@shanepadgett/tau-agent 0.36.0 → 0.38.0

package/extensions/tool-approval/allowlist.ts

@@ -0,0 +1,501 @@
+import { parse } from "unbash";
+import type { ArithmeticExpression, Command, Node, ParsedScript, Redirect, Word, WordPart } from "unbash";
+
+const ALWAYS_SKIP = new Set([
+	"cat",
+	"head",
+	"tail",
+	"wc",
+	"ls",
+	"tree",
+	"pwd",
+	"echo",
+	"printf",
+	"true",
+	"false",
+	"test",
+	"[",
+	"grep",
+	"egrep",
+	"fgrep",
+	"cut",
+	"tr",
+	"uniq",
+	"comm",
+	"cmp",
+	"paste",
+	"join",
+	"column",
+	"fmt",
+	"fold",
+	"nl",
+	"rev",
+	"tac",
+	"expand",
+	"unexpand",
+	"tsort",
+	"pr",
+	"seq",
+	"expr",
+	"getconf",
+	"id",
+	"whoami",
+	"uname",
+	"printenv",
+	"type",
+	"which",
+	"dirname",
+	"basename",
+	"readlink",
+	"realpath",
+	"file",
+	"stat",
+	"du",
+	"df",
+	"diff",
+	"md5sum",
+	"sha1sum",
+	"sha256sum",
+	"shasum",
+	"ps",
+	"uptime",
+	"sleep",
+	"cd",
+	"bat",
+	"jq",
+]);
+
+const FIND_VETO = new Set(["-exec", "-execdir", "-ok", "-okdir", "-delete", "-fls", "-fprint", "-fprint0", "-fprintf"]);
+
+const GIT_READ_VERBS = new Set([
+	"status",
+	"log",
+	"diff",
+	"show",
+	"blame",
+	"rev-parse",
+	"describe",
+	"ls-files",
+	"ls-tree",
+	"cat-file",
+	"rev-list",
+	"name-rev",
+	"merge-base",
+	"reflog",
+	"grep",
+	"for-each-ref",
+	"shortlog",
+	"version",
+	"help",
+	"count-objects",
+	"whatchanged",
+	"cherry",
+	"range-diff",
+	"var",
+]);
+
+const WRITE_REDIRECTS = new Set([">", ">>", ">|", "&>", "&>>", "<>"]);
+const SED_PRINT = /^(?:\d+|\d+,\d+)p$/;
+
+interface WalkState {
+	sawCd: boolean;
+	sawGit: boolean;
+}
+
+export function isAllowlistedBash(command: string): boolean {
+	if (!command.trim()) return false;
+	let script: ParsedScript;
+	try {
+		script = parse(command);
+	} catch {
+		return false;
+	}
+	const state: WalkState = { sawCd: false, sawGit: false };
+	return walkScript(script, state) && !(state.sawCd && state.sawGit);
+}
+
+function walkScript(script: ParsedScript, state: WalkState): boolean {
+	if (script.errors && script.errors.length > 0) return false;
+	if (script.shebang) return false;
+	if (script.commands.length === 0) return false;
+	return script.commands.every((statement) => walkNode(statement, state));
+}
+
+function walkNode(node: Node, state: WalkState): boolean {
+	switch (node.type) {
+		case "Statement":
+			if (node.background) return false;
+			return walkRedirects(node.redirects, state) && walkNode(node.command, state);
+		case "Command":
+			return walkCommand(node, state);
+		case "Pipeline":
+			if (node.time || node.negated) return false;
+			if (node.operators.includes("|&")) return false;
+			return node.commands.every((child) => walkNode(child, state));
+		case "AndOr":
+			return node.commands.every((child) => walkNode(child, state));
+		case "CompoundList":
+			return node.commands.every((child) => walkNode(child, state));
+		default:
+			return false;
+	}
+}
+
+function walkCommand(command: Command, state: WalkState): boolean {
+	if (command.prefix.length > 0) return false;
+	if (!command.name) return false;
+	if (!walkRedirects(command.redirects, state)) return false;
+	if (!walkWord(command.name, state)) return false;
+	if (!command.suffix.every((word) => walkWord(word, state))) return false;
+
+	const name = staticBareName(command.name);
+	if (!name) return false;
+	if (name === "cd") state.sawCd = true;
+	if (name === "git") state.sawGit = true;
+	if (state.sawCd && state.sawGit) return false;
+	if (ALWAYS_SKIP.has(name)) return true;
+
+	const args: string[] = [];
+	for (const word of command.suffix) {
+		const value = staticWordValue(word);
+		if (value === undefined) return false;
+		args.push(value);
+	}
+
+	switch (name) {
+		case "find":
+			return !args.some((arg) => FIND_VETO.has(arg));
+		case "fd":
+			return !hasFdVeto(args);
+		case "rg":
+			return !hasRgVeto(args);
+		case "sort":
+		case "base64":
+		case "iconv":
+			return !hasOutputFlag(args);
+		case "xxd":
+			return !hasShortOption(args, "r") && !hasLongOption(args, "revert");
+		case "yq":
+			return !hasYqInplace(args);
+		case "sed":
+			return isSafeSed(args);
+		case "hostname":
+			return !hasPositional(args);
+		case "date":
+			return !hasShortOption(args, "s") && !hasLongOption(args, "set");
+		case "git":
+			return isSafeGit(args);
+		default:
+			return false;
+	}
+}
+
+function walkRedirects(redirects: Redirect[], state: WalkState): boolean {
+	for (const redirect of redirects) {
+		if (redirect.target && !walkWord(redirect.target, state)) return false;
