ummaya 0.2.3 → 0.2.5

package/tui/src/tools/BashTool/bashPermissions/legacyMisparsing.ts

@@ -0,0 +1,62 @@
+import { feature } from 'bun:bundle'
+import type { ToolUseContext } from '../../../Tool.js'
+import { createPermissionRequestMessage } from '../../../utils/permissions/permissions.js'
+import { bashCommandIsSafeAsync_DEPRECATED, stripSafeHeredocSubstitutions } from '../bashSecurity.js'
+import type { BashToolInput } from '../schemas.js'
+import { BASH_TOOL_NAME } from '../toolName.js'
+import { buildPendingClassifierCheck } from './classifierChecks.js'
+import { bashToolCheckExactMatchPermission } from './permissionChecks.js'
+
+const bashCommandIsSafeAsync = bashCommandIsSafeAsync_DEPRECATED
+
+export async function checkLegacyMisparsing(
+  input: BashToolInput,
+  context: ToolUseContext,
+) {
+  const originalCommandSafetyResult = await bashCommandIsSafeAsync(input.command)
+  if (
+    originalCommandSafetyResult.behavior !== 'ask' ||
+    !originalCommandSafetyResult.isBashSecurityCheckForMisparsing
+  ) {
+    return null
+  }
+
+  const remainder = stripSafeHeredocSubstitutions(input.command)
+  const remainderResult =
+    remainder !== null ? await bashCommandIsSafeAsync(remainder) : null
+  if (
+    remainder !== null &&
+    !(
+      remainderResult?.behavior === 'ask' &&
+      remainderResult.isBashSecurityCheckForMisparsing
+    )
+  ) {
+    return null
+  }
+
+  const appState = context.getAppState()
+  const exactMatchResult = bashToolCheckExactMatchPermission(
+    input,
+    appState.toolPermissionContext,
+  )
+  if (exactMatchResult.behavior === 'allow') return exactMatchResult
+
+  const decisionReason = {
+    type: 'other' as const,
+    reason: originalCommandSafetyResult.message,
+  }
+  return {
+    behavior: 'ask' as const,
+    message: createPermissionRequestMessage(BASH_TOOL_NAME, decisionReason),
+    decisionReason,
+    suggestions: [],
+    ...(feature('BASH_CLASSIFIER')
+      ? {
+          pendingClassifierCheck: buildPendingClassifierCheck(
+            input.command,
+            appState.toolPermissionContext,
+          ),
+        }
+      : {}),
+  }
+}

