@phuetz/code-buddy 1.6.1 → 2.0.0

package/dist/security/bash-allowlist/approval-flow.js

@@ -46,8 +46,9 @@ export class ApprovalFlowManager extends EventEmitter {
      */
     async checkAndApprove(command, options) {
         await this.initialize();
+        const cwd = options?.cwd || process.cwd();
         // First check stored patterns
-        const checkResult = this.store.checkCommand(command);
+        const checkResult = this.store.checkCommand(command, cwd);
         if (checkResult.matched) {
             const approved = checkResult.decision === 'allow';
             this.emit(approved ? 'check:allowed' : 'check:denied', {
@@ -63,7 +64,7 @@ export class ApprovalFlowManager extends EventEmitter {
         }
         // No pattern match - need to prompt
         if (checkResult.decision === 'prompt') {
-            const promptResult = await this.promptUser(command, options);
+            const promptResult = await this.promptUser(command, { ...options, cwd });
             if (promptResult.timedOut) {
                 return {
                     approved: false,
@@ -79,6 +80,7 @@ export class ApprovalFlowManager extends EventEmitter {
                     pattern: promptResult.pattern,
                     patternType: promptResult.patternType,
                     description: promptResult.description,
+                    cwd,
                 });
             }
             return {
@@ -98,7 +100,7 @@ export class ApprovalFlowManager extends EventEmitter {
      * @param command Command to check
      * @returns Check result
      */
-    quickCheck(command) {
+    quickCheck(command, cwd = process.cwd()) {
         if (!this.store.isInitialized()) {
             // Store not initialized - return prompt
             return {
@@ -107,7 +109,7 @@ export class ApprovalFlowManager extends EventEmitter {
                 reason: 'Allowlist not initialized',
             };
         }
-        const result = this.store.checkCommand(command);
+        const result = this.store.checkCommand(command, cwd);
         return {
             matched: result.matched,
             pattern: result.pattern,
@@ -127,7 +129,7 @@ export class ApprovalFlowManager extends EventEmitter {
         // you would extend the confirmation service UI to show pattern options.
         const promptOptions = {
             command,
-            cwd: process.cwd(),
+            cwd: options?.cwd || process.cwd(),
             timeout: options?.timeout || config.defaults.timeout,
             showAlwaysAllow: options?.showAlwaysAllow ?? config.defaults.showAlwaysAllow,
             showAlwaysDeny: options?.showAlwaysDeny ?? config.defaults.showAlwaysDeny,
@@ -138,7 +140,7 @@ export class ApprovalFlowManager extends EventEmitter {
             operation: 'Execute bash command',
             filename: command,
             showVSCodeOpen: false,
-            content: this.formatPromptContent(command, suggestion),
+            content: this.formatPromptContent(command, suggestion, promptOptions.cwd),
         }, 'bash');
         // Map confirmation result to approval result
         if (!result.confirmed) {
@@ -163,10 +165,10 @@ export class ApprovalFlowManager extends EventEmitter {
     /**
      * Format content for the approval prompt
      */
-    formatPromptContent(command, suggestion) {
+    formatPromptContent(command, suggestion, cwd) {
         return [
             `Command: ${command}`,
-            `Working directory: ${process.cwd()}`,
+            `Working directory: ${cwd}`,
             '',
             `Suggested pattern: ${suggestion.pattern}`,
             `Pattern type: ${suggestion.type}`,

package/dist/security/bash-allowlist/deny-guard.d.ts

@@ -0,0 +1,14 @@
+export interface DenyRuleVerdict {
+    denied: boolean;
+    /** The matched pattern text (for the refusal message). */
+    pattern?: string;
+    /** The pattern's human description, when set. */
+    description?: string;
+}
+/** Test hook: drop the mtime cache so the next check re-reads the store. */
+export declare function resetDenyGuardCache(): void;
+/**
+ * Check a command against the user's deny rules. Called from the shared
+ * command validator — must stay synchronous and cheap.
+ */
+export declare function checkUserDenyRules(command: string, cwd?: string): DenyRuleVerdict;

