@guanlin4924/devflow-pi 0.1.94 → 0.1.95

package/plugins/devflow-core/runtime/hooks/hook_common.py

@@ -442,6 +442,275 @@ def tool_requests_protected_source(
     return False, []
 
 
+# Core control store protection (approval records live in control.db). This is
+# misuse prevention, not a defence against a hostile same-user process. It is
+# always on: neither DEVFLOW_SOFT_GATES, the policy mode nor hook-config can
+# disable it; hook-config may only add extra protected path globs.
+CONTROL_STORE_NAME_RE = re.compile(r"^control\.db(?:$|[-.])", re.IGNORECASE)
+CANONICAL_ACCEPTANCE_RE = re.compile(
+    r"(?:^|/)\.devflow/planning/test-runs/[^/]+/acceptance-results(?:\.meta)?\.json$",
+    re.IGNORECASE,
+)
+CANONICAL_ACCEPTANCE_COMMAND_RE = re.compile(
+    r"\.devflow/planning/test-runs/(?:[^\s/'\"`]+|\$\{?[^\s}/]+\}?)/acceptance-results(?:\.meta)?\.json\b",
+    re.IGNORECASE,
+)
+_CONTROL_TABLE = r"[\"'`\[]?(?:main\.)?(?:approval_proposals|approvals|authority_state)\b[\"'`\]]?"
+APPROVAL_SQL_RE = re.compile(
+    r"\b(?:insert\s+(?:or\s+\w+\s+)?into|replace\s+into|delete\s+from|drop\s+table(?:\s+if\s+exists)?|alter\s+table)\s+"
+    + _CONTROL_TABLE
+    + r"|\bupdate\s+(?:or\s+\w+\s+)?"
+    + _CONTROL_TABLE
+    + r"\s+set\b",
+    re.IGNORECASE,
+)
+
+
+def devflow_home() -> Path:
+    """DEVFLOW_HOME rule shared with src/paths.ts: unset/empty/whitespace-only -> ~/.devflow-pi,
+    otherwise expand a leading ``~`` and make absolute (no symlink resolution, existence not required)."""
+    configured = os.environ.get("DEVFLOW_HOME")
+    if configured is None or not configured.strip():
+        return Path(os.path.abspath(str(Path.home() / ".devflow-pi")))
+    if configured == "~" or configured.startswith("~/"):
+        configured = str(Path.home()) + configured[1:]
+    return Path(os.path.abspath(configured))
+
+
+def _raw_tool_paths(event: dict[str, Any]) -> list[str]:
+    tool_input = event.get("tool_input", {})
+    values = list(_walk_path_values(tool_input))
+    if isinstance(tool_input, dict):
+        for key in ("patch", "input"):
+            patch = tool_input.get(key)
+            if isinstance(patch, str):
+                values.extend(re.findall(r"^\*\*\* (?:Add|Update|Delete|Move) (?:File|to):\s*(.+)$", patch, re.MULTILINE))
+    elif isinstance(tool_input, str):
+        values.extend(re.findall(r"^\*\*\* (?:Add|Update|Delete|Move) (?:File|to):\s*(.+)$", tool_input, re.MULTILINE))
+    return [str(value).strip().strip("'\"") for value in values if str(value).strip()]
+
+
+def _extra_control_store_globs(root: Path) -> list[str]:
+    config = load_hook_config(root).get("gates", {})
+    section = config.get("control_store", {}) if isinstance(config, dict) else {}
+    extra = section.get("extra_protected_paths", []) if isinstance(section, dict) else []
+    return [str(item) for item in extra if isinstance(item, str) and item.strip()] if isinstance(extra, list) else []
+
+
+def _under(item: Path, base: Path) -> bool:
+    try:
+        item.relative_to(base)
+        return True
+    except ValueError:
+        return False
+
+
+def _data_home_project_roots() -> list[Path]:
+    """Every spelling of the Devflow ``projects`` tree (configured home, default home, symlink-resolved)."""
+    homes = [devflow_home(), Path(os.path.abspath(str(Path.home() / ".devflow-pi")))]
+    roots: list[Path] = []
+    for home in homes:
+        for base in (home, Path(os.path.realpath(str(home)))):
+            root = base / "projects"
+            if root not in roots:
+                roots.append(root)
+    return roots
+
+
+def is_pure_read_tool(event: dict[str, Any]) -> bool:
+    """True for file-reader tools (Read/Grep/Glob/...) that cannot mutate anything."""
+    name = tool_name(event)
+    return (
+        any(marker in name for marker in READ_TOOL_MARKERS)
+        and not is_mutation_tool(event)
+        and not is_command_tool(event)
+    )
+
+
+def path_is_control_store(
+    raw: str, cwd: Path, extra_globs: list[str] | None = None, allow_acceptance_read: bool = False
+) -> bool:
