;
-      }
-      tokens.push(op);
-      current = "";
-      continue;
-    }
-    current += char;
+    operands.push({ value, text, tildeExpansion });
   }
-  if (current) tokens.push(current);
-  return tokens;
-}
 
-function parseShell(command: string): ShellSegment[] {
-  return splitShellSegments(command).map((text) => {
-    const tokens = tokenizeShellSegment(text);
-    const words: string[] = [];
-    const redirectTargets: string[] = [];
-    for (let i = 0; i < tokens.length; i += 1) {
-      const token = tokens[i] ?? "";
-      if (/^(?:\d?>|\d?>>|>|>>|&>|<)$/.test(token)) {
-        const target = tokens[i + 1];
-        if (target) redirectTargets.push(target);
-        i += 1;
-        continue;
-      }
-      const attachedRedirect = token.match(/^(?:\d?>|\d?>>|>|>>|&>)(.+)$/);
-      if (attachedRedirect?.[1]) {
-        redirectTargets.push(attachedRedirect[1]);
-        continue;
-      }
-      words.push(token);
-    }
-    return { text, words, redirectTargets };
-  });
+  return { recursive, operands };
 }
 
-function commandName(words: string[]): string | undefined {
-  return words.find((word) => !/^\w+=/.test(word));
+function isUnresolvedUserHomeToken(
+  shellText: string,
+  tildeExpansion: boolean,
+): boolean {
+  return tildeExpansion && shellText !== "~" && !shellText.startsWith("~/");
 }
 
-function commandArgs(words: string[]): string[] {
-  const index = words.findIndex((word) => !/^\w+=/.test(word));
-  return index >= 0 ? words.slice(index + 1) : [];
+function isSameExistingPath(left: string, right: string): boolean {
+  try {
+    const leftStat = statSync(left);
+    const rightStat = statSync(right);
+    return leftStat.dev === rightStat.dev && leftStat.ino === rightStat.ino;
+  } catch {
+    return false;
+  }
 }
 
-function isRecursiveRmArg(arg: string): boolean {
-  return (
-    arg === "--recursive" ||
-    /^-[A-Za-z]*r[A-Za-z]*f?[A-Za-z]*$/.test(arg) ||
-    /^-[A-Za-z]*f[A-Za-z]*r[A-Za-z]*$/.test(arg)
-  );
+function matchesPathRoot(path: string, root: string): boolean {
+  if (path === root || path.startsWith(`${root}/`)) return true;
+  const lowerPath = path.toLowerCase();
+  const lowerRoot = root.toLowerCase();
+  if (lowerPath !== lowerRoot && !lowerPath.startsWith(`${lowerRoot}/`)) {
+    return false;
+  }
+  return isSameExistingPath(path.slice(0, root.length), root);
 }
 
 /**
@@ -173,24 +94,30 @@ export function isRootHomeOrSystemPath(path: string, home: string): boolean {
     "/boot",
     "/dev",
     "/etc",
+    "/home",
     "/lib",
     "/lib64",
+    "/Library",
     "/private",
+    "/proc",
+    "/root",
+    "/run",
     "/sbin",
     "/sys",
+    "/System",
     "/usr",
     "/var",
   ];
-  if (path.startsWith(`${home}/`)) return false;
+  if (matchesPathRoot(path, home) && path.length > home.length) return false;
   return (
     path === "/" ||
-    path === home ||
-    systemRoots.some((root) => path === root || path.startsWith(`${root}/`))
+    matchesPathRoot(path, home) ||
+    systemRoots.some((root) => matchesPathRoot(path, root))
   );
 }
 
 function segmentHardDeny(
-  segment: ShellSegment,
+  segment: BashCommandAnalysis,
   cwd: string,
 ): string | undefined {
   for (const target of segment.redirectTargets) {
@@ -213,9 +140,10 @@ function segmentHardDeny(
     }
   }
 
