nexrall-code 0.5.116 → 0.5.118

package/dist/permissions/handler.js

@@ -1,332 +0,0 @@
-import * as readline from 'readline';
-import * as fs from 'fs';
-import chalk from 'chalk';
-import { showDiff } from '../ui/diff';
-import { loadSettings, evaluatePermission, isDestructiveBash, decide as decidePolicy, parseMode, } from '@nexrall/code-core';
-// ─── Session State ────────────────────────────────────────────────────────────
-// Categories: 'read' | 'write' | 'bash' | 'fs' | 'all'
-const autoApproved = new Set();
-// Granular allow/ask/deny rules merged from the settings tiers.
-let _rules = { allow: [], ask: [], deny: [] };
-let _workDir = process.cwd();
-// Current agent mode ('ask' | 'edit' | 'plan' | 'auto'). In 'plan' mode every
-// mutating tool call is REFUSED at the permission gate — not merely discouraged
-// by the system prompt — so a plan-mode session can never write a file even if
-// the model ignores its instructions (prompt injection, misread context, etc.).
-// Mirrors the VS Code extension's hard gate in ChatPanel.ts.
-let _mode = 'ask';
-/** Load merged permission rules from the settings hierarchy for this workspace. */
-export function initPermissions(workDir) {
-    _workDir = workDir;
-    _rules = loadSettings(workDir).permissions;
-    return _rules;
-}
-/** Set the active agent mode so the plan-mode gate can enforce read-only. */
-export function setMode(mode) {
-    // parseMode normalises unknown values to the SAFE middle ('ask') rather than the
-    // permissive default this used to fall back to. A typo in a settings file or a stale
-    // client sending a mode this build doesn't know must not silently grant autonomy.
-    _mode = parseMode(mode);
-}
-export function setAutoApprove(category) {
-    autoApproved.add(category);
-}
-export function resetPermissions() {
-    autoApproved.clear();
-}
-function isAutoApproved(category) {
-    return autoApproved.has('all') || autoApproved.has(category);
-}
-/** Public read of the 'all' auto-approve flag, for the status-bar footer. */
-export function isYoloMode() {
-    return autoApproved.has('all');
-}
-// ─── Readline Prompt ──────────────────────────────────────────────────────────
-// The single, long-lived readline.Interface owned by the REPL (chat.ts). Every
-// permission prompt reuses THIS interface instead of creating a new one.
-//
-// Why this matters: readline.Interface#pause() only pauses the underlying
-// stream — it does NOT remove the 'keypress'/'data' listeners the interface
-// registered on process.stdin. chat.ts calls rl.pause() before each agent turn
-// (so its own prompt doesn't compete with the run), then requestPermission()
-// used to spin up a BRAND NEW readline.Interface on the same process.stdin to
-// ask "Run this command? [y/n]". That left two Interfaces alive and listening
-// on the same stdin at once, so every keystroke (including the y/n answer)
-// got processed — and the line re-drawn — by both, producing the classic
-// symptom users reported: typed characters appearing doubled/duplicated and
-// the prompt failing to advance to a clean new line. Routing every question
-// through the one REPL interface (via setReadlineInterface) eliminates the
-// second listener entirely.
-let _replInterface = null;
-/** Called once by chat.ts right after it creates the REPL's readline.Interface (or Ink adapter). */
-export function setReadlineInterface(rl) {
-    _replInterface = rl;
-}
-// ─── One prompt at a time ─────────────────────────────────────────────────────
-//
-// Up to 4 sub-agents run concurrently, each issuing its own tool calls, so two of them
-// needing approval at the same moment both reach this function. That used to mean two
-// concurrent `rl.question()` calls on ONE readline interface, which does not merely look
-// untidy — the second callback never fires. Verified directly: with two questions
-// outstanding and two lines piped in, only the first is ever answered and the second
-// promise hangs forever. A wedged permission request wedges the whole turn, and the
-// user's instinct (Ctrl+C, retry) is the wrong move because the work was fine.
