@lytharalab/dsh-cons-auto-review 1.1.0

package/src/preset-defaults.js

@@ -0,0 +1,85 @@
+/** A persisted CAutoR default must remain confined before DCAR activates. */
+export const DORMANT_PRESET = Object.freeze({
+  sandbox: "read-only",
+  approval: "never",
+  name: "CAutoR（DCAR 未启用）",
+  description: "DCAR 未启用时使用只读权限；启用后恢复 Con's 自动审查。",
+});
+
+export function isDormantPreset(spec) {
+  return spec && Object.entries(DORMANT_PRESET).every(([key, value]) => spec[key] === value);
+}
+
+/** Publish a live review preset and, for CAutoR, a guarded native default entry. */
+export function registerReviewPreset(service, entries, name, spec, admit) {
+  const table = service.presets;
+  const previous = name === "CAutoR" ? Object.getOwnPropertyDescriptor(table, name) : undefined;
+  const dormant = name === "CAutoR" && isDormantPreset(previous?.value);
+  if ((service.names.includes(name) && !dormant) || name === "auto" || name === "custom")
+    throw new Error(`DCAR preset ${name} already exists or is reserved`);
+  if (entries.has(name)) throw new Error(`DCAR preset ${name} already exists or is reserved`);
+  if (name === "CAutoR")
+    Object.defineProperty(table, name, { value: DORMANT_PRESET, configurable: true, enumerable: true, writable: true });
+  entries.set(name, { spec: Object.freeze({ ...spec }), admit });
+  const restore = (keepDefault) => {
+    if (name !== "CAutoR") return;
+    if (previous) Object.defineProperty(table, name, previous);
+    else if (!keepDefault) Reflect.deleteProperty(table, name);
+  };
+  try { service.emitCatalogChanged(); }
+  catch (error) { entries.delete(name); restore(false); throw error; }
+  let live = true;
+  return () => {
+    if (!live) return;
+    live = false;
+    const keepDefault = name === "CAutoR" && service.defaultPreset === name;
+    entries.delete(name);
+    restore(keepDefault);
+    service.emitCatalogChanged();
+  };
+}
+
+/** Persist a confined CAutoR entry through the host's normal config editor. */
+const persistenceKey = Symbol.for("dcar.default-persistence");
+export function attachDefaultPersistence(editor, service, admit) {
+  const provider = Object.getOwnPropertyDescriptor(service, "ctx")?.value?.fiber;
+  if (!provider) return () => {};
+  let registry = Object.getOwnPropertyDescriptor(editor, persistenceKey)?.value;
+  if (!registry) {
+    const previous = Object.getOwnPropertyDescriptor(editor, "edit");
+    let original;
+    for (let object = editor; object; object = Object.getPrototypeOf(object)) {
+      const descriptor = Object.getOwnPropertyDescriptor(object, "edit");
+      if (descriptor) { original = descriptor.value; break; }
+    }
+    if (typeof original !== "function") return () => {};
+    if (previous && !previous.configurable) throw new Error("DCAR cannot extend this config editor instance");
+    const handlers = new Map();
+    const wrapper = function (entry, change) {
+      const handler = handlers.get(entry.fiber);
+      if (!handler) return original.call(this, entry, change);
+      return original.call(this, entry, (current, inherited) => {
+        const next = change(current, inherited);
+        if ((next.defaultPreset ?? inherited.defaultPreset) !== "CAutoR") return next;
+        handler.admit();
+        const presets = next.presets ?? inherited.presets ?? handler.service.presets;
+        return { ...next, presets: { ...presets, CAutoR: { ...DORMANT_PRESET } } };
+      });
+    };
+    registry = { handlers, wrapper, previous };
+    Object.defineProperty(editor, "edit", { value: wrapper, configurable: true });
+    Object.defineProperty(editor, persistenceKey, { value: registry, configurable: true });
+  }
+  const handler = { service, admit };
+  registry.handlers.set(provider, handler);
+  return () => {
+    if (registry.handlers.get(provider) !== handler) return;
+    registry.handlers.delete(provider);
+    if (registry.handlers.size) return;
+    if (Object.getOwnPropertyDescriptor(editor, "edit")?.value === registry.wrapper) {
+      if (registry.previous) Object.defineProperty(editor, "edit", registry.previous);
+      else Reflect.deleteProperty(editor, "edit");
+    }
+    Reflect.deleteProperty(editor, persistenceKey);
+  };
+}