package/tui/src/tools/BashTool/bashPermissions/main.ts

@@ -0,0 +1,135 @@
+import type { ToolUseContext } from '../../../Tool.js'
+import {
+  getCommandSubcommandPrefix,
+  splitCommand_DEPRECATED,
+} from '../../../utils/bash/commands.js'
+import { getCwd } from '../../../utils/cwd.js'
+import { logForDebugging } from '../../../utils/debug.js'
+import { isEnvTruthy } from '../../../utils/envUtils.js'
+import { createPermissionRequestMessage } from '../../../utils/permissions/permissions.js'
+import { getPlatform } from '../../../utils/platform.js'
+import { SandboxManager } from '../../../utils/sandbox/sandbox-adapter.js'
+import { windowsPathToPosixPath } from '../../../utils/windowsPaths.js'
+import type { BashToolInput } from '../schemas.js'
+import { shouldUseSandbox } from '../shouldUseSandbox.js'
+import { BASH_TOOL_NAME } from '../toolName.js'
+import { prepareAstPermissionState } from './astPreflight.js'
+import { checkSubcommandDirectoryGuards } from './compoundGuards.js'
+import { MAX_SUBCOMMANDS_FOR_SECURITY_CHECK } from './constants.js'
+import { checkLegacyMisparsing } from './legacyMisparsing.js'
+import { resolveCommandOperatorPermission } from './operatorFlow.js'
+import { bashToolCheckExactMatchPermission } from './permissionChecks.js'
+import { checkPromptClassifierRules } from './promptClassifierRules.js'
+import { checkSandboxAutoAllow } from './sandboxAutoAllow.js'
+import { resolveSubcommandPermissionFlow } from './subcommandFlow.js'
+import { filterCdCwdSubcommands } from './subcommandGuards.js'
+
+const splitCommand = splitCommand_DEPRECATED
+
+export async function bashToolHasPermission(
+  input: BashToolInput,
+  context: ToolUseContext,
+  getCommandSubcommandPrefixFn = getCommandSubcommandPrefix,
+) {
+  let appState = context.getAppState()
+  const astPreflight = await prepareAstPermissionState(
+    input,
+    appState.toolPermissionContext,
+  )
+  if (astPreflight.kind === 'return') return astPreflight.result
+  const astState = astPreflight.state
+
+  if (
+    SandboxManager.isSandboxingEnabled() &&
+    SandboxManager.isAutoAllowBashIfSandboxedEnabled() &&
+    shouldUseSandbox(input)
+  ) {
+    const sandboxAutoAllowResult = checkSandboxAutoAllow(
+      input,
+      appState.toolPermissionContext,
+    )
+    if (sandboxAutoAllowResult.behavior !== 'passthrough') {
+      return sandboxAutoAllowResult
+    }
+  }
+
+  const exactMatchResult = bashToolCheckExactMatchPermission(
+    input,
+    appState.toolPermissionContext,
+  )
+  if (exactMatchResult.behavior === 'deny') return exactMatchResult
+
+  const promptClassifierResult = await checkPromptClassifierRules(
+    input,
+    context,
+    getCommandSubcommandPrefixFn,
+  )
+  if (promptClassifierResult !== null) return promptClassifierResult
+
+  const operatorResult = await resolveCommandOperatorPermission(
+    input,
+    context,
+    astState,
+    getCommandSubcommandPrefixFn,
+    bashToolHasPermission,
+  )
+  if (operatorResult !== null) return operatorResult
+
+  if (
+    astState.astSubcommands === null &&
+    !isEnvTruthy(process.env.CLAUDE_CODE_DISABLE_COMMAND_INJECTION_CHECK)
+  ) {
+    const legacyMisparsingResult = await checkLegacyMisparsing(input, context)
+    if (legacyMisparsingResult !== null) return legacyMisparsingResult
+  }
+
+  const cwd = getCwd()
+  const cwdMingw =
+    getPlatform() === 'windows' ? windowsPathToPosixPath(cwd) : cwd
+  const rawSubcommands =
+    astState.astSubcommands ??
+    astState.shadowLegacySubs ??
+    splitCommand(input.command)
+  const { subcommands, astCommandsByIdx } = filterCdCwdSubcommands(
+    rawSubcommands,
+    astState.astCommands,
+    cwd,
+    cwdMingw,
+  )
+
+  if (
+    astState.astSubcommands === null &&
+    subcommands.length > MAX_SUBCOMMANDS_FOR_SECURITY_CHECK
+  ) {
+    logForDebugging(
+      `bashPermissions: ${subcommands.length} subcommands exceeds cap (${MAX_SUBCOMMANDS_FOR_SECURITY_CHECK}) — returning ask`,
+      { level: 'debug' },
+    )
+    const decisionReason = {
+      type: 'other' as const,
+      reason: `Command splits into ${subcommands.length} subcommands, too many to safety-check individually`,
+    }
+    return {
+      behavior: 'ask' as const,
+      message: createPermissionRequestMessage(BASH_TOOL_NAME, decisionReason),
+      decisionReason,
+    }
+  }
+
+  const directoryGuard = checkSubcommandDirectoryGuards(input, subcommands)
+  if (directoryGuard.result !== null) return directoryGuard.result
+
+  appState = context.getAppState()
+  return resolveSubcommandPermissionFlow({
+    input,
+    context,
+    exactMatchResult,
+    subcommands,
+    astCommandsByIdx,
+    astRedirects: astState.astRedirects,
+    astCommands: astState.astCommands,
+    astSubcommands: astState.astSubcommands,
+    compoundCommandHasCd: directoryGuard.compoundCommandHasCd,
+    getCommandSubcommandPrefixFn,
+  })
+}

