one-code-extension 0.3.0 → 0.4.0

package/extensions/permissions/matcher.ts

@@ -8,11 +8,20 @@
  */
 
 import { homedir } from "node:os";
-import { isAbsolute, relative, resolve, sep } from "node:path";
+import { isAbsolute, relative, resolve } from "node:path";
 import { analyzeShellCommand, hasInjectionSyntax, leadTokens, parseCommand, resolvePayload } from "../auto-mode/shell-analysis.ts";
-import { pathArgument } from "../auto-mode/paths.ts";
+import { pathArgument, resolveForContainment } from "../auto-mode/paths.ts";
 import { isProtectedPath, isWritingTool } from "./protected-paths.ts";
-import { expandTilde } from "../lib/paths.ts";
+import {
+	canonicalCommandName,
+	canonicalizeStatement,
+	powershellInjectionSyntax,
+	powershellMatchForms,
+	powershellReadOnly,
+	powershellStatements,
+} from "./powershell-rules.ts";
+import { comparablePath, expandTilde, foldsCase, forwardSlashes, isRelativeInside, toPosixPath } from "../lib/paths.ts";
+import { isShellToolName } from "../lib/shell-tools.ts";
 
 export type PermissionMode = "default" | "acceptEdits" | "plan" | "bypassPermissions" | "dontAsk" | "auto";
 /** "classify" is auto mode's outcome: hand the call to the approval classifier. */
@@ -21,6 +30,7 @@ export type PermissionDecision = "allow" | "deny" | "ask" | "classify";
 /** Claude Code tool name (lowercased) → One Code tool name. */
 const CC_TOOL_NAMES: Record<string, string> = {
 	bash: "bash",
+	powershell: "powershell",
 	read: "read",
 	edit: "edit",
 	write: "write",
@@ -153,7 +163,7 @@ export function escapeLiteral(command: string): string {
 }
 
 /** Glob → RegExp. `**` crosses path separators, `*` does not. `\*` / `\\` are literals. */
-function globToRegex(glob: string, pathMode: boolean): RegExp {
+function globToRegex(glob: string, pathMode: boolean, ignoreCase = false): RegExp {
 	let out = "";
 	for (let i = 0; i < glob.length; i++) {
 		const ch = glob[i];
@@ -174,7 +184,7 @@ function globToRegex(glob: string, pathMode: boolean): RegExp {
 			out += ch;
 		}
 	}
-	return new RegExp(`^${out}$`);
+	return new RegExp(`^${out}$`, ignoreCase ? "i" : "");
 }
 
 /**
@@ -279,13 +289,41 @@ export function bashMatchForms(command: string, depth = 0): string[] {
  * `Bash(rm:*)` (CC: "deny/ask rules must match compound commands so they can't
  * be bypassed"). Unparseable lines are matched as a whole only.
  */
-function bashPatternMatchesAny(pattern: string, command: string): boolean {
-	// decide() tests every deny rule, then every ask rule, against the same
-	// command; the forms depend on the command alone, so the last parse is kept.
-	if (lastForms?.command !== command) lastForms = { command, forms: bashMatchForms(command) };
-	return lastForms.forms.some((form) => matchesBashPattern(pattern, form));
+/**
+ * "Any form matches" with a one-entry memo of the forms: decide() tests every
+ * deny rule, then every ask rule, against the same command, and the forms
+ * depend on the command alone, so the last parse is kept per shell grammar.
+ */
+function anyFormMatcher(formsOf: (command: string) => string[], matches: (pattern: string, form: string) => boolean) {
+	let last: { command: string; forms: string[] } | undefined;
+	return (pattern: string, command: string): boolean => {
+		if (last?.command !== command) last = { command, forms: formsOf(command) };
+		return last.forms.some((form) => matches(pattern, form));
+	};
+}
+
+const bashPatternMatchesAny = anyFormMatcher(bashMatchForms, matchesBashPattern);
+
+/**
+ * PowerShell's Bash-pattern match against ONE statement: both sides have their
+ * command word alias-canonicalized (`ls` ≡ `Get-ChildItem`) and are compared
+ * case-insensitively (cmdlet names are), then Claude Code's Bash pattern rules
+ * apply unchanged — exact, `prefix:*`, wildcards (powershell-rules.ts).
+ */
+export function matchesPowerShellPattern(pattern: string, statement: string): boolean {
+	const canonicalPattern = pattern.endsWith(":*")
+		? `${canonicalizeStatement(pattern.slice(0, -2))}:*`
+		: canonicalizeStatement(pattern);
+	return matchesBashPattern(canonicalPattern.toLowerCase(), canonicalizeStatement(statement).toLowerCase());
+}
+
+/** Deny/ask semantics for PowerShell: the pattern covers the line, any statement, or any canonical/nested form. */
+const powershellPatternMatchesAny = anyFormMatcher(powershellMatchForms, matchesPowerShellPattern);
+
+/** The tools whose subject is a shell command line and whose rules follow the Bash shape (lib/shell-tools.ts). */
+export function isShellTool(toolName: string): boolean {
+	return isShellToolName(normalizeToolName(toolName));
 }
-let lastForms: { command: string; forms: string[] } | undefined;
 
