qlogicagent 2.13.4 → 2.13.5

package/dist/skills/permissions/operation-classifier.js

@@ -0,0 +1,251 @@
+import path from "node:path";
+import { getDestructiveCommandWarning, getPowerShellDestructiveCommandWarning } from "../tools/shell/destructive-command-warning.js";
+import { extractPatchTargets } from "../tools/patch-tool.js";
+/**
+ * Canonical set of shell-command tool names. This is the single source of truth,
+ * imported and used by BOTH `classifyOperation` (below) AND hook-runner's bash
+ * pre-filter, so the two stay aligned. Includes the `Bash` case-variant.
+ */
+export const SHELL_TOOL_NAMES = new Set(["exec", "bash", "Bash", "shell", "execute_command", "run_command", "terminal"]);
+const PATH_ARG_REGISTRY = {
+    read: ["path"], edit: ["path"], write: ["path"], notebook_edit: ["notebook_path"],
+    file_management: ["path", "source", "destination"],
+    petdex_create: ["output_dir"],
+};
+// patch takes a patch BODY (the `input` arg), with target paths
+// embedded in *** Add/Update/Delete/Move File: lines — NOT a path arg. They are
+// deliberately absent from PATH_ARG_REGISTRY and handled by extractPatchPaths.
+const PATCH_TOOL_NAMES = new Set(["patch"]);
+const RECURSIVE_DELETE_RE = /\brm\s+(-[a-z]*r[a-z]*|--recursive)\b|\b(Remove-Item|ri)\b.*-Recurse/i;
+const DELETE_RE = /\b(rm|del|unlink|Remove-Item|rmdir)\b/i;
+// 已知限制:仅匹配单管道(curl|sh);多级管道(curl|tee|bash)不覆盖。递归删除 + shell helper 覆盖常见破坏性命令。
+const PIPE_NET_TO_SHELL_RE = /\b(curl|wget|iwr|Invoke-WebRequest)\b[^\n|]*\|\s*(sh|bash|iex|Invoke-Expression|powershell)/i;
+// Network-egress shell commands (best-effort). Gates untrusted community shell from
+// exfiltrating via raw commands that bypass the web_fetch/web_search tool deny.
+// Unix tools must appear at a COMMAND position (start of string or after a shell
+// separator) so substrings inside paths (e.g. "ssh" in "cat ~/.ssh/id_rsa") don't
+// false-positive. PowerShell web cmdlets are distinctive enough to match anywhere.
+const NET_EGRESS_RE = /(?:^|[\n;&|(`])\s*(?:sudo\s+)?(?:curl|wget|nc|ncat|netcat|telnet|scp|sftp|rsync|ssh|ftp|certutil|bitsadmin)\b|\b(?:Invoke-WebRequest|iwr|Invoke-RestMethod|irm|Start-BitsTransfer)\b/i;
+export function isWithinWorkspace(resolved, root) {
+    const base = path.resolve(root) + path.sep;
+    const r = path.resolve(resolved);
+    if (process.platform === "win32") {
+        return r.toLowerCase().startsWith(base.toLowerCase()) || r.toLowerCase() === base.slice(0, -1).toLowerCase();
+    }
+    return r.startsWith(base) || r === base.slice(0, -1);
+}
+function resolveAgainstRoot(p, root) {
+    return path.isAbsolute(p) ? path.normalize(p) : path.resolve(root, p);
+}
+function extractPaths(input, root) {
+    const args = input.arguments ?? {};
+    const names = PATH_ARG_REGISTRY[input.toolName] ?? [];
+    const out = [];
+    for (const n of names) {
+        const v = args[n];
+        if (typeof v === "string" && v)
+            out.push(resolveAgainstRoot(v, root));
+    }
+    return out;
+}
+/**
+ * Extract target paths from a patch body. The affected files live
+ * inside the `input` patch text (*** Add/Update/Delete/Move File: lines), not in
+ * a path argument — reuses the patch tool's own marker parser (DRY) so the format
+ * cannot drift. `hasDelete` is true when the patch contains a *** Delete File:.