package/tui/src/tools/BashTool/bashPermissions/normalizedCommands.ts

@@ -0,0 +1,33 @@
+import { splitCommand_DEPRECATED } from '../../../utils/bash/commands.js'
+import { tryParseShellCommand } from '../../../utils/bash/shellQuote.js'
+import { stripSafeWrappers } from './wrapperStripping.js'
+
+const splitCommand = splitCommand_DEPRECATED
+
+export function isNormalizedGitCommand(command: string): boolean {
+  if (command.startsWith('git ') || command === 'git') return true
+  const stripped = stripSafeWrappers(command)
+  const parsed = tryParseShellCommand(stripped)
+  if (parsed.success && parsed.tokens.length > 0) {
+    if (parsed.tokens[0] === 'git') return true
+    if (parsed.tokens[0] === 'xargs' && parsed.tokens.includes('git')) {
+      return true
+    }
+    return false
+  }
+  return /^git(?:\s|$)/.test(stripped)
+}
+
+export function isNormalizedCdCommand(command: string): boolean {
+  const stripped = stripSafeWrappers(command)
+  const parsed = tryParseShellCommand(stripped)
+  if (parsed.success && parsed.tokens.length > 0) {
+    const cmd = parsed.tokens[0]
+    return cmd === 'cd' || cmd === 'pushd' || cmd === 'popd'
+  }
+  return /^(?:cd|pushd|popd)(?:\s|$)/.test(stripped)
+}
+
+export function commandHasAnyCd(command: string): boolean {
+  return splitCommand(command).some(subcmd => isNormalizedCdCommand(subcmd.trim()))
+}

package/tui/src/tools/BashTool/bashPermissions/operatorFlow.ts

@@ -0,0 +1,98 @@
+import { feature } from 'bun:bundle'
+import type { ToolUseContext } from '../../../Tool.js'
+import { getCwd } from '../../../utils/cwd.js'
+import { createPermissionRequestMessage } from '../../../utils/permissions/permissions.js'
+import { checkCommandOperatorPermissions } from '../bashCommandHelpers.js'
+import { bashCommandIsSafeAsync_DEPRECATED } from '../bashSecurity.js'
+import { checkPathConstraints } from '../pathValidation.js'
+import type { BashToolInput } from '../schemas.js'
+import { BASH_TOOL_NAME } from '../toolName.js'
+import { buildPendingClassifierCheck } from './classifierChecks.js'
+import {
+  commandHasAnyCd,
+  isNormalizedCdCommand,
+  isNormalizedGitCommand,
+} from './normalizedCommands.js'
+import type {
+  BashAstPermissionState,
+  CommandPrefixResolver,
+  PermissionRunner,
+} from './types.js'
+
+const bashCommandIsSafeAsync = bashCommandIsSafeAsync_DEPRECATED
+
+export async function resolveCommandOperatorPermission(
+  input: BashToolInput,
+  context: ToolUseContext,
+  astState: BashAstPermissionState,
+  getCommandSubcommandPrefixFn: CommandPrefixResolver,
+  runPermissionCheck: PermissionRunner,
+) {
+  const commandOperatorResult = await checkCommandOperatorPermissions(
+    input,
+    (i: BashToolInput) =>
+      runPermissionCheck(i, context, getCommandSubcommandPrefixFn),
+    { isNormalizedCdCommand, isNormalizedGitCommand },
+    astState.astRoot,
+  )
+  if (commandOperatorResult.behavior === 'passthrough') return null
+
+  if (commandOperatorResult.behavior === 'allow') {
+    const safetyResult =
+      astState.astSubcommands === null
+        ? await bashCommandIsSafeAsync(input.command)
+        : null
+    if (
+      safetyResult !== null &&
+      safetyResult.behavior !== 'passthrough' &&
+      safetyResult.behavior !== 'allow'
+    ) {
+      const appState = context.getAppState()
+      const reason =
+        safetyResult.message ?? 'Command contains patterns that require approval'
+      return {
+        behavior: 'ask' as const,
+        message: createPermissionRequestMessage(BASH_TOOL_NAME, {
+          type: 'other',
+          reason,
+        }),
+        decisionReason: { type: 'other' as const, reason },
+        ...(feature('BASH_CLASSIFIER')
+          ? {
+              pendingClassifierCheck: buildPendingClassifierCheck(
+                input.command,
+                appState.toolPermissionContext,
+              ),
+            }
+          : {}),
+      }
+    }
+
+    const appState = context.getAppState()
+    const pathResult = checkPathConstraints(
+      input,
+      getCwd(),
+      appState.toolPermissionContext,
+      commandHasAnyCd(input.command),
+      astState.astRedirects,
+      astState.astCommands,
+    )
+    if (pathResult.behavior !== 'passthrough') return pathResult
+  }
+
+  if (commandOperatorResult.behavior === 'ask') {
+    const appState = context.getAppState()
+    return {
+      ...commandOperatorResult,
+      ...(feature('BASH_CLASSIFIER')
+        ? {
+            pendingClassifierCheck: buildPendingClassifierCheck(
+              input.command,
+              appState.toolPermissionContext,
+            ),
+          }
+        : {}),
+    }
+  }
+  return commandOperatorResult
+}

