@wichayutdew/pi-workflows 1.0.1 → 2.0.0

package/src/policy/reviewed-command-safety.ts

@@ -1,150 +0,0 @@
-import { basename } from 'node:path';
-import { tokenizeRestrictedCommand } from './restricted-command.ts';
-import { parseRestrictedGitCommand } from './restricted-git.ts';
-
-const SHELL_WRAPPERS: ReadonlySet<string> = new Set([
-  'bash',
-  'env',
-  'exec',
-  'fish',
-  'sh',
-  'xargs',
-  'zsh',
-]);
-const REMOTE_EXECUTABLES: ReadonlySet<string> = new Set([
-  'curl',
-  'scp',
-  'ssh',
-  'rsync',
-  'wget',
-]);
-const FORBIDDEN_LONG_PUSH_OPTIONS = [
-  '--force',
-  '--force-if-includes',
-  '--force-with-lease',
-  '--all',
-  '--delete',
-  '--mirror',
-  '--prune',
-  '--tags',
-] as const;
-const PUBLISH_EXECUTABLES: ReadonlySet<string> = new Set([
-  'bun',
-  'cargo',
-  'npm',
-  'pnpm',
-  'yarn',
-]);
-const LOCAL_VERIFICATION_GIT_SUBCOMMANDS: ReadonlySet<string> = new Set([
-  'add',
-  'branch',
-  'commit',
-  'diff',
-  'grep',
-  'log',
-  'ls-files',
-  'rev-parse',
-  'show',
-  'status',
-  'worktree',
-]);
-
-const containsPublishOperation = (tokens: ReadonlyArray<string>): boolean =>
-  tokens
-    .slice(1)
-    .some((token) => token.length >= 3 && 'publish'.startsWith(token));
-
-const hasDestructivePushShortOption = (token: string): boolean =>
-  token.startsWith('-') &&
-  !token.startsWith('--') &&
-  (token.slice(1).includes('f') || token.slice(1).includes('d'));
-
-const hasForbiddenLongPushOption = (token: string): boolean => {
-  if (!token.startsWith('--') || token === '--') return false;
-  const optionName = token.split('=', 1)[0] ?? token;
-  return FORBIDDEN_LONG_PUSH_OPTIONS.some((option) =>
-    option.startsWith(optionName),
-  );
-};
-
-const hasEmptyPushRefspecSide = (token: string): boolean => {
-  const separator = token.indexOf(':');
-  return separator >= 0 && (separator === 0 || separator === token.length - 1);
-};
-
-/**
- * Determines whether a reviewed verification command is safe to authorize.
- *
- * @param command - Exact command extracted from an approved artifact.
- * @returns `true` for local, non-publishing verification commands.
- */
-export const isSafeVerificationCommand = (command: string): boolean => {
-  const parsed = tokenizeRestrictedCommand(command);
-  if (!parsed.tokens) return false;
-
-  const executable = basename(parsed.tokens[0] ?? '');
-  if (SHELL_WRAPPERS.has(executable) || REMOTE_EXECUTABLES.has(executable)) {
-    return false;
-  }
-
-  const subcommand =
-    executable === 'git'
-      ? parseRestrictedGitCommand(parsed.tokens)?.subcommand
-      : parsed.tokens[1];
-  if (
-    executable === 'git' &&
-    (!subcommand || !LOCAL_VERIFICATION_GIT_SUBCOMMANDS.has(subcommand))
-  ) {
-    return false;
-  }
-  if (executable === 'gh' || executable === 'glab') return false;
-  if (
-    PUBLISH_EXECUTABLES.has(executable) &&
-    containsPublishOperation(parsed.tokens)
-  ) {
-    return false;
-  }
-  return !(executable === 'docker' && parsed.tokens.slice(1).includes('push'));
-};
-
-const isHostedApiDelete = (tokens: ReadonlyArray<string>): boolean =>
-  tokens.slice(2).some((token, index, apiTokens) => {
-    const normalizedToken = token.toUpperCase();
-    return (
-      normalizedToken === '--METHOD=DELETE' ||
-      normalizedToken === '-XDELETE' ||
-      ((normalizedToken === '--METHOD' || normalizedToken === '-X') &&
-        apiTokens[index + 1]?.toUpperCase() === 'DELETE')
-    );
-  });
-
-/**
- * Determines whether a reviewed remote action is narrowly safe to authorize.
- *
- * @param command - Exact command extracted from an approved artifact.
- * @returns `true` for non-destructive Git pushes and hosted API writes.
- */
-export const isSafeRemoteActionCommand = (command: string): boolean => {
-  const parsed = tokenizeRestrictedCommand(command);
-  if (!parsed.tokens) return false;
-
-  const executable = parsed.tokens[0];
-  const subcommand =
-    executable === 'git'
-      ? parseRestrictedGitCommand(parsed.tokens)?.subcommand
-      : parsed.tokens[1];
-  if (executable === 'gh' || executable === 'glab') {
-    return subcommand === 'api' && !isHostedApiDelete(parsed.tokens);
-  }
-  if (executable !== 'git' || subcommand !== 'push') return false;
-
-  return !parsed.tokens
-    .slice(1)
-    .some(
-      (token) =>
-        hasForbiddenLongPushOption(token) ||
-        token.startsWith('+') ||
-        hasEmptyPushRefspecSide(token) ||
-        hasDestructivePushShortOption(token),
-    );
-};

