@davisliu2006/pi-permission-system 0.0.0-stage → 0.2.0

package/src/extension.ts

@@ -0,0 +1,163 @@
+import { getAgentDir, type ExtensionAPI, type ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { join } from "node:path";
+
+import { clearPurposeCache, generateRequestPurpose } from "./ai-purpose.ts";
+import { clearWildcardCache } from "./matcher.ts";
+import {
+  ALLOW,
+  CONFIG_FILENAME,
+  DENY,
+  LOCAL_CONFIG_DIR_SEGMENTS,
+  MAX_CONFIG_WARNINGS,
+  STATUS_KEY,
+} from "./constants.ts";
+import { loadMergedConfig } from "./config.ts";
+import { promptForPermission } from "./permission-dialog.ts";
+import { findSessionApproval, resolvePolicy } from "./policy.ts";
+import {
+  buildPurposePromptContext,
+  formatDenyReason,
+  formatNoUiReason,
+  formatRejectReason,
+} from "./prompts.ts";
+import { buildRequest } from "./request-builder.ts";
+import { SessionApprovalStore } from "./session-approvals.ts";
+import {
+  buildSelectorSummary,
+  STATUS_SUMMARIZING_REQUEST,
+} from "./ui-strings.ts";
+import {
+  CONFIG_WARNING_PREFIX,
+  formatSuppressedConfigWarnings,
+} from "./warning-strings.ts";
+import { chooseAlwaysRules } from "./wildcard-editor.ts";
+import type { PermissionConfig } from "./types.ts";
+
+interface ExtensionState {
+  config?: PermissionConfig;
+  configCwd?: string;
+  readonly approvals: SessionApprovalStore;
+}
+
+/**
+ * Create an empty extension state.
+ */
+function createNewState(): ExtensionState {
+  return { approvals: new SessionApprovalStore() };
+}
+
+/**
+ * Loads config for the cwd.
+ * Displays any warnings that are generated.
+ */
+async function loadConfig(ctx: ExtensionContext): Promise<PermissionConfig> {
+  const { config, warnings } = await loadMergedConfig(
+    join(getAgentDir(), CONFIG_FILENAME),
+    join(ctx.cwd, ...LOCAL_CONFIG_DIR_SEGMENTS, CONFIG_FILENAME)
+  );
+
+  if (ctx.hasUI) {
+    for (const warning of warnings.slice(0, MAX_CONFIG_WARNINGS)) {
+      ctx.ui.notify(`${CONFIG_WARNING_PREFIX}${warning.message}`, "warning");
+    }
+    if (warnings.length > MAX_CONFIG_WARNINGS) {
+      const suppressed = warnings.length - MAX_CONFIG_WARNINGS;
+      ctx.ui.notify(
+        `${CONFIG_WARNING_PREFIX}${formatSuppressedConfigWarnings(suppressed)}`,
+        "warning"
+      );
+    }
+  }
+
+  return config;
+}
+
+/**
+ * Registers the extension.
+ */
+export function registerPermissionSystem(pi: ExtensionAPI): void {
+  const state = createNewState();
+
+  /**
+   * Ensures the config matches with the cwd.
+   */
+  const ensureConfig = async (ctx: ExtensionContext): Promise<PermissionConfig> => {
+    if (state.config && state.configCwd === ctx.cwd) {return state.config;}
+    const config = await loadConfig(ctx);
+    state.config = config;
+    state.configCwd = ctx.cwd;
+    return config;
+  };
+
+  // session start
+  pi.on("session_start", async (_event, ctx) => {
+    state.approvals.clear();
+    clearPurposeCache();
+    clearWildcardCache();
+    state.config = undefined;
+    state.configCwd = undefined;
+    state.config = await ensureConfig(ctx);
+  });
+
+  // session end
+  pi.on("session_shutdown", () => {
+    state.approvals.clear();
+    clearPurposeCache();
+    clearWildcardCache();
+  });
+
+  // tool called
+  pi.on("tool_call", async (event, ctx) => {
+    const request = await buildRequest(event.toolName, event.input, ctx.cwd);
+    const config = await ensureConfig(ctx);
+    const policy = resolvePolicy(config, request);
+
+    if (policy.state === DENY) { // auto deny
+      return { block: true, reason: formatDenyReason(request, policy) };
+    }
+    if (policy.state === ALLOW) { // auto allow
+      return undefined;
+    }
+    if (!ctx.hasUI) { // no ui, auto deny
+      return { block: true, reason: formatNoUiReason(request, policy) };
+    }
+
+    // check session approval
+    const approval = findSessionApproval(state.approvals.getRules(), request);
+    if (approval) {return undefined;} // approved, proceed
+
+    const summary = buildSelectorSummary(request);
+    ctx.ui.setStatus(STATUS_KEY, STATUS_SUMMARIZING_REQUEST);
+    let purpose: string | undefined;
+    try {
+      purpose = await generateRequestPurpose(
+        ctx,
+        request,
+        buildPurposePromptContext(request)
+      );
+    } finally {
+      ctx.ui.setStatus(STATUS_KEY, undefined);
+    }
+
+    while (true) {
+      const choice = await promptForPermission(ctx, request, policy, summary, purpose);
+      if (choice.kind === "once") { // approved, proceed
+        return;
+      }
+      if (choice.kind === "reject") { // rejected
+        return { block: true, reason: formatRejectReason(request) };
+      }
+
+      // "allow always"
+      const rules = await chooseAlwaysRules(ctx, request, policy);
+      if (!rules) {
+        // the user cancelled the wildcard editor, return to the permission dialog
+        continue;
+      }
+      for (const rule of rules) {
+        state.approvals.add(rule);
+      }
+      return undefined;
+    }
+  });
+}

