surgent 0.7.0-alpha.0

package/src/permission/components/rules-list.ts

@@ -0,0 +1,342 @@
+import type { KeybindingsManager, Theme } from "@earendil-works/pi-coding-agent";
+import { Key, type Focusable, type TUI } from "@earendil-works/pi-tui";
+import type {
+  Category,
+  DisplayRule,
+  FileAccess,
+  GroupedDisplayRules,
+  PermissionRule,
+} from "../types.js";
+import { Frame } from "../../ui/components/frame.js";
+import { Lines } from "../../ui/components/lines.js";
+import { FormField } from "../../ui/components/form-field.js";
+import { CATEGORIES } from "../constants.js";
+import {
+  cycleRuleScope,
+  cycleRuleValue,
+  formatRuleOptionLabel,
+  getRulePatternPlaceholder,
+} from "../helpers.js";
+
+type RuleOptionEntry = {
+  rule: DisplayRule;
+  option: FormField;
+  deleted: boolean;
+};
+
+export default class PermissionRulesList extends Frame implements Focusable {
+  private cursor = 0;
+  private escapeCount = 0;
+  private _focused = false;
+  private saved = true;
+  private readonly options = new Map<Category, RuleOptionEntry[]>();
+
+  onDone?: (action: "exit" | "add") => void;
+  onSave?: (data: {
+    session: PermissionRule;
+    project: PermissionRule;
+    global: PermissionRule;
+  }) => Promise<void> | void;
+  onSaveErr?: (error: unknown) => void;
+
+  constructor(
+    tui: TUI,
+    keybindings: KeybindingsManager,
+    protected theme: Theme,
+    groups: GroupedDisplayRules,
+  ) {
+    super(theme);
+
+    for (const [group, rules] of Object.entries(groups)) {
+      const category = group as Category;
+      const options = rules.map((rule) =>
+        this.createRuleOption(tui, keybindings, theme, category, rule),
+      );
+      this.options.set(category, options);
+    }
+
+    this.registerKeybindings([
+      {
+        key: Key.escape,
+        hint: "exit",
+        handler: () => {
+          if (this.saved) {
+            this.onDone?.("exit");
+            return;
+          }
+
+          this.escapeCount++;
+          const timeout = setTimeout(() => {
+            this.escapeCount = 0;
+          }, 1000);
+
+          if (this.escapeCount >= 2) {
+            clearTimeout(timeout);
+            this.onDone?.("exit");
+          }
+        },
+      },
+      {
+        key: Key.ctrl("s"),
+        hint: "save",
+        handler: () => {
+          if (!this.saved) this.save().catch(this.onSaveErr);
+        },
+      },
+      {
+        key: { navigation: "vertical" },
+        hint: "navigate",
+        navigate: (keyId) => {
+          if (keyId === Key.up) {
+            this.cursor = Math.max(0, this.cursor - 1);
+          } else {
+            this.cursor = Math.min(this.getTotalRules(), this.cursor + 1);
+          }
+          this.setHint(Key.enter, this.cursor === 0 ? "select" : "edit");
+        },
+      },
+      {
+        key: Key.ctrl("d"),
+        hint: "delete",
+        handler: () => {
+          const selectedEntry = this.getSelectedRule();
+          if (!selectedEntry) return;
+
+          selectedEntry.deleted = true;
+          this.saved = false;
+          this.cursor = Math.min(this.cursor, this.getTotalRules());
+        },
+      },
+      {
+        key: Key.enter,
+        hint: "select",
+        handler: () => {
+          if (this.cursor === 0) {
+            if (this.saved) {
+              this.onDone?.("add");
+            } else {
+              this.save()
+                .then(() => this.onDone?.("add"))
+                .catch(this.onSaveErr);
+            }
+            return;
+          }
+
+          const selectedEntry = this.getSelectedRule();
+          if (!selectedEntry) return;
+          selectedEntry.option.startEditing();
