@davisliu2006/pi-permission-system 0.1.0 → 0.2.0

package/src/policy.ts

@@ -1,4 +1,7 @@
-import { findLastWildcardMatch, matchesWildcard } from "./matcher.ts";
+import {
+  findBashSessionApproval,
+  resolveBashPolicy,
+} from "./policy-bash.ts";
 import type {
   PermissionConfig,
   PermissionRequest,
@@ -7,6 +10,8 @@ import type {
   AllowAlwaysRule,
 } from "./types.ts";
 
+export { resolveAllowAlwaysMode } from "./policy-bash.ts";
+
 /**
  * Returns the permission for that tool if specified in the config.
  */
@@ -17,13 +22,6 @@ function configuredToolState(
   return Object.hasOwn(config.tools, toolName) ? config.tools[toolName] : undefined;
 }
 
-/**
- * Returns the permission for that tool or the default if not specified.
- */
-function fallbackState(config: PermissionConfig, toolName: string): PermissionState {
-  return configuredToolState(config, toolName) ?? config.default;
-}
-
 /**
  * Returns the policy for the request using the correct precedence rules.
  */
@@ -40,36 +38,12 @@ export function resolvePolicy(
         state: externalState,
         source: "external",
         matchedPattern: request.toolName,
-        isChainedBash: false,
       };
     }
   }
 
-  if (request.toolName === "bash") { // bash
-    const chained = request.isChainedBash === true;
-    if (chained) { // chained bash - can't match wildcard
-      return {
-        state: fallbackState(config, "bash"),
-        source: configuredToolState(config, "bash") ? "tool" : "default",
-        isChainedBash: true,
-      };
-    }
-
-    const match = findLastWildcardMatch(config.bash, request.body);
-    if (match) { // matched with wildcard
-      return {
-        state: match.state,
-        source: "bash",
-        matchedPattern: match.pattern,
-        isChainedBash: false,
-      };
-    }
-
-    return { // fallback to default
-      state: fallbackState(config, "bash"),
-      source: configuredToolState(config, "bash") ? "tool" : "default",
-      isChainedBash: false,
-    };
+  if (request.toolName === "bash") {
+    return resolveBashPolicy(config, request);
   }
 
   // other tool
@@ -77,7 +51,6 @@ export function resolvePolicy(
   return {
     state: toolState ?? config.default,
     source: toolState ? "tool" : "default",
-    isChainedBash: false,
   };
 }
 
@@ -86,32 +59,19 @@ export function resolvePolicy(
  */
 export function findSessionApproval(
   rules: readonly AllowAlwaysRule[],
-  request: PermissionRequest,
-  isChainedBash: boolean
+  request: PermissionRequest
 ): AllowAlwaysRule | undefined {
-  const isExternal = request.isExternalDirectory === true;
+  if (request.toolName === "bash") {
+    return findBashSessionApproval(rules, request);
+  }
 
-  for (let index = rules.length - 1; index >= 0; index -= 1) {
+  for (let index = rules.length - 1; index >= 0; index--) {
     const rule = rules[index]!;
-
-    if (rule.scope === "external_directory") {
-      if (!isExternal) {continue;}
-      if (rule.tool !== request.toolName) {continue;}
-      if (rule.body === request.body) {return rule;}
-      continue;
-    }
-
-    if (isExternal) {continue;}
-    if (rule.tool !== request.toolName) {continue;}
-
-    if (rule.kind === "exact") {
-      if (rule.body === request.body) {return rule;}
-      continue;
-    }
-
-    if (rule.tool !== "bash" || request.bodyKind !== "command") {continue;}
-    if (isChainedBash) {continue;}
-    if (matchesWildcard(rule.body, request.body)) {return rule;}
+    if (
+      rule.kind === "exact"
+      && rule.tool === request.toolName
+      && rule.body === request.body
+    ) {return rule;}
   }
 
   return undefined;
@@ -129,17 +89,3 @@ export function describePolicy(policy: PolicyResolution): string {
   }
   return `${policy.state} (default)`;
 }
-
-/**
- * True when "Allow Always" will generate a bash wildcard instead of an exact rule.
- * Mirrors the branching in chooseAlwaysRule.
- */
-export function willGenerateBashWildcard(
-  request: PermissionRequest,
-  policy: PolicyResolution
-): boolean {
-  if (request.isExternalDirectory && policy.source === "external") {return false;}
-  if (request.toolName !== "bash") {return false;}
-  if (policy.isChainedBash) {return false;}
-  return true;
-}

