devcouncil 0.1.1 → 0.2.0

package/src/devcouncil/execution/hook_policy.py

@@ -2,10 +2,29 @@ import fnmatch
 import re
 from dataclasses import dataclass
 from pathlib import Path
-from pathlib import PurePosixPath
 from typing import Any, Optional
 
 from devcouncil.domain.task import Task
+from devcouncil.execution.policy_engine import (
+    PROTECTED_WRITE_PATTERNS,
+    SECRET_PATH_PATTERNS,
+    TaskPolicyEngine,
+    normalize_repo_path,
+)
+from devcouncil.utils.redaction import SECRET_PATTERNS
+
+# Splits a shell command into the segments a shell would execute independently, on
+# the chaining/pipe/sequence operators. We deliberately do NOT try to parse quoting
+# perfectly — any operator we miss only makes us evaluate a *larger* segment as a
+# single command (which then fails the allowlist), so this errs toward DENY.
+_SEGMENT_SPLIT_RE = re.compile(r"\s*(?:\|\||&&|\||;|\n)\s*")
+
+# Strips a `bash -c "..."` / `sh -c '...'` wrapper so the inner command is what gets
+# checked against the allowlist, closing the trivial obfuscation where a denied
+# command is smuggled inside a shell wrapper.
+_SHELL_WRAPPER_RE = re.compile(
+    r"""^\s*(?:[A-Za-z0-9_./\\-]*?(?:bash|sh|zsh|dash|ksh))(?:\.exe)?\s+-[A-Za-z]*c\s+(?P<quote>['"])(?P<inner>.*)(?P=quote)\s*$"""
+)
 
 
 @dataclass(frozen=True)
@@ -23,30 +42,30 @@ class HookPolicy:
     """Policy-backed hook checks for coding CLI tool-use events."""
 
     def __init__(self, project_root: Path | None = None):
-        self.project_root = project_root.resolve() if project_root else None
-
-    secret_path_patterns = (
-        ".env",
-        ".env.*",
-        "**/.env",
-        "**/.env.*",
-        "**/credentials/**",
-        "**/secrets/**",
-        "**/*.pem",
-        "**/*.key",
-    )
-    protected_path_patterns = (
-        "package.json",
-        "pyproject.toml",
-        "uv.lock",
-        "Dockerfile",
-        "docker-compose.yml",
-        ".github/workflows/*.yml",
-        ".github/workflows/*.yaml",
-        "schema.prisma",
-        "wrangler.toml",
-        "index.html",
-    )
+        self.project_root = (project_root or Path(".")).resolve()
+        self.policy_engine = TaskPolicyEngine(
+            self.project_root,
+            global_allowed_commands=self._load_global_allowed_commands(),
+        )
+
+    def _load_global_allowed_commands(self) -> list[str]:
+        """Best-effort load of repo-wide allowed commands from config.
+
+        Never raises — a missing/invalid config must not disable the gate, and the
+        gate stays fail-closed (empty allowlist) when config can't be read."""
+        try:
+            from devcouncil.app.config import load_config
+
+            execution = load_config(self.project_root).execution
+            configured = getattr(execution, "global_allowed_commands", None)
+            if isinstance(configured, (list, tuple)):
+                return [str(item) for item in configured]
+        except Exception:
+            pass
+        return []
+
+    secret_path_patterns = SECRET_PATH_PATTERNS
+    protected_path_patterns = PROTECTED_WRITE_PATTERNS
     write_tools = {
         "apply_patch",
         "edit",
@@ -57,6 +76,9 @@ class HookPolicy:
         "Edit",
         "MultiEdit",
         "Write",
+        "create_file",
+        "str_replace",
+        "search_replace",
     }
     shell_tools = {
         "bash",
@@ -65,9 +87,11 @@ class HookPolicy:
         "local_shell",
         "run_command",
         "run_shell_command",
+        "run_terminal_cmd",
         "shell",
         "shell_command",
         "Bash",
+        "Shell",
     }
 
