@vellumai/assistant 0.6.6 → 0.7.0

package/src/permissions/shell-identity.ts

@@ -1,297 +0,0 @@
-import {
-  type CommandSegment,
-  type DangerousPattern,
-  parse,
-  type ParsedCommand,
-} from "../tools/terminal/parser.js";
-import type { AllowlistOption } from "./types.js";
-
-export type { ParsedCommand };
-
-// ── Shell parse result cache ─────────────────────────────────────────────────
-// Shell parsing via web-tree-sitter WASM is deterministic — the same command
-// string always produces the same ParsedCommand. Cache results to avoid
-// redundant WASM invocations on repeated permission checks.
-const PARSE_CACHE_MAX = 256;
-const parseCache = new Map<string, ParsedCommand>();
-
-export async function cachedParse(command: string): Promise<ParsedCommand> {
-  const cached = parseCache.get(command);
-  if (cached !== undefined) {
-    // LRU refresh: move to end of insertion order
-    parseCache.delete(command);
-    parseCache.set(command, cached);
-    return cached;
-  }
-  const result = await parse(command);
-  // Evict oldest entry if at capacity
-  if (parseCache.size >= PARSE_CACHE_MAX) {
-    const oldest = parseCache.keys().next().value;
-    if (oldest !== undefined) parseCache.delete(oldest);
-  }
-  parseCache.set(command, result);
-  return result;
-}
-
-export interface ShellActionKey {
-  /** e.g. "action:gh", "action:gh pr", "action:gh pr view" */
-  key: string;
-  /** How many tokens deep this key goes */
-  depth: number;
-}
-
-export interface ShellIdentityAnalysis {
-  /** The parsed segments from the shell parser */
-  segments: CommandSegment[];
-  /** The operator sequence between segments (e.g. ['&&', '|']) */
-  operators: string[];
-  /** Whether the command contains opaque constructs (eval, heredocs, etc.) */
-  hasOpaqueConstructs: boolean;
-  /** Dangerous patterns detected by the parser */
-  dangerousPatterns: DangerousPattern[];
-}
-
-export interface ActionKeyResult {
-  /** The derived action keys from narrowest to broadest */
-  keys: ShellActionKey[];
-  /** Whether this command has a "simple action" shape (setup prefix + single action) */
-  isSimpleAction: boolean;
-  /** The primary action segment (the non-setup-prefix action command) */
-  primarySegment?: CommandSegment;
-}
-
-/** Programs that are considered setup prefixes (not the main action) */
-const SETUP_PREFIX_PROGRAMS = new Set([
-  "cd",
-  "pushd",
-  "export",
-  "unset",
-  "set",
-]);
-
-const MAX_ACTION_KEY_DEPTH = 3;
-
-/**
- * Analyze a shell command using the tree-sitter parser to extract
- * identity information for permission decisions.
- */
-export async function analyzeShellCommand(
-  command: string,
-  preParsed?: ParsedCommand,
-): Promise<ShellIdentityAnalysis> {
-  const parsed = preParsed ?? (await cachedParse(command));
-
-  const operators: string[] = [];
-  for (const seg of parsed.segments) {
-    if (seg.operator) {
-      operators.push(seg.operator);
-    }
-  }
-
-  return {
-    segments: parsed.segments,
-    operators,
-    hasOpaqueConstructs: parsed.hasOpaqueConstructs,
-    dangerousPatterns: parsed.dangerousPatterns,
-  };
-}
-
-/**
- * Derive canonical action keys from a shell command analysis.
- *
- * Action keys identify the "family" of a command for allowlist purposes.
- * For example, `cd repo && gh pr view 5525 --json title` derives:
- *   - action:gh pr view
- *   - action:gh pr
- *   - action:gh
- *
- * Simple actions (optional setup prefix + one action) and pipelines get
- * action keys. Both are marked non-simple when they involve pipes, but
- * pipelines extract keys from the first segment before the first pipe.
- * Complex chains (semicolons, ||, &, newlines) get no action keys.
- */
-export function deriveShellActionKeys(
-  analysis: ShellIdentityAnalysis,
-): ActionKeyResult {
-  const { segments } = analysis;
-
-  if (segments.length === 0) {
-    return { keys: [], isSimpleAction: false };
-  }
-
-  // For multi-segment commands, check operators to determine the command shape.