-  const name = commandName(segment.words);
+  const command = segment.effectiveCommand;
+  const name = command.name;
   if (!name) return undefined;
-  const args = commandArgs(segment.words);
+  const args = command.args;
   const lowerArgs = args.map((arg) => arg.toLowerCase());
 
   if (
@@ -270,18 +198,32 @@ function segmentHardDeny(
     return "platform security weakening is hard-denied";
   }
 
-  if (name === "rm" && args.some(isRecursiveRmArg)) {
-    for (const arg of args.filter((arg) => !arg.startsWith("-"))) {
-      const path = shellPathTokenToPath(arg, cwd);
-      if (path && isRootHomeOrSystemPath(path, HOME)) {
-        return "irreversible deletion of home/root/system paths is hard-denied";
+  if (name === "rm") {
+    const rm = parseRmInvocation(command);
+    if (rm.recursive) {
+      for (const { value: arg, text: shellText, tildeExpansion } of rm.operands) {
+        if (isUnresolvedUserHomeToken(shellText, tildeExpansion)) {
+          return "irreversible deletion of a user-home expansion is hard-denied";
+        }
+        const path = shellPathTokenToPath(arg, cwd, shellText);
+        const policyPath = path ? (resolvePathForPolicy(path) ?? path) : undefined;
+        const policyHome = resolvePathForPolicy(HOME) ?? HOME;
+        if (policyPath && isRootHomeOrSystemPath(policyPath, policyHome)) {
+          return "irreversible deletion of home/root/system paths is hard-denied";
+        }
       }
     }
   }
 
   if (name === "find" && lowerArgs.includes("-delete")) {
     const root = shellPathTokenToPath(args[0] ?? "", cwd);
-    if (root && isRootHomeOrSystemPath(root, HOME) && root !== HOME) {
+    const policyRoot = root ? (resolvePathForPolicy(root) ?? root) : undefined;
+    const policyHome = resolvePathForPolicy(HOME) ?? HOME;
+    if (
+      policyRoot &&
+      isRootHomeOrSystemPath(policyRoot, policyHome) &&
+      policyRoot !== policyHome
+    ) {
       return "system-wide delete is hard-denied";
     }
   }
@@ -320,7 +262,7 @@ function segmentHardDeny(
       "sed",
     ].includes(name) &&
     /\.pi\/automode|\.pi\/extensions|pi-automode|auto-mode\.json/i.test(
-      segment.text,
+      segment.raw,
     )
   ) {
     return "auto-mode or permission safety-control modification is hard-denied";
@@ -332,14 +274,14 @@ function segmentHardDeny(
 /**
  * Deterministic deny checks for actions too risky to delegate to the classifier.
  *
- * Bash checks use a small shell lexer instead of only regexes. It is not a full
- * POSIX shell implementation, but it handles quotes, redirects, pipes, `&&`, and
- * `;` well enough to avoid the common "safe prefix hides risky suffix" bypass.
+ * Bash checks use the shared unbash AST analysis. The hook passes one analysis
+ * through every enforcement stage so nested commands are not reparsed.
  */
 export function deterministicHardDeny(
   toolName: string,
   input: Record<string, unknown>,
   cwd: string,
+  bashAnalysis?: BashAnalysis,
 ): string | undefined {
   if (toolName === "write" || toolName === "edit") {
     const path = resolveInputPath(cwd, input.path);
@@ -355,7 +297,20 @@ export function deterministicHardDeny(
 
   if (toolName !== "bash") return undefined;
   const command = typeof input.command === "string" ? input.command : "";
-  for (const segment of parseShell(command)) {
+  const analysis = bashAnalysis ?? analyzeBash(command);
+  if (analysis.errors.length > 0) {
+    return `Bash input could not be parsed safely: ${analysis.errors[0]?.message ?? "unknown parser error"}`;
+  }
+  for (const target of analysis.redirectTargets) {
+    const path = shellPathTokenToPath(target, cwd);
+    if (!path) continue;
+    const profileReason = isProfileOrAuthorizedKeysPath(path);
+    if (profileReason) return profileReason;
+    if (isSafetyControlPath(path, cwd)) {
+      return "auto-mode or permission safety-control modification is hard-denied";
+    }
+  }
+  for (const segment of analysis.commands) {
     const reason = segmentHardDeny(segment, cwd);
     if (reason) return reason;
   }