package/src/prompts.ts

@@ -20,7 +20,7 @@ export function describeBlockedSubject(
     return `bash command ${JSON.stringify(request.body)}`;
   }
   if (request.bodyKind === "path") {
-    return `access to ${JSON.stringify(request.body)}`;
+    return `${request.toolName} access to ${JSON.stringify(request.body)}`;
   }
   return includeGenericSubject
     ? `tool ${JSON.stringify(request.toolName)} with input ${request.body}`
@@ -30,20 +30,13 @@ export function describeBlockedSubject(
 /**
  * Builds context for the ai-generated purpose.
  */
-export function buildPurposePromptContext(
-  request: PermissionRequest,
-  policy: PolicyResolution
-): string {
+export function buildPurposePromptContext(request: PermissionRequest): string {
   const lines = [
     `Tool: ${request.toolName}`,
-    `Policy: ${describePolicy(policy)}`,
   ];
 
   if (request.bodyKind === "command") {
     lines.push(`Command:\n${preview(request.body, 600)}`);
-    if (policy.isChainedBash) {
-      lines.push(CHAINED_BASH_NOTE);
-    }
   } else if (request.bodyKind === "path") {
     lines.push(`Path: ${preview(request.body, 400)}`);
     if (request.isExternalDirectory) {
@@ -63,6 +56,14 @@ export const PURPOSE_SYSTEM_PROMPT = [
 
 export function buildPurposeInstructions(context: string): string {
   return [
+    "Examples:",
+    "Tool: bash",
+    `Command: git commit -m "Add feature" && git log`,
+    "Commits the changes to the repository and lists the commit history.",
+    "Tool: bash",
+    `Command: grep -rnEI --color=never --exclude-dir={node_modules} --include=\\*.py -B 2 -A 3 "^[[:space:]]*[^/]*\\b(func_1|func_2)\\s*(" .`,
+    "Searches the project for instances of func_1 or func_2.",
+    "",
     "Explain why the following request is being made in a single sentence.",
     "Do not use markdown or quotes.",
     "",
@@ -75,31 +76,56 @@ export const WILDCARD_SYSTEM_PROMPT = [
   "Return only the pattern itself with no explanation or markdown.",
 ].join(" ");
 
+export const WILDCARD_LIST_SYSTEM_PROMPT = [
+  "You generate shell command permission patterns for the user to approve.",
+  "Return only semicolon-separated patterns with no explanation or markdown.",
+].join(" ");
+
+const WILDCARD_RULES = [
+  "Rules for each pattern:",
+  "- Use wildcard syntax, not regular expressions.",
+  "- * matches any sequence of characters.",
+  "- ? matches exactly one character.",
+  "- \\* and \\? match literal characters.",
+  "- All other characters are literal.",
+];
+
 export function buildWildcardInstructions(command: string): string {
   return [
     "Create a permission wildcard for this command.",
     "Select one that is general enough to be useful but narrow enough to not pose security risks.",
     "",
-    "Rules for the pattern:",
-    "- Use wildcard syntax, not regular expressions.",
-    "- * matches any sequence of characters.",
-    "- ? matches exactly one character.",
-    "- \\* and \\? match literal characters.",
-    "- All other characters are literal.",
+    ...WILDCARD_RULES,
     "The pattern must match the given command.",
     "",
     `Command: ${JSON.stringify(command)}`,
   ].join("\n");
 }
 
+/**
+ * Builds instructions for generating one wildcard per command in a simple list.
+ */
+export function buildWildcardListInstructions(commands: readonly string[]): string {
+  return [
+    "Create a permission wildcard for each command below.",
+    "Select patterns that are general enough to be useful but narrow enough to not pose security risks.",
+    "Return exactly one pattern per command, separated by semicolons, in the same order.",
+    "",
+    ...WILDCARD_RULES,
+    "Each pattern must match its corresponding command.",
+    "",
+    `Commands: ${commands.join("; ")}`,
+  ].join("\n");
+}
+
 /**
  * Prompt given to the agent on deny.
  */
 export function formatDenyReason(request: PermissionRequest, policy: PolicyResolution): string {
   const subject = describeBlockedSubject(request, true);
-  const chainedNote = policy.isChainedBash ? ` ${CHAINED_BASH_NOTE}` : "";
+  const chainedNote = request.bashAnalysis?.isComplex ? ` ${CHAINED_BASH_NOTE}` : "";
 
-  return `Permission denied for ${subject}. Policy: ${describePolicy(policy)}.${chainedNote} Hard stop: do not retry or investigate a bypass; report the denial to the user.`;
+  return `Permission denied for ${subject}. Policy: ${describePolicy(policy)}.${chainedNote} Hard stop: do not retry or investigate a bypass. Report the denial to the user.`;
 }
 