+          this.setEditing(true);
+        },
+      },
+      {
+        key: Key.tab,
+        hint: "cycle permission",
+        handler: () => {
+          const selectedEntry = this.getSelectedRule();
+          selectedEntry && this.cycleScope(selectedEntry);
+        },
+      },
+      {
+        key: Key.shift("tab"),
+        hint: "cycle scope",
+        handler: () => {
+          const selectedEntry = this.getSelectedRule();
+          selectedEntry && this.cyclePermission(selectedEntry);
+        },
+      },
+    ]);
+  }
+
+  get focused(): boolean {
+    return this._focused;
+  }
+
+  set focused(value: boolean) {
+    this._focused = value;
+    const selectedEntry = this.getSelectedRule();
+    if (selectedEntry) {
+      selectedEntry.option.focused = value;
+    }
+  }
+
+  private setEditing(value: boolean) {
+    this.setHint(Key.enter, value ? "finish editing" : "edit");
+    this.setHint(Key.escape, value ? "cancel editing" : "cancel");
+
+    this.setArrowKeyAccess({ navigation: "vertical" }, !value);
+    this.setKeyAccess(Key.enter, { consumable: !value });
+    this.setKeyAccess(Key.escape, { consumable: !value });
+    this.setKeyAccess(Key.ctrl("d"), !value);
+    this.setKeyAccess(Key.ctrl("s"), !value);
+  }
+
+  override invalidate() {
+    super.invalidate();
+    for (const options of this.options.values()) {
+      for (const option of options) {
+        option.option.invalidate();
+      }
+    }
+  }
+
+  protected override children(width: number): string[] {
+    const lines = new Lines(width);
+    const unsavedWarning = this.theme.fg("warning", !this.saved ? " (unsaved)" : "");
+
+    lines.add(this.theme.bold("All permission rules") + this.theme.fg("warning", unsavedWarning));
+    lines.space();
+
+    const addSelected = this.cursor === 0;
+    const addText = `${addSelected ? "→" : " "} [Add new permission rule]`;
+    lines.add(this.theme.fg(addSelected ? "accent" : "text", addText));
+
+    let orderedIndex = 1;
+    for (const category of CATEGORIES) {
+      const visibleEntries = this.getOptionsForCategory(category);
+      if (visibleEntries.length === 0) continue;
+
+      lines.space();
+      lines.add(this.theme.fg("muted", category), 2);
+
+      for (const entry of visibleEntries) {
+        const isSelected = this.cursor === orderedIndex;
+        const prefix = isSelected ? this.theme.fg("accent", "→") : " ";
+        entry.option.highlighted = isSelected;
+
+        const renderedOption = entry.option.render(width - 4);
+        if (renderedOption.length > 0) {
+          lines.add(`${prefix} ${renderedOption[0]!}`, 2);
+        }
+        orderedIndex++;
+      }
+    }
+
+    if (this.escapeCount === 1) {
+      lines.space();
+      lines.add(this.theme.fg("warning", "Press Esc/Ctrl+C again to exit without saving."), 1);
+    }
+
+    return lines.get();
+  }
+
+  handleInput(data: string) {
+    if (this.handleKb(data)) return;
+    const entry = this.getSelectedRule();
+    entry?.option.handleInput(data);
+  }
+
+  private async save() {
+    const global: PermissionRule = {};
+    const session: PermissionRule = {};
+    const project: PermissionRule = {};
+
+    for (const [category, options] of this.options.entries()) {
+      for (const optionEntry of options) {
+        if (optionEntry.deleted) continue;
+        const rule = optionEntry.rule;
+
+        let target: PermissionRule;
+        if (rule.scope === "always") target = global;
+        else if (rule.scope === "project") target = project;
+        else target = session;
+
+        if (category === "file") {
+          target.file = { ...target.file, [rule.pattern]: rule.value as FileAccess };
+        } else if (category === "web") {