+ */
+function extractPatchPaths(input, root) {
+    const body = String(input.arguments?.input ?? "");
+    const { paths, deletes } = extractPatchTargets(body);
+    return { paths: paths.map((p) => resolveAgainstRoot(p, root)), hasDelete: deletes.length > 0 };
+}
+/** Focused shell tokenizer: handles single/double quotes, redirection + separator operators.
+ *  NOT a full shell grammar (no var expansion / subshell / command substitution) — enough for path detection.
+ *  On win32 a backslash inside double quotes that is NOT escaping a quote stays literal (Windows paths use `\`). */
+function tokenizeShell(command) {
+    const toks = [];
+    const win = process.platform === "win32";
+    let i = 0;
+    const n = command.length;
+    let cur = "";
+    let curQuoted = false;
+    let has = false;
+    const flush = () => { if (has) {
+        toks.push({ value: cur, quoted: curQuoted });
+        cur = "";
+        curQuoted = false;
+        has = false;
+    } };
+    while (i < n) {
+        const c = command[i];
+        if (c === "'") {
+            has = true;
+            curQuoted = true;
+            i++;
+            while (i < n && command[i] !== "'") {
+                cur += command[i++];
+            }
+            i++;
+            continue;
+        }
+        if (c === '"') {
+            has = true;
+            curQuoted = true;
+            i++;
+            while (i < n && command[i] !== '"') {
+                if (command[i] === "\\" && i + 1 < n && (!win || command[i + 1] === '"' || command[i + 1] === "\\")) {
+                    // escape sequence: drop the backslash, keep the next char. On win32 a `\` NOT
+                    // followed by a quote/backslash is a literal path separator and is kept as-is.
+                    cur += command[i + 1];
+                    i += 2;
+                }
+                else {
+                    cur += command[i++];
+                }
+            }
+            i++;
+            continue;
+        }
+        if (c === " " || c === "\t" || c === "\n") {
+            flush();
+            i++;
+            continue;
+        }
+        // operators (longest match first)
+        if (c === "&" && command[i + 1] === "&") {
+            flush();
+            toks.push({ value: "&&", quoted: false, op: "&&" });
+            i += 2;
+            continue;
+        }
+        if (c === "|" && command[i + 1] === "|") {
+            flush();
+            toks.push({ value: "||", quoted: false, op: "||" });
+            i += 2;
+            continue;
+        }
+        if (c === ">" && command[i + 1] === ">") {
+            flush();
+            toks.push({ value: ">>", quoted: false, op: ">>" });
+            i += 2;
+            continue;
+        }
+        if ((c === "1" || c === "2") && command[i + 1] === ">") {
+            flush();
+            toks.push({ value: c + ">", quoted: false, op: c + ">" });
+            i += 2;
+            continue;
+        }
+        if (c === ">" || c === "<" || c === "|" || c === ";" || c === "(" || c === ")") {
+            flush();
+            toks.push({ value: c, quoted: false, op: c });
+            i++;
+            continue;
+        }
+        has = true;
+        cur += c;
+        i++;
+    }
+    flush();
+    return toks;
+}
+const REDIRECT_OPS = new Set([">", ">>", "1>", "2>", "<"]);
+function looksLikePath(v) {
+    return v.includes("/") || v.includes("\\") || /^[A-Za-z]:/.test(v);
+}
+/**
+ * 提取 shell 命令引用的路径(重定向目标 + Unix/Windows/相对路径),解析为绝对路径。
+ * 移植自 exec validateCommand;win32 下把 /c/Users → C:\Users;跳过单字母 flag(/c /s …);
+ * /dev/null 不计入(由绝对底线另处理)。供 classifyOperation 与 exec validateCommand 共用(单一源)。
+ * 扫描层用聚焦 shell tokenizer(替代正则):正确处理带空格的引号路径、管道/&& 后的路径、
+ * 以及单/双引号内的字面 `>`(不当作重定向)。push() 的过滤/解析逻辑保持不变。
+ */
+export function extractCommandPaths(command, root) {
+    const out = [];
+    const push = (token) => {
+        if (!token)
+            return;
+        // skip Windows-style command flags like /c, /s, /b (not real paths)
