@czottmann/pi-automode 1.12.0 → 1.14.0

package/extensions/auto-mode/hard-deny.ts

@@ -1,4 +1,12 @@
+import { statSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { resolve } from "node:path";
+import {
+  analyzeBash,
+  type BashAnalysis,
+  type BashCommandAnalysis,
+  type EffectiveCommand,
+} from "./bash.ts";
 import { HOME } from "./constants.ts";
 import {
   isProfileOrAuthorizedKeysPath,
@@ -8,157 +16,177 @@ import {
   shellPathTokenToPath,
 } from "./paths.ts";
 
-type ShellSegment = {
-  text: string;
-  words: string[];
-  redirectTargets: string[];
+function isRecursiveRmArg(arg: string): boolean {
+  return (
+    (arg.length > 2 && arg.startsWith("--") && "--recursive".startsWith(arg)) ||
+    /^-[A-Za-z]*r[A-Za-z]*f?[A-Za-z]*$/i.test(arg) ||
+    /^-[A-Za-z]*f[A-Za-z]*r[A-Za-z]*$/i.test(arg)
+  );
+}
+
+export type RmInvocation = {
+  recursive: boolean;
+  operands: Array<{ value: string; text: string; tildeExpansion: boolean }>;
 };
 
-function splitShellSegments(command: string): string[] {
-  const segments: string[] = [];
-  let current = "";
-  let quote: "'" | '"' | "`" | undefined;
-  let escaped = false;
+export function parseRmInvocation(command: EffectiveCommand): RmInvocation {
+  let recursive = false;
+  let optionsEnded = false;
+  const operands: RmInvocation["operands"] = [];
 
-  for (let i = 0; i < command.length; i += 1) {
-    const char = command[i] ?? "";
-    const next = command[i + 1] ?? "";
-    if (escaped) {
-      current += char;
-      escaped = false;
-      continue;
-    }
-    if (char === "\\" && quote !== "'") {
-      current += char;
-      escaped = true;
-      continue;
-    }
-    if (quote) {
-      current += char;
-      if (char === quote) quote = undefined;
+  for (const [index, value] of command.args.entries()) {
+    const text = command.argTexts[index] ?? value;
+    const tildeExpansion = command.argTildeExpansions[index] ?? false;
+    if (!optionsEnded && value === "--") {
+      optionsEnded = true;
       continue;
     }
-    if (char === "'" || char === '"' || char === "`") {
-      quote = char;
-      current += char;
+    if (!optionsEnded && value !== "-" && value.startsWith("-")) {
+      if (isRecursiveRmArg(value)) recursive = true;
       continue;
     }
-    if (
-      char === ";" ||
-      char === "\n" ||
-      char === "|" ||
-      (char === "&" && next === "&") ||
-      (char === "|" && next === "|")
-    ) {
-      if (current.trim()) segments.push(current.trim());
-      current = "";
-      if ((char === "&" && next === "&") || (char === "|" && next === "|")) {
-        i += 1;
-      }
-      continue;
-    }
-    current += char;
+    operands.push({ value, text, tildeExpansion });
   }
-  if (current.trim()) segments.push(current.trim());
-  return segments;
+
+  return { recursive, operands };
 }
 
-function tokenizeShellSegment(text: string): string[] {
-  const tokens: string[] = [];
-  let current = "";
-  let quote: "'" | '"' | "`" | undefined;
-  let escaped = false;
+function isUnresolvedUserHomeToken(
+  shellText: string,
+  tildeExpansion: boolean,
+): boolean {
+  return tildeExpansion && shellText !== "~" && !shellText.startsWith("~/");
+}
 
-  for (let i = 0; i < text.length; i += 1) {
-    const char = text[i] ?? "";
-    if (escaped) {
-      current += char;
-      escaped = false;
-      continue;
-    }
-    if (char === "\\" && quote !== "'") {
-      escaped = true;
-      continue;
-    }
-    if (quote) {
-      if (char === quote) quote = undefined;
-      else current += char;
-      continue;
-    }
-    if (char === "'" || char === '"' || char === "`") {
-      quote = char;
-      continue;
-    }
-    if (/\s/.test(char)) {
-      if (current) tokens.push(current);
-      current = "";
-      continue;
-    }
-    if (char === ">" || char === "<") {
-      let op = char;
-      if (/^\d+$/.test(current)) {
-        op = current + char;
-      } else if (current) {
-        tokens.push(current);
-      }
-      if (text[i + 1] === ">" || text[i + 1] === "&") {
-        op += text[i + 1];
-        i += 1;
-      }
-      tokens.push(op);
-      current = "";
-      continue;
-    }
-    current += char;
+function isSameExistingPath(left: string, right: string): boolean {
+  try {
+    const leftStat = statSync(left);
+    const rightStat = statSync(right);
+    return leftStat.dev === rightStat.dev && leftStat.ino === rightStat.ino;
+  } catch {
+    return false;
   }
-  if (current) tokens.push(current);
-  return tokens;
 }
 
