kira-glasses-bridge 2.0.0 → 2.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kira-glasses-bridge",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "Connects your Mac to Kira, the assistant for Even G2 glasses: Claude Code sessions, files, folders and apps, by voice.",
   "type": "module",
   "bin": {

package/src/agents/claude.mjs

@@ -4,14 +4,11 @@ import { query } from '@anthropic-ai/claude-agent-sdk'
 import { homedir } from 'node:os'
 import { relative, resolve, sep } from 'node:path'
 import { PERMISSION_OPTIONS, PLAN_OPTIONS, requestId } from './protocol.mjs'
+import { decide, ruleFor } from './policy.mjs'
 
 const TEXT_CAP = 4000
 const DIFF_CAP = 6000
 
-const READ_ONLY = new Set(['Read', 'Glob', 'Grep', 'LS', 'WebFetch', 'WebSearch', 'TodoWrite', 'TodoRead', 'NotebookRead', 'Task', 'Skill'])
-const EDITS = new Set(['Edit', 'Write', 'MultiEdit', 'NotebookEdit'])
-const SAFE_SHELL = /^(?:ls|pwd|cat|head|tail|wc|echo|which|type|env|printenv|date|whoami|tree|find|grep|rg|awk|sort|uniq|diff|stat|file|du|df|git (?:status|diff|log|show|branch|rev-parse|remote|ls-files|blame|describe|stash list)|node (?:-v|--version)|npm (?:-v|--version|ls|list|view|test|run (?:test|lint|typecheck|check|build))|pnpm (?:-v|--version|ls|list|test|typecheck|lint|build|run (?:test|lint|typecheck|check|build))|yarn (?:-v|--version|test|lint|typecheck|build)|cargo (?:check|test|build|fmt|clippy)|go (?:test|build|vet|version)|python3? -m pytest|pytest|make (?:test|check|lint|build))(?:\s|$)/
-
 const short = (s, n = 160) => (String(s ?? '').length > n ? `${String(s).slice(0, n)}…` : String(s ?? ''))
 
 function displayPath(p, cwd) {
@@ -133,40 +130,30 @@ function applyAnswer(name, input, request, answer, suggestions) {
  * @param io.ask(request)      resolves to { answer, by } when a person answers (the caller times it out)
  * @returns { ok, text, error, sessionId, stats }
  */
-/** "Always allow" answers, remembered for the rest of the process per session: `${sessionId}` -> Set of rule keys. */
-const sessionAllows = new Map()
-function ruleKey(toolName, input) {
-  if (toolName === 'Bash') return `Bash:${String(input.command ?? '').trim().split(/\s+/)[0]}`
-  return toolName
-}
-
-/**
- * The bridge's own policy, applied to every tool call regardless of what the
- * user's local Claude Code settings would do. Returns 'allow' or 'ask'.
- */
-function policy(toolName, input, cwd, session) {
-  if (READ_ONLY.has(toolName)) return 'allow'
-  if (EDITS.has(toolName) && inside(cwd, input.file_path ?? input.notebook_path)) return 'allow'
-  if (toolName === 'Bash' && SAFE_SHELL.test(String(input.command ?? '').trim())) return 'allow'
-  if (session && sessionAllows.get(session)?.has(ruleKey(toolName, input))) return 'allow'
-  return 'ask'
-}
+/** "Always allow" answers, kept for the rest of the process per session: sessionId -> Set of rules. */
+const sessionRules = new Map()
 
-export async function run({ prompt, sessionId, cwd }, io) {
+export async function run({ prompt, sessionId, cwd, policy }, io) {
   let session = sessionId ?? null
   let text = ''
   let error = null
+  const rulesFor = () => (session && sessionRules.get(session)) || new Set()
+  const judge = (toolName, input) => decide(policy, toolName, input ?? {}, cwd, rulesFor())
 
-  // Pre-tool hook: force the prompt for anything the policy does not allow, so
-  // a permissive local config (e.g. Bash(*) allowed) cannot bypass the person.
+  // Pre-tool hook: the policy is authoritative. It forces the prompt for what
+  // it does not allow (so a permissive local config cannot bypass the person)
+  // and refuses outright what it denies.
   const preToolUse = async input => {
     if (input.hook_event_name !== 'PreToolUse') return {}
-    const decision = policy(input.tool_name, input.tool_input ?? {}, cwd, session)
-    return { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: decision, permissionDecisionReason: decision === 'ask' ? 'Kira asks the user' : 'Kira policy' } }
+    const { decision, reason } = judge(input.tool_name, input.tool_input)
+    if (decision === 'deny') io.emit({ kind: 'request_resolved', id: `policy-${Date.now().toString(36)}`, answer: { optionIds: ['deny'] }, by: 'policy', tool: input.tool_name, reason })
+    return { hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: decision, permissionDecisionReason: `Kira: ${reason}` } }
   }
 
