auto-mode 0.20.0 → 0.20.1

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as readHostEnvironment, T as resolveXDGDir, a as classifyAction, b as loadConfig, i as recordScope, m as writeActionDiagnostic, n as parseScopeRecordRequest, p as loadPolicy, r as parseActionRequest, t as renderVerdict, v as findGitEntry } from "./render-verdict-0NxrIuIc.js";
+import { C as readHostEnvironment, T as resolveXDGDir, a as classifyAction, b as loadConfig, i as recordScope, m as writeActionDiagnostic, n as parseScopeRecordRequest, p as loadPolicy, r as parseActionRequest, t as renderVerdict, v as findGitEntry } from "./render-verdict-BEZSxyzF.js";
 import { chmod, mkdir, open, realpath, stat } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { randomUUID } from "node:crypto";

package/dist/index.js

@@ -1,4 +1,4 @@
-import { S as resolveConfigPath, _ as tryClassifyEdit, a as classifyAction, b as loadConfig, c as classifyWithModel, d as DecisionRequestError, f as buildDecisionRequest, g as loadClaudeSettings, h as checkContainment, i as recordScope, l as parseModelVerdict, n as parseScopeRecordRequest, o as buildTaskScope, p as loadPolicy, r as parseActionRequest, s as classifyLocally, t as renderVerdict, u as sendDecision, w as PRESETS, x as resolveApiKey, y as DEFAULT_CONFIG } from "./render-verdict-0NxrIuIc.js";
+import { S as resolveConfigPath, _ as tryClassifyEdit, a as classifyAction, b as loadConfig, c as classifyWithModel, d as DecisionRequestError, f as buildDecisionRequest, g as loadClaudeSettings, h as checkContainment, i as recordScope, l as parseModelVerdict, n as parseScopeRecordRequest, o as buildTaskScope, p as loadPolicy, r as parseActionRequest, s as classifyLocally, t as renderVerdict, u as sendDecision, w as PRESETS, x as resolveApiKey, y as DEFAULT_CONFIG } from "./render-verdict-BEZSxyzF.js";
 //#region src/config/load-claude-rules.ts
 async function loadClaudeRules(path, host) {
 	return (await loadClaudeSettings(path, host)).rules;