     def evaluate(self, call_data: dict[str, Any], active_task: Optional[Task]) -> HookDecision:
@@ -78,57 +102,131 @@ class HookPolicy:
 
         if tool_name in self.shell_tools:
             command = self._extract_command(arguments)
-            return self.evaluate_command(command)
+            return self.evaluate_command(command, active_task)
 
         if tool_name in self.write_tools:
             target = self._extract_path(arguments)
-            return self.evaluate_file_write(target, active_task)
+            content = self._extract_content(arguments)
+            return self.evaluate_file_write(target, active_task, content=content)
 
         return HookDecision("allow", "Tool is outside DevCouncil hook policy.")
 
-    def evaluate_command(self, command: str) -> HookDecision:
-        normalized = " ".join(command.split())
-        lowered = normalized.lower()
+    def evaluate_command(self, command: str, active_task: Optional[Task] = None) -> HookDecision:
+        """Evaluate a shell command before execution.
+
+        Two gates, deny wins:
+          1. Git-safety regexes (force push, --no-verify, protected-branch resets).
+          2. The task command allowlist: every segment of a chained command must be
+             authorized by the active task (or the global allowlist). With no active
+             task only the read-only no-task allowlist applies, so a Bash-routed
+             write/destructive command can no longer escape the planned-files gate.
+        This fails closed: anything we cannot positively authorize is denied."""
+        if self.policy_engine is None:
+            return HookDecision("deny", "No project root configured.", command)
+
+        # 1) Git-safety check first — a hard deny here wins regardless of allowlist.
+        git_decision = self.policy_engine.evaluate_hook_command(command)
+        if git_decision.action == "deny":
+            return HookDecision(git_decision.action, git_decision.reason, git_decision.target)
+
+        # 2) Allowlist enforcement over every executed segment.
+        segments = self._split_command_segments(command)
+        if not segments:
+            return HookDecision("deny", "Empty command is not allowed.", command)
+
+        warn: HookDecision | None = None
+        for segment in segments:
+            decision = self.policy_engine.evaluate_command(segment, active_task)
+            if decision.action == "deny":
+                return HookDecision("deny", decision.reason, decision.target)
+            if decision.action == "warn" and warn is None:
+                warn = HookDecision("warn", decision.reason, decision.target)
+
+        # A git-safety warn (e.g. direct push to a protected branch) should surface even
+        # when every segment is otherwise allowed.
+        if git_decision.action == "warn":
+            return HookDecision(git_decision.action, git_decision.reason, git_decision.target)
+        if warn is not None:
+            return warn
+        return HookDecision("allow", "Command authorized by task allowlist.", command)
+
+    def _split_command_segments(self, command: str) -> list[str]:
+        """Split a shell command on ; && || | and newlines, unwrapping bash -c wrappers.
+
+        Each returned segment is itself unwrapped/re-split so a denied command nested
+        inside a `bash -c "..."` wrapper is still checked. Errs toward DENY: anything
+        ambiguous collapses into a larger segment that the allowlist will reject."""
+        normalized = command.strip()
         if not normalized:
-            return HookDecision("allow", "No command detected.")
-
-        if "--no-verify" in lowered or "--no-gpg-sign" in lowered:
-            return HookDecision("deny", "Verification bypass flags are not allowed.", normalized)
-