+          target.web = { ...target.web, [rule.pattern]: rule.value as boolean };
+        } else if (category === "mcp") {
+          target.mcp = { ...target.mcp, [rule.pattern]: rule.value as boolean };
+        } else {
+          target.bash = { ...target.bash, [rule.pattern]: rule.value as boolean };
+        }
+      }
+    }
+
+    const data = { session, project, global };
+    await this.onSave?.(data);
+    this.saved = true;
+  }
+
+  private getSelectedRule(): RuleOptionEntry | undefined {
+    if (this.cursor === 0) return;
+    const visibleOptions = this.getVisibleOptions();
+    return visibleOptions[this.cursor - 1];
+  }
+
+  private getVisibleOptions(): RuleOptionEntry[] {
+    const visibleOptions: RuleOptionEntry[] = [];
+    for (const category of CATEGORIES) {
+      visibleOptions.push(...this.getOptionsForCategory(category));
+    }
+    return visibleOptions;
+  }
+
+  private getOptionsForCategory(category: Category): RuleOptionEntry[] {
+    const options = this.options.get(category) ?? [];
+    return options.filter((optionEntry) => !optionEntry.deleted);
+  }
+
+  private getTotalRules() {
+    return this.getVisibleOptions().length;
+  }
+
+  private createRuleOption(
+    tui: TUI,
+    keybindings: KeybindingsManager,
+    theme: Theme,
+    category: Category,
+    rule: DisplayRule,
+  ): RuleOptionEntry {
+    const option = new FormField(tui, keybindings, theme, {
+      key: "pattern",
+      label: formatRuleOptionLabel(rule.scope, rule.value),
+      mode: {
+        type: "input",
+        placeholder: getRulePatternPlaceholder(category),
+        text: rule.pattern,
+      },
+    });
+
+    const optionEntry: RuleOptionEntry = { rule, option, deleted: false };
+
+    option.onInputSubmit = (inputValue) => {
+      const inputPattern = inputValue.trim();
+      const nextPattern = inputPattern || optionEntry.rule.pattern.trim();
+      if (!nextPattern) {
+        return false;
+      }
+
+      if (nextPattern !== optionEntry.rule.pattern) {
+        optionEntry.rule.pattern = nextPattern;
+        option.setText(nextPattern);
+        this.saved = false;
+      }
+
+      this.setEditing(false);
+      return true;
+    };
+
+    option.onInputCancel = () => {
+      option.setText(optionEntry.rule.pattern);
+      this.setEditing(false);
+    };
+
+    return optionEntry;
+  }
+
+  private cycleScope(optionEntry: RuleOptionEntry) {
+    cycleRuleScope(optionEntry.rule);
+    optionEntry.option.setLabel(
+      formatRuleOptionLabel(optionEntry.rule.scope, optionEntry.rule.value),
+    );
+    this.saved = false;
+  }
+
+  private cyclePermission(optionEntry: RuleOptionEntry) {
+    cycleRuleValue(optionEntry.rule);
+    optionEntry.option.setLabel(
+      formatRuleOptionLabel(optionEntry.rule.scope, optionEntry.rule.value),
+    );
+    this.saved = false;
+  }
+}

package/src/permission/constants.ts

@@ -0,0 +1,48 @@
+export const SCOPES = ["session", "project", "always"] as const;
+export const CATEGORIES = ["file", "web", "bash", "mcp"] as const;
+
+export const PERMISSIVE_TOOLS = {
+  read: "file",
+  write: "file",
+  edit: "file",
+  grep: "file",
+  bash: "bash",
+  web_fetch: "web",
+  call_mcp_tool: "mcp",
+} as const;
+
+export const SUSPICIOUS_BASH_PATTERNS: Array<{ pattern: RegExp; reason: string }> = [
+  // Command injection syntax
+  { pattern: /\$\(/, reason: "Command substitution $(...)" },
+  { pattern: /`[^`]+`/, reason: "Backtick command substitution" },
+  { pattern: /\$\{[^}]*}/, reason: "Variable/command expansion ${...}" },
+
+  // Inline shell execution
+  { pattern: /\|\s*(?:bash|sh|zsh|fish|ksh|csh)/, reason: "Pipe into shell" },