-  // Pipes (|) get special handling — we can extract action keys from the first
-  // segment before the pipe. Other complex operators (||, ;, &, empty/missing)
-  // are truly opaque and get no action keys.
-  if (segments.length > 1) {
-    let hasPipe = false;
-
-    for (const seg of segments) {
-      const op = seg.operator;
-      // Non-empty operator that isn't && or | → definitely complex, no keys
-      if (op && op !== "&&" && op !== "|") {
-        return { keys: [], isSimpleAction: false };
-      }
-      if (op === "|") {
-        hasPipe = true;
-      }
-    }
-    // Also check: if there are multiple segments but no operators at all
-    // between them (e.g. newline-separated), that's suspicious.
-    // The first segment always has operator '' (no preceding operator).
-    // If any non-first segment also has operator '', the separator was
-    // not captured — treat as complex for safety.
-    for (let i = 1; i < segments.length; i++) {
-      if (!segments[i].operator) {
-        return { keys: [], isSimpleAction: false };
-      }
-    }
-
-    // For pipelines, extract action keys from the first non-setup-prefix segment
-    // before the first pipe. This enables broader "Any pdftotext command" rules
-    // that match pipelines like "pdftotext file | head -100".
-    if (hasPipe) {
-      const firstPipeIndex = segments.findIndex((s) => s.operator === "|");
-      if (firstPipeIndex > 0) {
-        const preSegments = segments.slice(0, firstPipeIndex);
-        const actionSegs = preSegments.filter(
-          (s) => !SETUP_PREFIX_PROGRAMS.has(s.program),
-        );
-        if (actionSegs.length === 1) {
-          const seg = actionSegs[0];
-          const tokens: string[] = [seg.program];
-          for (const arg of seg.args) {
-            if (tokens.length >= MAX_ACTION_KEY_DEPTH) break;
-            if (arg.startsWith("-")) continue;
-            if (arg.includes("/") || arg.startsWith(".")) continue;
-            if (/^\d+$/.test(arg)) continue;
-            if (arg.includes("$") || arg.includes('"') || arg.includes("'"))
-              continue;
-            tokens.push(arg);
-          }
-          const keys: ShellActionKey[] = [];
-          for (let depth = tokens.length; depth >= 1; depth--) {
-            keys.push({
-              key: `action:${tokens.slice(0, depth).join(" ")}`,
-              depth,
-            });
-          }
-          return { keys, isSimpleAction: false, primarySegment: seg };
-        }
-      }
-      // Pipeline but couldn't extract a single primary action — no keys
-      return { keys: [], isSimpleAction: false };
-    }
-  }
-
-  // Separate setup-prefix segments from action segments
-  const actionSegments: CommandSegment[] = [];
-  let foundNonPrefix = false;
-
-  for (const seg of segments) {
-    if (!foundNonPrefix && SETUP_PREFIX_PROGRAMS.has(seg.program)) {
-      continue;
-    }
-    foundNonPrefix = true;
-    actionSegments.push(seg);
-  }
-
-  // Simple action: exactly one non-prefix action segment
-  if (actionSegments.length !== 1) {
-    return { keys: [], isSimpleAction: false };
-  }
-
-  const primarySegment = actionSegments[0];
-  const tokens: string[] = [primarySegment.program];
-
-  // Add non-flag, non-path stable subcommand tokens (up to MAX_ACTION_KEY_DEPTH)
-  for (const arg of primarySegment.args) {
-    if (tokens.length >= MAX_ACTION_KEY_DEPTH) break;
-    if (arg.startsWith("-")) continue;
-    if (arg.includes("/") || arg.startsWith(".")) continue;
-    if (/^\d+$/.test(arg)) continue;
-    if (arg.includes("$") || arg.includes('"') || arg.includes("'")) continue;
-    tokens.push(arg);
-  }
-
-  // Build action keys from narrowest to broadest
-  const keys: ShellActionKey[] = [];
-  for (let depth = tokens.length; depth >= 1; depth--) {
-    keys.push({
-      key: `action:${tokens.slice(0, depth).join(" ")}`,
-      depth,
-    });
-  }
-
-  return { keys, isSimpleAction: true, primarySegment };
-}
-
-/**
- * Build allowlist options for shell commands using parser-derived identity.
