@shanepadgett/tau-agent 0.36.0 → 0.37.0

package/extensions/tau-help/help.md

@@ -128,7 +128,7 @@ Adds `/tau`, `/tau init [--global|--project]`, and `/tau doctor` for Tau setup a
 
 ## tool-approval
 
-Reviews agent `bash` and `script_runner` requests with a quick-effort model before execution. Set `extensions.toolApproval.autoApprove` to run every reviewer-approved request without another confirmation. The reviewer approves routine local development work. Concrete destructive, system, production, privileged, or security-sensitive effects require human approval with one explanatory paragraph. Reviewer failures fall back to human approval and send an attention notification.
+Reviews agent `bash` and `script_runner` requests before they run. Common read-only bash commands skip review. Set `extensions.toolApproval.autoApprove` to run every reviewer-approved request without another confirmation. Those auto-approvals show a user-only marker. The reviewer approves routine local development work. Concrete destructive, system, production, privileged, or security-sensitive effects require human approval with one explanatory paragraph. Reviewer failures fall back to human approval and send an attention notification.
 
 ## tool-loader
 

package/extensions/tool-approval/README.md

@@ -1,8 +1,10 @@
 # Tool Approval
 
-Reviews agent `bash` and `script_runner` requests with a quick-effort model before execution. The reviewer returns a validated decision and one concise paragraph that explains the request.
+Reviews agent `bash` and `script_runner` requests before they run.
 
-Trivially recognized read-only bash commands can run without a human prompt after a valid approval. With `autoApprove` enabled, every reviewer-approved request runs without another confirmation. Routine local development work should be approved, including requests that modify project files or run scripts. The reviewer asks for human approval only when it finds a concrete destructive, system, production, privileged, or security-sensitive effect.
+Common read-only bash commands skip review and run immediately. Other bash and every `script_runner` request go to a quick-effort model. The reviewer returns a validated decision and one concise paragraph that explains the request.
+
+With `autoApprove` enabled, reviewer-approved requests run without another confirmation. Tau shows a user-only marker after those auto-approvals. Common read-only bash that skips review does not get a marker. Routine local development work should be approved, including requests that modify project files or run scripts. The reviewer asks for human approval only when it finds a concrete destructive, system, production, privileged, or security-sensitive effect.
 
 When approval is required, Tau shows one paragraph that explains the effect and risk without repeating the request. If the reviewer fails or returns a malformed decision, Tau asks for direct human approval instead of running it automatically. Tau also sends an attention notification when the approval window opens.
 