+        if (/^\/[a-zA-Z](?:[- ]|$)/.test(token) || /^\/[a-zA-Z]{1,3}$/.test(token))
+            return;
+        let resolved;
+        if (process.platform === "win32" && /^\/[a-zA-Z]\//.test(token)) {
+            const winPath = token.replace(/^\/([a-zA-Z])\//, (_, d) => `${d.toUpperCase()}:\\`).replace(/\//g, "\\");
+            resolved = path.normalize(winPath);
+        }
+        else {
+            resolved = path.isAbsolute(token) ? path.normalize(token) : path.resolve(root, token);
+        }
+        // /dev/null and device/system paths are not "cross-workspace" — absolute floors handle them
+        const norm = resolved.replace(/\\/g, "/");
+        if (norm === "/dev/null" || norm.startsWith("/dev/") || norm.startsWith("/proc/") || norm.startsWith("/sys/"))
+            return;
+        out.push(resolved);
+    };
+    const toks = tokenizeShell(command);
+    for (let k = 0; k < toks.length; k++) {
+        const t = toks[k];
+        if (t.op && REDIRECT_OPS.has(t.op)) {
+            const tgt = toks[k + 1];
+            if (tgt && !tgt.op)
+                push(tgt.value);
+            continue;
+        }
+        if (t.op)
+            continue;
+        if (looksLikePath(t.value))
+            push(t.value);
+    }
+    return out;
+}
+export function classifyOperation(input, ctx) {
+    const meta = input.meta;
+    const registryPaths = extractPaths(input, ctx.workspaceRoot);
+    const patch = PATCH_TOOL_NAMES.has(input.toolName)
+        ? extractPatchPaths(input, ctx.workspaceRoot)
+        : { paths: [], hasDelete: false };
+    const paths = [...registryPaths, ...patch.paths];
+    let isDelete = meta?.isDelete === true || patch.hasDelete;
+    let isRecursiveDelete = false;
+    let isDestructive = false;
+    let commandNetworkEgress = false;
+    if (SHELL_TOOL_NAMES.has(input.toolName)) {
+        const cmd = String(input.arguments?.command ?? input.arguments?.cmd ?? "");
+        if (cmd) {
+            const warn = getDestructiveCommandWarning(cmd) ?? getPowerShellDestructiveCommandWarning(cmd);
+            isDestructive = Boolean(warn) || PIPE_NET_TO_SHELL_RE.test(cmd);
+            if (DELETE_RE.test(cmd))
+                isDelete = true;
+            if (RECURSIVE_DELETE_RE.test(cmd)) {
+                isDelete = true;
+                isRecursiveDelete = true;
+            }
+            // A recursive delete is always destructive even if shell helper missed it
+            if (isRecursiveDelete)
+                isDestructive = true;
+            commandNetworkEgress = NET_EGRESS_RE.test(cmd);
+            // Feed command-referenced paths into the workspace classifier
+            paths.push(...extractCommandPaths(cmd, ctx.workspaceRoot));
+        }
+    }
+    const hasPaths = paths.length > 0;
+    const crossWorkspace = paths.some((p) => !isWithinWorkspace(p, ctx.workspaceRoot));
+    const inWorkspace = hasPaths && !crossWorkspace;
+    // team(action="send") is the merged send_message: message content leaves the
+    // current agent context to teammates, so it keeps the data-egress ask gate the
+    // standalone tool carried via meta flags. Other team actions are local
+    // management, not egress — args-aware like commandNetworkEgress above.
+    const teamSend = input.toolName === "team"
+        && input.arguments?.action === "send";
+    return {
+        targetPaths: paths,
+        inWorkspace,
+        crossWorkspace,
+        isDelete,
+        isRecursiveDelete,
+        isEgress: meta?.isEgress === true || teamSend,
+        egressCarriesData: meta?.egressCarriesData === true || teamSend,
+        isDestructive,
+        commandNetworkEgress,
+    };
+}

package/dist/skills/permissions/permission-classifier.d.ts

@@ -0,0 +1,41 @@
+import type { ChatMessage } from "../../protocol/wire/index.js";
+export interface ClassifierResult {
+    shouldBlock: boolean;
+    reason: string;
+    stage: "allowlist" | "fast" | "thinking";
+    durationMs: number;
+}
+/**
+ * LLM call interfaceinjected by the host so the classifier
+ * doesn't depend on a specific LLM client.