-//
-// So prompts are serialised: at most one question is on screen, the rest wait their
-// turn. Every OTHER path here (deny rules, session auto-approve, allow rules) is
-// synchronous and unaffected — only the branch that actually asks a human is queued.
-let _promptChain = Promise.resolve();
-function serialisePrompt(fn) {
-    // Chain onto the previous prompt, swallowing its rejection so one failed prompt
-    // cannot poison every later one.
-    const next = _promptChain.then(fn, fn);
-    _promptChain = next.catch(() => undefined);
-    return next;
-}
-/**
- * Ask the user a question. Reuses the shared REPL interface when available
- * (the normal interactive-session case) so only one readline.Interface is ever
- * listening on stdin. Falls back to a throwaway interface for any caller that
- * hasn't registered one (e.g. standalone/test usage outside the REPL).
- * Returns the trimmed response.
- *
- * The question text is always written to stderr first (so it doesn't mix with
- * anything piped from stdout), then rl.question() is called with an empty
- * query — the shared REPL interface's output is stdout, but by the time
- * question() draws anything the prompt text is already on stderr, matching
- * the original stdout/stderr separation.
- */
-function askUser(question) {
-    // Serialised HERE rather than at each of the eight call sites: this is the single
-    // choke point where a human is actually asked, so wrapping it means a new prompt added
-    // later is safe by default instead of depending on whoever adds it remembering.
-    return serialisePrompt(() => {
-        if (_replInterface) {
-            const rl = _replInterface;
-            return new Promise((resolve) => {
-                rl.question(question, (answer) => resolve(answer.trim()));
-            });
-        }
-        return new Promise((resolve) => {
-            const rl = readline.createInterface({
-                input: process.stdin,
-                output: process.stderr,
-                terminal: true,
-            });
-            rl.question(question, (answer) => {
-                rl.close();
-                resolve(answer.trim());
-            });
-        });
-    });
-}
-// ─── Permission Request ───────────────────────────────────────────────────────
-export async function requestPermission(req) {
-    const { tool, input } = req;
-    // ── Granular rules (deny → allow → ask) from settings tiers ───────────────
-    const decision = evaluatePermission(_rules, tool, input, _workDir);
-    if (decision === 'deny') {
-        console.error(chalk.red(`  ✖ Denied by permission rule: ${tool}`));
-        return false;
-    }
-    // ── Destructive-command guard (DB drops, force-push, terraform destroy …) ──
-    // Fires AFTER an explicit deny but BEFORE any allow / session auto-approve, so
-    // an irreversible high-blast-radius command can never ride a blanket "approve
-    // all" straight to execution (the class of failure that has wiped prod DBs).
-    // Opt-out for CI/headless via NEXRALL_ALLOW_DESTRUCTIVE=1.
-    const destructive = isDestructiveBash(tool, input);
-    if (destructive && process.env.NEXRALL_ALLOW_DESTRUCTIVE !== '1') {
-        const command = (input.command ?? input.cmd ?? '');
-        console.error();
-        console.error(chalk.red.bold('  ⚠  DESTRUCTIVE / IRREVERSIBLE COMMAND'));
-        console.error(chalk.red(`     ${destructive.reason} [${destructive.category}]`));
-        console.error(chalk.yellow('  ┌─ bash ──────────────────────────────────────────'));
-        for (const line of command.split('\n')) {
-            console.error(chalk.yellow('  │ ') + chalk.white(line));
-        }
-        console.error(chalk.yellow('  └────────────────────────────────────────────────'));
-        console.error(chalk.dim('  This cannot be undone. Auto-approve does not apply here.'));
-        console.error();
-        // Require an explicit, unambiguous "yes" — no [a(ll)], no default-y.
-        const answer = await askUser(chalk.bold.red('Type "yes" to run this destructive command: '));
-        return answer.toLowerCase() === 'yes';
-    }
-    if (decision === 'allow')
-        return true;
-    // 'ask' or no matching rule → fall through to the interactive flow below.
