ummaya 0.2.3 → 0.2.5

package/tui/src/tools/BashTool/bashPermissions/subcommandResultHelpers.ts

@@ -0,0 +1,116 @@
+import { logEvent } from '../../../services/analytics/index.js'
+import type { PermissionResult } from '../../../utils/permissions/PermissionResult.js'
+import type { PermissionRuleValue } from '../../../utils/permissions/PermissionRule.js'
+import { extractRules } from '../../../utils/permissions/PermissionUpdate.js'
+import type { PermissionUpdate } from '../../../utils/permissions/PermissionUpdateSchema.js'
+import { permissionRuleValueToString } from '../../../utils/permissions/permissionRuleParser.js'
+import { bashCommandIsSafeAsync_DEPRECATED } from '../bashSecurity.js'
+import type { BashToolInput } from '../schemas.js'
+import { BASH_TOOL_NAME } from '../toolName.js'
+import { MAX_SUGGESTED_RULES_FOR_COMPOUND } from './constants.js'
+import { suggestionForExactCommand } from './prefixSuggestions.js'
+
+const bashCommandIsSafeAsync = bashCommandIsSafeAsync_DEPRECATED
+
+export function deniedSubcommandResult(
+  input: BashToolInput,
+  subcommands: readonly string[],
+  subcommandPermissionDecisions: readonly PermissionResult[],
+): PermissionResult {
+  return {
+    behavior: 'deny',
+    message: `Permission to use ${BASH_TOOL_NAME} with command ${input.command} has been denied.`,
+    decisionReason: {
+      type: 'subcommandResults',
+      reasons: new Map(
+        subcommandPermissionDecisions.map((result, i) => [
+          subcommands[i] ?? '',
+          result,
+        ]),
+      ),
+    },
+  }
+}
+
+export function allowedSubcommandsResult(
+  input: BashToolInput,
+  subcommands: readonly string[],
+  subcommandPermissionDecisions: readonly PermissionResult[],
+): PermissionResult {
+  return {
+    behavior: 'allow',
+    updatedInput: input,
+    decisionReason: {
+      type: 'subcommandResults',
+      reasons: new Map(
+        subcommandPermissionDecisions.map((result, i) => [
+          subcommands[i] ?? '',
+          result,
+        ]),
+      ),
+    },
+  }
+}
+
+export async function hasLegacyCommandInjection(
+  subcommands: readonly string[],
+): Promise<boolean> {
+  let divergenceCount = 0
+  const onDivergence = () => {
+    divergenceCount++
+  }
+  const results = await Promise.all(
+    subcommands.map(c => bashCommandIsSafeAsync(c, onDivergence)),
+  )
+  if (divergenceCount > 0) {
+    logEvent('tengu_tree_sitter_security_divergence', {
+      quoteContextDivergence: true,
+      count: divergenceCount,
+    })
+  }
+  return results.some(r => r.behavior !== 'passthrough')
+}
+
+export function collectSuggestedRuleUpdates(
+  subcommandResults: Map<string, PermissionResult>,
+): PermissionUpdate[] | undefined {
+  const collectedRules: Map<string, PermissionRuleValue> = new Map()
+  for (const [subcommand, permissionResult] of subcommandResults) {
+    if (
+      permissionResult.behavior !== 'ask' &&
+      permissionResult.behavior !== 'passthrough'
+    ) {
+      continue
+    }
+    const updates =
+      'suggestions' in permissionResult ? permissionResult.suggestions : undefined
+    const rules = extractRules(updates)
+    for (const rule of rules) {
+      collectedRules.set(permissionRuleValueToString(rule), rule)
+    }
+    if (
+      permissionResult.behavior === 'ask' &&
+      rules.length === 0 &&
+      permissionResult.decisionReason?.type !== 'rule'
+    ) {
+      for (const rule of extractRules(suggestionForExactCommand(subcommand))) {
+        collectedRules.set(permissionRuleValueToString(rule), rule)
+      }
+    }
+  }
+
+  const cappedRules = Array.from(collectedRules.values()).slice(
+    0,
+    MAX_SUGGESTED_RULES_FOR_COMPOUND,
+  )
+  return cappedRules.length > 0
+    ? [
+        {
+          type: 'addRules',
+          rules: cappedRules,
+          behavior: 'allow',
+          destination: 'localSettings',
+        },
+      ]
+    : undefined
+}