-function parseShell(command: string): ShellSegment[] {
-  return splitShellSegments(command).map((text) => {
-    const tokens = tokenizeShellSegment(text);
-    const words: string[] = [];
-    const redirectTargets: string[] = [];
-    for (let i = 0; i < tokens.length; i += 1) {
-      const token = tokens[i] ?? "";
-      if (/^(?:\d?>|\d?>>|>|>>|&>|<)$/.test(token)) {
-        const target = tokens[i + 1];
-        if (target) redirectTargets.push(target);
-        i += 1;
-        continue;
-      }
-      const attachedRedirect = token.match(/^(?:\d?>|\d?>>|>|>>|&>)(.+)$/);
-      if (attachedRedirect?.[1]) {
-        redirectTargets.push(attachedRedirect[1]);
-        continue;
-      }
-      words.push(token);
-    }
-    return { text, words, redirectTargets };
-  });
+function matchesPathRoot(path: string, root: string): boolean {
+  if (path === root || path.startsWith(`${root}/`)) return true;
+  const lowerPath = path.toLowerCase();
+  const lowerRoot = root.toLowerCase();
+  if (lowerPath !== lowerRoot && !lowerPath.startsWith(`${lowerRoot}/`)) {
+    return false;
+  }
+  return isSameExistingPath(path.slice(0, root.length), root);
 }
 
-function commandName(words: string[]): string | undefined {
-  return words.find((word) => !/^\w+=/.test(word));
+/**
+ * Top-level directories whose deletion or wholesale modification is a
+ * system-wide event. Shared between candidate validation and path
+ * classification; do not inline copies.
+ */
+const SYSTEM_ROOTS: ReadonlyArray<string> = [
+  "/bin",
+  "/boot",
+  "/dev",
+  "/etc",
+  "/home",
+  "/lib",
+  "/lib64",
+  "/Library",
+  "/private",
+  "/proc",
+  "/root",
+  "/run",
+  "/sbin",
+  "/sys",
+  "/System",
+  "/usr",
+  "/var",
+];
+
+/**
+ * Normalize a proposed temp-root value into a comparable absolute path.
+ * Returns undefined for values that cannot denote a subdirectory: the
+ * empty string, `/`, and slash-only artifacts.
+ */
+function normalizeRootCandidate(value: string): string | undefined {
+  const stripped = value.replace(/\/+$/, "");
+  // An empty stripped value must not fall through to `resolve()`, which
+  // would silently turn `/` into the process working directory.
+  if (!stripped) return undefined;
+  const normalized = resolve(stripped);
+  if (normalized === "/") return undefined;
+  return normalized;
 }
 
-function commandArgs(words: string[]): string[] {
-  const index = words.findIndex((word) => !/^\w+=/.test(word));
-  return index >= 0 ? words.slice(index + 1) : [];
+/**
+ * True when a candidate temp root would weaken the deterministic deny tiers:
+ * it aliases (exact, case-folded, or dev/inode) `HOME`, `/`, or any system
+ * root, or it is a proper ancestor of the canonical home directory.
+ *
+ * Dev/inode identity covers symlinked spellings of existing directories;
+ * string comparison alone handles candidates that do not exist yet. See
+ * issue #31: without these guards, `TMPDIR=/` reduced every absolute path
+ * below an empty-string prefix match, and `TMPDIR=/private` made
+ * `/private/etc/**` disposable.
+ */
+function conflictsWithProtectedRoots(candidate: string, home: string): boolean {
+  if (candidate === "/") return true;
+  for (const protectedRoot of ["/", home, ...SYSTEM_ROOTS]) {
+    const canonical = resolve(protectedRoot);
+    if (
+      candidate === canonical ||
+      candidate.toLowerCase() === canonical.toLowerCase()
+    ) {
+      return true;
+    }
+    if (isSameExistingPath(candidate, canonical)) return true;
+  }
+  const homeCanonical = resolvePathForPolicy(home) ?? resolve(home);
+  return homeCanonical.toLowerCase().startsWith(`${candidate.toLowerCase()}/`);
 }
 