   const canUseTool = async (toolName, input, { signal, suggestions }) => {
-    if (policy(toolName, input, cwd, session) === 'allow') return { behavior: 'allow', updatedInput: input }
+    const { decision, reason } = judge(toolName, input)
+    if (decision === 'allow') return { behavior: 'allow', updatedInput: input }
+    if (decision === 'deny') return { behavior: 'deny', message: `Refused by the user's policy (${reason}). Do not achieve the same effect another way; say what you could not do.` }
     const request = toRequest(toolName, input, cwd, suggestions)
     io.emit({ kind: 'request', request })
     let resolved
@@ -175,10 +162,11 @@ export async function run({ prompt, sessionId, cwd }, io) {
     } catch (err) {
       resolved = { answer: { optionIds: [], text: err.message }, by: 'timeout' }
     }
-    io.emit({ kind: 'request_resolved', id: request.id, answer: resolved.answer, by: resolved.by })
+    const rule = ruleFor(toolName, input)
+    io.emit({ kind: 'request_resolved', id: request.id, answer: resolved.answer, by: resolved.by, rule })
     if ((resolved.answer.optionIds ?? []).includes('always') && session) {
-      if (!sessionAllows.has(session)) sessionAllows.set(session, new Set())
-      sessionAllows.get(session).add(ruleKey(toolName, input))
+      if (!sessionRules.has(session)) sessionRules.set(session, new Set())
+      sessionRules.get(session).add(rule)
     }
     return applyAnswer(toolName, input, request, resolved.answer, suggestions)
   }