-        if re.search(r"\bgit\s+reset\s+--hard\s+(origin/)?(main|master)\b", lowered):
-            return HookDecision("deny", "Protected branch hard resets are not allowed.", normalized)
-
-        if re.search(r"\bgit\s+push\b.*(\s--force(?:-with-lease)?\b|\s-f\b)", lowered):
-            return HookDecision("deny", "Force pushes are not allowed.", normalized)
-
-        if re.search(r"\bgit\s+push\s+\S+\s+((head:)?(main|master)|(main|master):\S+)\b", lowered):
-            return HookDecision("warn", "Direct pushes to protected branches should go through verification gates.", normalized)
-
-        return HookDecision("allow", "Command is allowed.", normalized)
-
-    def evaluate_file_write(self, raw_path: Optional[str], active_task: Optional[Task]) -> HookDecision:
+            return []
+
+        wrapper = _SHELL_WRAPPER_RE.match(normalized)
+        if wrapper is not None:
+            # Recurse into the wrapped command so its own chaining is evaluated.
+            return self._split_command_segments(wrapper.group("inner"))
+
+        segments: list[str] = []
+        for raw in _SEGMENT_SPLIT_RE.split(normalized):
+            piece = raw.strip()
+            if not piece:
+                continue
+            nested = _SHELL_WRAPPER_RE.match(piece)
+            if nested is not None:
+                segments.extend(self._split_command_segments(nested.group("inner")))
+            else:
+                segments.append(piece)
+        return segments
+
+    def evaluate_file_write(
+        self,
+        raw_path: Optional[str],
+        active_task: Optional[Task],
+        *,
+        content: Optional[str] = None,
+    ) -> HookDecision:
         if not raw_path:
             return HookDecision("allow", "No file path detected.")
-
-        path = self._normalize_path(raw_path)
-        if self._matches_any(path, self.secret_path_patterns):
-            return HookDecision("deny", "Secret and credential paths are never writable through hooks.", path)
-
-        if active_task is None:
-            return HookDecision("deny", "No running DevCouncil task authorizes this file write.", path)
-
-        if active_task and not self._is_planned_file(path, active_task):
-            return HookDecision("deny", f"Task {active_task.id} does not authorize changes to {path}.", path)
-
-        if self._matches_any(path, self.protected_path_patterns):
-            return HookDecision("warn", f"{path} is a protected high-impact file; verification gates must approve it.", path)
-
-        return HookDecision("allow", "File write is allowed.", path)
+        if self.policy_engine is None:
+            return HookDecision("deny", "No project root configured.", raw_path)
+
+        # Pre-action secret scan: refuse to write content that contains a secret,
+        # before it ever lands on disk. Reuses the shared secret regexes.
+        if content is not None:
+            secret = self._scan_content_for_secret(content)
+            if secret is not None:
+                return HookDecision(
+                    "deny",
+                    f"Refusing to write content containing a potential {secret}.",
+                    raw_path,
+                )
+
+        # Delegate to the engine, which normalizes via the shared normalize_repo_path and
+        # denies out-of-root targets — so the path that is checked is the path enforced.
+        decision = self.policy_engine.evaluate_file_change(raw_path, active_task)
+        return HookDecision(decision.action, decision.reason, decision.target)
+
+    def _scan_content_for_secret(self, content: str) -> Optional[str]:
+        if not isinstance(content, str) or not content:
+            return None
+        for key_type, pattern in SECRET_PATTERNS.items():
+            if pattern.search(content):
+                return key_type
+        return None
 
