thatgfsj-code 0.2.1

package/src/core/permissions.ts

@@ -0,0 +1,308 @@
+/**
+ * S03: Permissions System
+ * 6-stage permission pipeline for tool execution
+ * Core principle: permissions are first-class citizens, not an afterthought
+ */
+
+import chalk from 'chalk';
+import { ToolContext, ToolMetadata } from './types.js';
+
+// ==================== Permission Types ====================
+
+export type PermissionMode = 'accept' | 'deny' | 'ask';
+export type PermissionLevel = 'none' | 'low' | 'medium' | 'high' | 'critical';
+
+export interface PermissionResult {
+  allowed: boolean;
+  reason: string;
+  level: PermissionLevel;
+  requiresConfirmation: boolean;
+  stage: 1 | 2 | 3 | 4 | 5 | 6;
+}
+
+/**
+ * Permission rule — pattern-based allow/deny rules
+ */
+export interface PermissionRule {
+  pattern: RegExp;
+  action: 'allow' | 'deny';
+  reason: string;
+}
+
+/**
+ * S03: Permission Checker — 6-stage pipeline
+ */
+export class PermissionChecker {
+  private mode: PermissionMode = 'ask';
+  private rules: PermissionRule[] = [];
+  private workspaceRoot: string;
+
+  // Stage 1: Blocked patterns
+  private static BLOCKED_PATTERNS = [
+    /^rm\s+-rf\s+\//i,
+    /^rm\s+-rf\s+\$HOME/i,
+    /^rm\s+-rf\s+%USERPROFILE%/i,
+    /^del\s+\/f\s+\/s\s+\/q/i,
+    /^format\s+[a-z]:/i,
+    /^mkfs/i,
+    /^dd\s+if=/i,
+    /^shred/i,
+    />\s*\/dev\/sda/i,
+    /^curl\s+.*\||^wget\s+.*\|/i,
+    /^eval\s+/i,
+    /^exec\s+/i,
+    /base64\s+-d\s+.*\|/i,
+    /\$\(.*\)/i,
+    /`.*`/i,
+  ];
+
+  // Stage 2: Commands needing confirmation
+  private static CONFIRM_REQUIRED = [
+    'rm -rf',
+    'rmdir',
+    'del /s /q',
+    'format',
+    'mkfs',
+    'dd',
+    'shutdown',
+    'init 0',
+    'init 6',
+    'poweroff',
+    'reboot',
+    'pkill',
+    'killall',
+    'mv .* /tmp',
+    'chmod 777',
+    'chmod -R 777',
+    'git push --force',
+    'git push -f',
+  ];
+
+  // Stage 4: AI borderline commands (use LLM to classify)
+  private static BORDERLINE_PATTERNS = [
+    /curl\s+https?:\/\//i,
+    /wget\s+/i,
+    /npm\s+install\s+-g/i,
+    /pip\s+install\s+/i,
+    /yarn\s+add\s+/i,
+    /sudo\s+/i,
+    /chown\s+/i,
+    /chmod\s+[67]/i,
+    /^git\s+reset/i,
+    /^git\s+clean/i,
+  ];
+
+  constructor(workspaceRoot: string = process.cwd()) {
+    this.workspaceRoot = workspaceRoot;
+  }
+
+  /**
+   * S03: 6-Stage Permission Pipeline
+   * Every tool execution passes through all 6 stages
+   */
+  async check(
+    toolName: string,
+    params: Record<string, any>,
+    ctx: ToolContext
+  ): Promise<PermissionResult> {
+
+    // Stage 1: Pattern block — reject known dangerous commands immediately
+    const stage1 = this.stage1PatternBlock(toolName, params);
+    if (!stage1.allowed) return stage1;
+
+    // Stage 2: Permission rules — check user-defined allow/deny rules
+    const stage2 = this.stage2Rules(toolName, params);
+    if (!stage2.allowed) return stage2;
+
+    // Stage 3: Path sandboxing — prevent workspace escape
+    const stage3 = this.stage3PathSandbox(toolName, params);
+    if (!stage3.allowed) return stage3;
+
+    // Stage 4: AI classification for borderline cases
+    const stage4 = await this.stage4AIClassify(toolName, params, ctx);
+    if (!stage4.allowed) return stage4;
+
+    // Stage 5: User confirmation for medium/high risk
+    const stage5 = this.stage5Confirmation(toolName, params, ctx);
+    if (stage5.requiresConfirmation) {
+      return stage5;
+    }
+
+    // Stage 6: Pass through
+    return {
+      allowed: true,
+      reason: 'Allowed',
+      level: stage5.level,
+      requiresConfirmation: false,
+      stage: 6
+    };
+  }
+
+  // Stage 1: Pattern block
