@yagni-app/code-staging 1.1.0-staging.1327.1 → 1.1.0-staging.1328.1

package/dist/extension/permission/execPolicy.d.ts

@@ -4,9 +4,10 @@
  *
  * Pure: no I/O, no network, no model. Loads at startup and classifies
  * synchronously. The curated default set auto-allows read-only commands
- * (ls, cat, rg, git status/log/diff), forbids destructive ones (rm -rf,
- * git reset --hard, git push --force, pipe-to-shell), and prompts for the
- * ambiguous middle band (npm install, git commit, curl, …).
+ * (ls, cat, rg, git status/log/diff), forbids destructive ones (recursive rm,
+ * git reset --hard, git push --force, pipe-to-shell, bare-interpreter
+ * pipes), and prompts for the ambiguous middle band (non-recursive rm -f,
+ * inline-code interpreter pipes, npm install, git commit, curl, …).
  *
  * The `prompt` band is what the Guardian arbitrates — see guardian.ts.
  *
@@ -126,8 +127,10 @@ export declare function tokenize(command: string): string[];
  * each is classified independently; the strictest decision wins (forbidden >
  * prompt > allow). Commands with shell constructs (substitution, redirects,
  * background &) have a floor of `prompt`, and their substitution inner text
- * is danger-scanned against the forbidden rules. Pipe-to-shell is always
- * forbidden.
+ * is danger-scanned against the forbidden rules. Pipes into shells and
+ * network relays, or into a bare interpreter (stdin executed as the program),
+ * are always forbidden; an interpreter carrying inline code (-c/-e) falls to
+ * the prompt band — the code rides the command string the Guardian can read.
  */
 export declare function classifyCommand(command: string, policy: ExecPolicy): ExecClassification;
 /** Curated default rules — the shipped safety floor. */

package/dist/extension/permission/execPolicy.js

@@ -4,9 +4,10 @@
  *
  * Pure: no I/O, no network, no model. Loads at startup and classifies
  * synchronously. The curated default set auto-allows read-only commands
- * (ls, cat, rg, git status/log/diff), forbids destructive ones (rm -rf,
- * git reset --hard, git push --force, pipe-to-shell), and prompts for the
- * ambiguous middle band (npm install, git commit, curl, …).
+ * (ls, cat, rg, git status/log/diff), forbids destructive ones (recursive rm,
+ * git reset --hard, git push --force, pipe-to-shell, bare-interpreter
+ * pipes), and prompts for the ambiguous middle band (non-recursive rm -f,
+ * inline-code interpreter pipes, npm install, git commit, curl, …).
  *
  * The `prompt` band is what the Guardian arbitrates — see guardian.ts.
  *
@@ -391,11 +392,28 @@ export function extractSubstitutions(command) {
     }
     return found;
 }
-/** Interpreters that, when piped into, indicate code execution — always forbidden. */
+/**
+ * Words that, when piped into, are always forbidden: shells (execute stdin)
+ * and network relays (remote-shell class). Interpreters are separate — see
+ * INTERPRETER_INLINE_FLAGS — because with an inline-code flag (-c/-e) the
+ * piped data is just input to a script the Guardian can read on the command
+ * line; without one, stdin IS the program (download-and-execute).
+ */
 const PIPE_TO_SHELL = new Set([
-    "sh", "bash", "zsh", "fish", "nc", "ncat", "socat",
+    "sh", "bash", "zsh", "fish", "dash", "ksh", "nc", "ncat", "socat",
+]);
+/** Interpreters that execute piped stdin as a program unless given inline code. */
+const PIPE_INTERPRETERS = new Set([
     "python", "python3", "perl", "ruby", "node",
 ]);
+/** Per-interpreter flags that mean "the code is on the command line". */
+const INTERPRETER_INLINE_FLAGS = {
+    python: new Set(["-c"]),
+    python3: new Set(["-c"]),
+    perl: new Set(["-e"]),
+    ruby: new Set(["-e"]),
+    node: new Set(["-e", "-p"]),
+};
 /** Wrapper words that forward to another command (`sudo rm …` runs rm). */
 const WRAPPER_WORDS = new Set(["sudo", "env", "command", "builtin", "exec", "nohup", "time", "nice"]);
 /** Shell reserved words that can precede a command inside control flow. */
@@ -710,23 +728,83 @@ function classifySegmentTokens(rawTokens, policy, opts) {
     // No rule matched → prompt (fail toward review, not toward allow)
     return { decision: "prompt", justification: `no policy rule matched for "${tokens[0]}"` };
 }
-/** Check if any segment pipes into a known shell/network interpreter. */
+/**
+ * Check if any segment pipes into a known shell/network interpreter, or into
+ * a bare interpreter (no inline-code flag — stdin is executed as the program).
