@czottmann/pi-automode 1.12.0 → 1.14.0

package/extensions/auto-mode/permissions.ts

@@ -1,7 +1,14 @@
+import {
+  analyzeBash,
+  type BashAnalysis,
+  type BashCommandAnalysis,
+  type BashRedirectAnalysis,
+} from "./bash.ts";
 import type { ToolPattern } from "./types.ts";
 import {
   expandHomePattern,
   normalizePathForMatch,
+  resolveInputPath,
   resolvePathForPolicy,
   resolveToolInputPath,
 } from "./paths.ts";
@@ -9,6 +16,8 @@ import {
 export const MAX_WILDCARD_PATTERN_LENGTH = 4096;
 export const MAX_WILDCARD_INPUT_LENGTH = 1024 * 1024;
 
+const bashPatternAnalyses = new WeakMap<ToolPattern, BashAnalysis>();
+
 /** Preserve the previous non-Unicode RegExp `/i` case-equivalence rules. */
 function canonicalizeCase(value: string): string {
   let canonical = "";
@@ -55,11 +64,14 @@ export function parseToolPattern(value: unknown): ToolPattern | undefined {
 
   const match = raw.match(/^@?([A-Za-z0-9_-]+)(?:\((.*)\))?$/s);
   if (!match) return { raw };
-  return {
-    raw,
-    toolName: normalizeToolName(match[1] ?? ""),
-    argumentPattern: match[2],
-  };
+  const toolName = normalizeToolName(match[1] ?? "");
+  const argumentPattern = match[2];
+  const bashPatternAnalysis = toolName === "bash" && argumentPattern
+    ? analyzeBash(argumentPattern)
+    : undefined;
+  const pattern: ToolPattern = { raw, toolName, argumentPattern };
+  if (bashPatternAnalysis) bashPatternAnalyses.set(pattern, bashPatternAnalysis);
+  return pattern;
 }
 
 function literalPrefixTable(value: string): number[] {
@@ -166,36 +178,110 @@ export function matchesWildcardPattern(
   return true;
 }
 
-function getPrimaryArgument(
+export function normalizePermissionPathForMatch(
+  path: string,
+  platform: NodeJS.Platform = process.platform,
+): string {
+  return platform === "win32" ? path.replace(/\\/g, "/") : path;
+}
+
+function pathArgumentsForMatch(
+  toolName: string,
+  cwd: string,
+  value: string,
+  overflowPolicy: WildcardOverflowPolicy,
+): string[] {
+  const resolved = resolveToolInputPath(toolName, cwd, value) ?? value;
+  const canonical = resolvePathForPolicy(resolved);
+  const candidates = canonical
+    ? [canonical, normalizePathForMatch(canonical, cwd)]
+    : [];
+  if (overflowPolicy === "match") {
+    candidates.push(resolved, normalizePathForMatch(resolved, cwd));
+  }
+  return [...new Set(
+    candidates.map((candidate) => normalizePermissionPathForMatch(candidate)),
+  )];
+}
+
+function getPrimaryArguments(
   toolName: string,
   input: Record<string, unknown>,
   cwd: string,
-): string {
+  overflowPolicy: WildcardOverflowPolicy,
+): string[] {
   if (toolName === "bash" && typeof input.command === "string") {
-    return input.command;
+    return [input.command];
   }
   if (
     (toolName === "read" || toolName === "write" || toolName === "edit") &&
     typeof input.path === "string"
   ) {
-    return normalizePathForMatch(
-      resolveToolInputPath(toolName, cwd, input.path) ?? input.path,
-      cwd,
-    );
+    return pathArgumentsForMatch(toolName, cwd, input.path, overflowPolicy);
   }
   if (toolName === "grep" && typeof input.pattern === "string") {
-    return input.pattern;
+    return [input.pattern];
   }
   if (
     (toolName === "find" || toolName === "ls") &&
     typeof input.path === "string"
   ) {
-    return normalizePathForMatch(
-      resolveToolInputPath(toolName, cwd, input.path) ?? input.path,
-      cwd,
-    );
+    return pathArgumentsForMatch(toolName, cwd, input.path, overflowPolicy);
   }
-  return JSON.stringify(input);
+  return [JSON.stringify(input)];
+}
+
+function isPermissionPathTool(toolName: string): boolean {
+  return toolName === "read" ||
+    toolName === "write" ||
+    toolName === "edit" ||
+    toolName === "find" ||
+    toolName === "ls";
+}
+
+export function appendPermissionPathPatternSuffix(
+  scope: string,
+  suffix: string,
+): string {
+  const normalizedScope = withoutTrailingSlash(
+    normalizePermissionPathForMatch(scope),
+  );
+  return normalizedScope.endsWith("/")
+    ? `${normalizedScope}${suffix}`
+    : `${normalizedScope}/${suffix}`;
+}
+
+function permissionPathPatternVariants(
+  pattern: string,
+  cwd: string,
+): string[] {
+  const expanded = normalizePermissionPathForMatch(expandHomePattern(pattern));
+  const wildcardIndex = expanded.indexOf("*");
+  if (wildcardIndex === -1) {
+    const resolved = resolveInputPath(cwd, expanded);
+    const canonical = resolved ? resolvePathForPolicy(resolved) : undefined;
+    return [...new Set(
+      [expanded, resolved, canonical]
+        .filter((value): value is string => !!value)
+        .map((value) => normalizePermissionPathForMatch(value)),
+    )];
+  }
+
+  const fixedPrefix = expanded.slice(0, wildcardIndex);
+  const lastSlash = fixedPrefix.lastIndexOf("/");
+  if (lastSlash < 0) return [expanded];
+  const fixedScope = fixedPrefix.slice(0, lastSlash) || "/";
+  const resolvedScope = resolveInputPath(cwd, fixedScope);
+  if (!resolvedScope) return [expanded];
+  const canonicalScope = resolvePathForPolicy(resolvedScope);
+  const suffix = expanded.slice(lastSlash).replace(/^\/+/, "");
+  return [...new Set([
+    expanded,
+    appendPermissionPathPatternSuffix(resolvedScope, suffix),
+    ...(canonicalScope
+      ? [appendPermissionPathPatternSuffix(canonicalScope, suffix)]
+      : []),
+  ])];
 }
 
