tau-coding-agent 0.1.5 → 0.2.0

package/extensions/sandbox/permissions/mach-lookup.ts

@@ -0,0 +1,186 @@
+import type { SandboxRuntimeConfig } from "@anthropic-ai/sandbox-runtime";
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+
+import {
+  cloneRuntimeConfig,
+  escapeSlashCommandArg,
+  mutateStringList,
+  type ListOp,
+  type PromptMode,
+} from "../config.js";
+import type { SandboxEvent, SandboxEventOutcome, SandboxEventReason } from "../runtime.js";
+import {
+  createPermissionResolution,
+  showPermissionDialog,
+  type PermissionResolution,
+} from "./dialog.js";
+
+interface MachLookupViolation {
+  service: string;
+}
+
+function detectMachLookupViolationFromLine(line: string): MachLookupViolation | null {
+  const match = line.match(/\bdeny\(\d+\)\s+mach-lookup\s+([^\s()"'*]+)/i);
+  const service = match?.[1];
+  return service ? { service } : null;
+}
+
+export function detectMachLookupViolations(lines: string[]): MachLookupViolation[] {
+  const violationsByService = new Map<string, MachLookupViolation>();
+
+  for (let index = lines.length - 1; index >= 0; index -= 1) {
+    const violation = detectMachLookupViolationFromLine(lines[index]);
+    if (violation && !violationsByService.has(violation.service)) {
+      violationsByService.set(violation.service, violation);
+    }
+  }
+
+  return Array.from(violationsByService.values());
+}
+
+export function isValidMachLookupRule(rule: string): boolean {
+  const trimmed = rule.trim();
+  if (!trimmed || /\s/.test(trimmed)) return false;
+
+  const prefix = trimmed.endsWith("*") ? trimmed.slice(0, -1) : trimmed;
+  return !prefix.includes("*");
+}
+
+function matchesMachLookupRule(service: string, rule: string): boolean {
+  if (rule === "*") return true;
+  if (rule.endsWith("*")) return service.startsWith(rule.slice(0, -1));
+  return service === rule;
+}
+
+export function mutateMachLookupAllowList(
+  runtimeConfig: SandboxRuntimeConfig,
+  op: ListOp,
+  service: string,
+): boolean {
+  runtimeConfig.network.allowMachLookup ??= [];
+  return mutateStringList(runtimeConfig.network.allowMachLookup, op, service);
+}
+
+function isMachLookupAlreadyAllowed(
+  runtimeConfig: SandboxRuntimeConfig | null,
+  service: string,
+): boolean {
+  return (runtimeConfig?.network.allowMachLookup ?? []).some((rule) =>
+    matchesMachLookupRule(service, rule),
+  );
+}
+
+function buildMachLookupAllowCommand(service: string): string {
+  return `/sandbox mach-lookup add ${escapeSlashCommandArg(service)}`;
+}
+
+function formatMachLookupViolationSummary(service: string): string {
+  return `[sandbox] Blocked macOS service lookup: ${service}`;
+}
+
+function describeMachLookupEventSummary(
+  reason: SandboxEventReason,
+  outcome: SandboxEventOutcome,
+): string {
+  if (outcome === "allowed") return "user allowed macOS service lookup for this session";
+  if (reason === "already-approved-still-failed") {
+    return "macOS service lookup was previously allowed for this session but is still failing";
+  }
+  return "macOS service lookup is not in the allowed service list";
+}
+
+function formatMachLookupBlockedTarget(service: string): string {
+  return `Sandbox blocked access to macOS service ${service}.`;
+}
+
+export async function handleMachLookupViolation(options: {
+  ctx: ExtensionContext | null;
+  promptMode: PromptMode;
+  runtimeConfig: SandboxRuntimeConfig;
+  violations: MachLookupViolation[];
+  command: string;
+  cwd?: string;
+  pendingDialogs?: Map<string, Promise<PermissionResolution | null>>;
+  applyRuntimeConfigForSession?: (
+    ctx: ExtensionContext,
+    runtimeConfig: SandboxRuntimeConfig,
+  ) => void;
+  recordEvent?: (event: SandboxEvent) => void;
+  autoRetryAvailable?: boolean;
+}): Promise<PermissionResolution | null> {
+  const {
+    ctx,
+    promptMode,
+    runtimeConfig,
+    violations,
+    command,
+    cwd,
+    pendingDialogs,
+    applyRuntimeConfigForSession,
+    recordEvent,
+    autoRetryAvailable = true,
+  } = options;
+  if (violations.length === 0) return null;
+
+  const violation =
+    violations.find((candidate) => !isMachLookupAlreadyAllowed(runtimeConfig, candidate.service)) ??