package/extensions/tool-approval/allowlist.ts

@@ -0,0 +1,501 @@
+import { parse } from "unbash";
+import type { ArithmeticExpression, Command, Node, ParsedScript, Redirect, Word, WordPart } from "unbash";
+
+const ALWAYS_SKIP = new Set([
+	"cat",
+	"head",
+	"tail",
+	"wc",
+	"ls",
+	"tree",
+	"pwd",
+	"echo",
+	"printf",
+	"true",
+	"false",
+	"test",
+	"[",
+	"grep",
+	"egrep",
+	"fgrep",
+	"cut",
+	"tr",
+	"uniq",
+	"comm",
+	"cmp",
+	"paste",
+	"join",
+	"column",
+	"fmt",
+	"fold",
+	"nl",
+	"rev",
+	"tac",
+	"expand",
+	"unexpand",
+	"tsort",
+	"pr",
+	"seq",
+	"expr",
+	"getconf",
+	"id",
+	"whoami",
+	"uname",
+	"printenv",
+	"type",
+	"which",
+	"dirname",
+	"basename",
+	"readlink",
+	"realpath",
+	"file",
+	"stat",
+	"du",
+	"df",
+	"diff",
+	"md5sum",
+	"sha1sum",
+	"sha256sum",
+	"shasum",
+	"ps",
+	"uptime",
+	"sleep",
+	"cd",
+	"bat",
+	"jq",
+]);
+
+const FIND_VETO = new Set(["-exec", "-execdir", "-ok", "-okdir", "-delete", "-fls", "-fprint", "-fprint0", "-fprintf"]);
+
+const GIT_READ_VERBS = new Set([
+	"status",
+	"log",
+	"diff",
+	"show",
+	"blame",
+	"rev-parse",
+	"describe",
+	"ls-files",
+	"ls-tree",
+	"cat-file",
+	"rev-list",
+	"name-rev",
+	"merge-base",
+	"reflog",
+	"grep",
+	"for-each-ref",
+	"shortlog",
+	"version",
+	"help",
+	"count-objects",
+	"whatchanged",
+	"cherry",
+	"range-diff",
+	"var",
+]);
+
+const WRITE_REDIRECTS = new Set([">", ">>", ">|", "&>", "&>>", "<>"]);
+const SED_PRINT = /^(?:\d+|\d+,\d+)p$/;
+
+interface WalkState {
+	sawCd: boolean;
+	sawGit: boolean;
+}
+
+export function isAllowlistedBash(command: string): boolean {
+	if (!command.trim()) return false;
+	let script: ParsedScript;
+	try {
+		script = parse(command);
+	} catch {
+		return false;
+	}
+	const state: WalkState = { sawCd: false, sawGit: false };
+	return walkScript(script, state) && !(state.sawCd && state.sawGit);
+}
+
+function walkScript(script: ParsedScript, state: WalkState): boolean {
+	if (script.errors && script.errors.length > 0) return false;
+	if (script.shebang) return false;
+	if (script.commands.length === 0) return false;
+	return script.commands.every((statement) => walkNode(statement, state));
+}
+
+function walkNode(node: Node, state: WalkState): boolean {
+	switch (node.type) {
+		case "Statement":
+			if (node.background) return false;
+			return walkRedirects(node.redirects, state) && walkNode(node.command, state);
+		case "Command":
+			return walkCommand(node, state);
+		case "Pipeline":
+			if (node.time || node.negated) return false;
+			if (node.operators.includes("|&")) return false;
+			return node.commands.every((child) => walkNode(child, state));
+		case "AndOr":
+			return node.commands.every((child) => walkNode(child, state));
+		case "CompoundList":
+			return node.commands.every((child) => walkNode(child, state));
+		default:
+			return false;
+	}
+}
+
+function walkCommand(command: Command, state: WalkState): boolean {
+	if (command.prefix.length > 0) return false;
+	if (!command.name) return false;
+	if (!walkRedirects(command.redirects, state)) return false;
+	if (!walkWord(command.name, state)) return false;
+	if (!command.suffix.every((word) => walkWord(word, state))) return false;
+
+	const name = staticBareName(command.name);
+	if (!name) return false;
+	if (name === "cd") state.sawCd = true;
+	if (name === "git") state.sawGit = true;
+	if (state.sawCd && state.sawGit) return false;
+	if (ALWAYS_SKIP.has(name)) return true;
+
+	const args: string[] = [];
+	for (const word of command.suffix) {
+		const value = staticWordValue(word);
+		if (value === undefined) return false;
+		args.push(value);
+	}
+
+	switch (name) {
+		case "find":
+			return !args.some((arg) => FIND_VETO.has(arg));
+		case "fd":
+			return !hasFdVeto(args);
+		case "rg":
+			return !hasRgVeto(args);
+		case "sort":
+		case "base64":
+		case "iconv":
+			return !hasOutputFlag(args);
+		case "xxd":
+			return !hasShortOption(args, "r") && !hasLongOption(args, "revert");
+		case "yq":
+			return !hasYqInplace(args);
+		case "sed":
+			return isSafeSed(args);
+		case "hostname":
+			return !hasPositional(args);
+		case "date":
+			return !hasShortOption(args, "s") && !hasLongOption(args, "set");
+		case "git":
+			return isSafeGit(args);
+		default:
+			return false;
+	}
+}
+
+function walkRedirects(redirects: Redirect[], state: WalkState): boolean {
+	for (const redirect of redirects) {
+		if (redirect.target && !walkWord(redirect.target, state)) return false;
