@davisliu2006/pi-permission-system 0.1.0 → 0.3.0

package/src/permission-dialog.ts

@@ -1,4 +1,6 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { ExtensionSelectorComponent } from "@earendil-works/pi-coding-agent";
+import { Container, Text } from "@earendil-works/pi-tui";
 import {
   ALLOW_ALWAYS_EXACT,
   ALLOW_ALWAYS_WILDCARD,
@@ -11,12 +13,21 @@ import type {
   PolicyResolution,
 } from "./types.ts";
 import {
+  buildPlainSelectorSummary,
+  buildStyledSelectorSummary,
   formatAllowAlwaysOption,
   PERMISSION_DIALOG_QUESTION,
   PERMISSION_DIALOG_TITLE,
-  PURPOSE_PREFIX,
 } from "./ui-strings.ts";
 
+function mapChoice(choice: string | undefined | null): PermissionDialogSelection {
+  if (choice === ALLOW_ONCE) {return { kind: "once" };}
+  if (choice === ALLOW_ALWAYS_EXACT || choice === ALLOW_ALWAYS_WILDCARD) {
+    return { kind: "always" };
+  }
+  return { kind: "reject" };
+}
+
 /**
  * Shows permission dialog and gets input.
  */
@@ -24,26 +35,48 @@ export async function promptForPermission(
   ctx: ExtensionContext,
   request: PermissionRequest,
   policy: PolicyResolution,
-  summary: string,
   purpose?: string
 ): Promise<PermissionDialogSelection> {
-  // if there's no ui, just reject
-  if (!ctx.hasUI) {return { kind: "reject" };}
-
-  const purposeLine = purpose ? `\n${PURPOSE_PREFIX}${purpose}` : "";
-  const title = `${PERMISSION_DIALOG_TITLE}\n${summary}${purposeLine}\n${PERMISSION_DIALOG_QUESTION}`;
   const options = [ALLOW_ONCE, formatAllowAlwaysOption(request, policy), REJECT];
 
-  let choice: string | undefined;
   try {
-    choice = await ctx.ui.select(title, options);
+    // non-tui mode fallback
+    if (ctx.mode !== "tui") {
+      const summary = buildPlainSelectorSummary(request, purpose);
+      const title = `${PERMISSION_DIALOG_TITLE}\n${summary}\n${PERMISSION_DIALOG_QUESTION}`;
+      return mapChoice(await ctx.ui.select(title, options));
+    }
+
+    // build custom tui
+    const choice = await ctx.ui.custom<string | null>((tui, theme, _kb, done) => {
+      const container = new Container();
+      container.addChild(new Text(theme.fg("accent", theme.bold(PERMISSION_DIALOG_TITLE)), 1, 0));
+      for (const line of buildStyledSelectorSummary(theme, request, purpose)) {
+        container.addChild(new Text(line, 1, 0));
+      }
+
+      const selector = new ExtensionSelectorComponent(
+        PERMISSION_DIALOG_QUESTION,
+        options,
+        (option) => done(option),
+        () => done(null),
+        { tui }
+      );
+      container.addChild(selector);
+
+      return {
+        render: (width: number) => container.render(width),
+        invalidate: () => container.invalidate(),
+        handleInput: (data: string) => {
+          selector.handleInput(data);
+          tui.requestRender();
+        },
+        dispose: () => selector.dispose(),
+      };
+    });
+
+    return mapChoice(choice);
   } catch {
     return { kind: "reject" };
   }
-
-  if (choice === ALLOW_ONCE) {return { kind: "once" };}
-  if (choice === ALLOW_ALWAYS_EXACT || choice === ALLOW_ALWAYS_WILDCARD) {
-    return { kind: "always" };
-  }
-  return { kind: "reject" };
 }

