@ibartel74/pi-automode-ext 1.0.0

package/extensions/auto-mode/permissions.ts

@@ -0,0 +1,667 @@
+import {
+  analyzeBash,
+  type BashAnalysis,
+  type BashCommandAnalysis,
+  type BashRedirectAnalysis,
+} from "./bash.ts";
+import { PATH_BEARING_TOOLS } from "./constants.ts";
+import type { ToolPattern } from "./types.ts";
+import {
+  extractInputPath,
+  expandHomePattern,
+  normalizePathForMatch,
+  resolveInputPath,
+  resolvePathForPolicy,
+  resolveToolInputPath,
+} from "./paths.ts";
+
+export const MAX_WILDCARD_PATTERN_LENGTH = 4096;
+export const MAX_WILDCARD_INPUT_LENGTH = 1024 * 1024;
+
+const bashPatternAnalyses = new WeakMap<ToolPattern, BashAnalysis>();
+
+/** Preserve the previous non-Unicode RegExp `/i` case-equivalence rules. */
+function canonicalizeCase(value: string): string {
+  let canonical = "";
+  for (let index = 0; index < value.length; index += 1) {
+    const character = value[index] ?? "";
+    const uppercase = character.toUpperCase();
+    if (
+      uppercase.length !== 1 ||
+      (character.charCodeAt(0) >= 128 && uppercase.charCodeAt(0) < 128)
+    ) {
+      canonical += character;
+    } else {
+      canonical += uppercase;
+    }
+  }
+  return canonical;
+}
+
+function normalizeToolName(name: string): string {
+  const lower = name.trim().replace(/^@/, "").toLowerCase();
+  const aliases: Record<string, string> = {
+    bash: "bash",
+    read: "read",
+    edit: "edit",
+    write: "write",
+    grep: "grep",
+    find: "find",
+    ls: "ls",
+  };
+  return aliases[lower] ?? lower;
+}
+
+/**
+ * Parse Pi permission entries such as `bash(git push *)`.
+ *
+ * Capitalized names such as `Bash(...)` are accepted as a convenience, but Pi's
+ * actual tool names are lowercase. Scoped entries stay scoped: we do not flatten
+ * `bash(git status *)` into a blanket `bash` permission.
+ */
+export function parseToolPattern(value: unknown): ToolPattern | undefined {
+  if (typeof value !== "string") return undefined;
+  const raw = value.trim();
+  if (!raw) return undefined;
+
+  const match = raw.match(/^@?([A-Za-z0-9_-]+)(?:\((.*)\))?$/s);
+  if (!match) return { raw };
+  const toolName = normalizeToolName(match[1] ?? "");
+  const argumentPattern = match[2];
+  const bashPatternAnalysis = toolName === "bash" && argumentPattern
+    ? analyzeBash(argumentPattern)
+    : undefined;
+  const pattern: ToolPattern = { raw, toolName, argumentPattern };
+  if (bashPatternAnalysis) bashPatternAnalyses.set(pattern, bashPatternAnalysis);
+  return pattern;
+}
+
+/**
+ * Generate an exact-match `permissions.allow` rule for the current action, used
+ * by the interactive-confirmation "always allow" choices. Returns undefined
+ * when no safe exact rule exists: pattern metacharacters in the target would
+ * widen the match into a wildcard, implicit search roots (grep/find/ls without
+ * a path) are not persistable, and tools without a known argument cannot be
+ * scoped.
+ */
+export function allowRuleForAction(
+  toolName: string,
+  input: Record<string, unknown>,
+): string | undefined {
+  const target = toolName === "bash"
+    ? (typeof input.command === "string" ? input.command.trim() : "")
+    : extractInputPath(toolName, input) ?? "";
+  if (!target || target === ".") return undefined;
+  if (target.length > MAX_WILDCARD_PATTERN_LENGTH) return undefined;
+  if (/[*()\n\r]/.test(target)) return undefined;
+  return `${toolName}(${target})`;
+}
+
+/**
+ * Validate a user-edited allow rule from the interactive-confirmation dialog.
+ * Unlike `allowRuleForAction`, wildcards are permitted — the user explicitly
+ * chose the scope — but the rule must parse as a scoped tool pattern for the
+ * same tool as the blocked action. Returns the normalized rule, or undefined
+ * when the input is unusable.