+ */
+export interface ClassifierLLMCall {
+    (params: {
+        system: string;
+        messages: Array<{
+            role: "user" | "assistant";
+            content: string;
+        }>;
+        maxTokens: number;
+        temperature: number;
+        stop?: string[];
+        /** If true, host should cache the system prompt (cc cache_control). */
+        cacheSystemPrompt?: boolean;
+    }): Promise<{
+        text: string;
+        usage?: {
+            promptTokens: number;
+            completionTokens: number;
+        };
+    }>;
+}
+export declare function isAutoModeAllowlistedTool(toolName: string): boolean;
+/**
+ * Two-stage XML classifier for auto-mode permission decisions.
+ *
+ * Stage 1 (fast): Quick classification with minimal tokens.
+ * Stage 2 (thinking): Only if stage 1 blocks, do a more careful review.
+ *
+ * cc reference: classifyYoloAction() in yoloClassifier.ts
+ */
+export declare function classifyToolAction(toolName: string, toolArgs: Record<string, unknown>, recentMessages: ChatMessage[], llmCall: ClassifierLLMCall): Promise<ClassifierResult>;

package/dist/skills/permissions/permission-classifier.js

@@ -0,0 +1,186 @@
+// ============================================================
+// Permission Classifiercc-aligned auto-mode LLM classifier
+//
+// Two-stage XML classifier (cc yoloClassifier pattern):
+//   Stage 1: Fast classification (max 64 tokens) -> block/allow
+//   Stage 2: Thinking review (max 4096 tokens) -> if stage 1 blocks
+//
+// Safe-tool allowlist: Known read-only tools skip classifier entirely.
+//
+// cc reference: utils/permissions/yoloClassifier.ts
+// ============================================================
+// ── Safe Tool Allowlist (skip classifier entirely) ──────────
+/**
+ * Tools that are inherently safe and never need classifier approval.
+ * cc reference: isAutoModeAllowlistedTool()
+ */
+const SAFE_TOOLS = new Set([
+    // Read-only file operations
+    "read",
+    "search",
+    "instructions",
+    "task",
+    // Memory (read via search action)
+    "memory",
+    // Skill (list/view actions are read-only)
+    "skill",
+    "tool_search",
+    // Plan mode
+    "plan_mode",
+    // LSP (read-only operations)
+    "lsp",
+    // Brief
+    "brief",
+    // Web search (read-only)
+    "web_search",
+    // User-requested provider media generation from the main interactive agent.
+    // Community skills are still guarded by the community sandbox rule engine
+    // before this allowlist is considered.
+    "image_generate",
+    "video_generate",
+    "music_generate",
+    "tts",
+    "three_d_generate",
+    // Checkpoint list/diff
+    "checkpoint", // list and diff actions are read-only at tool level
+]);
+export function isAutoModeAllowlistedTool(toolName) {
+    return SAFE_TOOLS.has(toolName);
+}
+// ── System Prompt ───────────────────────────────────────────
+const CLASSIFIER_SYSTEM_PROMPT = `You are a security classifier for an AI coding agent. Your job is to decide whether a tool invocation is safe to execute without user confirmation.
+
+The agent operates in a workspace and has been given permission to use tools autonomously. You must decide if each tool call is SAFE (routine development work) or DANGEROUS (could cause harm, data loss, or unexpected side effects).
+
+SAFE operations (should NOT be blocked):
+- Reading, writing, editing code files in the project
+- Running build commands, test commands, linters
+- Installing project dependencies (npm install, pip install, etc.)
+- Git operations within the project (add, commit, status, diff, log)
+- Creating/modifying config files (.env, tsconfig.json, etc.)