package/tui/src/tools/BashTool/bashPermissions/permissionChecks.ts

@@ -0,0 +1,200 @@
+import type { ToolPermissionContext } from '../../../Tool.js'
+import type { CommandPrefixResult } from '../../../utils/bash/commands.js'
+import type { SimpleCommand } from '../../../utils/bash/ast.js'
+import { getCwd } from '../../../utils/cwd.js'
+import { isEnvTruthy } from '../../../utils/envUtils.js'
+import type {
+  PermissionDecisionReason,
+  PermissionResult,
+} from '../../../utils/permissions/PermissionResult.js'
+import { createPermissionRequestMessage } from '../../../utils/permissions/permissions.js'
+import type { BashToolInput } from '../schemas.js'
+import { bashCommandIsSafeAsync_DEPRECATED } from '../bashSecurity.js'
+import { checkPermissionMode } from '../modeValidation.js'
+import { checkPathConstraints } from '../pathValidation.js'
+import { checkReadOnlyConstraints } from '../readOnlyValidation.js'
+import { checkSedConstraints } from '../sedValidation.js'
+import { BASH_TOOL_NAME } from '../toolName.js'
+import { commandHasAnyCd } from './normalizedCommands.js'
+import {
+  suggestionForExactCommand,
+  suggestionForPrefix,
+} from './prefixSuggestions.js'
+import { matchingRulesForInput } from './ruleMatching.js'
+
+const bashCommandIsSafeAsync = bashCommandIsSafeAsync_DEPRECATED
+
+export const bashToolCheckExactMatchPermission = (
+  input: BashToolInput,
+  toolPermissionContext: ToolPermissionContext,
+): PermissionResult => {
+  const command = input.command.trim()
+  const { matchingDenyRules, matchingAskRules, matchingAllowRules } =
+    matchingRulesForInput(input, toolPermissionContext, 'exact')
+
+  if (matchingDenyRules[0] !== undefined) {
+    return {
+      behavior: 'deny',
+      message: `Permission to use ${BASH_TOOL_NAME} with command ${command} has been denied.`,
+      decisionReason: { type: 'rule', rule: matchingDenyRules[0] },
+    }
+  }
+  if (matchingAskRules[0] !== undefined) {
+    return {
+      behavior: 'ask',
+      message: createPermissionRequestMessage(BASH_TOOL_NAME),
+      decisionReason: { type: 'rule', rule: matchingAskRules[0] },
+    }
+  }
+  if (matchingAllowRules[0] !== undefined) {
+    return {
+      behavior: 'allow',
+      updatedInput: input,
+      decisionReason: { type: 'rule', rule: matchingAllowRules[0] },
+    }
+  }
+
+  const decisionReason = {
+    type: 'other' as const,
+    reason: 'This command requires approval',
+  }
+  return {
+    behavior: 'passthrough',
+    message: createPermissionRequestMessage(BASH_TOOL_NAME, decisionReason),
+    decisionReason,
+    suggestions: suggestionForExactCommand(command),
+  }
+}
+
+export const bashToolCheckPermission = (
+  input: BashToolInput,
+  toolPermissionContext: ToolPermissionContext,
+  compoundCommandHasCd?: boolean,
+  astCommand?: SimpleCommand,
+): PermissionResult => {
+  const command = input.command.trim()
+  const exactMatchResult = bashToolCheckExactMatchPermission(
+    input,
+    toolPermissionContext,
+  )
+  if (
+    exactMatchResult.behavior === 'deny' ||
+    exactMatchResult.behavior === 'ask'
+  ) {
+    return exactMatchResult
+  }
+
+  const { matchingDenyRules, matchingAskRules, matchingAllowRules } =
+    matchingRulesForInput(input, toolPermissionContext, 'prefix', {
+      skipCompoundCheck: astCommand !== undefined,
+    })
+  if (matchingDenyRules[0] !== undefined) {
+    return {
+      behavior: 'deny',
+      message: `Permission to use ${BASH_TOOL_NAME} with command ${command} has been denied.`,
