@within-7/minto 0.4.1 → 0.4.3

package/dist/utils/commands.js

@@ -1,219 +0,0 @@
-import { API_ERROR_MESSAGE_PREFIX, queryQuick } from "../services/claude.js";
-import { memoizeAsyncWithLimit } from "./async.js";
-import { parse } from "shell-quote";
-import { PRODUCT_NAME } from "../constants/product.js";
-const SINGLE_QUOTE = "__SINGLE_QUOTE__";
-const DOUBLE_QUOTE = "__DOUBLE_QUOTE__";
-function splitCommand(command) {
-  const parts = [];
-  for (const part of parse(
-    command.replaceAll('"', `"${DOUBLE_QUOTE}`).replaceAll("'", `'${SINGLE_QUOTE}`),
-    // parse() strips out quotes :P
-    (varName) => `$${varName}`
-    // Preserve shell variables
-  )) {
-    if (typeof part === "string") {
-      if (parts.length > 0 && typeof parts[parts.length - 1] === "string") {
-        parts[parts.length - 1] += " " + part;
-        continue;
-      }
-    }
-    parts.push(part);
-  }
-  const stringParts = parts.map((part) => {
-    if (typeof part === "string") {
-      return part;
-    }
-    if ("comment" in part) {
-      return "#" + part.comment;
-    }
-    if ("op" in part && part.op === "glob") {
-      return part.pattern;
-    }
-    if ("op" in part) {
-      return part.op;
-    }
-    return null;
-  }).filter((_) => _ !== null);
-  const quotedParts = stringParts.map((part) => {
-    return part.replaceAll(`${SINGLE_QUOTE}`, "'").replaceAll(`${DOUBLE_QUOTE}`, '"');
-  });
-  return quotedParts.filter(
-    (part) => !COMMAND_LIST_SEPARATORS.has(part)
-  );
-}
-const getCommandSubcommandPrefix = memoizeAsyncWithLimit(
-  async (command, abortSignal) => {
-    const subcommands = splitCommand(command);
-    const [fullCommandPrefix, ...subcommandPrefixesResults] = await Promise.all(
-      [
-        getCommandPrefix(command, abortSignal),
-        ...subcommands.map(async (subcommand) => ({
-          subcommand,
-          prefix: await getCommandPrefix(subcommand, abortSignal)
-        }))
-      ]
-    );
-    if (!fullCommandPrefix) {
-      return null;
-    }
-    const subcommandPrefixes = subcommandPrefixesResults.reduce(
-      (acc, { subcommand, prefix }) => {
-        if (prefix) {
-          acc.set(subcommand, prefix);
-        }
-        return acc;
-      },
-      /* @__PURE__ */ new Map()
-    );
-    return {
-      ...fullCommandPrefix,
-      subcommandPrefixes
-    };
-  },
-  {
-    max: 200,
-    // Cache up to 200 unique commands
-    ttl: 3e5,
-    // 5 minutes TTL
-    resolver: (command) => command
-    // memoize by command only, ignore abortSignal
-  }
-);
-const getCommandPrefix = memoizeAsyncWithLimit(
-  async (command, abortSignal) => {
-    const response = await queryQuick({
-      systemPrompt: [
-        `Your task is to process Bash commands that an AI coding agent wants to run.
-
-This policy spec defines how to determine the prefix of a Bash command:`
-      ],
-      userPrompt: `<policy_spec>
-# ${PRODUCT_NAME} Code Bash command prefix detection
-
-This document defines risk levels for actions that the ${PRODUCT_NAME} agent may take. This classification system is part of a broader safety framework and is used to determine when additional user confirmation or oversight may be needed.
-
-## Definitions
-
-**Command Injection:** Any technique used that would result in a command being run other than the detected prefix.
