sift-light 1.0.0

package/src/search-policy-recovery.ts

@@ -0,0 +1,388 @@
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import type { SearchKind } from "./search-policy-commands.js";
+import { SiftLightError } from "./errors.js";
+import { validateRawSearchInput, type RawSearchInput } from "./request.js";
+import type { ShellSearchMatch } from "./search-policy-shell.js";
+
+export interface ConcreteSearchRecovery {
+  kind: "concrete";
+  request: string;
+}
+
+export interface ManualSearchRecovery {
+  kind: "manual";
+  reason: string;
+}
+
+export type SearchRecovery = ConcreteSearchRecovery | ManualSearchRecovery;
+
+interface ParsedRipgrepRequest {
+  pattern: string;
+  path: string;
+  literal: boolean;
+  ignoreCase: boolean | undefined;
+  hidden: boolean;
+  wholeWord: boolean;
+  glob: string[];
+  exclude: string[];
+  noConfig: boolean;
+  pathWasProvided: boolean;
+}
+
+const CONTENT_MANUAL_REASON =
+  "the command is not one standalone static rg search using the supported option and single-target subset";
+const FILE_MANUAL_REASON =
+  "the command is not a plain `find <root> -type f` enumeration, so depth limits, multiple or case-insensitive name predicates, extra tests and other actions cannot be expressed as one files request with the same scope";
+
+function manual(kind: SearchKind): ManualSearchRecovery {
+  return { kind: "manual", reason: kind === "files" ? FILE_MANUAL_REASON : CONTENT_MANUAL_REASON };
+}
+
+interface ParsedFindRequest {
+  root: string;
+  glob?: string;
+}
+
+function pushGlob(
+  value: string,
+  include: string[],
+  exclude: string[],
+  exclusionSeen: boolean,
+): boolean | undefined {
+  if (value.length === 0 || value.startsWith("\\!") || value.startsWith("!!")) return undefined;
+  if (value.startsWith("!")) {
+    if (value.length === 1) return undefined;
+    exclude.push(value.slice(1));
+    return true;
+  }
+  // The MCP runner applies every exclusion after every inclusion. A later positive rg glob
+  // could re-include an earlier exclusion, so that ordering cannot be represented faithfully.
+  if (exclusionSeen) return undefined;
+  include.push(value);
+  return false;
+}
+
+function parseRipgrepArguments(args: readonly string[]): ParsedRipgrepRequest | undefined {
+  let pattern: string | undefined;
+  const paths: string[] = [];
+  const glob: string[] = [];
+  const exclude: string[] = [];
+  let literal = false;
+  let ignoreCase: boolean | undefined = false;
+  let hidden = false;
+  let wholeWord = false;
+  let noConfig = false;
+  let optionsEnded = false;
+  let exclusionSeen = false;
+
+  const takePattern = (value: string): boolean => {
+    if (pattern !== undefined) return false;
+    pattern = value;
+    return true;
+  };
+
+  for (let index = 0; index < args.length; index += 1) {
+    const value = args[index];
+    if (value === undefined) return undefined;
+    if (optionsEnded || !value.startsWith("-") || value === "-") {
+      if (!takePattern(value)) paths.push(value);
+      continue;
+    }
+    if (value === "--") {
+      optionsEnded = true;
+      continue;
+    }
+    if (value.startsWith("--")) {
+      const separator = value.indexOf("=");
+      const option = separator < 0 ? value : value.slice(0, separator);
+      const inlineValue = separator < 0 ? undefined : value.slice(separator + 1);
+      if (
+        [
+          "--line-number",
+          "--no-line-number",
+          "--heading",
+          "--no-heading",
+          "--with-filename",
+          "--no-filename",
+        ].includes(option)
+      ) {
+        if (inlineValue !== undefined) return undefined;
+        continue;
+      }
+      if (option === "--no-config") {
+        if (inlineValue !== undefined) return undefined;
+        noConfig = true;
+        continue;
+      }
+      if (option === "--fixed-strings" || option === "--no-fixed-strings") {
+        if (inlineValue !== undefined) return undefined;
+        literal = option === "--fixed-strings";
+        continue;
+      }
+      if (["--ignore-case", "--case-sensitive", "--smart-case"].includes(option)) {
+        if (inlineValue !== undefined) return undefined;
+        ignoreCase =