package/tui/src/tools/BashTool/bashPermissions/types.ts

@@ -0,0 +1,26 @@
+import type { ToolUseContext } from '../../../Tool.js'
+import type { Redirect, SimpleCommand } from '../../../utils/bash/ast.js'
+import type { getCommandSubcommandPrefix } from '../../../utils/bash/commands.js'
+import { PARSE_ABORTED, type Node } from '../../../utils/bash/parser.js'
+import type { PermissionResult } from '../../../utils/permissions/PermissionResult.js'
+import type { BashToolInput } from '../schemas.js'
+
+export type CommandPrefixResolver = typeof getCommandSubcommandPrefix
+
+export type PermissionRunner = (
+  input: BashToolInput,
+  context: ToolUseContext,
+  getCommandSubcommandPrefixFn: CommandPrefixResolver,
+) => Promise<PermissionResult>
+
+export type BashAstPermissionState = {
+  readonly astRoot: Node | null | typeof PARSE_ABORTED
+  readonly astSubcommands: string[] | null
+  readonly astRedirects?: Redirect[]
+  readonly astCommands?: SimpleCommand[]
+  readonly shadowLegacySubs?: string[]
+}
+
+export type AstPreflightResult =
+  | { readonly kind: 'return'; readonly result: PermissionResult }
+  | { readonly kind: 'continue'; readonly state: BashAstPermissionState }

