nexrall-code 0.5.107 → 0.5.109

package/dist/permissions/handler.js

@@ -0,0 +1,332 @@
+import * as readline from 'readline';
+import * as fs from 'fs';
+import chalk from 'chalk';
+import { showDiff } from '../ui/diff';
+import { loadSettings, evaluatePermission, isDestructiveBash, decide as decidePolicy, parseMode, } from '@nexrall/code-core';
+// ─── Session State ────────────────────────────────────────────────────────────
+// Categories: 'read' | 'write' | 'bash' | 'fs' | 'all'
+const autoApproved = new Set();
+// Granular allow/ask/deny rules merged from the settings tiers.
+let _rules = { allow: [], ask: [], deny: [] };
+let _workDir = process.cwd();
+// Current agent mode ('ask' | 'edit' | 'plan' | 'auto'). In 'plan' mode every
+// mutating tool call is REFUSED at the permission gate — not merely discouraged
+// by the system prompt — so a plan-mode session can never write a file even if
+// the model ignores its instructions (prompt injection, misread context, etc.).
+// Mirrors the VS Code extension's hard gate in ChatPanel.ts.
+let _mode = 'ask';
+/** Load merged permission rules from the settings hierarchy for this workspace. */
+export function initPermissions(workDir) {
+    _workDir = workDir;
+    _rules = loadSettings(workDir).permissions;
+    return _rules;
+}
+/** Set the active agent mode so the plan-mode gate can enforce read-only. */
+export function setMode(mode) {
+    // parseMode normalises unknown values to the SAFE middle ('ask') rather than the
+    // permissive default this used to fall back to. A typo in a settings file or a stale
+    // client sending a mode this build doesn't know must not silently grant autonomy.
+    _mode = parseMode(mode);
+}
+export function setAutoApprove(category) {
+    autoApproved.add(category);
+}
+export function resetPermissions() {
+    autoApproved.clear();
+}
+function isAutoApproved(category) {
+    return autoApproved.has('all') || autoApproved.has(category);
+}
+/** Public read of the 'all' auto-approve flag, for the status-bar footer. */
+export function isYoloMode() {
+    return autoApproved.has('all');
+}
+// ─── Readline Prompt ──────────────────────────────────────────────────────────
+// The single, long-lived readline.Interface owned by the REPL (chat.ts). Every
+// permission prompt reuses THIS interface instead of creating a new one.
+//
+// Why this matters: readline.Interface#pause() only pauses the underlying
+// stream — it does NOT remove the 'keypress'/'data' listeners the interface
+// registered on process.stdin. chat.ts calls rl.pause() before each agent turn
+// (so its own prompt doesn't compete with the run), then requestPermission()
+// used to spin up a BRAND NEW readline.Interface on the same process.stdin to
+// ask "Run this command? [y/n]". That left two Interfaces alive and listening
+// on the same stdin at once, so every keystroke (including the y/n answer)
+// got processed — and the line re-drawn — by both, producing the classic
+// symptom users reported: typed characters appearing doubled/duplicated and
+// the prompt failing to advance to a clean new line. Routing every question
+// through the one REPL interface (via setReadlineInterface) eliminates the
+// second listener entirely.
+let _replInterface = null;
+/** Called once by chat.ts right after it creates the REPL's readline.Interface (or Ink adapter). */
+export function setReadlineInterface(rl) {
+    _replInterface = rl;
+}
+// ─── One prompt at a time ─────────────────────────────────────────────────────
+//
+// Up to 4 sub-agents run concurrently, each issuing its own tool calls, so two of them
+// needing approval at the same moment both reach this function. That used to mean two
+// concurrent `rl.question()` calls on ONE readline interface, which does not merely look
+// untidy — the second callback never fires. Verified directly: with two questions
+// outstanding and two lines piped in, only the first is ever answered and the second
+// promise hangs forever. A wedged permission request wedges the whole turn, and the
+// user's instinct (Ctrl+C, retry) is the wrong move because the work was fine.