-function isRecursiveRmArg(arg: string): boolean {
-  return (
-    arg === "--recursive" ||
-    /^-[A-Za-z]*r[A-Za-z]*f?[A-Za-z]*$/.test(arg) ||
-    /^-[A-Za-z]*f[A-Za-z]*r[A-Za-z]*$/.test(arg)
-  );
+let cachedTempRoots: ReadonlyArray<string> | undefined;
+let cachedTmpdirValue: string | undefined;
+
+/**
+ * Validated launcher-declared temp-dir roots whose subtrees are treated as
+ * disposable by `isRootHomeOrSystemPath`: the platform tmpdir, plus `/tmp` on
+ * macOS where it exists independently of `os.tmpdir()`. Each root appears in
+ * canonical and resolved spelling because callers pass symlink-resolved
+ * policy paths (`/tmp` → `/private/tmp` on macOS) and unresolved fallbacks
+ * alike. Values from `os.tmpdir()` are not trusted blindly; see
+ * `conflictsWithProtectedRoots`. The roots themselves are never exempt:
+ * deleting one is a system-wide delete.
+ *
+ * The memoization keys on the effective `os.tmpdir()` return value so tests
+ * can mutate `TMPDIR`, `TMP`, or `TEMP` between calls.
+ */
+export function tempRootCandidates(): ReadonlyArray<string> {
+  const currentTmpdir = tmpdir();
+  if (cachedTempRoots && cachedTmpdirValue === currentTmpdir) {
+    return cachedTempRoots;
+  }
+  cachedTmpdirValue = currentTmpdir;
+  cachedTempRoots = (() => {
+    const roots = new Set<string>();
+    const consider = (value: string) => {
+      const candidate = normalizeRootCandidate(value);
+      if (!candidate || conflictsWithProtectedRoots(candidate, HOME)) return;
+      roots.add(candidate);
+      const resolved = resolvePathForPolicy(candidate);
+      if (resolved) roots.add(resolved);
+    };
+    consider(currentTmpdir);
+    if (process.platform === "darwin") consider("/tmp");
+    return [...roots];
+  })();
+  return cachedTempRoots;
 }
 
 /**
  * True for `/`, the user's home root, or a top-level system root such as
- * `/etc`, `/usr`, or `/var`. Excludes the home *subtree*.
+ * `/etc`, `/usr`, or `/var`. Excludes the home *subtree* and the subtrees of
+ * platform temp directories (`os.tmpdir()` and `/tmp` on macOS).
  *
  * On some distros (e.g. Fedora Silverblue) HOME lives under `/var`, which is
  * in `systemRoots`. Without the subtree exemption, `path.startsWith("/var/")`
@@ -166,31 +194,41 @@ function isRecursiveRmArg(arg: string): boolean {
  * `rm -rf ~/...`. HOME itself is still matched below, so `rm -rf ~` stays
  * blocked. `home` is a parameter so this can be unit-tested with a synthetic
  * `/var/home/...` value.
+ *
+ * The temp exemption mirrors the home one and covers cleanup of directories
+ * created with `mktemp`, `os.tmpdir()`, or plain `/tmp` paths. On macOS these
+ * resolve into `/private/tmp` or `/private/var/folders`, which used to match
+ * the `/private` system root and hard-deny every temp cleanup. Deleting a
+ * temp root itself still returns true; `tempRoots` is injectable for tests.
+ *
+ * Protection order matters (issue #31): exact `/`, the exact home root, and
+ * system roots win over every exemption. Injected `tempRoots` values are
+ * validated per call so hostile or malformed candidates cannot weaken the
+ * deterministic tiers.
  */
-export function isRootHomeOrSystemPath(path: string, home: string): boolean {
-  const systemRoots = [
-    "/bin",
-    "/boot",
-    "/dev",
-    "/etc",
-    "/lib",
-    "/lib64",
-    "/private",
-    "/sbin",
-    "/sys",
-    "/usr",
-    "/var",
-  ];
-  if (path.startsWith(`${home}/`)) return false;
+export function isRootHomeOrSystemPath(
+  path: string,
+  home: string,
+  tempRoots: ReadonlyArray<string> = tempRootCandidates(),
+): boolean {
+  if (path === "/") return true;
+  if (path === home || isSameExistingPath(path, home)) return true;
+  if (matchesPathRoot(path, home) && path.length > home.length) return false;
+  for (const root of tempRoots) {
+    const candidate = normalizeRootCandidate(root);
+    if (!candidate || conflictsWithProtectedRoots(candidate, home)) continue;
+    if (!matchesPathRoot(path, candidate)) continue;
+    // Subtree: disposable. Exact match: the temp root stays protected.
+    return path.length > candidate.length ? false : true;
+  }
   return (
-    path === "/" ||
-    path === home ||
-    systemRoots.some((root) => path === root || path.startsWith(`${root}/`))
+    matchesPathRoot(path, home) ||
+    SYSTEM_ROOTS.some((root) => matchesPathRoot(path, root))
   );
 }
 