     def _extract_command(self, arguments: dict[str, Any]) -> str:
         value = arguments.get("command") or arguments.get("cmd") or arguments.get("script") or ""
         return str(value)
 
+    def _extract_content(self, arguments: dict[str, Any]) -> Optional[str]:
+        """Pull the to-be-written content from a write tool's arguments.
+
+        Covers the common shapes across coding CLIs (content/new_str/new_string/text)."""
+        for key in ("content", "new_str", "new_string", "text", "file_text", "contents"):
+            value = arguments.get(key)
+            if isinstance(value, str) and value:
+                return value
+        return None
+
     def _extract_path(self, arguments: dict[str, Any]) -> Optional[str]:
         value = (
             arguments.get("path")
@@ -141,18 +239,8 @@ class HookPolicy:
         return str(value) if value else None
 
     def _normalize_path(self, raw_path: str) -> str:
-        path = raw_path.strip().strip('"').replace("\\", "/")
-        if self.project_root:
-            try:
-                candidate = Path(path)
-                resolved = candidate.resolve() if candidate.is_absolute() else (self.project_root / path).resolve()
-                return resolved.relative_to(self.project_root).as_posix()
-            except (OSError, ValueError):
-                pass
-        if re.match(r"^[A-Za-z]:/", path):
-            parts = PurePosixPath(path).parts
-            path = "/".join(parts[1:])
-        return path[2:] if path.startswith("./") else path
+        # Shared normalizer — single source of truth with TaskPolicyEngine.
+        return normalize_repo_path(self.project_root, raw_path)[0]
 
     def _is_planned_file(self, path: str, task: Task) -> bool:
         for planned in task.planned_files:

package/src/devcouncil/execution/patch.py

@@ -1,28 +1,77 @@
+import re
 import subprocess
 from pathlib import Path
 from devcouncil.app.errors import ExecutionError
 
+
 class PatchEngine:
     """Handles applying unified diff patches to the codebase."""
-    
+
+    # Progressively more tolerant `git apply` invocations. The first that succeeds
+    # wins; we only escalate tolerance (whitespace, 3-way merge) rather than ever
+    # falling back to `--reject` (which would leave a half-applied tree + .rej files).
+    _APPLY_LADDER: tuple[tuple[str, ...], ...] = (
+        (),                                   # strict: exact context match
+        ("--ignore-whitespace",),             # tolerate whitespace-only context drift
+        ("--3way",),                          # reconstruct via blob ancestry when context moved
+        ("--3way", "--ignore-whitespace"),    # both
+    )
+
     def __init__(self, project_root: Path):
         self.project_root = project_root
 
+    def _validate_paths(self, patch_content: str) -> None:
+        """Defense-in-depth: reject a diff that touches anything outside the repo root.
+
+        Callers that go through ``TaskRunner.apply_patch`` already gate against the
+        task's planned files, but the engine is directly callable, so it validates the
+        coarse containment boundary (within ``project_root``) itself."""
+        root = self.project_root.resolve()
+        for match in re.finditer(r"^(?:\+\+\+|---)\s+(?:[ab]/)?(\S+)", patch_content, re.MULTILINE):
+            raw = match.group(1)
+            if raw == "/dev/null":  # new/deleted file sentinel
+                continue
+            try:
+                resolved = (root / raw).resolve()
+            except (OSError, ValueError) as exc:
+                raise ExecutionError(f"Patch references an invalid path: {raw!r} ({exc})")
+            if resolved != root and root not in resolved.parents:
+                raise ExecutionError(
+                    f"Patch attempts to modify a path outside the project root: {raw!r}."
+                )
+
     def apply_patch(self, patch_content: str) -> bool:
-        """Applies a git-style patch to the repository."""
+        """Applies a git-style patch to the repository.
+
+        Tries an escalating ladder of ``git apply`` tolerances so a patch whose context
+        drifted slightly (common when an agent edits the file after producing the diff)
+        still applies cleanly instead of hard-failing on the strict first pass. If every
+        rung fails, the error names the failing hunks from git's own report rather than a
+        bare exit code."""
+        self._validate_paths(patch_content)
+
         patch_file = self.project_root / ".devcouncil" / "temp.patch"
         patch_file.parent.mkdir(parents=True, exist_ok=True)
         patch_file.write_text(patch_content, encoding="utf-8")
-        
+
+        last_stderr = ""
         try:
-            # Using git apply for robust patch application
-            subprocess.check_call(
-                ["git", "apply", "--ignore-whitespace", str(patch_file)],
-                cwd=self.project_root
+            for extra_args in self._APPLY_LADDER:
+                proc = subprocess.run(
+                    ["git", "apply", *extra_args, str(patch_file)],
+                    cwd=self.project_root,
+                    capture_output=True,
+                    text=True,
+                    encoding="utf-8",
+                    errors="replace",
+                )
+                if proc.returncode == 0:
+                    return True
+                last_stderr = (proc.stderr or "").strip()
+            raise ExecutionError(
+                "Failed to apply patch even with whitespace/3-way fallbacks. "
+                f"git reported: {last_stderr or '(no detail)'}"
             )
-            return True
-        except subprocess.CalledProcessError as e:
-            raise ExecutionError(f"Failed to apply patch: {e}")
         finally:
             if patch_file.exists():
                 patch_file.unlink()