+ */
+export function normalizeEditedAllowRule(
+  toolName: string,
+  value: unknown,
+): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  if (!trimmed || trimmed.length > MAX_WILDCARD_PATTERN_LENGTH) return undefined;
+  if (/[\n\r]/.test(trimmed)) return undefined;
+  const pattern = parseToolPattern(trimmed);
+  if (!pattern?.argumentPattern) return undefined;
+  if (pattern.toolName !== normalizeToolName(toolName)) return undefined;
+  return pattern.raw;
+}
+
+function literalPrefixTable(value: string): number[] {
+  const table = new Array<number>(value.length).fill(0);
+  let prefixLength = 0;
+  for (let index = 1; index < value.length; index += 1) {
+    while (
+      prefixLength > 0 && value[index] !== value[prefixLength]
+    ) {
+      prefixLength = table[prefixLength - 1] ?? 0;
+    }
+    if (value[index] === value[prefixLength]) prefixLength += 1;
+    table[index] = prefixLength;
+  }
+  return table;
+}
+
+function findLiteral(
+  value: string,
+  literal: string,
+  start: number,
+  end: number,
+): number {
+  const prefixTable = literalPrefixTable(literal);
+  let matched = 0;
+  for (let index = start; index < end; index += 1) {
+    while (matched > 0 && value[index] !== literal[matched]) {
+      matched = prefixTable[matched - 1] ?? 0;
+    }
+    if (value[index] === literal[matched]) matched += 1;
+    if (matched === literal.length) return index - literal.length + 1;
+  }
+  return -1;
+}
+
+export type WildcardOverflowPolicy = "match" | "no-match";
+
+/**
+ * Match a case-insensitive `*` wildcard pattern in linear time.
+ *
+ * `*` matches zero or more characters, including newlines and path separators.
+ * Denial callers use `match` for over-limit values so they fail closed. Allow
+ * callers use `no-match` so an oversized input cannot broaden an allow rule.
+ */
+export function matchesWildcardPattern(
+  pattern: string,
+  value: string,
+  overflowPolicy: WildcardOverflowPolicy = "match",
+): boolean {
+  if (
+    pattern.length > MAX_WILDCARD_PATTERN_LENGTH ||
+    value.length > MAX_WILDCARD_INPUT_LENGTH
+  ) {
+    return overflowPolicy === "match";
+  }
+
+  const normalizedPattern = canonicalizeCase(pattern);
+  const normalizedValue = canonicalizeCase(value);
+  if (!normalizedPattern.includes("*")) {
+    return normalizedPattern === normalizedValue;
+  }
+
+  const startsWithWildcard = normalizedPattern.startsWith("*");
+  const endsWithWildcard = normalizedPattern.endsWith("*");
+  const literals = normalizedPattern.split("*").filter(Boolean);
+  if (literals.length === 0) return true;
+
+  let literalIndex = 0;
+  let valueIndex = 0;
+  let lastLiteralIndex = literals.length;
+
+  if (!startsWithWildcard) {
+    const prefix = literals[0] ?? "";
+    if (!normalizedValue.startsWith(prefix)) return false;
+    valueIndex = prefix.length;
+    literalIndex = 1;
+  }
+
+  let searchEnd = normalizedValue.length;
+  if (!endsWithWildcard) {
+    const suffix = literals[literals.length - 1] ?? "";
+    searchEnd -= suffix.length;
+    if (
+      searchEnd < valueIndex ||
+      !normalizedValue.endsWith(suffix)
+    ) {
+      return false;
+    }
+    lastLiteralIndex -= 1;
+  }
+
+  for (; literalIndex < lastLiteralIndex; literalIndex += 1) {
+    const literal = literals[literalIndex] ?? "";
+    const found = findLiteral(
+      normalizedValue,
+      literal,
+      valueIndex,
+      searchEnd,
+    );
+    if (found < 0) return false;
+    valueIndex = found + literal.length;
+  }
+
+  return true;
+}
+
+export function normalizePermissionPathForMatch(
+  path: string,
