@swifty.js/swifty 0.0.21 → 0.0.22

package/dist/lib/chunk-7URDLWQN.js

@@ -0,0 +1,426 @@
+import {
+  mcpCallPermissionContent
+} from "./chunk-GNBXECZN.js";
+import {
+  createChildLogger,
+  strArg
+} from "./chunk-EJLGB2EJ.js";
+import {
+  MCP_CALL_TOOL_NAME
+} from "./chunk-GHF2PSEW.js";
+
+// src/permissions/checker.ts
+import { readFileSync, writeFileSync, mkdirSync, statSync } from "fs";
+import { homedir, tmpdir } from "os";
+import { join, resolve, dirname } from "path";
+import yaml from "js-yaml";
+import z, { parse } from "zod";
+var log = createChildLogger({ module: "permissions" });
+var DANGEROUS_PATTERNS = [];
+var SAFE_PREFIXES = [
+  "ls",
+  "pwd",
+  "echo",
+  "cat",
+  "head",
+  "tail",
+  "wc",
+  "date",
+  "whoami",
+  "uname",
+  "hostname",
+  "which",
+  "type",
+  "file",
+  "git status",
+  "git log",
+  "git diff",
+  "git branch",
+  "git show",
+  "git rev-parse",
+  "git remote",
+  "bun test",
+  "bun run",
+  "npm test",
+  "npm run",
+  "go test",
+  "go build",
+  "go vet",
+  "python -c",
+  "node -e"
+];
+var CONTENT_FIELDS = {
+  Bash: "command",
+  PowerShell: "command",
+  ReadFile: "file_path",
+  WriteFile: "file_path",
+  EditFile: "file_path",
+  Glob: "pattern",
+  Grep: "pattern"
+};
+var DEFAULT_DENY_WRITE = [
+  ".swifty/config.yaml",
+  ".swifty/permissions.local.yaml",
+  ".swifty/skills/"
+];
+function extractContent(toolName, args) {
+  if (toolName === MCP_CALL_TOOL_NAME) {
+    return mcpCallPermissionContent(strArg(args, "server", ""), strArg(args, "tool", ""));
+  }
+  const field = CONTENT_FIELDS[toolName];
+  if (!field) {
+    return "";
+  }
+  const v = args[field];
+  return typeof v === "string" ? v : "";
+}
+var PathSandbox = class {
+  allowedRoots;
+  denyWritePaths;
+  projectDir;
+  constructor(projectDir) {
+    this.projectDir = resolve(projectDir);
+    this.allowedRoots = [this.projectDir, tmpdir()];
+    this.denyWritePaths = DEFAULT_DENY_WRITE.map((p) => join(this.projectDir, p));
+  }
+  addRoot(root) {
+    this.allowedRoots.push(resolve(root));
+  }
+  // Add custom deny-write paths
+  addDenyWrite(path) {
+    this.denyWritePaths.push(resolve(path));
+  }
+  /**
+   * Check whether a path is in the deny-write list.
+   * denyWrite has the highest priority — even if the path is within an allowed root, writes are still denied.
+   */
+  checkDenyWrite(filePath) {
+    const absolute = resolve(filePath);
+    for (const denied of this.denyWritePaths) {
+      if (absolute.startsWith(denied)) {
+        return {
+          effect: "deny",
+          reason: `Path ${filePath} is in deny-write list`
+        };
+      }
+    }
+    return null;
+  }
+  check(filePath) {
+    const absolute = resolve(filePath);
+    for (const root of this.allowedRoots) {
+      if (absolute.startsWith(root)) {
+        return null;
+      }
+    }
+    return {
+      effect: "deny",
+      reason: `Path ${filePath} is outside allowed directories`
+    };
+  }
+};
+function globMatch(pattern, content) {
+  const re = "^" + pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".") + "$";
+  try {
+    return new RegExp(re).test(content);
+  } catch (err) {
+    log.error({ err }, "permissions operation failed");
+    return false;
+  }
+}
+var RULE_RE = /^(\w+)\((.+)\)$/;
+function loadRulesFile(path) {
+  let data;
+  try {
+    data = readFileSync(path, "utf-8");
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      log.error({ err }, "permissions operation failed");
+    }
+    return [];
+  }
+  const YamlEntrySchema = z.object({
+    rule: z.string().optional(),
+    effect: z.string().optional()
+  });
+  let yamlData;
+  try {
+    const parsed = yaml.load(data);
+    yamlData = parse(z.array(YamlEntrySchema), parsed);
+  } catch (err) {
+    log.error({ err }, "permissions operation failed");
+    return [];
+  }
+  const rules = [];
+  for (const entry of yamlData) {
+    if (entry.effect !== "allow" && entry.effect !== "deny" && entry.effect !== "ask") {
+      continue;
+    }
+    const m = RULE_RE.exec((entry.rule ?? "").trim());
+    if (!m) {
+      continue;
+    }
+    rules.push({ tool: m[1], pattern: m[2], effect: entry.effect });
+  }
+  return rules;
+}
+function evaluateRules(rules, toolName, content) {
+  let hit = null;
+  for (const r of rules) {
+    if (r.tool !== toolName && r.tool !== "*") {
+      continue;
+    }
+    if (!globMatch(r.pattern, content)) {
+      continue;
+    }
+    if (r.effect === "deny") {
+      return "deny";
+    }
+    if (r.effect === "ask") {
+      hit = "ask";
+    } else {
+      hit ??= "allow";
+    }
+  }
+  return hit;
+}
+var RuleEngine = class {
+  userPath;
+  projectPath;
+  localPath;
+  cache = /* @__PURE__ */ new Map();
+  constructor(workDir) {
+    this.userPath = join(homedir(), ".swifty", "permissions.yaml");
+    this.projectPath = join(workDir, ".swifty", "permissions.yaml");
+    this.localPath = join(workDir, ".swifty", "permissions.local.yaml");
+  }
+  // Read a single rules file; skips disk I/O and parsing on cache hit.
