jaitus 0.3.0

package/src/agent/permissions.js

@@ -0,0 +1,218 @@
+// ─── Asking before acting ───────────────────────────────────────────────────────
+//
+// The agent can change files and run commands. Whether that is fine or catastrophic
+// depends entirely on what it decided to do, and it decided in a language model.
+//
+// Four permission modes, cycled from the prompt with Shift+Tab:
+//
+//   default      ask about every write and every command (the start)
+//   acceptEdits  write_file and edit_file run without asking; commands still ask
+//   plan         nothing runs at all — the agent reads, thinks, and proposes a plan
+//   auto         nothing asks; for CI and people who enjoy living dangerously
+//
+// "Allow for this session" still exists inside default, because being asked forty
+// times in a row trains people to hit `a` without reading, which is worse than not
+// asking at all.
+
+import path from 'node:path';
+import { c, out, askKey, glyph } from '../ui.js';
+import { decide, ruleForCall, broaderRule, DEFAULT_DENY, subjectOf } from './rules.js';
+
+export class PermissionDenied extends Error {}
+
+export const MODES = ['default', 'acceptEdits', 'plan', 'bypassPermissions'];
+
+/** opencode permission icons per tool: shell #, edits ←, reads →, search ✱. */
+const TOOL_ICONS = {
+  run_command: '#', write_file: '←', edit_file: '←',
+  read_file: '→', read_image: '→', list_files: '→',
+  search: '✱', web_fetch: '%', web_search: '◈',
+  background_run: '◉', todo_write: '⚙',
+};
+
+export function createPermissions({
+  autoApprove = false, mode = 'default', onModeChange = null,
+  allow = [], deny = [], onRulesChange = null,
+} = {}) {
+  let current = autoApprove ? 'bypassPermissions' : (MODES.includes(mode) ? mode : mode === 'auto' ? 'bypassPermissions' : 'default');
+  // Session rules live beside the saved ones and are never written to disk: "allow for
+  // this session" has to mean this session, or the word is a lie.
+  const savedAllow = [...allow];
+  const savedDeny = [...DEFAULT_DENY, ...deny];
+  const sessionAllow = [];
+
+  const api = {
+    get mode() { return current; },
+    get rules() { return { allow: [...savedAllow], deny: [...savedDeny], session: [...sessionAllow] }; },
+
+    /** Add a rule. `persist` writes it to settings via onRulesChange. */
+    addRule(rule, { persist = false, kind = 'allow' } = {}) {
+      const list = kind === 'deny' ? savedDeny : (persist ? savedAllow : sessionAllow);
+      if (!list.includes(rule)) list.push(rule);
+      if (persist) onRulesChange?.({ allow: savedAllow, deny: savedDeny.filter((r) => !DEFAULT_DENY.includes(r)) });
+      return rule;
+    },
+
+    removeRule(rule) {
+      for (const list of [savedAllow, savedDeny, sessionAllow]) {
+        const at = list.indexOf(rule);
+        if (at >= 0) list.splice(at, 1);
+      }
+      onRulesChange?.({ allow: savedAllow, deny: savedDeny.filter((r) => !DEFAULT_DENY.includes(r)) });
+    },
+
+    /** What the rules say about this call, without asking. */
+    verdict(toolName, input) {
+      return decide({ allow: [...savedAllow, ...sessionAllow], deny: savedDeny }, toolName, input);
+    },
+
+    setMode(next) {
+      if (!MODES.includes(next)) return;
+      current = next;
+      onModeChange?.(current);
+    },
+
+    /** Shift+Tab: default → acceptEdits → plan → auto → default. */
+    cycleMode() {
+      const next = MODES[(MODES.indexOf(current) + 1) % MODES.length];
+      api.setMode(next);
+      return current;
+    },
+
+    /**
+     * @returns true to proceed. Throws PermissionDenied if the user says no.
+     */
+    async request(tool, input, { cwd, tui = null } = {}) {
+      // A deny rule outranks everything, including bypass. Someone who wrote
+      // `deny: ["run_command(git push:*)"]` and then turned on bypass to get through a
+      // long refactor did not mean "except that one".
+      const verdict = api.verdict(tool.name, input);
+      if (verdict === 'deny') {
+        throw new PermissionDenied(
+          `A deny rule blocks ${tool.name}${subjectOf(tool.name, input) ? `: ${subjectOf(tool.name, input).slice(0, 80)}` : ''}. `
+          + 'Change it with /permissions if that is wrong.'
+        );
+      }
+      if (!tool.needsPermission) return true;
+      if (verdict === 'allow') return true;
+      if (current === 'bypassPermissions') return true;
+      if (current === 'acceptEdits' && (tool.name === 'write_file' || tool.name === 'edit_file')) return true;
+
+      // Not a terminal — a script cannot answer, and silently proceeding would be the
+      // worst possible reading of "no answer". In plan mode the same wall is the point.