 /**
  * The allow rule that lets a bash command run, or undefined. CC semantics: an
@@ -312,12 +350,17 @@ export function findBashAllowRule(rules: PermissionRule[], command: string, tool
 		(r) => r.pattern !== undefined && !hasUnescapedWildcard(r.pattern) && unescapeLiteral(r.pattern) === cmd,
 	);
 	if (exact) return exact;
-	if (hasInjectionSyntax(cmd)) return undefined;
-	const subs = bashSubcommands(cmd);
+	// PowerShell lines split on PowerShell's separators and match alias-
+	// canonicalized, case-insensitively (powershell-rules.ts); the shape of
+	// the rule — every statement covered, no injection syntax — is the same.
+	const powershell = normalizeToolName(toolName) === "powershell";
+	if (powershell ? powershellInjectionSyntax(cmd) : hasInjectionSyntax(cmd)) return undefined;
+	const subs = powershell ? powershellStatements(cmd) : bashSubcommands(cmd);
 	if (!subs || subs.length === 0) return undefined;
+	const matches = powershell ? matchesPowerShellPattern : matchesBashPattern;
 	let first: PermissionRule | undefined;
 	for (const sub of subs) {
-		const rule = bashRules.find((r) => r.pattern !== undefined && matchesBashPattern(r.pattern, sub));
+		const rule = bashRules.find((r) => r.pattern !== undefined && matches(r.pattern, sub));
 		if (!rule) return undefined;
 		first ??= rule;
 	}
@@ -329,23 +372,44 @@ export function findBashAllowRule(rules: PermissionRule[], command: string, tool
  * (with `.`/`..` normalised), cwd-relative, and `~/`-relative — never the raw
  * spelling: `Edit(docs/**)` must not match `docs/../src/main.ts`, and a
  * `~/.ssh/id_rsa` subject must hit `Read(~/.ssh/**)` (review P6).
+ *
+ * Every candidate is spelled with forward slashes: patterns are `/`-globs
+ * (gitignore semantics, as in Claude Code), so on Windows the native
+ * `C:\Users\x\docs\a.md` is matched as Claude Code matches it — its POSIX form
+ * `/c/Users/x/docs/a.md` (`lib/paths.ts toPosixPath`, the shape CC's own
+ * Windows rules such as `Read(//c/Users/x/**)` are written in) — and also as
+ * `C:/Users/x/docs/a.md`, so a rule spelled with the drive letter works too.
+ * darwin and win32 compare case-insensitively, like their filesystems.
  */
 export function matchesPathPattern(pattern: string, subject: string, cwd: string): boolean {
 	const home = homedir();
+	const win32 = process.platform === "win32";
 	// Claude Code's rule syntax: `//path` is an absolute filesystem path (the
 	// doubled slash distinguishes it from `/path`, which CC reads relative to
 	// the project root). `Read(//etc/**)` is the form CC's own suggestions write.
-	const expandedPattern = pattern.startsWith("//") ? expandTilde(pattern.slice(1), home) : expandTilde(pattern, home);
+	// A Windows pattern spelled with backslash separators is read as its `/`
+	// form; `\*` and `\\` stay the literal escapes globToRegex documents.
+	const spelled = win32 ? pattern.replace(/\\(?![*\\])/g, "/") : pattern;
+	// `~` in a pattern expands to the home dir spelled with `/` (never `join`,
+	// whose backslashes would read as escapes on Windows); it matches the
+	// `C:/Users/x/…` candidate below.
+	const expandHome = (p: string) => (p === "~" ? forwardSlashes(home) : p.startsWith("~/") ? `${forwardSlashes(home)}/${p.slice(2)}` : p);
+	const expandedPattern = expandHome(spelled.startsWith("//") ? spelled.slice(1) : spelled);
 	const expandedSubject = expandTilde(subject, home);
 