-    // ── Mode policy ───────────────────────────────────────────────────────────
-    //
-    // Delegated to the shared policy in core rather than decided here. This file used to
-    // read `_mode` in exactly ONE place (`=== 'plan'`), so `ask`, `edit` and `auto` were
-    // indistinguishable: choosing `auto` still prompted for `npm test`, and `edit` did
-    // nothing whatsoever. Meanwhile the system prompt already told the model that in
-    // `auto` "file edits proceed" and only irreversible actions need confirmation — an
-    // accurate statement of intent and a false description of the product.
-    //
-    // The policy owns the read-only list too, so the CLI and the VS Code panel stop
-    // maintaining two copies that had already drifted apart.
-    const verdict = decidePolicy({
-        tool,
-        input,
-        mode: _mode,
-        bypass: isAutoApproved('all'),
-        // The destructive case was already handled above with the strong confirm flow
-        // (type "yes", no "approve all"), so it must not be re-triggered here.
-        destructive: false,
-    });
-    if (verdict === 'allow')
-        return true;
-    if (verdict === 'deny') {
-        console.error(chalk.yellow(`  ⊘ Plan mode — refused ${tool} (read-only until you switch mode).`));
-        return false;
-    }
-    // 'ask' → fall through to the per-tool flows below, which render a diff or command
-    // preview before asking.
-    // ── Write file (full overwrite) ───────────────────────────────────────────
-    if (tool === 'write_file' || tool === 'create_file') {
-        if (isAutoApproved('write'))
-            return true;
-        const filePath = (input.path ?? input.file_path ?? '');
-        const newContent = (input.content ?? '');
-        let oldContent = null;
-        try {
-            if (fs.existsSync(filePath))
-                oldContent = fs.readFileSync(filePath, 'utf-8');
-        }
-        catch { /* new file */ }
-        showDiff(filePath, oldContent, newContent);
-        const answer = await askUser(chalk.bold('Apply this change?') + chalk.dim(' [y/n/a(ll)] > '));
-        if (answer === 'a' || answer === 'all') {
-            setAutoApprove('write');
-            return true;
-        }
-        return answer === 'y' || answer === 'yes';
-    }
-    // ── Edit file (targeted patch) ────────────────────────────────────────────
-    if (tool === 'edit_file') {
-        if (isAutoApproved('write'))
-            return true;
-        const filePath = (input.path ?? '');
-        const oldStr = (input.old_string ?? '');
-        const newStr = (input.new_string ?? '');
-        let oldContent = null;
-        let newContent = '';
-        try {
-            if (fs.existsSync(filePath)) {
-                oldContent = fs.readFileSync(filePath, 'utf-8');
-                newContent = oldContent.replace(oldStr, newStr);
-            }
-        }
-        catch { /* ignore */ }
-        if (oldContent !== null) {
-            showDiff(filePath, oldContent, newContent);
-        }
-        else {
-            console.error(chalk.yellow(`\n  edit_file: ${filePath}`));
-            console.error(chalk.red(`  - ${oldStr.split('\n')[0]}…`));
-            console.error(chalk.green(`  + ${newStr.split('\n')[0]}…`));
-            console.error();
-        }
-        const answer = await askUser(chalk.bold('Apply this edit?') + chalk.dim(' [y/n/a(ll)] > '));
-        if (answer === 'a' || answer === 'all') {
-            setAutoApprove('write');
-            return true;
-        }
-        return answer === 'y' || answer === 'yes';
-    }
-    // ── Multi-edit (multiple patches in one file) ─────────────────────────────
-    if (tool === 'multi_edit') {
-        if (isAutoApproved('write'))
-            return true;
-        const filePath = (input.path ?? '');
-        const edits = Array.isArray(input.edits)
-            ? input.edits
-            : [];
-        let oldContent = null;
-        let newContent = '';
-        try {
-            if (fs.existsSync(filePath)) {
-                oldContent = fs.readFileSync(filePath, 'utf-8');
