devcouncil 0.1.0 → 0.2.0

package/src/devcouncil/execution/patch.py

@@ -1,28 +1,77 @@
-import subprocess
-from pathlib import Path
-from devcouncil.app.errors import ExecutionError
-
-class PatchEngine:
-    """Handles applying unified diff patches to the codebase."""
-    
-    def __init__(self, project_root: Path):
-        self.project_root = project_root
-
-    def apply_patch(self, patch_content: str) -> bool:
-        """Applies a git-style patch to the repository."""
-        patch_file = self.project_root / ".devcouncil" / "temp.patch"
-        patch_file.parent.mkdir(parents=True, exist_ok=True)
-        patch_file.write_text(patch_content, encoding="utf-8")
-        
-        try:
-            # Using git apply for robust patch application
-            subprocess.check_call(
-                ["git", "apply", "--ignore-whitespace", str(patch_file)],
-                cwd=self.project_root
-            )
-            return True
-        except subprocess.CalledProcessError as e:
-            raise ExecutionError(f"Failed to apply patch: {e}")
-        finally:
-            if patch_file.exists():
-                patch_file.unlink()
+import re
+import subprocess
+from pathlib import Path
+from devcouncil.app.errors import ExecutionError
+
+
+class PatchEngine:
+    """Handles applying unified diff patches to the codebase."""
+
+    # Progressively more tolerant `git apply` invocations. The first that succeeds
+    # wins; we only escalate tolerance (whitespace, 3-way merge) rather than ever
+    # falling back to `--reject` (which would leave a half-applied tree + .rej files).
+    _APPLY_LADDER: tuple[tuple[str, ...], ...] = (
+        (),                                   # strict: exact context match
+        ("--ignore-whitespace",),             # tolerate whitespace-only context drift
+        ("--3way",),                          # reconstruct via blob ancestry when context moved
+        ("--3way", "--ignore-whitespace"),    # both
+    )
+
+    def __init__(self, project_root: Path):
+        self.project_root = project_root
+
+    def _validate_paths(self, patch_content: str) -> None:
+        """Defense-in-depth: reject a diff that touches anything outside the repo root.
+
+        Callers that go through ``TaskRunner.apply_patch`` already gate against the
+        task's planned files, but the engine is directly callable, so it validates the
+        coarse containment boundary (within ``project_root``) itself."""
+        root = self.project_root.resolve()
+        for match in re.finditer(r"^(?:\+\+\+|---)\s+(?:[ab]/)?(\S+)", patch_content, re.MULTILINE):
+            raw = match.group(1)
+            if raw == "/dev/null":  # new/deleted file sentinel
+                continue
+            try:
+                resolved = (root / raw).resolve()
+            except (OSError, ValueError) as exc:
+                raise ExecutionError(f"Patch references an invalid path: {raw!r} ({exc})")
+            if resolved != root and root not in resolved.parents:
+                raise ExecutionError(
+                    f"Patch attempts to modify a path outside the project root: {raw!r}."
+                )
+
+    def apply_patch(self, patch_content: str) -> bool:
+        """Applies a git-style patch to the repository.
+
+        Tries an escalating ladder of ``git apply`` tolerances so a patch whose context
+        drifted slightly (common when an agent edits the file after producing the diff)
+        still applies cleanly instead of hard-failing on the strict first pass. If every
+        rung fails, the error names the failing hunks from git's own report rather than a
+        bare exit code."""
+        self._validate_paths(patch_content)
+
+        patch_file = self.project_root / ".devcouncil" / "temp.patch"
+        patch_file.parent.mkdir(parents=True, exist_ok=True)
+        patch_file.write_text(patch_content, encoding="utf-8")
+
+        last_stderr = ""
+        try:
+            for extra_args in self._APPLY_LADDER:
+                proc = subprocess.run(
+                    ["git", "apply", *extra_args, str(patch_file)],
+                    cwd=self.project_root,
+                    capture_output=True,
+                    text=True,
+                    encoding="utf-8",
+                    errors="replace",
+                )
+                if proc.returncode == 0:
+                    return True
+                last_stderr = (proc.stderr or "").strip()
+            raise ExecutionError(
+                "Failed to apply patch even with whitespace/3-way fallbacks. "
+                f"git reported: {last_stderr or '(no detail)'}"
+            )
+        finally:
+            if patch_file.exists():
+                patch_file.unlink()

package/src/devcouncil/execution/permissions.py

@@ -1,57 +1,55 @@
-import fnmatch
-from pathlib import Path
+import fnmatch
+from pathlib import Path
 from typing import List, Literal, Optional
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field
 from devcouncil.domain.task import PlannedFile, Task
-from devcouncil.app.errors import GatingError
-
-class PermissionPolicy(BaseModel):
-    """Defines the security boundaries for task execution."""
