@hank-warren/pi-auto-permissions 0.12.0 → 0.13.0

package/setup-scan.ts

@@ -0,0 +1,262 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+
+/**
+ * Fact gathering behind `/auto-permissions setup`.
+ *
+ * The privacy line matches Claude Code's `/auto-mode-setup` exactly: project
+ * files (git remotes, AGENTS.md/README.md, lockfiles) are read as content the
+ * user already chose to keep in the project, but session files contribute
+ * **command strings only** — the hosts, registries, buckets, and CLI names
+ * that appeared in commands the agent ran. User messages are never read,
+ * never excerpted, and never sent to the drafting model.
+ */
+
+export interface ProjectScan {
+  remotes: string[];
+  lockfiles: string[];
+  registryHosts: string[];
+  /** First slice of AGENTS.md (preferred) or README.md, as workflow context. */
+  instructionExcerpt?: string;
+}
+
+export interface CommandScan {
+  cliNames: string[];
+  hosts: string[];
+  buckets: string[];
+  sampleCount: number;
+}
+
+const INSTRUCTION_EXCERPT_CHARS = 4_000;
+const LOCKFILE_NAMES = [
+  "package-lock.json",
+  "yarn.lock",
+  "pnpm-lock.yaml",
+  "bun.lock",
+  "Cargo.lock",
+  "poetry.lock",
+  "uv.lock",
+  "go.sum",
+  "Gemfile.lock",
+];
+const MAX_LOCKFILE_BYTES = 5 * 1024 * 1024;
+const MAX_SESSION_FILE_BYTES = 8 * 1024 * 1024;
+const MAX_LIST = 20;
+
+const HOST_PATTERN = /https?:\/\/([a-z0-9.-]+\.[a-z]{2,})(?=[/:\s'"]|$)/gi;
+const BUCKET_PATTERN = /\b(?:s3|gs):\/\/[a-z0-9._-]+/gi;
+const SSH_HOST_PATTERN = /\b[a-z_][a-z0-9_-]*@([a-z0-9.-]+\.[a-z]{2,})\b/gi;
+
+function unique(values: Iterable<string>): string[] {
+  return [...new Set(values)];
+}
+
+export function extractHosts(text: string): string[] {
+  const hosts: string[] = [];
+  for (const match of text.matchAll(HOST_PATTERN)) hosts.push(match[1].toLowerCase());
+  for (const match of text.matchAll(SSH_HOST_PATTERN)) hosts.push(match[1].toLowerCase());
+  return unique(hosts);
+}
+
+function gitRemotes(cwd: string): string[] {
+  try {
+    const output = execFileSync("git", ["remote", "-v"], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5_000,
+    });
+    return output.split("\n").map((line) => line.trim()).filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+
+export function scanProject(cwd: string): ProjectScan {
+  const lockfiles: string[] = [];
+  const registryHosts: string[] = [];
+  for (const name of LOCKFILE_NAMES) {
+    const path = join(cwd, name);
+    if (!existsSync(path)) continue;
+    lockfiles.push(name);
+    try {
+      if (statSync(path).size > MAX_LOCKFILE_BYTES) continue;
+      registryHosts.push(...extractHosts(readFileSync(path, "utf8")));
+    } catch {
+      // A lockfile that cannot be read contributes only its name.
+    }
+  }
+
+  let instructionExcerpt: string | undefined;
+  for (const name of ["AGENTS.md", "README.md"]) {
+    try {
+      const content = readFileSync(join(cwd, name), "utf8");
+      instructionExcerpt = `${name}:\n${content.slice(0, INSTRUCTION_EXCERPT_CHARS)}`;
+      break;
+    } catch {
+      // Try the next candidate.
+    }
+  }
+
+  return {
+    remotes: gitRemotes(cwd),
+    lockfiles,
+    registryHosts: unique(registryHosts).slice(0, MAX_LIST),
+    ...(instructionExcerpt ? { instructionExcerpt } : {}),
+  };
+}
+
+/**
+ * Bash command strings from one session file's JSONL content — and nothing
+ * else. Only assistant toolCall blocks whose tool is bash contribute; user
+ * messages, assistant prose, and tool results are never extracted.