-                newContent = edits.reduce((src, e) => src.replace(e.old_string, e.new_string), oldContent);
-            }
-        }
-        catch { /* ignore */ }
-        if (oldContent !== null) {
-            showDiff(filePath, oldContent, newContent);
-        }
-        else {
-            console.error(chalk.yellow(`\n  multi_edit: ${filePath} (${edits.length} change${edits.length !== 1 ? 's' : ''})\n`));
-        }
-        const answer = await askUser(chalk.bold(`Apply ${edits.length} edit${edits.length !== 1 ? 's' : ''}?`) + chalk.dim(' [y/n/a(ll)] > '));
-        if (answer === 'a' || answer === 'all') {
-            setAutoApprove('write');
-            return true;
-        }
-        return answer === 'y' || answer === 'yes';
-    }
-    // ── Bash / run_command ────────────────────────────────────────────────────
-    if (tool === 'bash' || tool === 'run_command' || tool === 'execute_command') {
-        if (isAutoApproved('bash'))
-            return true;
-        const command = (input.command ?? input.cmd ?? '');
-        console.error();
-        console.error(chalk.yellow('  ┌─ bash ──────────────────────────────────────────'));
-        for (const line of command.split('\n')) {
-            console.error(chalk.yellow('  │ ') + chalk.white(line));
-        }
-        console.error(chalk.yellow('  └────────────────────────────────────────────────'));
-        console.error();
-        const answer = await askUser(chalk.bold('Run this command?') + chalk.dim(' [y/n/a(ll)] > '));
-        if (answer === 'a' || answer === 'all') {
-            setAutoApprove('bash');
-            return true;
-        }
-        return answer === 'y' || answer === 'yes';
-    }
-    // ── Notebook edit ─────────────────────────────────────────────────────────
-    if (tool === 'notebook_edit') {
-        if (isAutoApproved('write'))
-            return true;
-        const filePath = (input.path ?? '');
-        const editType = (input.edit_type ?? 'edit');
-        const cellIdx = input.cell_index != null ? `cell ${input.cell_index}` : '';
-        console.error(chalk.yellow(`\n  notebook_edit: ${filePath}  [${editType} ${cellIdx}]\n`));
-        const answer = await askUser(chalk.bold('Apply this notebook edit?') + chalk.dim(' [y/n/a(ll)] > '));
-        if (answer === 'a' || answer === 'all') {
-            setAutoApprove('write');
-            return true;
-        }
-        return answer === 'y' || answer === 'yes';
-    }
-    // ── Copy file ─────────────────────────────────────────────────────────────
-    if (tool === 'copy_file') {
-        if (isAutoApproved('fs'))
-            return true;
-        const src = (input.source ?? '');
-        const dest = (input.destination ?? '');
-        console.error(chalk.yellow(`\n  copy_file  `) + chalk.white(`${src} → ${dest}\n`));
-        const answer = await askUser(chalk.bold('Allow copy?') + chalk.dim(' [y/n] > '));
-        return answer === 'y' || answer === 'yes';
-    }
-    // ── Filesystem mutations (create_directory, move_file, delete_file) ───────
-    if (['create_directory', 'move_file', 'delete_file', 'rename_file'].includes(tool)) {
-        if (isAutoApproved('fs'))
-            return true;
-        const src = (input.path ?? input.source ?? input.src ?? '');
-        const dest = (input.destination ?? input.dest ?? '');
-        const action = tool.replace(/_/g, ' ');
-        const detail = dest ? `${src} → ${dest}` : src;
-        console.error();
-        console.error(chalk.yellow('  ') + chalk.bold(action) + chalk.dim('  ') + chalk.white(detail));
-        console.error();
-        const answer = await askUser(chalk.bold(`Allow ${action}?`) + chalk.dim(' [y/n] > '));
-        return answer === 'y' || answer === 'yes';
-    }
-    // ── Unknown tool: prompt ──────────────────────────────────────────────────
-    console.error();
-    console.error(chalk.dim(`  Unknown tool: ${chalk.bold(tool)}`));
-    console.error(chalk.dim(`  Input: ${JSON.stringify(input).slice(0, 120)}`));
-    console.error();
-    const answer = await askUser(chalk.bold(`Allow ${tool}?`) + chalk.dim(' [y/n] > '));
-    return answer === 'y' || answer === 'yes';
-}