-    allow_file_create: bool = False
-    allow_file_delete: bool = False
-    allowed_shell_commands: List[str] = Field(default_factory=list)
-    restricted_paths: List[str] = Field(default_factory=lambda: [".git/*", ".devcouncil/*", ".env*"])
-
+from devcouncil.app.errors import GatingError
+from devcouncil.execution.policy_engine import TaskPolicyEngine
+
+class PermissionPolicy(BaseModel):
+    """Defines the security boundaries for task execution."""
+    allow_file_create: bool = False
+    allow_file_delete: bool = False
+    allowed_shell_commands: List[str] = Field(default_factory=list)
+    restricted_paths: List[str] = Field(default_factory=lambda: [".git/*", ".devcouncil/*", ".env*"])
+
 class PermissionManager:
-    def __init__(self, policy: PermissionPolicy, project_root: Path = Path(".")):
-        self.policy = policy
-        self.project_root = project_root
-        self.dynamic_ignores = self._load_devcouncilignore()
-
-    def _load_devcouncilignore(self) -> List[str]:
-        """Load additional restricted paths from .devcouncilignore."""
-        ignore_file = self.project_root / ".devcouncilignore"
-        if ignore_file.exists():
-            try:
-                lines = ignore_file.read_text().splitlines()
-                return [line.strip() for line in lines if line.strip() and not line.startswith("#")]
-            except Exception:
-                pass
-        return []
-
+    def __init__(self, policy: PermissionPolicy, project_root: Path = Path(".")):
+        self.policy = policy
+        self.project_root = project_root
+        self.dynamic_ignores = self._load_devcouncilignore()
+        self.policy_engine = TaskPolicyEngine(
+            project_root,
+            global_allowed_commands=policy.allowed_shell_commands,
+        )
+
+    def _load_devcouncilignore(self) -> List[str]:
+        """Load additional restricted paths from .devcouncilignore."""
+        ignore_file = self.project_root / ".devcouncilignore"
+        if ignore_file.exists():
+            try:
+                lines = ignore_file.read_text().splitlines()
+                return [line.strip() for line in lines if line.strip() and not line.startswith("#")]
+            except Exception:
+                pass
+        return []
+
     def is_file_change_allowed(
         self,
         path: str,
         task: Task,
         operation: Literal["create", "modify", "delete", "write"] = "write",
+        *,
+        internal: bool = False,
     ) -> bool:
         """Check if a file change is authorized by the task or policy."""
-        # 1. Check restricted paths (e.g. .git) and dynamic ignores
-        all_restricted = self.policy.restricted_paths + self.dynamic_ignores
-        for restricted in all_restricted:
+        for restricted in self.dynamic_ignores:
             if fnmatch.fnmatch(path, restricted) or path.startswith(restricted.strip("*")):
                 return False
-
-        # 2. Check if path is in task's planned files with a compatible operation.
-        planned = self._planned_file_for(path, task)
-        if not planned:
-            return False
-
-        if planned.allowed_change == "read_only":
-            return False
-        if operation == "write":
-            return planned.allowed_change in {"create", "modify"}
-        return planned.allowed_change == operation
+        decision = self.policy_engine.evaluate_file_change(
+            path, task, operation, internal=internal
+        )
+        return decision.action in {"allow", "warn"}
 
     def _planned_file_for(self, path: str, task: Task) -> Optional[PlannedFile]:
         normalized = path.replace("\\", "/")
@@ -60,33 +58,28 @@ class PermissionManager:
             if normalized == planned_path or fnmatch.fnmatch(normalized, planned_path):
                 return planned
         return None
-
-    def is_command_allowed(self, command: str, task: Task) -> bool:
-        """Check if a shell command is authorized by the task or global allowlist."""