+  { pattern: /(?:bash|sh|zsh)\s+-c/, reason: "Inline shell execution" },
+  { pattern: /\beval\b/, reason: "eval" },
+  { pattern: /\bexec\b/, reason: "exec" },
+
+  // Remote fetch
+  { pattern: /\bcurl\s/, reason: "Potential remote execution with curl" },
+  { pattern: /\bwget\s/, reason: "Potential remote execution with wget" },
+  { pattern: /\bfetch\s/, reason: "Potential remote execution with fetch" },
+
+  // Reverse shell / network tricks
+  { pattern: /\/dev\/tcp/, reason: "Bash TCP redirect" },
+  { pattern: /\/dev\/udp/, reason: "Bash UDP redirect" },
+  { pattern: /\bnc\b/, reason: "netcat" },
+  { pattern: /\bncat\b/, reason: "ncat" },
+  { pattern: /\bsocat\b/, reason: "socat" },
+
+  // Obfuscation
+  { pattern: /\$'[^']*'/, reason: "ANSI-C quoting (possible obfuscation)" },
+  { pattern: /\$\(\(/, reason: "arithmetic expansion" },
+  { pattern: /\bbase64\b/, reason: "base64 (possible encoded payload)" },
+  { pattern: /\\x[0-9a-f]{2}/i, reason: "Hex escape sequence" },
+  { pattern: /\\u[0-9a-f]{4}/i, reason: "Unicode escape sequence" },
+
+  // Privilege escalation
+  { pattern: /\bsudo\b/, reason: "Privilege escalation with sudo" },
+  { pattern: /\bsu\b/, reason: "Privilege escalation with su" },
+];

package/src/permission/helpers.ts

@@ -0,0 +1,156 @@
+import type { BashCommand, PermissionCheck, PermissiveToolName } from "./types.js";
+import { PERMISSIVE_TOOLS, SUSPICIOUS_BASH_PATTERNS } from "./constants.js";
+import { SCOPES } from "./constants.js";
+import type { Category, DisplayRule, FileAccess, Scope } from "./types.js";
+import type { AgentMode } from "../agent/types.js";
+import { extractBashCommands } from "./bash.js";
+import { unique } from "../utils.js";
+
+function getRuleValueLabel(value: FileAccess | boolean): string {
+  if (typeof value === "boolean") {
+    return value ? "allowed" : "disallowed";
+  }
+  if (value === "read") {
+    return "read only";
+  }
+  if (value === "write") {
+    return "full access";
+  }
+  return value;
+}
+
+export function getScopeLabel(scope: Scope) {
+  return scope !== "always" ? `[this ${scope}]` : `[${scope}]`;
+}
+
+export function formatRuleOptionLabel(scope: Scope, value: FileAccess | boolean): string {
+  return `${getScopeLabel(scope)} ${getRuleValueLabel(value)}`;
+}
+
+export function getRulePatternPlaceholder(category: Category): string {
+  if (category === "file") {
+    return "Path or glob pattern (example: src/**/*.ts)";
+  }
+  if (category === "web") {
+    return "Host or URL pattern (example: api.example.com/**)";
+  }
+  if (category === "mcp") {
+    return "MCP server and tool (example: github:search)";
+  }
+  return "Command pattern (example: git * or pnpm test)";
+}
+
+export function cycleRuleScope(rule: DisplayRule) {
+  const scopeIndex = SCOPES.indexOf(rule.scope);
+  rule.scope = SCOPES[(scopeIndex + 1) % SCOPES.length]!;
+}
+
+export function cycleRuleValue(rule: DisplayRule) {
+  if (typeof rule.value === "boolean") {
+    rule.value = !rule.value;
+    return;
+  }
+  const fileOps = ["read", "write", "blocked"] as const;
+  const valueIndex = fileOps.findIndex((value) => value === rule.value);
+  rule.value = fileOps[(valueIndex + 1) % fileOps.length]!;
+}
+
+function getBashUncertainty(command: BashCommand): string | undefined {
+  if (command.unresolved) return "Dynamic or invalid bash command";
+  for (const { pattern, reason } of SUSPICIOUS_BASH_PATTERNS) {
+    if (pattern.test(command.text)) return reason;
+  }
+}
+
+export function getPermissionCheck(
+  sessionId: string,
+  toolName: string,
+  input: Record<string, unknown>,
+): PermissionCheck | null {
+  if (!(toolName in PERMISSIVE_TOOLS)) return null;
+  const typedName = toolName as PermissiveToolName;
