@hydra-acp/approver 0.1.5 → 0.1.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +34 -60
- package/dist/config.js +1 -0
- package/dist/config.js.map +1 -1
- package/dist/index.js +22 -15
- package/dist/index.js.map +1 -1
- package/dist/rule.js +80 -7
- package/dist/rule.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -56,7 +56,7 @@ process with these env vars set: `HYDRA_ACP_DAEMON_URL`, `HYDRA_ACP_TOKEN`,
|
|
|
56
56
|
`HYDRA_ACP_WS_URL`. Stdout/stderr land in
|
|
57
57
|
`~/.hydra-acp/extensions/hydra-acp-approver.log`. Lifecycle is managed with
|
|
58
58
|
`hydra-acp extensions start|stop|restart hydra-acp-approver` and
|
|
59
|
-
`hydra-acp extensions
|
|
59
|
+
`hydra-acp extensions log hydra-acp-approver -f` to tail.
|
|
60
60
|
|
|
61
61
|
## Configure
|
|
62
62
|
|
|
@@ -79,68 +79,15 @@ export default function approve(req) {
|
|
|
79
79
|
|
|
80
80
|
> Prefer `allow_once` — agents typically cache `allow_always` choices locally and bypass the approver on subsequent identical calls.
|
|
81
81
|
|
|
82
|
-
###
|
|
82
|
+
### Built-in default rule
|
|
83
83
|
|
|
84
|
-
|
|
84
|
+
When no config file is present, the approver applies a built-in default rule defined in [`src/rule.ts`](src/rule.ts) (`DEFAULT_RULE`). It auto-approves `read`/`search`/`other`, auto-approves `execute` *unless* the serialized tool call matches one of a list of danger patterns (`rm -rf /`, `dd of=/dev/...`, fork bombs, piping `curl` into `sh`, system-state changes like `shutdown`/`reboot`, and friends), and abstains on every other kind. When it abstains, the request stays open so an interactive client (Slack, TUI, browser) can prompt a human.
|
|
85
85
|
|
|
86
86
|
Patterns are matched against `JSON.stringify(toolCall)`, so they catch whichever field the agent put the command in (`rawInput.command`, terminal blocks in `content`, the title, etc.). Abstaining is safe — the request stays open — so the list errs on the side of being broad.
|
|
87
87
|
|
|
88
|
-
|
|
89
|
-
// ~/.hydra-acp/approver.config.js
|
|
90
|
-
const SAFE_KINDS = new Set(["read", "search", "other"]);
|
|
91
|
-
|
|
92
|
-
const DANGEROUS_PATTERNS = [
|
|
93
|
-
// rm with recursive + force flags hitting /, /*, ~, $HOME, or a bare glob
|
|
94
|
-
/\brm\b[^\n]*\s-[a-zA-Z]*(rf|fr)[a-zA-Z]*\b[^\n]*(\s|=)(\/(?!\w)|\/\*|~|\$HOME|\*)(\s|"|'|\\|$)/,
|
|
95
|
-
/\brm\b[^\n]*--recursive\b[^\n]*--force\b[^\n]*(\s|=)(\/(?!\w)|\/\*|~|\$HOME|\*)/,
|
|
96
|
-
/\brm\b[^\n]*--force\b[^\n]*--recursive\b[^\n]*(\s|=)(\/(?!\w)|\/\*|~|\$HOME|\*)/,
|
|
97
|
-
/\bdd\b[^\n]*\bof=\/dev\/(sd|nvme|disk|hd|mmcblk|xvd|vd)\w*/i,
|
|
98
|
-
/\bmkfs(\.\w+)?\s+\/dev\//i,
|
|
99
|
-
/\bfdisk\s+\/dev\//i,
|
|
100
|
-
/\bparted\s+\/dev\//i,
|
|
101
|
-
/\bshred\b[^\n]*\/dev\//i,
|
|
102
|
-
/:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/, // fork bomb
|
|
103
|
-
/>\s*\/dev\/(sd|nvme|disk|hd|mmcblk|xvd|vd)\w*/i,
|
|
104
|
-
/>\s*\/etc\/(passwd|shadow|sudoers|hosts)\b/i,
|
|
105
|
-
/\b(shutdown|reboot|halt|poweroff)\b/i,
|
|
106
|
-
/\binit\s+[06]\b/,
|
|
107
|
-
/\bkill\s+-(?:9|KILL|SIGKILL)\s+1\b/,
|
|