package/dist/security/bash-allowlist/deny-guard.js

@@ -0,0 +1,61 @@
+/**
+ * User deny-rule guard for bash commands (Hermes-parity: user-defined deny
+ * rules block commands EVEN under YOLO).
+ *
+ * The allowlist store (`~/.codebuddy/exec-approvals.json`, managed via
+ * `/allowlist deny <pattern>`) existed but was consulted nowhere on the real
+ * execution path — deny patterns blocked nothing. This guard is the missing
+ * consumer: a synchronous check wired into the SHARED command validator
+ * (`src/tools/bash/command-validator.ts`), which both the buffered and the
+ * streaming bash paths run unconditionally — YOLO skips confirmations, never
+ * validation, so a user deny rule is a hard stop in every mode.
+ *
+ * Sync + fail-open by design: a missing/corrupt store must never break bash
+ * (it only disables the extra guard); the file is re-read when its mtime
+ * changes so `/allowlist deny` edits apply without a restart.
+ */
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { matchApprovalPattern } from './pattern-matcher.js';
+let cache = null;
+function storePath() {
+    return path.join(process.env.CODEBUDDY_HOME ?? path.join(os.homedir(), '.codebuddy'), 'exec-approvals.json');
+}
+function loadDenyPatterns() {
+    try {
+        const file = storePath();
+        const stat = fs.statSync(file);
+        if (cache && cache.mtimeMs === stat.mtimeMs)
+            return cache.patterns;
+        const parsed = JSON.parse(fs.readFileSync(file, 'utf-8'));
+        const patterns = (parsed.patterns ?? []).filter((p) => p.enabled && p.decision === 'deny');
+        cache = { mtimeMs: stat.mtimeMs, patterns };
+        return patterns;
+    }
+    catch {
+        // No store / unreadable / invalid JSON → no user deny rules.
+        return [];
+    }
+}
+/** Test hook: drop the mtime cache so the next check re-reads the store. */
+export function resetDenyGuardCache() {
+    cache = null;
+}
+/**
+ * Check a command against the user's deny rules. Called from the shared
+ * command validator — must stay synchronous and cheap.
+ */
+export function checkUserDenyRules(command, cwd = process.cwd()) {
+    const patterns = loadDenyPatterns();
+    const canonicalCwd = path.resolve(cwd);
+    for (const pattern of patterns) {
+        if (pattern.cwd && path.resolve(pattern.cwd) !== canonicalCwd)
+            continue;
+        if (matchApprovalPattern(command, pattern)) {
+            return { denied: true, pattern: pattern.pattern, description: pattern.description };
+        }
+    }
+    return { denied: false };
+}
+//# sourceMappingURL=deny-guard.js.map

package/dist/security/bash-allowlist/types.d.ts

@@ -41,6 +41,11 @@ export interface ApprovalPattern {
     tags?: string[];
     /** Source of this pattern (user, system, plugin) */
     source: PatternSource;
+    /**
+     * Optional project boundary for an approval learned from a prompt.
+     * Missing means global, preserving legacy and explicitly managed patterns.
+     */
+    cwd?: string;
 }
 /**
  * Where the pattern came from