+  platform: NodeJS.Platform = process.platform,
+): string {
+  return platform === "win32" ? path.replace(/\\/g, "/") : path;
+}
+
+function pathArgumentsForMatch(
+  toolName: string,
+  cwd: string,
+  value: string,
+  overflowPolicy: WildcardOverflowPolicy,
+): string[] {
+  const resolved = resolveToolInputPath(toolName, cwd, value) ?? value;
+  const canonical = resolvePathForPolicy(resolved);
+  const candidates = canonical
+    ? [canonical, normalizePathForMatch(canonical, cwd)]
+    : [];
+  if (overflowPolicy === "match") {
+    candidates.push(resolved, normalizePathForMatch(resolved, cwd));
+  }
+  return [...new Set(
+    candidates.map((candidate) => normalizePermissionPathForMatch(candidate)),
+  )];
+}
+
+function getPrimaryArguments(
+  toolName: string,
+  input: Record<string, unknown>,
+  cwd: string,
+  overflowPolicy: WildcardOverflowPolicy,
+): string[] {
+  if (toolName === "bash" && typeof input.command === "string") {
+    return [input.command];
+  }
+  if (
+    (toolName === "read" || toolName === "write" || toolName === "edit") &&
+    typeof input.path === "string"
+  ) {
+    return pathArgumentsForMatch(toolName, cwd, input.path, overflowPolicy);
+  }
+  if (toolName === "grep" && typeof input.pattern === "string") {
+    return [input.pattern];
+  }
+  if (
+    (toolName === "find" || toolName === "ls") &&
+    typeof input.path === "string"
+  ) {
+    return pathArgumentsForMatch(toolName, cwd, input.path, overflowPolicy);
+  }
+  return [JSON.stringify(input)];
+}
+
+function isPermissionPathTool(toolName: string): boolean {
+  return toolName === "read" ||
+    toolName === "write" ||
+    toolName === "edit" ||
+    toolName === "find" ||
+    toolName === "ls";
+}
+
+export function appendPermissionPathPatternSuffix(
+  scope: string,
+  suffix: string,
+): string {
+  const normalizedScope = withoutTrailingSlash(
+    normalizePermissionPathForMatch(scope),
+  );
+  return normalizedScope.endsWith("/")
+    ? `${normalizedScope}${suffix}`
+    : `${normalizedScope}/${suffix}`;
+}
+
+function permissionPathPatternVariants(
+  pattern: string,
+  cwd: string,
+): string[] {
+  const expanded = normalizePermissionPathForMatch(expandHomePattern(pattern));
+  const wildcardIndex = expanded.indexOf("*");
+  if (wildcardIndex === -1) {
+    const resolved = resolveInputPath(cwd, expanded);
+    const canonical = resolved ? resolvePathForPolicy(resolved) : undefined;
+    return [...new Set(
+      [expanded, resolved, canonical]
+        .filter((value): value is string => !!value)
+        .map((value) => normalizePermissionPathForMatch(value)),
+    )];
+  }
+
+  const fixedPrefix = expanded.slice(0, wildcardIndex);
+  const lastSlash = fixedPrefix.lastIndexOf("/");
+  if (lastSlash < 0) return [expanded];
+  const fixedScope = fixedPrefix.slice(0, lastSlash) || "/";
+  const resolvedScope = resolveInputPath(cwd, fixedScope);
+  if (!resolvedScope) return [expanded];
+  const canonicalScope = resolvePathForPolicy(resolvedScope);
+  const suffix = expanded.slice(lastSlash).replace(/^\/+/, "");
+  return [...new Set([
+    expanded,
+    appendPermissionPathPatternSuffix(resolvedScope, suffix),
+    ...(canonicalScope
+      ? [appendPermissionPathPatternSuffix(canonicalScope, suffix)]
+      : []),
+  ])];
+}
+
+/**
+ * Whether a resolved absolute path matches a configured path-denial pattern.
+ * Patterns support `~`/`$HOME` expansion and `*` globs, where `*` matches any
+ * characters, including `/`. Matching is case-insensitive and
+ * conservative-safe: over-matching only blocks more.