+		if (redirect.body && !walkWord(redirect.body, state)) return false;
+		if (WRITE_REDIRECTS.has(redirect.operator)) {
+			if (!redirect.target || staticWordValue(redirect.target) !== "/dev/null") return false;
+			continue;
+		}
+		if (redirect.operator === ">&" || redirect.operator === "<&") {
+			const target = redirect.target ? staticWordValue(redirect.target) : undefined;
+			if (target === "1" || target === "2" || target === "-") continue;
+			if (redirect.operator === "<&" && target === "0") continue;
+			return false;
+		}
+		if (
+			redirect.operator !== "<" &&
+			redirect.operator !== "<<" &&
+			redirect.operator !== "<<-" &&
+			redirect.operator !== "<<<"
+		) {
+			return false;
+		}
+	}
+	return true;
+}
+
+function walkWord(word: Word, state: WalkState): boolean {
+	const parts = word.parts;
+	if (!parts) return true;
+	return parts.every((part) => walkPart(part, state));
+}
+
+function walkPart(part: WordPart, state: WalkState): boolean {
+	switch (part.type) {
+		case "Literal":
+		case "SingleQuoted":
+		case "AnsiCQuoted":
+		case "SimpleExpansion":
+			return true;
+		case "DoubleQuoted":
+		case "LocaleString":
+			return part.parts.every((child) => walkPart(child, state));
+		case "ParameterExpansion":
+			if (part.indexParts && !part.indexParts.every((child) => walkPart(child, state))) return false;
+			if (part.operand && !walkWord(part.operand, state)) return false;
+			if (part.slice) {
+				if (!walkWord(part.slice.offset, state)) return false;
+				if (part.slice.length && !walkWord(part.slice.length, state)) return false;
+			}
+			if (part.replace) {
+				if (!walkWord(part.replace.pattern, state)) return false;
+				if (!walkWord(part.replace.replacement, state)) return false;
+			}
+			return true;
+		case "CommandExpansion":
+			return walkNestedScript(part.script, state);
+		case "ProcessSubstitution":
+			return false;
+		case "ArithmeticExpansion":
+			return part.expression ? walkArithmetic(part.expression, state) : false;
+		case "ExtendedGlob":
+		case "BraceExpansion":
+			return !part.parts || part.parts.every((child) => walkPart(child, state));
+	}
+}
+
+function walkArithmetic(expression: ArithmeticExpression, state: WalkState): boolean {
+	switch (expression.type) {
+		case "ArithmeticBinary":
+			return walkArithmetic(expression.left, state) && walkArithmetic(expression.right, state);
+		case "ArithmeticUnary":
+			return walkArithmetic(expression.operand, state);
+		case "ArithmeticTernary":
+			return (
+				walkArithmetic(expression.test, state) &&
+				walkArithmetic(expression.consequent, state) &&
+				walkArithmetic(expression.alternate, state)
+			);
+		case "ArithmeticGroup":
+			return walkArithmetic(expression.expression, state);
+		case "ArithmeticWord": {
+			const parts = expression.parts;
+			return !parts || parts.every((part) => walkPart(part, state));
+		}
+		case "ArithmeticCommandExpansion":
+			return walkNestedScript(expression.script, state);
+	}
+}
+
+function walkNestedScript(script: ParsedScript | undefined, state: WalkState): boolean {
+	if (!script) return false;
+	return walkScript(script, state);
+}
+
+function staticBareName(word: Word): string | undefined {
+	const value = staticWordValue(word);
+	if (!value || value.includes("/")) return undefined;
+	return value;
+}
+
+function staticWordValue(word: Word): string | undefined {
+	const parts = word.parts;
+	if (!parts) return word.value;
+	if (!parts.every(isStaticPart)) return undefined;
+	return word.value;
+}
+
+function isStaticPart(part: WordPart): boolean {
+	switch (part.type) {
+		case "Literal":
+		case "SingleQuoted":
+		case "AnsiCQuoted":
+			return true;
+		case "DoubleQuoted":
+		case "LocaleString":
+			return part.parts.every((child) => child.type === "Literal");
+		default:
+			return false;
+	}
+}
+
+function hasFdVeto(args: readonly string[]): boolean {
+	return (
+		hasShortOption(args, "x") ||
+		hasShortOption(args, "X") ||
+		hasLongOption(args, "exec") ||
+		hasLongOption(args, "exec-batch")
+	);
+}
+
+function hasRgVeto(args: readonly string[]): boolean {
+	return (
+		hasShortOption(args, "z") ||
+		hasLongOption(args, "pre") ||
+		hasLongOption(args, "hostname-bin") ||
+		hasLongOption(args, "search-zip")
+	);
+}
+
+function hasOutputFlag(args: readonly string[]): boolean {
+	return hasShortOption(args, "o") || hasLongOption(args, "output");
+}
+
+function hasYqInplace(args: readonly string[]): boolean {
+	return hasShortOption(args, "i") || hasLongOption(args, "inplace") || hasLongOption(args, "in-place");