 	const candidates = new Set<string>();
 	const absolute = isAbsolute(expandedSubject) ? resolve(expandedSubject) : resolve(cwd, expandedSubject);
-	candidates.add(absolute);
+	candidates.add(toPosixPath(absolute));
+	if (win32) candidates.add(forwardSlashes(absolute));
 	const rel = relative(cwd, absolute);
-	if (rel && !rel.startsWith("..")) candidates.add(rel);
-	if (absolute.startsWith(`${home}/`)) candidates.add(`~/${absolute.slice(home.length + 1)}`);
-
-	const regex = globToRegex(expandedPattern, true);
+	if (isRelativeInside(rel)) candidates.add(forwardSlashes(rel));
+	const homeRel = relative(resolve(home), absolute);
+	if (isRelativeInside(homeRel)) candidates.add(`~/${forwardSlashes(homeRel)}`);
+
+	// Case-insensitive where the filesystem is (darwin, win32): `Read(~/Notes/**)`
+	// covers `~/notes/a.md`, the same file there — the rule every other
+	// containment check in this file compares by (comparablePath).
+	const regex = globToRegex(expandedPattern, true, foldsCase());
 	for (const candidate of candidates) {
 		if (regex.test(candidate)) return true;
 	}
@@ -362,7 +426,7 @@ export type SubjectKind = "command" | "path" | "url" | "text";
 
 export function subjectKind(toolName: string): SubjectKind {
 	const name = normalizeToolName(toolName);
-	if (name === "bash" || name === "monitor") return "command";
+	if (isShellToolName(name) || name === "monitor") return "command";
 	if (name === "web_fetch") return "url";
 	if (isPathSubjectTool(name)) return "path";
 	return "text";
@@ -391,6 +455,7 @@ export function extractSubject(toolName: string, input: Record<string, unknown>)
 	const str = (key: string): string | undefined => (typeof input[key] === "string" ? (input[key] as string) : undefined);
 	switch (name) {
 		case "bash":
+		case "powershell":
 		case "monitor":
 			return str("command") ?? "";
 		case "web_fetch":
@@ -444,8 +509,7 @@ function matchesUrlPattern(pattern: string, url: string): boolean {
  * `/home/u/project`.
  */
 function toAbsoluteFolded(p: string, cwd: string): string {
-	const absolute = resolve(cwd, expandTilde(p, homedir()));
-	return process.platform === "linux" ? absolute : absolute.toLowerCase();
+	return comparablePath(resolve(cwd, expandTilde(p, homedir())));
 }
 
 function isPlanFilePath(candidate: string, planFilePath: string, cwd: string): boolean {
@@ -460,7 +524,7 @@ function isPlanFilePath(candidate: string, planFilePath: string, cwd: string): b
  * case-folded from `resolveForContainment`.
  */
 export function isInsideDir(candidate: string, dir: string, cwd: string): boolean {
-	return toAbsoluteFolded(candidate, cwd).startsWith(toAbsoluteFolded(dir, cwd) + sep);
+	return toAbsoluteFolded(candidate, cwd).startsWith(`${toAbsoluteFolded(dir, cwd)}/`);
 }
 
 /** `isInsideDir`, plus the directory itself (`ls <cwd>` lists the working directory). */
@@ -478,7 +542,9 @@ export function ruleMatches(rule: PermissionRule, toolName: string, subject: str
 	if (!subject) return false;
 	switch (subjectKind(toolName)) {
 		case "command":
-			return bashPatternMatchesAny(rule.pattern, subject);
+			return normalizeToolName(toolName) === "powershell"
+				? powershellPatternMatchesAny(rule.pattern, subject)
+				: bashPatternMatchesAny(rule.pattern, subject);
 		case "path":
 			return matchesPathPattern(rule.pattern, subject, cwd);
 		case "url":
@@ -514,7 +580,7 @@ export function toolTier(toolName: string): ToolTier {
 	const name = normalizeToolName(toolName);
 	if (SAFE_TOOLS.has(name)) return "safe";
 	if (EDIT_TOOLS.has(name)) return "edit";
-	if (name === "bash") return "execute";
+	if (isShellToolName(name)) return "execute";
 	return "custom";
 }
 