- *
- * For simple actions (optional setup prefix + one action), options are:
- *   1. Exact canonical primary command
- *   2. Deepest action key (e.g. "action:gh pr view")
- *   3. Broader action keys (e.g. "action:gh pr", "action:gh")
- *
- * For pipelines, the exact command plus action-key-based broader options
- * are offered. For other complex commands (multi-action chains, semicolons,
- * etc.), only the exact command is offered.
- */
-export async function buildShellAllowlistOptions(
-  command: string,
-): Promise<AllowlistOption[]> {
-  const trimmed = command.trim();
-  if (!trimmed) return [];
-
-  const analysis = await analyzeShellCommand(trimmed);
-  const actionResult = deriveShellActionKeys(analysis);
-
-  if (!actionResult.isSimpleAction || !actionResult.primarySegment) {
-    const options: AllowlistOption[] = [
-      {
-        label: trimmed,
-        description: "This exact compound command",
-        pattern: trimmed,
-      },
-    ];
-    // If pipeline action keys were extracted, offer them as broader options
-    for (const actionKey of actionResult.keys) {
-      const keyTokens = actionKey.key.replace(/^action:/, "");
-      options.push({
-        label: `${keyTokens} *`,
-        description: `Any "${keyTokens}" command`,
-        pattern: actionKey.key,
-      });
-    }
-    return options;
-  }
-
-  const options: AllowlistOption[] = [];
-
-  // Full original command text
-  options.push({
-    label: trimmed,
-    description: "This exact command",
-    pattern: trimmed,
-  });
-
-  // Action keys from narrowest to broadest
-  for (const actionKey of actionResult.keys) {
-    const keyTokens = actionKey.key.replace(/^action:/, "");
-    options.push({
-      label: `${keyTokens} *`,
-      description: `Any "${keyTokens}" command`,
-      pattern: actionKey.key,
-    });
-  }
-
-  // Deduplicate by pattern
-  const seen = new Set<string>();
-  return options.filter((o) => {
-    if (seen.has(o.pattern)) return false;
-    seen.add(o.pattern);
-    return true;
-  });
-}
-

package/src/permissions/skill-risk-classifier.test.ts

@@ -1,311 +0,0 @@
-import { describe, expect, mock, test } from "bun:test";
-
-// ── Mocks ────────────────────────────────────────────────────────────────────
-
-// Mock skill resolution so we can control version hashes and catalog lookups.
-let mockResolvedSkill: {
-  id: string;
-  directoryPath: string;
-} | null = null;
-let mockVersionHash: string | undefined;
-let mockTransitiveHash: string | undefined;
-let mockInlineExpansions: string[] = [];
-let mockInlineEnabled = false;
-
-mock.module("../config/skills.js", () => ({
-  resolveSkillSelector: (_selector: string) => ({
-    skill: mockResolvedSkill,
-  }),
-  loadSkillCatalog: () =>
-    mockResolvedSkill
-      ? [
-          {
-            id: mockResolvedSkill.id,
-            directoryPath: mockResolvedSkill.directoryPath,
-            inlineCommandExpansions:
-              mockInlineExpansions.length > 0
-                ? mockInlineExpansions
-                : undefined,
-          },
-        ]
-      : [],
-}));
-
-mock.module("../skills/version-hash.js", () => ({
-  computeSkillVersionHash: () => {
-    if (mockVersionHash === undefined) throw new Error("no hash");
-    return mockVersionHash;
-  },
-}));
-
-mock.module("../skills/transitive-version-hash.js", () => ({
-  computeTransitiveSkillVersionHash: () => {
-    if (mockTransitiveHash === undefined) throw new Error("no hash");
-    return mockTransitiveHash;
-  },
-}));
-
-mock.module("../skills/include-graph.js", () => ({
-  indexCatalogById: () => new Map(),
-}));
-
-mock.module("../config/loader.js", () => ({
-  getConfig: () => ({}),
-}));
-
-mock.module("../config/assistant-feature-flags.js", () => ({
-  isAssistantFeatureFlagEnabled: () => mockInlineEnabled,
-}));
-
-import {
-  type SkillClassifierInput,
-  SkillLoadRiskClassifier,
-  skillLoadRiskClassifier,
-} from "./skill-risk-classifier.js";
-
-// ── Test helpers ─────────────────────────────────────────────────────────────
-