+}
+
+function isSafeSed(args: readonly string[]): boolean {
+	if (args.length < 2 || args[0] !== "-n") return false;
+	const script = args[1];
+	if (script === undefined || !SED_PRINT.test(script)) return false;
+	for (const arg of args.slice(2)) {
+		if (arg === "--") continue;
+		if (arg.startsWith("-")) return false;
+	}
+	return true;
+}
+
+function hasPositional(args: readonly string[]): boolean {
+	let endFlags = false;
+	for (const arg of args) {
+		if (!endFlags) {
+			if (arg === "--") {
+				endFlags = true;
+				continue;
+			}
+			if (arg.startsWith("-") && arg !== "-") continue;
+		}
+		return true;
+	}
+	return false;
+}
+
+function isSafeGit(args: readonly string[]): boolean {
+	if (hasGitWriteExecFlag(args)) return false;
+	const verbIndex = gitVerbIndex(args);
+	if (verbIndex === undefined) return false;
+	const verb = args[verbIndex];
+	if (verb === undefined) return false;
+	const rest = args.slice(verbIndex + 1);
+	if (GIT_READ_VERBS.has(verb)) return true;
+	if (verb === "branch") return isGitBranch(rest);
+	if (verb === "remote") return isGitRemote(rest);
+	if (verb === "tag") return isGitTag(rest);
+	return false;
+}
+
+function gitVerbIndex(args: readonly string[]): number | undefined {
+	for (let index = 0; index < args.length; index += 1) {
+		const arg = args[index];
+		if (arg === undefined || arg === "--") return undefined;
+		if (arg === "--no-pager" || arg === "-P" || arg === "--no-color") continue;
+		if (
+			arg === "-C" ||
+			arg === "-c" ||
+			arg === "-p" ||
+			arg === "--paginate" ||
+			isLongOption(arg, "config-env") ||
+			isLongOption(arg, "exec-path") ||
+			isLongOption(arg, "git-dir") ||
+			isLongOption(arg, "work-tree") ||
+			isLongOption(arg, "namespace") ||
+			isLongOption(arg, "super-prefix")
+		) {
+			return undefined;
+		}
+		if (arg.startsWith("-")) return undefined;
+		return index;
+	}
+	return undefined;
+}
+
+function hasGitWriteExecFlag(args: readonly string[]): boolean {
+	for (const arg of args) {
+		if (arg === "--") break;
+		if (
+			arg === "--paginate" ||
+			isLongOption(arg, "output") ||
+			isLongOption(arg, "ext-diff") ||
+			isLongOption(arg, "textconv") ||
+			isLongOption(arg, "exec")
+		) {
+			return true;
+		}
+	}
+	return false;
+}
+
+function isGitBranch(args: readonly string[]): boolean {
+	for (let index = 0; index < args.length; index += 1) {
+		const arg = args[index];
+		if (arg === undefined || arg === "--") return false;
+		if (
+			arg === "--list" ||
+			arg === "--all" ||
+			arg === "--remotes" ||
+			arg === "--verbose" ||
+			arg === "--show-current"
+		) {
+			continue;
+		}
+		if (isLongOption(arg, "format")) {
+			if (arg === "--format") {
+				if (args[index + 1] === undefined) return false;
+				index += 1;
+			}
+			continue;
+		}
+		if (arg.startsWith("--")) return false;
+		if (!arg.startsWith("-") || arg.length < 2) return false;
+		for (const flag of arg.slice(1)) {
+			if (flag !== "a" && flag !== "l" && flag !== "r" && flag !== "v") return false;
+		}
+	}
+	return true;
+}
+
+function isGitRemote(args: readonly string[]): boolean {
+	let index = 0;
+	while (index < args.length) {
+		const arg = args[index];
+		if (arg !== "-v" && arg !== "--verbose") break;
+		index += 1;
+	}
+	if (index >= args.length) return true;
+	const verb = args[index];
+	return verb === "show" || verb === "get-url";
+}
+
+function isGitTag(args: readonly string[]): boolean {
+	let listing = false;
+	for (const arg of args) {
+		if (arg === "--") return false;
+		if (arg === "-l" || arg === "--list") {
+			listing = true;
+			continue;
+		}
+		if (arg.startsWith("-") && !arg.startsWith("--") && arg.length > 1) {
+			for (const flag of arg.slice(1)) {
+				if (flag !== "l") return false;
+			}
+			listing = true;
+			continue;
+		}
+		if (arg.startsWith("-") || !listing) return false;
+	}
+	return true;
+}
+
+function hasShortOption(args: readonly string[], letter: string): boolean {
+	for (const arg of args) {
+		if (arg === "--") break;
+		if (arg.length < 2 || !arg.startsWith("-") || arg.startsWith("--")) continue;
+		if (arg.slice(1).includes(letter)) return true;
+	}
+	return false;
+}
+
+function hasLongOption(args: readonly string[], name: string): boolean {
+	for (const arg of args) {
+		if (arg === "--") break;
+		if (isLongOption(arg, name)) return true;
+	}
+	return false;
+}
+
+function isLongOption(arg: string, name: string): boolean {
+	return arg === `--${name}` || arg.startsWith(`--${name}=`);
+}