+      if (!process.stdin.isTTY) {
+        throw new PermissionDenied(
+          current === 'plan'
+            ? 'Plan mode blocks every write and command. Shift+Tab out of plan mode, or run it with a mode that acts.'
+            : `${tool.name} needs permission, but there is no terminal to ask. Re-run with --yes to allow it.`
+        );
+      }
+
+      // Inside the TUI the ask is an inline panel pinned above the prompt
+      // (opencode shape), with the preview inside it; outside it stays
+      // inline below the last output.
+      // The scope of "always" is spelled out in the option itself. Previously it read
+      // "Allow always" and meant the whole tool, so approving `npm test` also approved
+      // every future shell command — including the one you would never have allowed.
+      const exact = ruleForCall(tool.name, input, cwd);
+      const broad = broaderRule(tool.name, input, cwd);
+
+      if (tui) {
+        tui.bellIfAway?.();
+        const previewText = previewTextOf(tool, input);
+        const options = [
+          { label: 'Allow once', value: 'y' },
+          { label: `Allow ${describeRule(exact)} for this session`, value: 'session' },
+          { label: `Always allow ${describeRule(exact)}`, value: 'always' },
+        ];
+        if (broad !== exact) options.push({ label: `Always allow ${describeRule(broad)}`, value: 'broad' });
+        options.push({ label: 'Reject', value: 'deny' });
+
+        const answer = await tui.askDialog(describe(tool, input, cwd), options, previewText, {
+          icon: TOOL_ICONS[tool.name] || '⚙',
+          pills: true,
+          title: 'Permission',
+          tone: tool.name === 'run_command' ? 'danger' : undefined,
+        });
+        const value = answer && typeof answer === 'object' ? answer.value : answer;
+        const comment = (answer?.comment || '').trim();
+        if (value === 'session') { api.addRule(exact); return true; }
+        if (value === 'always') { api.addRule(exact, { persist: true }); return true; }
+        if (value === 'broad') { api.addRule(broad, { persist: true }); return true; }
+        if (value === 'y') return true;
+        const err = new PermissionDenied(`You declined: ${tool.name}`);
+        if (comment) err.comment = comment;
+        throw err;
+      }
+
+      out(`  ${c.permission(glyph('△', '!'))} ${c.bold(describe(tool, input, cwd))}`);
+      preview(tool, input);
+      out('');
+
+      out(`  ${c.dim(`always → adds the rule ${c.bold(exact)}`)}`);
+      const answer = await askKey(
+        `  ${c.dim('[y] Allow once   [s] this session   [a] always   [n] Reject  ›')} `,
+        ['y', 's', 'a', 'n', '\r']
+      );
+      out('');
+
+      if (answer === 's') { api.addRule(exact); return true; }
+      if (answer === 'a') { api.addRule(exact, { persist: true }); return true; }
+      if (answer === 'y' || answer === '\r') return true;
+      throw new PermissionDenied(`You declined: ${tool.name}`);
+    },
+  };
+
+  return api;
+}
+
+/** `run_command(npm test:*)` → `npm test *`, which is what the rule means out loud. */
+function describeRule(rule) {
+  const m = /^([a-z_]+)\((.*)\)$/i.exec(rule);
+  if (!m) return `every ${String(rule).replace(/_/g, ' ')}`;
+  return m[2].endsWith(':*') ? `${m[2].slice(0, -2)} …` : m[2];
+}
+
+/** The whole tool call as plain lines, for the TUI permission dialog. */
+function previewTextOf(tool, input) {
+  const lines = [];
+  if (tool.name === 'run_command') lines.push(`$ ${input.command}`);
+  else if (tool.name === 'write_file') lines.push(...String(input.content ?? '').split('\n').slice(0, 12));
+  else if (tool.name === 'edit_file') {
+    for (const l of String(input.old ?? '').split('\n').slice(0, 6)) lines.push(`- ${l}`);
+    for (const l of String(input.new ?? '').split('\n').slice(0, 6)) lines.push(`+ ${l}`);
+  } else lines.push(JSON.stringify(input).slice(0, 200));
+  return lines.slice(0, 12);
+}
+
+function describe(tool, input, cwd) {
+  switch (tool.name) {
+    case 'write_file': return `Write ${path.relative(cwd, path.resolve(cwd, input.path)) || input.path}`;
+    case 'edit_file': return `Edit ${path.relative(cwd, path.resolve(cwd, input.path)) || input.path}`;
+    case 'run_command': return `Run a command`;
+    default: return `${tool.name}`;
+  }
+}
+
+/** Show enough that the answer is informed, but not so much it scrolls away. */
+function preview(tool, input) {