package/src/shell.js

@@ -0,0 +1,197 @@
+/** Conservative command grammar for unconfined execution. Unrecognized syntax escalates. */
+import { checkPaths, allow, escalate } from "./paths.js";
+/** Parse literal argv only; never evaluate a command or use a prefix permission match. */
+export function literalArgv(command) {
+  if (
+    typeof command !== "string" ||
+    !command.trim() ||
+    /[\r\n\x00-\x1f$`<>|;&(){}\\*?\[\]@]/.test(command)
+  )
+    return undefined;
+  const args = [];
+  let token = "",
+    started = false,
+    quote = "";
+  for (const ch of command.trim()) {
+    if (quote) {
+      if (ch === quote) quote = "";
+      else token += ch;
+      started = true;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      started = true;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      if (started) {
+        args.push(token);
+        token = "";
+        started = false;
+      }
+      continue;
+    }
+    if (/[\\*?!#]/.test(ch)) return undefined;
+    token += ch;
+    started = true;
+  }
+  if (quote) return undefined;
+  if (started) args.push(token);
+  if (args[0] && /^[A-Za-z_][A-Za-z0-9_]*=/.test(args[0])) return undefined;
+  return args.length ? args : undefined;
+}
+function same(a, b) {
+  return a.length === b.length && a.every((x, i) => x === b[i]);
+}
+/** Exact literal commands and checked workspace mutations can skip LLM review. */
+export async function checkShell(exec, ctx, c, signal) {
+  const a = exec.arguments;
+  if (!c.shell.enabled)
+    return escalate("SHELL_RULES_DISABLED", "Shell rules disabled");
+  if (
+    typeof a.command !== "string" ||
+    a.command.length > c.shell.maxCommandChars
+  )
+    return escalate("COMMAND_SIZE", "Command missing or too long");
+  const argv = literalArgv(a.command);
+  if (!argv)
+    return escalate(
+      "SHELL_SYNTAX",
+      "Expansion, compound syntax or scripts require LLM review",
+    );
+  const [exe, ...args] = argv;
+  const cwd = exec.agent.session.header.cwd;
+  if (a.workdir !== undefined) {
+    const checked = await checkPaths([a.workdir], "write", cwd, ctx, c, signal);
+    if (checked.kind !== "allow") return checked;
+  }
+  const base =
+    a.workdir === undefined
+      ? cwd
+      : String((await ctx.fs.resolve(a.workdir, { cwd, signal })).targetKey);
+  if (
+    c.shell.trustedCommands.some(
+      (cmd) => cmd.executable === exe && same(cmd.args, args),
+    )
+  )
+    return allow("TRUSTED_COMMAND", "Administrator configured this exact argv");
+  const isPwsh = exec.name === "pwsh";
+  // PowerShell resolves aliases and case-insensitive names; only canonical cmdlets are admitted.
+  const readExe = c.shell.readCommands.find((x) =>
+    isPwsh ? x.toLowerCase() === exe.toLowerCase() : x === exe,
+  );
+  if (readExe) {
+    if (isPwsh) {
+      if (
+        ![
+          "Get-Location",
+          "Get-ChildItem",
+          "Get-Content",
+          "Write-Output",
+        ].includes(readExe)
+      )
+        return escalate("UNKNOWN_COMMAND", "Unknown PowerShell read semantics");
+      if (readExe === "Get-Location")
+        return args.length
+          ? escalate("SHELL_OPTIONS", "Unsupported parameters")
+          : allow("READ_COMMAND", "Get-Location");
+      if (readExe === "Write-Output")
+        return args.some((x) => x.startsWith("-"))
+          ? escalate("SHELL_OPTIONS", "Unsupported parameters")
+          : allow("READ_COMMAND", "Literal output");
+      if (args.some((x) => x.startsWith("-")))
+        return escalate("SHELL_OPTIONS", "PowerShell options require review");
+      return checkPaths(
+        args.length ? args : [base],
+        "read",
+        base,
+        ctx,
+        c,
+        signal,
+      );
+    }
+    if (exe === "pwd")
+      return args.length
+        ? escalate("SHELL_OPTIONS", "Unsupported pwd arguments")
+        : allow("READ_COMMAND", "Print current directory");
+    if (exe === "echo") return allow("READ_COMMAND", "Literal output");
+    const safeOptions = {
+      ls: new Set([
+        "-a",
+        "-l",
+        "-h",
+        "-la",
+        "-al",
+        "-lh",
+        "-lah",
+        "-R",
+        "--all",
+      ]),
+      cat: new Set(["-n", "-b", "--number"]),
+      head: new Set(["-n", "-c"]),
+      tail: new Set(["-n", "-c"]),
+      wc: new Set(["-l", "-w", "-c", "-m"]),
+      rg: new Set([
+        "-n",
+        "-l",
+        "-i",
+        "--files",
+        "--hidden",
+        "--no-ignore",
+        "-F",
+        "--fixed-strings",
+        "--count",
+      ]),
+      grep: new Set(["-n", "-l", "-i", "-r", "-R", "-F", "--count"]),
+    };
+    if (!safeOptions[exe])
+      return escalate(
+        "UNKNOWN_COMMAND",
+        "Configured command has no built-in semantics; use trustedCommands for exact argv",
+      );
+    let positional = [];
+    for (let i = 0; i < args.length; i++) {
+      const arg = args[i];
+      if (arg === "--") {
+        positional.push(...args.slice(i + 1));
+        break;
+      }
+      if (arg.startsWith("-")) {
+        if (!safeOptions[exe].has(arg))
+          return escalate("SHELL_OPTIONS", `Unsupported ${exe} option ${arg}`);
+        if (
+          (exe === "head" || exe === "tail") &&
+          (arg === "-n" || arg === "-c")
+        ) {
+          if (!/^\d+$/.test(args[++i] ?? ""))
+            return escalate("SHELL_OPTIONS", "Invalid count");
+        }
+      } else positional.push(arg);
+    }
+    if ((exe === "rg" && !args.includes("--files")) || exe === "grep") {
+      if (!positional.length)
+        return escalate("SHELL_OPTIONS", "Missing search pattern");
+      positional = positional.slice(1);
+    }
+    return checkPaths(
+      positional.length ? positional : [base],
+      "read",
+      base,
+      ctx,
+      c,
+      signal,
+    );
+  }
+  if (c.shell.workspaceMutationCommands.includes(exe)) {
+    if (isPwsh || !["mkdir", "touch"].includes(exe))
+      return escalate("UNKNOWN_COMMAND", "No built-in mutation semantics");
+    const paths = args.filter(
+      (x) => !(exe === "mkdir" && x === "-p") && x !== "--",
+    );
+    if (!paths.length || paths.some((x) => x.startsWith("-")))
+      return escalate("SHELL_OPTIONS", "Unsupported mutation options");
+    return checkPaths(paths, "write", base, ctx, c, signal);
+  }
+  return escalate("UNKNOWN_COMMAND", `Command ${exe} requires semantic review`);
+}