+    violations[0];
+  const { service } = violation;
+  const blockedTarget = formatMachLookupBlockedTarget(service);
+  const allowCommand = buildMachLookupAllowCommand(service);
+  const alreadyApproved = isMachLookupAlreadyAllowed(runtimeConfig, service);
+  const eventReason: SandboxEventReason = alreadyApproved
+    ? "already-approved-still-failed"
+    : "missing-mach-lookup";
+
+  const recordMachLookupEvent = (outcome: SandboxEventOutcome): void => {
+    recordEvent?.({
+      timestamp: Date.now(),
+      kind: "mach-lookup",
+      outcome,
+      reason: eventReason,
+      target: service,
+      command,
+      cwd,
+      summary: describeMachLookupEventSummary(eventReason, outcome),
+      suggestedCommand: outcome === "blocked" && !alreadyApproved ? allowCommand : undefined,
+    });
+  };
+
+  if (promptMode === "non-interactive" || !ctx?.hasUI) {
+    recordMachLookupEvent("blocked");
+    return {
+      kind: "deny",
+      message: `${formatMachLookupViolationSummary(service)}\n[sandbox] To temporarily allow for this session, run: ${allowCommand}`,
+    };
+  }
+
+  if (alreadyApproved) {
+    recordMachLookupEvent("blocked");
+    return createPermissionResolution("allow-adapt", blockedTarget, false);
+  }
+
+  const promptKey = `${allowCommand}:${autoRetryAvailable ? "retry" : "adapt"}`;
+  return showPermissionDialog({
+    ctx,
+    title: `Sandbox blocked access to macOS service ${service}`,
+    promptKey,
+    pendingDialogs,
+    autoRetryAvailable,
+    onDecision(decision) {
+      if (decision === "deny") {
+        recordMachLookupEvent("blocked");
+        return createPermissionResolution(decision, blockedTarget);
+      }
+
+      const nextConfig = cloneRuntimeConfig(runtimeConfig);
+      const changed = mutateMachLookupAllowList(nextConfig, "add", service);
+      if (changed) {
+        applyRuntimeConfigForSession?.(ctx, nextConfig);
+      }
+
+      recordMachLookupEvent("allowed");
+      return createPermissionResolution(decision, blockedTarget, changed);
+    },
+  });
+}

package/extensions/sandbox/permissions/network.ts

@@ -0,0 +1,164 @@
+import type { SandboxAskCallback, SandboxRuntimeConfig } from "@anthropic-ai/sandbox-runtime";
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+
+import {
+  cloneRuntimeConfig,
+  escapeSlashCommandArg,
+  mutateStringList,
+  type PromptMode,
+} from "../config.js";
+type NetworkEventOutcome = "blocked" | "allowed";
+type NetworkEventReason = "explicit-deny-domain" | "missing-allowed-domain";
+
+interface NetworkPermissionEvent {
+  outcome: NetworkEventOutcome;
+  reason: NetworkEventReason;
+  target: string;
+  summary: string;
+  suggestedCommand?: string;
+}
+
+interface NetworkPermissions {
+  ask: SandboxAskCallback;
+  clear(): void;
+}
+
+export function createNetworkPermissions(options: {
+  getContext: () => ExtensionContext | null;
+  getPromptMode: () => PromptMode;
+  getRuntimeConfig: () => SandboxRuntimeConfig | null;
+  isSuspended: () => boolean;
+  applyRuntimeConfigForSession: (
+    ctx: ExtensionContext,
+    runtimeConfig: SandboxRuntimeConfig,
+  ) => void;
+  recordEvent: (event: NetworkPermissionEvent) => void;
+  notify: (ctx: ExtensionContext, text: string, level?: "info" | "warning" | "error") => void;
+}): NetworkPermissions {
+  const {
+    getContext,
+    getPromptMode,
+    getRuntimeConfig,
+    isSuspended,
+    applyRuntimeConfigForSession,
+    recordEvent,
+    notify,
+  } = options;
+  const pendingApprovals = new Map<string, Promise<boolean>>();
+
+  function recordNetworkEvent(
+    outcome: NetworkEventOutcome,
+    reason: NetworkEventReason,
+    host: string,
+    port?: number,
+  ): void {
+    recordEvent({
+      outcome,
+      reason,
+      target: port ? `${host}:${port}` : host,
+      summary: describeNetworkEventSummary(reason, outcome),
+      suggestedCommand: outcome === "blocked" ? buildNetworkBlockCommand(reason, host) : undefined,