package/extensions/auto-mode/log.ts

@@ -1,6 +1,7 @@
-import { randomBytes } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import { appendFileSync, mkdirSync } from "node:fs";
-import { basename, dirname, extname, join } from "node:path";
+import { homedir } from "node:os";
+import { basename, dirname, extname, isAbsolute, join, resolve } from "node:path";
 import type {
   ClassifierIo,
   ClassifierIoAttempt,
@@ -65,9 +66,32 @@ export type LoggerOptions = {
   classifierIo: boolean;
   sessionFile?: string;
   sessionDir: string;
+  /** Effective cwd for an in-memory session. */
+  sessionCwd?: string;
   sessionId: string;
+  /** Test/embedder override. Runtime uses ~/.pi/agent/extensions/pi-automode/logs. */
+  logRoot?: string;
+  /** Test clock used for the UTC date partition. */
+  now?: Date;
 };
 
+export const DEFAULT_AUTOMODE_LOG_ROOT = join(
+  homedir(),
+  ".pi/agent/extensions/pi-automode/logs",
+);
+
+const VALID_SESSION_ID =
+  /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+
+function safeLogSessionId(sessionId: string): string {
+  if (VALID_SESSION_ID.test(sessionId)) return sessionId;
+  const digest = createHash("sha256")
+    .update(sessionId)
+    .digest("hex")
+    .slice(0, 16);
+  return `invalid-${digest}`;
+}
+
 /** Short id linking a classifier entry to its decision entry in the same file. */
 export function newDecisionId(): string {
   return randomBytes(4).toString("hex");
@@ -76,19 +100,43 @@ export function newDecisionId(): string {
 /**
  * Derive the log file path from the current session: the session file's
  * directory with `-pi-automode` inserted before the extension. Falls back to
- * `<sessionDir>/<sessionId>-pi-automode.jsonl` when no session file is set.
+ * an absolute session directory when one is available. In-memory sessions use
+ * an application-owned, project- and date-partitioned directory instead of a
+ * relative path resolved against the launching process cwd.
  */
 export function resolveLogPath(
   sessionFile: string | undefined,
   sessionDir: string,
   sessionId: string,
+  sessionCwd = process.cwd(),
+  logRoot = DEFAULT_AUTOMODE_LOG_ROOT,
+  now = new Date(),
 ): string {
   if (sessionFile) {
     const ext = extname(sessionFile);
     const stem = ext ? basename(sessionFile, ext) : basename(sessionFile);
     return join(dirname(sessionFile), `${stem}-pi-automode${ext}`);
   }
-  return join(sessionDir, `${sessionId}-pi-automode.jsonl`);
+
+  const logFile = `${safeLogSessionId(sessionId)}-pi-automode.jsonl`;
+  if (isAbsolute(sessionDir)) {
+    return join(sessionDir, logFile);
+  }
+
+  const resolvedCwd = resolve(sessionCwd);
+  const projectDir = `--${
+    resolvedCwd.replace(/^[/\\]/, "").replace(/[/\\:]/g, "-")
+  }--`;
+  const dateDir = now.toISOString().slice(0, 10);
+  const resolvedLogRoot = isAbsolute(logRoot)
+    ? logRoot
+    : DEFAULT_AUTOMODE_LOG_ROOT;
+  return join(
+    resolvedLogRoot,
+    projectDir,
+    dateDir,
+    logFile,
+  );
 }
 