 /**
@@ -114,5 +140,5 @@ export function formatNoUiReason(request: PermissionRequest, policy: PolicyResol
  */
 export function formatRejectReason(request: PermissionRequest): string {
   const subject = describeBlockedSubject(request, false);
-  return `User rejected ${subject}. Do not retry the rejected request. Ask the user what to do next.`;
+  return `User rejected ${subject}. Pause the task immediately (do not do further analysis or run more tool requests) and concisely ask the user what to do next.`;
 }

package/src/request-builder.ts

@@ -1,5 +1,5 @@
 import { isPathTool, resolveToolPath } from "./paths.ts";
-import { hasShellChaining } from "./shell.ts";
+import { analyzeShellCommand } from "./shell.ts";
 import type { PiToolInput } from "./types-pi.ts";
 import { toRecord, type PermissionRequest } from "./types.ts";
 
@@ -45,7 +45,7 @@ export async function buildRequest(
       body: command,
       bodyKind: "command",
       cwd,
-      isChainedBash: hasShellChaining(command),
+      bashAnalysis: analyzeShellCommand(command),
     };
   }
 

package/src/session-approvals.ts

@@ -1,9 +1,18 @@
 import type { AllowAlwaysRule } from "./types.ts";
 
+function ruleEq(a: AllowAlwaysRule, b: AllowAlwaysRule): boolean {
+  return a.kind === b.kind && a.tool === b.tool && a.body === b.body;
+}
+
 export class SessionApprovalStore {
+  /**
+   * Stored as an array rather than a set because JS
+   * objects don't compare by value.
+   */
   private readonly rules: AllowAlwaysRule[] = [];
 
   add(rule: AllowAlwaysRule): void {
+    if (this.rules.some((existing) => ruleEq(existing, rule))) {return;}
     this.rules.push(rule);
   }
 

package/src/shell.ts

@@ -1,15 +1,39 @@
 /**
- * Conservative shell-chaining detector.
- * This is not a parser and is biased toward returning true.
- * 
- * Guards against:
+ * Result of a conservative shell scan.
+ *
+ * When `isComplex` is false, `segments` are commands separated only by `;`,
+ * `&&`, `||`, or newlines (or a single command). When true, `segments` is empty.
+ */
+export type ShellCommandAnalysis = {
+  isComplex: boolean;
+  segments: string[];
+};
+
+const COMPLEX: ShellCommandAnalysis = { isComplex: true, segments: [] };
+
+/**
+ * Conservative shell command scanner.
+ * This is not a full parser and is biased toward `isComplex: true`.
+ *
+ * Splits on:
+ * - `;`, `&&`, `||`, and newlines outside quotes
+ *
+ * Treats as complex:
  * - Substitutions like `command` and $(command)
- * - Chaining like ;, &&, ||, \n, and \r
+ * - Pipes `|` and background `&`
  * - Parentheses
  */
-export function hasShellChaining(command: string): boolean {
+export function analyzeShellCommand(command: string): ShellCommandAnalysis {
   let quote: "'" | '"' | undefined;
   let index = 0;
+  let current = "";
+  const segments: string[] = [];
+
+  const pushCurrent = (): void => {
+    const trimmed = current.trim();
+    if (trimmed) {segments.push(trimmed);}
+    current = "";
+  };
 
   while (index < command.length) {
     const character = command[index]!;
@@ -17,52 +41,89 @@ export function hasShellChaining(command: string): boolean {
     // inside quote
     if (quote === "'") {
       if (character === "'") {quote = undefined;}
+      current += character;
       index++;
       continue;
     }
     if (quote === '"') {
       if (character === "\\") {
+        current += character + (command[index + 1] ?? "");
         index += 2;
         continue;
       }
       if (character === '"') {
         quote = undefined;
+        current += character;
         index++;
         continue;
       }
-      if (character === "`") {return true;}
-      if (character === "$" && command[index + 1] === "(") {return true;}
+      if (character === "`") {return COMPLEX;}
+      if (character === "$" && command[index + 1] === "(") {return COMPLEX;}
+      current += character;
       index++;
       continue;
     }
 
     // escape character
     if (character === "\\") {
+      current += character + (command[index + 1] ?? "");
       index += 2;
       continue;
     }
-  
-    // strat quote
+
+    // start quote
     if (character === "'") {
       quote = "'";
+      current += character;
       index++;
       continue;
     }
     if (character === '"') {
       quote = '"';
+      current += character;
       index++;
       continue;
     }
 
