@diegopetrucci/pi-permission-gate 0.1.7 → 0.1.9

package/.pi-fleet-tested-version

@@ -1 +1 @@
-0.80.6
+0.81.1

package/README.md

@@ -2,7 +2,7 @@
 
 A small pi extension that prompts for confirmation before running potentially dangerous bash commands or writing to protected paths.
 
-This is adapted from the original `permission-gate.ts` example in [`earendil-works/pi-mono`](https://github.com/earendil-works/pi-mono/blob/main/packages/coding-agent/examples/extensions/permission-gate.ts) and kept basically the same.
+This is adapted from the original `permission-gate.ts` example in [`earendil-works/pi`](https://github.com/earendil-works/pi/blob/main/packages/coding-agent/examples/extensions/permission-gate.ts) and kept basically the same.
 
 ## What it checks
 

package/index.ts

@@ -11,8 +11,9 @@ import * as path from "node:path";
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
-const dangerousPatterns = [/\brm\s+(-rf?|--recursive)/i, /\bsudo\b/i, /\b(chmod|chown)\b.*777/i];
+const dangerousPatterns = [/\bsudo\b/i, /\b(chmod|chown)\b.*777/i];
 const protectedPathSegments = new Set([".git", "node_modules"]);
+const shellCommandSeparators = new Set([";", "&", "&&", "||", "|", "\n", "(", ")", "{", "}"]);
 const safeEnvSuffixes = new Set(["example", "examples", "template", "templates"]);
 
 type GuardDecision = { block: true; reason: string } | undefined;
@@ -22,6 +23,10 @@ type NormalizedPath = {
 	segments: string[];
 	basename: string;
 };
+type ShellToken = {
+	text: string;
+	quote?: '"' | "'";
+};
 
 type WriteInput = { path: string; content: string };
 type EditInput = { path: string; edits: Array<{ oldText: string; newText: string }> };
@@ -73,6 +78,452 @@ function isProtectedPath(normalizedPath: NormalizedPath): boolean {
 	return isProtectedEnvFile(normalizedPath.basename);
 }
 