+ * Interpreters carrying an inline-code flag WITH its code argument
+ * (`… | python3 -c '…'`) are NOT caught here: they fall through to normal
+ * segment classification (prompt band), because the code rides the command
+ * string the Guardian can read. The pipe target is resolved through the SAME
+ * stripLeadingTokens walk used for command words, so wrapper spellings
+ * (`… | env sh`, `… | env -i python3`, `… | /usr/bin/env python3 -c '…'`)
+ * resolve identically — one resolver, no drift between the two paths.
+ */
 function isPipeToShell(command) {
     const parsed = shellParse(command);
     for (let i = 0; i < parsed.length - 1; i++) {
         const t = parsed[i];
-        if (typeof t === "object" && t.op === "pipe") {
-            const next = parsed[i + 1];
-            if (typeof next !== "string")
-                continue;
-            const word = basenameToken(next.startsWith("\\") ? next.slice(1) : next);
+        if (typeof t !== "object" || t.op !== "pipe")
+            continue;
+        // Collect the pipe target's leading plain tokens (up to the next op),
+        // then resolve the program word through the shared wrapper strip.
+        const target = [];
+        let j = i + 1;
+        while (j < parsed.length && typeof parsed[j] === "string") {
+            target.push(parsed[j]);
+            j++;
+        }
+        const { tokens: resolved, stripped: targetStripped } = stripLeadingTokens(target);
+        if (resolved.length === 0)
+            continue;
+        // Candidate program words: the resolved word, plus — when wrappers were
+        // stripped — every non-flag token after it. stripLeadingTokens stops at
+        // the first non-flag token after a wrapper, which for flags that TAKE a
+        // value (`env -u FOO python3`) makes the value the resolved word and can
+        // let a bare interpreter slip past. Checking every candidate is a
+        // deliberate conservative tradeoff: it can only ADD forbidden verdicts,
+        // never remove them, so a benign target like `… | env grep python3`
+        // (grep is the program, python3 an argument) is hard-forbidden instead
+        // of prompted — a false positive we accept to keep bare interpreters
+        // from escaping the floor through wrapper-flag spellings.
+        const candidates = [basenameToken(resolved[0])];
+        if (targetStripped) {
+            for (let k = 1; k < resolved.length; k++) {
+                if (!resolved[k].startsWith("-"))
+                    candidates.push(basenameToken(resolved[k]));
+            }
+        }
+        for (const word of candidates) {
             if (PIPE_TO_SHELL.has(word))
                 return true;
-            // `… | env sh` / `… | /usr/bin/env sh`
-            if (word === "env") {
-                const after = parsed[i + 2];
-                if (typeof after === "string" && PIPE_TO_SHELL.has(basenameToken(after)))
+        }
+        if (candidates.some((word) => PIPE_INTERPRETERS.has(word))) {
+            if (!hasInlineCodeArg(resolved))
+                return true;
+        }
+    }
+    return false;
+}
+/**
+ * Does a resolved pipe-target token list contain an interpreter carrying an
+ * inline-code flag WITH its code argument? An inline flag only counts when
+ * its argument follows in the same segment: argumentless `… | python3 -c`
+ * still leaves stdin as the program, so it stays forbidden. ANY interpreter
+ * in the segment satisfying flag+arg is enough — multi-interpreter segments
+ * (`… | python3 -c - python3 -c '…'`) downgrade to prompt when any word has
+ * its code on the command line, so the scan never early-returns on the first
+ * flag-without-arg.
+ */
+function hasInlineCodeArg(resolved) {
+    for (let k = 0; k < resolved.length; k++) {
+        const w = basenameToken(resolved[k]);
+        if (!PIPE_INTERPRETERS.has(w))
+            continue;
+        const inlineFlags = INTERPRETER_INLINE_FLAGS[w] ?? new Set();
+        for (let m = k + 1; m < resolved.length; m++) {
+            if (inlineFlags.has(resolved[m])) {
+                if (m + 1 < resolved.length && !resolved[m + 1].startsWith("-"))
                     return true;
+                break;
             }
         }
     }
@@ -814,8 +892,10 @@ function dangerScanSubstitutions(command, policy, depth) {
  * each is classified independently; the strictest decision wins (forbidden >
  * prompt > allow). Commands with shell constructs (substitution, redirects,
  * background &) have a floor of `prompt`, and their substitution inner text
- * is danger-scanned against the forbidden rules. Pipe-to-shell is always
- * forbidden.
+ * is danger-scanned against the forbidden rules. Pipes into shells and
+ * network relays, or into a bare interpreter (stdin executed as the program),
+ * are always forbidden; an interpreter carrying inline code (-c/-e) falls to
+ * the prompt band — the code rides the command string the Guardian can read.
  */
 export function classifyCommand(command, policy) {
     // Pipe-to-shell is always forbidden regardless of other rules.