 /** Append one JSON object as a line. Failures are swallowed: logging must
@@ -105,7 +153,14 @@ function appendJsonl(path: string, entry: unknown): void {
 /** Build a logger bound to one session's log path. No-ops when disabled. */
 export function createLogger(opts: LoggerOptions): Logger {
   const { enabled, classifierIo } = opts;
-  const path = resolveLogPath(opts.sessionFile, opts.sessionDir, opts.sessionId);
+  const path = resolveLogPath(
+    opts.sessionFile,
+    opts.sessionDir,
+    opts.sessionId,
+    opts.sessionCwd,
+    opts.logRoot,
+    opts.now,
+  );
   return {
     enabled,
     classifierIo,

package/extensions/auto-mode/paths.ts

@@ -1,35 +1,119 @@
-import { lstatSync, readlinkSync, realpathSync } from "node:fs";
+import {
+  accessSync,
+  constants,
+  lstatSync,
+  readlinkSync,
+  realpathSync,
+} from "node:fs";
 import {
   basename,
   dirname,
   isAbsolute,
+  join,
   normalize,
   relative,
   resolve,
 } from "node:path";
+import { fileURLToPath } from "node:url";
 import { HOME, PATH_BEARING_TOOLS, PROFILE_FILES } from "./constants.ts";
 
-function stripLeadingAt(value: string): string {
-  return value.startsWith("@") ? value.slice(1) : value;
+const UNICODE_SPACES = /[\u00A0\u2000-\u200A\u202F\u205F\u3000]/g;
+
+/** Convert Git Bash, MSYS, Cygwin, and WSL drive paths for Windows APIs. */
+function normalizeWindowsShellPath(path: string): string {
+  if (
+    process.platform !== "win32" ||
+    !path.startsWith("/") ||
+    path.startsWith("//") ||
+    path.includes("\\")
+  ) {
+    return path;
+  }
+  const match = path.match(/^\/(?:mnt\/|cygdrive\/)?([a-z])(?:\/(.*))?$/i);
+  if (!match) return path;
+  const suffix = match[2]?.replaceAll("/", "\\");
+  return `${match[1]?.toUpperCase()}:\\${suffix ?? ""}`;
+}
+
+/** Mirror Pi's path normalization options. */
+function normalizeInputPath(
+  value: string,
+  options: { normalizeUnicodeSpaces?: boolean; stripAtPrefix?: boolean } = {},
+): string {
+  let normalized = options.normalizeUnicodeSpaces
+    ? value.replace(UNICODE_SPACES, " ")
+    : value;
+  if (options.stripAtPrefix && normalized.startsWith("@")) {
+    normalized = normalized.slice(1);
+  }
+  normalized = normalizeWindowsShellPath(normalized);
+  if (normalized === "~") return HOME;
+  if (
+    normalized.startsWith("~/") ||
+    (process.platform === "win32" && normalized.startsWith("~\\"))
+  ) {
+    return join(HOME, normalized.slice(2));
+  }
+  if (/^file:\/\//.test(normalized)) return fileURLToPath(normalized);
+  return normalized;
 }
 
 export function resolveInputPath(
   cwd: string,
   value: unknown,
 ): string | undefined {
-  if (typeof value !== "string" || value.trim() === "") return undefined;
-  const raw = stripLeadingAt(value.trim());
-  return isAbsolute(raw) ? resolve(raw) : resolve(cwd, raw);
+  if (typeof value !== "string") return undefined;
+  const normalized = normalizeInputPath(value, {
+    normalizeUnicodeSpaces: true,
+    stripAtPrefix: true,
+  });
+  return isAbsolute(normalized)
+    ? resolve(normalized)
+    : resolve(normalizeInputPath(cwd), normalized);
 }
 
-/** The target path a file tool operates on, from `input.path` (or undefined). */
+function existingReadVariant(path: string): string {
+  const candidates = [
+    path,
+    path.replace(/ (AM|PM)\./gi, "\u202F$1."),
+    path.normalize("NFD"),
+    path.replace(/'/g, "\u2019"),
+    path.normalize("NFD").replace(/'/g, "\u2019"),
+  ];
+  for (const candidate of candidates) {
+    try {
+      accessSync(candidate, constants.F_OK);
+      return candidate;
+    } catch {
+      // Try the next Pi-compatible read fallback.
+    }
+  }
+  return path;
+}
+
+/** Resolve the path that the named Pi file tool will operate on. */
+export function resolveToolInputPath(
+  toolName: string,
+  cwd: string,
+  value: unknown,
+): string | undefined {
+  const resolved = resolveInputPath(cwd, value);
+  if (!resolved || toolName !== "read") return resolved;
+  return existingReadVariant(resolved);
+}
+
+/** The effective target path of a file tool, including Pi's `.` defaults. */
 export function extractInputPath(
   toolName: string,
   input: Record<string, unknown>,
 ): string | undefined {
   if (!PATH_BEARING_TOOLS.has(toolName)) return undefined;
   const value = input.path;
-  return typeof value === "string" && value.trim() !== "" ? value : undefined;
+  if (typeof value === "string" && value !== "") return value;
+  if (toolName === "grep" || toolName === "find" || toolName === "ls") {
+    return ".";
+  }
+  return typeof value === "string" ? value : undefined;
 }
 