+ */
+export function matchesDeniedPath(
+  resolvedPath: string,
+  deniedPaths: string[],
+): boolean {
+  const normalized = resolvedPath.replace(/\\/g, "/").normalize("NFC");
+  return deniedPaths.some((pattern) =>
+    deniedPatternVariants(pattern).some((variant) =>
+      matchesWildcardPattern(variant.normalize("NFC"), normalized)
+    )
+  );
+}
+
+function deniedPatternVariants(pattern: string): string[] {
+  const expanded = expandHomePattern(pattern).replace(/\\/g, "/");
+  const wildcardIndex = expanded.indexOf("*");
+  if (wildcardIndex === -1) {
+    const canonical = resolvePathForPolicy(expanded)?.replace(/\\/g, "/");
+    return canonical && canonical !== expanded
+      ? [expanded, canonical]
+      : [expanded];
+  }
+
+  const fixedPrefix = expanded.slice(0, wildcardIndex);
+  const lastSlash = fixedPrefix.lastIndexOf("/");
+  if (lastSlash < 0) return [expanded];
+  const fixedScope = fixedPrefix.slice(0, lastSlash) || "/";
+  const canonicalScope = resolvePathForPolicy(fixedScope)?.replace(/\\/g, "/");
+  if (!canonicalScope || canonicalScope === fixedScope) return [expanded];
+  const suffix = expanded.slice(lastSlash).replace(/^\/+/, "");
+  const canonicalPattern = canonicalScope === "/"
+    ? `/${suffix}`
+    : `${withoutTrailingSlash(canonicalScope)}/${suffix}`;
+  return canonicalPattern === expanded
+    ? [expanded]
+    : [expanded, canonicalPattern];
+}
+
+function withoutTrailingSlash(path: string): string {
+  if (path === "/" || /^[A-Za-z]:\/$/.test(path)) return path;
+  return path.replace(/\/+$/, "");
+}
+
+function wildcardCanMatchDescendant(root: string, pattern: string): boolean {
+  const normalizedRoot = withoutTrailingSlash(
+    canonicalizeCase(root.replace(/\\/g, "/").normalize("NFC")),
+  );
+  const prefix = normalizedRoot === "/" || /^[A-Za-z]:\/$/.test(normalizedRoot)
+    ? normalizedRoot
+    : `${normalizedRoot}/`;
+  const normalizedPattern = canonicalizeCase(pattern.normalize("NFC"));
+  const wildcardIndex = normalizedPattern.indexOf("*");
+  if (wildcardIndex < 0) {
+    return normalizedPattern.length > prefix.length &&
+      normalizedPattern.startsWith(prefix);
+  }
+
+  const fixedPrefix = normalizedPattern.slice(0, wildcardIndex);
+  return prefix.startsWith(fixedPrefix) || fixedPrefix.startsWith(prefix);
+}
+
+/**
+ * Whether a recursive search scope can contain a path matched by `deniedPaths`.
+ *
+ * The check asks whether the wildcard pattern can match any path beginning
+ * with the search-root prefix. It does not scan the search tree.
+ */
+export function recursiveSearchMayReachDeniedPath(
+  resolvedRoot: string,
+  deniedPaths: string[],
+): boolean {
+  if (resolvedRoot.length > MAX_WILDCARD_INPUT_LENGTH) {
+    return deniedPaths.length > 0;
+  }
+  return deniedPaths.some((pattern) => {
+    if (pattern.length > MAX_WILDCARD_PATTERN_LENGTH) return true;
+    return deniedPatternVariants(pattern).some((expanded) =>
+      wildcardCanMatchDescendant(resolvedRoot, expanded)
+    );
+  });
+}
+
+function normalizedBashArgumentPattern(pattern: ToolPattern): string {
+  const patternAnalysis = bashPatternAnalyses.get(pattern);
+  if (
+    patternAnalysis &&
+    patternAnalysis.errors.length === 0 &&
+    patternAnalysis.redirects.length === 0 &&
+    isStructurallyPlainSingleCommand(patternAnalysis)
+  ) {
+    return patternAnalysis.commands[0]?.text ?? pattern.argumentPattern ?? "";
+  }
+  return pattern.argumentPattern ?? "";
+}
+
+function matchesBashArgumentPattern(
+  argumentPattern: string,
+  candidate: string,
+  overflowPolicy: WildcardOverflowPolicy,
+): boolean {
+  if (matchesWildcardPattern(argumentPattern, candidate, overflowPolicy)) {
+    return true;
+  }
+  if (overflowPolicy !== "match" || !argumentPattern.endsWith(" *")) {
+    return false;
+  }
+  return matchesWildcardPattern(
+    argumentPattern.slice(0, -2),
