jaitus 0.3.3 → 0.3.5

package/src/agent/permissions.js

@@ -32,7 +32,7 @@ const TOOL_ICONS = {
 
 export function createPermissions({
   autoApprove = false, mode = 'default', onModeChange = null,
-  allow = [], deny = [], onRulesChange = null,
+  allow = [], deny = [], onRulesChange = null, interactive = true,
 } = {}) {
   let current = autoApprove ? 'bypassPermissions' : (MODES.includes(mode) ? mode : mode === 'auto' ? 'bypassPermissions' : 'default');
   // Session rules live beside the saved ones and are never written to disk: "allow for
@@ -62,8 +62,23 @@ export function createPermissions({
     },
 
     /** What the rules say about this call, without asking. */
-    verdict(toolName, input) {
-      return decide({ allow: [...savedAllow, ...sessionAllow], deny: savedDeny }, toolName, input);
+    verdict(toolName, input, cwd = null) {
+      return decide({ allow: [...savedAllow, ...sessionAllow], deny: savedDeny }, toolName, input, { cwd });
+    },
+
+    /**
+     * The same rules, a different mode — for subagents and side commands (/review --fix,
+     * /btw, /test --fix). Those used to build fresh permissions with no user rules at
+     * all, so `deny run_command(git push:*)` did not apply inside them.
+     */
+    fork({ mode: nextMode = current, interactive: canAsk = interactive, allow: extraAllow = [] } = {}) {
+      return createPermissions({
+        mode: nextMode,
+        interactive: canAsk,
+        // Extra rules for this run only — /research allows web_fetch for itself.
+        allow: [...savedAllow, ...sessionAllow, ...extraAllow],
+        deny: savedDeny.filter((r) => !DEFAULT_DENY.includes(r)),
+      });
     },
 
     setMode(next) {
@@ -82,11 +97,11 @@ export function createPermissions({
     /**
      * @returns true to proceed. Throws PermissionDenied if the user says no.
      */
-    async request(tool, input, { cwd, tui = null } = {}) {
+    async request(tool, input, { cwd, tui = null, signal = null } = {}) {
       // A deny rule outranks everything, including bypass. Someone who wrote
       // `deny: ["run_command(git push:*)"]` and then turned on bypass to get through a
       // long refactor did not mean "except that one".
-      const verdict = api.verdict(tool.name, input);
+      const verdict = api.verdict(tool.name, input, cwd);
       if (verdict === 'deny') {
         throw new PermissionDenied(
           `A deny rule blocks ${tool.name}${subjectOf(tool.name, input) ? `: ${subjectOf(tool.name, input).slice(0, 80)}` : ''}. `
@@ -100,12 +115,17 @@ export function createPermissions({
 
       // Not a terminal — a script cannot answer, and silently proceeding would be the
       // worst possible reading of "no answer". In plan mode the same wall is the point.
-      if (!process.stdin.isTTY) {
-        throw new PermissionDenied(
+      // One-shot runs (-p, a task on the command line) are this case too even in a
+      // terminal: a prompt there wrote to stdout — into --output-format json — and waited
+      // for a key nobody saw.
+      if (!process.stdin.isTTY || !interactive) {
+        const err = new PermissionDenied(
           current === 'plan'
             ? 'Plan mode blocks every write and command. Shift+Tab out of plan mode, or run it with a mode that acts.'
-            : `${tool.name} needs permission, but there is no terminal to ask. Re-run with --yes to allow it.`
+            : `${tool.name} needs permission, and this run cannot ask. Re-run with --yes, or --permission-mode acceptEdits for file edits only.`
         );
+        err.headless = true;
+        throw err;
       }
 
       // Inside the TUI the ask is an inline panel pinned above the prompt
@@ -133,6 +153,7 @@ export function createPermissions({
           pills: true,
           title: 'Permission',
           tone: tool.name === 'run_command' ? 'danger' : undefined,
+          signal,
         });
         const value = answer && typeof answer === 'object' ? answer.value : answer;
         const comment = (answer?.comment || '').trim();
@@ -151,14 +172,16 @@ export function createPermissions({
 
       out(`  ${c.dim(`always → adds the rule ${c.bold(exact)}`)}`);
       const answer = await askKey(
-        `  ${c.dim('[y] Allow once   [s] this session   [a] always   [n] Reject  ›')} `,
+        `  ${c.dim('[y] Allow once   [s] this session   [a] always   [n] Reject (Enter)  ›')} `,
         ['y', 's', 'a', 'n', '\r']
       );
       out('');
 