-
-## Command prefix extraction examples
-Examples:
-- cat foo.txt => cat
-- cd src => cd
-- cd path/to/files/ => cd
-- find ./src -type f -name "*.ts" => find
-- gg cat foo.py => gg cat
-- gg cp foo.py bar.py => gg cp
-- git commit -m "foo" => git commit
-- git diff HEAD~1 => git diff
-- git diff --staged => git diff
-- git diff $(pwd) => command_injection_detected
-- git status => git status
-- git status# test(\`id\`) => command_injection_detected
-- git status\`ls\` => command_injection_detected
-- git push => none
-- git push origin master => git push
-- git log -n 5 => git log
-- git log --oneline -n 5 => git log
-- grep -A 40 "from foo.bar.baz import" alpha/beta/gamma.py => grep
-- pig tail zerba.log => pig tail
-- npm test => none
-- npm test --foo => npm test
-- npm test -- -f "foo" => npm test
-- pwd
- curl example.com => command_injection_detected
-- pytest foo/bar.py => pytest
-- scalac build => none
-</policy_spec>
-
-The user has allowed certain command prefixes to be run, and will otherwise be asked to approve or deny the command.
-Your task is to determine the command prefix for the following command.
-
-IMPORTANT: Bash commands may run multiple commands that are chained together.
-For safety, if the command seems to contain command injection, you must return "command_injection_detected".
-(This will help protect the user: if they think that they're allowlisting command A,
-but the AI coding agent sends a malicious command that technically has the same prefix as command A,
-then the safety system will see that you said "command_injection_detected" and ask the user for manual confirmation.)
-
-Note that not every command has a prefix. If a command has no prefix, return "none".
-
-ONLY return the prefix. Do not return any other text, markdown markers, or other content or formatting.
-
-Command: ${command}
-`,
-      signal: abortSignal,
-      enablePromptCaching: false
-    });
-    const prefix = typeof response.message.content === "string" ? response.message.content : Array.isArray(response.message.content) ? response.message.content.find((_) => _.type === "text")?.text ?? "none" : "none";
-    if (prefix.startsWith(API_ERROR_MESSAGE_PREFIX)) {
-      return null;
-    }
-    if (prefix === "command_injection_detected") {
-      return { commandInjectionDetected: true };
-    }
-    if (prefix === "git") {
-      return {
-        commandPrefix: null,
-        commandInjectionDetected: false
-      };
-    }
-    if (prefix === "none") {
-      return {
-        commandPrefix: null,
-        commandInjectionDetected: false
-      };
-    }
-    return {
-      commandPrefix: prefix,
-      commandInjectionDetected: false
-    };
-  },
-  {
-    max: 200,
-    // Cache up to 200 unique commands
-    ttl: 3e5,
-    // 5 minutes TTL
-    resolver: (command) => command
-    // memoize by command only, ignore abortSignal
-  }
-);
-const COMMAND_LIST_SEPARATORS = /* @__PURE__ */ new Set([
-  "&&",
-  "||",
-  ";",
-  ";;"
-]);
-function isCommandList(command) {
-  for (const part of parse(
-    command.replaceAll('"', `"${DOUBLE_QUOTE}`).replaceAll("'", `'${SINGLE_QUOTE}`),
