@namzu/sdk 44.3.0 → 45.0.0

package/src/authorization/gate.ts

@@ -10,11 +10,18 @@ import type { ToolDefinition } from '../types/tool/index.js'
 import { SCOPE_ATTRIBUTE } from '../utils/log/types.js'
 import type { Logger } from '../utils/logger.js'
 import { evaluateRule } from './rules.js'
+import type { ShellDialect } from './shell-lexer.js'
 
 export interface ToolCallContext {
 	readonly toolName: string
 	readonly toolInput: unknown
 	readonly toolDef: ToolDefinition | undefined
+	/**
+	 * The shell this call's command line will run in, when the caller knows
+	 * (`ToolDefinition.commandDialect`). Absent, a command line is read in the
+	 * `sh` dialect, which holds whichever shell runs it.
+	 */
+	readonly commandDialect?: ShellDialect
 }
 
 /**
@@ -206,6 +213,7 @@ export class AuthorizationGate {
 				ctx.toolDef,
 				this.compiledPatterns.get(i),
 				this.nameSets.get(i),
+				ctx.commandDialect !== undefined ? { commandDialect: ctx.commandDialect } : {},
 			)
 
 			if (decision !== null) {

package/src/authorization/rules.ts

@@ -2,7 +2,17 @@ import { DANGEROUS_PATTERNS } from '../constants/tools/index.js'
 import { isTrustedReadOnly } from '../tools/trusted-read-only.js'
 import type { AuthorizationRule, GateDecision } from '../types/authorization/index.js'
 import type { ToolDefinition } from '../types/tool/index.js'
-import { decomposeCommandLine } from './command-line.js'
+import { decodedCommands, decomposeCommandLine } from './command-line.js'
+import type { ShellDialect } from './shell-lexer.js'
+
+export interface EvaluateRuleOptions {
+	/**
+	 * The shell the tool will run a command-line argument in. Default `sh`:
+	 * every construct bash and a POSIX shell read differently makes the line
+	 * opaque. `ToolDefinition.commandDialect` supplies it for a tool.
+	 */
+	readonly commandDialect?: ShellDialect
+}
 
 export function evaluateRule(
 	rule: AuthorizationRule,
@@ -11,7 +21,11 @@ export function evaluateRule(
 	toolDef: ToolDefinition | undefined,
 	compiledPattern?: RegExp,
 	nameSet?: Set<string>,
+	options: EvaluateRuleOptions = {},
 ): GateDecision | null {
+	// A command line is read for the shell that will run it. Not knowing
+	// which, the reading that holds for every POSIX shell is the safe one.
+	const dialect = options.commandDialect ?? 'sh'
 	switch (rule.type) {
 		case 'allow_read_only': {
 			// A server's own claim about its own tool cannot settle this. See
@@ -106,19 +120,34 @@ export function evaluateRule(
 						: undefined
 			if (subject === undefined) return null
 
+			// A path the tool itself declares is a path, not a command line.
+			// Read as shell, `app/(auth)/page.tsx` is a syntax error, and an
+			// opaque reading would withdraw every allow rule written for it.
+			if (
+				typeof value === 'string' &&
+				toolDef?.pathArgument === rule.argument &&
+				toolDef.commandArgument !== rule.argument
+			) {
+				return compiledPattern.test(subject) ? rule.decision : null
+			}
+
 			// A command line is not one string, and testing it as one is how a
 			// prohibition gets bypassed: `^git push` sees `git push origin main`
 			// and does not see `true; git push origin main`. See
 			// `decomposeCommandLine` for the measurement and for why the two
 			// decisions must read the result differently.
-			const { segments, opaque } = decomposeCommandLine(subject)
+			const { segments, opaque } = decomposeCommandLine(subject, dialect)
 
 			if (rule.decision === 'deny') {
 				// ANY segment. The whole subject is tested first so an
 				// unanchored deny keeps matching across a boundary, which
-				// splitting alone would have taken away.
+				// splitting alone would have taken away. Then each command's
+				// words as bash passes them, so that `'git' push` is `git push`.
 				if (compiledPattern.test(subject)) return 'deny'
-				return segments.some((segment) => compiledPattern.test(segment)) ? 'deny' : null
+				if (segments.some((segment) => compiledPattern.test(segment))) return 'deny'
+				return decodedCommands(subject, dialect).some((text) => compiledPattern.test(text))
+					? 'deny'
+					: null
 			}
 
 			// EVERY segment, and nothing that hides one. Permission is a claim