+function findClosingDelimiter(command: string, start: number, delimiter: ')' | '`'): number {
+	let quote: '"' | "'" | undefined;
+	let escaping = false;
+	let depth = delimiter === ')' ? 1 : 0;
+
+	for (let index = start; index < command.length; index += 1) {
+		const char = command[index];
+		const next = command[index + 1];
+
+		if (escaping) {
+			escaping = false;
+			continue;
+		}
+
+		if (quote) {
+			if (char === "\\" && quote === '"') {
+				escaping = true;
+				continue;
+			}
+			if (char === quote) {
+				quote = undefined;
+			}
+			continue;
+		}
+
+		if (char === "\\") {
+			escaping = true;
+			continue;
+		}
+
+		if (char === '"' || char === "'") {
+			quote = char;
+			continue;
+		}
+
+		if (delimiter === ')' && char === '$' && next === '(') {
+			depth += 1;
+			index += 1;
+			continue;
+		}
+
+		if (char === delimiter) {
+			if (delimiter === ')') {
+				depth -= 1;
+				if (depth === 0) return index;
+				continue;
+			}
+			return index;
+		}
+	}
+
+	return -1;
+}
+
+function tokenizeShellWords(command: string): ShellToken[] {
+	// Intentionally shallow tokenization for reviewable safety checks. This handles
+	// simple quoting, command separators, and nested command substitutions, but it does
+	// not attempt full shell grammar such as heredocs, arrays, or parameter expansion.
+	const tokens: ShellToken[] = [];
+	let current = "";
+	let currentQuote: '"' | "'" | undefined;
+	let escaping = false;
+
+	const flushCurrent = () => {
+		if (!current) return;
+		tokens.push({ text: current, quote: currentQuote });
+		current = "";
+		currentQuote = undefined;
+	};
+
+	for (let index = 0; index < command.length; index += 1) {
+		const char = command[index];
+		const next = command[index + 1];
+
+		if (escaping) {
+			current += char;
+			escaping = false;
+			continue;
+		}
+
+		if (currentQuote) {
+			if (char === "\\" && currentQuote === '"') {
+				escaping = true;
+				continue;
+			}
+			if (char === currentQuote) {
+				flushCurrent();
+				continue;
+			}
+			current += char;
+			continue;
+		}
+
+		if (char === "\\") {
+			escaping = true;
+			continue;
+		}
+
+		if (char === '"' || char === "'") {
+			flushCurrent();
+			currentQuote = char;
+			continue;
+		}
+
+		if (char === "$" && next === "(") {
+			const closingIndex = findClosingDelimiter(command, index + 2, ')');
+			if (closingIndex !== -1) {
+				flushCurrent();
+				tokens.push({ text: command.slice(index, closingIndex + 1) });
+				index = closingIndex;
+				continue;
+			}
+		}
+
+		if (char === "`") {
+			const closingIndex = findClosingDelimiter(command, index + 1, '`');
+			if (closingIndex !== -1) {
+				flushCurrent();
+				tokens.push({ text: command.slice(index, closingIndex + 1) });
+				index = closingIndex;
+				continue;
+			}
+		}
+
+		if (char === "&" && next === "&") {
+			flushCurrent();
+			tokens.push({ text: "&&" });
+			index += 1;
+			continue;
+		}
+
+		if (char === "|" && next === "|") {
+			flushCurrent();
+			tokens.push({ text: "||" });
+			index += 1;
+			continue;
+		}
+
+		if (char === ";" || char === "&" || char === "|" || char === "\n" || char === "(" || char === ")" || char === "{" || char === "}") {
+			flushCurrent();
+			tokens.push({ text: char });
+			continue;
+		}
+
+		if (/\s/.test(char)) {
+			flushCurrent();
+			continue;
+		}
+
+		current += char;
+	}
+
+	flushCurrent();
+	return tokens;
+}
+
+function isShellAssignmentToken(token: string): boolean {
+	return /^[A-Za-z_][A-Za-z0-9_]*=.*/.test(token);
+}
+
+function hasDangerousSubstitution(command: string): boolean {
+	let quote: '"' | "'" | undefined;
+	let escaping = false;
+
+	for (let index = 0; index < command.length; index += 1) {
+		const char = command[index];
+		const next = command[index + 1];
+
+		if (escaping) {
+			escaping = false;
+			continue;
+		}
+
+		if (quote === "'") {
+			if (char === "'") quote = undefined;
+			continue;
+		}
+
+		if (char === "\\") {
+			escaping = true;
+			continue;
+		}
+
+		if (char === "'") {
+			quote = "'";
+			continue;
+		}
+
+		if (char === '"') {
+			quote = quote === '"' ? undefined : '"';
+			continue;
+		}
+
+		if (char === '$' && next === '(') {
+			const closingIndex = findClosingDelimiter(command, index + 2, ')');
+			if (closingIndex !== -1 && hasDangerousRecursiveRm(command.slice(index + 2, closingIndex))) return true;
+			if (closingIndex !== -1) index = closingIndex;