+- Running development servers locally
+
+DANGEROUS operations (SHOULD be blocked):
+- Deleting files outside the project directory
+- Running commands that modify system configuration
+- Network requests to unknown/suspicious URLs
+- Commands that could leak secrets or credentials
+- Force-pushing to remote repositories
+- Modifying system files (/etc, registry, etc.)
+- Running commands with sudo/admin privileges
+- Downloading and executing unknown scripts
+
+Respond ONLY with XML. No other text.`;
+// ── Classifier ──────────────────────────────────────────────
+/**
+ * Two-stage XML classifier for auto-mode permission decisions.
+ *
+ * Stage 1 (fast): Quick classification with minimal tokens.
+ * Stage 2 (thinking): Only if stage 1 blocks, do a more careful review.
+ *
+ * cc reference: classifyYoloAction() in yoloClassifier.ts
+ */
+export async function classifyToolAction(toolName, toolArgs, recentMessages, llmCall) {
+    const start = Date.now();
+    // Fast-path: allowlisted tools always pass
+    if (isAutoModeAllowlistedTool(toolName)) {
+        return {
+            shouldBlock: false,
+            reason: "allowlisted safe tool",
+            stage: "allowlist",
+            durationMs: Date.now() - start,
+        };
+    }
+    // Build transcript context (compact, cc-style)
+    const transcript = buildTranscript(recentMessages);
+    const actionText = formatToolAction(toolName, toolArgs);
+    // ── Stage 1: Fast classification ────────────────────────
+    const stage1Prompt = `<transcript>\n${transcript}\n</transcript>\n\n<action>\n${actionText}\n</action>\n\nShould this action be blocked? Respond with <block>yes</block> or <block>no</block>. If blocking, add <reason>explanation</reason>.`;
+    try {
+        const stage1 = await llmCall({
+            system: CLASSIFIER_SYSTEM_PROMPT,
+            messages: [{ role: "user", content: stage1Prompt }],
+            maxTokens: 64,
+            temperature: 0,
+            stop: ["</reason>"],
+            cacheSystemPrompt: true,
+        });
+        const stage1Text = stripThinking(stage1.text);
+        const stage1Block = parseXmlBlock(stage1Text);
+        // If stage 1 says "not blocked" -> allow immediately
+        if (stage1Block === false) {
+            return {
+                shouldBlock: false,
+                reason: "classifier: safe",
+                stage: "fast",
+                durationMs: Date.now() - start,
+            };
+        }
+        // ── Stage 2: Thinking review (only if stage 1 blocks) ─
+        const stage2Prompt = `<transcript>\n${transcript}\n</transcript>\n\n<action>\n${actionText}\n</action>\n\nThe fast classifier flagged this action. Review carefullyis it actually dangerous, or is it safe development work? Consider the project context. Use <thinking> tags to reason, then respond with <block>yes</block> or <block>no</block> and <reason>explanation</reason>.`;
+        const stage2 = await llmCall({
+            system: CLASSIFIER_SYSTEM_PROMPT,
+            messages: [{ role: "user", content: stage2Prompt }],
+            maxTokens: 4096,
+            temperature: 0,
+            cacheSystemPrompt: true,
+        });
+        const stage2Text = stripThinking(stage2.text);
+        const stage2Block = parseXmlBlock(stage2Text);
+        const reason = parseXmlReason(stage2Text) ?? parseXmlReason(stage1Text) ?? "classifier decision";
+        return {
+            shouldBlock: stage2Block !== false, // null (parse fail) -> block conservatively
+            reason,
+            stage: "thinking",
+            durationMs: Date.now() - start,
+        };
+    }
+    catch {
+        // Classifier error -> fall back to blocking (safe default)
+        return {
+            shouldBlock: true,
+            reason: "classifier unavailable",
+            stage: "fast",
+            durationMs: Date.now() - start,
+        };
+    }
+}
+// ── Helpers ─────────────────────────────────────────────────
+function buildTranscript(messages) {
+    // Take the last 20 messages for context (cc uses full transcript but truncates)
+    const recent = messages.slice(-20);
+    return recent
+        .map((m) => {
+        const role = m.role === "user" ? "User" : m.role === "assistant" ? "Assistant" : "System";
+        const text = typeof m.content === "string"
+            ? m.content.slice(0, 500) // Truncate long messages
+            : JSON.stringify(m.content).slice(0, 500);
+        return `${role}: ${text}`;
+    })
+        .join("\n");
+}
+function formatToolAction(toolName, args) {
+    // Compact representation (cc: Tool.toAutoClassifierInput)
+    const argStr = JSON.stringify(args, null, 0);
+    const truncated = argStr.length > 2000 ? argStr.slice(0, 2000) + "..." : argStr;
+    return `Tool: ${toolName}\nArguments: ${truncated}`;
+}
+function parseXmlBlock(text) {
+    const match = text.match(/<block>(yes|no)<\/block>/i);
+    if (!match)
+        return null;
+    return match[1].toLowerCase() === "yes";
+}
+function parseXmlReason(text) {
+    const match = text.match(/<reason>([\s\S]*?)(?:<\/reason>|$)/i);
+    return match ? match[1].trim() : null;
+}
+/**
+ * Strip <thinking>...</thinking> tags from classifier output.