@@ -858,11 +938,16 @@ export const DEFAULT_EXEC_POLICY = {
         // --- forbidden: position-independent dangerous-flag rules (checked first;
         //     GNU getopt permutes flags, so `rm x -rf` and `git push origin
         //     --force` carry the flag after positional args) ---
+        // Recursive deletion only: any -r/-R-bearing flag bundle. Combined
+        // bundles where r is not first (-fr, -fR) are listed explicitly because
+        // the trailing-star globs only anchor at the leading char. Exotic bundles
+        // (-fir) miss this rule and land on the -f prompt rule below — fail-closed
+        // toward Guardian review, never auto-allowed.
         {
             pattern: ["rm"],
-            flagsAnywhere: ["-r*", "-f*", "--recursive*", "--force*"],
+            flagsAnywhere: ["-r*", "-R*", "-fr", "-fR", "--recursive*"],
             decision: "forbidden",
-            justification: "recursive/forced deletion is destructive and irreversible",
+            justification: "recursive deletion is destructive and irreversible",
         },
         {
             // Exact --force/-f only: --force-with-lease is the guarded variant and
@@ -900,9 +985,9 @@ export const DEFAULT_EXEC_POLICY = {
         },
         // --- forbidden: destructive commands (positional) ---
         {
-            pattern: ["rm", ["-rf", "-fr", "-r", "-f", "--recursive", "--force"]],
+            pattern: ["rm", ["-rf", "-fr", "-r", "-R", "--recursive"]],
             decision: "forbidden",
-            justification: "recursive/forced deletion is destructive and irreversible",
+            justification: "recursive deletion is destructive and irreversible",
         },
         { pattern: ["git", "reset", "--hard"], decision: "forbidden", justification: "hard reset discards uncommitted changes irreversibly" },
         { pattern: ["git", "checkout", "--"], decision: "forbidden", justification: "discards working tree changes" },
@@ -1049,6 +1134,14 @@ export const DEFAULT_EXEC_POLICY = {
         { pattern: ["printenv"], decision: "allow", justification: "print environment variables (read-only)" },
         { pattern: ["npm", ["view", "info"]], decision: "allow", justification: "read package metadata from registry" },
         // --- prompt: potentially destructive but context-dependent ---
+        // Non-recursive forced deletion — Guardian-reviewable, single file.
+        // Must precede the generic rm prompt rule; ordered before it in this list.
+        {
+            pattern: ["rm"],
+            flagsAnywhere: ["-f*", "--force*"],
+            decision: "prompt",
+            justification: "forced deletion of a single file — review the target",
+        },
         { pattern: ["rm"], decision: "prompt", justification: "file deletion — review the target" },
         { pattern: ["git", "commit"], decision: "prompt", justification: "creates a commit — confirm intent" },
         { pattern: ["git", "push"], decision: "prompt", justification: "pushes to remote — confirm intent" },
@@ -1079,6 +1172,19 @@ export const DEFAULT_EXEC_POLICY = {
         { pattern: ["mkdir"], decision: "prompt", justification: "creates directories" },
         { pattern: ["touch"], decision: "prompt", justification: "creates or updates file timestamps" },
         { pattern: ["tar"], decision: "prompt", justification: "archive operation" },
+        // Interpreters with inline code — the code is on the command line where
+        // the Guardian can read it. Bare interpreters (program from stdin or a
+        // file) never reach these: the pipe-to-interpreter check forbids the piped
+        // form, and the file form is covered by the prompt rules below. Ordered
+        // AFTER the `node --version`/`node -v` allow rules so version checks stay
+        // auto-allowed.
+        { pattern: ["python"], flagsAnywhere: ["-c"], decision: "prompt", justification: "python runs inline code — review the script" },
+        { pattern: ["python3"], flagsAnywhere: ["-c"], decision: "prompt", justification: "python runs inline code — review the script" },
+        { pattern: ["node", ["-e", "-p"]], decision: "prompt", justification: "node runs inline code — review the script" },
+        { pattern: ["perl", "-e"], decision: "prompt", justification: "perl runs inline code — review the script" },
+        { pattern: ["ruby", "-e"], decision: "prompt", justification: "ruby runs inline code — review the script" },
+        { pattern: ["python", "-m"], decision: "prompt", justification: "python runs a module — review the module and args" },
+        { pattern: ["python3", "-m"], decision: "prompt", justification: "python runs a module — review the module and args" },
         { pattern: ["zip"], decision: "prompt", justification: "archive operation" },
         { pattern: ["unzip"], decision: "prompt", justification: "archive operation" },
         { pattern: ["kill"], decision: "prompt", justification: "sends a signal to a process" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.1.0-staging.1327.1",
+  "version": "1.1.0-staging.1328.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "82e201e640d0f201b2e2a28a14b4259921086436"
+  "yagniSourceSha": "34b64c98d42aa85f408a4f85de7ef103722038f7"
 }