-    // parse() strips out quotes :P
-    (varName) => `$${varName}`
-    // Preserve shell variables
-  )) {
-    if (typeof part === "string") {
-      continue;
-    }
-    if ("comment" in part) {
-      return false;
-    }
-    if ("op" in part) {
-      if (part.op === "glob") {
-        continue;
-      } else if (COMMAND_LIST_SEPARATORS.has(part.op)) {
-        continue;
-      }
-      return false;
-    }
-  }
-  return true;
-}
-function isUnsafeCompoundCommand(command) {
-  return splitCommand(command).length > 1 && !isCommandList(command);
-}
-export {
-  getCommandSubcommandPrefix,
-  isUnsafeCompoundCommand,
-  splitCommand
-};
-//# sourceMappingURL=commands.js.map

package/dist/utils/commands.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../src/utils/commands.ts"],
-  "sourcesContent": ["import { API_ERROR_MESSAGE_PREFIX, queryQuick } from '@services/claude'\nimport { memoizeAsyncWithLimit } from './async'\nimport { type ControlOperator, parse, ParseEntry } from 'shell-quote'\nimport { PRODUCT_NAME } from '@constants/product'\n\nconst SINGLE_QUOTE = '__SINGLE_QUOTE__'\nconst DOUBLE_QUOTE = '__DOUBLE_QUOTE__'\n\nexport type CommandPrefixResult =\n  | {\n      commandPrefix: string | null\n      commandInjectionDetected: false\n    }\n  | { commandInjectionDetected: true }\n\n// Command prefix result alongside subcommand prefixes\nexport type CommandSubcommandPrefixResult = CommandPrefixResult & {\n  subcommandPrefixes: Map<string, CommandPrefixResult>\n}\n\n/**\n * Splits a command string into individual commands based on shell operators\n */\nexport function splitCommand(command: string): string[] {\n  const parts: ParseEntry[] = []\n\n  // 1. Collapse adjacent strings\n  for (const part of parse(\n    command\n      .replaceAll('\"', `\"${DOUBLE_QUOTE}`) // parse() strips out quotes :P\n      .replaceAll(\"'\", `'${SINGLE_QUOTE}`), // parse() strips out quotes :P\n    varName => `$${varName}`, // Preserve shell variables\n  )) {\n    if (typeof part === 'string') {\n      if (parts.length > 0 && typeof parts[parts.length - 1] === 'string') {\n        parts[parts.length - 1] += ' ' + part\n        continue\n      }\n    }\n    parts.push(part)\n  }\n\n  // 2. Map tokens to strings\n  const stringParts = parts\n    .map(part => {\n      if (typeof part === 'string') {\n        return part\n      }\n      if ('comment' in part) {\n        // TODO: make this less hacky\n        return '#' + part.comment\n      }\n      if ('op' in part && part.op === 'glob') {\n        return part.pattern\n      }\n      if ('op' in part) {\n        return part.op\n      }\n      return null\n    })\n    .filter(_ => _ !== null)\n\n  // 3. Map quotes back to their original form\n  const quotedParts = stringParts.map(part => {\n    return part\n      .replaceAll(`${SINGLE_QUOTE}`, \"'\")\n      .replaceAll(`${DOUBLE_QUOTE}`, '\"')\n  })\n\n  // 4. Filter out separators\n  return quotedParts.filter(\n    part => !