package/src/jsonc.ts

@@ -0,0 +1,78 @@
+/**
+ * Strips comments from JSON.
+ */
+function stripComments(input: string): string {
+  let output = "";
+  let inString = false; // comments cannot exist in string
+  let escaped = false;
+
+  for (let i = 0; i < input.length; i++) {
+    const char = input[i]!;
+    if (inString) {
+      output += char;
+      if (escaped) {escaped = false;}
+      else if (char === "\\") {escaped = true;}
+      else if (char === '"') {inString = false;}
+    } else if (char === '"') {
+      inString = true;
+      output += char;
+    } else if (char === "/" && input[i+1] === "/") { // single-line comment
+      i += 2;
+      while (i < input.length && input[i] !== "\n") {i++;}
+      if (i < input.length) {output += "\n";}
+    } else if (char === "/" && input[i+1] === "*") { // multi-line comment
+      i += 2;
+      while (i < input.length && !(input[i] === "*" && input[i+1] === "/")) {
+        if (input[i] === "\n") {output += "\n";}
+        i++;
+      }
+      i++;
+    } else {
+      output += char;
+    }
+  }
+
+  return output;
+}
+
+/**
+ * Strips extraneous trailing commas from JSON.
+ */
+function stripTrailingCommas(input: string): string {
+  let output = "";
+  let inString = false; // trailing comma cannot exist in string
+  let escaped = false;
+
+  for (let i = 0; i < input.length; i++) {
+    const char = input[i]!;
+    if (inString) {
+      output += char;
+      if (escaped) {escaped = false;}
+      else if (char === "\\") {escaped = true;}
+      else if (char === '"') {inString = false;}
+    } else if (char === '"') {
+      inString = true;
+      output += char;
+    } else if (char === ",") {
+      let lookahead = i+1;
+      while (lookahead < input.length && /\s/.test(input[lookahead]!)) {lookahead++;}
+      if (input[lookahead] === "}" || input[lookahead] === "]") {
+        continue;
+      }
+      output += char;
+    } else {
+      output += char;
+    }
+  }
+
+  return output;
+}
+
+/**
+ * Convert JSONC to standard JSON.
+ */
+export function parseJsonc(input: string): unknown {
+  const withoutComments = stripComments(input);
+  const withoutTrailingCommas = stripTrailingCommas(withoutComments);
+  return JSON.parse(withoutTrailingCommas);
+}