package/src/policy/reviewed-command-shape.ts

@@ -1,49 +0,0 @@
-import { basename } from 'node:path';
-import { tokenizeRestrictedCommand } from './restricted-command.ts';
-import {
-  parseJsonDocuments,
-  verificationCommands,
-} from './reviewed-artifact.ts';
-
-const malformedBunInstallReason = (command: string): string | undefined => {
-  const parsed = tokenizeRestrictedCommand(command);
-  if (!parsed.tokens || basename(parsed.tokens[0] ?? '') !== 'bun') {
-    return undefined;
-  }
-
-  const installIndex = parsed.tokens.indexOf('install', 1);
-  if (installIndex <= 1) return undefined;
-  const hasCwdBeforeInstall = parsed.tokens
-    .slice(1, installIndex)
-    .some((token) => token === '--cwd' || token.startsWith('--cwd='));
-  if (!hasCwdBeforeInstall) return undefined;
-
-  return [
-    `Invalid Bun install command: ${JSON.stringify(command)}.`,
-    '`--cwd` appears before `install`, so Bun interprets `install` as a package script.',
-    'Use `bun install --cwd <absolute-cwd> --frozen-lockfile`, preserving the reviewed path and any other intended install flags, then resubmit the plan.',
-  ].join(' ');
-};
-
-/**
- * Rejects known command-shape mistakes before human approval.
- *
- * Deterministic checks prevent known parser traps from becoming approved
- * capabilities while leaving arbitrary runtime diagnosis to the agent.
- *
- * @param artifact - Reviewed execution contract.
- * @returns A corrective error message, or `undefined` when shapes are valid.
- */
-export const reviewedCommandShapeError = (
-  artifact: string,
-): string | undefined => {
-  for (const document of parseJsonDocuments(artifact)) {
-    for (const role of ['worker', 'reviewer'] as const) {
-      for (const command of verificationCommands(document, role)) {
-        const reason = malformedBunInstallReason(command);
-        if (reason) return reason;
-      }
-    }
-  }
-  return undefined;
-};