+    """``allow_acceptance_read`` opens canonical acceptance-results*.json for pure read tools only;
+    control.db, the data-home projects tree and extra globs stay denied for every access."""
+    candidate = Path(raw).expanduser()
+    if not candidate.is_absolute():
+        candidate = cwd / candidate
+    lexical = Path(os.path.normpath(str(candidate)))
+    resolved = Path(os.path.realpath(str(candidate)))
+    project_roots = _data_home_project_roots()
+    for item in (lexical, resolved):
+        if not allow_acceptance_read and CANONICAL_ACCEPTANCE_RE.search(item.as_posix()):
+            return True
+        if CONTROL_STORE_NAME_RE.match(item.name):
+            return True
+        if any(_under(item, root) for root in project_roots):
+            return True
+        if any(fnmatch.fnmatch(item.as_posix(), pattern) for pattern in extra_globs or []):
+            return True
+    return False
+
+
+# Programs that can open a SQLite file (or run arbitrary code that can) from their arguments.
+DB_CAPABLE_PROGRAM_RE = re.compile(
+    r"^(?:sqlite3?|python[\d.]*|pypy[\d.]*|bun|bunx|node|deno|ruby|perl|php|lua|litecli|duckdb|datasette|sqlite-utils|sqlitebrowser)$",
+    re.IGNORECASE,
+)
+# Programs that read/copy/delete their file arguments, so a bare ``control.db`` operand is a real file target.
+FILE_OPERAND_PROGRAMS = {
+    "cat", "less", "more", "head", "tail", "strings", "xxd", "od", "hexdump", "file", "stat", "cp", "mv", "rm",
+    "tee", "ln", "dd", "install", "touch", "truncate", "rsync", "scp", "sha256sum", "shasum", "md5sum", "md5",
+    "cksum", "base64", "open", "tar", "zip", "gzip", "gunzip", "bzip2", "xz", "unlink", "shred", "chmod", "chown",
+}
+WRAPPER_PROGRAMS = {"sudo", "env", "command", "time", "nohup", "exec", "nice", "xargs", "builtin", "stdbuf", "timeout"}
+SHELL_PROGRAMS = {"sh", "bash", "zsh", "dash", "ksh", "fish"}
+CONTROL_OPERATORS = {";", "&&", "||", "|", "&", "|&", "(", ")", "\n"}
+REDIRECT_OPERATORS = {">", ">>", ">|", "<", "<>", "&>", ">&", "<&", "&>>"}
+ASSIGNMENT_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*=")
+
+
+def _split_unquoted_newlines(command: str) -> str:
+    out: list[str] = []
+    quote = ""
+    escaped = False
+    for ch in command:
+        if escaped:
+            escaped = False
+        elif ch == "\\" and quote != "'":
+            escaped = True
+        elif quote:
+            if ch == quote:
+                quote = ""
+        elif ch in "'\"":
+            quote = ch
+        elif ch == "\n":
+            out.append(" ; ")
+            continue
+        out.append(ch)
+    return "".join(out)
+
+
+def _shell_tokens(command: str) -> list[str]:
+    import shlex
+
+    prepared = _split_unquoted_newlines(command)
+    try:
+        lexer = shlex.shlex(prepared, posix=True, punctuation_chars=True)
+        lexer.whitespace_split = True
+        lexer.commenters = ""
+        return list(lexer)
+    except ValueError:
+        return [item.strip("'\"") for item in prepared.split()]
+
+
+def _expand_shell_path(token: str) -> str:
+    home = devflow_home().as_posix()
+    user_home = str(Path.home())
+    for name, value in (("DEVFLOW_HOME", home), ("HOME", user_home)):
+        token = re.sub(r"\$\{" + name + r"(?::-[^}]*)?\}|\$" + name + r"\b", lambda _m, v=value: v, token)
+    if token == "~" or token.startswith("~/"):
+        token = user_home + token[1:]
+    return token
+
+
+def _token_is_control_target(token: str, cwd: Path, *, bare_name_is_target: bool) -> bool:
+    if not token or any(ch.isspace() for ch in token):
+        return False
+    if token.startswith("-") and "=" in token:
+        token = token.split("=", 1)[1]
+    elif token.startswith("-"):
+        return False
+    expanded = _expand_shell_path(token).replace("\\", "/")
+    candidate = Path(expanded)
+    if not candidate.is_absolute():
+        candidate = cwd / candidate
+    lexical = Path(os.path.normpath(str(candidate)))
+    resolved = Path(os.path.realpath(str(candidate)))
+    project_roots = _data_home_project_roots()
+    for item in (lexical, resolved):
+        if any(_under(item, root) for root in project_roots):