+ * CC reference: stripThinking() in yoloClassifier.ts
+ * Models may emit thinking blocks before the XML decisionstrip them
+ * so parseXmlBlock/parseXmlReason only see the actual classification.
+ */
+function stripThinking(text) {
+    return text.replace(/<thinking>[\s\S]*?<\/thinking>/gi, "").trim();
+}

package/dist/skills/permissions/rule-engine.d.ts

@@ -0,0 +1,49 @@
+import type { OperationClassification } from "./operation-classifier.js";
+import type { PermissionMode, PermissionBehavior, PermissionResult, PermissionRuleEntry, PermissionEngineConfig, ToolPermissionCheckInput } from "./types.js";
+export declare class PermissionRuleEngine {
+    private mode;
+    private rules;
+    private sessionRules;
+    private compiledPatterns;
+    constructor(config: PermissionEngineConfig);
+    getMode(): PermissionMode;
+    setMode(mode: PermissionMode): void;
+    getRules(): readonly PermissionRuleEntry[];
+    /** Replace all persistent rules at once (for settings hot-reload). Session rules are preserved. */
+    replaceRules(rules: PermissionRuleEntry[]): void;
+    addRule(rule: PermissionRuleEntry): void;
+    /** Add a session-scoped rule (e.g. "remember directory" approvals). */
+    addSessionRule(rule: {
+        pathPrefix?: string;
+        pattern?: string;
+        behavior?: PermissionBehavior;
+    }): void;
+    /** sandbox 可写根:rules + sessionRules 中 allow 且带 pathPrefix 的目录(去重)。 */
+    getAllowedWriteDirectories(): string[];
+    /**
+     * Workspace + danger decision pipeline.
+     *
+     * `op` is optional and defaults to an all-false classification so callers
+     * that have not yet been wired to the classifier keep compiling.
+     */
+    check(input: ToolPermissionCheckInput, op?: OperationClassification, ctx?: {
+        extraRules?: readonly PermissionRuleEntry[];
+    }): PermissionResult;
+    /** Rebuild compiledPatterns: [persistent-deny] → [session] → [persistent non-deny]. */
+    private recompile;
+    private matchCompiledRules;
+    /**
+     * Match a caller-supplied rule set (deny-first) against this call, using the SAME
+     * matching semantics as the base rules (pathPrefix prefix-match, else toolName glob).
+     * Returns the first hit's result, or null if none match. Used for per-call scoped
+     * rules (community-skill turns) so trust-level restrictions stay in the one engine.
+     */
+    private matchRuleSet;
+}
+/**
+ * Parse permission config from Gateway-injected or local settings.
+ *
+ * Accepts the user-facing permission mode plus the persistent `rules` channel.
+ * Legacy top-level alias keys (allow/deny/ask arrays, default) are still rejected.
+ */
+export declare function parsePermissionConfig(raw: unknown): PermissionEngineConfig;