package/extensions/tool-approval/index.ts

@@ -5,6 +5,7 @@ import {
 	type ExtensionContext,
 	type ToolCallEvent,
 } from "@earendil-works/pi-coding-agent";
+import { Marker } from "@shanepadgett/tau-tui";
 import { Type, type Static } from "typebox";
 import { Value } from "typebox/value";
 import { emitAgentBlocked } from "../../shared/agent-blocked.ts";
@@ -12,9 +13,11 @@ import { resolveEffortCandidates } from "../../shared/model-effort.ts";
 import { generateToolValidated } from "../../shared/model-fallback/index.ts";
 import { errorText, truncAt } from "../../shared/text.ts";
 import { loadTauExtensionSettings } from "../../shared/settings/load.ts";
+import { isAllowlistedBash } from "./allowlist.ts";
 import toolApprovalSettings from "./settings.ts";
 
 const STATUS_KEY = "tool-approval";
+const AUTO_APPROVED_TYPE = "tau.tool-approval.auto-approved";
 const MAX_REVIEW_CHARS = 12_000;
 
 const SUMMARY_SCHEMA = Type.String({
@@ -61,29 +64,6 @@ const REVIEW_SYSTEM_PROMPT = [
 	"An approved review has no reason field. A review that requires user approval must give one concise reason naming the concrete risk without repeating the summary.",
 ].join("\n");
 
-const PLAIN_COMMAND_PATTERN = /^[A-Za-z0-9_./:@%+,=-]+(?: +[A-Za-z0-9_./:@%+,=-]+)*$/;
-const TRIVIAL_READ_ONLY_COMMANDS = new Set(["git diff", "git log", "git show", "git status", "pwd"]);
-const TRIVIAL_READ_ONLY_PROGRAMS = new Set([
-	"basename",
-	"cat",
-	"comm",
-	"cut",
-	"dirname",
-	"du",
-	"echo",
-	"grep",
-	"head",
-	"ls",
-	"printf",
-	"realpath",
-	"rg",
-	"tail",
-	"test",
-	"uniq",
-	"wc",
-	"which",
-]);
-
 const REVIEW_TOOL = {
 	name: "submit_tool_review",
 	description: "Submit the complete safety review for the agent tool request.",
@@ -98,9 +78,24 @@ interface ToolApprovalRequest {
 	input: Record<string, unknown>;
 }
 
+interface AutoApprovedMarker {
+	toolName: ApprovalToolName;
+}
+
 export default function toolApprovalExtension(pi: ExtensionAPI): void {
 	let settings = toolApprovalSettings.defaults;
 