+          option === "--ignore-case" ? true : option === "--case-sensitive" ? false : undefined;
+        continue;
+      }
+      if (option === "--hidden" || option === "--no-hidden") {
+        if (inlineValue !== undefined) return undefined;
+        hidden = option === "--hidden";
+        continue;
+      }
+      if (option === "--word-regexp" || option === "--no-word-regexp") {
+        if (inlineValue !== undefined) return undefined;
+        wholeWord = option === "--word-regexp";
+        continue;
+      }
+      if (option === "--regexp") {
+        const next = inlineValue ?? args[index + 1];
+        if (next === undefined || !takePattern(next)) return undefined;
+        if (inlineValue === undefined) index += 1;
+        continue;
+      }
+      if (option === "--glob") {
+        const next = inlineValue ?? args[index + 1];
+        if (next === undefined) return undefined;
+        const excluded = pushGlob(next, glob, exclude, exclusionSeen);
+        if (excluded === undefined) return undefined;
+        exclusionSeen ||= excluded;
+        if (inlineValue === undefined) index += 1;
+        continue;
+      }
+      if (option === "--color") {
+        const next = inlineValue ?? args[index + 1];
+        if (next === undefined || !["never", "auto", "always", "ansi"].includes(next))
+          return undefined;
+        if (inlineValue === undefined) index += 1;
+        continue;
+      }
+      return undefined;
+    }
+
+    for (let offset = 1; offset < value.length; offset += 1) {
+      const option = value[offset];
+      if (option === undefined) return undefined;
+      if (["n", "N", "H"].includes(option)) continue;
+      if (option === "F") {
+        literal = true;
+        continue;
+      }
+      if (option === "i" || option === "s" || option === "S") {
+        ignoreCase = option === "i" ? true : option === "s" ? false : undefined;
+        continue;
+      }
+      if (option === "w") {
+        wholeWord = true;
+        continue;
+      }
+      if (option === "e") {
+        const next = value.slice(offset + 1) || args[index + 1];
+        if (next === undefined || !takePattern(next)) return undefined;
+        if (value.slice(offset + 1).length === 0) index += 1;
+        offset = value.length;
+        continue;
+      }
+      if (option === "g") {
+        const next = value.slice(offset + 1) || args[index + 1];
+        if (next === undefined) return undefined;
+        const excluded = pushGlob(next, glob, exclude, exclusionSeen);
+        if (excluded === undefined) return undefined;
+        exclusionSeen ||= excluded;
+        if (value.slice(offset + 1).length === 0) index += 1;
+        offset = value.length;
+        continue;
+      }
+      return undefined;
+    }
+  }
+
+  if (pattern === undefined || paths.length > 1 || paths[0] === "-") return undefined;
+  return {
+    pattern,
+    path: paths[0] ?? ".",
+    literal,
+    ignoreCase,
+    hidden,
+    wholeWord,
+    glob,
+    exclude,
+    noConfig,
+    pathWasProvided: paths.length === 1,
+  };
+}
+
+function listValue(values: readonly string[]): string | string[] | undefined {
+  if (values.length === 0) return undefined;
+  return values.length === 1 ? values[0] : [...values];
+}
+
+function isStandalone(command: string, match: ShellSearchMatch): boolean {
+  if (match.nestedDepth > 0) return false;
+  const bytes = Buffer.from(command, "utf8");
+  if (match.startByte < 0 || match.endByte > bytes.length || match.startByte > match.endByte)
+    return false;
+  return (
+    bytes.subarray(0, match.startByte).toString("utf8").trim().length === 0 &&
+    bytes.subarray(match.endByte).toString("utf8").trim().length === 0
+  );
+}
+
+function isPlatformPathSeparator(character: string): boolean {
+  return character === sep || (process.platform === "win32" && character === "/");
+}
+
+function hasNormalizationSensitivePath(path: string): boolean {
+  if (isPlatformPathSeparator(path.at(-1) ?? "")) return true;
+  if (process.platform === "win32" && /^[A-Za-z]:(?![\\/])/u.test(path)) return true;
+  const segments = path.split(process.platform === "win32" ? /[\\/]/u : "/");
+  let namedSegmentSeen = isAbsolute(path);