package/dist/security/bash-parser.d.ts

@@ -10,6 +10,19 @@
  * This is critical for security: `rm -rf / && echo safe` should
  * detect the `rm -rf /` component, not just see "echo safe".
  */
+import { type PowerShellParserOptions } from './powershell-parser.js';
+/**
+ * Start loading the OPTIONAL tree-sitter grammars, at most once.
+ *
+ * Deliberately NOT started while this module is being evaluated: merely
+ * importing the security layer must never pull a native `.node` addon into a
+ * process that parses no shell command (`buddy dev plan` parses none). Such an
+ * import is a floating promise detached from the running command, and on
+ * Windows a delay-loaded DLL that cannot be resolved raises an SEH exception
+ * (`0xC06D007F`) no `try/catch` can intercept: the whole process dies, and the
+ * exit code replaces that of a command which had otherwise succeeded.
+ */
+export declare function preloadBashGrammars(): void;
 export interface ParsedCommand {
     /** The base command name (e.g., 'rm', 'git', 'npm') */
     command: string;
@@ -28,12 +41,31 @@ export interface ParseResult {
     usedTreeSitter: boolean;
     /** Any parsing warnings */
     warnings: string[];
+    /** Whether the selected shell parser found output/input redirection. */
+    hasRedirection?: boolean;
+}
+export type ShellKind = 'posix' | 'powershell' | 'cmd' | 'unknown';
+export interface ShellParseOptions {
+    /** Resolved shell executable/name when the command itself is not wrapped. */
+    shell?: string;
+    powershell?: PowerShellParserOptions;
 }
+/**
+ * Remove recognized shell wrappers recursively so an inner command cannot hide
+ * behind bash/sh/zsh -c, cmd /c, powershell -Command or pwsh -Command.
+ */
+export declare function stripShellWrapper(input: string): string;
 /**
  * Parse a bash command string into individual commands.
  * Uses tree-sitter if available, falls back to state-machine parser.
  */
 export declare function parseBashCommand(input: string): ParseResult;
+/**
+ * Parse with the grammar of the resolved or wrapped shell. PowerShell never
+ * falls back to the POSIX parser: if its native parser is unavailable or
+ * uncertain, the returned warnings require the caller to refuse execution.
+ */
+export declare function parseShellCommand(input: string, options?: ShellParseOptions): ParseResult;
 /**
  * Extract just the command names from a bash string (convenience).
  */