 /**
@@ -285,6 +371,37 @@ export function recursiveSearchMayReachDeniedPath(
   });
 }
 
+function normalizedBashArgumentPattern(pattern: ToolPattern): string {
+  const patternAnalysis = bashPatternAnalyses.get(pattern);
+  if (
+    patternAnalysis &&
+    patternAnalysis.errors.length === 0 &&
+    patternAnalysis.redirects.length === 0 &&
+    isStructurallyPlainSingleCommand(patternAnalysis)
+  ) {
+    return patternAnalysis.commands[0]?.text ?? pattern.argumentPattern ?? "";
+  }
+  return pattern.argumentPattern ?? "";
+}
+
+function matchesBashArgumentPattern(
+  argumentPattern: string,
+  candidate: string,
+  overflowPolicy: WildcardOverflowPolicy,
+): boolean {
+  if (matchesWildcardPattern(argumentPattern, candidate, overflowPolicy)) {
+    return true;
+  }
+  if (overflowPolicy !== "match" || !argumentPattern.endsWith(" *")) {
+    return false;
+  }
+  return matchesWildcardPattern(
+    argumentPattern.slice(0, -2),
+    candidate,
+    overflowPolicy,
+  );
+}
+
 /** Match a scoped permission rule against a concrete tool call. */
 export function matchesToolPattern(
   pattern: ToolPattern,
@@ -292,10 +409,215 @@ export function matchesToolPattern(
   input: Record<string, unknown>,
   cwd: string,
   overflowPolicy: WildcardOverflowPolicy = "match",
+  bashAnalysis?: BashAnalysis,
 ): boolean {
-  if (!pattern.toolName) return false;
+  if (!pattern.toolName) return overflowPolicy === "match";
   if (pattern.toolName !== normalizeToolName(toolName)) return false;
-  if (!pattern.argumentPattern) return true;
-  const primary = getPrimaryArgument(toolName, input, cwd);
-  return matchesWildcardPattern(pattern.argumentPattern, primary, overflowPolicy);
+  if (pattern.argumentPattern === undefined) return true;
+  if (pattern.argumentPattern.trim() === "") {
+    return overflowPolicy === "match";
+  }
+  if (
+    toolName === "bash" &&
+    (bashPatternAnalyses.get(pattern)?.errors.length ?? 0) > 0
+  ) {
+    return overflowPolicy === "match";
+  }
+  if (toolName === "bash" && bashAnalysis) {
+    if (bashAnalysis.errors.length > 0) return overflowPolicy === "match";
+    const candidates = overflowPolicy === "match"
+      ? [bashAnalysis.source, ...bashAnalysis.commands.map((command) => command.text)]
+      : [bashAnalysis.source];
+    const argumentPattern = normalizedBashArgumentPattern(pattern);
+    return candidates.some((candidate) =>
+      matchesBashArgumentPattern(argumentPattern, candidate, overflowPolicy)
+    );
+  }
+  const argumentPatterns = isPermissionPathTool(toolName)
+    ? permissionPathPatternVariants(pattern.argumentPattern, cwd)
+    : [pattern.argumentPattern];
+  const primaryArguments = getPrimaryArguments(
+    toolName,
+    input,
+    cwd,
+    overflowPolicy,
+  );
+  return argumentPatterns.some((argumentPattern) =>
+    primaryArguments.some((primary) =>
+      matchesWildcardPattern(argumentPattern, primary, overflowPolicy)
+    )
+  );
+}
+
+/** Return the normalized Bash command that matched a scoped permission rule. */
+export function matchingBashCommandText(
+  pattern: ToolPattern,
+  bashAnalysis: BashAnalysis | undefined,
+  overflowPolicy: WildcardOverflowPolicy = "match",