+ */
+export function extractBashCommands(sessionFileContent: string): string[] {
+  const commands: string[] = [];
+  for (const line of sessionFileContent.split("\n")) {
+    if (!line.trim()) continue;
+    let entry: unknown;
+    try {
+      entry = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    const message = (entry as { type?: string; message?: { role?: string; content?: unknown } })?.message;
+    if ((entry as { type?: string })?.type !== "message" || message?.role !== "assistant") continue;
+    const blocks = Array.isArray(message.content) ? message.content : [];
+    for (const block of blocks) {
+      if (!block || typeof block !== "object") continue;
+      const call = block as { type?: string; name?: string; arguments?: { command?: unknown } };
+      if (call.type !== "toolCall" || typeof call.name !== "string") continue;
+      const baseName = call.name.slice(call.name.lastIndexOf(".") + 1);
+      if (baseName !== "bash") continue;
+      if (typeof call.arguments?.command === "string") commands.push(call.arguments.command);
+    }
+  }
+  return commands;
+}
+
+export function summarizeCommands(commands: readonly string[]): CommandScan {
+  const cliCounts = new Map<string, number>();
+  const hosts = new Set<string>();
+  const buckets = new Set<string>();
+  for (const command of commands) {
+    const first = /^[\s(]*(?:sudo\s+)?([A-Za-z0-9_.\/-]+)/.exec(command)?.[1];
+    if (first) {
+      const name = first.slice(first.lastIndexOf("/") + 1);
+      if (name && !/^[0-9.]+$/.test(name)) cliCounts.set(name, (cliCounts.get(name) ?? 0) + 1);
+    }
+    for (const host of extractHosts(command)) hosts.add(host);
+    for (const match of command.matchAll(BUCKET_PATTERN)) buckets.add(match[0].toLowerCase());
+  }
+  const cliNames = [...cliCounts.entries()]
+    .sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))
+    .slice(0, MAX_LIST)
+    .map(([name]) => name);
+  return {
+    cliNames,
+    hosts: [...hosts].slice(0, MAX_LIST),
+    buckets: [...buckets].slice(0, MAX_LIST),
+    sampleCount: commands.length,
+  };
+}
+
+/** Newest session files first, bounded, across the per-project directories. */
+export function scanRecentSessionCommands(sessionsRoot: string, maxFiles = 10): CommandScan {
+  const files: { path: string; mtimeMs: number }[] = [];
+  try {
+    for (const dir of readdirSync(sessionsRoot)) {
+      const dirPath = join(sessionsRoot, dir);
+      let names: string[];
+      try {
+        names = readdirSync(dirPath);
+      } catch {
+        continue;
+      }
+      for (const name of names) {
+        if (!name.endsWith(".jsonl")) continue;
+        const path = join(dirPath, name);
+        try {
+          const stats = statSync(path);
+          if (stats.size <= MAX_SESSION_FILE_BYTES) files.push({ path, mtimeMs: stats.mtimeMs });
+        } catch {
+          // Skip unreadable files.
+        }
+      }
+    }
+  } catch {
+    return { cliNames: [], hosts: [], buckets: [], sampleCount: 0 };
+  }
+  files.sort((a, b) => b.mtimeMs - a.mtimeMs);
+
+  const commands: string[] = [];
+  for (const file of files.slice(0, maxFiles)) {
+    try {
+      commands.push(...extractBashCommands(readFileSync(file.path, "utf8")));
+    } catch {
+      // Skip unreadable files.
+    }
+  }
+  return summarizeCommands(commands);
+}
+
+export const SETUP_DRAFT_SYSTEM_PROMPT = `You draft trust configuration for Auto Permissions, a command reviewer for an AI coding agent. You receive verifiable facts about one operator's project and recent agent activity: git remotes, lockfiles and the registry hosts inside them, an excerpt of the project's own instructions, and facts derived from commands recent sessions ran (CLI names, hosts, buckets). No user conversation is included and none may be assumed.
+
+Draft two things:
+1. "environment": prose entries for the reviewer's trust configuration, written the way you would describe the infrastructure to a new engineer ("Our GitHub org X is trusted source control", "registry.internal.example is our internal package registry"). Only name infrastructure the provided facts support. Never invent hosts, orgs, or services, and never include one-off or public utility hosts (example.com downloads, api.github.com) unless the facts show them as this project's own infrastructure.
+2. "trustedGroups": rule groups from the provided list that this project could reasonably trust in .pi/trusted-ops, based on what the commands show as routine. Suggest a group only when the activity clearly supports it; when in doubt, suggest none.
+
+Return strict JSON only: {"environment": string[], "trustedGroups": string[]}. Either list may be empty.`;
+
+export function buildSetupDraftRequest(
+  project: ProjectScan,
+  commands: CommandScan,
+  availableGroups: readonly string[],
+): string {
+  return [
+    "<PROJECT_FACTS>",
+    JSON.stringify(
+      {
+        gitRemotes: project.remotes,
+        lockfiles: project.lockfiles,
+        lockfileRegistryHosts: project.registryHosts,
+        ...(project.instructionExcerpt ? { projectInstructionsExcerpt: project.instructionExcerpt } : {}),
+      },
+      null,
+      2,
+    ),
+    "</PROJECT_FACTS>",
+    "",
+    "<RECENT_COMMAND_FACTS note=\"derived from command strings only; no user messages\">",
+    JSON.stringify(commands, null, 2),
+    "</RECENT_COMMAND_FACTS>",
+    "",
+    `<AVAILABLE_TRUST_GROUPS>${JSON.stringify([...availableGroups])}</AVAILABLE_TRUST_GROUPS>`,
+  ].join("\n");
+}
+
+export interface SetupDraft {
+  environment: string[];
+  trustedGroups: string[];
+}
+
+export function parseSetupDraft(text: string, availableGroups: readonly string[]): SetupDraft {
+  const trimmed = text.trim();
+  const fenced = trimmed.match(/^```(?:json)?\s*([\s\S]*?)\s*```$/i)?.[1];
+  const candidate = fenced ?? trimmed;
+  const start = candidate.indexOf("{");
+  const end = candidate.lastIndexOf("}");
+  if (start < 0 || end <= start) throw new Error("setup draft returned no JSON object");
+  const value = JSON.parse(candidate.slice(start, end + 1)) as { environment?: unknown; trustedGroups?: unknown };
+
+  const strings = (input: unknown): string[] =>
+    Array.isArray(input)
+      ? unique(input.filter((entry): entry is string => typeof entry === "string" && entry.trim().length > 0).map((entry) => entry.trim()))
+      : [];
+  const groups = new Set(availableGroups);
+  return {
+    environment: strings(value.environment).slice(0, MAX_LIST),
+    trustedGroups: strings(value.trustedGroups).filter((group) => groups.has(group)),
+  };
+}