package/src/matcher.ts

@@ -0,0 +1,116 @@
+import type { PermissionState } from "./types.ts";
+
+const MAX_PATTERN_LENGTH = 500; // guard cache size
+const NEVER_MATCH = /$^/;
+
+export interface WildcardMatch {
+  pattern: string;
+  state: PermissionState;
+}
+
+/**
+ * Cache for the compileWildcard function.
+ */
+const cache = new Map<string, RegExp>();
+
+/**
+ * Clears the compiled wildcard cache.
+ */
+export function clearWildcardCache(): void {
+  cache.clear();
+}
+
+/**
+ * If the character is a special regex character, prepend '\'.
+ */
+function escapeRegexChar(char: string): string {
+  return /[\\^$.*+?()[\]{}|]/.test(char) ? `\\${char}` : char;
+}
+
+/**
+ * Converts wildcard to regex.
+ */
+function compileWildcard(pattern: string): RegExp {
+  const cached = cache.get(pattern);
+  if (cached) {return cached;}
+
+  if (pattern.length > MAX_PATTERN_LENGTH) {
+    cache.set(pattern, NEVER_MATCH);
+    return NEVER_MATCH;
+  }
+
+  let regexSource = "";
+  for (let i = 0; i < pattern.length; i++) {
+    const char = pattern[i];
+    if (char === "\\") { // escape
+      const next = pattern[i+1];
+      if (next === "*" || next === "?") {
+        regexSource += `\\${next}`;
+        i++;
+      } else {
+        regexSource += "\\\\";
+      }
+    } else if (char === "*") {
+      regexSource += ".*";
+    } else if (char === "?") {
+      regexSource += ".";
+    } else {
+      regexSource += escapeRegexChar(char);
+    }
+  }
+
+  const compiled = new RegExp(`^${regexSource}$`, "s");
+  cache.set(pattern, compiled);
+  return compiled;
+}
+
+/**
+ * True if the string matches wildcard.
+ */
+export function matchesWildcard(pattern: string, str: string): boolean {
+  return compileWildcard(pattern).test(str);
+}
+
+/**
+ * Finds the last wildcard match in a list of rules.
+ */
+export function findLastWildcardMatch(
+  rules: Record<string, PermissionState>,
+  str: string
+): WildcardMatch | undefined {
+  const entries = Object.entries(rules);
+  for (let i = entries.length - 1; i >= 0; i--) {
+    const [pattern, state] = entries[i]!;
+    if (matchesWildcard(pattern, str)) {
+      return { pattern, state };
+    }
+  }
+  return undefined;
+}
+
+/**
+ * True if the pattern is equivalent to "*".
+ */
+export function isMatchEverythingPattern(pattern: string): boolean {
+  if (!pattern) {return false;}
+  let sawStar = false;
+  for (let i = 0; i < pattern.length; i++) {
+    const char = pattern[i];
+    if (char === "\\") {
+      const next = pattern[i+1];
+      if (next === "*" || next === "?") {
+        return false;
+      }
+      i++;
+    } else if (char === "*") {
+      sawStar = true;
+    } else if (char !== "?") {
+      return false;
+    }
+  }
+  return sawStar;
+}
+
+export function isValidWildcardPattern(pattern: string): boolean {
+  return pattern.length > 0 && pattern.length <= MAX_PATTERN_LENGTH;
+}

package/src/paths.ts

@@ -0,0 +1,89 @@
+import { realpath } from "node:fs/promises";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { homedir } from "node:os";
+
+const PATH_TOOLS = new Set(["read", "write", "edit", "grep", "find", "ls"]);
+
+export interface ResolvedToolPath {
+  absolute: string;
+  permissionPath: string;
+  outsideCwd: boolean;
+}
+
+/**
+ * True if the string is one of the builtin path tools:
+ * "read", "write", "edit", "grep", "find", or "ls".
+ */
+export function isPathTool(toolName: string): boolean {
+  return PATH_TOOLS.has(toolName);
+}
+
+/**
+ * Expands "~" to the home directory.
+ */
+export function expandHome(filePath: string): string {
+  if (filePath === "~") {return homedir();}
+  if (filePath.startsWith("~/") || filePath.startsWith("~\\")) {
+    return join(homedir(), filePath.slice(2));
+  }
+  return filePath;
+}
+
+/**
+ * Normalizes the path to use '/' as a separator.
+ */
+export function toPermissionPath(filePath: string): string {
+  return filePath.split(sep).join("/");
+}
+
+/**
+ * True if target is outside cwd.
+ */
+export function isPathOutside(cwd: string, target: string): boolean {
+  const relativePath = relative(cwd, target);
+  return (
+    relativePath === ".." ||
+    relativePath.startsWith(`..${sep}`) ||
+    isAbsolute(relativePath)
+  );
+}
+
+/**
+ * Gets the actual path of a path with a symlink.
+ */
+async function resolvePathWithSymlink(absolutePath: string): Promise<string> {
+  let current = absolutePath;
+  const missingSegments: string[] = [];
+
+  while (true) {
+    try {
+      const resolved = await realpath(current);
+      return missingSegments.length > 0 ? join(resolved, ...missingSegments.reverse()) : resolved;
+    } catch {
+      const parent = dirname(current);
+      if (parent === current) {
+        return absolutePath;
+      }
+      missingSegments.push(current.slice(parent.length).replace(/^[\\/]+/, ""));
+      current = parent;
+    }
+  }
+}
+
+/**
+ * Returns a ResolvedToolPath from cwd and raw requested path.
+ */
+export async function resolveToolPath(
+  cwd: string,
+  rawPath: string
+): Promise<ResolvedToolPath> {
+  const absolute = resolve(cwd, expandHome(rawPath));
+  const resolvedAbsolute = await resolvePathWithSymlink(absolute);
+  const resolvedCwd = await resolvePathWithSymlink(cwd);
+
+  return {
+    absolute: resolvedAbsolute,
+    permissionPath: toPermissionPath(resolvedAbsolute),
+    outsideCwd: isPathOutside(resolvedCwd, resolvedAbsolute),
+  };
+}