-    if (character === "`") {return true;}
-    if (character === "$" && command[index + 1] === "(") {return true;}
-    if (character === ";" || character === "|" || character === "&") {return true;}
-    if (character === "\n" || character === "\r") {return true;}
-    if (character === "(" || character === ")") {return true;}
+    if (character === "`") {return COMPLEX;}
+    if (character === "$" && command[index + 1] === "(") {return COMPLEX;}
+    if (character === "(" || character === ")") {return COMPLEX;}
 
+    // simple separators
+    if (character === ";") {
+      pushCurrent();
+      index++;
+      continue;
+    }
+    if (character === "&") {
+      if (command[index+1] !== "&") {return COMPLEX;}
+      pushCurrent();
+      index += 2;
+      continue;
+    }
+    if (character === "|") {
+      if (command[index+1] !== "|") {return COMPLEX;}
+      pushCurrent();
+      index += 2;
+      continue;
+    }
+    if (character === "\n" || character === "\r") {
+      pushCurrent();
+      if (character === "\r" && command[index + 1] === "\n") {index += 2;}
+      else {index++;}
+      continue;
+    }
+
+    current += character;
     index++;
   }
 
   // Unterminated quotes are unsafe to reason about.
-  return quote !== undefined;
+  if (quote !== undefined) {return COMPLEX;}
+
+  pushCurrent();
+  return {
+    isComplex: false,
+    segments: segments.length > 0 ? segments : [""],
+  };
 }

package/src/types-pi.ts

@@ -23,12 +23,3 @@ export type PiToolInput =
   | PathToolInput
   | BashToolInput
   | Record<string, unknown>;
-
-export function validatePathToolInput(input: PiToolInput): PathToolInput | undefined {
-  if (!("path" in input) || typeof(input.path) !== "string") {return undefined;}
-  return input as PathToolInput;
-}
-export function validateBashToolInput(input: PiToolInput): BashToolInput | undefined {
-  if (!("command" in input) || typeof(input.command) !== "string") {return undefined;}
-  return input as BashToolInput;
-}

package/src/types.ts

@@ -1,4 +1,5 @@
 import { ASK, PERMISSION_STATES } from "./constants.ts";
+import type { ShellCommandAnalysis } from "./shell.ts";
 import type { PiToolInput } from "./types-pi.ts";
 
 // utility functions
@@ -31,11 +32,9 @@ export function createDefaultPermissionConfig(): PermissionConfig {
   return { default: ASK, tools: {}, bash: {}, external_directory: {} };
 }
 
-export const DEFAULT_PERMISSION_CONFIG = createDefaultPermissionConfig();
-
 // permission request
 
-export type RequestBodyKind = "command" | "path" | "generic";
+export type RequestBodyKind = "path" | "command" | "generic";
 
 /**
  * Request for a tool.
@@ -44,6 +43,8 @@ export type RequestBodyKind = "command" | "path" | "generic";
  * @property body - The body for the permission request.
  * @property bodyKind - The meaning of the body.
  * @property cwd - The current working directory.
+ * @property isExternalDirectory - Whether the request uses path to an external directory.
+ * @property bashAnalysis - Shell scan for bash requests.
  */
 export interface PermissionRequest {
   toolName: string;
@@ -52,12 +53,12 @@ export interface PermissionRequest {
   bodyKind: RequestBodyKind;
   cwd: string;
   isExternalDirectory?: boolean;
-  isChainedBash?: boolean;
+  bashAnalysis?: ShellCommandAnalysis;
 }
 
 // resolved policy
 
-export type PolicySource = "bash" | "tool" | "default" | "external";
+export type PolicySource = "default" | "tool" | "bash" | "external";
 
 /**
  * A resolved policy.
@@ -66,18 +67,17 @@ export interface PolicyResolution {
   state: PermissionState;
   source: PolicySource;
   matchedPattern?: string;
-  isChainedBash: boolean;
 }
 
+export type AllowAlwaysMode = "wildcard" | "wildcard-list" | "exact";
+
 // other types
 
 export type AllowAlwaysRule = {
-  scope: "tool" | "external_directory";
   kind: "exact";
   tool: string;
   body: string;
 } | {
-  scope: "tool";
   kind: "wildcard";
   tool: "bash";
   body: string;

package/src/ui-strings.ts

@@ -2,7 +2,7 @@ import {
   ALLOW_ALWAYS_EXACT,
   ALLOW_ALWAYS_WILDCARD,
 } from "./constants.ts";
-import { willGenerateBashWildcard } from "./policy.ts";
+import { resolveAllowAlwaysMode } from "./policy-bash.ts";
 import type { PermissionRequest, PolicyResolution } from "./types.ts";
 