+			continue;
+		}
+
+		if (char === '`') {
+			const closingIndex = findClosingDelimiter(command, index + 1, '`');
+			if (closingIndex !== -1 && hasDangerousRecursiveRm(command.slice(index + 1, closingIndex))) return true;
+			if (closingIndex !== -1) index = closingIndex;
+		}
+	}
+
+	return false;
+}
+
+function basenameToken(token: string): string {
+	return path.posix.basename(token);
+}
+
+function unwrapLeadingWrappers(
+	tokens: ShellToken[],
+	startIndex: number,
+): { headIndex: number; nonExecuting: boolean; consumed: number } {
+	let index = startIndex;
+
+	const consumeOptionValue = (inlinePrefix: string, separateOptions: string[], longOption: string): boolean => {
+		const token = tokens[index]?.text;
+		if (!token) return false;
+		if (token === longOption || separateOptions.includes(token)) {
+			index += 1;
+			if (index < tokens.length) index += 1;
+			return true;
+		}
+		if (token.startsWith(`${longOption}=`) || (inlinePrefix && token.startsWith(inlinePrefix) && token.length > inlinePrefix.length)) {
+			index += 1;
+			return true;
+		}
+		return false;
+	};
+
+	const consumeOptionalLongOption = (inlinePrefix: string, shortOption: string, longOption: string): boolean => {
+		const token = tokens[index]?.text;
+		if (!token) return false;
+		if (token === longOption) {
+			index += 1;
+			return true;
+		}
+		if (token === shortOption) {
+			index += 1;
+			if (index < tokens.length) index += 1;
+			return true;
+		}
+		if (token.startsWith(`${longOption}=`) || token.startsWith(inlinePrefix) && token.length > inlinePrefix.length) {
+			index += 1;
+			return true;
+		}
+		return false;
+	};
+
+	while (index < tokens.length && isShellAssignmentToken(tokens[index].text)) index += 1;
+	while (tokens[index]?.text === "sudo") index += 1;
+
+	while (index < tokens.length) {
+		const current = tokens[index]?.text;
+		const currentBase = current ? basenameToken(current) : undefined;
+		if (!current) break;
+
+		if (current === "command") {
+			index += 1;
+			while (index < tokens.length) {
+				const option = tokens[index]?.text;
+				if (!option?.startsWith("-")) break;
+				if (option === "--") {
+					index += 1;
+					break;
+				}
+				if (option === "-v" || option === "-V") {
+					return { headIndex: tokens.length, nonExecuting: true, consumed: index + 1 - startIndex };
+				}
+				index += 1;
+			}
+			continue;
+		}
+
+		if (currentBase === "env") {
+			index += 1;
+			while (index < tokens.length) {
+				const option = tokens[index]?.text;
+				if (!option) break;
+				if (option === "--") {
+					index += 1;
+					break;
+				}
+				if (option === "--help" || option === "--version") {
+					return { headIndex: tokens.length, nonExecuting: true, consumed: index + 1 - startIndex };
+				}
+				if (isShellAssignmentToken(option)) {
+					index += 1;
+					continue;
+				}
+				if (consumeOptionValue("-u", ["-u"], "--unset")) continue;
+				if (consumeOptionValue("-C", ["-C"], "--chdir")) continue;
+				if (!option.startsWith("-")) break;
+				index += 1;
+			}
+			continue;
+		}
+
+		if (currentBase === "xargs") {
+			index += 1;
+			while (index < tokens.length) {
+				const option = tokens[index]?.text;
+				if (!option) break;
+				if (option === "--") {
+					index += 1;
+					break;
+				}
+				if (option === "--help" || option === "--version") {
+					return { headIndex: tokens.length, nonExecuting: true, consumed: index + 1 - startIndex };
+				}
+				if (consumeOptionValue("-n", ["-n"], "--max-args")) continue;
+				if (consumeOptionValue("-P", ["-P"], "--max-procs")) continue;
+				if (consumeOptionalLongOption("-I", "-I", "--replace")) continue;
+				if (consumeOptionValue("-a", ["-a"], "--arg-file")) continue;
+				if (consumeOptionalLongOption("-E", "-E", "--eof")) continue;
+				if (consumeOptionValue("-s", ["-s"], "--max-chars")) continue;
+				if (consumeOptionValue("-d", ["-d"], "--delimiter")) continue;
+				if (consumeOptionalLongOption("-L", "-L", "--max-lines")) continue;
+				if (!option.startsWith("-")) break;
+				index += 1;
+			}
+			continue;
+		}
+
+		break;
+	}
+
+	return { headIndex: index, nonExecuting: false, consumed: index - startIndex };
+}
+
+function detectRecursiveForceRm(tokens: ShellToken[], headIndex: number): boolean {
+	const commandName = tokens[headIndex];
+	if (!commandName || basenameToken(commandName.text) !== "rm") return false;