package/src/policy-bash.ts

@@ -0,0 +1,180 @@
+import { findLastWildcardMatch, matchesWildcard } from "./matcher.ts";
+import { analyzeShellCommand, type ShellCommandAnalysis } from "./shell.ts";
+import type {
+  AllowAlwaysMode,
+  AllowAlwaysRule,
+  PermissionConfig,
+  PermissionRequest,
+  PermissionState,
+  PolicyResolution,
+} from "./types.ts";
+
+const STATE_RANK: Record<PermissionState, number> = {
+  allow: 0,
+  ask: 1,
+  deny: 2,
+};
+
+/**
+ * Prefers the analysis stored on the request.
+ * Falls back for hand-built fixtures.
+ */
+function bashAnalysisOf(request: PermissionRequest): ShellCommandAnalysis {
+  return request.bashAnalysis ?? analyzeShellCommand(request.body);
+}
+
+/**
+ * The general permission state for bash.
+ */
+function generalBashToolState(
+  config: PermissionConfig
+): PermissionState | undefined {
+  return Object.hasOwn(config.tools, "bash") ? config.tools.bash : undefined;
+}
+
+function bashFallbackResolution(config: PermissionConfig): PolicyResolution {
+  const toolState = generalBashToolState(config);
+  return {
+    state: toolState ?? config.default,
+    source: toolState ? "tool" : "default",
+  };
+}
+
+/**
+ * Resolves one simple bash segment against bash rules, then tools.bash / default.
+ */
+function resolveBashSegment(
+  config: PermissionConfig,
+  segment: string
+): PolicyResolution {
+  const match = findLastWildcardMatch(config.bash, segment);
+  if (match) {
+    return {
+      state: match.state,
+      source: "bash",
+      matchedPattern: match.pattern,
+    };
+  }
+  return bashFallbackResolution(config);
+}
+
+/**
+ * Worst state wins across simple list segments.
+ * When ranks tie, keep the later segment's resolution.
+ */
+function combineBashSegmentResolutions(
+  resolutions: PolicyResolution[]
+): PolicyResolution {
+  let worst = resolutions[0]!;
+  for (let index = 1; index < resolutions.length; index++) {
+    const next = resolutions[index]!;
+    if (STATE_RANK[next.state] >= STATE_RANK[worst.state]) {
+      worst = next;
+    }
+  }
+  return worst;
+}
+
+/**
+ * "Deny" rule can do raw wildcard matching on complex segments.
+ */
+function resolveComplexBashDeny(
+  config: PermissionConfig,
+  segments: readonly string[]
+): PolicyResolution | undefined {
+  let denied: PolicyResolution | undefined;
+  for (const segment of segments) {
+    const match = findLastWildcardMatch(config.bash, segment);
+    if (match?.state !== "deny") {continue;}
+    denied = {
+      state: "deny",
+      source: "bash",
+      matchedPattern: match.pattern,
+    };
+  }
+  return denied;
+}
+
+/**
+ * Resolves bash policy, including simple list splitting.
+ */
+export function resolveBashPolicy(
+  config: PermissionConfig,
+  request: PermissionRequest
+): PolicyResolution {
+  const analysis = bashAnalysisOf(request);
+  if (analysis.isComplex) {
+    return (
+      resolveComplexBashDeny(config, analysis.segments) ??
+      bashFallbackResolution(config)
+    );
+  }
+  const resolutions = analysis.segments.map((segment) =>
+    resolveBashSegment(config, segment)
+  );
+  return combineBashSegmentResolutions(resolutions);
+}
+
+/**
+ * Newest matching bash rule for one command segment.
+ */
+function findBashSegmentSessionApproval(
+  rules: readonly AllowAlwaysRule[],
+  segment: string
+): AllowAlwaysRule | undefined {
+  for (let index = rules.length - 1; index >= 0; index--) {
+    const rule = rules[index]!;
+    if (rule.tool !== "bash") {continue;}
+    if (rule.kind === "exact") {
+      if (rule.body === segment) {return rule;}
+      continue;
+    }
+    if (matchesWildcard(rule.body, segment)) {return rule;}
+  }
+  return undefined;
+}
+
+/**
+ * Session approval for bash, including per-segment matching for simple lists.
+ */
+export function findBashSessionApproval(
+  rules: readonly AllowAlwaysRule[],
+  request: PermissionRequest
+): AllowAlwaysRule | undefined {
+  // check full exact match first
+  for (let index = rules.length - 1; index >= 0; index--) {
+    const rule = rules[index]!;
+    if (rule.tool === "bash" && rule.kind === "exact" && rule.body === request.body) {
+      return rule;
+    }
+  }
+
+  const analysis = bashAnalysisOf(request);
+  if (analysis.isComplex) {return undefined;} // complex only has full exact match
+
+  // check segments with wildcard / exact
+  let lastMatch: AllowAlwaysRule | undefined;
+  for (const segment of analysis.segments) {
+    const match = findBashSegmentSessionApproval(rules, segment);
+    if (!match) {return undefined;}
+    lastMatch = match;
+  }
+  return lastMatch;
+}
+
+/**
+ * How "allow always" should persist this request for the session.
+ */
+export function resolveAllowAlwaysMode(
+  request: PermissionRequest,
+  policy: PolicyResolution
+): AllowAlwaysMode {
+  if (request.isExternalDirectory && policy.source === "external") {return "exact";}
+  if (request.toolName !== "bash") {return "exact";}
+
+  const analysis = bashAnalysisOf(request);
+  if (analysis.isComplex) {return "exact";}
+  if (analysis.segments.length > 1) {return "wildcard-list";}
+  if (analysis.segments.length === 1) {return "wildcard";}
+  return "exact";
+}