       if (answer === 's') { api.addRule(exact); return true; }
       if (answer === 'a') { api.addRule(exact, { persist: true }); return true; }
-      if (answer === 'y' || answer === '\r') return true;
+      // Enter is the safe answer. It used to be "Allow once" — one stray key approved a
+      // command nobody had read.
+      if (answer === 'y') return true;
       throw new PermissionDenied(`You declined: ${tool.name}`);
     },
   };
@@ -176,13 +199,23 @@ function describeRule(rule) {
 /** The whole tool call as plain lines, for the TUI permission dialog. */
 function previewTextOf(tool, input) {
   const lines = [];
-  if (tool.name === 'run_command') lines.push(`$ ${input.command}`);
-  else if (tool.name === 'write_file') lines.push(...String(input.content ?? '').split('\n').slice(0, 12));
-  else if (tool.name === 'edit_file') {
-    for (const l of String(input.old ?? '').split('\n').slice(0, 6)) lines.push(`- ${l}`);
-    for (const l of String(input.new ?? '').split('\n').slice(0, 6)) lines.push(`+ ${l}`);
-  } else lines.push(JSON.stringify(input).slice(0, 200));
-  return lines.slice(0, 12);
+  const more = (all, shown) => (all > shown ? [`… ${all - shown} more line${all - shown === 1 ? '' : 's'}`] : []);
+  // A command is shown WHOLE — every line of it (the dialog wraps and, if it must, shows
+  // the start and the end). Content previews are samples, and say how much is left out.
+  if (tool.name === 'run_command' || tool.name === 'background_run') lines.push(...`$ ${input.command}`.split('\n'));
+  else if (tool.name === 'write_file') {
+    const all = String(input.content ?? '').split('\n');
+    lines.push(...all.slice(0, 12), ...more(all.length, 12));
+  } else if (tool.name === 'edit_file') {
+    const olds = String(input.old ?? '').split('\n');
+    const news = String(input.new ?? '').split('\n');
+    for (const l of olds.slice(0, 6)) lines.push(`- ${l}`);
+    lines.push(...more(olds.length, 6).map((l) => `- ${l}`));
+    for (const l of news.slice(0, 6)) lines.push(`+ ${l}`);
+    lines.push(...more(news.length, 6).map((l) => `+ ${l}`));
+  } else if (tool.name === 'web_fetch') lines.push(String(input.url ?? ''));
+  else lines.push(JSON.stringify(input).slice(0, 400));
+  return lines;
 }
 
 function describe(tool, input, cwd) {

package/src/agent/rules.js

@@ -58,22 +58,52 @@ export function parseRule(text) {
  * it, approving `npm test` would not cover `npm test -- --watch`, and people would
  * write `npm*` instead — which also matches `npm publish`.
  */
-export function matches(pattern, subject) {
+export function matches(pattern, subject, { command = false } = {}) {
   if (pattern === null || pattern === '') return true;
-  const value = String(subject ?? '');
+  // Runs of spaces are one space: `git  push` is `git push`.
+  const value = command ? squash(subject) : String(subject ?? '');
 
   if (pattern.endsWith(':*')) {
-    const prefix = pattern.slice(0, -2).trim();
+    const prefix = (command ? squash(pattern.slice(0, -2)) : pattern.slice(0, -2).trim());
     if (!value.startsWith(prefix)) return false;
     // A prefix must end at a word boundary: `git pu:*` must not match `git push`
     // by accident of spelling, but `git push:*` must match `git push --force`.
     const rest = value.slice(prefix.length);
-    return rest === '' || /^[\s\-]/.test(rest);
+    if (!(rest === '' || /^[\s\-]/.test(rest))) return false;
+    // "This command and its arguments" — never "this command, then anything". The rest
+    // of the line may not chain, pipe or redirect: `npm test:*` used to approve
+    // `npm test && del /s /q C:\` because only the first character after the prefix
+    // was looked at.
+    // Checked on the RAW line: squashing whitespace above turns a newline — which runs a
+    // second command — into a harmless-looking space.
+    if (command && SHELL_META.test(String(subject ?? '')) && !SHELL_META.test(prefix)) return false;
+    return true;
   }
 
   return globToRegExp(pattern).test(value);
 }
 
+/**
+ * Characters that make one shell line run more than the command it starts with — in
+ * cmd, PowerShell and POSIX shells: chaining, pipes, redirects, substitution, grouping,
+ * and a line break.
+ */
+export const SHELL_META = /[;&|<>`$(){}\r\n]/;
+
+const squash = (value) => String(value ?? '').replace(/\s+/g, ' ').trim();
+
+/**
+ * The separate commands in one shell line, for DENY checks. A deny rule is anchored to
+ * the start of a command, so `deny git push:*` used to miss `cd . && git push --force` —
+ * the push is simply the second command. Each piece is checked on its own.
+ */
+export function commandsIn(line) {
+  return String(line ?? '')
+    .split(/&&|\|\||[;&|\r\n]/)
+    .map((part) => squash(part).replace(/^[({\s]+|[)}\s]+$/g, ''))
+    .filter(Boolean);
+}
+
 const cache = new Map();
 function globToRegExp(pattern) {
   if (cache.has(pattern)) return cache.get(pattern);
@@ -99,19 +129,43 @@ function globToRegExp(pattern) {
  * Both lists are scanned in full even after a match, because a deny anywhere has to
  * beat an allow everywhere and short-circuiting on the first allow would lose that.
  */
-export function decide({ allow = [], deny = [] }, toolName, input) {
-  const subject = subjectOf(toolName, input);
+export function decide({ allow = [], deny = [] }, toolName, input, { cwd = null } = {}) {
+  const command = COMMAND_TOOLS.has(toolName);
+  let subject = subjectOf(toolName, input);
+  // A path rule is written relative to the project; the model often sends an absolute
+  // path. Compared raw, `deny edit_file(src/**)` did not stop `C:/p/src/a.js`.
+  if (cwd && PATH_TOOLS.has(toolName) && subject) {
+    const rel = normalise(path.relative(cwd, path.resolve(cwd, subject)));
+    if (rel && !rel.startsWith('..') && !path.isAbsolute(rel)) subject = rel;
+  }
+  // Deny: the whole line, and each command inside it.
+  const denySubjects = command ? [subject, ...commandsIn(subject)] : [subject];
   for (const rule of deny) {
     const parsed = typeof rule === 'string' ? parseRule(rule) : rule;
-    if (parsed && parsed.tool === toolName && matches(parsed.pattern, subject)) return 'deny';
+    if (parsed && parsed.tool === toolName && denySubjects.some((s) => matches(parsed.pattern, s, { command }))) return 'deny';
   }
   for (const rule of allow) {
     const parsed = typeof rule === 'string' ? parseRule(rule) : rule;
-    if (parsed && parsed.tool === toolName && matches(parsed.pattern, subject)) return 'allow';
+    if (parsed && parsed.tool === toolName && matches(parsed.pattern, subject, { command })) return 'allow';
   }
   return 'ask';
 }
 