+
+	let sawRecursive = false;
+	let sawForce = false;
+
+	for (let index = headIndex + 1; index < tokens.length; index += 1) {
+		const token = tokens[index]?.text;
+		if (!token) continue;
+		if (token === "--") break;
+		if (!token.startsWith("-") || token === "-") continue;
+		if (token === "--recursive") sawRecursive = true;
+		if (token === "--force") sawForce = true;
+		if (/^-[^-]+$/.test(token)) {
+			const flags = token.slice(1);
+			if (flags.includes("r") || flags.includes("R")) sawRecursive = true;
+			if (flags.includes("f")) sawForce = true;
+		}
+	}
+
+	return sawRecursive && sawForce;
+}
+
+function hasDangerousCommandHead(tokens: ShellToken[], headIndex: number): boolean {
+	if (detectRecursiveForceRm(tokens, headIndex)) return true;
+
+	const firstToken = tokens[headIndex];
+	if (!firstToken) return false;
+
+	if (["sh", "bash", "zsh", "dash", "ksh"].includes(basenameToken(firstToken.text))) {
+		for (let index = headIndex + 1; index < tokens.length; index += 1) {
+			const token = tokens[index]?.text;
+			if (!token) break;
+			if (token === "--") break;
+			if (token === "-c" || (/^-[A-Za-z]+$/.test(token) && token.includes("c"))) {
+				const script = tokens[index + 1]?.text;
+				return typeof script === "string" && hasDangerousRecursiveRm(script);
+			}
+			if (!token.startsWith("-")) break;
+		}
+	}
+
+	if (firstToken.text === "eval") {
+		return headIndex + 1 < tokens.length && hasDangerousRecursiveRm(tokens.slice(headIndex + 1).map(({ text }) => text).join(" "));
+	}
+
+	return false;
+}
+
+function hasDangerousCommandSuffix(tokens: ShellToken[]): boolean {
+	let index = 0;
+
+	while (index < tokens.length) {
+		const unwrapped = unwrapLeadingWrappers(tokens, index);
+		if (unwrapped.nonExecuting) return false;
+		if (hasDangerousCommandHead(tokens, unwrapped.headIndex)) return true;
+
+		// Check every possible executable head once, while skipping known-wrapper
+		// option values so data such as an xargs EOF marker is never treated as a command.
+		index += unwrapped.consumed + 1;
+	}
+
+	return false;
+}
+
+function hasDangerousRecursiveRm(command: string): boolean {
+	// Conservative detector: recurse through obvious command-substitution and shell-wrapper
+	// surfaces, then inspect argv-like tokens for rm plus recursive+force semantics.
+	if (hasDangerousSubstitution(command)) return true;
+
+	const tokens = tokenizeShellWords(command);
+	let currentCommand: ShellToken[] = [];
+	let findExecCommand: ShellToken[] | undefined;
+
+	const evaluateTokens = (commandTokens: ShellToken[]): boolean => hasDangerousCommandSuffix(commandTokens);
+
+	const resetCurrentCommand = () => {
+		currentCommand = [];
+	};
+
+	for (const token of tokens) {
+		if (findExecCommand) {
+			if (token.text === ";" || token.text === "+") {
+				if (evaluateTokens(findExecCommand)) return true;
+				findExecCommand = undefined;
+				resetCurrentCommand();
+				continue;
+			}
+			findExecCommand.push(token);
+			continue;
+		}
+
+		if (token.text === "-exec" || token.text === "-execdir") {
+			findExecCommand = [];
+			continue;
+		}
+
+		if (shellCommandSeparators.has(token.text)) {
+			if (evaluateTokens(currentCommand)) return true;
+			resetCurrentCommand();
+			continue;
+		}
+
+		currentCommand.push(token);
+	}
+
+	if (findExecCommand && evaluateTokens(findExecCommand)) return true;
+	return evaluateTokens(currentCommand);
+}
+
 function validateWriteInput(input: unknown): WriteInput | undefined {
 	if (!isRecord(input)) return undefined;
 	if (typeof input.path !== "string" || typeof input.content !== "string") return undefined;
@@ -131,7 +582,7 @@ export default function (pi: ExtensionAPI) {
 				return { block: true, reason: "Malformed bash command blocked" };
 			}
 
-			const isDangerous = dangerousPatterns.some((p) => p.test(command));
+			const isDangerous = hasDangerousRecursiveRm(command) || dangerousPatterns.some((p) => p.test(command));
 
 			if (isDangerous) {
 				if (!ctx.hasUI) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-permission-gate",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "A pi extension that prompts before dangerous bash commands and protected file writes.",
   "keywords": [
     "pi-package",
@@ -31,5 +31,9 @@
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": "*"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=22.19.0"
   }
 }