+  private stage1PatternBlock(toolName: string, params: Record<string, any>): PermissionResult {
+    if (toolName !== 'shell') return { allowed: true, reason: 'Stage 1: N/A', level: 'none', requiresConfirmation: false, stage: 1 };
+
+    const command = params.command || '';
+    for (const pattern of PermissionChecker.BLOCKED_PATTERNS) {
+      if (pattern.test(command.trim())) {
+        return {
+          allowed: false,
+          reason: `Blocked: command matches dangerous pattern ${pattern}`,
+          level: 'critical',
+          requiresConfirmation: false,
+          stage: 1
+        };
+      }
+    }
+    return { allowed: true, reason: 'Stage 1: Passed pattern check', level: 'none', requiresConfirmation: false, stage: 1 };
+  }
+
+  // Stage 2: User-defined rules
+  private stage2Rules(toolName: string, params: Record<string, any>): PermissionResult {
+    const command = params.command || '';
+
+    for (const rule of this.rules) {
+      if (rule.pattern.test(command)) {
+        return {
+          allowed: rule.action === 'allow',
+          reason: `Rule matched: ${rule.reason}`,
+          level: rule.action === 'deny' ? 'high' : 'none',
+          requiresConfirmation: false,
+          stage: 2
+        };
+      }
+    }
+    return { allowed: true, reason: 'Stage 2: No rules matched', level: 'none', requiresConfirmation: false, stage: 2 };
+  }
+
+  // Stage 3: Path sandboxing
+  private stage3PathSandbox(toolName: string, params: Record<string, any>): PermissionResult {
+    if (toolName !== 'shell' && toolName !== 'file') return { allowed: true, reason: 'Stage 3: N/A', level: 'none', requiresConfirmation: false, stage: 3 };
+
+    const path = params.path || params.command || '';
+
+    // Check for path traversal attempts
+    if (/^\.\.\//.test(path) || /\%00/.test(path) || /\0/.test(path)) {
+      return {
+        allowed: false,
+        reason: 'Blocked: path traversal attempt detected',
+        level: 'high',
+        requiresConfirmation: false,
+        stage: 3
+      };
+    }
+
+    return { allowed: true, reason: 'Stage 3: Path sandbox passed', level: 'none', requiresConfirmation: false, stage: 3 };
+  }
+
+  // Stage 4: AI classification for borderline commands
+  private async stage4AIClassify(
+    toolName: string,
+    params: Record<string, any>,
+    ctx: ToolContext
+  ): Promise<PermissionResult> {
+    if (toolName !== 'shell') return { allowed: true, reason: 'Stage 4: N/A', level: 'none', requiresConfirmation: false, stage: 4 };
+
+    const command = params.command || '';
+
+    // Check if borderline
+    const isBorderline = PermissionChecker.BORDERLINE_PATTERNS.some(p => p.test(command));
+    if (!isBorderline) {
+      return { allowed: true, reason: 'Stage 4: Not borderline', level: 'none', requiresConfirmation: false, stage: 4 };
+    }
+
+    // For CLI, mark as medium risk (actual AI classification skipped for perf)
+    return {
+      allowed: true,
+      reason: 'Stage 4: Borderline — escalated to confirmation',
+      level: 'medium',
+      requiresConfirmation: false,
+      stage: 4
+    };
+  }
+
+  // Stage 5: User confirmation
+  private stage5Confirmation(
+    toolName: string,
+    params: Record<string, any>,
+    ctx: ToolContext
+  ): PermissionResult {
+    if (this.mode === 'accept') {
+      return { allowed: true, reason: 'Mode: accept all', level: 'none', requiresConfirmation: false, stage: 5 };
+    }
+
+    if (this.mode === 'deny') {
+      return { allowed: false, reason: 'Mode: deny all', level: 'high', requiresConfirmation: false, stage: 5 };
+    }
+
+    // mode === 'ask'
+    const command = params.command || '';
+
+    // Critical: auto-deny