package/src/policy/reviewed-repository-contract.ts

@@ -1,138 +0,0 @@
-import { isAbsolute } from 'node:path';
-import {
-  isRecord,
-  parseJsonDocumentsWithValidity,
-} from './reviewed-artifact.ts';
-
-export type ReviewedRepositoryContract =
-  | { readonly kind: 'none' }
-  | { readonly kind: 'invalid'; readonly reason: string }
-  | {
-      readonly kind: 'valid';
-      readonly repositoryCwd: string;
-      readonly sourceCwd?: string;
-    };
-
-const invalidContract = (reason: string): ReviewedRepositoryContract => ({
-  kind: 'invalid',
-  reason,
-});
-
-const isAbsoluteSafePath = (value: unknown): value is string =>
-  typeof value === 'string' && isAbsolute(value) && !value.includes('\0');
-
-type RepositoryDirectories = {
-  readonly repositoryDirectories: ReadonlySet<string>;
-  readonly sourceDirectories: ReadonlySet<string>;
-};
-
-const addRepositoryDirectories = (
-  document: Readonly<Record<string, unknown>>,
-  repositoryDirectories: Set<string>,
-  sourceDirectories: Set<string>,
-): ReviewedRepositoryContract | undefined => {
-  if (
-    !Array.isArray(document.repositories) ||
-    document.repositories.length === 0
-  ) {
-    return invalidContract(
-      'Reviewed repository contract must contain a non-empty repositories array',
-    );
-  }
-
-  for (const repository of document.repositories) {
-    if (!isRecord(repository)) {
-      return invalidContract(
-        'Reviewed repository contract contains a malformed repository entry',
-      );
-    }
-    if (!isAbsoluteSafePath(repository.cwd)) {
-      return invalidContract(
-        'Reviewed repository contract repository cwd must be an absolute path',
-      );
-    }
-    repositoryDirectories.add(repository.cwd);
-
-    if ('sourceCwd' in repository) {
-      if (!isAbsoluteSafePath(repository.sourceCwd)) {
-        return invalidContract(
-          'Reviewed repository contract sourceCwd must be an absolute path',
-        );
-      }
-      sourceDirectories.add(repository.sourceCwd);
-    }
-  }
-  return undefined;
-};
-
-const collectRepositoryDirectories = (
-  documents: ReadonlyArray<unknown>,
-): RepositoryDirectories | ReviewedRepositoryContract => {
-  const repositoryDirectories = new Set<string>();
-  const sourceDirectories = new Set<string>();
-
-  for (const document of documents) {
-    if (!isRecord(document) || !('repositories' in document)) continue;
-    const error = addRepositoryDirectories(
-      document,
-      repositoryDirectories,
-      sourceDirectories,
-    );
-    if (error) return error;
-  }
-  return { repositoryDirectories, sourceDirectories };
-};
-
-/**
- * Parses and validates the repository-directory portion of a reviewed artifact.
- *
- * This function is the pure validation core; filesystem availability is
- * resolved separately.
- *
- * @param artifact - Human-reviewed artifact text.
- * @returns A validated repository contract, absence, or validation error.
- */
-export const parseReviewedRepositoryContract = (
-  artifact: string,
-): ReviewedRepositoryContract => {
-  const parsed = parseJsonDocumentsWithValidity(artifact);
-  const hasRepositoryContract = parsed.documents.some(
-    (document) => isRecord(document) && 'repositories' in document,
-  );
-  if (!hasRepositoryContract) {
-    return parsed.hasMalformedCandidate
-      ? invalidContract('Reviewed repository contract contains malformed JSON')
-      : { kind: 'none' };
-  }
-
-  const collected = collectRepositoryDirectories(parsed.documents);
-  if ('kind' in collected) return collected;
-  if (parsed.hasMalformedCandidate) {
-    return invalidContract(
-      'Reviewed repository contract contains malformed JSON',
-    );
-  }
-  if (collected.repositoryDirectories.size !== 1) {
-    return invalidContract(
-      'Reviewed repository contract is ambiguous: expected exactly one repository cwd',
-    );
-  }
-  if (collected.sourceDirectories.size > 1) {
-    return invalidContract(
-      'Reviewed repository contract is ambiguous: expected at most one sourceCwd',
-    );
-  }
-
-  const [repositoryCwd] = collected.repositoryDirectories;
-  if (!repositoryCwd) {
-    return invalidContract(
-      'Reviewed repository contract is ambiguous: expected exactly one repository cwd',
-    );
-  }
-  const [sourceCwd] = collected.sourceDirectories;
-  return {
-    kind: 'valid',
-    repositoryCwd,
-    ...(sourceCwd ? { sourceCwd } : {}),
-  };
-};