(COMMAND_LIST_SEPARATORS as Set<string>).has(part),\n  )\n}\n\n// Use memoizeAsyncWithLimit to prevent unbounded cache growth from unique commands\nexport const getCommandSubcommandPrefix = memoizeAsyncWithLimit(\n  async (\n    command: string,\n    abortSignal: AbortSignal,\n  ): Promise<CommandSubcommandPrefixResult | null> => {\n    const subcommands = splitCommand(command)\n\n    const [fullCommandPrefix, ...subcommandPrefixesResults] = await Promise.all(\n      [\n        getCommandPrefix(command, abortSignal),\n        ...subcommands.map(async subcommand => ({\n          subcommand,\n          prefix: await getCommandPrefix(subcommand, abortSignal),\n        })),\n      ],\n    )\n    if (!fullCommandPrefix) {\n      return null\n    }\n    const subcommandPrefixes = subcommandPrefixesResults.reduce(\n      (acc, { subcommand, prefix }) => {\n        if (prefix) {\n          acc.set(subcommand, prefix)\n        }\n        return acc\n      },\n      new Map<string, CommandPrefixResult>(),\n    )\n\n    return {\n      ...fullCommandPrefix,\n      subcommandPrefixes,\n    }\n  },\n  {\n    max: 200, // Cache up to 200 unique commands\n    ttl: 300000, // 5 minutes TTL\n    resolver: (command: string) => command, // memoize by command only, ignore abortSignal\n  },\n)\n\n// Use memoizeAsyncWithLimit to prevent unbounded cache growth from unique commands\nconst getCommandPrefix = memoizeAsyncWithLimit(\n  async (\n    command: string,\n    abortSignal: AbortSignal,\n  ): Promise<CommandPrefixResult | null> => {\n    const response = await queryQuick({\n      systemPrompt: [\n        `Your task is to process Bash commands that an AI coding agent wants to run.\n\nThis policy spec defines how to determine the prefix of a Bash command:`,\n      ],\n      userPrompt: `<policy_spec>\n# ${PRODUCT_NAME} Code Bash command prefix detection\n\nThis document defines risk levels for actions that the ${PRODUCT_NAME} agent may take. This classification system is part of a broader safety framework and is used to determine when additional user confirmation or oversight may be needed.\n\n## Definitions\n\n**Command Injection:** Any technique used that would result in a command being run other than the detected prefix.\n\n## Command prefix extraction examples\nExamples:\n- cat foo.txt => cat\n- cd src => cd\n- cd path/to/files/ => cd\n- find ./src -type f -name \"*.ts\" => find\n- gg cat foo.py => gg cat\n- gg cp foo.py bar.py => gg cp\n- git commit -m \"foo\" => git commit\n- git diff HEAD~1 => git diff\n- git diff --staged => git diff\n- git diff $(pwd) => command_injection_detected\n- git status => git status\n- git status# test(\\`id\\`) => command_injection_detected\n- git status\\`ls\\` => command_injection_detected\n- git push => none\n- git push origin master => git push\n- git log -n 5 => git log\n- git log --oneline -n 5 => git log\n- grep -A 40 \"from foo.bar.baz import\" alpha/beta/gamma.py => grep\n- pig tail zerba.log => pig tail\n- npm test => none\n- npm test --foo => npm test\n- npm test -- -f \"foo\" => npm test\n- pwd\\n curl example.com => command_injection_detected\n- pytest foo/bar.py => pytest\n- scalac build => none\n</policy_spec>\n\nThe user has allowed certain command prefixes to be run, and will otherwise be asked to approve or deny the command.