108
|
-
/\b(curl|wget|fetch)\b[^\n|]*\|\s*(sudo\s+)?(sh|bash|zsh|fish)\b/i,
|
|
109
|
-
/\bchmod\s+-R\b[^\n]*\s\/(\s|$|"|')/,
|
|
110
|
-
/\bchown\s+-R\b[^\n]*\s\/(\s|$|"|')/,
|
|
111
|
-
/\bsudo\s+(rm|dd|mkfs|fdisk|parted|shred|chmod|chown|shutdown|reboot|halt|poweroff|init|userdel|groupdel)\b/i,
|
|
112
|
-
];
|
|
113
|
-
|
|
114
|
-
function looksDangerous(toolCall) {
|
|
115
|
-
let blob;
|
|
116
|
-
try {
|
|
117
|
-
blob = JSON.stringify(toolCall);
|
|
118
|
-
} catch {
|
|
119
|
-
return true;
|
|
120
|
-
}
|
|
121
|
-
return DANGEROUS_PATTERNS.some((p) => p.test(blob));
|
|
122
|
-
}
|
|
88
|
+
Treat the default as a starting point, not a security boundary — pattern-based detection inevitably misses things, and an agent that can craft commands can probably evade any list. The win is "no permission prompts for the 99% case, human-in-the-loop for the obviously-irreversible 1%."
|
|
123
89
|
|
|
124
|
-
|
|
125
|
-
return options.find((o) => o.kind === "allow_once")?.optionId ?? null;
|
|
126
|
-
}
|
|
127
|
-
|
|
128
|
-
export default function approve(req) {
|
|
129
|
-
const kind = req.toolCall?.kind;
|
|
130
|
-
if (SAFE_KINDS.has(kind)) {
|
|
131
|
-
return pickAllowOnce(req.options);
|
|
132
|
-
}
|
|
133
|
-
if (kind === "execute") {
|
|
134
|
-
if (looksDangerous(req.toolCall)) {
|
|
135
|
-
return null;
|
|
136
|
-
}
|
|
137
|
-
return pickAllowOnce(req.options);
|
|
138
|
-
}
|
|
139
|
-
return null;
|
|
140
|
-
}
|
|
141
|
-
```
|
|
142
|
-
|
|
143
|
-
Treat this as a starting point, not a security boundary — pattern-based detection inevitably misses things, and an agent that can craft commands can probably evade any list you write. The win is "no permission prompts for the 99% case, human-in-the-loop for the obviously-irreversible 1%."
|
|
90
|
+
Drop a JS file at `~/.hydra-acp/approver.config.js` to override it entirely. See [`src/rule.ts`](src/rule.ts) if you want to copy the default and extend it.
|
|
144
91
|
|
|
145
92
|
### Request shape
|
|
146
93
|
|
|
@@ -189,9 +136,35 @@ kill -HUP $(cat ~/.hydra-acp/extensions/hydra-acp-approver.pid)
|
|
|
189
136
|
|
|
190
137
|
Pending (already-abstained) requests are unaffected; new requests use the fresh rule.
|
|
191
138
|
|
|
192
|
-
###
|
|
139
|
+
### Broken config
|
|
140
|
+
|
|
141
|
+
If the config file *exists* but fails to load (syntax error, no default export, throw at import time, etc.), the approver abstains on every request rather than silently falling back to the built-in default — a broken config shouldn't quietly auto-approve anything. Fix the file and either save it (auto-reloads) or `SIGHUP` the process.
|
|
142
|
+
|
|
143
|
+
### Dangerously allow all
|
|
193
144
|
|
|
194
|
-
|
|
145
|
+
Set `HYDRA_ACP_APPROVER_DANGEROUSLY_ALLOW_ALL=1` to auto-approve **every** permission request — no kind check, no danger list, no human in the loop. The rule config file is ignored entirely (not loaded, not watched). This is the equivalent of Claude Code's `--dangerously-skip-permissions`: convenient for sandboxes and throwaway VMs, reckless on anything you care about.