+): string | undefined {
+  if (!bashAnalysis || pattern.toolName !== "bash") return undefined;
+  if (bashAnalysis.errors.length > 0) return undefined;
+  if (!pattern.argumentPattern) return undefined;
+  const argumentPattern = normalizedBashArgumentPattern(pattern);
+  const command = bashAnalysis.commands.find((candidate) =>
+    matchesBashArgumentPattern(argumentPattern, candidate.text, overflowPolicy)
+  );
+  if (command) return command.text;
+  return matchesBashArgumentPattern(argumentPattern, bashAnalysis.source, overflowPolicy)
+    ? bashAnalysis.source
+    : undefined;
+}
+
+function redirectListsMatch(
+  patternRedirects: BashRedirectAnalysis[],
+  inputRedirects: BashRedirectAnalysis[],
+): boolean {
+  if (patternRedirects.length !== inputRedirects.length) return false;
+  return patternRedirects.every((pattern, index) => {
+    const input = inputRedirects[index];
+    if (!input || pattern.heredoc || input.heredoc || input.targetDynamic) {
+      return false;
+    }
+    if (
+      pattern.operator !== input.operator ||
+      pattern.fileDescriptor !== input.fileDescriptor ||
+      pattern.variableName !== input.variableName
+    ) {
+      return false;
+    }
+    if (pattern.target === undefined) return input.target === undefined;
+    if (input.target === undefined) return false;
+    return matchesWildcardPattern(pattern.target, input.target, "no-match");
+  });
+}
+
+function commandMatchesAllowPattern(
+  patternCommand: BashCommandAnalysis,
+  inputCommand: BashCommandAnalysis,
+): boolean {
+  return matchesWildcardPattern(
+    patternCommand.text,
+    inputCommand.text,
+    "no-match",
+  ) && redirectListsMatch(patternCommand.redirects, inputCommand.redirects);
+}
+
+function structuresMatch(pattern: BashAnalysis, input: BashAnalysis): boolean {
+  return pattern.structure.length === input.structure.length &&
+    pattern.structure.every((token, index) => token === input.structure[index]);
+}
+
+function allRedirectsAreCommandRedirects(analysis: BashAnalysis): boolean {
+  return analysis.redirects.length === analysis.commands.reduce(
+    (count, command) => count + command.redirects.length,
+    0,
+  );
+}
+
+function isStructurallyPlainSingleCommand(analysis: BashAnalysis): boolean {
+  if (analysis.commands.length !== 1) return false;
+  if (analysis.structure.length !== 3 + analysis.redirects.length) return false;
+  if (analysis.structure[0] !== "script:1") return false;
+  if (analysis.structure[1] !== "node:Statement:foreground:0") return false;
+  if (!/^node:Command:\d+:\d+$/.test(analysis.structure[2] ?? "")) {
+    return false;
+  }
+  return analysis.structure.slice(3).every((token) =>
+    token.startsWith("redirect:")
+  );
+}
+
+function supportsPerCommandAllowPatterns(analysis: BashAnalysis): boolean {
+  return analysis.structure.every((token) =>
+    token.startsWith("script:") ||
+    token.startsWith("node:Statement:foreground:") ||
+    token.startsWith("node:Command:") ||
+    token.startsWith("node:AndOr:") ||
+    token.startsWith("node:Pipeline:plain:plain:") ||
+    token.startsWith("redirect:")
+  );
+}
+
+/** Whether permission allow rules cover the complete tool call. */