@@ -625,6 +691,17 @@ export interface DecideInput {
 	 * told to read those files back.
 	 */
 	resultsDirPath?: string;
+	/**
+	 * This project's pi session directory (`<agentDir>/sessions/<encoded-cwd>`):
+	 * the session transcripts and, next to them, auto mode's decision log.
+	 * Readable like the working directory — Claude Code lets a session read
+	 * its own project directory under its config root, which is where its
+	 * transcripts live (`checkReadableInternalPath`, "Project directory files
+	 * are allowed for reading"), and /doctor's evidence gathering depends on
+	 * it. Other projects' session directories are not in the set. Never a
+	 * write root: the agent dir stays protected.
+	 */
+	sessionDirPath?: string;
 	/**
 	 * Directories protected at runtime, beyond the static list in
 	 * protected-paths.ts (see `runtimeProtectedDirs()`, the sole producer): pi's
@@ -684,7 +761,7 @@ const DELEGATION_TOOLS = new Set(["Agent", "workflow", "SendMessage"]);
  * surely as `Bash(*)` does.
  */
 const INTERPRETERS_AND_RUNNERS =
-	/^(python[0-9.]*|python3|node|deno|bun|ruby|perl|php|osascript|bash|sh|zsh|fish|pwsh|powershell|eval|exec|env|xargs|nohup|setsid|timeout|make|npx|pnpx|yarn|npm|pnpm|bunx|uv|uvx|pip[0-9]*|poetry|cargo|go|dotnet|java|mvn|gradle|docker|kubectl|ssh)\b/;
+	/^(python[0-9.]*|python3|node|deno|bun|ruby|perl|php|osascript|bash|sh|zsh|fish|pwsh|powershell|cmd|wsl|eval|exec|env|xargs|nohup|setsid|timeout|make|npx|pnpx|yarn|npm|pnpm|bunx|uv|uvx|pip[0-9]*|poetry|cargo|go|dotnet|java|mvn|gradle|docker|kubectl|ssh|invoke-expression|invoke-command|start-process|start-job)\b/;
 
 /**
  * An allow rule broad enough to grant arbitrary code execution. Auto mode
@@ -700,7 +777,7 @@ export function isBroadExecutionRule(rule: PermissionRule): boolean {
 	// Delegation rules are dropped outright: a subagent is a fresh agent loop, so
 	// pre-approving one pre-approves whatever that loop decides to do.
 	if (DELEGATION_TOOLS.has(rule.tool)) return true;
-	if (rule.tool !== "bash") return false;
+	if (!isShellToolName(rule.tool)) return false;
 
 	if (!rule.pattern) return true;
 	const pattern = rule.pattern.trim().toLowerCase();
@@ -710,10 +787,13 @@ export function isBroadExecutionRule(rule: PermissionRule): boolean {
 	if (!hasUnescapedWildcard(pattern)) return false;
 	if (/^(\*|:\*|\*\*)$/.test(pattern)) return true;
 
-	const head = pattern.split(/[\s*]/)[0] ?? "";
+	const rawHead = pattern.split(/[\s*]/)[0] ?? "";
+	// A PowerShell alias is as broad as its cmdlet: `PowerShell(iex *)` is
+	// `Invoke-Expression *`, `PowerShell(saps *)` is `Start-Process *`.
+	const head = rule.tool === "powershell" ? canonicalCommandName(rawHead).toLowerCase() : rawHead;
 	if (!INTERPRETERS_AND_RUNNERS.test(head)) return false;
 