+  for (const segment of segments) {
+    if (segment === "..") return true;
+    if (segment === ".") {
+      if (namedSegmentSeen) return true;
+      continue;
+    }
+    if (segment.length > 0) namedSegmentSeen = true;
+  }
+  return false;
+}
+
+function isRipgrepExecutable(executable: string, language: ShellSearchMatch["language"]): boolean {
+  const name = executable.split(/[\\/]/u).at(-1) ?? executable;
+  const normalized =
+    language === "powershell" || process.platform === "win32" ? name.toLowerCase() : name;
+  return (
+    normalized === "rg" ||
+    normalized === "ripgrep" ||
+    ((language === "powershell" || process.platform === "win32") &&
+      (normalized === "rg.exe" || normalized === "ripgrep.exe"))
+  );
+}
+
+function isFindExecutable(executable: string, language: ShellSearchMatch["language"]): boolean {
+  const name = executable.split(/[\\/]/u).at(-1) ?? executable;
+  const normalized =
+    language === "powershell" || process.platform === "win32" ? name.toLowerCase() : name;
+  return (
+    normalized === "find" ||
+    ((language === "powershell" || process.platform === "win32") && normalized === "find.exe")
+  );
+}
+
+/** Accepts only `find <root> [-name <pattern>] -type f [-print|-print0]`, in any option order. */
+function parseFindArguments(args: readonly string[]): ParsedFindRequest | undefined {
+  let root: string | undefined;
+  let glob: string | undefined;
+  let typeFile = false;
+  for (let index = 0; index < args.length; index += 1) {
+    const value = args[index];
+    if (value === undefined) return undefined;
+    if (!value.startsWith("-") || value === "-") {
+      if (root !== undefined) return undefined;
+      root = value;
+      continue;
+    }
+    if (value === "-print" || value === "-print0") continue;
+    if (value === "-type") {
+      const next = args[index + 1];
+      if (next === undefined || next !== "f") return undefined;
+      index += 1;
+      typeFile = true;
+      continue;
+    }
+    if (value === "-name") {
+      const next = args[index + 1];
+      if (next === undefined || glob !== undefined) return undefined;
+      index += 1;
+      glob = next;
+      continue;
+    }
+    return undefined;
+  }
+  if (!typeFile || root === undefined || root.length === 0) return undefined;
+  return glob === undefined ? { root } : { root, glob };
+}
+
+function recoverFileEnumeration(
+  argv: readonly string[],
+  language: ShellSearchMatch["language"],
+  workingDirectory: string,
+): SearchRecovery {
+  const executable = argv[0];
+  if (executable === undefined || !isFindExecutable(executable, language)) return manual("files");
+  const parsed = parseFindArguments(argv.slice(1));
+  if (!parsed) return manual("files");
+  if (hasNormalizationSensitivePath(parsed.root)) return manual("files");
+  const base = resolve(workingDirectory);
+  const path = resolve(base, parsed.root);
+  const localPath = relative(base, path);
+  if (isAbsolute(localPath) || localPath === ".." || localPath.startsWith(`..${sep}`))
+    return manual("files");
+  if (path.split(/[\\/]/u).some((part) => part.toLowerCase() === ".git")) return manual("files");
+  const filters: RawSearchInput = {
+    path,
+    ...(parsed.glob === undefined ? {} : { glob: parsed.glob }),
+  };
+  try {
+    validateRawSearchInput(filters);
+  } catch (error) {
+    if (error instanceof SiftLightError) return manual("files");
+    throw error;
+  }
+  return { kind: "concrete", request: JSON.stringify({ mode: "files", ...filters }) };
+}
+
+export function recoverShellSearch(
+  command: string,
+  match: ShellSearchMatch,
+  workingDirectory: string | undefined,
+): SearchRecovery {
+  if (workingDirectory === undefined) return manual(match.kind);
+  if (match.hasVariableAssignments || match.hasUntranslatedShellSyntax || match.hasSyntaxError)
+    return manual(match.kind);
+  const argv: readonly string[] = match.argv.filter((value): value is string => value !== null);
+  if (argv.length !== match.argv.length) return manual(match.kind);
+  // File enumeration rewrites only the retained `find` expression, so a compound
+  // atomic call still reports that nothing ran and the two parts are replayed separately.