package/dist/{render-verdict-0NxrIuIc.js → render-verdict-BEZSxyzF.js}

@@ -8681,13 +8681,10 @@ const READ_ONLY_TOOLS = /* @__PURE__ */ new Set([
 	"Grep",
 	"LS",
 	"NotebookRead",
-	"WebFetch",
-	"WebSearch",
 	"TodoWrite"
 ]);
 const SHELL_TOOLS = /* @__PURE__ */ new Set(["Bash"]);
 const READ_ONLY_COMMANDS = /* @__PURE__ */ new Set([
-	"awk",
 	"basename",
 	"cat",
 	"cksum",
@@ -8700,7 +8697,6 @@ const READ_ONLY_COMMANDS = /* @__PURE__ */ new Set([
 	"dirname",
 	"du",
 	"echo",
-	"env",
 	"false",
 	"fd",
 	"file",
@@ -8710,7 +8706,6 @@ const READ_ONLY_COMMANDS = /* @__PURE__ */ new Set([
 	"hostname",
 	"id",
 	"jq",
-	"less",
 	"ls",
 	"md5sum",
 	"nl",
@@ -8735,9 +8730,138 @@ const READ_ONLY_COMMANDS = /* @__PURE__ */ new Set([
 	"uptime",
 	"wc",
 	"which",
-	"whoami",
-	"xxd",
-	"yq"
+	"whoami"
+]);
+const UNSAFE_OPTIONS = /* @__PURE__ */ new Map([
+	["date", {
+		short: ["s"],
+		long: ["set"],
+		valued: {
+			short: [
+				"d",
+				"f",
+				"r"
+			],
+			attached: ["I"],
+			long: [
+				"date",
+				"file",
+				"reference",
+				"rfc-3339"
+			]
+		}
+	}],
+	["fd", {
+		short: ["x", "X"],
+		long: ["exec", "exec-batch"],
+		valued: {
+			short: [
+				"c",
+				"d",
+				"e",
+				"E",
+				"j",
+				"o",
+				"S",
+				"t"
+			],
+			long: [
+				"color",
+				"exclude",
+				"extension",
+				"max-depth",
+				"owner",
+				"size",
+				"threads",
+				"type"
+			]
+		}
+	}],
+	["file", {
+		short: ["C"],
+		long: ["compile"],
+		valued: {
+			short: [
+				"e",
+				"f",
+				"F",
+				"m",
+				"P"
+			],
+			long: [
+				"exclude",
+				"exclude-quiet",
+				"files-from",
+				"magic-file",
+				"parameter",
+				"separator"
+			]
+		}
+	}],
+	["find", { words: [
+		"-delete",
+		"-exec",
+		"-execdir",
+		"-fls",
+		"-fprint",
+		"-fprint0",
+		"-fprintf",
+		"-ok",
+		"-okdir"
+	] }],
+	["hostname", {
+		short: ["b", "F"],
+		long: ["boot", "file"],
+		operands: 0
+	}],
+	["rg", {
+		short: ["z"],
+		long: [
+			"hostname-bin",
+			"pre",
+			"search-zip"
+		]
+	}],
+	["sort", {
+		short: ["o", "T"],
+		long: [
+			"compress-program",
+			"output",
+			"temporary-directory"
+		],
+		valued: {
+			short: [
+				"k",
+				"S",
+				"t"
+			],
+			long: [
+				"batch-size",
+				"buffer-size",
+				"field-separator",
+				"files0-from",
+				"key",
+				"parallel",
+				"random-source",
+				"sort"
+			]
+		}
+	}],
+	["uniq", {
+		operands: 1,
+		valued: {
+			short: [
+				"f",
+				"s",
+				"w"
+			],
+			long: [
+				"check-chars",
+				"skip-chars",
+				"skip-fields"
+			]
+		}
+	}]
 ]);
 const READ_ONLY_GIT_SUBCOMMANDS = /* @__PURE__ */ new Set([
 	"blame",
@@ -8745,7 +8869,6 @@ const READ_ONLY_GIT_SUBCOMMANDS = /* @__PURE__ */ new Set([
 	"diff",
 	"log",
 	"ls-files",
-	"ls-remote",
 	"ls-tree",
 	"rev-list",
 	"rev-parse",
@@ -8753,9 +8876,14 @@ const READ_ONLY_GIT_SUBCOMMANDS = /* @__PURE__ */ new Set([
 	"show",
 	"show-ref",
 	"status",
-	"tag",
 	"whatchanged"
 ]);
+const UNSAFE_GIT_OPTIONS = { long: [
+	"ext-diff",
+	"output",
+	"textconv"
+] };
+const SAFE_GIT_GLOBAL_FLAGS = /* @__PURE__ */ new Set(["--no-pager", "-P"]);
 const REGENERABLE_DIRS = /* @__PURE__ */ new Set([
 	".gradle",
 	".next",
@@ -8798,21 +8926,90 @@ function classifyLocally(payload) {
 	};
 }
 function classifySegment(text, cwd) {
+	if (splitShellTokens(text).tokens.some((token) => token.kind === "redirect")) return null;
 	const words = splitWords(text);
-	const start = words.findIndex((word) => !/^[A-Za-z_][A-Za-z0-9_]*=/.test(word.raw));
-	if (start === -1) return "Read-only actions";
-	const head = words[start];
-	invariant(head !== void 0, "findIndex returned an index the array holds");
-	const rest = words.slice(start + 1);
+	if (words.length === 0 || splitCommandWords(text).length !== words.length) return null;
+	if (words.some((word) => hasShellExpansion(word.raw))) return null;
+	const [head, ...rest] = words;
+	invariant(head !== void 0, "the segment holds at least one word");
 	const name = head.raw.slice(head.raw.lastIndexOf("/") + 1);
