@mutmutco/codex-plugin 4.3.5 → 4.3.7

package/scripts/edit-tool-paths.mjs

@@ -1,115 +0,0 @@
-// The files one edit-shaped tool call touches, across BOTH host contracts (#3563).
-//
-// Claude sends `Edit`/`Write` with `tool_input.file_path`. Codex also sends `apply_patch`, and puts the
-// whole patch in `tool_input.command` — there is no `file_path` at all. A gate that reads only
-// `file_path` therefore sees nothing to check and exits 0: on Codex the vault-edit gate FAILED OPEN and
-// `apply_patch` could create a `.env`, while the guide claimed the path was protected (cross-vendor
-// check, openai-sol). Matching `apply_patch` in a host manifest does not rewrite the payload.
-//
-// One extractor, used by every edit-shaped integration, so a new host contract is taught in one place.
-
-/** Tool names that mean "this call writes files". `StrReplace` is Cursor's in-place edit tool: it
- *  carries its target in `tool_input.path` and was outside this set, so even once the adapter matched
- *  it the gate would have read a non-edit tool and allowed (#5852). */
-export const EDIT_TOOL_NAMES = new Set(['Edit', 'Write', 'apply_patch', 'ApplyPatch', 'StrReplace']);
-
-export function isEditTool(toolName) {
-  return typeof toolName === 'string' && EDIT_TOOL_NAMES.has(toolName);
-}
-
-// `*** Add File: path`, `*** Update File: path`, `*** Delete File: path`, and the `*** Move to: path`
-// destination of a rename. Case-insensitive on the verb; the path runs to end of line.
-const PATCH_TOUCH = /^\*\*\*\s+(add|update|delete)\s+file:\s*(.+?)\s*$/gim;
-const PATCH_MOVE = /^\*\*\*\s+move\s+to:\s*(.+?)\s*$/gim;
-
-function scan(re, patch, onMatch) {
-  re.lastIndex = 0;
-  for (let m = re.exec(patch); m; m = re.exec(patch)) onMatch(m);
-}
-
-/** Every path an `apply_patch` body TOUCHES — created, updated, deleted, or renamed onto. */
-export function applyPatchTargets(patch) {
-  if (typeof patch !== 'string' || !patch) return [];
-  const out = [];
-  scan(PATCH_TOUCH, patch, (m) => out.push(m[2]));
-  scan(PATCH_MOVE, patch, (m) => out.push(m[1]));
-  return out;
-}
-
-/** Only the paths a patch CREATES or WRITES — `Add`, `Update`, and a rename destination. A `Delete File:`
- *  target is excluded: the no-env floor blocks creating a `.env`, never removing one, and treating every
- *  extracted target as a write turned a delete-only patch into a denial (cross-vendor check, openai-sol). */
-export function applyPatchWriteTargets(patch) {
-  if (typeof patch !== 'string' || !patch) return [];
-  const out = [];
-  scan(PATCH_TOUCH, patch, (m) => { if (m[1].toLowerCase() !== 'delete') out.push(m[2]); });
-  scan(PATCH_MOVE, patch, (m) => out.push(m[1]));
-  return out;
-}
-
-/** True when a shell command actually INVOKES `apply_patch` — as the COMMAND of some segment, not merely
- *  as a word in it.
- *
- *  Patch-looking text is not a patch: `cat <<EOF … *** Add File: .env … EOF` writes nothing. But a bare
- *  word-boundary test was wrong both ways — `"apply_patch" <<EOF` (quoted) and `/usr/bin/apply_patch`
- *  slipped through, while `echo apply_patch <<EOF` was denied for running `echo` (cross-vendor check,
- *  openai-sol). So: split into segments, take each segment's first token, strip quotes and any directory
- *  prefix, and skip the leading `env`/`command`/`exec`/`sudo` wrappers that only prefix a real command. */
-const INVOKE_PREFIXES = new Set(['env', 'command', 'exec', 'sudo', 'nohup', 'time']);
-// `bash -lc "apply_patch …"` is how Codex delivers a patch through a shell tool: the real command sits
-// inside the wrapper's argument, so the wrapper and its flags are stepped over too.
-const SHELL_WRAPPERS = new Set(['bash', 'sh', 'zsh', 'dash', 'pwsh', 'powershell', 'cmd', 'cmd.exe']);
-
-export function invokesApplyPatch(command) {
-  if (typeof command !== 'string' || !command) return false;
-  // Redirects may abut the command word — `apply_patch<<'EOF'` and `apply_patch<<<"$P"` are both valid
-  // shell, and both hid the command name from a whitespace tokenizer (cross-vendor check).
-  // Separating the operators first is what makes the command word its own token in every form.
-  const spaced = command.replace(/([<>]+)/g, ' $1 ');
-  for (const segment of spaced.split(/\|\||&&|[;&|\n]|<<-?\s*['"]?\w+['"]?/)) {
-    let wrapped = false;
-    for (const raw of segment.trim().split(/\s+/).filter(Boolean)) {
-      const bare = raw.replace(/^['"]+|['"]+$/g, '').replace(/\\/g, '/').split('/').pop() ?? '';
-      if (bare === 'apply_patch') return true;
-      // Step over wrappers, their env assignments, and — once inside a shell wrapper — its flags.
-      // Anything else in command position means this segment runs something other than apply_patch.
-      if (SHELL_WRAPPERS.has(bare.toLowerCase())) { wrapped = true; continue; }
-      if (INVOKE_PREFIXES.has(bare) || /^[A-Za-z_][A-Za-z0-9_]*=/.test(raw)) continue;
-      if (wrapped && /^[-/]/.test(raw)) continue;
-      break;
-    }
-  }
-  return false;
-}
-
-/**
- * Every file path a tool call writes to. Returns `[]` for non-edit tools and unreadable payloads —
- * callers treat an empty list as "nothing to check", exactly as they treated a missing `file_path`.
- * @param {{ tool_name?: unknown, tool_input?: Record<string, unknown> }} input raw tool payload
- * @returns {string[]}
- */
-export function editedPaths(input) {
-  const toolName = input?.tool_name;
-  if (!isEditTool(toolName)) return [];
-  return collectEditedPaths(input?.tool_input ?? {});
-}
-
-/** Every write target in a tool_input, from a direct path AND from any patch body it carries.
- *
- *  Union, never first-match. Returning early on `file_path` meant an `apply_patch` carrying a harmless
- *  `file_path: "safe.txt"` alongside `*** Add File: .env` reported only `safe.txt`, and the vault gate
- *  allowed it — a fail-open reachable by adding one benign field (cross-vendor check, openai-sol). A
- *  gate must see every path a call writes, not the first one it finds. */
-export function collectEditedPaths(toolInput) {
-  const ti = toolInput ?? {};
-  const out = [];
-  for (const direct of [ti.file_path, ti.path]) {
-    if (typeof direct === 'string' && direct) out.push(direct);
-  }
-  // Codex `apply_patch`: the patch text arrives as `command` (or `patch`/`input` on some builds).
-  // WRITE targets only — the shell path already excluded a `*** Delete File:` and this one did not, so a
-  // delete-only patch was allowed through the shell and denied through the tool (cross-vendor check,
-  // openai-sol). One rule, both doors.
-  for (const field of ['command', 'patch', 'input']) out.push(...applyPatchWriteTargets(ti[field]));
-  return [...new Set(out)];
-}