+            return True
+    if ".devflow-pi/projects" in expanded:
+        return True
+    for item in (lexical, resolved):
+        if not CONTROL_STORE_NAME_RE.match(item.name):
+            continue
+        # ``rg control.db src/`` names a pattern, not a file: a bare name only counts when it is
+        # a real file, is redirected/handed to a file-operating program, or carries a directory part.
+        if "/" in expanded or bare_name_is_target or item.exists() or resolved.exists():
+            return True
+    return False
+
+
+def _segments(tokens: list[str]) -> list[list[str]]:
+    segments: list[list[str]] = [[]]
+    for token in tokens:
+        if token in CONTROL_OPERATORS:
+            segments.append([])
+        else:
+            segments[-1].append(token)
+    return [segment for segment in segments if segment]
+
+
+def _analyze_command(command: str, cwd: Path, depth: int = 0) -> bool:
+    tokens = _shell_tokens(command)
+    for segment in _segments(tokens):
+        index = 0
+        while index < len(segment) and (ASSIGNMENT_RE.match(segment[index]) or segment[index] in WRAPPER_PROGRAMS):
+            index += 1
+        if index >= len(segment):
+            continue
+        program = os.path.basename(segment[index]).lower()
+        operands = segment[index + 1 :]
+        db_program = bool(DB_CAPABLE_PROGRAM_RE.match(program))
+        if program in SHELL_PROGRAMS and depth < 3:
+            for pos, operand in enumerate(operands):
+                if operand.startswith("-") and "c" in operand[1:] and pos + 1 < len(operands):
+                    if _analyze_command(operands[pos + 1], cwd, depth + 1):
+                        return True
+        previous = ""
+        for operand in [*segment[:index], *operands]:
+            after_redirect = previous in REDIRECT_OPERATORS or bool(re.match(r"^\d*(?:>>?|<)$", previous))
+            bare_ok = db_program or after_redirect or program in FILE_OPERAND_PROGRAMS
+            if operand not in REDIRECT_OPERATORS:
+                if db_program and (
+                    re.search(r"control\.db", operand, re.IGNORECASE) or ".devflow-pi/projects" in operand
+                ):
+                    return True
+                if _token_is_control_target(operand, cwd, bare_name_is_target=bare_ok):
+                    return True
+                glued = re.sub(r"^\d*[<>]+", "", operand)
+                if glued != operand and _token_is_control_target(glued, cwd, bare_name_is_target=True):
+                    return True
+            previous = operand
+    return False
+
+
+def command_touches_control_store(command: str, cwd: Path | None = None) -> bool:
+    """Deny shell commands that target the real control store or write approval tables.
+
+    Merely mentioning the text ``control.db`` (rg patterns, commit messages, echo) is allowed;
+    this is a mistake-prevention guard, not a sandbox."""
+    normalized = command.replace("\\", "/")
+    if APPROVAL_SQL_RE.search(normalized) or CANONICAL_ACCEPTANCE_COMMAND_RE.search(normalized):
+        return True
+    return _analyze_command(command, cwd or Path.cwd())
+
+
+def tool_touches_control_store(event: dict[str, Any], root: Path) -> tuple[bool, list[str]]:
+    """Deny non-Core access to control.db and the Devflow project data dir; canonical
+    acceptance results are additionally readable by pure read tools (never writable)."""
+    cwd = Path(str(event.get("cwd") or root)).expanduser()
+    extra = _extra_control_store_globs(root)
+    allow_read = is_pure_read_tool(event)
+    blocked = [raw for raw in _raw_tool_paths(event) if path_is_control_store(raw, cwd, extra, allow_read)]
+    if blocked:
+        return True, sorted(dict.fromkeys(blocked))
+    command = command_text(event)
+    if command and command_touches_control_store(command, cwd):
+        return True, ["<shell command>"]
+    return False, []
+
+
 def evidence_observed(event: dict[str, Any], root: Path, artifacts: list[str]) -> list[str]:
     name = tool_name(event)
     if not (any(marker in name for marker in READ_TOOL_MARKERS) or is_command_tool(event)):