+  const check: PermissionCheck = {
+    sessionId,
+    toolName: typedName,
+    category: PERMISSIVE_TOOLS[typedName],
+    raw: "",
+    purpose: "",
+    extracted: [],
+  };
+
+  switch (typedName) {
+    case "read":
+      check.raw = input.path as string;
+      check.purpose = `Read content from file ${check.raw}`;
+      check.extracted = [`read:${check.raw}`];
+      break;
+    case "write":
+    case "edit":
+      check.raw = input.path as string;
+      check.purpose = `Write content to file ${check.raw}`;
+      check.extracted = [`write:${check.raw}`];
+      break;
+    case "grep":
+      check.raw = (input.path as string | undefined) ?? ".";
+      check.purpose = `Perform search in path ${check.raw}`;
+      check.extracted = [`read:${check.raw}`];
+      break;
+    case "bash":
+      check.raw = input.command as string;
+      check.purpose = input.purpose as string;
+      break;
+    case "web_fetch":
+      check.raw = input.url as string;
+      check.purpose = `Fetch content from URL ${input.url}`;
+      check.extracted = [check.raw];
+      break;
+    case "call_mcp_tool":
+      check.raw = `${(input.server as string).trim()}:${(input.tool as string).trim()}`;
+      check.purpose = `Call MCP tool ${check.raw}`;
+      check.extracted = [check.raw];
+      break;
+  }
+
+  if (typedName === "bash") {
+    const commands = extractBashCommands(check.raw);
+    const uncertainty = commands.map(getBashUncertainty).filter(Boolean);
+    check.extracted = commands.map(({ text }) => text);
+    check.uncertainty = unique(uncertainty).join("; ") || undefined;
+  }
+
+  return check;
+}
+
+export function cycleMode(mode: AgentMode): AgentMode {
+  switch (mode) {
+    case "assistant":
+      return "yolo";
+    case "yolo":
+      return "restricted";
+    case "restricted":
+      return "assistant";
+  }
+}
+
+export function extractOpAndPath(input: string): ["read" | "write", string] {
+  const separator = input.indexOf(":");
+  if (separator < 0) return ["read", input];
+  return [input.slice(0, separator) === "write" ? "write" : "read", input.slice(separator + 1)];
+}
+
+export function mapToRules(
+  patterns: string[],
+  category: Category,
+  allowed: boolean,
+): Map<string, FileAccess | boolean> {
+  const map = new Map<string, FileAccess | boolean>();
+  for (const pattern of patterns) {
+    if (category === "file") {
+      const [op, path] = extractOpAndPath(pattern);
+      map.set(path, allowed ? op : "blocked");
+    } else {
+      map.set(pattern, allowed);
+    }
+  }
+  return map;
+}

package/src/permission/index.ts

@@ -0,0 +1,134 @@
+import type {
+  ExtensionAPI,
+  ExtensionContext,
+  ToolCallEvent,
+} from "@earendil-works/pi-coding-agent";
+import { Key, visibleWidth } from "@earendil-works/pi-tui";
+import { handlePermissionsCommand } from "./command.js";
+import { checkAgentRules, resolvePermission } from "./resolution.js";
+import { getPiIgnoreInputs, resolvePiIgnorePathBlock } from "./piignore.js";
+import { readAgentMode, writeAgentMode } from "./storage.js";
+import { loadMainAgent } from "../agent/storage.js";
+import type { PermissionCheck, PromptDecision } from "./types.js";
+import PermissionPrompt from "./components/prompt.js";
+import { getPermissionCheck, cycleMode } from "./helpers.js";
+import type { Agent, AgentMeta, AgentMode } from "../agent/types.js";
+
+async function askForPermission(pi: ExtensionAPI, ctx: ExtensionContext, check: PermissionCheck) {
+  const decision = await ctx.ui.custom<PromptDecision>((_tui, theme, _keybindings, done) => {
+    const component = new PermissionPrompt(theme, check, ctx.cwd);
+    component.onDone = done;