 /** Expand a leading `~`, `$HOME`, or `${HOME}` in a path-denial pattern. */
@@ -96,13 +180,21 @@ function resolvePathForPolicyInner(
   }
 }
 
+function normalizeProtectedPathForMatch(value: string): string {
+  return value
+    .replace(/\\/g, "/")
+    .normalize("NFC")
+    .toLowerCase()
+    .normalize("NFC");
+}
+
 export function matchesProtectedPath(
   relativePath: string,
   protectedPaths: string[],
 ): boolean {
-  const normalizedPath = relativePath.replace(/\\/g, "/");
+  const normalizedPath = normalizeProtectedPathForMatch(relativePath);
   return protectedPaths.some((pattern) => {
-    const normalizedPattern = pattern.replace(/\\/g, "/");
+    const normalizedPattern = normalizeProtectedPathForMatch(pattern);
     return normalizedPath === normalizedPattern ||
       normalizedPath.startsWith(`${normalizedPattern}/`);
   });
@@ -140,8 +232,24 @@ export function isProtectedPath(
 }
 
 export function isSafetyControlPath(path: string, cwd: string): boolean {
-  const normalized = path.replace(/\\/g, "/");
-  const file = basename(normalized).toLowerCase();
+  const policyPath = resolvePathForPolicy(path) ?? resolve(path);
+  const policyCwd = resolvePathForPolicy(cwd) ?? resolve(cwd);
+  const normalized = normalizeProtectedPathForMatch(policyPath);
+  const file = basename(normalized);
+  const piAgentRoot = normalizeProtectedPathForMatch(
+    resolve(HOME, ".pi/agent"),
+  );
+  const globalExtensions = `${piAgentRoot}/extensions`;
+  const globalSettings = `${piAgentRoot}/settings`;
+  if (
+    normalized === `${piAgentRoot}/settings.json` ||
+    normalized === globalExtensions ||
+    normalized.startsWith(`${globalExtensions}/`) ||
+    normalized === globalSettings ||
+    normalized.startsWith(`${globalSettings}/`)
+  ) {
+    return true;
+  }
   if (
     normalized.endsWith("/.pi/auto-mode.json") ||
     normalized.endsWith("/auto-mode.json")
@@ -154,7 +262,7 @@ export function isSafetyControlPath(path: string, cwd: string): boolean {
   if (normalized.includes("/.pi/") && file.startsWith("automode")) return true;
   if (
     normalized.includes("/pi-automode/") ||
-    (isInside(path, cwd) && file.includes("auto-mode"))
+    (isInside(policyPath, policyCwd) && file.includes("auto-mode"))
   ) {
     return true;
   }
@@ -164,13 +272,15 @@ export function isSafetyControlPath(path: string, cwd: string): boolean {
 export function shellPathTokenToPath(
   token: string,
   cwd: string,
+  shellText = token,
 ): string | undefined {
   let value = token.trim();
   if (!value || value === "-" || value.startsWith("&")) return undefined;
   value = value
     .replace(/^\$HOME(?=\/|$)/, HOME)
     .replace(/^\$\{HOME\}(?=\/|$)/, HOME);
-  if (value.startsWith("~/")) value = resolve(HOME, value.slice(2));
+  if (shellText === "~") value = HOME;
+  else if (shellText.startsWith("~/")) value = resolve(HOME, value.slice(2));
   return isAbsolute(value) ? resolve(value) : resolve(cwd, value);
 }