+//
+// So prompts are serialised: at most one question is on screen, the rest wait their
+// turn. Every OTHER path here (deny rules, session auto-approve, allow rules) is
+// synchronous and unaffected — only the branch that actually asks a human is queued.
+let _promptChain = Promise.resolve();
+function serialisePrompt(fn) {
+    // Chain onto the previous prompt, swallowing its rejection so one failed prompt
+    // cannot poison every later one.
+    const next = _promptChain.then(fn, fn);
+    _promptChain = next.catch(() => undefined);
+    return next;
+}
+/**
+ * Ask the user a question. Reuses the shared REPL interface when available
+ * (the normal interactive-session case) so only one readline.Interface is ever
+ * listening on stdin. Falls back to a throwaway interface for any caller that
+ * hasn't registered one (e.g. standalone/test usage outside the REPL).
+ * Returns the trimmed response.
+ *
+ * The question text is always written to stderr first (so it doesn't mix with
+ * anything piped from stdout), then rl.question() is called with an empty
+ * query — the shared REPL interface's output is stdout, but by the time
+ * question() draws anything the prompt text is already on stderr, matching
+ * the original stdout/stderr separation.
+ */
+function askUser(question) {
+    // Serialised HERE rather than at each of the eight call sites: this is the single
+    // choke point where a human is actually asked, so wrapping it means a new prompt added
+    // later is safe by default instead of depending on whoever adds it remembering.
+    return serialisePrompt(() => {
+        if (_replInterface) {
+            const rl = _replInterface;
+            return new Promise((resolve) => {
+                rl.question(question, (answer) => resolve(answer.trim()));
+            });
+        }
+        return new Promise((resolve) => {
+            const rl = readline.createInterface({
+                input: process.stdin,
+                output: process.stderr,
+                terminal: true,
+            });
+            rl.question(question, (answer) => {
+                rl.close();
+                resolve(answer.trim());
+            });
+        });
+    });
+}
+// ─── Permission Request ───────────────────────────────────────────────────────
+export async function requestPermission(req) {
+    const { tool, input } = req;
+    // ── Granular rules (deny → allow → ask) from settings tiers ───────────────
+    const decision = evaluatePermission(_rules, tool, input, _workDir);
+    if (decision === 'deny') {
+        console.error(chalk.red(`  ✖ Denied by permission rule: ${tool}`));
+        return false;
+    }
+    // ── Destructive-command guard (DB drops, force-push, terraform destroy …) ──
+    // Fires AFTER an explicit deny but BEFORE any allow / session auto-approve, so
+    // an irreversible high-blast-radius command can never ride a blanket "approve
+    // all" straight to execution (the class of failure that has wiped prod DBs).
+    // Opt-out for CI/headless via NEXRALL_ALLOW_DESTRUCTIVE=1.
+    const destructive = isDestructiveBash(tool, input);
+    if (destructive && process.env.NEXRALL_ALLOW_DESTRUCTIVE !== '1') {
+        const command = (input.command ?? input.cmd ?? '');
+        console.error();
+        console.error(chalk.red.bold('  ⚠  DESTRUCTIVE / IRREVERSIBLE COMMAND'));
+        console.error(chalk.red(`     ${destructive.reason} [${destructive.category}]`));
+        console.error(chalk.yellow('  ┌─ bash ──────────────────────────────────────────'));
+        for (const line of command.split('\n')) {
+            console.error(chalk.yellow('  │ ') + chalk.white(line));
+        }
+        console.error(chalk.yellow('  └────────────────────────────────────────────────'));
+        console.error(chalk.dim('  This cannot be undone. Auto-approve does not apply here.'));
+        console.error();
+        // Require an explicit, unambiguous "yes" — no [a(ll)], no default-y.
+        const answer = await askUser(chalk.bold.red('Type "yes" to run this destructive command: '));
+        return answer.toLowerCase() === 'yes';
+    }
+    if (decision === 'allow')
+        return true;
+    // 'ask' or no matching rule → fall through to the interactive flow below.