package/src/permission-dialog.ts

@@ -0,0 +1,93 @@
+import type { ExtensionContext, Theme } from "@earendil-works/pi-coding-agent";
+import { ExtensionSelectorComponent } from "@earendil-works/pi-coding-agent";
+import { Container, Text } from "@earendil-works/pi-tui";
+import {
+  ALLOW_ALWAYS_EXACT,
+  ALLOW_ALWAYS_WILDCARD,
+  ALLOW_ONCE,
+  REJECT,
+} from "./constants.ts";
+import type {
+  PermissionDialogSelection,
+  PermissionRequest,
+  PolicyResolution,
+} from "./types.ts";
+import {
+  formatAllowAlwaysOption,
+  PERMISSION_DIALOG_QUESTION,
+  PERMISSION_DIALOG_TITLE,
+  PURPOSE_PREFIX,
+} from "./ui-strings.ts";
+
+function mapChoice(choice: string | undefined | null): PermissionDialogSelection {
+  if (choice === ALLOW_ONCE) {return { kind: "once" };}
+  if (choice === ALLOW_ALWAYS_EXACT || choice === ALLOW_ALWAYS_WILDCARD) {
+    return { kind: "always" };
+  }
+  return { kind: "reject" };
+}
+
+/** Bold + color the `Label:` prefix; warning color for note lines. */
+function styleSummaryLine(theme: Theme, line: string): string {
+  const sep = line.indexOf(": ");
+  if (sep === -1) {return theme.fg("text", line);}
+  return theme.fg("accent", theme.bold(line.slice(0, sep + 1)))
+    + theme.fg("text", line.slice(sep + 1));
+}
+
+/**
+ * Shows permission dialog and gets input.
+ */
+export async function promptForPermission(
+  ctx: ExtensionContext,
+  request: PermissionRequest,
+  policy: PolicyResolution,
+  summary: string,
+  purpose?: string
+): Promise<PermissionDialogSelection> {
+  const options = [ALLOW_ONCE, formatAllowAlwaysOption(request, policy), REJECT];
+
+  try {
+    // non-tui mode fallback
+    if (ctx.mode !== "tui") {
+      const purposeLine = purpose ? `\n${PURPOSE_PREFIX}${purpose}` : "";
+      const title = `${PERMISSION_DIALOG_TITLE}\n${summary}${purposeLine}\n${PERMISSION_DIALOG_QUESTION}`;
+      return mapChoice(await ctx.ui.select(title, options));
+    }
+
+    // build custom tui
+    const choice = await ctx.ui.custom<string | null>((tui, theme, _kb, done) => {
+      const container = new Container();
+      container.addChild(new Text(theme.fg("accent", theme.bold(PERMISSION_DIALOG_TITLE)), 1, 0));
+      for (const line of summary.split("\n")) {
+        container.addChild(new Text(styleSummaryLine(theme, line), 1, 0));
+      }
+      if (purpose) {
+        container.addChild(new Text(styleSummaryLine(theme, `${PURPOSE_PREFIX}${purpose}`), 1, 0));
+      }
+
+      const selector = new ExtensionSelectorComponent(
+        PERMISSION_DIALOG_QUESTION,
+        options,
+        (option) => done(option),
+        () => done(null),
+        { tui }
+      );
+      container.addChild(selector);
+
+      return {
+        render: (width: number) => container.render(width),
+        invalidate: () => container.invalidate(),
+        handleInput: (data: string) => {
+          selector.handleInput(data);
+          tui.requestRender();
+        },
+        dispose: () => selector.dispose(),
+      };
+    });
+
+    return mapChoice(choice);
+  } catch {
+    return { kind: "reject" };
+  }
+}