-        # 1. Check task-specific allowlist
-        if any(fnmatch.fnmatch(command, allowed) for allowed in task.allowed_commands):
-            return True
-            
-        # 2. Check global policy allowlist
-        if any(fnmatch.fnmatch(command, allowed) for allowed in self.policy.allowed_shell_commands):
-            return True
-            
-        return False
-
+
+    def is_command_allowed(self, command: str, task: Task) -> bool:
+        """Check if a shell command is authorized by the task or global allowlist."""
+        decision = self.policy_engine.evaluate_command(command, task)
+        return decision.action == "allow"
+
     def validate_action(
         self,
         action_type: str,
         target: str,
         task: Task,
         operation: Literal["create", "modify", "delete", "write"] = "write",
+        *,
+        internal: bool = False,
     ):
         """Raise GatingError if an execution action violates permissions."""
         if action_type == "file_write":
-            if not self.is_file_change_allowed(target, task, operation):
+            if not self.is_file_change_allowed(target, task, operation, internal=internal):
                 raise GatingError(
                     f"Unauthorized file {operation}: {target}. "
                     "File and operation must match task planned_files."
                 )
-        elif action_type == "shell":
-            if not self.is_command_allowed(target, task):
-                raise GatingError(f"Unauthorized shell command: {target}. Command must be in task's allowed_commands.")
+        elif action_type == "shell":
+            if not self.is_command_allowed(target, task):
+                raise GatingError(f"Unauthorized shell command: {target}. Command must be in task's allowed_commands.")

package/src/devcouncil/execution/policy_engine.py

@@ -0,0 +1,343 @@
+"""Shared task policy engine for shell commands and file changes."""
+
+from __future__ import annotations
+
+import fnmatch
+import re
+from pathlib import Path
+from typing import Literal
+
+from pydantic import BaseModel
+
+from devcouncil.domain.task import PlannedFile, Task
+
+
+class PolicyDecision(BaseModel):
+    action: Literal["allow", "warn", "deny"]
+    reason: str
+    target: str
+    task_id: str | None = None
+
+
+def normalize_repo_path(project_root: Path, raw_path: str) -> tuple[str, bool]:
+    """Resolve ``raw_path`` against ``project_root`` and report containment.
+
+    Returns ``(normalized_posix_path, is_outside_root)``. This is the single source of
+    truth used by both the task policy engine and the coding-CLI hook policy, so a path
+    is normalized identically wherever it is checked — closing the bypass where a path
+    that failed to resolve was returned raw and enforced differently than it was
+    checked. ``is_outside_root`` is True for anything that escapes the project (absolute
+    elsewhere, ``..`` traversal) or cannot be resolved, so callers fail closed."""
+    cleaned = raw_path.strip().strip('"').replace("\\", "/")
+    root = project_root.resolve()
+    try:
+        candidate = Path(cleaned)
+        resolved = candidate.resolve() if candidate.is_absolute() else (root / cleaned).resolve()
+    except OSError:
+        fallback = cleaned[2:] if cleaned.startswith("./") else cleaned
+        return fallback, True
+    try:
+        return resolved.relative_to(root).as_posix(), False
+    except ValueError:
+        return resolved.as_posix(), True
+
+
+_NO_TASK_ALLOWED_COMMANDS = (
+    "dev status",
+    "dev tasks",
+    "git status",
+    "git diff",
+    "git diff *",
+)
+
+# Shared with HookPolicy — keep these as the single source of truth for
+# protected/secret path patterns.
+PROTECTED_WRITE_PATTERNS = (
+    "package.json",
+    "pyproject.toml",
+    "uv.lock",
+    "package-lock.json",
+    "yarn.lock",
+    "pnpm-lock.yaml",
+    "Dockerfile",
+    "docker-compose.yml",
+    ".github/workflows/*.yml",
+    ".github/workflows/*.yaml",
+    "schema.prisma",
+    "wrangler.toml",
+    "index.html",
+)
+
+SECRET_PATH_PATTERNS = (
+    ".env",
+    ".env.*",
+    "**/.env",
+    "**/.env.*",
+    "**/credentials/**",
+    "**/secrets/**",
+    "**/*.pem",
+    "**/*.key",
+    # Private SSH keys and well-known credential/token files. These are never
+    # writable through the gate so an agent cannot plant or overwrite credentials.
