@klarkxy/dsh-safe-auto 0.2.0-rc.3 → 0.2.1

package/src/policy.js

@@ -1,12 +1,20 @@
-import { shellRefusals } from './shell-command.js';
+import { analyzeShell, isReadonly, isSafeStaticExposure, shellRefusals } from './shell-command.js';
+import { commandForPolicy } from './host-runtime.js';
+import { credentialSourcePath, isCredentialPath, isMutationProtectedPath } from './credential-paths.js';
 
 const SHELL_TOOLS = new Set(['shell', 'bash', 'pwsh']);
-const PROTECTED = /(?:^|[\\/])(?:\.git|\.ssh|\.aws|\.gnupg|\.dsh|\.claude|\.agents|\.github|\.kube|\.azure|\.config)(?:[\\/]|$)|(?:^|[\\/])(?:\.env(?:\.[^\\/]*)?|\.npmrc|\.netrc|\.pypirc|\.gitconfig|\.bashrc|\.zshrc|\.profile|AGENTS(?:\.local)?\.md|CLAUDE\.md|id_rsa|id_ed25519|credentials)(?:[\\/]|$)|\.(?:pem|key|p12|pfx)$/i;
+const READ_TOOLS = new Set(['read', 'read_image', 'grep']);
 const DANGEROUS_PROGRAM = /^(?:sudo|su|doas|rm|rmdir|del|erase|mkfs(?:\..*)?|shutdown|reboot|curl|wget|nc|ncat|ssh|scp|sftp|powershell|pwsh|bash|sh|eval|exec|env|xargs)$/i;
 const SECRET = /\b(?:sk-|ghp_|github_pat_|xox[baprs]-)[A-Za-z0-9_-]{8,}|\bBearer\s+\S+|(?:password|api[_-]?key|token|secret)["']?\s*[:=]\s*\S+/i;
 const verdict = (kind, code) => ({ kind, code });
 export const containsSecret = text => SECRET.test(text);
 
+// These files mix normal settings with possible secrets. Native read can
+// sanitize values; raw shell content readers cannot. Directory metadata and
+// literal output remain usable, and package.json/generic JSON are not denied.
+const shellMixedConfigPath = path => /(?:^|\/)(?:\.env(?:\.[^/]*)?|\.npmrc|\.pypirc|\.gitconfig)$|(?:^|\/)\.(?:git|kube|aws)\/config$|(?:^|\/)\.docker\/config\.json$|(?:^|\/)\.(?:codex|dsh|claude|agents)\/(?:[^/]+\/)*(?:config|settings(?:\.local)?|cordis)\.(?:toml|ya?ml|jsonc?)$/.test(credentialSourcePath(path));
+const readAccess = call => READ_TOOLS.has(call?.tool) || call?.tool === 'str_replace_editor' && call?.args?.command === 'view';
+
 /** Narrow lexer, NOT a shell parser. Only used to recognize a bare dangerous program name. */
 export function simpleCommand(command) {
   return typeof command === 'string' && command.length <= 4096 &&
@@ -19,17 +27,25 @@ export function simpleCommand(command) {
 export function hardRisk(call) {
   const args = call?.args ?? {};
   for (const path of [args.file_path, args.path]) {
-    if (typeof path === 'string' && PROTECTED.test(path)) return verdict('deny', 'PROTECTED_PATH');
+    if (typeof path === 'string' && (isCredentialPath(path) || !readAccess(call) && isMutationProtectedPath(path))) {
+      return verdict('deny', 'PROTECTED_PATH');
+    }
   }
   if (SHELL_TOOLS.has(call?.tool) && typeof args.command === 'string') {
-    if (args.command.split(/\s+/).some(p => PROTECTED.test(p)) || containsSecret(args.command)) return verdict('deny', 'SENSITIVE_COMMAND');
+    const screened = commandForPolicy(call);
+    if (containsSecret(args.command)) return verdict('deny', 'SENSITIVE_COMMAND');
+    const analysis = analyzeShell(screened), readonly = isReadonly(analysis);
+    const safeExposure = isSafeStaticExposure(analysis);
     // Check decoded literal argv, assignment and redirect values, including
     // quote concatenation. Refusal-only decoding also survives an unrelated
     // dynamic fragment; it cannot establish safety or grant permission.
-    const refusals = shellRefusals(args.command);
-    for (const value of refusals.values) {
-      if (containsSecret(value) || PROTECTED.test(value) ||
-          value.split(/[=:]/).some(part => PROTECTED.test(part))) return verdict('deny', 'SENSITIVE_COMMAND');
+    // Only attested runner entry positions differ; all data operands remain.
+    const refusals = shellRefusals(screened);
+    for (const value of [...screened.split(/\s+/), ...refusals.values]) {
+      const parts = [value, ...value.split(/[=:]/)];
+      if (containsSecret(value) || parts.some(isCredentialPath) ||
+          !readonly && parts.some(isMutationProtectedPath)) return verdict('deny', 'SENSITIVE_COMMAND');
+      if (readonly && !safeExposure && parts.some(shellMixedConfigPath)) return verdict('deny', 'USE_SAFE_READ');
     }
     // Known literal roots remain refusals even when their arguments are not
     // statically provable. Unparseable commands keep the legacy bare check.