package/src/policy.ts

@@ -1,4 +1,7 @@
-import { findLastWildcardMatch, matchesWildcard } from "./matcher.ts";
+import {
+  findBashSessionApproval,
+  resolveBashPolicy,
+} from "./policy-bash.ts";
 import type {
   PermissionConfig,
   PermissionRequest,
@@ -7,6 +10,8 @@ import type {
   AllowAlwaysRule,
 } from "./types.ts";
 
+export { resolveAllowAlwaysMode } from "./policy-bash.ts";
+
 /**
  * Returns the permission for that tool if specified in the config.
  */
@@ -17,13 +22,6 @@ function configuredToolState(
   return Object.hasOwn(config.tools, toolName) ? config.tools[toolName] : undefined;
 }
 
-/**
- * Returns the permission for that tool or the default if not specified.
- */
-function fallbackState(config: PermissionConfig, toolName: string): PermissionState {
-  return configuredToolState(config, toolName) ?? config.default;
-}
-
 /**
  * Returns the policy for the request using the correct precedence rules.
  */
@@ -40,36 +38,12 @@ export function resolvePolicy(
         state: externalState,
         source: "external",
         matchedPattern: request.toolName,
-        isChainedBash: false,
       };
     }
   }
 
-  if (request.toolName === "bash") { // bash
-    const chained = request.isChainedBash === true;
-    if (chained) { // chained bash - can't match wildcard
-      return {
-        state: fallbackState(config, "bash"),
-        source: configuredToolState(config, "bash") ? "tool" : "default",
-        isChainedBash: true,
-      };
-    }
-
-    const match = findLastWildcardMatch(config.bash, request.body);
-    if (match) { // matched with wildcard
-      return {
-        state: match.state,
-        source: "bash",
-        matchedPattern: match.pattern,
-        isChainedBash: false,
-      };
-    }
-
-    return { // fallback to default
-      state: fallbackState(config, "bash"),
-      source: configuredToolState(config, "bash") ? "tool" : "default",
-      isChainedBash: false,
-    };
+  if (request.toolName === "bash") {
+    return resolveBashPolicy(config, request);
   }
 
   // other tool
@@ -77,7 +51,6 @@ export function resolvePolicy(
   return {
     state: toolState ?? config.default,
     source: toolState ? "tool" : "default",
-    isChainedBash: false,
   };
 }
 
@@ -86,32 +59,19 @@ export function resolvePolicy(
  */
 export function findSessionApproval(
   rules: readonly AllowAlwaysRule[],
-  request: PermissionRequest,
-  isChainedBash: boolean
+  request: PermissionRequest
 ): AllowAlwaysRule | undefined {
-  const isExternal = request.isExternalDirectory === true;
+  if (request.toolName === "bash") {
+    return findBashSessionApproval(rules, request);
+  }
 