|
|
146
|
+
|
|
147
|
+
Wire it through the extension's env in `~/.hydra-acp/config.json`:
|
|
148
|
+
|
|
149
|
+
```json
|
|
150
|
+
{
|
|
151
|
+
"extensions": {
|
|
152
|
+
"hydra-acp-approver": {
|
|
153
|
+
"command": ["hydra-acp-approver"],
|
|
154
|
+
"env": { "HYDRA_ACP_APPROVER_DANGEROUSLY_ALLOW_ALL": "1" },
|
|
155
|
+
"enabled": true
|
|
156
|
+
}
|
|
157
|
+
}
|
|
158
|
+
}
|
|
159
|
+
```
|
|
160
|
+
|
|
161
|
+
Or via the CLI:
|
|
162
|
+
|
|
163
|
+
```sh
|
|
164
|
+
hydra-acp extensions add hydra-acp-approver \
|
|
165
|
+
--command hydra-acp-approver \
|
|
166
|
+
--env HYDRA_ACP_APPROVER_DANGEROUSLY_ALLOW_ALL=1
|
|
167
|
+
```
|
|
195
168
|
|
|
196
169
|
## Environment
|
|
197
170
|
|
|
@@ -202,6 +175,7 @@ If `approver.config.js` doesn't exist, the approver defaults to **abstain on eve
|
|
|
202
175
|
| `HYDRA_ACP_WS_URL` | derived from daemon URL | Override WS endpoint |
|
|
203
176
|
| `HYDRA_ACP_APPROVER_CONFIG` | `~/.hydra-acp/approver.config.js` | Path to the rule module |
|
|
204
177
|
| `HYDRA_ACP_APPROVER_POLL_MS` | `2000` | Session-discovery poll interval |
|
|
178
|
+
| `HYDRA_ACP_APPROVER_DANGEROUSLY_ALLOW_ALL` | `false` | Auto-approve every request, ignoring the rule config |
|
|
205
179
|
| `DEBUG` | `false` | Verbose logging |
|
|
206
180
|
|
|
207
181
|
## How it works
|
package/dist/config.js
CHANGED
|
@@ -40,6 +40,7 @@ export function loadConfig() {
|
|
|
40
40
|
hydraToken,
|
|
41
41
|
hydraPollIntervalMs: intEnv("HYDRA_ACP_APPROVER_POLL_MS", 2000),
|
|
42
42
|
ruleConfigPath,
|
|
43
|
+
dangerouslyAllowAll: boolEnv("HYDRA_ACP_APPROVER_DANGEROUSLY_ALLOW_ALL", false),
|
|
43
44
|
debug: boolEnv("DEBUG", false),
|
|
44
45
|
};
|
|
45
46
|
}
|
package/dist/config.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAkBpC,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,OAAO,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,OAAO,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC;IAC/E,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,OAAO,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,QAAgB;IAC5C,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC3C,CAAC;AAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;AAExD,SAAS,OAAO,CAAC,IAAY,EAAE,QAAiB;IAC9C,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACpB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,cAAc,GAClB,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,uBAAuB,CAAC;IAC9D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;IACrD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GACd,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,WAAW,CAAC,cAAc,CAAC,CAAC;IAC9D,MAAM,cAAc,GAClB,OAAO,CAAC,GAAG,CAAC,yBAAyB;QACrC,OAAO,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC;IAEzD,OAAO;QACL,cAAc;QACd,UAAU;QACV,UAAU;QACV,mBAAmB,EAAE,MAAM,CAAC,4BAA4B,EAAE,IAAI,CAAC;QAC/D,cAAc;QACd,mBAAmB,EAAE,OAAO,CAC1B,0CAA0C,EAC1C,KAAK,CACN;QACD,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC;KAC/B,CAAC;AACJ,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -5,7 +5,7 @@ import { fileURLToPath } from "node:url";
|
|
|
5
5
|
import { loadConfig } from "./config.js";
|
|
6
6
|
import { HydraDiscovery } from "./discovery.js";
|
|
7
7
|
import { ApproverBridge } from "./bridge.js";
|
|
8
|
-
import {
|
|
8
|
+
import { ALLOW_ALL_RULE, DEFAULT_RULE, loadRule, } from "./rule.js";
|
|
9
9
|
import { logger, setDebug } from "./util/log.js";
|
|
10
10
|
import { watchConfigPath } from "./util/watch.js";
|
|
11
11
|
const log = logger("main");
|
|
@@ -30,8 +30,14 @@ async function main() {
|
|
|
30
30
|
// The current rule function. SIGHUP-triggered reloads mutate this
|
|
31
31
|
// box; bridges re-read it on each request via a thunk so they always
|
|
32
32
|
// see the latest version.