+export function matchesAllowedToolPatterns(
+  patterns: ToolPattern[],
+  toolName: string,
+  input: Record<string, unknown>,
+  cwd: string,
+  bashAnalysis?: BashAnalysis,
+): boolean {
+  if (toolName !== "bash" || !bashAnalysis) {
+    return patterns.some((pattern) =>
+      matchesToolPattern(pattern, toolName, input, cwd, "no-match")
+    );
+  }
+  if (
+    bashAnalysis.errors.length > 0 ||
+    bashAnalysis.commands.length === 0 ||
+    !bashAnalysis.allowStructureSafe
+  ) {
+    return false;
+  }
+  if (
+    bashAnalysis.commands.some((command) =>
+      command.dynamicName || command.dynamicShellScript
+    )
+  ) {
+    return false;
+  }
+
+  for (const pattern of patterns) {
+    if (pattern.toolName !== "bash") continue;
+    const patternAnalysis = bashPatternAnalyses.get(pattern);
+    if (
+      !patternAnalysis ||
+      patternAnalysis.errors.length > 0 ||
+      !patternAnalysis.allowStructureSafe ||
+      isStructurallyPlainSingleCommand(patternAnalysis) ||
+      patternAnalysis.commands.length !== bashAnalysis.commands.length ||
+      !structuresMatch(patternAnalysis, bashAnalysis) ||
+      !redirectListsMatch(patternAnalysis.redirects, bashAnalysis.redirects)
+    ) {
+      continue;
+    }
+    if (
+      patternAnalysis.commands.every((patternCommand, index) => {
+        const inputCommand = bashAnalysis.commands[index];
+        return !!inputCommand &&
+          commandMatchesAllowPattern(patternCommand, inputCommand);
+      })
+    ) {
+      return true;
+    }
+  }
+
+  const hasBareBashPattern = patterns.some((pattern) =>
+    pattern.toolName === "bash" && pattern.argumentPattern === undefined
+  );
+  if (
+    !hasBareBashPattern &&
+    !supportsPerCommandAllowPatterns(bashAnalysis)
+  ) {
+    return false;
+  }
+  if (!allRedirectsAreCommandRedirects(bashAnalysis)) return false;
+  return bashAnalysis.commands.every((command) =>
+    patterns.some((pattern) => {
+      if (pattern.toolName !== "bash") return false;
+      if (pattern.argumentPattern === undefined) {
+        return command.redirects.length === 0;
+      }
+      const patternAnalysis = bashPatternAnalyses.get(pattern);
+      if (
+        !patternAnalysis ||
+        patternAnalysis.errors.length > 0 ||
+        !isStructurallyPlainSingleCommand(patternAnalysis)
+      ) {
+        return false;
+      }
+      const patternCommand = patternAnalysis.commands[0];
+      return !!patternCommand &&
+        commandMatchesAllowPattern(patternCommand, command);
+    })
+  );
 }

package/extensions/auto-mode.ts

@@ -7,6 +7,7 @@
  */
 
 export * from "./auto-mode/classifier.ts";
+export * from "./auto-mode/bash.ts";
 export * from "./auto-mode/config.ts";
 export * from "./auto-mode/constants.ts";
 export * from "./auto-mode/extension.ts";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@czottmann/pi-automode",
-  "version": "1.12.0",
+  "version": "1.14.0",
   "description": "Claude Code-style auto mode guardrail for pi.",
   "repository": {
     "url": "https://github.com/czottmann/pi-automode"
@@ -54,5 +54,8 @@
     "tsx": "^4.22.4",
     "typebox": "^1.3.10",
     "typescript": "^5.8.0"
+  },
+  "dependencies": {
+    "unbash": "4.0.10"
   }
 }