package/dist/security/bash-parser.js

@@ -11,25 +11,124 @@
  * detect the `rm -rf /` component, not just see "echo safe".
  */
 import { logger } from '../utils/logger.js';
-// Cache tree-sitter modules loaded via async import at module init time.
+import { parsePowerShellCommand, } from './powershell-parser.js';
+// Cache tree-sitter modules loaded via async import on first parse.
 // parseBashCommand is sync, so we pre-load and cache these optional deps.
 let _treeSitterParser = null;
 let _treeSitterBash = null;
 let _treeSitterLoaded = false;
-// Kick off async import immediately; result is cached for sync use.
-(async () => {
-    try {
-        const parserMod = await import('tree-sitter');
-        const bashMod = await import('tree-sitter-bash');
-        _treeSitterParser = parserMod.default ?? parserMod;
-        _treeSitterBash = bashMod.default ?? bashMod;
-        _treeSitterLoaded = true;
+let _treeSitterPreload = null;
+let _treeSitterWarned = false;
+/**
+ * Start loading the OPTIONAL tree-sitter grammars, at most once.
+ *
+ * Deliberately NOT started while this module is being evaluated: merely
+ * importing the security layer must never pull a native `.node` addon into a
+ * process that parses no shell command (`buddy dev plan` parses none). Such an
+ * import is a floating promise detached from the running command, and on
+ * Windows a delay-loaded DLL that cannot be resolved raises an SEH exception
+ * (`0xC06D007F`) no `try/catch` can intercept: the whole process dies, and the
+ * exit code replaces that of a command which had otherwise succeeded.
+ */
+export function preloadBashGrammars() {
+    if (_treeSitterPreload)
+        return;
+    _treeSitterPreload = (async () => {
+        try {
+            const parserMod = await import('tree-sitter');
+            const bashMod = await import('tree-sitter-bash');
+            _treeSitterParser = parserMod.default ?? parserMod;
+            _treeSitterBash = bashMod.default ?? bashMod;
+            _treeSitterLoaded = true;
+        }
+        catch (error) {
+            // tree-sitter not installed or unloadable — the fallback parser is used.
+            _treeSitterLoaded = false;
+            if (!_treeSitterWarned) {
+                _treeSitterWarned = true;
+                logger.warn('tree-sitter unavailable; bash parsing falls back to the state-machine parser', { error: error instanceof Error ? error.message : String(error) });
+            }
+        }
+    })();
+}
+function stripMatchingOuterQuotes(value) {
+    const trimmed = value.trim();
+    if (trimmed.length < 2)
+        return trimmed;
+    const first = trimmed[0];
+    const last = trimmed.at(-1);
+    if ((first === '"' && last === '"') || (first === "'" && last === "'")) {
+        return trimmed.slice(1, -1);
+    }
+    return trimmed;
+}
+function shellKind(executable) {
+    if (!executable)
+        return 'unknown';
+    const unquoted = executable.trim().replace(/^(['"])(.*)\1$/, '$2');
+    const parts = unquoted.split(/[\\/]/).filter(Boolean);
+    const base = (parts.at(-1) ?? unquoted).replace(/\.exe$/i, '').toLowerCase();
+    if (base === 'powershell' || base === 'pwsh')
+        return 'powershell';
+    if (base === 'cmd')
+        return 'cmd';
+    if (base === 'bash' || base === 'sh' || base === 'zsh')
+        return 'posix';
+    return 'unknown';
+}
+function unwrapShellOnce(input) {
+    const match = input.trim().match(/^(?:"([^"]+)"|'([^']+)'|(\S+))(?:\s+([\s\S]+))$/);
+    if (!match)
+        return null;
+    const executable = match[1] ?? match[2] ?? match[3];
+    const rest = match[4];
+    if (executable === undefined || rest === undefined)
+        return null;
+    const kind = shellKind(executable);
+    let payload;
+    if (kind === 'posix') {
+        payload = rest.match(/^-[a-z]*c\s+([\s\S]+)$/i)?.[1];
+    }
+    else if (kind === 'cmd') {
+        payload = rest.match(/^(?:(?:\/[dqs])\s+)*\/c\s+([\s\S]+)$/i)?.[1];
     }
-    catch {
-        // tree-sitter not installed — fallback parser will be used
-        _treeSitterLoaded = false;
+    else if (kind === 'powershell') {
+        const commandFlag = /(?:^|\s)-(?:command|c)(?=\s|$)\s*/i.exec(rest);
+        if (commandFlag) {
+            payload = rest.slice(commandFlag.index + commandFlag[0].length);
+        }
+    }
+    if (payload === undefined || !payload.trim())
+        return null;
+    return {
+        command: stripMatchingOuterQuotes(payload),
+        executable: executable.replace(/^(['"])(.*)\1$/, '$2'),
+        shell: kind,
+    };
+}
+function unwrapShellCommand(input, explicitShell) {
+    let command = input.trim();
+    let executable = explicitShell;
+    let selectedShell = shellKind(explicitShell);
+    for (let depth = 0; depth < 10; depth++) {
+        const wrapper = unwrapShellOnce(command);
+        if (!wrapper)
+            break;
+        command = wrapper.command;
+        executable = wrapper.executable;
+        selectedShell = wrapper.shell;
     }
-})();
+    return { command, executable, shell: selectedShell };
+}
+/**
+ * Remove recognized shell wrappers recursively so an inner command cannot hide
+ * behind bash/sh/zsh -c, cmd /c, powershell -Command or pwsh -Command.
+ */
+export function stripShellWrapper(input) {
+    if (typeof input !== 'string')
+        return '';
+    return unwrapShellCommand(input).command;
+}
 /**
  * Parse bash commands using a state-machine approach.
  * Handles quotes, escapes, pipelines, chains, subshells.
@@ -255,7 +354,8 @@ export function parseBashCommand(input) {
     if (!input || !input.trim()) {
         return { commands: [], usedTreeSitter: false, warnings: [] };
     }
-    // Try tree-sitter first (optional dependency, pre-loaded at module init)
+    // Try tree-sitter first (optional dependency, loaded from the first parse on)
+    preloadBashGrammars();
     if (_treeSitterLoaded && _treeSitterParser && _treeSitterBash) {
         try {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -274,6 +374,21 @@ export function parseBashCommand(input) {
     }
     return fallbackParse(input);
 }
+/**
+ * Parse with the grammar of the resolved or wrapped shell. PowerShell never
+ * falls back to the POSIX parser: if its native parser is unavailable or
+ * uncertain, the returned warnings require the caller to refuse execution.
+ */
+export function parseShellCommand(input, options = {}) {
+    const resolved = unwrapShellCommand(input, options.shell);
+    if (resolved.shell === 'powershell') {
+        return parsePowerShellCommand(resolved.command, {
+            ...options.powershell,
+            executable: options.powershell?.executable ?? resolved.executable,
+        });
+    }
+    return parseBashCommand(resolved.command);
+}
 /**
  * Extract commands from a tree-sitter AST node.
  */