package/src/review-context.js

@@ -14,6 +14,10 @@ export function authority(session) {
   const messages = [];
   let bytes = 0, task, intent, incomplete = false;
   for (const [index, event] of events.entries()) {
+    // 约定禁例：source.kind === 'user' 不能当真人判据。此处安全依赖两道闸：
+    // 上方 isSubagentSession(session) 排除子线程，以及下游 assessApproval 再核授权。
+    // 宿主若改变事件来源语义，这道过滤会失效；若宿主把委派提示注入父会话为 user 事件，
+    // 此处授权面会扩大，评审模型 prompt 构建前必须复核。
     if (event?.type !== 'user/message' || event.data?.source?.kind !== 'user') continue;
     task = event.seq ?? index;
     const blocks = event.data.content;

package/src/review-paths.js

@@ -0,0 +1,53 @@
+import path from 'node:path';
+
+const shellTools = new Set(['bash', 'pwsh']);
+const fileTools = new Set(['write', 'edit']);
+const pathText = value => typeof value === 'string' && Boolean(value.trim()) && !/[\x00-\x1f\x7f]/.test(value);
+
+/**
+ * Resolve only the coordinates used for review, never execution arguments.
+ * These are lexical absolute paths, NOT realpath/canonical filesystem identities.
+ * Evidence collection must still use fs.resolve/processPath/contains before reads.
+ *
+ * Native tool-pwsh resolves relative workdir against header.cwd; tool-bash uses
+ * sandboxPolicy.workspaceRoot first. File mutations pass that policy root as
+ * fs.resolve's cwd. Keep these separate even when a normal session makes them equal.
+ * processPathFromHostPath is an optional, synchronous host-world identity check;
+ * it cannot establish locality when a provider translates or withholds a path.
+ */
+export function resolveReviewPaths(call, fs, pathImpl = path) {
+  const unavailable = () => ({ localExecution: false });
+  try {
+    if (typeof fs?.processPathFromHostPath !== 'function') return unavailable();
+    const fullyAbsolute = value => pathText(value) && pathImpl.isAbsolute(value) &&
+      (pathImpl.sep !== '\\' || /^[A-Za-z]:[\\/]|^[\\/]{2}[^\\/]+[\\/][^\\/]+/.test(value));
+    const normalizeAbsolute = value => fullyAbsolute(value) ? pathImpl.normalize(value) : undefined;
+    const cwd = normalizeAbsolute(call?.cwd);
+    const root = normalizeAbsolute(call?.sandbox?.workspaceRoot ?? call?.cwd);
+    if (!cwd || !root) return unavailable();
+    const resolveFrom = (value, base) => {
+      if (!pathText(value)) return undefined;
+      if (pathImpl.isAbsolute(value)) return normalizeAbsolute(value);
+      // Windows drive-relative paths consult ambient per-drive cwd; do not infer it.
+      if (pathImpl.sep === '\\' && /^[A-Za-z]:/.test(value)) return undefined;
+      return pathImpl.resolve(base, value);
+    };
+    let result;
+    if (shellTools.has(call.tool)) {
+      const base = call.tool === 'pwsh' ? cwd : root;
+      const workdir = call.args?.workdir === undefined ? base : resolveFrom(call.args.workdir, base);
+      if (!workdir) return unavailable();
+      result = { workdir };
+    } else if (fileTools.has(call.tool)) {
+      const filePath = resolveFrom(call.args?.file_path, root);
+      if (!filePath) return unavailable();
+      result = { filePath };
+    } else return unavailable();
+    for (const value of [cwd, root, ...Object.values(result)]) {
+      if (fs.processPathFromHostPath(value) !== value) return unavailable();
+    }
+    return { localExecution: true, ...result };
+  } catch {
+    return unavailable();
+  }
+}