+	pi.registerEntryRenderer<AutoApprovedMarker>(AUTO_APPROVED_TYPE, (entry, _options, theme) => {
+		const marker = autoApprovedMarker(entry.data);
+		if (!marker) return undefined;
+		return new Marker({
+			theme,
+			state: "complete",
+			label: "Auto-approved",
+			parts: [toolLabel(marker.toolName)],
+		});
+	});
+
 	async function refreshSettings(ctx: Pick<ExtensionContext, "cwd" | "isProjectTrusted">): Promise<void> {
 		settings = await loadTauExtensionSettings(ctx, toolApprovalSettings);
 	}
@@ -114,7 +109,8 @@ export default function toolApprovalExtension(pi: ExtensionAPI): void {
 		if (!settings.enabled) return undefined;
 		return {
 			systemPrompt: `${event.systemPrompt}\n\n${[
-				"Agent bash and script_runner requests are reviewed by a separate quick-effort safety classifier before execution.",
+				"Known-safe read-only bash commands skip review.",
+				"Other bash and every script_runner request are reviewed by a separate quick-effort safety classifier before execution.",
 				"Treat classifier approval as a gate, not as permission to hide command intent from the user.",
 				"Routine local development requests can be approved automatically.",
 				"Requests with destructive, system, production, privileged, or security-sensitive effects require human confirmation.",
@@ -143,9 +139,9 @@ export default function toolApprovalExtension(pi: ExtensionAPI): void {
 				return block("bash command is empty");
 			}
 			command = value;
+			if (isAllowlistedBash(command)) return undefined;
 		}
 
-		const readOnlyCommand = request.toolName === "bash" && isTriviallyReadOnly(command ?? "");
 		ctx.ui.setStatus(STATUS_KEY, `reviewing ${toolLabel(request.toolName)}`);
 		try {
 			const review = await reviewToolRequest(ctx, request);
@@ -158,7 +154,10 @@ export default function toolApprovalExtension(pi: ExtensionAPI): void {
 					formatApproval(review.summary, review.reason),
 				);
 			}
-			if (settings.autoApprove || readOnlyCommand) return undefined;
+			if (settings.autoApprove) {
+				pi.appendEntry<AutoApprovedMarker>(AUTO_APPROVED_TYPE, { toolName: request.toolName });
+				return undefined;
+			}
 			return requestToolApproval(
 				pi,
 				ctx,
@@ -194,17 +193,17 @@ function approvalRequest(event: ToolCallEvent): ToolApprovalRequest | undefined
 	return undefined;
 }
 
-function isTriviallyReadOnly(command: string): boolean {
-	const plainCommand = PLAIN_COMMAND_PATTERN.test(command);
-	const separator = command.indexOf(" ");
-	const program = separator === -1 ? command : command.slice(0, separator);
-	return plainCommand && (TRIVIAL_READ_ONLY_COMMANDS.has(command) || TRIVIAL_READ_ONLY_PROGRAMS.has(program));
-}
-
 function toolLabel(toolName: ApprovalToolName): string {
 	return toolName === "bash" ? "bash command" : "script_runner request";
 }
 
+function autoApprovedMarker(value: unknown): AutoApprovedMarker | undefined {
+	if (!value || typeof value !== "object") return undefined;
+	const toolName = (value as AutoApprovedMarker).toolName;
+	if (toolName !== "bash" && toolName !== "script_runner") return undefined;
+	return { toolName };
+}
+
 async function reviewToolRequest(ctx: ExtensionContext, request: ToolApprovalRequest): Promise<ToolReview> {
 	const requestJson = JSON.stringify(request);
 	if (!requestJson || requestJson.length > MAX_REVIEW_CHARS)

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@shanepadgett/tau-agent",
-	"version": "0.36.0",
+	"version": "0.37.0",
 	"description": "Tau is a custom agentic harness built with pi extensions",
 	"type": "module",
 	"main": "./src/index.ts",
@@ -35,10 +35,11 @@
 	],
 	"dependencies": {
 		"@ast-grep/wasm": "0.45.0",
-		"@shanepadgett/tau-tui": "0.36.0",
+		"@shanepadgett/tau-tui": "0.37.0",
 		"@vscode/tree-sitter-wasm": "0.3.1",
 		"image-size": "2.0.2",
 		"smol-toml": "1.7.1",
+		"unbash": "4.0.10",
 		"web-tree-sitter": "0.26.11"
 	},
 	"peerDependencies": {