+    "**/id_rsa",
+    "**/id_dsa",
+    "**/id_ecdsa",
+    "**/id_ed25519",
+    "id_rsa",
+    "id_ed25519",
+    ".npmrc",
+    "**/.npmrc",
+    ".pypirc",
+    "**/.pypirc",
+    ".netrc",
+    "**/.netrc",
+    "**/.aws/credentials",
+    ".aws/credentials",
+    "**/*.pfx",
+    "**/*.p12",
+    "*.pfx",
+    "*.p12",
+    ".git-credentials",
+    "**/.git-credentials",
+    "**/kube/config",
+    "**/.kube/config",
+)
+
+_RESTRICTED_PATH_PATTERNS = (
+    ".git/*",
+    ".devcouncil/*",
+    # Protect the client hook/agent configs themselves: an agent must not be able to
+    # disarm or rewire the pre-action gate by editing its own client integration files.
+    ".claude/*",
+    ".claude/**",
+    ".codex/*",
+    ".codex/**",
+    ".cursor/*",
+    ".cursor/**",
+    ".gemini/*",
+    ".gemini/**",
+    ".opencode/*",
+    ".opencode/**",
+    ".agents/*",
+    ".agents/**",
+    "opencode.json",
+)
+
+
+class TaskPolicyEngine:
+    def __init__(
+        self,
+        project_root: Path,
+        global_allowed_commands: list[str] | None = None,
+    ):
+        self.project_root = project_root.resolve()
+        self.global_allowed_commands = global_allowed_commands or []
+
+    def evaluate_command(self, command: str, task: Task | None) -> PolicyDecision:
+        normalized = " ".join(command.split())
+        if not normalized:
+            return PolicyDecision(
+                action="deny",
+                reason="Empty command is not allowed.",
+                target=command,
+                task_id=task.id if task else None,
+            )
+
+        if task is None:
+            if any(fnmatch.fnmatch(normalized, allowed) for allowed in _NO_TASK_ALLOWED_COMMANDS):
+                return PolicyDecision(
+                    action="allow",
+                    reason="Read-only command allowed without active task.",
+                    target=normalized,
+                )
+            return PolicyDecision(
+                action="deny",
+                reason="Shell commands require an active task lease.",
+                target=normalized,
+            )
+
+        if any(fnmatch.fnmatch(normalized, allowed) for allowed in task.allowed_commands):
+            return PolicyDecision(
+                action="allow",
+                reason="Command matches task allowed_commands.",
+                target=normalized,
+                task_id=task.id,
+            )
+        if any(fnmatch.fnmatch(normalized, allowed) for allowed in self.global_allowed_commands):
+            return PolicyDecision(
+                action="allow",
+                reason="Command matches global allowed commands.",
+                target=normalized,
+                task_id=task.id,
+            )
+        return PolicyDecision(
+            action="deny",
+            reason="Command is not in task or global allowlists.",
+            target=normalized,
+            task_id=task.id,
+        )
+
+    def evaluate_file_change(
+        self,
+        path: str,
+        task: Task | None,
+        operation: Literal["create", "modify", "delete", "write"] = "write",
+        *,
+        internal: bool = False,
+    ) -> PolicyDecision:
+        normalized, outside_root = normalize_repo_path(self.project_root, path)
+        task_id = task.id if task else None
+
+        if outside_root:
+            return PolicyDecision(
+                action="deny",
+                reason="Path is outside the project root.",
+                target=normalized,
+                task_id=task_id,
+            )
+
+        if self._matches_any(normalized, SECRET_PATH_PATTERNS):
+            return PolicyDecision(
+                action="deny",
+                reason="Secret and credential paths are never writable.",
+                target=normalized,
+                task_id=task_id,
+            )
+
+        if not internal and self._matches_restricted(normalized):
+            return PolicyDecision(
+                action="deny",
+                reason="Protected repository paths cannot be modified.",
+                target=normalized,
+                task_id=task_id,
+            )
+
+        if task is None:
+            return PolicyDecision(
+                action="deny",
+                reason="No running DevCouncil task authorizes this file write.",
+                target=normalized,
+            )
+
+        if self._matches_forbidden(normalized, task):
+            return PolicyDecision(
+                action="deny",
+                reason="Path is listed in forbidden_changes.",
+                target=normalized,
+                task_id=task.id,
+            )
+