-	const rest = pattern.slice(head.length).trim();
+	const rest = pattern.slice(rawHead.length).trim();
 	// Nothing constrains the arguments: `python*`, `node *`, `npm *`.
 	if (/^[:\s]*\*+$/.test(rest)) return true;
 	// The runner's own escape hatch takes arbitrary code: `npm run *`, `npx *`.
@@ -762,14 +842,21 @@ export function decide(params: DecideInput): Decision {
 		// redirect writes, which it records; a safe verdict with no writes is
 		// exactly read-only. Anything it cannot vouch for is denied as before.
 		// Without this the frontier tier (no grep/find/ls) was left with `read` alone.
+		// The harness's readable session dirs, as the auto-mode pre-gate sees them
+		// (permissions/index.ts `readableRoots`): a plan-mode read of this project's
+		// transcripts is a read like any other.
+		const readableRoots = [params.memoryDirPath, params.scratchpadDirPath, params.resultsDirPath, params.sessionDirPath].filter((d): d is string => !!d).map((d) => resolveForContainment(d) ?? d);
 		if (tool === "bash" && subject) {
-			const evidence = analyzeShellCommand({ command: subject, cwd, home: homedir(), protectedDirs: params.protectedDirs });
+			const evidence = analyzeShellCommand({ command: subject, cwd, home: homedir(), protectedDirs: params.protectedDirs, readableRoots });
 			if (evidence.verdict === "safe" && evidence.writes.length === 0) return { decision: "allow", cause: "plan-readonly" };
 			// Read-only, but of a path outside the working directory: still a read,
 			// so it is put to the user rather than refused as a plan-mode mutation
 			// (the read tools ask for the same path below).
 			if (evidence.readOnlyOutside && evidence.writes.length === 0) return { decision: "ask", cause: "working-dir" };
 		}
+		// The PowerShell counterpart: Claude Code's read-only cmdlet allowlist,
+		// with in-project paths by shape (powershell-rules.ts).
+		if (tool === "powershell" && subject && powershellReadOnly(subject, { cwd, home: homedir(), readableRoots }).readOnly) return { decision: "allow", cause: "plan-readonly" };
 		if (PLAN_READ_ONLY_TOOLS.has(tool)) return { decision: "allow", cause: "plan-readonly" };
 		return { decision: "deny", cause: "plan-mode" };
 	}
@@ -825,7 +912,7 @@ export function decide(params: DecideInput): Decision {
 		mode === "auto"
 			? allow.filter((rule) => {
 					if (isBroadExecutionRule(rule)) return false;
-					if (params.classifyAllShell && rule.tool === "bash") return false;
+					if (params.classifyAllShell && isShellTool(rule.tool)) return false;
 					return true;
 				})
 			: allow;
@@ -857,7 +944,7 @@ export function decide(params: DecideInput): Decision {
 	 */
 	const inWorkingSpace = (): boolean => {
 		const target = params.resolvedSubject ?? subject;
-		const roots = [cwd, params.resolvedCwd, params.memoryDirPath, params.scratchpadDirPath, params.resultsDirPath];
+		const roots = [cwd, params.resolvedCwd, params.memoryDirPath, params.scratchpadDirPath, params.resultsDirPath, params.sessionDirPath];
 		if (roots.some((dir) => dir && isAtOrInsideDir(target, dir, cwd))) return true;
 		return params.planFilePath ? isPlanFilePath(target, params.planFilePath, cwd) : false;
 	};

package/extensions/permissions/modes.ts

@@ -10,12 +10,18 @@
  */
 
 import type { PermissionMode } from "./matcher.ts";
+import { modeCycleKey, pauseGlyph } from "../lib/keys.ts";
 
-/** Footer badge per mode — Claude Code's exact strings and icons. */
+/**
+ * Footer badge per mode — Claude Code's exact strings and icons. The pause
+ * icon is swapped for a single-cell glyph on Windows and WSL, where Windows
+ * Terminal draws U+23F8 two cells wide and over the mode name (lib/keys.ts).
+ */
+const PAUSE = pauseGlyph();
 export const MODE_BADGES: Record<PermissionMode, string> = {
-	default: "⏸ manual mode on",
+	default: `${PAUSE} manual mode on`,
 	acceptEdits: "⏵⏵ accept edits on",
-	plan: "⏸ plan mode on",
+	plan: `${PAUSE} plan mode on`,
 	bypassPermissions: "⏵⏵ bypass permissions on",
 	dontAsk: "⏵⏵ don't ask on",
 	auto: "⏵⏵ auto mode on",
@@ -86,9 +92,11 @@ export function isRealModel(id: string | undefined): id is string {
 /**
  * The key that cycles permission modes. Claude Code cycles on shift+tab and
  * says so in this footer; pi reserves shift+tab for the effort dial, so One Code
- * cycles on ctrl+q (see docs/decisions/modes.md) and the hint names that key.
+ * cycles on ctrl+q (see docs/decisions/modes.md) — alt+m on Windows and WSL,
+ * where pi owns ctrl+q (lib/keys.ts) — and the hint names that key.
  */
-export const CYCLE_KEY_HINT = "ctrl+q to cycle";
+export const CYCLE_KEY = modeCycleKey();
+export const CYCLE_KEY_HINT = `${CYCLE_KEY} to cycle`;
 
 /**
  * The footer badge, with auto mode naming the model screening the calls. That
@@ -110,7 +118,7 @@ export function modeBadge(
 function badgeBase(mode: PermissionMode, opts?: { paused?: boolean; classifierModel?: string }): string {
 	if (mode !== "auto") return MODE_BADGES[mode];
 	const suffix = opts?.classifierModel ? ` · ${shortModelName(opts.classifierModel)}` : "";
-	return opts?.paused ? `⏸ auto mode paused${suffix}` : `${MODE_BADGES.auto}${suffix}`;
+	return opts?.paused ? `${PAUSE} auto mode paused${suffix}` : `${MODE_BADGES.auto}${suffix}`;
 }
 
 /**