+		if (redirect.body && !walkWord(redirect.body, state)) return false;
+		if (WRITE_REDIRECTS.has(redirect.operator)) {
+			if (!redirect.target || staticWordValue(redirect.target) !== "/dev/null") return false;
+			continue;
+		}
+		if (redirect.operator === ">&" || redirect.operator === "<&") {
+			const target = redirect.target ? staticWordValue(redirect.target) : undefined;
+			if (target === "1" || target === "2" || target === "-") continue;
+			if (redirect.operator === "<&" && target === "0") continue;
+			return false;
+		}
+		if (
+			redirect.operator !== "<" &&
+			redirect.operator !== "<<" &&
+			redirect.operator !== "<<-" &&
+			redirect.operator !== "<<<"
+		) {
+			return false;
+		}
+	}
+	return true;
+}
+
+function walkWord(word: Word, state: WalkState): boolean {
+	const parts = word.parts;
+	if (!parts) return true;
+	return parts.every((part) => walkPart(part, state));
+}
+
+function walkPart(part: WordPart, state: WalkState): boolean {
+	switch (part.type) {
+		case "Literal":
+		case "SingleQuoted":
+		case "AnsiCQuoted":
+		case "SimpleExpansion":
+			return true;
+		case "DoubleQuoted":
+		case "LocaleString":
+			return part.parts.every((child) => walkPart(child, state));
+		case "ParameterExpansion":
+			if (part.indexParts && !part.indexParts.every((child) => walkPart(child, state))) return false;
+			if (part.operand && !walkWord(part.operand, state)) return false;
+			if (part.slice) {
+				if (!walkWord(part.slice.offset, state)) return false;
+				if (part.slice.length && !walkWord(part.slice.length, state)) return false;
+			}
+			if (part.replace) {
+				if (!walkWord(part.replace.pattern, state)) return false;
+				if (!walkWord(part.replace.replacement, state)) return false;
+			}
+			return true;
+		case "CommandExpansion":
+			return walkNestedScript(part.script, state);
+		case "ProcessSubstitution":
+			return false;
+		case "ArithmeticExpansion":
+			return part.expression ? walkArithmetic(part.expression, state) : false;
+		case "ExtendedGlob":
+		case "BraceExpansion":
+			return !part.parts || part.parts.every((child) => walkPart(child, state));
+	}
+}
+
+function walkArithmetic(expression: ArithmeticExpression, state: WalkState): boolean {
+	switch (expression.type) {
+		case "ArithmeticBinary":
+			return walkArithmetic(expression.left, state) && walkArithmetic(expression.right, state);
+		case "ArithmeticUnary":
+			return walkArithmetic(expression.operand, state);
+		case "ArithmeticTernary":
+			return (
+				walkArithmetic(expression.test, state) &&
+				walkArithmetic(expression.consequent, state) &&
+				walkArithmetic(expression.alternate, state)
+			);
+		case "ArithmeticGroup":
+			return walkArithmetic(expression.expression, state);
+		case "ArithmeticWord": {
+			const parts = expression.parts;
+			return !parts || parts.every((part) => walkPart(part, state));
+		}
+		case "ArithmeticCommandExpansion":
+			return walkNestedScript(expression.script, state);
+	}
+}
+
+function walkNestedScript(script: ParsedScript | undefined, state: WalkState): boolean {
+	if (!script) return false;
+	return walkScript(script, state);
+}
+
+function staticBareName(word: Word): string | undefined {
+	const value = staticWordValue(word);
+	if (!value || value.includes("/")) return undefined;
+	return value;
+}
+
+function staticWordValue(word: Word): string | undefined {
+	const parts = word.parts;
+	if (!parts) return word.value;
+	if (!parts.every(isStaticPart)) return undefined;
+	return word.value;
+}
+
+function isStaticPart(part: WordPart): boolean {
+	switch (part.type) {
+		case "Literal":
+		case "SingleQuoted":
+		case "AnsiCQuoted":
+			return true;
+		case "DoubleQuoted":
+		case "LocaleString":
+			return part.parts.every((child) => child.type === "Literal");
+		default:
+			return false;
+	}
+}
+
+function hasFdVeto(args: readonly string[]): boolean {
+	return (
+		hasShortOption(args, "x") ||
+		hasShortOption(args, "X") ||
+		hasLongOption(args, "exec") ||
+		hasLongOption(args, "exec-batch")
+	);
+}
+
+function hasRgVeto(args: readonly string[]): boolean {
+	return (
+		hasShortOption(args, "z") ||
+		hasLongOption(args, "pre") ||
+		hasLongOption(args, "hostname-bin") ||
+		hasLongOption(args, "search-zip")
+	);
+}
+
+function hasOutputFlag(args: readonly string[]): boolean {
+	return hasShortOption(args, "o") || hasLongOption(args, "output");
+}
+
+function hasYqInplace(args: readonly string[]): boolean {
+	return hasShortOption(args, "i") || hasLongOption(args, "inplace") || hasLongOption(args, "in-place");