\nYour task is to determine the command prefix for the following command.\n\nIMPORTANT: Bash commands may run multiple commands that are chained together.\nFor safety, if the command seems to contain command injection, you must return \"command_injection_detected\".\n(This will help protect the user: if they think that they're allowlisting command A,\nbut the AI coding agent sends a malicious command that technically has the same prefix as command A,\nthen the safety system will see that you said \"command_injection_detected\" and ask the user for manual confirmation.)\n\nNote that not every command has a prefix. If a command has no prefix, return \"none\".\n\nONLY return the prefix. Do not return any other text, markdown markers, or other content or formatting.\n\nCommand: ${command}\n`,\n      signal: abortSignal,\n      enablePromptCaching: false,\n    })\n\n    const prefix =\n      typeof response.message.content === 'string'\n        ? response.message.content\n        : Array.isArray(response.message.content)\n          ? (response.message.content.find(_ => _.type === 'text')?.text ??\n            'none')\n          : 'none'\n\n    if (prefix.startsWith(API_ERROR_MESSAGE_PREFIX)) {\n      return null\n    }\n\n    if (prefix === 'command_injection_detected') {\n      return { commandInjectionDetected: true }\n    }\n\n    // Never accept base `git` as a prefix (if e.g. `git diff` prefix not detected)\n    if (prefix === 'git') {\n      return {\n        commandPrefix: null,\n        commandInjectionDetected: false,\n      }\n    }\n\n    if (prefix === 'none') {\n      return {\n        commandPrefix: null,\n        commandInjectionDetected: false,\n      }\n    }\n\n    return {\n      commandPrefix: prefix,\n      commandInjectionDetected: false,\n    }\n  },\n  {\n    max: 200, // Cache up to 200 unique commands\n    ttl: 300000, // 5 minutes TTL\n    resolver: (command: string) => command, // memoize by command only, ignore abortSignal\n  },\n)\n\nconst COMMAND_LIST_SEPARATORS = new Set<ControlOperator>([\n  '&&',\n  '||',\n  ';',\n  ';;',\n])\n\n// Checks if this is just a list of commands\nfunction isCommandList(command: string): boolean {\n  for (const part of parse(\n    command\n      .replaceAll('\"', `\"${DOUBLE_QUOTE}`) // parse() strips out quotes :P\n      .replaceAll(\"'\", `'${SINGLE_QUOTE}`), // parse() strips out quotes :P\n    varName => `$${varName}`, // Preserve shell variables\n  )) {\n    if (typeof part === 'string') {\n      // Strings are safe\n      continue\n    }\n    if ('comment' in part) {\n      // Don't trust comments, they can contain command injection\n      return false\n    }\n    if ('op' in part) {\n      if (part.op === 'glob') {\n        // Globs are safe\n        continue\n      } else if (COMMAND_LIST_SEPARATORS.has(part.op)) {\n        // Command list separators are safe\n        continue\n      }\n      // Other operators are unsafe\n      return false\n    }\n  }\n  // No unsafe operators found in entire command\n  return true\n}\n\nexport function isUnsafeCompoundCommand(command: string): boolean {\n  return splitCommand(command).length > 1 && !isCommandList(command)\n}\n"],