-  for (let index = rules.length - 1; index >= 0; index -= 1) {
+  for (let index = rules.length - 1; index >= 0; index--) {
     const rule = rules[index]!;
-
-    if (rule.scope === "external_directory") {
-      if (!isExternal) {continue;}
-      if (rule.tool !== request.toolName) {continue;}
-      if (rule.body === request.body) {return rule;}
-      continue;
-    }
-
-    if (isExternal) {continue;}
-    if (rule.tool !== request.toolName) {continue;}
-
-    if (rule.kind === "exact") {
-      if (rule.body === request.body) {return rule;}
-      continue;
-    }
-
-    if (rule.tool !== "bash" || request.bodyKind !== "command") {continue;}
-    if (isChainedBash) {continue;}
-    if (matchesWildcard(rule.body, request.body)) {return rule;}
+    if (
+      rule.kind === "exact"
+      && rule.tool === request.toolName
+      && rule.body === request.body
+    ) {return rule;}
   }
 
   return undefined;
@@ -129,17 +89,3 @@ export function describePolicy(policy: PolicyResolution): string {
   }
   return `${policy.state} (default)`;
 }
-
-/**
- * True when "Allow Always" will generate a bash wildcard instead of an exact rule.
- * Mirrors the branching in chooseAlwaysRule.
- */
-export function willGenerateBashWildcard(
-  request: PermissionRequest,
-  policy: PolicyResolution
-): boolean {
-  if (request.isExternalDirectory && policy.source === "external") {return false;}
-  if (request.toolName !== "bash") {return false;}
-  if (policy.isChainedBash) {return false;}
-  return true;
-}

package/src/prompts.ts

@@ -20,7 +20,7 @@ export function describeBlockedSubject(
     return `bash command ${JSON.stringify(request.body)}`;
   }
   if (request.bodyKind === "path") {
-    return `access to ${JSON.stringify(request.body)}`;
+    return `${request.toolName} access to ${JSON.stringify(request.body)}`;
   }
   return includeGenericSubject
     ? `tool ${JSON.stringify(request.toolName)} with input ${request.body}`
@@ -30,20 +30,13 @@ export function describeBlockedSubject(
 /**
  * Builds context for the ai-generated purpose.
  */
-export function buildPurposePromptContext(
-  request: PermissionRequest,
-  policy: PolicyResolution
-): string {
+export function buildPurposePromptContext(request: PermissionRequest): string {
   const lines = [
     `Tool: ${request.toolName}`,
-    `Policy: ${describePolicy(policy)}`,
   ];
 
   if (request.bodyKind === "command") {
     lines.push(`Command:\n${preview(request.body, 600)}`);
-    if (policy.isChainedBash) {
-      lines.push(CHAINED_BASH_NOTE);
-    }
   } else if (request.bodyKind === "path") {
     lines.push(`Path: ${preview(request.body, 400)}`);
     if (request.isExternalDirectory) {
@@ -63,6 +56,14 @@ export const PURPOSE_SYSTEM_PROMPT = [
 
 export function buildPurposeInstructions(context: string): string {
   return [
+    "Examples:",
+    "Tool: bash",
+    `Command: git commit -m "Add feature" && git log`,
+    "Commits the changes to the repository and lists the commit history.",
+    "Tool: bash",
+    `Command: grep -rnEI --color=never --exclude-dir={node_modules} --include=\\*.py -B 2 -A 3 "^[[:space:]]*[^/]*\\b(func_1|func_2)\\s*(" .`,
+    "Searches the project for instances of func_1 or func_2.",
+    "",
     "Explain why the following request is being made in a single sentence.",
     "Do not use markdown or quotes.",
     "",
@@ -75,31 +76,56 @@ export const WILDCARD_SYSTEM_PROMPT = [
   "Return only the pattern itself with no explanation or markdown.",
 ].join(" ");
 