+    if (/rm\s+-rf/.test(command) && !command.includes('node_modules')) {
+      return {
+        allowed: false,
+        reason: 'Auto-deny: rm -rf without node_modules is too risky',
+        level: 'critical',
+        requiresConfirmation: false,
+        stage: 5
+      };
+    }
+
+    // Check confirm required list
+    const needsConfirm = PermissionChecker.CONFIRM_REQUIRED.some(cmd =>
+      command.toLowerCase().includes(cmd.toLowerCase())
+    );
+
+    if (needsConfirm) {
+      return {
+        allowed: true,
+        reason: 'Requires user confirmation',
+        level: 'medium',
+        requiresConfirmation: true,
+        stage: 5
+      };
+    }
+
+    return { allowed: true, reason: 'Stage 5: No confirmation needed', level: 'low', requiresConfirmation: false, stage: 5 };
+  }
+
+  // ==================== Config Methods ====================
+
+  setMode(mode: PermissionMode) {
+    this.mode = mode;
+  }
+
+  getMode(): PermissionMode {
+    return this.mode;
+  }
+
+  addRule(pattern: RegExp, action: 'allow' | 'deny', reason: string) {
+    this.rules.push({ pattern, action, reason });
+  }
+
+  clearRules() {
+    this.rules = [];
+  }
+
+  setWorkspaceRoot(path: string) {
+    this.workspaceRoot = path;
+  }
+}
+
+// ==================== Permission Mode CLI ====================
+
+export function printPermissionResult(result: PermissionResult, command?: string) {
+  if (!result.allowed) {
+    console.log(chalk.red(`\n🚫 BLOCKED [Stage ${result.stage}]: ${result.reason}`));
+    return;
+  }
+
+  if (result.requiresConfirmation && command) {
+    console.log(chalk.yellow(`\n⚠️  Requires confirmation [Stage ${result.stage}]: ${result.reason}`));
+    console.log(chalk.gray(`  Command: ${command}`));
+    return;
+  }
+
+  console.log(chalk.green(`\n✅ Allowed [Stage ${result.stage}]: ${result.reason}`));
+}

package/src/core/session.ts

@@ -0,0 +1,165 @@
+/**
+ * Session Manager - Manages conversation history
+ *
+ * F4 (anti-[已中断]):
+ *   - addMessage 拦截含"已中断" / 链形 think 块等污染字符串
+ *     （之前 AI 在失败重试时会把这些字面写进 history 造成病毒循环）
+ *   - sanitize() 在 lastMessages 输出到 LLM 前再做一次去噪
+ */
+
+import { ChatMessage, Session } from './types.js';
+
+/**
+ * Patterns that indicate the message is polluted by a previous broken
+ * tool/stream retry loop. These should never be re-sent to the LLM.
+ */
+const POLLUTION_PATTERNS: RegExp[] = [
+  /\[已中断/,                       // literally "[已中断" - sentinel from bad run
+  /\u5df2\u4e2d\u65ad/,              // 已中断 (escaped form)
+  /^\s*\[已中断\s*$/m,                // line that is exactly [已中断
+  /^<think>[\s\S]*?<\/think>\s*$/m,  // entire message that is just a think block
+  /\u{1F6AB}/u,                     // ⛔ emoji sometimes used as interrupt marker
+];
+
+function looksPolluted(content: string): boolean {
+  if (!content) return false;
+  // Strip obvious thinking fences and check the *remaining* core content.
+  const stripped = content
+    .replace(/<think>[\s\S]*?<\/think>/g, '')
+    .replace(/<\/?think>/g, '')
+    .trim();
+
+  for (const p of POLLUTION_PATTERNS) {
+    if (p.test(content)) return true;
+  }
+
+  // A message whose entire stripped form is shorter than 6 chars AND
+  // contains an interruption-related token is also suspect.
+  if (stripped.length < 6 && /(中断|interrupted|cancelled|已取消)/i.test(stripped)) {
+    return true;
+  }
+  return false;
+}
+
+export class SessionManager {
+  private messages: ChatMessage[] = [];
+  private sessionId: string;
+  private createdAt: Date;
+  private droppedCount = 0;
+
+  constructor() {
+    this.sessionId = this.generateId();
+    this.createdAt = new Date();
+  }
+
+  /**
+   * Add a message to the session.