|
|
33
|
-
let currentRule =
|
|
34
|
-
|
|
33
|
+
let currentRule = DEFAULT_RULE;
|
|
34
|
+
if (config.dangerouslyAllowAll) {
|
|
35
|
+
log.warn("HYDRA_ACP_APPROVER_DANGEROUSLY_ALLOW_ALL is set — auto-approving every permission request. Rule config file is ignored.");
|
|
36
|
+
currentRule = ALLOW_ALL_RULE;
|
|
37
|
+
}
|
|
38
|
+
else {
|
|
39
|
+
currentRule = await loadRule(config.ruleConfigPath);
|
|
40
|
+
}
|
|
35
41
|
const bridges = new Map();
|
|
36
42
|
const discovery = new HydraDiscovery({
|
|
37
43
|
daemonUrl: config.hydraDaemonUrl,
|
|
@@ -87,20 +93,21 @@ async function main() {
|
|
|
87
93
|
log.warn(`rule reload failed: ${err.message}`);
|
|
88
94
|
});
|
|
89
95
|
};
|
|
90
|
-
|
|
91
|
-
//
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
96
|
+
// Skip rule reloading entirely when dangerouslyAllowAll is on —
|
|
97
|
+
// the config file is being ignored, so there's nothing to reload.
|
|
98
|
+
const configWatcher = config.dangerouslyAllowAll
|
|
99
|
+
? null
|
|
100
|
+
: watchConfigPath({
|
|
101
|
+
path: config.ruleConfigPath,
|
|
102
|
+
onChange: () => reloadRule("config file changed"),
|
|
103
|
+
onError: (err) => log.warn(`config watcher error: ${err.message}`),
|
|
104
|
+
});
|
|
105
|
+
if (!config.dangerouslyAllowAll) {
|
|
106
|
+
process.on("SIGHUP", () => reloadRule("SIGHUP"));
|
|
107
|
+
}
|
|
101
108
|
const shutdown = (sig) => {
|
|
102
109
|
log.info(`${sig} received — shutting down`);
|
|
103
|
-
configWatcher
|
|
110
|
+
configWatcher?.stop();
|
|
104
111
|
discovery.stop();
|
|
105
112
|
for (const bridge of bridges.values()) {
|
|
106
113
|
bridge.stop();
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EACL,cAAc,EACd,YAAY,EACZ,QAAQ,GAET,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;AAE3B,SAAS,WAAW;IAClB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC,CAC/B,CAAC;QAC1B,OAAO,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,WAAW,EAAE,IAAI,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEvB,kEAAkE;IAClE,qEAAqE;IACrE,0BAA0B;IAC1B,IAAI,WAAW,GAAiB,YAAY,CAAC;IAC7C,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CACN,yHAAyH,CAC1H,CAAC;QACF,WAAW,GAAG,cAAc,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,WAAW,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAElD,MAAM,SAAS,GAAG,IAAI,cAAc,CAAC;QACnC,SAAS,EAAE,MAAM,CAAC,cAAc;QAChC,KAAK,EAAE,MAAM,CAAC,UAAU;QACxB,cAAc,EAAE,MAAM,CAAC,mBAAmB;QAC1C,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE;YACjB,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnC,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CACN,gBAAgB,OAAO,CAAC,SAAS,UAAU,OAAO,CAAC,OAAO,IAAI,GAAG,QAAQ,OAAO,CAAC,GAAG,EAAE,CACvF,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC;gBAChC,WAAW,EAAE,MAAM,CAAC,UAAU;gBAC9B,KAAK,EAAE,MAAM,CAAC,UAAU;gBACxB,IAAI,EAAE;oBACJ,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS;wBAC/B,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE;wBAC9B,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW;aAC3B,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACvC,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;QACD,QAAQ,EAAE,CAAC,SAAS,EAAE,EAAE;YACtB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,kBAAkB,SAAS,EAAE,CAAC,CAAC;YACxC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