package/src/agents/policy.mjs

@@ -0,0 +1,97 @@
+// The agent policy, enforced here on the Mac. The API sends the user's policy
+// with every job; this decides allow / ask / deny for each tool call.
+//
+//   { edits, editsOutside, shell, web, delegate, plan, allowRules, askRules, denyRules }
+//
+// Shell commands are split into their pieces (`;`, `&&`, `||`, `|`, newlines)
+// and every piece has to be safe for the whole command to be safe.
+import { relative, resolve, sep } from 'node:path'
+
+export const READ_ONLY = new Set(['Read', 'Glob', 'Grep', 'LS', 'TodoWrite', 'TodoRead', 'NotebookRead', 'Skill'])
+export const EDITS = new Set(['Edit', 'Write', 'MultiEdit', 'NotebookEdit'])
+export const WEB = new Set(['WebFetch', 'WebSearch'])
+
+/** Read-only commands: looking, listing, testing, type-checking, building. Nothing that writes, sends or installs. */
+const SAFE_CMD = /^(?:ls|ll|pwd|cat|head|tail|wc|echo|printf|which|type|env|printenv|date|whoami|id|uname|tree|find|fd|grep|rg|ag|awk|cut|tr|sort|uniq|diff|comm|stat|file|du|df|basename|dirname|realpath|readlink|jq|yq|xxd|hexdump|strings|test|\[|true|false|sleep|md5|shasum|sha256sum|md5sum|column|nl|less|more|open -n --args|sed -n|sed -E -n|sed -n -E|git (?:status|diff|log|show|branch|rev-parse|remote|ls-files|ls-tree|blame|describe|stash list|tag|config --get|config -l|cat-file|grep|shortlog|count-objects|reflog)|node (?:-v|--version|-e|-p|--eval|--print)|npm (?:-v|--version|ls|list|view|outdated|why|test|run (?:test|lint|typecheck|check|build|format:check))|pnpm (?:-v|--version|ls|list|why|outdated|test|typecheck|lint|build|run (?:test|lint|typecheck|check|build))|yarn (?:-v|--version|list|test|lint|typecheck|build)|npx (?:tsc|eslint|prettier --check|jest|vitest|playwright test)|tsc|eslint|prettier --check|jest|vitest|cargo (?:check|test|build|fmt --check|clippy|tree|metadata)|go (?:test|build|vet|version|list|env)|python3? (?:-V|--version|-m pytest|-c)|pytest|ruby -v|make (?:test|check|lint|build)|mvn (?:test|compile)|gradle (?:test|build)|swift (?:build|test)|xcodebuild -list|brew (?:list|info|--version)|docker (?:ps|images|version)|gh (?:pr (?:list|view|status|checks)|issue (?:list|view)|run (?:list|view)|repo view|api)|heroku (?:logs|ps|releases|config(?::get)?|apps|info))(?:\s|$)/
+
+/** Redirections that write somewhere other than nowhere. */
+const WRITES = /(^|[^&\d])>(?!&)|>>|\btee\b|\bxargs\b|\beval\b|\bexec\b|`/
+
+function pieces(command) {
+  // Strip quoted strings so separators inside them do not split; keep a placeholder.
+  const stripped = String(command).replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g, '""')
+  return stripped
+    .split(/\n|;|&&|\|\||\|/)
+    .map(p => p.trim())
+    // Shell keywords are structure, not commands: drop them, and a "for x in …" header entirely.
+    .map(p => p.replace(/^(?:if|then|else|elif|fi|do|done|while|until)\b\s*/, '').replace(/^for\s+\w+\s+in\b.*$/, '').trim())
+    .filter(Boolean)
+}
+
+function matchesRule(rules, toolName, command) {
+  const c = (command ?? '').trim()
+  for (const r of rules) {
+    const rule = String(r).trim()
+    if (!rule) continue
+    if (rule === toolName) return true
+    if (toolName === 'Bash' && c && (c === rule || c.startsWith(rule + ' ') || pieces(c).some(p => p === rule || p.startsWith(rule + ' ')))) return true
+  }
+  return false
+}
+
+export function insideFolder(cwd, p) {
+  const rel = relative(cwd, resolve(cwd, String(p ?? '')))
+  return !!rel && !rel.startsWith('..') && !rel.startsWith(sep)
+}
+
+/** Is this shell command read-only, judged piece by piece? Command substitutions are judged by what is inside them. */
+export function shellIsSafe(command, allowRules = []) {
+  let c = String(command ?? '').trim()
+  if (!c) return false
+  // $(inner): safe only if the inner command is; then drop it so the outer check sees plain text.
+  for (let guard = 0; guard < 20; guard++) {
+    const m = /\$\(([^()]*)\)/.exec(c)
+    if (!m) break
+    if (!shellIsSafe(m[1], allowRules)) return false
+    c = c.slice(0, m.index) + '""' + c.slice(m.index + m[0].length)
+  }
+  if (WRITES.test(c.replace(/2>&1|2>\/dev\/null|>\/dev\/null|&>\/dev\/null/g, ''))) return false
+  return pieces(c).every(p => SAFE_CMD.test(p) || allowRules.some(r => r && (p === r || p.startsWith(String(r) + ' '))))
+}
+
+/** The rule key an "always allow" answer produces. */
+export function ruleFor(toolName, input) {
+  if (toolName !== 'Bash') return toolName
+  const first = pieces(String(input?.command ?? ''))[0] ?? ''
+  const words = first.split(/\s+/)
+  // Two words for package managers and git ("npm run", "git push"), one otherwise.
+  return /^(?:git|npm|pnpm|yarn|npx|cargo|go|docker|gh|heroku|make)$/.test(words[0]) && words[1] ? `${words[0]} ${words[1]}` : words[0]
+}
+
+/**
+ * Decide for one tool call. Returns { decision: 'allow'|'ask'|'deny', reason }.
+ * @param sessionRules rules allowed earlier in this session ("always allow")
+ */
+export function decide(policy, toolName, input, cwd, sessionRules = new Set()) {
+  const p = policy ?? {}
+  const command = toolName === 'Bash' ? String(input?.command ?? '') : ''
+  if (matchesRule(p.denyRules ?? [], toolName, command)) return { decision: 'deny', reason: 'refused by your policy' }
+  if (toolName === 'AskUserQuestion') return { decision: 'ask', reason: 'a question for you' }
+  if (matchesRule(p.askRules ?? [], toolName, command)) return { decision: 'ask', reason: 'your policy always asks for this' }
+  if (matchesRule([...(p.allowRules ?? []), ...sessionRules], toolName, command)) return { decision: 'allow', reason: 'allowed by your policy' }
+  if (READ_ONLY.has(toolName)) return { decision: 'allow', reason: 'read-only' }
+  if (EDITS.has(toolName)) {
+    const file = input?.file_path ?? input?.notebook_path
+    if (insideFolder(cwd, file)) return { decision: p.edits === 'ask' ? 'ask' : 'allow', reason: 'edit inside the project' }
+    return { decision: p.editsOutside === 'deny' ? 'deny' : 'ask', reason: 'edit outside the project folder' }
+  }
+  if (toolName === 'Bash') {
+    if (p.shell === 'allow') return { decision: 'allow', reason: 'shell allowed by your policy' }
+    if (p.shell !== 'ask' && shellIsSafe(command, p.allowRules ?? [])) return { decision: 'allow', reason: 'read-only command' }
+    return { decision: 'ask', reason: 'shell command' }
+  }
+  if (WEB.has(toolName)) return { decision: p.web === 'ask' ? 'ask' : 'allow', reason: 'web' }
+  if (toolName === 'Task') return { decision: p.delegate === 'ask' ? 'ask' : 'allow', reason: 'subagent' }
+  if (toolName === 'ExitPlanMode') return { decision: p.plan === 'allow' ? 'allow' : 'ask', reason: 'plan approval' }
+  return { decision: 'ask', reason: 'unfamiliar tool' }
+}

package/src/index.mjs

@@ -103,7 +103,7 @@ const tools = {
           }, { once: true })
         }),
     }
-    void agent.run({ prompt, sessionId: args.session_id, cwd: dir }, io).then(async outcome => {
+    void agent.run({ prompt, sessionId: args.session_id, cwd: dir, policy: args.policy ?? {} }, io).then(async outcome => {
       for (const key of [...answerWaits.keys()]) if (key.startsWith(`${jobId}:`)) answerWaits.delete(key)
       let change = null
       if (before) change = await changesSince(before).catch(err => (log(`git after job failed: ${err.message}`), null))