-function resetMocks(): void {
-  mockResolvedSkill = null;
-  mockVersionHash = undefined;
-  mockTransitiveHash = undefined;
-  mockInlineExpansions = [];
-  mockInlineEnabled = false;
-}
-
-// ── SkillLoadRiskClassifier ──────────────────────────────────────────────────
-
-describe("SkillLoadRiskClassifier", () => {
-  test("skill_load is always Low risk", async () => {
-    resetMocks();
-    const classifier = new SkillLoadRiskClassifier();
-    const result = await classifier.classify({ toolName: "skill_load" });
-    expect(result.riskLevel).toBe("low");
-    expect(result.reason).toBe("Skill load (default)");
-    expect(result.scopeOptions).toEqual([]);
-    expect(result.matchType).toBe("registry");
-  });
-
-  test("scaffold_managed_skill is always High risk", async () => {
-    resetMocks();
-    const classifier = new SkillLoadRiskClassifier();
-    const result = await classifier.classify({
-      toolName: "scaffold_managed_skill",
-    });
-    expect(result.riskLevel).toBe("high");
-    expect(result.reason).toBe(
-      "Skill scaffold — writes persistent skill source code",
-    );
-    expect(result.scopeOptions).toEqual([]);
-    expect(result.matchType).toBe("registry");
-  });
-
-  test("delete_managed_skill is always High risk", async () => {
-    resetMocks();
-    const classifier = new SkillLoadRiskClassifier();
-    const result = await classifier.classify({
-      toolName: "delete_managed_skill",
-    });
-    expect(result.riskLevel).toBe("high");
-    expect(result.reason).toBe(
-      "Skill delete — removes persistent skill source code",
-    );
-    expect(result.scopeOptions).toEqual([]);
-    expect(result.matchType).toBe("registry");
-  });
-
-  test("skill_load with skillSelector is still Low risk", async () => {
-    resetMocks();
-    const classifier = new SkillLoadRiskClassifier();
-    const result = await classifier.classify({
-      toolName: "skill_load",
-      skillSelector: "my-custom-skill",
-    });
-    expect(result.riskLevel).toBe("low");
-    expect(result.reason).toBe("Skill load (default)");
-  });
-
-  test("scaffold_managed_skill with skillSelector is still High risk", async () => {
-    resetMocks();
-    const classifier = new SkillLoadRiskClassifier();
-    const result = await classifier.classify({
-      toolName: "scaffold_managed_skill",
-      skillSelector: "new-skill",
-    });
-    expect(result.riskLevel).toBe("high");
-  });
-
-  test("delete_managed_skill with skillSelector is still High risk", async () => {
-    resetMocks();
-    const classifier = new SkillLoadRiskClassifier();
-    const result = await classifier.classify({
-      toolName: "delete_managed_skill",
-      skillSelector: "old-skill",
-    });
-    expect(result.riskLevel).toBe("high");
-  });
-});
-
-// ── Allowlist options ────────────────────────────────────────────────────────
-
-describe("allowlistOptions", () => {
-  test("skill_load without selector produces wildcard option", async () => {
-    resetMocks();
-    const classifier = new SkillLoadRiskClassifier();
-    const result = await classifier.classify({ toolName: "skill_load" });
-    expect(result.allowlistOptions).toEqual([
-      {
-        label: "skill_load:*",
-        description: "All skill loads",
-        pattern: "skill_load:*",
-      },
-    ]);
-  });
-
-  test("skill_load with unresolvable selector produces selector-based option", async () => {
-    resetMocks();
-    // mockResolvedSkill is null — skill not found
-    const classifier = new SkillLoadRiskClassifier();
-    const result = await classifier.classify({
-      toolName: "skill_load",
-      skillSelector: "unknown-skill",
-    });
-    expect(result.allowlistOptions).toEqual([
-      {
-        label: "unknown-skill",
-        description: "This skill",
-        pattern: "skill_load:unknown-skill",
-      },
-    ]);
-  });
-
-  test("skill_load with resolved skill + version hash produces version-pinned option", async () => {
-    resetMocks();
-    mockResolvedSkill = { id: "my-skill", directoryPath: "/skills/my-skill" };