package/plugins/devflow-core/runtime/hooks/index_gate.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""PreToolUse hook: block protected source access until indexes were observed."""
+"""PreToolUse hook: deny control-store access and block protected source access until indexes were observed."""
 
 from __future__ import annotations
 
@@ -16,12 +16,39 @@ from hook_common import (
     record_prechange_fingerprints,
     required_evidence,
     tool_requests_protected_source,
+    tool_touches_control_store,
 )
 
 
+def deny(reason: str) -> int:
+    print(
+        json.dumps(
+            {
+                "hookSpecificOutput": {
+                    "hookEventName": "PreToolUse",
+                    "permissionDecision": "deny",
+                    "permissionDecisionReason": reason,
+                }
+            },
+            ensure_ascii=False,
+        )
+    )
+    return 0
+
+
 def main() -> int:
     event = read_event()
     root = project_root(event)
+    # Hard protection, evaluated before any soft/strict policy handling.
+    control_blocked, control_paths = tool_touches_control_store(event, root)
+    if control_blocked:
+        return deny(
+            "CONTROL_STORE_PROTECTED: Devflow control.db, the Devflow data-home projects tree and writes to canonical "
+            "acceptance results are reserved for Core runtime tools; this misuse-prevention hook denies ordinary agent file and "
+            "shell access to them regardless of DEVFLOW_SOFT_GATES, but is not a same-user process sandbox. "
+            "Canonical acceptance-results*.json may be read with the Read/Grep file tools. "
+            f"Use devflow_approval(action=\"propose\"|\"list\") for approvals. Blocked target: {', '.join(control_paths)}."
+        )
     policy = load_policy(root)
     session_id = ensure_session(root, event)
     required = required_evidence(root, policy)
@@ -34,24 +61,11 @@ def main() -> int:
     missing = [path for path in required if path not in observed]
     strict = str(policy.get("mode", "strict")).lower() == "strict"
     if strict and required and missing and blocked:
-        reason = (
+        return deny(
             "INDEX_GATE_BLOCKED: protected source access requires observed index evidence. "
             f"Read these files first, in order: {', '.join(missing)}. "
             f"Blocked target: {', '.join(paths)}. The gate records successful tool reads, not assistant promises."
         )
-        print(
-            json.dumps(
-                {
-                    "hookSpecificOutput": {
-                        "hookEventName": "PreToolUse",
-                        "permissionDecision": "deny",
-                        "permissionDecisionReason": reason,
-                    }
-                },
-                ensure_ascii=False,
-            )
-        )
-        return 0
 
     if is_mutation_tool(event):
         record_prechange_fingerprints(root, session_id, direct_tool_paths(event, root))
@@ -60,4 +74,3 @@ def main() -> int:
 
 if __name__ == "__main__":
     raise SystemExit(main())
-