+  if (match.kind === "files") return recoverFileEnumeration(argv, match.language, workingDirectory);
+  if (!isStandalone(command, match)) return manual(match.kind);
+  const executable = argv[0];
+  if (executable === undefined || !isRipgrepExecutable(executable, match.language))
+    return manual(match.kind);
+  const parsed = parseRipgrepArguments(argv.slice(1));
+  if (!parsed) return manual(match.kind);
+  if (!parsed.noConfig && (process.env.RIPGREP_CONFIG_PATH?.length ?? 0) > 0)
+    return manual(match.kind);
+  if (!parsed.pathWasProvided) return manual(match.kind);
+  if (parsed.path.length === 0) return manual(match.kind);
+  if (hasNormalizationSensitivePath(parsed.path)) return manual(match.kind);
+
+  const base = resolve(workingDirectory);
+  const path = resolve(base, parsed.path);
+  const localPath = relative(base, path);
+  if (isAbsolute(localPath) || localPath === ".." || localPath.startsWith(`..${sep}`))
+    return manual(match.kind);
+  if (path.split(/[\\/]/u).some((part) => part.toLowerCase() === ".git")) return manual(match.kind);
+
+  const glob = listValue(parsed.glob);
+  const exclude = listValue(parsed.exclude);
+  const request: RawSearchInput = {
+    pattern: parsed.pattern,
+    ...(parsed.literal ? { literal: true } : {}),
+    ...(parsed.ignoreCase === undefined ? {} : { ignoreCase: parsed.ignoreCase }),
+    ...(parsed.wholeWord ? { wholeWord: true } : {}),
+    ...(glob === undefined ? {} : { glob }),
+    ...(exclude === undefined ? {} : { exclude }),
+    hidden: parsed.hidden,
+    path,
+    scope: "strict",
+  };
+  try {
+    validateRawSearchInput(request);
+  } catch (error) {
+    if (error instanceof SiftLightError) return manual(match.kind);
+    throw error;
+  }
+  return { kind: "concrete", request: JSON.stringify(request) };
+}

package/src/search-policy-shell.ts

@@ -0,0 +1,280 @@
+import { fileURLToPath } from "node:url";
+import { Language, Parser, type Node } from "web-tree-sitter";
+import {
+  classifyCommand,
+  executableName,
+  type SearchKind,
+  type ShellLanguage,
+} from "./search-policy-commands.js";
+
+export const MAX_POLICY_COMMAND_BYTES = 64 * 1024;
+const MAX_SHELL_NESTING = 4;
+
+export interface ShellSearchMatch {
+  kind: SearchKind;
+  command: string;
+  argv: readonly (string | null)[];
+  hasUntranslatedShellSyntax: boolean;
+  hasVariableAssignments: boolean;
+  hasSyntaxError: boolean;
+  commandIndex: number;
+  startByte: number;
+  endByte: number;
+  nestedDepth: number;
+  language: ShellLanguage;
+}
+
+interface InspectionState {
+  nextCommandIndex: number;
+}
+
+function decodeBashDoubleQuoted(value: string): string {
+  let result = "";
+  for (let index = 0; index < value.length; index += 1) {
+    const character = value[index];
+    if (character !== "\\") {
+      result += character;
+      continue;
+    }
+    const next = value[index + 1];
+    if (next === undefined || !["$", "`", '"', "\\", "\n"].includes(next)) {
+      result += character;
+      continue;
+    }
+    if (next !== "\n") result += next;
+    index += 1;
+  }
+  return result;
+}
+
+function decodePowerShellSingleQuoted(value: string): string | null {
+  if (!(value.length >= 2 && value.startsWith("'") && value.endsWith("'"))) return null;
+  const body = value.slice(1, -1);
+  let result = "";
+  for (let index = 0; index < body.length; index += 1) {
+    const character = body[index];
+    if (character !== "'") {
+      result += character;
+      continue;
+    }
+    if (body[index + 1] !== "'") return null;
+    result += "'";
+    index += 1;
+  }
+  return result;
+}
+
+function literalWord(node: Node, language: ShellLanguage): string | null {
+  const text = node.text;
+  if (language === "powershell") {
+    const singleQuoted = decodePowerShellSingleQuoted(text);
+    if (singleQuoted !== null) return singleQuoted;
+    if (node.descendantsOfType(["variable", "sub_expression"]).length > 0) return null;
+    const quoted = text.length >= 2 && text.startsWith('"') && text.endsWith('"');
+    if (!quoted && !["command_name", "generic_token", "command_parameter"].includes(node.type))
+      return null;
+    const unquoted = quoted ? text.slice(1, -1) : text;
+    return unquoted.replace(/`([`"'$])/gu, "$1");
+  }
+  if (node.type === "raw_string")
+    return text.length >= 2 && text.startsWith("'") && text.endsWith("'")
+      ? text.slice(1, -1)