-    mockVersionHash = "abc123";
-
-    const classifier = new SkillLoadRiskClassifier();
-    const result = await classifier.classify({
-      toolName: "skill_load",
-      skillSelector: "my-skill",
-    });
-    expect(result.allowlistOptions).toEqual([
-      {
-        label: "my-skill@abc123",
-        description: "This exact version",
-        pattern: "skill_load:my-skill@abc123",
-      },
-    ]);
-  });
-
-  test("skill_load with dynamic skill produces version-pinned + any-version options", async () => {
-    resetMocks();
-    mockResolvedSkill = {
-      id: "dynamic-skill",
-      directoryPath: "/skills/dynamic-skill",
-    };
-    mockVersionHash = "def456";
-    mockTransitiveHash = "trans789";
-    mockInlineExpansions = ["some-command"];
-    mockInlineEnabled = true;
-
-    const classifier = new SkillLoadRiskClassifier();
-    const result = await classifier.classify({
-      toolName: "skill_load",
-      skillSelector: "dynamic-skill",
-    });
-    expect(result.allowlistOptions).toEqual([
-      {
-        label: "dynamic-skill@trans789",
-        description: "This exact version (pinned)",
-        pattern: "skill_load_dynamic:dynamic-skill@trans789",
-      },
-      {
-        label: "dynamic-skill",
-        description: "This skill (any version)",
-        pattern: "skill_load_dynamic:dynamic-skill",
-      },
-    ]);
-  });
-
-  test("scaffold_managed_skill produces skill-specific + wildcard options", async () => {
-    resetMocks();
-    const classifier = new SkillLoadRiskClassifier();
-    const result = await classifier.classify({
-      toolName: "scaffold_managed_skill",
-      skillSelector: "new-skill",
-    });
-    expect(result.allowlistOptions).toEqual([
-      {
-        label: "new-skill",
-        description: "This skill only",
-        pattern: "scaffold_managed_skill:new-skill",
-      },
-      {
-        label: "scaffold_managed_skill:*",
-        description: "All managed skill scaffolds",
-        pattern: "scaffold_managed_skill:*",
-      },
-    ]);
-  });
-
-  test("delete_managed_skill produces skill-specific + wildcard options", async () => {
-    resetMocks();
-    const classifier = new SkillLoadRiskClassifier();
-    const result = await classifier.classify({
-      toolName: "delete_managed_skill",
-      skillSelector: "old-skill",
-    });
-    expect(result.allowlistOptions).toEqual([
-      {
-        label: "old-skill",
-        description: "This skill only",
-        pattern: "delete_managed_skill:old-skill",
-      },
-      {
-        label: "delete_managed_skill:*",
-        description: "All managed skill deletes",
-        pattern: "delete_managed_skill:*",
-      },
-    ]);
-  });
-
-  test("scaffold_managed_skill without selector produces only wildcard", async () => {
-    resetMocks();
-    const classifier = new SkillLoadRiskClassifier();
-    const result = await classifier.classify({
-      toolName: "scaffold_managed_skill",
-    });
-    expect(result.allowlistOptions).toEqual([
-      {
-        label: "scaffold_managed_skill:*",
-        description: "All managed skill scaffolds",
-        pattern: "scaffold_managed_skill:*",
-      },
-    ]);
-  });
-});
-
-// ── Singleton export ─────────────────────────────────────────────────────────
-
-describe("singleton", () => {
-  test("skillLoadRiskClassifier is an instance of SkillLoadRiskClassifier", () => {
-    expect(skillLoadRiskClassifier).toBeInstanceOf(SkillLoadRiskClassifier);
-  });
-
-  test("singleton produces same results as fresh instance", async () => {
-    resetMocks();
-    const inputs: SkillClassifierInput[] = [
-      { toolName: "skill_load" },
-      { toolName: "scaffold_managed_skill" },
-      { toolName: "delete_managed_skill" },
-    ];
-
-    const fresh = new SkillLoadRiskClassifier();
-    for (const input of inputs) {
-      const singletonResult = await skillLoadRiskClassifier.classify(input);
-      const freshResult = await fresh.classify(input);
-      expect(singletonResult).toEqual(freshResult);
-    }
-  });
-});