+  const show = (label, text, limit = 14) => {
+    const lines = String(text ?? '').split('\n');
+    out(`    ${c.dim(label)}`);
+    lines.slice(0, limit).forEach((l) => out(`    ${c.grey(glyph('│', '|'))} ${l.slice(0, 160)}`));
+    if (lines.length > limit) out(`    ${c.grey(glyph('│', '|'))} ${c.dim(`${glyph('…', '...')} ${lines.length - limit} more lines`)}`);
+  };
+
+  if (tool.name === 'run_command') {
+    out(`    ${c.grey('$')} ${c.bold(input.command)}`);
+    return;
+  }
+  if (tool.name === 'write_file') {
+    show('new contents', input.content);
+    return;
+  }
+  if (tool.name === 'edit_file') {
+    String(input.old ?? '').split('\n').slice(0, 10).forEach((l) => out(`    ${c.red('-')} ${l.slice(0, 160)}`));
+    String(input.new ?? '').split('\n').slice(0, 10).forEach((l) => out(`    ${c.green('+')} ${l.slice(0, 160)}`));
+  }
+}

package/src/agent/rules.js

@@ -0,0 +1,190 @@
+// ─── Permission rules ───────────────────────────────────────────────────────────
+//
+// "Allow always" used to add the TOOL to a set. Answering it once for `npm test`
+// therefore also approved `rm -rf /`, `curl | sh`, and every other command for the
+// rest of the session — from a prompt whose preview showed only the harmless one. It
+// is the most dangerous kind of bug: the safe answer and the catastrophic answer are
+// the same keystroke, and nothing on screen distinguishes them.
+//
+// A rule names the tool AND what it may be used on:
+//
+//   run_command(npm test:*)     that command and its arguments
+//   run_command(git status)     exactly that, nothing else
+//   edit_file(src/**)           any path under src
+//   web_fetch(https://docs.*)   any URL matching the glob
+//   read_file                   the whole tool, for the genuinely harmless ones
+//
+// Deny wins over allow, always, at any specificity. A deny rule is the only mechanism
+// here that someone would rely on to stop something dangerous, and a precedence order
+// that lets a broad allow override a narrow deny would make it worthless.
+
+import path from 'node:path';
+
+/** The argument a rule matches against, per tool. */
+export function subjectOf(toolName, input = {}) {
+  switch (toolName) {
+    case 'run_command':
+    case 'background_run':
+      return String(input.command ?? '');
+    case 'write_file':
+    case 'edit_file':
+    case 'read_file':
+    case 'read_image':
+    case 'list_files':
+      return normalise(input.path);
+    case 'web_fetch':
+      return String(input.url ?? '');
+    case 'web_search':
+      return String(input.query ?? '');
+    default:
+      return '';
+  }
+}
+
+const normalise = (value) => String(value ?? '').replace(/\\/g, '/').replace(/^\.\//, '');
+
+/** `tool(pattern)` or `tool`. Returns null for anything unparseable. */
+export function parseRule(text) {
+  const raw = String(text ?? '').trim();
+  if (!raw) return null;
+  const m = /^([a-z_][\w]*)\s*(?:\(([\s\S]*)\))?$/i.exec(raw);
+  if (!m) return null;
+  return { tool: m[1], pattern: m[2] === undefined ? null : m[2].trim(), source: raw };
+}
+
+/**
+ * Glob match, with one extension that matters more than the rest of the syntax
+ * combined: a trailing `:*` means "this command and any arguments after it". Without
+ * it, approving `npm test` would not cover `npm test -- --watch`, and people would
+ * write `npm*` instead — which also matches `npm publish`.
+ */
+export function matches(pattern, subject) {
+  if (pattern === null || pattern === '') return true;
+  const value = String(subject ?? '');
+
+  if (pattern.endsWith(':*')) {
+    const prefix = pattern.slice(0, -2).trim();
+    if (!value.startsWith(prefix)) return false;
+    // A prefix must end at a word boundary: `git pu:*` must not match `git push`
+    // by accident of spelling, but `git push:*` must match `git push --force`.
+    const rest = value.slice(prefix.length);
+    return rest === '' || /^[\s\-]/.test(rest);
+  }
+
+  return globToRegExp(pattern).test(value);
+}
+
+const cache = new Map();
+function globToRegExp(pattern) {
+  if (cache.has(pattern)) return cache.get(pattern);
+  let out = '';
+  for (let i = 0; i < pattern.length; i++) {
+    const ch = pattern[i];
+    if (ch === '*') {
+      // `**` crosses directory separators; a single `*` does not, so `edit_file(src/*)`
+      // covers src/a.js and not src/deep/a.js — which is what someone writing it means.