+   * Returns true if accepted, false if dropped because it looked polluted.
+   */
+  addMessage(role: ChatMessage['role'], content: string): boolean {
+    if (role !== 'system' && looksPolluted(content)) {
+      this.droppedCount++;
+      // Keep a 1-line internal note so the user can see *something* happened,
+      // but the original polluted text does NOT go to the LLM context.
+      this.messages.push({
+        role: 'user',
+        content: '[system: dropped a polluted prior message containing "已中断" markers. Continue with the original task.]',
+        name: 'system'
+      });
+      return false;
+    }
+
+    this.messages.push({
+      role,
+      content,
+      name: role === 'user' ? 'user' : undefined
+    });
+    return true;
+  }
+
+  /**
+   * Add a message WITHOUT any sanitization (for trusted callers, e.g. system prompt)
+   */
+  addMessageRaw(role: ChatMessage['role'], content: string): void {
+    this.messages.push({ role, content });
+  }
+
+  /**
+   * How many polluted messages have we filtered out? Useful for debugging
+   * the "AI keeps saying interrupted" loop.
+   */
+  getDroppedCount(): number {
+    return this.droppedCount;
+  }
+
+  /**
+   * Return messages ready to send to the LLM.  We additionally dedupe
+   * adjacent identical assistant messages (a recovery hack against the
+   * "AI repeats the same paragraph each turn" loop).
+   */
+  getMessages(): ChatMessage[] {
+    const out: ChatMessage[] = [];
+    for (let i = 0; i < this.messages.length; i++) {
+      const m = this.messages[i];
+      const prev = out[out.length - 1];
+      if (
+        prev &&
+        m.role === 'assistant' &&
+        prev.role === 'assistant' &&
+        m.content.length > 0 &&
+        m.content === prev.content
+      ) {
+        // collapse identical neighbour
+        continue;
+      }
+      out.push(m);
+    }
+    return out;
+  }
+
+  /**
+   * Get message count (raw, includes internal notes)
+   */
+  getMessageCount(): number {
+    return this.messages.length;
+  }
+
+  /**
+   * Clear session history
+   */
+  clear(): void {
+    this.messages = [];
+    this.droppedCount = 0;
+  }
+
+  /**
+   * Get session info
+   */
+  getSession(): Session {
+    return {
+      id: this.sessionId,
+      messages: this.messages,
+      createdAt: this.createdAt,
+      lastActiveAt: new Date()
+    };
+  }
+
+  /**
+   * Truncate messages to fit token limit
+   */
+  truncate(maxMessages: number = 20): void {
+    if (this.messages.length > maxMessages) {
+      const systemMsg = this.messages.find(m => m.role === 'system');
+      const otherMsgs = this.messages.filter(m => m.role !== 'system');
+
+      this.messages = [
+        ...(systemMsg ? [systemMsg] : []),
+        ...otherMsgs.slice(-(maxMessages - 1))
+      ];
+    }
+  }
+
+  private generateId(): string {
+    return `session_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
+  }
+}

package/src/core/skills.ts

@@ -0,0 +1,208 @@
+/**
+ * S10: Skills System
+ * Load skills from CLAUDE.md files and expose them as available commands
+ * 
+ * Skills are domain-specific knowledge packages that extend agent capabilities.