+    });
+  }
+
+  const ask: SandboxAskCallback = async ({ host, port }) => {
+    if (isSuspended()) return true;
+
+    const normalizedHost = host.toLowerCase();
+    const existingDecision = pendingApprovals.get(normalizedHost);
+    if (existingDecision) return existingDecision;
+
+    const decision = (async () => {
+      try {
+        const initialConfig = getRuntimeConfig();
+        if (!initialConfig) return false;
+
+        if (initialConfig.network.allowedDomains.includes(normalizedHost)) return true;
+        if (initialConfig.network.deniedDomains.includes(normalizedHost)) {
+          recordNetworkEvent("blocked", "explicit-deny-domain", normalizedHost, port);
+          return false;
+        }
+
+        const suggestedCommand = buildNetworkBlockCommand("missing-allowed-domain", normalizedHost);
+        const ctx = getContext();
+        if (getPromptMode() === "non-interactive" || !ctx || !ctx.hasUI) {
+          recordNetworkEvent("blocked", "missing-allowed-domain", normalizedHost, port);
+          const message = `Sandbox blocked network access to ${normalizedHost}. To temporarily allow for this session, run: ${suggestedCommand}`;
+          if (ctx) notify(ctx, message, "warning");
+          else console.warn(message);
+          return false;
+        }
+
+        const target = port ? `${normalizedHost}:${port}` : normalizedHost;
+        const approved = await ctx.ui.confirm(
+          `Sandbox blocked network access to ${target}`,
+          "\nAllow for this session?",
+        );
+        if (!approved) {
+          recordNetworkEvent("blocked", "missing-allowed-domain", normalizedHost, port);
+          return false;
+        }
+
+        const latestConfig = getRuntimeConfig();
+        if (!latestConfig) return false;
+        if (latestConfig.network.deniedDomains.includes(normalizedHost)) {
+          recordNetworkEvent("blocked", "explicit-deny-domain", normalizedHost, port);
+          notify(
+            ctx,
+            `Network access to ${normalizedHost} remains denied by current sandbox policy. Remove it from deny list to allow.`,
+            "warning",
+          );
+          return false;
+        }
+        if (latestConfig.network.allowedDomains.includes(normalizedHost)) {
+          recordNetworkEvent("allowed", "missing-allowed-domain", normalizedHost, port);
+          return true;
+        }
+
+        const nextConfig = cloneRuntimeConfig(latestConfig);
+        const changed = mutateStringList(nextConfig.network.allowedDomains, "add", normalizedHost);
+        if (changed) {
+          applyRuntimeConfigForSession(ctx, nextConfig);
+        }
+
+        recordNetworkEvent("allowed", "missing-allowed-domain", normalizedHost, port);
+        notify(ctx, `Allowed network domain for this session: ${normalizedHost}`, "info");
+        return true;
+      } catch (error) {
+        const ctx = getContext();
+        const message = `Sandbox permission prompt failed for ${normalizedHost}: ${error instanceof Error ? error.message : error}`;
+        if (ctx) notify(ctx, message, "warning");
+        else console.warn(message);
+        return false;
+      }
+    })();
+
+    pendingApprovals.set(normalizedHost, decision);
+    try {
+      return await decision;
+    } finally {
+      pendingApprovals.delete(normalizedHost);
+    }
+  };
+
+  return {
+    ask,
+    clear: () => pendingApprovals.clear(),
+  };
+}
+
+function buildNetworkBlockCommand(reason: NetworkEventReason, host: string): string {
+  if (reason === "explicit-deny-domain") {
+    return `/sandbox network deny remove ${escapeSlashCommandArg(host)}`;
+  }
+  return `/sandbox network allow add ${escapeSlashCommandArg(host)}`;
+}
+
+function describeNetworkEventSummary(
+  reason: NetworkEventReason,
+  outcome: NetworkEventOutcome,
+): string {
+  if (outcome === "allowed") return "user allowed network domain for this session";