package/src/shell-command.js

@@ -426,7 +426,6 @@ const READONLY_COMMANDS = new Map(Object.entries({
   which: grammar('-a --all', {}, { min: 1 }),
   echo: grammar('-n -e -E'),
   printf: printfReadonly,
-  printenv: grammar('-0 --null'),
   uname: grammar('-a -s -n -r -v -m -p -i -o --all --kernel-name --nodename --kernel-release --kernel-version --machine --processor --hardware-platform --operating-system', {}, { max: 0 }),
   id: grammar('-u -g -G -n -r -un -gn --user --group --groups --name --real', {}, { max: 1 }),
   whoami: grammar('', {}, { max: 0 }), groups: grammar(),
@@ -498,3 +497,51 @@ function readonlyInvocation(invocation) {
 export function isReadonly(analysis) {
   return analysis.ok && analysis.invocations.length > 0 && analysis.invocations.every(readonlyInvocation);
 }
+
+// Read-only is an integrity property, not a privacy guarantee: cat, grep,
+// Git object/config readers and ps can expose secrets without changing a file.
+// Static approval only covers metadata and already-literal output. Every
+// invocation in a pipeline must qualify; filters do not sanitize prior output.
+const STATIC_METADATA_COMMANDS = new Set([
+  'ls', 'stat', 'pwd', 'which', 'uname', 'id', 'whoami', 'groups', 'uptime',
+  'df', 'du', 'free', 'true', 'false', 'basename', 'dirname', 'realpath',
+  'readlink', 'tree', 'find', 'echo', 'printf',
+]);
+
+function gitStaticExposure(args) {
+  if (args.length === 1 && ['--version', 'version'].includes(args[0])) return true;
+  let index = 0;
+  // gitReadonly has already validated these exact original controls.
+  while (args[index]?.startsWith('-')) index += args[index] === '-c' ? 2 : 1;
+  const sub = args[index++], rest = args.slice(index);
+  switch (sub) {
+    case 'config': return rest.length === 2 && rest[0] === '--get' && ['user.name', 'user.email'].includes(rest[1]);
+    case 'branch': return grammar('-a --all -r --remotes --list --show-current --no-color', {},
+      { max: rest.includes('--list') ? Infinity : 0 })(rest);
+    case 'tag': return (rest.includes('--list') || rest.includes('-l')) && grammar('-l --list -i --ignore-case --no-color')(rest);
+    case 'rev-parse':
+    case 'ls-files':
+    case 'ls-tree': return true;
+    default: return false; // includes history, object contents, remote URLs and config enumeration
+  }
+}
+
+function staticExposureInvocation(invocation) {
+  if (!readonlyInvocation(invocation)) return false;
+  // Even a metadata command must not inherit arbitrary input file descriptors.
+  // Here-strings are fully literal; output redirects were checked above.
+  if (invocation.redirects.some(redirect => redirect.operator === '<')) return false;
+  const [program, ...args] = invocation.argv;
+  if (STATIC_METADATA_COMMANDS.has(program)) return true;
+  if (program === 'git') return gitStaticExposure(args);
+  // date --file can include raw input in parse-error output. Timestamp and
+  // literal date/format forms are safe; reference only reads file metadata.
+  if (program === 'date') return !args.some(arg => arg === '-f' || arg === '--file' || arg.startsWith('--file='));
+  return false;
+}
+
+/** Privacy proof kept separate from the no-mutation proof. Unknown or
+ * content-reading commands fall back to review, not a hard refusal. */
+export function isSafeStaticExposure(analysis) {
+  return analysis.ok && analysis.invocations.length > 0 && analysis.invocations.every(staticExposureInvocation);
+}

package/src/ui-host.js

@@ -1,5 +1,6 @@
 import { createControl, CHANNEL, REVIEW_FIELDS } from './control.js';
 import { registerHostRpc } from '@klarkxy/dsh-plugin-kit/host-rpc';
+import { registerModelSettings, notifyModelSettingsChanged } from '@klarkxy/dsh-plugin-kit/model-settings';
 
 export const name = 'dsh-safe-auto-ui-host';
 // Register on this fiber. connection.rpc.handle mounts routes on connection's
@@ -47,9 +48,26 @@ export async function apply(ctx) {
   let control;
   ctx.effect(() => async () => { await control?.dispose(); await domain.close(); });
   control = createControl(ctx.safeAutoRuntime.base, { table: domain.table('settings'), presets: ctx.permissionPresets,
-    sandboxPolicy: ctx.sandboxPolicy, sessions: ctx.sessions, onChange: () => ctx.safeAutoRuntime.invalidateApprovals?.() });
+    sandboxPolicy: ctx.sandboxPolicy, sessions: ctx.sessions, onChange: () => ctx.safeAutoRuntime.invalidateApprovals?.(),
+    onSettingsChanged: revision => notifyModelSettingsChanged(ctx, '@klarkxy/dsh-safe-auto', revision) });
   // Validate stored settings before publishing any UI endpoint.
   control.settingsView();
+  ctx.effect(() => registerModelSettings(ctx, {
+    ns: '@klarkxy/dsh-safe-auto', title: { zh: '安全自动', en: 'Safe Auto' },
+    read(signal) {
+      signal.throwIfAborted(); control.signal.throwIfAborted();
+      const { revision, values } = control.settingsView();
+      const current = { provider: values.provider, model: values.model,
+        ...(values.reasoningEffort ? { reasoningEffort: values.reasoningEffort } : {}) };
+      return { revision, fields: [{ path: ['model'], label: { zh: '审查模型', en: 'Reviewer model' }, current,
+        followLabel: { zh: '当前会话模型', en: 'Current conversation model' }, allowFollow: true }] };
+    },
+    async write(path, route, expectedRevision, signal) {
+      if (path.length !== 1 || path[0] !== 'model') throw new Error('Unknown Safe Auto model setting');
+      return control.call('settings.save', { values: { provider: route.provider, model: route.model,
+        reasoningEffort: route.reasoningEffort || '' }, expectedRevision }, signal);
+    },
+  }));
   ctx.effect(() => ctx.safeAutoRuntime.attach(control));
   ctx.effect(() => registerControlRoute(ctx, async (endpoint, payload, signal, source) => {
     try {