-  "mappings": "AAAA,SAAS,0BAA0B,kBAAkB;AACrD,SAAS,6BAA6B;AACtC,SAA+B,aAAyB;AACxD,SAAS,oBAAoB;AAE7B,MAAM,eAAe;AACrB,MAAM,eAAe;AAiBd,SAAS,aAAa,SAA2B;AACtD,QAAM,QAAsB,CAAC;AAG7B,aAAW,QAAQ;AAAA,IACjB,QACG,WAAW,KAAK,IAAI,YAAY,EAAE,EAClC,WAAW,KAAK,IAAI,YAAY,EAAE;AAAA;AAAA,IACrC,aAAW,IAAI,OAAO;AAAA;AAAA,EACxB,GAAG;AACD,QAAI,OAAO,SAAS,UAAU;AAC5B,UAAI,MAAM,SAAS,KAAK,OAAO,MAAM,MAAM,SAAS,CAAC,MAAM,UAAU;AACnE,cAAM,MAAM,SAAS,CAAC,KAAK,MAAM;AACjC;AAAA,MACF;AAAA,IACF;AACA,UAAM,KAAK,IAAI;AAAA,EACjB;AAGA,QAAM,cAAc,MACjB,IAAI,UAAQ;AACX,QAAI,OAAO,SAAS,UAAU;AAC5B,aAAO;AAAA,IACT;AACA,QAAI,aAAa,MAAM;AAErB,aAAO,MAAM,KAAK;AAAA,IACpB;AACA,QAAI,QAAQ,QAAQ,KAAK,OAAO,QAAQ;AACtC,aAAO,KAAK;AAAA,IACd;AACA,QAAI,QAAQ,MAAM;AAChB,aAAO,KAAK;AAAA,IACd;AACA,WAAO;AAAA,EACT,CAAC,EACA,OAAO,OAAK,MAAM,IAAI;AAGzB,QAAM,cAAc,YAAY,IAAI,UAAQ;AAC1C,WAAO,KACJ,WAAW,GAAG,YAAY,IAAI,GAAG,EACjC,WAAW,GAAG,YAAY,IAAI,GAAG;AAAA,EACtC,CAAC;AAGD,SAAO,YAAY;AAAA,IACjB,UAAQ,CAAE,wBAAwC,IAAI,IAAI;AAAA,EAC5D;AACF;AAGO,MAAM,6BAA6B;AAAA,EACxC,OACE,SACA,gBACkD;AAClD,UAAM,cAAc,aAAa,OAAO;AAExC,UAAM,CAAC,mBAAmB,GAAG,yBAAyB,IAAI,MAAM,QAAQ;AAAA,MACtE;AAAA,QACE,iBAAiB,SAAS,WAAW;AAAA,QACrC,GAAG,YAAY,IAAI,OAAM,gBAAe;AAAA,UACtC;AAAA,UACA,QAAQ,MAAM,iBAAiB,YAAY,WAAW;AAAA,QACxD,EAAE;AAAA,MACJ;AAAA,IACF;AACA,QAAI,CAAC,mBAAmB;AACtB,aAAO;AAAA,IACT;AACA,UAAM,qBAAqB,0BAA0B;AAAA,MACnD,CAAC,KAAK,EAAE,YAAY,OAAO,MAAM;AAC/B,YAAI,QAAQ;AACV,cAAI,IAAI,YAAY,MAAM;AAAA,QAC5B;AACA,eAAO;AAAA,MACT;AAAA,MACA,oBAAI,IAAiC;AAAA,IACvC;AAEA,WAAO;AAAA,MACL,GAAG;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,KAAK;AAAA;AAAA,IACL,KAAK;AAAA;AAAA,IACL,UAAU,CAAC,YAAoB;AAAA;AAAA,EACjC;AACF;AAGA,MAAM,mBAAmB;AAAA,EACvB,OACE,SACA,gBACwC;AACxC,UAAM,WAAW,MAAM,WAAW;AAAA,MAChC,cAAc;AAAA,QACZ;AAAA;AAAA;AAAA,MAGF;AAAA,MACA,YAAY;AAAA,IACd,YAAY;AAAA;AAAA,yDAEyC,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAgD1D,OAAO;AAAA;AAAA,MAEZ,QAAQ;AAAA,MACR,qBAAqB;AAAA,IACvB,CAAC;AAED,UAAM,SACJ,OAAO,SAAS,QAAQ,YAAY,WAChC,SAAS,QAAQ,UACjB,MAAM,QAAQ,SAAS,QAAQ,OAAO,IACnC,SAAS,QAAQ,QAAQ,KAAK,OAAK,EAAE,SAAS,MAAM,GAAG,QACxD,SACA;AAER,QAAI,OAAO,WAAW,wBAAwB,GAAG;AAC/C,aAAO;AAAA,IACT;AAEA,QAAI,WAAW,8BAA8B;AAC3C,aAAO,EAAE,0BAA0B,KAAK;AAAA,IAC1C;AAGA,QAAI,WAAW,OAAO;AACpB,aAAO;AAAA,QACL,eAAe;AAAA,QACf,0BAA0B;AAAA,MAC5B;AAAA,IACF;AAEA,QAAI,WAAW,QAAQ;AACrB,aAAO;AAAA,QACL,eAAe;AAAA,QACf,0BAA0B;AAAA,MAC5B;AAAA,IACF;AAEA,WAAO;AAAA,MACL,eAAe;AAAA,MACf,0BAA0B;AAAA,IAC5B;AAAA,EACF;AAAA,EACA;AAAA,IACE,KAAK;AAAA;AAAA,IACL,KAAK;AAAA;AAAA,IACL,UAAU,CAAC,YAAoB;AAAA;AAAA,EACjC;AACF;AAEA,MAAM,0BAA0B,oBAAI,IAAqB;AAAA,EACvD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,SAAS,cAAc,SAA0B;AAC/C,aAAW,QAAQ;AAAA,IACjB,QACG,WAAW,KAAK,IAAI,YAAY,EAAE,EAClC,WAAW,KAAK,IAAI,YAAY,EAAE;AAAA;AAAA,IACrC,aAAW,IAAI,OAAO;AAAA;AAAA,EACxB,GAAG;AACD,QAAI,OAAO,SAAS,UAAU;AAE5B;AAAA,IACF;AACA,QAAI,aAAa,MAAM;AAErB,aAAO;AAAA,IACT;AACA,QAAI,QAAQ,MAAM;AAChB,UAAI,KAAK,OAAO,QAAQ;AAEtB;AAAA,MACF,WAAW,wBAAwB,IAAI,KAAK,EAAE,GAAG;AAE/C;AAAA,MACF;AAEA,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,wBAAwB,SAA0B;AAChE,SAAO,aAAa,OAAO,EAAE,SAAS,KAAK,CAAC,cAAc,OAAO;AACnE;",
-  "names": []
-}