+  if (reason === "explicit-deny-domain") return "network access matched a deny list entry";
+  return "network access target is not in the allowed domain list";
+}

package/extensions/sandbox/permissions/unsandboxed.ts

@@ -0,0 +1,270 @@
+import { homedir } from "node:os";
+import {
+  DynamicBorder,
+  type ExtensionContext,
+  type KeybindingsManager,
+  type Theme,
+} from "@earendil-works/pi-coding-agent";
+import {
+  CURSOR_MARKER,
+  Text,
+  TUI_KEYBINDINGS,
+  visibleWidth,
+  type Component,
+  type Focusable,
+  type TUI,
+  type TuiMouseEvent,
+  type TuiMouseEventResult,
+} from "@earendil-works/pi-tui";
+
+export const UNSANDBOXED_APPROVAL_CHOICES = ["Deny", "Run once outside sandbox"] as const;
+
+export function isUnsandboxedApproval(choices: readonly string[]): boolean {
+  return (
+    choices.length === UNSANDBOXED_APPROVAL_CHOICES.length &&
+    choices.every((choice, index) => choice === UNSANDBOXED_APPROVAL_CHOICES[index])
+  );
+}
+
+/** Use Pi's editor-area dialog. RPC presentation belongs to its human client. */
+export async function showUnsandboxedApproval(
+  ctx: ExtensionContext,
+  title: string,
+  signal?: AbortSignal,
+): Promise<string | undefined> {
+  if (!ctx.hasUI || ctx.mode !== "tui" || signal?.aborted) return undefined;
+  let cancel: (() => void) | undefined;
+  try {
+    const result = await ctx.ui.custom<string | undefined>((tui, theme, keybindings, done) => {
+      cancel = () => done(undefined);
+      signal?.addEventListener("abort", cancel, { once: true });
+      if (signal?.aborted) cancel();
+      return new UnsandboxedApproval(title, tui, theme, keybindings, (choice) =>
+        done(signal?.aborted ? undefined : choice),
+      );
+    });
+    return signal?.aborted ? undefined : result;
+  } catch {
+    return undefined;
+  } finally {
+    if (cancel) signal?.removeEventListener("abort", cancel);
+  }
+}
+
+/** Shell-style details for both the local dialog and forwarded RPC approvals. */
+export function formatUnsandboxedApproval(command: string, cwd: string): string {
+  const home = homedir();
+  const homePrefix = home.endsWith("/") ? home : `${home}/`;
+  const directory =
+    cwd === home ? "~" : cwd.startsWith(homePrefix) ? `~/${cwd.slice(homePrefix.length)}` : cwd;
+  return [
+    "Run once outside sandbox?",
+    "",
+    escapeControls(directory).replaceAll("\n", "\\u000a"),
+    `$ ${escapeControls(command)}`,
+    "",
+    "This command and its descendants get host filesystem and network access.",
+  ].join("\n");
+}
+
+/** The cursor keeps the focused review line or choice visible when Pi shrinks its editor dock. */
+class UnsandboxedApproval implements Component, Focusable {
+  focused = false;
+  private readonly content = new Text("", 0, 0);
+  private readonly titleLines: string[];
+  private readonly directoryLine: number;
+  private selected = 0;
+  private reviewLine: number | undefined;
+  private scrollTop = 0;
+  private contentLines: string[] = [];
+  private viewportHeight = 0;
+  private renderedWidth = 0;
+  private renderedHeight = 0;
+  private canApprove = false;
+
+  constructor(
+    title: string,
+    private readonly tui: TUI,
+    private readonly theme: Theme,
+    private readonly keybindings: KeybindingsManager,
+    private readonly done: (choice: string | undefined) => void,
+  ) {
+    this.titleLines = escapeControls(title).split("\n");
+    this.directoryLine = this.titleLines.findIndex((line) => line.startsWith("$ ")) - 1;
+  }
+
+  render(width: number): string[] {
+    const rows = this.tui.terminal.rows;
+    const height = Math.min(16, Math.max(0, rows - 2));
+    if (width !== this.renderedWidth || rows !== this.renderedHeight) this.selected = 0;
+    this.renderedWidth = width;
+    this.renderedHeight = rows;
+    this.canApprove = false;
+    // Fullscreen owns unmodified PageUp/PageDown and Home/End before dialog input.