+}
+
+function isSafeSed(args: readonly string[]): boolean {
+	if (args.length < 2 || args[0] !== "-n") return false;
+	const script = args[1];
+	if (script === undefined || !SED_PRINT.test(script)) return false;
+	for (const arg of args.slice(2)) {
+		if (arg === "--") continue;
+		if (arg.startsWith("-")) return false;
+	}
+	return true;
+}
+
+function hasPositional(args: readonly string[]): boolean {
+	let endFlags = false;
+	for (const arg of args) {
+		if (!endFlags) {
+			if (arg === "--") {
+				endFlags = true;
+				continue;
+			}
+			if (arg.startsWith("-") && arg !== "-") continue;
+		}
+		return true;
+	}
+	return false;
+}
+
+function isSafeGit(args: readonly string[]): boolean {
+	if (hasGitWriteExecFlag(args)) return false;
+	const verbIndex = gitVerbIndex(args);
+	if (verbIndex === undefined) return false;
+	const verb = args[verbIndex];
+	if (verb === undefined) return false;
+	const rest = args.slice(verbIndex + 1);
+	if (GIT_READ_VERBS.has(verb)) return true;
+	if (verb === "branch") return isGitBranch(rest);
+	if (verb === "remote") return isGitRemote(rest);
+	if (verb === "tag") return isGitTag(rest);
+	return false;
+}
+
+function gitVerbIndex(args: readonly string[]): number | undefined {
+	for (let index = 0; index < args.length; index += 1) {
+		const arg = args[index];
+		if (arg === undefined || arg === "--") return undefined;
+		if (arg === "--no-pager" || arg === "-P" || arg === "--no-color") continue;
+		if (
+			arg === "-C" ||
+			arg === "-c" ||
+			arg === "-p" ||
+			arg === "--paginate" ||
+			isLongOption(arg, "config-env") ||
+			isLongOption(arg, "exec-path") ||
+			isLongOption(arg, "git-dir") ||
+			isLongOption(arg, "work-tree") ||
+			isLongOption(arg, "namespace") ||
+			isLongOption(arg, "super-prefix")
+		) {
+			return undefined;
+		}
+		if (arg.startsWith("-")) return undefined;
+		return index;
+	}
+	return undefined;
+}
+
+function hasGitWriteExecFlag(args: readonly string[]): boolean {
+	for (const arg of args) {
+		if (arg === "--") break;
+		if (
+			arg === "--paginate" ||
+			isLongOption(arg, "output") ||
+			isLongOption(arg, "ext-diff") ||
+			isLongOption(arg, "textconv") ||
+			isLongOption(arg, "exec")
+		) {
+			return true;
+		}
+	}
+	return false;
+}
+
+function isGitBranch(args: readonly string[]): boolean {
+	for (let index = 0; index < args.length; index += 1) {
+		const arg = args[index];
+		if (arg === undefined || arg === "--") return false;
+		if (
+			arg === "--list" ||
+			arg === "--all" ||
+			arg === "--remotes" ||
+			arg === "--verbose" ||
+			arg === "--show-current"
+		) {
+			continue;
+		}
+		if (isLongOption(arg, "format")) {
+			if (arg === "--format") {
+				if (args[index + 1] === undefined) return false;
+				index += 1;
+			}
+			continue;
+		}
+		if (arg.startsWith("--")) return false;
+		if (!arg.startsWith("-") || arg.length < 2) return false;
+		for (const flag of arg.slice(1)) {
+			if (flag !== "a" && flag !== "l" && flag !== "r" && flag !== "v") return false;
+		}
+	}
+	return true;
+}
+
+function isGitRemote(args: readonly string[]): boolean {
+	let index = 0;
+	while (index < args.length) {
+		const arg = args[index];
+		if (arg !== "-v" && arg !== "--verbose") break;
+		index += 1;
+	}
+	if (index >= args.length) return true;
+	const verb = args[index];
+	return verb === "show" || verb === "get-url";
+}
+
+function isGitTag(args: readonly string[]): boolean {
+	let listing = false;
+	for (const arg of args) {
+		if (arg === "--") return false;
+		if (arg === "-l" || arg === "--list") {
+			listing = true;
+			continue;
+		}
+		if (arg.startsWith("-") && !arg.startsWith("--") && arg.length > 1) {
+			for (const flag of arg.slice(1)) {
+				if (flag !== "l") return false;
+			}
+			listing = true;
+			continue;
+		}
+		if (arg.startsWith("-") || !listing) return false;
+	}
+	return true;
+}
+
+function hasShortOption(args: readonly string[], letter: string): boolean {
+	for (const arg of args) {
+		if (arg === "--") break;
+		if (arg.length < 2 || !arg.startsWith("-") || arg.startsWith("--")) continue;
+		if (arg.slice(1).includes(letter)) return true;
+	}
+	return false;
+}
+
+function hasLongOption(args: readonly string[], name: string): boolean {
+	for (const arg of args) {
+		if (arg === "--") break;
+		if (isLongOption(arg, name)) return true;
+	}
+	return false;
+}
+
+function isLongOption(arg: string, name: string): boolean {
+	return arg === `--${name}` || arg.startsWith(`--${name}=`);
+}