+    // ── Mode policy ───────────────────────────────────────────────────────────
+    //
+    // Delegated to the shared policy in core rather than decided here. This file used to
+    // read `_mode` in exactly ONE place (`=== 'plan'`), so `ask`, `edit` and `auto` were
+    // indistinguishable: choosing `auto` still prompted for `npm test`, and `edit` did
+    // nothing whatsoever. Meanwhile the system prompt already told the model that in
+    // `auto` "file edits proceed" and only irreversible actions need confirmation — an
+    // accurate statement of intent and a false description of the product.
+    //
+    // The policy owns the read-only list too, so the CLI and the VS Code panel stop
+    // maintaining two copies that had already drifted apart.
+    const verdict = decidePolicy({
+        tool,
+        input,
+        mode: _mode,
+        bypass: isAutoApproved('all'),
+        // The destructive case was already handled above with the strong confirm flow
+        // (type "yes", no "approve all"), so it must not be re-triggered here.
+        destructive: false,
+    });
+    if (verdict === 'allow')
+        return true;
+    if (verdict === 'deny') {
+        console.error(chalk.yellow(`  ⊘ Plan mode — refused ${tool} (read-only until you switch mode).`));
+        return false;
+    }
+    // 'ask' → fall through to the per-tool flows below, which render a diff or command
+    // preview before asking.
+    // ── Write file (full overwrite) ───────────────────────────────────────────
+    if (tool === 'write_file' || tool === 'create_file') {
+        if (isAutoApproved('write'))
+            return true;
+        const filePath = (input.path ?? input.file_path ?? '');
+        const newContent = (input.content ?? '');
+        let oldContent = null;
+        try {
+            if (fs.existsSync(filePath))
+                oldContent = fs.readFileSync(filePath, 'utf-8');
+        }
+        catch { /* new file */ }
+        showDiff(filePath, oldContent, newContent);
+        const answer = await askUser(chalk.bold('Apply this change?') + chalk.dim(' [y/n/a(ll)] > '));
+        if (answer === 'a' || answer === 'all') {
+            setAutoApprove('write');
+            return true;
+        }
+        return answer === 'y' || answer === 'yes';
+    }
+    // ── Edit file (targeted patch) ────────────────────────────────────────────
+    if (tool === 'edit_file') {
+        if (isAutoApproved('write'))
+            return true;
+        const filePath = (input.path ?? '');
+        const oldStr = (input.old_string ?? '');
+        const newStr = (input.new_string ?? '');
+        let oldContent = null;
+        let newContent = '';
+        try {
+            if (fs.existsSync(filePath)) {
+                oldContent = fs.readFileSync(filePath, 'utf-8');
+                newContent = oldContent.replace(oldStr, newStr);
+            }
+        }
+        catch { /* ignore */ }
+        if (oldContent !== null) {
+            showDiff(filePath, oldContent, newContent);
+        }
+        else {
+            console.error(chalk.yellow(`\n  edit_file: ${filePath}`));
+            console.error(chalk.red(`  - ${oldStr.split('\n')[0]}…`));
+            console.error(chalk.green(`  + ${newStr.split('\n')[0]}…`));
+            console.error();
+        }
+        const answer = await askUser(chalk.bold('Apply this edit?') + chalk.dim(' [y/n/a(ll)] > '));
+        if (answer === 'a' || answer === 'all') {
+            setAutoApprove('write');
+            return true;
+        }
+        return answer === 'y' || answer === 'yes';
+    }
+    // ── Multi-edit (multiple patches in one file) ─────────────────────────────
+    if (tool === 'multi_edit') {
+        if (isAutoApproved('write'))
+            return true;
+        const filePath = (input.path ?? '');
+        const edits = Array.isArray(input.edits)
+            ? input.edits
+            : [];
+        let oldContent = null;
+        let newContent = '';
+        try {
+            if (fs.existsSync(filePath)) {
+                oldContent = fs.readFileSync(filePath, 'utf-8');