+    // Advertise the configured editor aliases that can actually reach this dialog.
+    const viewportKeys = new Set(
+      this.tui.mode === "fullscreen"
+        ? Object.keys(TUI_KEYBINDINGS)
+            .filter((action) => action.startsWith("tui.altScreen."))
+            .flatMap((action) => this.keybindings.getKeys(action as keyof typeof TUI_KEYBINDINGS))
+        : [],
+    );
+    const key = (action: Parameters<KeybindingsManager["getKeys"]>[0]) =>
+      this.keybindings
+        .getKeys(action)
+        .find((binding) => !action.startsWith("tui.editor.") || !viewportKeys.has(binding)) ??
+      "unbound";
+    const border = new DynamicBorder((line) => this.theme.fg("border", line)).render(width);
+    const gap = height >= 14 ? [""] : [];
+    this.content.setText(
+      this.titleLines
+        .map((line, index) =>
+          index === this.directoryLine
+            ? this.theme.fg("dim", line)
+            : line.startsWith("$ ")
+              ? this.theme.fg("text", line)
+              : line,
+        )
+        .join("\n"),
+    );
+    this.contentLines = this.content.render(Math.max(1, width - 2));
+    const choices = UNSANDBOXED_APPROVAL_CHOICES.flatMap((choice, index) =>
+      new Text(
+        this.theme.fg(
+          index === this.selected ? "accent" : "text",
+          `${this.focused && this.reviewLine === undefined && index === this.selected ? CURSOR_MARKER : ""}${index === this.selected ? "→" : " "} ${choice}`,
+        ),
+        1,
+        0,
+      ).render(width),
+    );
+    const navigation =
+      key("tui.select.up") === "up" && key("tui.select.down") === "down"
+        ? "↑↓"
+        : `${key("tui.select.up")}/${key("tui.select.down")}`;
+    const hint = (binding: string, description: string) =>
+      this.theme.fg("dim", binding) + this.theme.fg("muted", ` ${description}`);
+    const hints = new Text(
+      `${hint(navigation, "navigate")}  ${hint(key("tui.select.confirm"), "select")}  ${hint(key("tui.select.cancel"), "cancel")}`,
+      1,
+      0,
+    ).render(width);
+    this.viewportHeight =
+      height - border.length * 2 - gap.length * 4 - choices.length - hints.length;
+    const reviewHints =
+      this.contentLines.length > this.viewportHeight || this.reviewLine !== undefined
+        ? new Text(
+            this.theme.fg(
+              "dim",
+              `${key("tui.editor.pageUp")}/${key("tui.editor.pageDown")} review lines · ${key("tui.editor.cursorLineStart")}/${key("tui.editor.cursorLineEnd")} top/end`,
+            ),
+            1,
+            0,
+          ).render(width)
+        : [];
+    this.viewportHeight -= reviewHints.length;
+    if (width < 3 || this.viewportHeight < 1) {
+      return new Text("Resize to review. Escape denies.", 0, 0)
+        .render(Math.max(1, width))
+        .slice(0, Math.max(0, height));
+    }
+    this.viewportHeight = Math.min(this.viewportHeight, this.contentLines.length);
+    if (this.reviewLine !== undefined) {
+      this.reviewLine = Math.min(this.reviewLine, this.contentLines.length - 1);
+      this.scrollTop = Math.max(0, this.reviewLine - this.viewportHeight + 1);
+    }
+    this.scrollTop = Math.min(
+      this.scrollTop,