+const COMMAND_TOOLS = new Set(['run_command', 'background_run']);
+const PATH_TOOLS = new Set(['write_file', 'edit_file', 'read_file', 'read_image', 'list_files']);
+
+// Programs whose "first argument" is arbitrary code or another program. Generalised,
+// `node -e x` becomes `node:*` and `cmd /c dir` becomes `cmd /c:*` — every command there
+// is. These are always pinned to the exact line approved.
+const RUNS_ANYTHING = new Set([
+  'cmd', 'cmd.exe', 'powershell', 'powershell.exe', 'pwsh', 'pwsh.exe', 'bash', 'sh', 'zsh', 'fish', 'dash',
+  'node', 'node.exe', 'python', 'python3', 'py', 'ruby', 'perl', 'php', 'deno', 'bun', 'npx', 'bunx', 'pnpx',
+  'sudo', 'doas', 'env', 'xargs', 'eval', 'exec', 'start', 'call', 'wsl', 'wsl.exe', 'ssh', 'nohup', 'time', 'watch',
+]);
+// `npm run <script>` names the script as its third word; `npm run:*` would approve every
+// script in package.json.
+const RUNNER_VERBS = new Set(['run', 'run-script', 'exec', 'x', 'dlx']);
+
 /**
  * The rule "Allow always" should create for this exact call.
  *
@@ -125,12 +179,20 @@ export function ruleForCall(toolName, input, cwd) {
   if (!subject) return `${toolName}`;
 
   if (toolName === 'run_command' || toolName === 'background_run') {
-    const words = subject.trim().split(/\s+/);
-    // A command with a shell operator in it cannot be generalised safely: `npm test &&
-    // rm -rf .` would become a rule that approves the rm. Pin those exactly.
-    if (/[;&|>`$(){}]/.test(subject)) return `${toolName}(${subject})`;
-    const head = words.slice(0, words[1] && !words[1].startsWith('-') ? 2 : 1).join(' ');
-    return `${toolName}(${head}:*)`;
+    const line = squash(subject);
+    const words = line.split(' ');
+    const exe = path.basename(words[0].replace(/^["']|["']$/g, '')).toLowerCase();
+    // Pinned exactly, never generalised:
+    //  - a shell operator: `npm test && rm -rf .` must not become `npm test:*`;
+    //  - an interpreter or launcher: its argument is the whole program;
+    //  - a flag before the subcommand: `git -C sub status` generalised to `git:*`,
+    //    which includes `git push`.
+    if (SHELL_META.test(line) || RUNS_ANYTHING.has(exe) || (words[1] && words[1].startsWith('-'))) {
+      return `${toolName}(${line})`;
+    }
+    let take = words[1] ? 2 : 1;
+    if (RUNNER_VERBS.has(String(words[1]).toLowerCase()) && words[2] && !words[2].startsWith('-')) take = 3;
+    return `${toolName}(${words.slice(0, take).join(' ')}:*)`;
   }
 
   if (toolName === 'web_fetch') {
@@ -175,6 +237,15 @@ export const DEFAULT_DENY = [
   'run_command(**:(){ :|:& };:**)',
   'run_command(**of=/dev/sd**)',
   'run_command(**> /dev/sd**)',
+  // The Windows spellings of the same accidents — the list had none.
+  'run_command(**rd /s /q C:\\)',
+  'run_command(**rd /s /q C:\\ **)',
+  'run_command(**rmdir /s /q C:\\)',
+  'run_command(**del /s /q C:\\)',
+  'run_command(**del /s /q C:\\*)',
+  'run_command(**format C:**)',
+  'run_command(**Remove-Item -Recurse -Force C:\\)',
+  'run_command(**Remove-Item C:\\ -Recurse**)',
 ];
 
 /** Validate a list of rule strings, returning { rules, bad }. */