+export const WILDCARD_LIST_SYSTEM_PROMPT = [
+  "You generate shell command permission patterns for the user to approve.",
+  "Return only semicolon-separated patterns with no explanation or markdown.",
+].join(" ");
+
+const WILDCARD_RULES = [
+  "Rules for each pattern:",
+  "- Use wildcard syntax, not regular expressions.",
+  "- * matches any sequence of characters.",
+  "- ? matches exactly one character.",
+  "- \\* and \\? match literal characters.",
+  "- All other characters are literal.",
+];
+
 export function buildWildcardInstructions(command: string): string {
   return [
     "Create a permission wildcard for this command.",
     "Select one that is general enough to be useful but narrow enough to not pose security risks.",
     "",
-    "Rules for the pattern:",
-    "- Use wildcard syntax, not regular expressions.",
-    "- * matches any sequence of characters.",
-    "- ? matches exactly one character.",
-    "- \\* and \\? match literal characters.",
-    "- All other characters are literal.",
+    ...WILDCARD_RULES,
     "The pattern must match the given command.",
     "",
     `Command: ${JSON.stringify(command)}`,
   ].join("\n");
 }
 
+/**
+ * Builds instructions for generating one wildcard per command in a simple list.
+ */
+export function buildWildcardListInstructions(commands: readonly string[]): string {
+  return [
+    "Create a permission wildcard for each command below.",
+    "Select patterns that are general enough to be useful but narrow enough to not pose security risks.",
+    "Return exactly one pattern per command, separated by semicolons, in the same order.",
+    "",
+    ...WILDCARD_RULES,
+    "Each pattern must match its corresponding command.",
+    "",
+    `Commands: ${commands.join("; ")}`,
+  ].join("\n");
+}
+
 /**
  * Prompt given to the agent on deny.
  */
 export function formatDenyReason(request: PermissionRequest, policy: PolicyResolution): string {
   const subject = describeBlockedSubject(request, true);
-  const chainedNote = policy.isChainedBash ? ` ${CHAINED_BASH_NOTE}` : "";
+  const chainedNote = request.bashAnalysis?.isComplex ? ` ${CHAINED_BASH_NOTE}` : "";
 
-  return `Permission denied for ${subject}. Policy: ${describePolicy(policy)}.${chainedNote} Hard stop: do not retry or investigate a bypass; report the denial to the user.`;
+  return `Permission denied for ${subject}. Policy: ${describePolicy(policy)}.${chainedNote} Hard stop: do not retry or investigate a bypass. Report the denial to the user.`;
 }
 
 /**
@@ -114,5 +140,5 @@ export function formatNoUiReason(request: PermissionRequest, policy: PolicyResol
  */
 export function formatRejectReason(request: PermissionRequest): string {
   const subject = describeBlockedSubject(request, false);
-  return `User rejected ${subject}. Do not retry the rejected request. Ask the user what to do next.`;
+  return `User rejected ${subject}. Pause the task immediately (do not do further analysis or run more tool requests) and concisely ask the user what to do next.`;
 }

package/src/request-builder.ts

@@ -1,5 +1,5 @@
 import { isPathTool, resolveToolPath } from "./paths.ts";
-import { hasShellChaining } from "./shell.ts";
+import { analyzeShellCommand } from "./shell.ts";
 import type { PiToolInput } from "./types-pi.ts";
 import { toRecord, type PermissionRequest } from "./types.ts";
 
@@ -45,7 +45,7 @@ export async function buildRequest(
       body: command,
       bodyKind: "command",
       cwd,
-      isChainedBash: hasShellChaining(command),
+      bashAnalysis: analyzeShellCommand(command),
     };
   }
 

package/src/session-approvals.ts

@@ -1,9 +1,18 @@
 import type { AllowAlwaysRule } from "./types.ts";
 
+function ruleEq(a: AllowAlwaysRule, b: AllowAlwaysRule): boolean {
+  return a.kind === b.kind && a.tool === b.tool && a.body === b.body;
+}
+
 export class SessionApprovalStore {
+  /**
+   * Stored as an array rather than a set because JS
+   * objects don't compare by value.
+   */
   private readonly rules: AllowAlwaysRule[] = [];
 
   add(rule: AllowAlwaysRule): void {
+    if (this.rules.some((existing) => ruleEq(existing, rule))) {return;}
     this.rules.push(rule);
   }