package/dist/security/dangerous-patterns.js

@@ -62,8 +62,12 @@ export const DANGEROUS_COMMANDS = new Set([
  */
 export const DANGEROUS_BASH_PATTERNS = [
     // --- Filesystem destruction ---
-    { pattern: /rm\s+(-rf?|--recursive)\s+[/~]/i, severity: 'critical', description: 'Recursive force delete from root or home', name: 'rm-rf-root', category: 'filesystem_destruction', appliesTo: ['bash', 'command'] },
-    { pattern: /rm\s+.*\/\s*$/i, severity: 'high', description: 'Delete ending with directory path', name: 'rm-dir-path', category: 'filesystem_destruction', appliesTo: ['bash', 'command'] },
+    // Recursive delete targeting root/home. Hardened to survive flag reordering and forms that
+    // the old `-rf?` catcher missed: `rm -fr ~`, `rm -r -f ~`, `rm --recursive --force ~`, and
+    // `$HOME`/`${HOME}` targets (all as destructive as `rm -rf /`). The lookahead asserts a recursive
+    // flag is present in the same command (any short flag containing `r`, or `--recursive`); the tail
+    // asserts a root/home target. Relative paths (`rm -rf ./build`, `node_modules`) stay unflagged.
+    { pattern: /\brm\b(?=[^|;&\n]*(?:\s-[a-z]*r[a-z]*\b|--recursive\b))[^|;&\n]*\s(?:\/|\/home\/?|~\/?|\$\{?HOME\}?)\s*$/i, severity: 'critical', description: 'Recursive delete targeting root/home (any flag order/form, incl. $HOME)', name: 'rm-rf-root', category: 'filesystem_destruction', appliesTo: ['bash', 'command'] },
     { pattern: />\s*\/dev\/sd[a-z]/i, severity: 'critical', description: 'Write to disk device', name: 'write-disk-device', category: 'filesystem_destruction', appliesTo: ['bash', 'command'] },
     { pattern: /dd\s+.*if=.*of=\/dev/i, severity: 'critical', description: 'dd to disk device', name: 'dd-device', category: 'filesystem_destruction', appliesTo: ['bash', 'command'] },
     { pattern: /mkfs/i, severity: 'critical', description: 'Format filesystem', name: 'mkfs', category: 'filesystem_destruction', appliesTo: ['bash', 'command'] },
@@ -124,7 +128,11 @@ export const DANGEROUS_CODE_PATTERNS = [
     { pattern: /\bspawn\s*\(/, severity: 'medium', description: 'Process spawning', name: 'spawn', category: 'code_execution', appliesTo: ['skill', 'code'] },
     { pattern: /\bexec\s*\(/, severity: 'high', description: 'Command execution', name: 'exec', category: 'code_execution', appliesTo: ['skill', 'code'] },
     // --- Filesystem dangers ---
-    { pattern: /\brm\s+-rf\b/, severity: 'critical', description: 'Recursive force delete', name: 'rm-rf', category: 'filesystem_destruction', appliesTo: ['skill', 'code'] },
+    // Recursive+force delete in skill/code content. Broadened from `-rf` only to any single short
+    // flag carrying both r and f in either order (`-fr`, `-Rf`, `-rvf`) and the separated long form
+    // (`--recursive … --force`), bounded to one statement. Still requires BOTH recursive and force,
+    // so `rm -f` / `rm -r` alone stay unflagged (no new false positives).
+    { pattern: /\brm\s+-[a-z]*r[a-z]*f[a-z]*\b|\brm\s+-[a-z]*f[a-z]*r[a-z]*\b|\brm\b[^;&|\n]*--recursive\b[^;&|\n]*--force\b|\brm\b[^;&|\n]*--force\b[^;&|\n]*--recursive\b/i, severity: 'critical', description: 'Recursive force delete', name: 'rm-rf', category: 'filesystem_destruction', appliesTo: ['skill', 'code'] },
     { pattern: /\bunlinkSync\s*\(/, severity: 'medium', description: 'Synchronous file deletion', name: 'unlinkSync', category: 'filesystem_destruction', appliesTo: ['skill', 'code'] },