+      Math.max(0, this.contentLines.length - this.viewportHeight),
+    );
+    this.canApprove =
+      this.focused &&
+      this.reviewLine === undefined &&
+      this.selected === 1 &&
+      width >= visibleWidth(` → ${UNSANDBOXED_APPROVAL_CHOICES[1]} `);
+    const visible = Array.from({ length: this.viewportHeight }, (_, index) => {
+      const row = this.scrollTop + index;
+      const line = this.contentLines[row] ?? "";
+      const cursor = this.focused && row === this.reviewLine ? CURSOR_MARKER : "";
+      const text = row === 0 ? this.theme.fg("accent", this.theme.bold(line)) : line;
+      return ` ${cursor}${text}`;
+    });
+    return [
+      ...border,
+      ...gap,
+      ...visible,
+      ...gap,
+      ...choices,
+      ...gap,
+      ...hints,
+      ...reviewHints,
+      ...gap,
+      ...border,
+    ];
+  }
+
+  handleInput(data: string): void {
+    const kb = this.keybindings;
+    if (kb.matches(data, "tui.select.cancel")) {
+      this.done(undefined);
+      return;
+    }
+    if (
+      this.renderedWidth !== this.tui.terminal.columns ||
+      this.renderedHeight !== this.tui.terminal.rows
+    ) {
+      this.canApprove = false;
+      this.selected = 0;
+      this.tui.requestRender();
+      return;
+    }
+    if (kb.matches(data, "tui.select.confirm")) {
+      if (this.selected === 0) this.done("Deny");
+      else if (this.canApprove) this.done("Run once outside sandbox");
+      return;
+    }
+    if (kb.matches(data, "tui.select.up") || kb.matches(data, "tui.select.down")) {
+      this.selected = kb.matches(data, "tui.select.down") && this.viewportHeight > 0 ? 1 : 0;
+      this.reviewLine = undefined;
+      this.canApprove = false;
+    }
+    // Pi does not expose the editor dock's height. Advance one review line so its
+    // cursor can reveal every line even when only part of this component fits.
+    else if (kb.matches(data, "tui.editor.pageUp")) this.scroll(-1);
+    else if (kb.matches(data, "tui.editor.pageDown")) this.scroll(1);
+    else if (kb.matches(data, "tui.editor.cursorLineStart")) this.scroll(-this.contentLines.length);
+    else if (kb.matches(data, "tui.editor.cursorLineEnd")) this.scroll(this.contentLines.length);
+    this.tui.requestRender();
+  }
+
+  handleMouse(event: TuiMouseEvent): TuiMouseEventResult | undefined {
+    if (event.type !== "wheel") return undefined;
+    this.scroll(event.wheelDelta ?? 0);
+    return { handled: true, render: true };
+  }
+
+  invalidate(): void {
+    this.content.invalidate();
+  }
+
+  private scroll(lines: number): void {
+    this.selected = 0;
+    this.canApprove = false;
+    this.reviewLine = Math.max(
+      0,
+      Math.min(this.contentLines.length - 1, (this.reviewLine ?? 0) + lines),
+    );
+  }
+}
+
+/** Preserve layout newlines while making untrusted terminal and Unicode controls inert. */
+function escapeControls(text: string): string {
+  return text.replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu, (character) =>
+    character === "\n"
+      ? character
+      : character
+          .split("")
+          .map((unit) => `\\u${unit.charCodeAt(0).toString(16).padStart(4, "0")}`)
+          .join(""),
+  );
+}