1B,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,CAAC;KACF,CAAC,CAAC;IACH,SAAS,CAAC,KAAK,EAAE,CAAC;IAElB,6DAA6D;IAC7D,oEAAoE;IACpE,iEAAiE;IACjE,mEAAmE;IACnE,qDAAqD;IACrD,MAAM,UAAU,GAAG,CAAC,MAAc,EAAQ,EAAE;QAC1C,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,0BAA0B,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;QACrE,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC;aAC5B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACb,WAAW,GAAG,IAAI,CAAC;YACnB,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBACtC,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACnC,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,GAAG,CAAC,IAAI,CAAC,uBAAwB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACP,CAAC,CAAC;IAEF,gEAAgE;IAChE,kEAAkE;IAClE,MAAM,aAAa,GAAG,MAAM,CAAC,mBAAmB;QAC9C,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,eAAe,CAAC;YACd,IAAI,EAAE,MAAM,CAAC,cAAc;YAC3B,QAAQ,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC;YACjD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,GAAG,CAAC,OAAO,EAAE,CAAC;SACnE,CAAC,CAAC;IACP,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAChC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAQ,EAAE;QACrC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,2BAA2B,CAAC,CAAC;QAC5C,aAAa,EAAE,IAAI,EAAE,CAAC;QACtB,SAAS,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,iDAAiD;QACjD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;IACjD,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAEjD,GAAG,CAAC,IAAI,CACN,iCAAiC,MAAM,CAAC,cAAc,SAAS,MAAM,CAAC,cAAc,EAAE,CACvF,CAAC;AACJ,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAwB,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;IACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
|
package/dist/rule.js
CHANGED
|
@@ -2,17 +2,90 @@ import { stat } from "node:fs/promises";
|
|
|
2
2
|
import { pathToFileURL } from "node:url";
|
|
3
3
|
import { logger } from "./util/log.js";
|
|
4
4
|
const log = logger("rule");
|
|
5
|
-
//
|
|
6
|
-
//
|
|
7
|
-
//
|
|
5
|
+
// Fallback when a config file exists but fails to load (bad syntax,
|
|
6
|
+
// no default export, etc.): abstain on every request. We don't guess
|
|
7
|
+
// at the user's intent when their config is broken.
|
|
8
8
|
export const ABSTAIN_RULE = () => null;
|
|
9
|
+
// Engaged by HYDRA_ACP_APPROVER_DANGEROUSLY_ALLOW_ALL=1. Approves
|
|
10
|
+
// every request by picking an allow_once option (allow_always as a
|
|
11
|
+
// fallback). Mirrors Claude Code's --dangerously-skip-permissions:
|
|
12
|
+
// no prompts, no danger-list guarding, no human in the loop.
|
|
13
|
+
export const ALLOW_ALL_RULE = (req) => {
|
|
14
|
+
const allowOnce = req.options.find((o) => o.kind === "allow_once");
|
|
15
|
+
if (allowOnce) {
|
|
16
|
+
return allowOnce.optionId;
|
|
17
|
+
}
|
|
18
|
+
const allowAlways = req.options.find((o) => o.kind === "allow_always");
|
|
19
|
+
if (allowAlways) {
|
|
20
|
+
return allowAlways.optionId;
|
|
21
|
+
}
|
|
22
|
+
return null;
|
|
23
|
+
};
|
|
24
|
+
const SAFE_KINDS = new Set(["read", "search", "other"]);
|
|
25
|
+
// Tool calls whose serialized JSON matches one of these patterns
|
|
26
|
+
// abstain instead of auto-approving, so a human client gets the
|
|
27
|
+
// prompt.