+      if (pattern[i + 1] === '*') { out += '.*'; i += 1; if (pattern[i + 1] === '/') i += 1; }
+      else out += '[^/]*';
+    } else if (ch === '?') out += '[^/]';
+    else out += ch.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+  }
+  const re = new RegExp(`^${out}$`, 'i');
+  cache.set(pattern, re);
+  return re;
+}
+
+/**
+ * Decide from a rule set. Returns 'deny', 'allow' or 'ask'.
+ *
+ * Both lists are scanned in full even after a match, because a deny anywhere has to
+ * beat an allow everywhere and short-circuiting on the first allow would lose that.
+ */
+export function decide({ allow = [], deny = [] }, toolName, input) {
+  const subject = subjectOf(toolName, input);
+  for (const rule of deny) {
+    const parsed = typeof rule === 'string' ? parseRule(rule) : rule;
+    if (parsed && parsed.tool === toolName && matches(parsed.pattern, subject)) return 'deny';
+  }
+  for (const rule of allow) {
+    const parsed = typeof rule === 'string' ? parseRule(rule) : rule;
+    if (parsed && parsed.tool === toolName && matches(parsed.pattern, subject)) return 'allow';
+  }
+  return 'ask';
+}
+
+/**
+ * The rule "Allow always" should create for this exact call.
+ *
+ * Narrow on purpose. For a shell command it is the executable and its first
+ * subcommand — `npm test:*`, `git status:*` — because that is the unit a person
+ * actually means when they say "yes, this is fine". For a path it is the file, not its
+ * directory: approving one edit is not approving the tree.
+ */
+export function ruleForCall(toolName, input, cwd) {
+  const subject = subjectOf(toolName, input);
+  if (!subject) return `${toolName}`;
+
+  if (toolName === 'run_command' || toolName === 'background_run') {
+    const words = subject.trim().split(/\s+/);
+    // A command with a shell operator in it cannot be generalised safely: `npm test &&
+    // rm -rf .` would become a rule that approves the rm. Pin those exactly.
+    if (/[;&|>`$(){}]/.test(subject)) return `${toolName}(${subject})`;
+    const head = words.slice(0, words[1] && !words[1].startsWith('-') ? 2 : 1).join(' ');
+    return `${toolName}(${head}:*)`;
+  }
+
+  if (toolName === 'web_fetch') {
+    try {
+      const url = new URL(subject);
+      return `${toolName}(${url.protocol}//${url.host}/**)`;
+    } catch { return `${toolName}(${subject})`; }
+  }
+
+  const relative = cwd ? normalise(path.relative(cwd, path.resolve(cwd, subject))) : subject;
+  return `${toolName}(${relative && !relative.startsWith('..') ? relative : subject})`;
+}
+
+/** A broader rule, offered beside the exact one: the whole directory, or the tool. */
+export function broaderRule(toolName, input, cwd) {
+  const subject = subjectOf(toolName, input);
+  if (['write_file', 'edit_file', 'read_file', 'read_image', 'list_files'].includes(toolName) && subject) {
+    const relative = cwd ? normalise(path.relative(cwd, path.resolve(cwd, subject))) : subject;
+    const dir = relative.includes('/') ? relative.slice(0, relative.lastIndexOf('/')) : '';
+    return dir && !dir.startsWith('..') ? `${toolName}(${dir}/**)` : `${toolName}`;
+  }
+  return `${toolName}`;
+}
+
+/**
+ * Rules that ship on by default.
+ *
+ * Deny-only. Nothing is pre-approved, because a default allow-list is a promise about
+ * someone else's repository that this code is in no position to make — but these are
+ * destructive in a way no plausible task needs, and a model that has talked itself into
+ * one of them should be stopped rather than asked.
+ *
+ * This is a tripwire, not a sandbox. It catches the handful of literal spellings that
+ * have destroyed real machines; it does not and cannot catch an equivalent written any
+ * other way, and nothing here should be read as making `bypassPermissions` safe.
+ */
+export const DEFAULT_DENY = [
+  'run_command(**rm -rf /)',
+  'run_command(**rm -rf / **)',
+  'run_command(**rm -rf /*)',
+  'run_command(**mkfs**)',
+  'run_command(**:(){ :|:& };:**)',
+  'run_command(**of=/dev/sd**)',
+  'run_command(**> /dev/sd**)',
+];
+
+/** Validate a list of rule strings, returning { rules, bad }. */
+export function normaliseRules(list) {
+  const rules = [];
+  const bad = [];
+  for (const entry of Array.isArray(list) ? list : []) {
+    const parsed = parseRule(entry);
+    if (parsed) rules.push(parsed.source);
+    else bad.push(String(entry));
+  }
+  return { rules, bad };
+}