+ */
+
+import { readFileSync, existsSync, readdirSync, statSync } from 'fs';
+import { join, dirname } from 'path';
+
+export interface Skill {
+  name: string;
+  description: string;
+  prompt: string;
+  source: string; // File path or 'builtin'
+  tags: string[];
+}
+
+export interface SkillsCatalog {
+  skills: Skill[];
+  loadedAt: Date;
+  sources: string[];
+}
+
+/**
+ * S10: Skills Loader — discovers and loads skills from filesystem
+ */
+export class SkillsLoader {
+  private skills: Map<string, Skill> = new Map();
+  private sources: Set<string> = new Set();
+
+  /**
+   * S10: Load skills from a directory
+   * Looks for .md files with # SkillName header
+   */
+  loadFromDir(dirPath: string): number {
+    if (!existsSync(dirPath)) return 0;
+
+    let count = 0;
+    const files = readdirSync(dirPath);
+
+    for (const file of files) {
+      const fullPath = join(dirPath, file);
+      const stat = statSync(fullPath);
+
+      if (stat.isDirectory()) {
+        count += this.loadFromDir(fullPath);
+        continue;
+      }
+
+      if (file.endsWith('.md') || file.endsWith('.skill')) {
+        const loaded = this.loadFromFile(fullPath);
+        if (loaded) count++;
+      }
+    }
+
+    return count;
+  }
+
+  /**
+   * S10: Load a single skill file
+   */
+  loadFromFile(filePath: string): boolean {
+    try {
+      const content = readFileSync(filePath, 'utf-8');
+      const skill = this.parseSkillFile(content, filePath);
+      if (skill) {
+        this.skills.set(skill.name, skill);
+        this.sources.add(filePath);
+        return true;
+      }
+    } catch (error) {
+      // Ignore errors
+    }
+    return false;
+  }
+
+  /**
+   * S10: Parse a skill file — extract name, description, prompt from markdown
+   */
+  private parseSkillFile(content: string, source: string): Skill | null {
+    const lines = content.split('\n');
+
+    // Find skill name from first heading
+    let name = '';
+    let description = '';
+    let promptLines: string[] = [];
+    let inPrompt = false;
+    let tags: string[] = [];
+
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+
+      // Match # SkillName or ## SkillName
+      if (/^#{1,2}\s+(\S+)/.test(line.trim())) {
+        if (!name) {
+          name = line.replace(/^#{1,2}\s+/, '').trim();
+        } else {
+          // Second heading — end of prompt
+          break;
+        }
+        continue;
+      }
+
+      // Description line (after name, before first code block or empty line)
+      if (name && !description && line.trim() && !line.startsWith('```')) {
+        description = line.trim();
+      }
+
+      // Code block — start of prompt template
+      if (line.startsWith('```')) {
+        if (!inPrompt) {
+          inPrompt = true;
+          continue;
+        } else {
+          // End of prompt
+          break;
+        }
+      }
+
+      if (inPrompt) {
+        promptLines.push(line);
+      }
+    }
+
+    if (!name) return null;
+
+    return {
+      name,
+      description: description || name,
+      prompt: promptLines.join('\n').trim(),
+      source,
+      tags: this.extractTags(content)
+    };
+  }
+
+  private extractTags(content: string): string[] {
+    const tagMatch = content.match(/tags?:\s*(.+)/i);
+    if (tagMatch) {
+      return tagMatch[1].split(/[,\s]+/).filter(Boolean);
+    }
+    return [];
+  }
+
+  /**
+   * S10: Get all skills
+   */
+  getAll(): Skill[] {
+    return [...this.skills.values()];
+  }
+
+  /**
+   * S10: Get skill by name
+   */
+  get(name: string): Skill | undefined {
+    return this.skills.get(name);
+  }
+
+  /**
+   * S10: Search skills by tag or name
+   */
+  search(query: string): Skill[] {
+    const q = query.toLowerCase();
+    return this.getAll().filter(s =>
+      s.name.toLowerCase().includes(q) ||
+      s.description.toLowerCase().includes(q) ||
+      s.tags.some(t => t.toLowerCase().includes(q))
+    );
+  }
+
+  /**
+   * S10: Get catalog
+   */
+  getCatalog(): SkillsCatalog {
+    return {
+      skills: this.getAll(),
+      loadedAt: new Date(),
+      sources: [...this.sources]
+    };
+  }
+}
+
+/**
+ * S10: Built-in skills
+ */
+export const BUILT_IN_SKILLS: Skill[] = [
+  {
+    name: 'explain-code',
+    description: 'Explain what a piece of code does in plain English',
+    prompt: 'Explain this code:\n\n```\n{{CODE}}\n```\n\nBe concise and clear.',
+    source: 'builtin',
+    tags: ['analysis', 'documentation']
+  },
+  {
+    name: 'review-code',
+    description: 'Review code for bugs, performance issues, and best practices',
+    prompt: 'Review this code:\n\n```\n{{CODE}}\n```\n\nFocus on: bugs, security, performance, readability.',
+    source: 'builtin',
+    tags: ['review', 'quality']
+  },
+  {
+    name: 'write-test',
+    description: 'Generate unit tests for the given code',
+    prompt: 'Write unit tests for:\n\n```\n{{CODE}}\n```\n\nUse a testing framework appropriate for the language.',
+    source: 'builtin',
+    tags: ['testing', 'quality']
+  }
+];