+      decisionReason: { type: 'rule', rule: matchingDenyRules[0] },
+    }
+  }
+  if (matchingAskRules[0] !== undefined) {
+    return {
+      behavior: 'ask',
+      message: createPermissionRequestMessage(BASH_TOOL_NAME),
+      decisionReason: { type: 'rule', rule: matchingAskRules[0] },
+    }
+  }
+
+  const pathResult = checkPathConstraints(
+    input,
+    getCwd(),
+    toolPermissionContext,
+    compoundCommandHasCd,
+    astCommand?.redirects,
+    astCommand ? [astCommand] : undefined,
+  )
+  if (pathResult.behavior !== 'passthrough') return pathResult
+  if (exactMatchResult.behavior === 'allow') return exactMatchResult
+  if (matchingAllowRules[0] !== undefined) {
+    return {
+      behavior: 'allow',
+      updatedInput: input,
+      decisionReason: { type: 'rule', rule: matchingAllowRules[0] },
+    }
+  }
+
+  const sedConstraintResult = checkSedConstraints(input, toolPermissionContext)
+  if (sedConstraintResult.behavior !== 'passthrough') return sedConstraintResult
+  const modeResult = checkPermissionMode(input, toolPermissionContext)
+  if (modeResult.behavior !== 'passthrough') return modeResult
+  if (checkReadOnlyConstraints(input, commandHasAnyCd(input.command)).behavior === 'allow') {
+    return {
+      behavior: 'allow',
+      updatedInput: input,
+      decisionReason: { type: 'other', reason: 'Read-only command is allowed' },
+    }
+  }
+
+  const decisionReason = {
+    type: 'other' as const,
+    reason: 'This command requires approval',
+  }
+  return {
+    behavior: 'passthrough',
+    message: createPermissionRequestMessage(BASH_TOOL_NAME, decisionReason),
+    decisionReason,
+    suggestions: suggestionForExactCommand(command),
+  }
+}
+
+export async function checkCommandAndSuggestRules(
+  input: BashToolInput,
+  toolPermissionContext: ToolPermissionContext,
+  commandPrefixResult: CommandPrefixResult | null | undefined,
+  compoundCommandHasCd?: boolean,
+  astParseSucceeded?: boolean,
+): Promise<PermissionResult> {
+  const exactMatchResult = bashToolCheckExactMatchPermission(
+    input,
+    toolPermissionContext,
+  )
+  if (exactMatchResult.behavior !== 'passthrough') return exactMatchResult
+
+  const permissionResult = bashToolCheckPermission(
+    input,
+    toolPermissionContext,
+    compoundCommandHasCd,
+  )
+  if (
+    permissionResult.behavior === 'deny' ||
+    permissionResult.behavior === 'ask'
+  ) {
+    return permissionResult
+  }
+
+  if (
+    !astParseSucceeded &&
+    !isEnvTruthy(process.env.CLAUDE_CODE_DISABLE_COMMAND_INJECTION_CHECK)
+  ) {
+    const safetyResult = await bashCommandIsSafeAsync(input.command)
+    if (safetyResult.behavior !== 'passthrough') {
+      const decisionReason: PermissionDecisionReason = {
+        type: 'other',
+        reason:
+          safetyResult.behavior === 'ask' && safetyResult.message
+            ? safetyResult.message
+            : 'This command contains patterns that could pose security risks and requires approval',
+      }
+      return {
+        behavior: 'ask',
+        message: createPermissionRequestMessage(BASH_TOOL_NAME, decisionReason),
+        decisionReason,
+        suggestions: [],
+      }
+    }
+  }
+
+  if (permissionResult.behavior === 'allow') return permissionResult
+  const suggestedUpdates = commandPrefixResult?.commandPrefix
+    ? suggestionForPrefix(commandPrefixResult.commandPrefix)
+    : suggestionForExactCommand(input.command)
+  return { ...permissionResult, suggestions: suggestedUpdates }
+}