+  rulesFor(path) {
+    let st;
+    try {
+      st = statSync(path, { bigint: true });
+    } catch {
+      this.cache.delete(path);
+      return [];
+    }
+    const cached = this.cache.get(path);
+    if (cached?.mtimeNs === st.mtimeNs && cached.size === st.size) {
+      return cached.rules;
+    }
+    const rules = loadRulesFile(path);
+    this.cache.set(path, { mtimeNs: st.mtimeNs, size: st.size, rules });
+    return rules;
+  }
+  // Return the merged snapshot of all three rules files. Reuses the previous
+  // parse result when files are unchanged; re-reads only on change, so edits
+  // take effect on the next evaluation without redundant parsing. One snapshot
+  // is taken per tool call and shared across sub-command checks.
+  snapshot() {
+    return [this.userPath, this.projectPath, this.localPath].flatMap((p) => this.rulesFor(p));
+  }
+  // Take a snapshot then adjudicate: reuses the previous parse result when
+  // files are unchanged; a freshly written "allow always" rule takes effect
+  // immediately. Priority is deny > ask > allow regardless of which layer or
+  // line a rule resides on, so a deny cannot be overridden by an allow from
+  // another layer. Returns null when no rule matches.
+  evaluate(toolName, content) {
+    return evaluateRules(this.snapshot(), toolName, content);
+  }
+  // Persists a rule to the project-local YAML file in the `Tool(pattern)`
+  // format so "allow always" survives a restart.
+  appendLocalRule(rule) {
+    mkdirSync(dirname(this.localPath), { recursive: true });
+    const rules = loadRulesFile(this.localPath);
+    const exists = rules.some(
+      (r) => r.tool === rule.tool && r.pattern === rule.pattern && r.effect === rule.effect
+    );
+    if (exists) {
+      return;
+    }
+    rules.push(rule);
+    const entries = rules.map((r) => ({
+      rule: `${r.tool}(${r.pattern})`,
+      effect: r.effect
+    }));
+    writeFileSync(this.localPath, yaml.dump(entries), "utf-8");
+  }
+};
+function detectDangerous(command) {
+  for (const p of DANGEROUS_PATTERNS) {
+    if (p.re.test(command)) {
+      return p.reason;
+    }
+  }
+  return "";
+}
+function isSafeCommand(command) {
+  const trimmed = command.trim();
+  if (trimmed.includes(">") || trimmed.includes("|") || trimmed.includes(";") || trimmed.includes("&&") || trimmed.includes("$(") || trimmed.includes("`")) {
+    return false;
+  }
+  return SAFE_PREFIXES.some(
+    (prefix) => trimmed === prefix || trimmed.startsWith(prefix + " ") || trimmed.startsWith(prefix + "	")
+  );
+}
+function modeDecide(mode, category) {
+  switch (mode) {
+    case "bypassPermissions":
+      return "allow";
+    case "plan":
+      return category === "read" ? "allow" : "ask";
+    case "acceptEdits":
+      return category === "command" ? "ask" : "allow";
+    case "default":
+    default:
+      return category === "read" ? "allow" : "ask";
+  }
+}
+var PermissionChecker = class {
+  mode;
+  planFilePath = "";
+  // Sandbox mode: when enabled, command-category tools run through OS sandbox isolation, with optional auto-allow
+  sandboxEnabled = false;
+  sandboxAutoAllow = false;
+  sandbox;
+  ruleEngine;
+  constructor(workDir, mode = "default") {
+    this.mode = mode;
+    this.sandbox = new PathSandbox(workDir);
+    this.ruleEngine = new RuleEngine(workDir);
+  }
+  check(toolName, category, args) {
+    const content = extractContent(toolName, args);
+    let snapshot = null;
+    const rules = () => snapshot ??= this.ruleEngine.snapshot();
+    if (this.mode === "plan" && (toolName === "WriteFile" || toolName === "EditFile")) {
+      const path = strArg(args, "file_path", "");
+      if (path.includes(".swifty/plans/")) {
+        return {
+          effect: "allow",
+          reason: "Plan file write allowed in plan mode"
+        };
+      }
+    }
+    if (category === "command" && isSafeCommand(content)) {
+      return { effect: "allow", reason: "Safe read-only command" };
+    }
+    const dangerReason = category === "command" ? detectDangerous(content) : "";