+                newContent = edits.reduce((src, e) => src.replace(e.old_string, e.new_string), oldContent);
+            }
+        }
+        catch { /* ignore */ }
+        if (oldContent !== null) {
+            showDiff(filePath, oldContent, newContent);
+        }
+        else {
+            console.error(chalk.yellow(`\n  multi_edit: ${filePath} (${edits.length} change${edits.length !== 1 ? 's' : ''})\n`));
+        }
+        const answer = await askUser(chalk.bold(`Apply ${edits.length} edit${edits.length !== 1 ? 's' : ''}?`) + chalk.dim(' [y/n/a(ll)] > '));
+        if (answer === 'a' || answer === 'all') {
+            setAutoApprove('write');
+            return true;
+        }
+        return answer === 'y' || answer === 'yes';
+    }
+    // ── Bash / run_command ────────────────────────────────────────────────────
+    if (tool === 'bash' || tool === 'run_command' || tool === 'execute_command') {
+        if (isAutoApproved('bash'))
+            return true;
+        const command = (input.command ?? input.cmd ?? '');
+        console.error();
+        console.error(chalk.yellow('  ┌─ bash ──────────────────────────────────────────'));
+        for (const line of command.split('\n')) {
+            console.error(chalk.yellow('  │ ') + chalk.white(line));
+        }
+        console.error(chalk.yellow('  └────────────────────────────────────────────────'));
+        console.error();
+        const answer = await askUser(chalk.bold('Run this command?') + chalk.dim(' [y/n/a(ll)] > '));
+        if (answer === 'a' || answer === 'all') {
+            setAutoApprove('bash');
+            return true;
+        }
+        return answer === 'y' || answer === 'yes';
+    }
+    // ── Notebook edit ─────────────────────────────────────────────────────────
+    if (tool === 'notebook_edit') {
+        if (isAutoApproved('write'))
+            return true;
+        const filePath = (input.path ?? '');
+        const editType = (input.edit_type ?? 'edit');
+        const cellIdx = input.cell_index != null ? `cell ${input.cell_index}` : '';
+        console.error(chalk.yellow(`\n  notebook_edit: ${filePath}  [${editType} ${cellIdx}]\n`));
+        const answer = await askUser(chalk.bold('Apply this notebook edit?') + chalk.dim(' [y/n/a(ll)] > '));
+        if (answer === 'a' || answer === 'all') {
+            setAutoApprove('write');
+            return true;
+        }
+        return answer === 'y' || answer === 'yes';
+    }
+    // ── Copy file ─────────────────────────────────────────────────────────────
+    if (tool === 'copy_file') {
+        if (isAutoApproved('fs'))
+            return true;
+        const src = (input.source ?? '');
+        const dest = (input.destination ?? '');
+        console.error(chalk.yellow(`\n  copy_file  `) + chalk.white(`${src} → ${dest}\n`));
+        const answer = await askUser(chalk.bold('Allow copy?') + chalk.dim(' [y/n] > '));
+        return answer === 'y' || answer === 'yes';
+    }
+    // ── Filesystem mutations (create_directory, move_file, delete_file) ───────
+    if (['create_directory', 'move_file', 'delete_file', 'rename_file'].includes(tool)) {
+        if (isAutoApproved('fs'))
+            return true;
+        const src = (input.path ?? input.source ?? input.src ?? '');
+        const dest = (input.destination ?? input.dest ?? '');
+        const action = tool.replace(/_/g, ' ');
+        const detail = dest ? `${src} → ${dest}` : src;
+        console.error();
+        console.error(chalk.yellow('  ') + chalk.bold(action) + chalk.dim('  ') + chalk.white(detail));
+        console.error();
+        const answer = await askUser(chalk.bold(`Allow ${action}?`) + chalk.dim(' [y/n] > '));
+        return answer === 'y' || answer === 'yes';
+    }
+    // ── Unknown tool: prompt ──────────────────────────────────────────────────
+    console.error();
+    console.error(chalk.dim(`  Unknown tool: ${chalk.bold(tool)}`));
+    console.error(chalk.dim(`  Input: ${JSON.stringify(input).slice(0, 120)}`));
+    console.error();
+    const answer = await askUser(chalk.bold(`Allow ${tool}?`) + chalk.dim(' [y/n] > '));
+    return answer === 'y' || answer === 'yes';
+}