package/extensions/tool-approval/index.ts

@@ -5,6 +5,7 @@ import {
 	type ExtensionContext,
 	type ToolCallEvent,
 } from "@earendil-works/pi-coding-agent";
+import { Marker } from "@shanepadgett/tau-tui";
 import { Type, type Static } from "typebox";
 import { Value } from "typebox/value";
 import { emitAgentBlocked } from "../../shared/agent-blocked.ts";
@@ -12,10 +13,11 @@ import { resolveEffortCandidates } from "../../shared/model-effort.ts";
 import { generateToolValidated } from "../../shared/model-fallback/index.ts";
 import { errorText, truncAt } from "../../shared/text.ts";
 import { loadTauExtensionSettings } from "../../shared/settings/load.ts";
+import { isAllowlistedBash } from "./allowlist.ts";
 import toolApprovalSettings from "./settings.ts";
 
 const STATUS_KEY = "tool-approval";
-const MAX_REVIEW_CHARS = 12_000;
+const AUTO_APPROVED_TYPE = "tau.tool-approval.auto-approved";
 
 const SUMMARY_SCHEMA = Type.String({
 	minLength: 1,
@@ -61,29 +63,6 @@ const REVIEW_SYSTEM_PROMPT = [
 	"An approved review has no reason field. A review that requires user approval must give one concise reason naming the concrete risk without repeating the summary.",
 ].join("\n");
 
-const PLAIN_COMMAND_PATTERN = /^[A-Za-z0-9_./:@%+,=-]+(?: +[A-Za-z0-9_./:@%+,=-]+)*$/;
-const TRIVIAL_READ_ONLY_COMMANDS = new Set(["git diff", "git log", "git show", "git status", "pwd"]);
-const TRIVIAL_READ_ONLY_PROGRAMS = new Set([
-	"basename",
-	"cat",
-	"comm",
-	"cut",
-	"dirname",
-	"du",
-	"echo",
-	"grep",
-	"head",
-	"ls",
-	"printf",
-	"realpath",
-	"rg",
-	"tail",
-	"test",
-	"uniq",
-	"wc",
-	"which",
-]);
-
 const REVIEW_TOOL = {
 	name: "submit_tool_review",
 	description: "Submit the complete safety review for the agent tool request.",
@@ -98,9 +77,24 @@ interface ToolApprovalRequest {
 	input: Record<string, unknown>;
 }
 
+interface AutoApprovedMarker {
+	toolName: ApprovalToolName;
+}
+
 export default function toolApprovalExtension(pi: ExtensionAPI): void {
 	let settings = toolApprovalSettings.defaults;
 