package/src/policy/reviewed-repository-cwd.ts

@@ -1,102 +0,0 @@
-import { statSync } from 'node:fs';
-import { isRecord } from './reviewed-artifact.ts';
-import { parseReviewedRepositoryContract } from './reviewed-repository-contract.ts';
-
-export type ReviewedRepositoryCwdResolution =
-  | { readonly kind: 'none' }
-  | { readonly kind: 'invalid'; readonly reason: string }
-  | {
-      readonly kind: 'resolved';
-      readonly cwd: string;
-      readonly repositoryCwd: string;
-      readonly bootstrapping: boolean;
-    };
-
-export type DirectoryState = 'directory' | 'missing' | 'invalid';
-
-export type ReviewedRepositoryCwdDependencies = {
-  readonly readDirectoryState: (path: string) => DirectoryState;
-};
-
-export type ResolveReviewedRepositoryCwd = (
-  artifact: string,
-) => ReviewedRepositoryCwdResolution;
-
-const readDirectoryState = (path: string): DirectoryState => {
-  try {
-    return statSync(path).isDirectory() ? 'directory' : 'invalid';
-  } catch (error) {
-    const code = isRecord(error) ? error.code : undefined;
-    return code === 'ENOENT' || code === 'ENOTDIR' ? 'missing' : 'invalid';
-  }
-};
-
-const invalidResolution = (
-  reason: string,
-): ReviewedRepositoryCwdResolution => ({
-  kind: 'invalid',
-  reason,
-});
-
-/**
- * Creates a reviewed-directory resolver with an injected filesystem reader.
- *
- * The injected boundary keeps contract parsing and launch-path selection
- * deterministic and independently testable.
- *
- * @param dependencies - Filesystem operations used by the resolver.
- * @returns A resolver bound to those dependencies.
- */
-export const createReviewedRepositoryCwdResolver = (
-  dependencies: ReviewedRepositoryCwdDependencies,
-): ResolveReviewedRepositoryCwd => {
-  return (artifact): ReviewedRepositoryCwdResolution => {
-    const contract = parseReviewedRepositoryContract(artifact);
-    if (contract.kind !== 'valid') return contract;
-
-    const repositoryState = dependencies.readDirectoryState(
-      contract.repositoryCwd,
-    );
-    if (repositoryState === 'directory') {
-      return {
-        kind: 'resolved',
-        cwd: contract.repositoryCwd,
-        repositoryCwd: contract.repositoryCwd,
-        bootstrapping: false,
-      };
-    }
-    if (repositoryState === 'invalid') {
-      return invalidResolution(
-        `Reviewed repository cwd is not an accessible directory: ${contract.repositoryCwd}`,
-      );
-    }
-    if (!contract.sourceCwd) {
-      return invalidResolution(
-        'Reviewed repository target is missing and requires exactly one absolute sourceCwd',
-      );
-    }
-    if (dependencies.readDirectoryState(contract.sourceCwd) !== 'directory') {
-      return invalidResolution(
-        `Reviewed repository sourceCwd is not an existing directory: ${contract.sourceCwd}`,
-      );
-    }
-    return {
-      kind: 'resolved',
-      cwd: contract.sourceCwd,
-      repositoryCwd: contract.repositoryCwd,
-      bootstrapping: true,
-    };
-  };
-};
-
-/**
- * Resolves the launch directory from a reviewed repository contract.
- *
- * Malformed, ambiguous, or incomplete contracts never fall back silently.
- *
- * @param artifact - Human-reviewed artifact text.
- * @returns The resolved directory, absence, or a validation error.
- */
-export const resolveReviewedRepositoryCwd = createReviewedRepositoryCwdResolver(
-  { readDirectoryState },
-);