package/src/policy-bash.ts

@@ -0,0 +1,157 @@
+import { findLastWildcardMatch, matchesWildcard } from "./matcher.ts";
+import { analyzeShellCommand, type ShellCommandAnalysis } from "./shell.ts";
+import type {
+  AllowAlwaysMode,
+  AllowAlwaysRule,
+  PermissionConfig,
+  PermissionRequest,
+  PermissionState,
+  PolicyResolution,
+} from "./types.ts";
+
+const STATE_RANK: Record<PermissionState, number> = {
+  allow: 0,
+  ask: 1,
+  deny: 2,
+};
+
+/**
+ * Prefers the analysis stored on the request.
+ * Falls back for hand-built fixtures.
+ */
+function bashAnalysisOf(request: PermissionRequest): ShellCommandAnalysis {
+  return request.bashAnalysis ?? analyzeShellCommand(request.body);
+}
+
+/**
+ * The general permission state for bash.
+ */
+function generalBashToolState(
+  config: PermissionConfig
+): PermissionState | undefined {
+  return Object.hasOwn(config.tools, "bash") ? config.tools.bash : undefined;
+}
+
+function bashFallbackResolution(config: PermissionConfig): PolicyResolution {
+  const toolState = generalBashToolState(config);
+  return {
+    state: toolState ?? config.default,
+    source: toolState ? "tool" : "default",
+  };
+}
+
+/**
+ * Resolves one simple bash segment against bash rules, then tools.bash / default.
+ */
+function resolveBashSegment(
+  config: PermissionConfig,
+  segment: string
+): PolicyResolution {
+  const match = findLastWildcardMatch(config.bash, segment);
+  if (match) {
+    return {
+      state: match.state,
+      source: "bash",
+      matchedPattern: match.pattern,
+    };
+  }
+  return bashFallbackResolution(config);
+}
+
+/**
+ * Worst state wins across simple list segments.
+ * When ranks tie, keep the later segment's resolution.
+ */
+function combineBashSegmentResolutions(
+  resolutions: PolicyResolution[]
+): PolicyResolution {
+  let worst = resolutions[0]!;
+  for (let index = 1; index < resolutions.length; index++) {
+    const next = resolutions[index]!;
+    if (STATE_RANK[next.state] >= STATE_RANK[worst.state]) {
+      worst = next;
+    }
+  }
+  return worst;
+}
+
+/**
+ * Resolves bash policy, including simple list splitting.
+ */
+export function resolveBashPolicy(
+  config: PermissionConfig,
+  request: PermissionRequest
+): PolicyResolution {
+  const analysis = bashAnalysisOf(request);
+  if (analysis.isComplex) {
+    return bashFallbackResolution(config);
+  }
+  const resolutions = analysis.segments.map((segment) =>
+    resolveBashSegment(config, segment)
+  );
+  return combineBashSegmentResolutions(resolutions);
+}
+
+/**
+ * Newest matching bash rule for one command segment.
+ */
+function findBashSegmentSessionApproval(
+  rules: readonly AllowAlwaysRule[],
+  segment: string
+): AllowAlwaysRule | undefined {
+  for (let index = rules.length - 1; index >= 0; index--) {
+    const rule = rules[index]!;
+    if (rule.tool !== "bash") {continue;}
+    if (rule.kind === "exact") {
+      if (rule.body === segment) {return rule;}
+      continue;
+    }
+    if (matchesWildcard(rule.body, segment)) {return rule;}
+  }
+  return undefined;
+}
+
+/**
+ * Session approval for bash, including per-segment matching for simple lists.
+ */
+export function findBashSessionApproval(
+  rules: readonly AllowAlwaysRule[],
+  request: PermissionRequest
+): AllowAlwaysRule | undefined {
+  // check full exact match first
+  for (let index = rules.length - 1; index >= 0; index--) {
+    const rule = rules[index]!;
+    if (rule.tool === "bash" && rule.kind === "exact" && rule.body === request.body) {
+      return rule;
+    }
+  }
+
+  const analysis = bashAnalysisOf(request);
+  if (analysis.isComplex) {return undefined;} // complex only has full exact match
+
+  // check segments with wildcard / exact
+  let lastMatch: AllowAlwaysRule | undefined;
+  for (const segment of analysis.segments) {
+    const match = findBashSegmentSessionApproval(rules, segment);
+    if (!match) {return undefined;}
+    lastMatch = match;
+  }
+  return lastMatch;
+}
+
+/**
+ * How "allow always" should persist this request for the session.
+ */
+export function resolveAllowAlwaysMode(
+  request: PermissionRequest,
+  policy: PolicyResolution
+): AllowAlwaysMode {
+  if (request.isExternalDirectory && policy.source === "external") {return "exact";}
+  if (request.toolName !== "bash") {return "exact";}
+
+  const analysis = bashAnalysisOf(request);
+  if (analysis.isComplex) {return "exact";}
+  if (analysis.segments.length > 1) {return "wildcard-list";}
+  if (analysis.segments.length === 1) {return "wildcard";}
+  return "exact";
+}