 function segmentHardDeny(
-  segment: ShellSegment,
+  segment: BashCommandAnalysis,
   cwd: string,
 ): string | undefined {
   for (const target of segment.redirectTargets) {
@@ -213,9 +251,10 @@ function segmentHardDeny(
     }
   }
 
-  const name = commandName(segment.words);
+  const command = segment.effectiveCommand;
+  const name = command.name;
   if (!name) return undefined;
-  const args = commandArgs(segment.words);
+  const args = command.args;
   const lowerArgs = args.map((arg) => arg.toLowerCase());
 
   if (
@@ -270,18 +309,32 @@ function segmentHardDeny(
     return "platform security weakening is hard-denied";
   }
 
-  if (name === "rm" && args.some(isRecursiveRmArg)) {
-    for (const arg of args.filter((arg) => !arg.startsWith("-"))) {
-      const path = shellPathTokenToPath(arg, cwd);
-      if (path && isRootHomeOrSystemPath(path, HOME)) {
-        return "irreversible deletion of home/root/system paths is hard-denied";
+  if (name === "rm") {
+    const rm = parseRmInvocation(command);
+    if (rm.recursive) {
+      for (const { value: arg, text: shellText, tildeExpansion } of rm.operands) {
+        if (isUnresolvedUserHomeToken(shellText, tildeExpansion)) {
+          return "irreversible deletion of a user-home expansion is hard-denied";
+        }
+        const path = shellPathTokenToPath(arg, cwd, shellText);
+        const policyPath = path ? (resolvePathForPolicy(path) ?? path) : undefined;
+        const policyHome = resolvePathForPolicy(HOME) ?? HOME;
+        if (policyPath && isRootHomeOrSystemPath(policyPath, policyHome)) {
+          return "irreversible deletion of home/root/system paths is hard-denied";
+        }
       }
     }
   }
 
   if (name === "find" && lowerArgs.includes("-delete")) {
     const root = shellPathTokenToPath(args[0] ?? "", cwd);
-    if (root && isRootHomeOrSystemPath(root, HOME) && root !== HOME) {
+    const policyRoot = root ? (resolvePathForPolicy(root) ?? root) : undefined;
+    const policyHome = resolvePathForPolicy(HOME) ?? HOME;
+    if (
+      policyRoot &&
+      isRootHomeOrSystemPath(policyRoot, policyHome) &&
+      policyRoot !== policyHome
+    ) {
       return "system-wide delete is hard-denied";
     }
   }
@@ -320,7 +373,7 @@ function segmentHardDeny(
       "sed",
     ].includes(name) &&
     /\.pi\/automode|\.pi\/extensions|pi-automode|auto-mode\.json/i.test(
-      segment.text,
+      segment.raw,
     )
   ) {
     return "auto-mode or permission safety-control modification is hard-denied";
@@ -332,14 +385,14 @@ function segmentHardDeny(
 /**
  * Deterministic deny checks for actions too risky to delegate to the classifier.
  *
- * Bash checks use a small shell lexer instead of only regexes. It is not a full
- * POSIX shell implementation, but it handles quotes, redirects, pipes, `&&`, and
- * `;` well enough to avoid the common "safe prefix hides risky suffix" bypass.
+ * Bash checks use the shared unbash AST analysis. The hook passes one analysis
+ * through every enforcement stage so nested commands are not reparsed.
  */
 export function deterministicHardDeny(
   toolName: string,
   input: Record<string, unknown>,
   cwd: string,
+  bashAnalysis?: BashAnalysis,
 ): string | undefined {
   if (toolName === "write" || toolName === "edit") {
     const path = resolveInputPath(cwd, input.path);
@@ -355,7 +408,20 @@ export function deterministicHardDeny(
 