package/tui/src/tools/BashTool/bashPermissions/prefixSuggestions.ts

@@ -0,0 +1,88 @@
+import type { PermissionUpdate } from '../../../utils/permissions/PermissionUpdateSchema.js'
+import {
+  suggestionForExactCommand as sharedSuggestionForExactCommand,
+  suggestionForPrefix as sharedSuggestionForPrefix,
+} from '../../../utils/permissions/shellRuleMatching.js'
+import { BASH_TOOL_NAME } from '../toolName.js'
+import {
+  ANT_ONLY_SAFE_ENV_VARS,
+  BARE_SHELL_PREFIXES,
+  ENV_VAR_ASSIGN_RE,
+  SAFE_ENV_VARS,
+} from './constants.js'
+
+function safeEnvPrefixEnd(tokens: readonly string[]): number | null {
+  let i = 0
+  while (i < tokens.length) {
+    const token = tokens[i]
+    if (token === undefined || !ENV_VAR_ASSIGN_RE.test(token)) break
+    const varName = token.split('=')[0]
+    if (varName === undefined) return null
+    const isAntOnlySafe =
+      process.env.USER_TYPE === 'ant' && ANT_ONLY_SAFE_ENV_VARS.has(varName)
+    if (!SAFE_ENV_VARS.has(varName) && !isAntOnlySafe) return null
+    i++
+  }
+  return i
+}
+
+export function getSimpleCommandPrefix(command: string): string | null {
+  const tokens = command.trim().split(/\s+/).filter(Boolean)
+  if (tokens.length === 0) return null
+
+  const prefixEnd = safeEnvPrefixEnd(tokens)
+  if (prefixEnd === null) return null
+  const remaining = tokens.slice(prefixEnd)
+  if (remaining.length < 2) return null
+  const subcmd = remaining[1]
+  if (subcmd === undefined) return null
+  if (!/^[a-z][a-z0-9]*(-[a-z0-9]+)*$/.test(subcmd)) return null
+  return remaining.slice(0, 2).join(' ')
+}
+
+export function getFirstWordPrefix(command: string): string | null {
+  const tokens = command.trim().split(/\s+/).filter(Boolean)
+  const prefixEnd = safeEnvPrefixEnd(tokens)
+  if (prefixEnd === null) return null
+  const cmd = tokens[prefixEnd]
+  if (!cmd) return null
+  if (!/^[a-z][a-z0-9]*(-[a-z0-9]+)*$/.test(cmd)) return null
+  if (BARE_SHELL_PREFIXES.has(cmd)) return null
+  return cmd
+}
+
+export function suggestionForExactCommand(command: string): PermissionUpdate[] {
+  const heredocPrefix = extractPrefixBeforeHeredoc(command)
+  if (heredocPrefix) {
+    return sharedSuggestionForPrefix(BASH_TOOL_NAME, heredocPrefix)
+  }
+
+  if (command.includes('\n')) {
+    const firstLine = command.split('\n')[0]?.trim() ?? ''
+    if (firstLine) return sharedSuggestionForPrefix(BASH_TOOL_NAME, firstLine)
+  }
+
+  const prefix = getSimpleCommandPrefix(command)
+  if (prefix) return sharedSuggestionForPrefix(BASH_TOOL_NAME, prefix)
+  return sharedSuggestionForExactCommand(BASH_TOOL_NAME, command)
+}
+
+function extractPrefixBeforeHeredoc(command: string): string | null {
+  if (!command.includes('<<')) return null
+  const idx = command.indexOf('<<')
+  if (idx <= 0) return null
+  const before = command.substring(0, idx).trim()
+  if (!before) return null
+
+  const prefix = getSimpleCommandPrefix(before)
+  if (prefix) return prefix
+
+  const tokens = before.split(/\s+/).filter(Boolean)
+  const prefixEnd = safeEnvPrefixEnd(tokens)
+  if (prefixEnd === null || prefixEnd >= tokens.length) return null
+  return tokens.slice(prefixEnd, prefixEnd + 2).join(' ') || null
+}
+
+export function suggestionForPrefix(prefix: string): PermissionUpdate[] {
+  return sharedSuggestionForPrefix(BASH_TOOL_NAME, prefix)
+}