+    return component;
+  });
+
+  if (!decision.allowed) {
+    const appended = decision.amended ? `. User input: ${decision.amended}` : "";
+    return {
+      block: true,
+      reason: `User rejected this tool call. Find a different approach, or skip this step, or abort and report if cannot proceed${appended}`,
+    };
+  }
+  if (decision.amended) {
+    pi.sendUserMessage(decision.amended, { deliverAs: "steer" });
+  }
+}
+
+export async function enforceToolPermission(
+  pi: ExtensionAPI,
+  event: ToolCallEvent,
+  ctx: ExtensionContext,
+  meta: AgentMeta,
+  sessionId: string,
+  mode: AgentMode,
+) {
+  for (const input of getPiIgnoreInputs(event)) {
+    const piIgnoreBlock = await resolvePiIgnorePathBlock(ctx.cwd, input);
+    if (piIgnoreBlock) {
+      return { block: true, reason: piIgnoreBlock };
+    }
+  }
+
+  const check = getPermissionCheck(sessionId, event.toolName, event.input);
+  if (!check) return;
+  if (!checkAgentRules(meta, check)) {
+    return { block: true, reason: "Access to this resource is beyond allowed scope" };
+  }
+
+  const permission = await resolvePermission(ctx.cwd, check, mode);
+  if (permission === "blocked") {
+    return { block: true, reason: "Access to this resource is denied" };
+  }
+  if (mode === "yolo") return;
+  if (permission === "allowed" && !check.uncertainty) return;
+  if (!ctx.hasUI) {
+    return { block: true, reason: "Permission request requires interactive UI" };
+  }
+
+  return askForPermission(pi, ctx, check);
+}
+
+export default function (pi: ExtensionAPI) {
+  let agent: Agent;
+  let mode: AgentMode;
+  let updateStatus: (() => void) | undefined;
+
+  const updateAgentMode = (ctx: ExtensionContext) => {
+    const modeText =
+      mode === "yolo"
+        ? ctx.ui.theme.fg("warning", "YOLO mode ⚠️")
+        : mode === "restricted"
+          ? ctx.ui.theme.fg("dim", "restricted mode")
+          : ctx.ui.theme.fg("dim", "assistant mode");
+    const width = (process.stdout.columns ?? 80) - visibleWidth(modeText) + 1;
+    // statuses are sorted alphabetically and joined with " "; use ANSI cursor absolute (CHA)
+    // to jump to the right edge — spaces would be collapsed by sanitizeStatusText
+    ctx.ui.setStatus("mode", `\x1b[${width}G` + modeText);
+  };
+
+  pi.registerShortcut(Key.alt("m"), {
+    description: "Cycle assistant, YOLO, and restricted modes",
+    handler: async (ctx) => {
+      mode = cycleMode(mode);
+      await writeAgentMode(mode);
+      updateStatus?.();
+
+      ctx.ui.notify(
+        mode === "yolo"
+          ? "YOLO mode ON - agents can now run commands and tools without asking"
+          : "YOLO mode OFF",
+        "info",
+      );
+    },
+  });
+
+  pi.registerCommand("permissions", {
+    description: "View and manage permissions",
+    handler: async (_args, ctx) => await handlePermissionsCommand(ctx),
+  });
+
+  pi.on("session_start", async (_event, ctx) => {
+    [agent, mode] = await Promise.all([loadMainAgent(pi, ctx), readAgentMode()]);
+    ctx.ui.setStatus("agent", ctx.ui.theme.fg("dim", `agent: ${agent.name}`));
+
+    if (updateStatus) {
+      process.stdout.off("resize", updateStatus);
+    }
+    updateStatus = () => updateAgentMode(ctx);
+    updateStatus();
+    process.stdout.on("resize", updateStatus);
+  });
+
+  pi.on("before_agent_start", (event) => ({
+    systemPrompt: `${agent.body}\n\n${event.systemPrompt}`,
+  }));
+
+  pi.on("session_shutdown", async (_event, _ctx) => {
+    if (updateStatus) {
+      process.stdout.off("resize", updateStatus);
+    }
+  });
+
+  pi.on("tool_call", async (event, ctx) =>
+    enforceToolPermission(pi, event, ctx, agent.meta, ctx.sessionManager.getSessionId(), mode),
+  );
+}