+      : null;
+  if (node.type === "string_content") return decodeBashDoubleQuoted(text);
+  if (node.type === "word" || node.type === "number") return text.replace(/\\(.)/gsu, "$1");
+  if (["command_name", "concatenation", "string"].includes(node.type)) {
+    if (node.type === "string" && !(text.length >= 2 && text.startsWith('"') && text.endsWith('"')))
+      return null;
+    let result = "";
+    for (const child of node.namedChildren) {
+      if (!child) continue;
+      const part = literalWord(child, language);
+      if (part === null) return null;
+      result += part;
+    }
+    return result;
+  }
+  return null;
+}
+
+function commandWordNodes(node: Node, language: ShellLanguage): Node[] {
+  const name = node.childForFieldName(language === "bash" ? "name" : "command_name");
+  if (!name) return [];
+  const args =
+    language === "bash"
+      ? node.childrenForFieldName("argument").filter((child): child is Node => child !== null)
+      : (node
+          .childForFieldName("command_elements")
+          ?.namedChildren.filter(
+            (child): child is Node =>
+              child !== null && !["command_argument_sep", "redirection"].includes(child.type),
+          ) ?? []);
+  return [name, ...args];
+}
+
+function commandWords(node: Node, language: ShellLanguage): Array<string | null> {
+  return commandWordNodes(node, language).map((word) => literalWord(word, language));
+}
+
+function hasUntranslatedShellSyntax(node: Node, language: ShellLanguage): boolean {
+  const text = node.text;
+  if (language === "powershell") {
+    if (text.length >= 2 && text.startsWith("'") && text.endsWith("'"))
+      return decodePowerShellSingleQuoted(text) === null;
+    const quoted = text.length >= 2 && text.startsWith('"') && text.endsWith('"');
+    const quotedBody = quoted ? text.slice(1, -1) : "";
+    return (
+      text.includes("`") ||
+      quotedBody.includes('"') ||
+      (!quoted && /['"]/u.test(text)) ||
+      (!quoted && text.startsWith("~"))
+    );
+  }
+  if (["raw_string", "string", "string_content"].includes(node.type)) return false;
+  if (["word", "number", "command_name"].includes(node.type))
+    return /[*?[\]{}]/u.test(text) || text.startsWith("~") || text.startsWith("=");
+  if (node.type === "concatenation")
+    return node.namedChildren.some(
+      (child) => child !== null && hasUntranslatedShellSyntax(child, language),
+    );
+  return false;
+}
+
+function isSafePipelineFilter(
+  node: Node,
+  language: ShellLanguage,
+  words: Array<string | null>,
+): boolean {
+  const executable = words[0];
+  if (executable === null || executable === undefined) return false;
+  const name = executableName(executable);
+  const filterNames =
+    language === "powershell"
+      ? new Set(["select-string", "sls"])
+      : new Set(["grep", "egrep", "fgrep"]);
+  if (!filterNames.has(language === "powershell" ? name.toLowerCase() : name)) return false;
+  const pipeline = node.parent;
+  if (!pipeline || pipeline.type !== "pipeline") return false;
+  const commands = pipeline.namedChildren.filter(
+    (child): child is Node => child !== null && child.type === "command",
+  );
+  const last = commands.at(-1);
+  if (
+    !last ||
+    last.startIndex !== node.startIndex ||
+    last.endIndex !== node.endIndex ||
+    commands.length < 2
+  )
+    return false;
+  return commands.slice(0, -1).every((candidate) => {
+    const decision = classifyCommand(commandWords(candidate, language), language);
+    return !decision.kind && !decision.nested;
+  });
+}
+
+/** WASM grammars are shipped with the hook; parsing never reads shell scripts or executes code. */
+export class ShellSearchPolicy {
+  readonly #assets: URL;
+  #initialization: Promise<void> | undefined;
+  readonly #languages = new Map<ShellLanguage, Promise<Language>>();
+
+  constructor(assets: URL) {
+    this.#assets = assets;
+  }
+
+  async inspect(command: string, language: ShellLanguage): Promise<ShellSearchMatch | undefined> {
+    if (Buffer.byteLength(command, "utf8") > MAX_POLICY_COMMAND_BYTES)
+      throw new Error("Search policy command exceeds 64 KiB; split the shell request");
+    this.#initialization ??= Parser.init({
+      locateFile: () => fileURLToPath(new URL("tree-sitter.wasm", this.#assets)),
+    });
+    await this.#initialization;
+    // Both grammars are needed for literal bash -c / pwsh -Command wrappers.