|
|
28
|
+
const DANGEROUS_PATTERNS = [
|
|
29
|
+
/\brm\b[^\n]*\s-[a-zA-Z]*(rf|fr)[a-zA-Z]*\b[^\n]*(\s|=)(\/(?!\w)|\/\*|~|\$HOME|\*)(\s|"|'|\\|$)/,
|
|
30
|
+
/\brm\b[^\n]*--recursive\b[^\n]*--force\b[^\n]*(\s|=)(\/(?!\w)|\/\*|~|\$HOME|\*)/,
|
|
31
|
+
/\brm\b[^\n]*--force\b[^\n]*--recursive\b[^\n]*(\s|=)(\/(?!\w)|\/\*|~|\$HOME|\*)/,
|
|
32
|
+
/\bdd\b[^\n]*\bof=\/dev\/(sd|nvme|disk|hd|mmcblk|xvd|vd)\w*/i,
|
|
33
|
+
/\bmkfs(\.\w+)?\s+\/dev\//i,
|
|
34
|
+
/\bfdisk\s+\/dev\//i,
|
|
35
|
+
/\bparted\s+\/dev\//i,
|
|
36
|
+
/\bshred\b[^\n]*\/dev\//i,
|
|
37
|
+
/:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/,
|
|
38
|
+
/>\s*\/dev\/(sd|nvme|disk|hd|mmcblk|xvd|vd)\w*/i,
|
|
39
|
+
/>\s*\/etc\/(passwd|shadow|sudoers|hosts)\b/i,
|
|
40
|
+
/\b(shutdown|reboot|halt|poweroff)\b/i,
|
|
41
|
+
/\binit\s+[06]\b/,
|
|
42
|
+
/\bkill\s+-(?:9|KILL|SIGKILL)\s+1\b/,
|
|
43
|
+
/\b(curl|wget|fetch)\b[^\n|]*\|\s*(sudo\s+)?(sh|bash|zsh|fish)\b/i,
|
|
44
|
+
/\bchmod\s+-R\b[^\n]*\s\/(\s|$|"|')/,
|
|
45
|
+
/\bchown\s+-R\b[^\n]*\s\/(\s|$|"|')/,
|
|
46
|
+
/\bsudo\s+(rm|dd|mkfs|fdisk|parted|shred|chmod|chown|shutdown|reboot|halt|poweroff|init|userdel|groupdel)\b/i,
|
|
47
|
+
];
|
|
48
|
+
function looksDangerous(toolCall) {
|
|
49
|
+
let blob;
|
|
50
|
+
try {
|
|
51
|
+
blob = JSON.stringify(toolCall);
|
|
52
|
+
}
|
|
53
|
+
catch {
|
|
54
|
+
return true;
|
|
55
|
+
}
|
|
56
|
+
return DANGEROUS_PATTERNS.some((p) => p.test(blob));
|
|
57
|
+
}
|
|
58
|
+
function pickAllowOnce(options) {
|
|
59
|
+
return options.find((o) => o.kind === "allow_once")?.optionId ?? null;
|
|
60
|
+
}
|
|
61
|
+
// The default rule when no config file is present. Matches the
|
|
62
|
+
// "Recommended starting point" shown in README.md: auto-approve
|
|
63
|
+
// read/search/other, auto-approve execute unless it matches a
|
|
64
|
+
// danger pattern, abstain otherwise. Users override this by
|
|
65
|
+
// dropping a JS module at the configured path.
|
|
66
|
+
export const DEFAULT_RULE = (req) => {
|
|
67
|
+
const kind = req.toolCall?.kind;
|
|
68
|
+
if (kind !== undefined && SAFE_KINDS.has(kind)) {
|
|
69
|
+
return pickAllowOnce(req.options);
|
|
70
|
+
}
|
|
71
|
+
if (kind === "execute") {
|
|
72
|
+
if (looksDangerous(req.toolCall)) {
|
|
73
|
+
return null;
|
|
74
|
+
}
|
|
75
|
+
return pickAllowOnce(req.options);
|
|
76
|
+
}
|
|
77
|
+
return null;
|
|
78
|
+
};
|
|
9
79
|
let loadCounter = 0;
|
|
10
80
|
// Loads (or reloads) the user's rule function from `path`. Each call
|
|
11
81
|
// re-imports with a fresh cache-busting query param so SIGHUP-driven
|
|
12
82
|
// reloads pick up edits without restarting the process.
|
|
13
83
|
//
|
|
14
|
-
// Returns
|
|
15
|
-
//
|
|
84
|
+
// Returns DEFAULT_RULE when the file is missing (the recommended
|
|
85
|
+
// starting point — auto-approve safe kinds, guard execute against a
|
|
86
|
+
// danger list, abstain otherwise). Returns ABSTAIN_RULE when the
|
|
87
|
+
// file exists but fails to import, so a broken user config doesn't
|
|
88
|
+
// silently fall back to auto-approval.
