reasonix 0.26.0 → 0.26.1

package/dist/index.d.ts

@@ -1191,7 +1191,7 @@ interface ShellToolsOptions {
 declare function tokenizeCommand(cmd: string): string[];
 /** Up-front detection — without it, `dir | findstr foo` quotes `|` literal and pipe silently fails. */
 declare function detectShellOperator(cmd: string): string | null;
-/** Match on space-normalized leading tokens — `git   status  -s` matches the `git status` prefix. */
+/** Allowlist match on leading argv tokens; demoted by `RISKY_ARGS` when a destructive flag appears in the tail. */
 declare function isAllowed(cmd: string, extra?: readonly string[]): boolean;
 interface RunCommandResult {
     exitCode: number | null;

package/dist/index.js

@@ -6406,12 +6406,65 @@ function detectShellOperator(cmd) {
   if (quote) return null;
   return check();
 }
+var RISKY_ARGS = {
+  // Branch / remote mutation
+  "git branch": ["-d", "-D", "--delete", "-m", "-M", "--move", "-c", "-C", "--copy", "--force"],
+  "git remote": ["add", "remove", "rm", "rename", "set-url", "set-head", "prune"],
+  // `--output` writes to an arbitrary path; `--ext-diff` invokes user-config'd external programs.
+  "git diff": ["--output", "--ext-diff"],
+  "git log": ["--output"],
+  "git show": ["--output"],
+  // `-exec*` / `-ok*` are RCE; `-delete` and `-fprint*` / `-fls` write to arbitrary paths.
+  find: [
+    "-delete",
+    "-exec",
+    "-execdir",
+    "-ok",
+    "-okdir",
+    "-fprint",
+    "-fprint0",
+    "-fprintf",
+    "-fls"
+  ],
+  // `-o FILE` writes the tree to an arbitrary path.
+  tree: ["-o"],
+  // Auto-fix mutates source files.
+  "npx eslint": ["--fix", "--fix-dry-run"],
+  "npx biome check": ["--write", "--apply", "--apply-unsafe"],
+  ruff: ["--fix", "--unsafe-fixes", "format"]
+};
+function tailHasRisky(tail, risky) {
+  for (const a of tail) {
+    for (const r of risky) {
+      if (a === r) return true;
+      if (a.startsWith(`${r}=`)) return true;
+    }
+  }
+  return false;
+}
 function isAllowed(cmd, extra = []) {
-  const normalized = cmd.trim().replace(/\s+/g, " ");
+  let argv;
+  try {
+    argv = tokenizeCommand(cmd);
+  } catch {
+    return false;
+  }
+  if (argv.length === 0) return false;
   const allowlist = [...BUILTIN_ALLOWLIST, ...extra];
   for (const prefix of allowlist) {
-    if (normalized === prefix) return true;
-    if (normalized.startsWith(`${prefix} `)) return true;
+    const prefixTokens = prefix.split(" ");
+    if (argv.length < prefixTokens.length) continue;
+    let match = true;
+    for (let i = 0; i < prefixTokens.length; i++) {
+      if (argv[i] !== prefixTokens[i]) {
+        match = false;
+        break;
+      }
+    }
+    if (!match) continue;
+    const risky = RISKY_ARGS[prefix];
+    if (risky && tailHasRisky(argv.slice(prefixTokens.length), risky)) return false;
+    return true;
   }
   return false;
 }