+    if (dangerReason) {
+      return {
+        effect: "deny",
+        reason: `Dangerous command blocked: ${dangerReason}`
+      };
+    }
+    if (this.sandboxEnabled && this.sandboxAutoAllow && toolName === "Bash") {
+      const subcommands = strArg(args, "command").split(/\s*(?:&&|\|\||[;|])\s*/).map((s) => s.trim()).filter(Boolean);
+      let hasAsk = false;
+      for (const sub of subcommands) {
+        const ruleResult = evaluateRules(rules(), toolName, sub);
+        if (ruleResult === "deny") {
+          return { effect: "deny", reason: "Permission rule: deny" };
+        }
+        if (ruleResult === "ask") {
+          hasAsk = true;
+        }
+      }
+      if (hasAsk) {
+        return {
+          effect: "ask",
+          reason: "Permission rule: ask (sandbox does not override)"
+        };
+      }
+      return {
+        effect: "allow",
+        reason: "Sandbox auto-allow: OS sandbox active"
+      };
+    }
+    const filePath = strArg(args, "file_path", strArg(args, "path", ""));
+    if ((category === "read" || category === "write") && filePath) {
+      if (category === "write") {
+        const denyDecision = this.sandbox.checkDenyWrite(filePath);
+        if (denyDecision) {
+          return denyDecision;
+        }
+      }
+      const sandboxDecision = this.sandbox.check(filePath);
+      if (sandboxDecision && this.mode !== "bypassPermissions") {
+        const ruleEffect2 = this.ruleEngine.evaluate(toolName, content);
+        if (ruleEffect2) {
+          return {
+            effect: ruleEffect2,
+            reason: `Permission rule: ${ruleEffect2}`
+          };
+        }
+        return { effect: "ask", reason: sandboxDecision.reason };
+      }
+    }
+    const ruleEffect = evaluateRules(rules(), toolName, content);
+    if (ruleEffect) {
+      return { effect: ruleEffect, reason: `Permission rule: ${ruleEffect}` };
+    }
+    return {
+      effect: modeDecide(this.mode, category),
+      reason: `Mode: ${this.mode}`
+    };
+  }
+  // Allow an extra directory outside the project root. When a background agent
+  // needs read/write access to user-level data (e.g., user-level memory dir),
+  // the caller declares it explicitly; the sandbox baseline stays at the project root.
+  allowExtraRoot(path) {
+    this.sandbox.addRoot(path);
+  }
+  // Persist a scoped "allow always" rule.
+  // - File path: parent directory + `/*` (a directory path uses itself + `/*`).
+  // - Command: first 1-2 words + `*` so it allows that command family.
+  allowAlways(toolName, args) {
+    const content = extractContent(toolName, args);
+    const isFilePath = toolName === "ReadFile" || toolName === "WriteFile" || toolName === "EditFile";
+    let pattern;
+    if (isFilePath && content) {
+      const abs = resolve(content);
+      let isDir = false;
+      try {
+        isDir = statSync(abs).isDirectory();
+      } catch {
+      }
+      pattern = join(isDir ? abs : dirname(abs), "*");
+    } else {
+      const words = content.trim().split(/\s+/).slice(0, 2);
+      pattern = words.join(" ") + "*";
+    }
+    this.ruleEngine.appendLocalRule({
+      tool: toolName,
+      pattern,
+      effect: "allow"
+    });
+  }
+  /**
+   * Generate a human-readable description of the tool action for display in HITL confirmation dialogs.
+   * Prioritizes extracting fields defined in contentFields (e.g., command, file_path);
+   * falls back to a key:value summary of parameters if no match is found.
+   */
+  describeToolAction(toolName, args) {
+    const content = extractContent(toolName, args);
+    if (content) {
+      return content;
+    }
+    const parts = [];
+    for (const [k, v] of Object.entries(args)) {
+      let s = String(v);
+      if (s.length > 80) {
+        s = s.slice(0, 80) + "...";
+      }
+      parts.push(`${k}: ${s}`);
+    }
+    return parts.join(", ");
+  }
+};
+
+export {
+  extractContent,
+  PathSandbox,
+  evaluateRules,
+  RuleEngine,
+  isSafeCommand,
+  PermissionChecker
+};