|
|
16
89
|
export async function loadRule(path) {
|
|
17
90
|
try {
|
|
18
91
|
await stat(path);
|
|
@@ -20,8 +93,8 @@ export async function loadRule(path) {
|
|
|
20
93
|
catch (err) {
|
|
21
94
|
const e = err;
|
|
22
95
|
if (e.code === "ENOENT") {
|
|
23
|
-
log.info(`no rule config at ${path} —
|
|
24
|
-
return
|
|
96
|
+
log.info(`no rule config at ${path} — using built-in default rule (drop a JS file at that path to override)`);
|
|
97
|
+
return DEFAULT_RULE;
|
|
25
98
|
}
|
|
26
99
|
log.warn(`stat ${path} failed: ${e.message}; abstaining`);
|
|
27
100
|
return ABSTAIN_RULE;
|
package/dist/rule.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"rule.js","sourceRoot":"","sources":["../src/rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEvC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;AAwB3B,
|
|
1
|
+
{"version":3,"file":"rule.js","sourceRoot":"","sources":["../src/rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEvC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;AAwB3B,oEAAoE;AACpE,qEAAqE;AACrE,oDAAoD;AACpD,MAAM,CAAC,MAAM,YAAY,GAAiB,GAAG,EAAE,CAAC,IAAI,CAAC;AAErD,kEAAkE;AAClE,mEAAmE;AACnE,mEAAmE;AACnE,6DAA6D;AAC7D,MAAM,CAAC,MAAM,cAAc,GAAiB,CAAC,GAAG,EAAE,EAAE;IAClD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;IACnE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,SAAS,CAAC,QAAQ,CAAC;IAC5B,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;IACvE,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,WAAW,CAAC,QAAQ,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAExD,iEAAiE;AACjE,gEAAgE;AAChE,UAAU;AACV,MAAM,kBAAkB,GAAa;IACnC,gGAAgG;IAChG,iFAAiF;IACjF,iFAAiF;IACjF,6DAA6D;IAC7D,2BAA2B;IAC3B,oBAAoB;IACpB,qBAAqB;IACrB,yBAAyB;IACzB,gDAAgD;IAChD,gDAAgD;IAChD,6CAA6C;IAC7C,sCAAsC;IACtC,iBAAiB;IACjB,oCAAoC;IACpC,kEAAkE;IAClE,oCAAoC;IACpC,oCAAoC;IACpC,6GAA6G;CAC9G,CAAC;AAEF,SAAS,cAAc,CAAC,QAAuC;IAC7D,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,aAAa,CACpB,OAAqC;IAErC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,QAAQ,IAAI,IAAI,CAAC;AACxE,CAAC;AAED,+DAA+D;AAC/D,gEAAgE;AAChE,8DAA8D;AAC9D,4DAA4D;AAC5D,+CAA+C;AAC/C,MAAM,CAAC,MAAM,YAAY,GAAiB,CAAC,GAAG,EAAE,EAAE;IAChD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC;IAChC,IAAI,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,IAAI,WAAW,GAAG,CAAC,CAAC;AAEpB,qEAAqE;AACrE,qEAAqE;AACrE,wDAAwD;AACxD,EAAE;AACF,iEAAiE;AACjE,oEAAoE;AACpE,iEAAiE;AACjE,mEAAmE;AACnE,uCAAuC;AACvC,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAY;IACzC,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAA4B,CAAC;QACvC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CACN,qBAAqB,IAAI,0EAA0E,CACpG,CAAC;YACF,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC;QAC1D,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,qEAAqE;IACrE,+DAA+D;IAC/D,sCAAsC;IACtC,WAAW,IAAI,CAAC,CAAC;IACjB,MAAM,GAAG,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,MAAM,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC;IACzE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,CAA0B,CAAC;QACzD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC;QACvB,IAAI,OAAO,EAAE,KAAK,UAAU,EAAE,CAAC;YAC7B,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,gDAAgD,CAAC,CAAC;YAClE,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;QAC9C,OAAO,EAAkB,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,YAAa,GAAa,CAAC,OAAO,cAAc,CAAC,CAAC;QACzE,OAAO,YAAY,CAAC;IACtB,CAAC;AACH,CAAC"}
|