+	pi.registerEntryRenderer<AutoApprovedMarker>(AUTO_APPROVED_TYPE, (entry, _options, theme) => {
+		const marker = autoApprovedMarker(entry.data);
+		if (!marker) return undefined;
+		return new Marker({
+			theme,
+			state: "complete",
+			label: "Auto-approved",
+			parts: [toolLabel(marker.toolName)],
+		});
+	});
+
 	async function refreshSettings(ctx: Pick<ExtensionContext, "cwd" | "isProjectTrusted">): Promise<void> {
 		settings = await loadTauExtensionSettings(ctx, toolApprovalSettings);
 	}
@@ -114,7 +108,8 @@ export default function toolApprovalExtension(pi: ExtensionAPI): void {
 		if (!settings.enabled) return undefined;
 		return {
 			systemPrompt: `${event.systemPrompt}\n\n${[
-				"Agent bash and script_runner requests are reviewed by a separate quick-effort safety classifier before execution.",
+				"Known-safe read-only bash commands skip review.",
+				"Other bash and every script_runner request are reviewed by a separate quick-effort safety classifier before execution.",
 				"Treat classifier approval as a gate, not as permission to hide command intent from the user.",
 				"Routine local development requests can be approved automatically.",
 				"Requests with destructive, system, production, privileged, or security-sensitive effects require human confirmation.",
@@ -143,9 +138,9 @@ export default function toolApprovalExtension(pi: ExtensionAPI): void {
 				return block("bash command is empty");
 			}
 			command = value;
+			if (isAllowlistedBash(command)) return undefined;
 		}
 
-		const readOnlyCommand = request.toolName === "bash" && isTriviallyReadOnly(command ?? "");
 		ctx.ui.setStatus(STATUS_KEY, `reviewing ${toolLabel(request.toolName)}`);
 		try {
 			const review = await reviewToolRequest(ctx, request);
@@ -158,7 +153,10 @@ export default function toolApprovalExtension(pi: ExtensionAPI): void {
 					formatApproval(review.summary, review.reason),
 				);
 			}
-			if (settings.autoApprove || readOnlyCommand) return undefined;
+			if (settings.autoApprove) {
+				pi.appendEntry<AutoApprovedMarker>(AUTO_APPROVED_TYPE, { toolName: request.toolName });
+				return undefined;
+			}
 			return requestToolApproval(
 				pi,
 				ctx,
@@ -194,21 +192,19 @@ function approvalRequest(event: ToolCallEvent): ToolApprovalRequest | undefined
 	return undefined;
 }
 
-function isTriviallyReadOnly(command: string): boolean {
-	const plainCommand = PLAIN_COMMAND_PATTERN.test(command);
-	const separator = command.indexOf(" ");
-	const program = separator === -1 ? command : command.slice(0, separator);
-	return plainCommand && (TRIVIAL_READ_ONLY_COMMANDS.has(command) || TRIVIAL_READ_ONLY_PROGRAMS.has(program));
-}
-
 function toolLabel(toolName: ApprovalToolName): string {
 	return toolName === "bash" ? "bash command" : "script_runner request";
 }
 
+function autoApprovedMarker(value: unknown): AutoApprovedMarker | undefined {
+	if (!value || typeof value !== "object") return undefined;
+	const toolName = (value as AutoApprovedMarker).toolName;
+	if (toolName !== "bash" && toolName !== "script_runner") return undefined;
+	return { toolName };
+}
+
 async function reviewToolRequest(ctx: ExtensionContext, request: ToolApprovalRequest): Promise<ToolReview> {
 	const requestJson = JSON.stringify(request);
-	if (!requestJson || requestJson.length > MAX_REVIEW_CHARS)
-		throw new Error("tool request is too large to review safely");
 	const candidates = await resolveEffortCandidates(ctx, "quick", {
 		includeParentModel: false,
 		preferredProvider: "xai",

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@shanepadgett/tau-agent",
-	"version": "0.36.0",
+	"version": "0.38.0",
 	"description": "Tau is a custom agentic harness built with pi extensions",
 	"type": "module",
 	"main": "./src/index.ts",
@@ -35,10 +35,11 @@
 	],
 	"dependencies": {
 		"@ast-grep/wasm": "0.45.0",
-		"@shanepadgett/tau-tui": "0.36.0",
+		"@shanepadgett/tau-tui": "0.38.0",
 		"@vscode/tree-sitter-wasm": "0.3.1",
 		"image-size": "2.0.2",
 		"smol-toml": "1.7.1",
+		"unbash": "4.0.10",
 		"web-tree-sitter": "0.26.11"
 	},
 	"peerDependencies": {