package/src/devcouncil/execution/permissions.py

@@ -4,6 +4,7 @@ from typing import List, Literal, Optional
 from pydantic import BaseModel, Field
 from devcouncil.domain.task import PlannedFile, Task
 from devcouncil.app.errors import GatingError
+from devcouncil.execution.policy_engine import TaskPolicyEngine
 
 class PermissionPolicy(BaseModel):
     """Defines the security boundaries for task execution."""
@@ -17,6 +18,10 @@ class PermissionManager:
         self.policy = policy
         self.project_root = project_root
         self.dynamic_ignores = self._load_devcouncilignore()
+        self.policy_engine = TaskPolicyEngine(
+            project_root,
+            global_allowed_commands=policy.allowed_shell_commands,
+        )
 
     def _load_devcouncilignore(self) -> List[str]:
         """Load additional restricted paths from .devcouncilignore."""
@@ -34,24 +39,17 @@ class PermissionManager:
         path: str,
         task: Task,
         operation: Literal["create", "modify", "delete", "write"] = "write",
+        *,
+        internal: bool = False,
     ) -> bool:
         """Check if a file change is authorized by the task or policy."""
-        # 1. Check restricted paths (e.g. .git) and dynamic ignores
-        all_restricted = self.policy.restricted_paths + self.dynamic_ignores
-        for restricted in all_restricted:
+        for restricted in self.dynamic_ignores:
             if fnmatch.fnmatch(path, restricted) or path.startswith(restricted.strip("*")):
                 return False
-
-        # 2. Check if path is in task's planned files with a compatible operation.
-        planned = self._planned_file_for(path, task)
-        if not planned:
-            return False
-
-        if planned.allowed_change == "read_only":
-            return False
-        if operation == "write":
-            return planned.allowed_change in {"create", "modify"}
-        return planned.allowed_change == operation
+        decision = self.policy_engine.evaluate_file_change(
+            path, task, operation, internal=internal
+        )
+        return decision.action in {"allow", "warn"}
 
     def _planned_file_for(self, path: str, task: Task) -> Optional[PlannedFile]:
         normalized = path.replace("\\", "/")
@@ -63,15 +61,8 @@ class PermissionManager:
 
     def is_command_allowed(self, command: str, task: Task) -> bool:
         """Check if a shell command is authorized by the task or global allowlist."""
-        # 1. Check task-specific allowlist
-        if any(fnmatch.fnmatch(command, allowed) for allowed in task.allowed_commands):
-            return True
-            
-        # 2. Check global policy allowlist
-        if any(fnmatch.fnmatch(command, allowed) for allowed in self.policy.allowed_shell_commands):
-            return True
-            
-        return False
+        decision = self.policy_engine.evaluate_command(command, task)
+        return decision.action == "allow"
 
     def validate_action(
         self,
@@ -79,10 +70,12 @@ class PermissionManager:
         target: str,
         task: Task,
         operation: Literal["create", "modify", "delete", "write"] = "write",
+        *,
+        internal: bool = False,
     ):
         """Raise GatingError if an execution action violates permissions."""
         if action_type == "file_write":
-            if not self.is_file_change_allowed(target, task, operation):
+            if not self.is_file_change_allowed(target, task, operation, internal=internal):
                 raise GatingError(
                     f"Unauthorized file {operation}: {target}. "
                     "File and operation must match task planned_files."