+    for (const shell of ["bash", "powershell"] as const) {
+      if (!this.#languages.has(shell))
+        this.#languages.set(
+          shell,
+          Language.load(fileURLToPath(new URL(`tree-sitter-${shell}.wasm`, this.#assets))),
+        );
+    }
+    const [bash, powershell] = await Promise.all([
+      this.#languages.get("bash"),
+      this.#languages.get("powershell"),
+    ]);
+    if (!bash || !powershell) throw new Error("Search policy grammar initialization failed");
+    return this.#inspect(command, language, { bash, powershell }, 0, { nextCommandIndex: 1 });
+  }
+
+  #inspect(
+    command: string,
+    language: ShellLanguage,
+    grammars: Record<ShellLanguage, Language>,
+    depth: number,
+    state: InspectionState,
+  ): ShellSearchMatch | undefined {
+    if (depth > MAX_SHELL_NESTING)
+      throw new Error("Search policy shell nesting exceeds 4 levels; simplify the command");
+    const parser = new Parser();
+    try {
+      parser.setLanguage(grammars[language]);
+      const deadline = performance.now() + 100;
+      const tree = parser.parse(command, null, {
+        progressCallback: () => performance.now() > deadline,
+      });
+      if (!tree)
+        throw new Error("Search policy parsing exceeded its time budget; simplify the command");
+      try {
+        const hasSyntaxError = tree.rootNode.hasError;
+        const commands = tree.rootNode.descendantsOfType("command");
+        for (const node of commands) {
+          if (!node) continue;
+          const commandIndex = state.nextCommandIndex;
+          state.nextCommandIndex += 1;
+          const words = commandWords(node, language);
+          const decision = classifyCommand(words, language);
+          if (
+            decision.kind &&
+            !(decision.kind === "content" && isSafePipelineFilter(node, language, words))
+          )
+            return {
+              kind: decision.kind,
+              command: decision.command ?? "search command",
+              argv: words,
+              hasUntranslatedShellSyntax:
+                node.descendantsOfType("redirection").length > 0 ||
+                commandWordNodes(node, language).some((word) =>
+                  hasUntranslatedShellSyntax(word, language),
+                ),
+              hasVariableAssignments:
+                language === "bash" && node.descendantsOfType("variable_assignment").length > 0,
+              hasSyntaxError,
+              commandIndex,
+              startByte: node.startIndex,
+              endByte: node.endIndex,
+              nestedDepth: depth,
+              language,
+            };
+          if (decision.nested) {
+            const nested = this.#inspect(
+              decision.nested.command,
+              decision.nested.language,
+              grammars,
+              depth + 1,
+              state,
+            );
+            if (nested) return nested;
+          }
+        }
+        // Tree-sitter's Bash grammar deliberately does not implement every zsh extension.
+        // Error recovery still exposes executable-position `command` nodes, which are the
+        // policy's authority. An error in an argument (for example `${(P)name}`) is not
+        // evidence of a search and must not turn an otherwise ordinary command into a denial.
+        return undefined;
+      } finally {
+        tree.delete();
+      }
+    } finally {
+      parser.delete();
+    }
+  }
+}