+        planned = self._planned_file_for(normalized, task)
+        if planned is None:
+            return PolicyDecision(
+                action="deny",
+                reason=f"Task {task.id} does not authorize changes to {normalized}.",
+                target=normalized,
+                task_id=task.id,
+            )
+
+        if planned.allowed_change == "read_only":
+            return PolicyDecision(
+                action="deny",
+                reason="Planned file is read-only.",
+                target=normalized,
+                task_id=task.id,
+            )
+        if operation == "write":
+            if planned.allowed_change not in {"create", "modify"}:
+                return PolicyDecision(
+                    action="deny",
+                    reason=f"Operation {operation} not allowed for planned file.",
+                    target=normalized,
+                    task_id=task.id,
+                )
+        elif planned.allowed_change != operation:
+            return PolicyDecision(
+                action="deny",
+                reason=f"Operation {operation} not allowed for planned file.",
+                target=normalized,
+                task_id=task.id,
+            )
+
+        if self._matches_any(normalized, PROTECTED_WRITE_PATTERNS):
+            return PolicyDecision(
+                action="warn",
+                reason=f"{normalized} is a protected high-impact file; verification gates must approve it.",
+                target=normalized,
+                task_id=task.id,
+            )
+
+        return PolicyDecision(
+            action="allow",
+            reason="File change is allowed.",
+            target=normalized,
+            task_id=task.id,
+        )
+
+    def evaluate_hook_command(self, command: str) -> PolicyDecision:
+        """Git safety checks for hook/shell tool paths."""
+        normalized = " ".join(command.split())
+        lowered = normalized.lower()
+        if not normalized:
+            return PolicyDecision(action="allow", reason="No command detected.", target=normalized)
+
+        if "--no-verify" in lowered or "--no-gpg-sign" in lowered:
+            return PolicyDecision(
+                action="deny",
+                reason="Verification bypass flags are not allowed.",
+                target=normalized,
+            )
+
+        if re.search(r"\bgit\s+reset\s+--hard\s+(origin/)?(main|master)\b", lowered):
+            return PolicyDecision(
+                action="deny",
+                reason="Protected branch hard resets are not allowed.",
+                target=normalized,
+            )
+
+        if re.search(r"\bgit\s+push\b.*(\s--force(?:-with-lease)?\b|\s-f\b)", lowered) or re.search(
+            r"\bgit\s+push\s+\S+\s+\+\S", lowered
+        ):
+            # The second pattern catches the leading-plus refspec form
+            # (`git push origin +HEAD:master`), which forces a non-fast-forward update
+            # without the --force flag.
+            return PolicyDecision(
+                action="deny",
+                reason="Force pushes are not allowed.",
+                target=normalized,
+            )
+
+        if re.search(r"\bgit\s+push\s+\S+\s+((head:)?(main|master)|(main|master):\S+)\b", lowered):
+            return PolicyDecision(
+                action="warn",
+                reason="Direct pushes to protected branches should go through verification gates.",
+                target=normalized,
+            )
+
+        return PolicyDecision(action="allow", reason="Command is allowed.", target=normalized)
+
+    def _normalize_path(self, raw_path: str) -> str:
+        return normalize_repo_path(self.project_root, raw_path)[0]
+
+    def _planned_file_for(self, path: str, task: Task) -> PlannedFile | None:
+        for planned in task.planned_files:
+            planned_path = planned.path.replace("\\", "/")
+            if path == planned_path or fnmatch.fnmatch(path, planned_path):
+                return planned
+        return None
+
+    def _matches_forbidden(self, path: str, task: Task) -> bool:
+        for forbidden in task.forbidden_changes:
+            pattern = forbidden.replace("\\", "/")
+            if path == pattern or fnmatch.fnmatch(path, pattern):
+                return True
+        return False
+
+    def _matches_restricted(self, path: str) -> bool:
+        for pattern in _RESTRICTED_PATH_PATTERNS:
+            if fnmatch.fnmatch(path, pattern) or path.startswith(pattern.strip("*")):
+                return True
+        return False
+
+    def _matches_any(self, path: str, patterns: tuple[str, ...]) -> bool:
+        return any(fnmatch.fnmatch(path, pattern) for pattern in patterns)