   if (toolName !== "bash") return undefined;
   const command = typeof input.command === "string" ? input.command : "";
-  for (const segment of parseShell(command)) {
+  const analysis = bashAnalysis ?? analyzeBash(command);
+  if (analysis.errors.length > 0) {
+    return `Bash input could not be parsed safely: ${analysis.errors[0]?.message ?? "unknown parser error"}`;
+  }
+  for (const target of analysis.redirectTargets) {
+    const path = shellPathTokenToPath(target, cwd);
+    if (!path) continue;
+    const profileReason = isProfileOrAuthorizedKeysPath(path);
+    if (profileReason) return profileReason;
+    if (isSafetyControlPath(path, cwd)) {
+      return "auto-mode or permission safety-control modification is hard-denied";
+    }
+  }
+  for (const segment of analysis.commands) {
     const reason = segmentHardDeny(segment, cwd);
     if (reason) return reason;
   }

package/extensions/auto-mode/paths.ts

@@ -180,13 +180,21 @@ function resolvePathForPolicyInner(
   }
 }
 
+function normalizeProtectedPathForMatch(value: string): string {
+  return value
+    .replace(/\\/g, "/")
+    .normalize("NFC")
+    .toLowerCase()
+    .normalize("NFC");
+}
+
 export function matchesProtectedPath(
   relativePath: string,
   protectedPaths: string[],
 ): boolean {
-  const normalizedPath = relativePath.replace(/\\/g, "/");
+  const normalizedPath = normalizeProtectedPathForMatch(relativePath);
   return protectedPaths.some((pattern) => {
-    const normalizedPattern = pattern.replace(/\\/g, "/");
+    const normalizedPattern = normalizeProtectedPathForMatch(pattern);
     return normalizedPath === normalizedPattern ||
       normalizedPath.startsWith(`${normalizedPattern}/`);
   });
@@ -224,8 +232,24 @@ export function isProtectedPath(
 }
 
 export function isSafetyControlPath(path: string, cwd: string): boolean {
-  const normalized = path.replace(/\\/g, "/");
-  const file = basename(normalized).toLowerCase();
+  const policyPath = resolvePathForPolicy(path) ?? resolve(path);
+  const policyCwd = resolvePathForPolicy(cwd) ?? resolve(cwd);
+  const normalized = normalizeProtectedPathForMatch(policyPath);
+  const file = basename(normalized);
+  const piAgentRoot = normalizeProtectedPathForMatch(
+    resolve(HOME, ".pi/agent"),
+  );
+  const globalExtensions = `${piAgentRoot}/extensions`;
+  const globalSettings = `${piAgentRoot}/settings`;
+  if (
+    normalized === `${piAgentRoot}/settings.json` ||
+    normalized === globalExtensions ||
+    normalized.startsWith(`${globalExtensions}/`) ||
+    normalized === globalSettings ||
+    normalized.startsWith(`${globalSettings}/`)
+  ) {
+    return true;
+  }
   if (
     normalized.endsWith("/.pi/auto-mode.json") ||
     normalized.endsWith("/auto-mode.json")
@@ -238,7 +262,7 @@ export function isSafetyControlPath(path: string, cwd: string): boolean {
   if (normalized.includes("/.pi/") && file.startsWith("automode")) return true;
   if (
     normalized.includes("/pi-automode/") ||
-    (isInside(path, cwd) && file.includes("auto-mode"))
+    (isInside(policyPath, policyCwd) && file.includes("auto-mode"))
   ) {
     return true;
   }
@@ -248,13 +272,15 @@ export function isSafetyControlPath(path: string, cwd: string): boolean {
 export function shellPathTokenToPath(
   token: string,
   cwd: string,
+  shellText = token,
 ): string | undefined {
   let value = token.trim();
   if (!value || value === "-" || value.startsWith("&")) return undefined;
   value = value
     .replace(/^\$HOME(?=\/|$)/, HOME)
     .replace(/^\$\{HOME\}(?=\/|$)/, HOME);
-  if (value.startsWith("~/")) value = resolve(HOME, value.slice(2));
+  if (shellText === "~") value = HOME;
+  else if (shellText.startsWith("~/")) value = resolve(HOME, value.slice(2));
   return isAbsolute(value) ? resolve(value) : resolve(cwd, value);
 }