 export const STATUS_SUMMARIZING_REQUEST = "Summarizing permission request...";
@@ -13,8 +13,8 @@ export const PERMISSION_DIALOG_QUESTION = "What should the agent be allowed to d
 export const PURPOSE_PREFIX = "Purpose: ";
 
 export const WILDCARD_EDITOR_TITLE = "Review bash wildcard";
+export const WILDCARD_LIST_EDITOR_TITLE = "Review bash wildcards (semicolon-separated)";
 export const BROAD_WILDCARD_TITLE = "Very broad wildcard";
-export const INVALID_WILDCARD_PREFIX = "Invalid wildcard: ";
 
 const CHAINED_BASH_NOTE = "Shell chaining detected.";
 const EXTERNAL_DIRECTORY_NOTE = "Outside the current working directory.";
@@ -33,8 +33,8 @@ export function buildSelectorSummary(request: PermissionRequest): string {
   ];
 
   if (request.bodyKind === "command") {
-    lines.push(`Command: \`${preview(request.body, 600)}\``);
-    if (request.isChainedBash) {
+    lines.push(`Command: ${preview(request.body, 600)}`);
+    if (request.bashAnalysis?.isComplex) {
       lines.push(CHAINED_BASH_NOTE);
     }
   } else if (request.bodyKind === "path") {
@@ -50,17 +50,21 @@ export function buildSelectorSummary(request: PermissionRequest): string {
 }
 
 /**
- * Label for the "Allow Always" select option.
+ * Label for the "allow always" select option.
  */
 export function formatAllowAlwaysOption(
   request: PermissionRequest,
   policy: PolicyResolution
 ): string {
-  return willGenerateBashWildcard(request, policy)
-    ? ALLOW_ALWAYS_WILDCARD
-    : ALLOW_ALWAYS_EXACT;
+  return resolveAllowAlwaysMode(request, policy) === "exact"
+    ? ALLOW_ALWAYS_EXACT
+    : ALLOW_ALWAYS_WILDCARD;
 }
 
 export function formatBroadWildcardConfirm(pattern: string): string {
   return `This pattern can match many commands:\n\n${pattern}\n\nSave it for this session?`;
 }
+
+export function formatBroadWildcardListConfirm(patterns: readonly string[]): string {
+  return `These patterns can match many commands:\n\n${patterns.join("\n")}\n\nSave them for this session?`;
+}

package/src/warning-strings.ts

@@ -0,0 +1,54 @@
+import { EXTENSION_NAME, PERMISSION_STATES_DESCRIPTION } from "./constants.ts";
+
+export const CONFIG_WARNING_PREFIX = `${EXTENSION_NAME}: `;
+export const INVALID_WILDCARD_PREFIX = "Invalid wildcard: ";
+
+export const CONFIG_MUST_BE_OBJECT =
+  "Permission config must be a JSON object; using defaults.";
+export const IGNORED_DEFAULT_WARNING =
+  `Ignoring "default": expected ${PERMISSION_STATES_DESCRIPTION}.`;
+
+export const WILDCARD_LENGTH_REASON =
+  "Pattern must be between 1 and 500 characters.";
+export const WILDCARD_NO_MATCH_REASON =
+  "Pattern does not match the current command.";
+
+export function formatIgnoredSectionWarning(sectionName: string): string {
+  return `Ignoring "${sectionName}": expected an object mapping names to ${PERMISSION_STATES_DESCRIPTION}.`;
+}
+
+export function formatIgnoredSectionEntryWarning(
+  sectionName: string,
+  key: string
+): string {
+  return `Ignoring "${sectionName}.${key}": expected ${PERMISSION_STATES_DESCRIPTION}.`;
+}
+
+export function formatConfigReadFailure(error: unknown): string {
+  const detail = error instanceof Error ? error.message : String(error);
+  return `Failed to read permission config: ${detail}`;
+}
+
+export function formatConfigParseFailure(error: unknown): string {
+  const detail = error instanceof Error ? error.message : String(error);
+  return `Failed to parse permission config: ${detail}`;
+}
+
+export function formatSuppressedConfigWarnings(suppressed: number): string {
+  return `${suppressed} additional config warning(s) suppressed.`;
+}
+
+export function formatWildcardListCountReason(
+  expected: number,
+  actual: number
+): string {
+  return `Expected ${expected} semicolon-separated pattern(s), got ${actual}.`;
+}
+
+export function formatWildcardListItemReason(
+  index: number,
+  pattern: string,
+  reason: string
+): string {
+  return `Pattern ${index} (${JSON.stringify(pattern)}): ${reason}`;
+}