+    candidate,
+    overflowPolicy,
+  );
+}
+
+/** Match a scoped permission rule against a concrete tool call. */
+export function matchesToolPattern(
+  pattern: ToolPattern,
+  toolName: string,
+  input: Record<string, unknown>,
+  cwd: string,
+  overflowPolicy: WildcardOverflowPolicy = "match",
+  bashAnalysis?: BashAnalysis,
+): boolean {
+  if (!pattern.toolName) return overflowPolicy === "match";
+  if (pattern.toolName !== normalizeToolName(toolName)) return false;
+  if (pattern.argumentPattern === undefined) return true;
+  if (pattern.argumentPattern.trim() === "") {
+    return overflowPolicy === "match";
+  }
+  if (
+    toolName === "bash" &&
+    (bashPatternAnalyses.get(pattern)?.errors.length ?? 0) > 0
+  ) {
+    return overflowPolicy === "match";
+  }
+  if (toolName === "bash" && bashAnalysis) {
+    if (bashAnalysis.errors.length > 0) return overflowPolicy === "match";
+    const candidates = overflowPolicy === "match"
+      ? [bashAnalysis.source, ...bashAnalysis.commands.map((command) => command.text)]
+      : [bashAnalysis.source];
+    const argumentPattern = normalizedBashArgumentPattern(pattern);
+    return candidates.some((candidate) =>
+      matchesBashArgumentPattern(argumentPattern, candidate, overflowPolicy)
+    );
+  }
+  const argumentPatterns = isPermissionPathTool(toolName)
+    ? permissionPathPatternVariants(pattern.argumentPattern, cwd)
+    : [pattern.argumentPattern];
+  const primaryArguments = getPrimaryArguments(
+    toolName,
+    input,
+    cwd,
+    overflowPolicy,
+  );
+  return argumentPatterns.some((argumentPattern) =>
+    primaryArguments.some((primary) =>
+      matchesWildcardPattern(argumentPattern, primary, overflowPolicy)
+    )
+  );
+}
+
+/** Return the normalized Bash command that matched a scoped permission rule. */
+export function matchingBashCommandText(
+  pattern: ToolPattern,
+  bashAnalysis: BashAnalysis | undefined,
+  overflowPolicy: WildcardOverflowPolicy = "match",
+): string | undefined {
+  if (!bashAnalysis || pattern.toolName !== "bash") return undefined;
+  if (bashAnalysis.errors.length > 0) return undefined;
+  if (!pattern.argumentPattern) return undefined;
+  const argumentPattern = normalizedBashArgumentPattern(pattern);
+  const command = bashAnalysis.commands.find((candidate) =>
+    matchesBashArgumentPattern(argumentPattern, candidate.text, overflowPolicy)
+  );
+  if (command) return command.text;
+  return matchesBashArgumentPattern(argumentPattern, bashAnalysis.source, overflowPolicy)
+    ? bashAnalysis.source
+    : undefined;
+}
+
+function redirectListsMatch(
+  patternRedirects: BashRedirectAnalysis[],
+  inputRedirects: BashRedirectAnalysis[],
+): boolean {
+  if (patternRedirects.length !== inputRedirects.length) return false;
+  return patternRedirects.every((pattern, index) => {
+    const input = inputRedirects[index];
+    if (!input || pattern.heredoc || input.heredoc || input.targetDynamic) {
+      return false;
+    }
+    if (
+      pattern.operator !== input.operator ||
+      pattern.fileDescriptor !== input.fileDescriptor ||
+      pattern.variableName !== input.variableName
+    ) {
+      return false;
+    }
+    if (pattern.target === undefined) return input.target === undefined;
+    if (input.target === undefined) return false;
+    return matchesWildcardPattern(pattern.target, input.target, "no-match");
+  });
+}
+
+function commandMatchesAllowPattern(
+  patternCommand: BashCommandAnalysis,
+  inputCommand: BashCommandAnalysis,
+): boolean {
+  return matchesWildcardPattern(
+    patternCommand.text,
+    inputCommand.text,
+    "no-match",
+  ) && redirectListsMatch(patternCommand.redirects, inputCommand.redirects);
+}
+
+function structuresMatch(pattern: BashAnalysis, input: BashAnalysis): boolean {
+  return pattern.structure.length === input.structure.length &&