-	if (READ_ONLY_COMMANDS.has(name)) return "Read-only actions";
-	if (name === "git") {
-		const sub = rest.find((word) => !word.raw.startsWith("-"));
-		return sub !== void 0 && READ_ONLY_GIT_SUBCOMMANDS.has(sub.raw) ? "Read-only actions" : null;
+	const args = rest.map((word) => word.value);
+	if (READ_ONLY_COMMANDS.has(name)) {
+		const unsafe = UNSAFE_OPTIONS.get(name);
+		return unsafe === void 0 || !hasUnsafeOption(args, unsafe) ? "Read-only actions" : null;
 	}
+	if (name === "git") return classifyGit(args, cwd);
 	if (name === "rm") return classifyRemove(rest, cwd);
 	return null;
 }
+function hasUnsafeOption(args, unsafe) {
+	if (args.some((arg) => unsafe.words?.includes(arg) === true)) return true;
+	let operands = 0;
+	let index = 0;
+	while (index < args.length) {
+		const arg = args[index] ?? "";
+		if (arg === "--") {
+			operands += args.length - index - 1;
+			break;
+		}
+		if (isOptionWord(arg)) {
+			const option = parseOption(arg, unsafe);
+			if (option.isUnsafe) return true;
+			if (option.takesNextWord && !isOptionWord(args[index + 1] ?? "-")) index += 1;
+		} else operands += 1;
+		index += 1;
+	}
+	return unsafe.operands !== void 0 && operands > unsafe.operands;
+}
+function parseOption(arg, unsafe) {
+	const valued = unsafe.valued;
+	if (arg.startsWith("--")) {
+		const [name = "", ...value] = arg.slice(2).split("=");
+		return {
+			isUnsafe: name !== "" && unsafe.long?.some((long) => long.startsWith(name)) === true,
+			takesNextWord: value.length === 0 && valued?.long.includes(name) === true
+		};
+	}
+	for (let index = 1; index < arg.length; index += 1) {
+		const letter = arg.charAt(index);
+		if (unsafe.short?.includes(letter) === true) return {
+			isUnsafe: true,
+			takesNextWord: false
+		};
+		if (valued?.attached?.includes(letter) === true) break;
+		if (valued?.short.includes(letter) === true) return {
+			isUnsafe: false,
+			takesNextWord: index === arg.length - 1
+		};
+	}
+	return {
+		isUnsafe: false,
+		takesNextWord: false
+	};
+}
+function isOptionWord(arg) {
+	return arg.startsWith("-") && arg !== "-";
+}
+function classifyGit(args, cwd) {
+	const git = splitGitCommand(args, cwd, "");
+	const globals = args.slice(0, args.length - git.args.length);
+	const [sub, ...subArgs] = git.args;
+	if (sub === void 0 || !READ_ONLY_GIT_SUBCOMMANDS.has(sub)) return null;
+	return hasOnlySafeGitGlobals(globals) && !hasUnsafeOption(subArgs, UNSAFE_GIT_OPTIONS) ? "Read-only actions" : null;
+}
+function hasOnlySafeGitGlobals(globals) {
+	let index = 0;
+	while (index < globals.length) {
+		const option = globals[index] ?? "";
+		if (option === "-C") {
+			const directory = globals[index + 1];
+			if (directory === void 0 || directory.startsWith("-")) return false;
+			index += 2;
+		} else if (SAFE_GIT_GLOBAL_FLAGS.has(option)) index += 1;
+		else return false;
+	}
+	return true;
+}
 function classifyRemove(args, cwd) {
 	const paths = args.filter((arg) => !arg.raw.startsWith("-"));
 	if (paths.length === 0) return null;
@@ -8834,6 +9031,23 @@ function splitWords(text) {
 		value: token.value
 	}] : []);
 }
+function hasShellExpansion(raw) {
+	let quote = null;
+	let previous = "";
+	for (const char of raw) {
+		if (quote === "'") quote = char === "'" ? null : quote;
+		else if (char === "\\" || char === "$" || char === "`") return true;
+		else if (char === quote) quote = null;
+		else if (quote === null && (char === "'" || char === "\"")) quote = char;
+		else if (quote === null && isExpansionCharacter(char, previous)) return true;
+		previous = char;
+	}
+	return false;
+}
+function isExpansionCharacter(char, previous) {
+	if (char === "~") return previous === "" || previous === "=" || previous === ":";
+	return "{}*?[]()!".includes(char) || /\s/u.test(char);
+}
 function isPlainOperand(word) {
 	return [
 		word.value,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auto-mode",
-  "version": "0.20.0",
+  "version": "0.20.1",
   "description": "A permission classifier library and Claude Code mod, so agents that are not Claude can run unattended",
   "keywords": [
     "agent",