     { pattern: /\bwriteFileSync\s*\(/, severity: 'low', description: 'Synchronous file write', name: 'writeFileSync', category: 'filesystem_destruction', appliesTo: ['skill'] },
     { pattern: /\brmdirSync\s*\(/, severity: 'medium', description: 'Directory removal', name: 'rmdirSync', category: 'filesystem_destruction', appliesTo: ['skill', 'code'] },
@@ -156,6 +164,13 @@ export const DANGEROUS_CODE_PATTERNS = [
     // --- Hardcoded secrets ---
     { pattern: /(?:password|passwd|pwd|secret|token|api_key|apikey)\s*[:=]\s*['"][^'"]{8,}['"]/i, severity: 'high', description: 'Hardcoded secret in code', name: 'hardcoded-secret', category: 'secret_exposure', appliesTo: ['code'] },
     { pattern: /-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/, severity: 'critical', description: 'Private key in code', name: 'private-key', category: 'secret_exposure', appliesTo: ['code', 'skill'] },
+    // SECAUDIT 2026-09-05: an authored tool ("read input from env, print to
+    // stdout") has no reason to touch a credential file. The runtime redirects
+    // HOME away from the real one, but a HARDCODED absolute path defeats that;
+    // egress is already blocked (network + child_process), yet reading a secret
+    // into the agent's own context still defeats the documented env-isolation.
+    // Fail closed on any reference to a well-known credential/secret path.
+    { pattern: /(?:\.ssh\/|\bid_rsa\b|\bid_ed25519\b|\bid_ecdsa\b|\.aws\/(?:credentials|config)|\.gnupg\/|\.netrc\b|\.kube\/config|\.docker\/config|\/etc\/shadow\b|\/etc\/gshadow\b|\.codebuddy\/(?:auth|secret|[^'"`\s]*\.env)|(?:^|['"`/\s])\.env(?:\.[a-z0-9]+)?['"`\s)]|\baws_secret_access_key\b|\.config\/gh\/|application_default_credentials\.json|\.config\/gcloud\/|(?:^|[/'"`~\s])\.azure\b|\.terraformrc\b|credentials\.tfrc\.json|\.npmrc\b|\.cargo\/credentials|\.pypirc\b|\.git-credentials\b)/i, severity: 'high', description: 'References a well-known credential/secret path', name: 'sensitive-credential-path', category: 'secret_exposure', appliesTo: ['code'] },
     // --- Unsafe deserialization ---
     { pattern: /\bpickle\.loads?\b/, severity: 'high', description: 'Python pickle deserialization', name: 'pickle-loads', category: 'code_execution', appliesTo: ['code'] },
     { pattern: /\byaml\.load\s*\((?!.*Loader)/, severity: 'medium', description: 'Unsafe YAML load (no Loader specified)', name: 'yaml-unsafe-load', category: 'code_execution', appliesTo: ['code'] },

package/dist/security/declarative-rules.d.ts

@@ -40,7 +40,7 @@ export declare function loadPermissions(projectRoot?: string): DeclarativePermis
  */
 export declare function checkDeclarativePermission(toolName: string, toolArgs: Record<string, unknown>, projectRoot?: string): PermissionDecision;
 export declare function explainDeclarativePermission(toolName: string, toolArgs: Record<string, unknown>, projectRoot?: string): DeclarativePermissionExplanation;
-export declare function explainDeclarativePermissionFromPermissions(toolName: string, toolArgs: Record<string, unknown>, permissions: DeclarativePermissions): DeclarativePermissionExplanation;
+export declare function explainDeclarativePermissionFromPermissions(toolName: string, toolArgs: Record<string, unknown>, permissions: DeclarativePermissions, projectRoot?: string): DeclarativePermissionExplanation;
 /**
  * Convenience: check if a tool call should skip confirmation.
  */