+    pattern.structure.every((token, index) => token === input.structure[index]);
+}
+
+function allRedirectsAreCommandRedirects(analysis: BashAnalysis): boolean {
+  return analysis.redirects.length === analysis.commands.reduce(
+    (count, command) => count + command.redirects.length,
+    0,
+  );
+}
+
+function isStructurallyPlainSingleCommand(analysis: BashAnalysis): boolean {
+  if (analysis.commands.length !== 1) return false;
+  if (analysis.structure.length !== 3 + analysis.redirects.length) return false;
+  if (analysis.structure[0] !== "script:1") return false;
+  if (analysis.structure[1] !== "node:Statement:foreground:0") return false;
+  if (!/^node:Command:\d+:\d+$/.test(analysis.structure[2] ?? "")) {
+    return false;
+  }
+  return analysis.structure.slice(3).every((token) =>
+    token.startsWith("redirect:")
+  );
+}
+
+function supportsPerCommandAllowPatterns(analysis: BashAnalysis): boolean {
+  return analysis.structure.every((token) =>
+    token.startsWith("script:") ||
+    token.startsWith("node:Statement:foreground:") ||
+    token.startsWith("node:Command:") ||
+    token.startsWith("node:AndOr:") ||
+    token.startsWith("node:Pipeline:plain:plain:") ||
+    token.startsWith("redirect:")
+  );
+}
+
+/** Whether permission allow rules cover the complete tool call. */
+export function matchesAllowedToolPatterns(
+  patterns: ToolPattern[],
+  toolName: string,
+  input: Record<string, unknown>,
+  cwd: string,
+  bashAnalysis?: BashAnalysis,
+): boolean {
+  if (toolName !== "bash" || !bashAnalysis) {
+    return patterns.some((pattern) =>
+      matchesToolPattern(pattern, toolName, input, cwd, "no-match")
+    );
+  }
+  if (
+    bashAnalysis.errors.length > 0 ||
+    bashAnalysis.commands.length === 0 ||
+    !bashAnalysis.allowStructureSafe
+  ) {
+    return false;
+  }
+  if (
+    bashAnalysis.commands.some((command) =>
+      command.dynamicName || command.dynamicShellScript
+    )
+  ) {
+    return false;
+  }
+
+  for (const pattern of patterns) {
+    if (pattern.toolName !== "bash") continue;
+    const patternAnalysis = bashPatternAnalyses.get(pattern);
+    if (
+      !patternAnalysis ||
+      patternAnalysis.errors.length > 0 ||
+      !patternAnalysis.allowStructureSafe ||
+      isStructurallyPlainSingleCommand(patternAnalysis) ||
+      patternAnalysis.commands.length !== bashAnalysis.commands.length ||
+      !structuresMatch(patternAnalysis, bashAnalysis) ||
+      !redirectListsMatch(patternAnalysis.redirects, bashAnalysis.redirects)
+    ) {
+      continue;
+    }
+    if (
+      patternAnalysis.commands.every((patternCommand, index) => {
+        const inputCommand = bashAnalysis.commands[index];
+        return !!inputCommand &&
+          commandMatchesAllowPattern(patternCommand, inputCommand);
+      })
+    ) {
+      return true;
+    }
+  }
+
+  const hasBareBashPattern = patterns.some((pattern) =>
+    pattern.toolName === "bash" && pattern.argumentPattern === undefined
+  );
+  if (
+    !hasBareBashPattern &&
+    !supportsPerCommandAllowPatterns(bashAnalysis)
+  ) {
+    return false;
+  }
+  if (!allRedirectsAreCommandRedirects(bashAnalysis)) return false;
+  return bashAnalysis.commands.every((command) =>
+    patterns.some((pattern) => {
+      if (pattern.toolName !== "bash") return false;
+      if (pattern.argumentPattern === undefined) {
+        return command.redirects.length === 0;
+      }
+      const patternAnalysis = bashPatternAnalyses.get(pattern);
+      if (
+        !patternAnalysis ||
+        patternAnalysis.errors.length > 0 ||
+        !isStructurallyPlainSingleCommand(patternAnalysis)
+      ) {
+        return false;
+      }
+      const patternCommand = patternAnalysis.commands[0];
+      return !!patternCommand &&
+        commandMatchesAllowPattern(patternCommand, command);
+    })
+  );
+}