package/tui/src/tools/BashTool/bashPermissions/wrapperStripping.ts

@@ -0,0 +1,139 @@
+import {
+  ANT_ONLY_SAFE_ENV_VARS,
+  BINARY_HIJACK_VARS,
+  SAFE_ENV_VARS,
+} from './constants.js'
+
+function stripCommentLines(command: string): string {
+  const lines = command.split('\n')
+  const nonCommentLines = lines.filter(line => {
+    const trimmed = line.trim()
+    return trimmed !== '' && !trimmed.startsWith('#')
+  })
+  return nonCommentLines.length === 0 ? command : nonCommentLines.join('\n')
+}
+
+export function stripSafeWrappers(command: string): string {
+  const SAFE_WRAPPER_PATTERNS = [
+    /^timeout[ \t]+(?:(?:--(?:foreground|preserve-status|verbose)|--(?:kill-after|signal)=[A-Za-z0-9_.+-]+|--(?:kill-after|signal)[ \t]+[A-Za-z0-9_.+-]+|-v|-[ks][ \t]+[A-Za-z0-9_.+-]+|-[ks][A-Za-z0-9_.+-]+)[ \t]+)*(?:--[ \t]+)?\d+(?:\.\d+)?[smhd]?[ \t]+/,
+    /^time[ \t]+(?:--[ \t]+)?/,
+    /^nice(?:[ \t]+-n[ \t]+-?\d+|[ \t]+-\d+)?[ \t]+(?:--[ \t]+)?/,
+    /^stdbuf(?:[ \t]+-[ioe][LN0-9]+)+[ \t]+(?:--[ \t]+)?/,
+    /^nohup[ \t]+(?:--[ \t]+)?/,
+  ] as const
+  const ENV_VAR_PATTERN = /^([A-Za-z_][A-Za-z0-9_]*)=([A-Za-z0-9_./:-]+)[ \t]+/
+
+  let stripped = command
+  let previousStripped = ''
+  while (stripped !== previousStripped) {
+    previousStripped = stripped
+    stripped = stripCommentLines(stripped)
+    const envVarMatch = stripped.match(ENV_VAR_PATTERN)
+    if (envVarMatch) {
+      const varName = envVarMatch[1]
+      if (varName === undefined) break
+      const isAntOnlySafe =
+        process.env.USER_TYPE === 'ant' && ANT_ONLY_SAFE_ENV_VARS.has(varName)
+      if (SAFE_ENV_VARS.has(varName) || isAntOnlySafe) {
+        stripped = stripped.replace(ENV_VAR_PATTERN, '')
+      }
+    }
+  }
+
+  previousStripped = ''
+  while (stripped !== previousStripped) {
+    previousStripped = stripped
+    stripped = stripCommentLines(stripped)
+    for (const pattern of SAFE_WRAPPER_PATTERNS) {
+      stripped = stripped.replace(pattern, '')
+    }
+  }
+  return stripped.trim()
+}
+
+const TIMEOUT_FLAG_VALUE_RE = /^[A-Za-z0-9_.+-]+$/
+
+function skipTimeoutFlags(a: readonly string[]): number {
+  let i = 1
+  while (i < a.length) {
+    const arg = a[i]
+    if (arg === undefined) break
+    const next = a[i + 1]
+    if (
+      arg === '--foreground' ||
+      arg === '--preserve-status' ||
+      arg === '--verbose'
+    )
+      i++
+    else if (/^--(?:kill-after|signal)=[A-Za-z0-9_.+-]+$/.test(arg)) i++
+    else if (
+      (arg === '--kill-after' || arg === '--signal') &&
+      next &&
+      TIMEOUT_FLAG_VALUE_RE.test(next)
+    )
+      i += 2
+    else if (arg === '--') {
+      i++
+      break
+    } else if (arg.startsWith('--')) return -1
+    else if (arg === '-v') i++
+    else if (
+      (arg === '-k' || arg === '-s') &&
+      next &&
+      TIMEOUT_FLAG_VALUE_RE.test(next)
+    )
+      i += 2
+    else if (/^-[ks][A-Za-z0-9_.+-]+$/.test(arg)) i++
+    else if (arg.startsWith('-')) return -1
+    else break
+  }
+  return i
+}
+
+export function stripWrappersFromArgv(argv: string[]): string[] {
+  let a = argv
+  for (;;) {
+    if (a[0] === 'time' || a[0] === 'nohup') {
+      a = a.slice(a[1] === '--' ? 2 : 1)
+    } else if (a[0] === 'timeout') {
+      const i = skipTimeoutFlags(a)
+      const duration = a[i]
+      if (i < 0 || duration === undefined || !/^\d+(?:\.\d+)?[smhd]?$/.test(duration))
+        return a
+      a = a.slice(i + 1)
+    } else if (
+      a[0] === 'nice' &&
+      a[1] === '-n' &&
+      a[2] &&
+      /^-?\d+$/.test(a[2])
+    ) {
+      a = a.slice(a[3] === '--' ? 4 : 3)
+    } else {
+      return a
+    }
+  }
+}
+
+export function stripAllLeadingEnvVars(
+  command: string,
+  blocklist?: RegExp,
+): string {
+  const ENV_VAR_PATTERN =
+    /^([A-Za-z_][A-Za-z0-9_]*(?:\[[^\]]*\])?)\+?=(?:'[^'\n\r]*'|"(?:\\.|[^"$`\\\n\r])*"|\\.|[^ \t\n\r$`;|&()<>\\\\'"])*[ \t]+/
+  let stripped = command
+  let previousStripped = ''
+
+  while (stripped !== previousStripped) {
+    previousStripped = stripped
+    stripped = stripCommentLines(stripped)
+    const m = stripped.match(ENV_VAR_PATTERN)
+    if (!m) continue
+    const envName = m[1]
+    if (envName === undefined) break
+    if (blocklist?.test(envName)) break
+    stripped = stripped.slice(m[0].length)
+  }
+  return stripped.trim()
+}
+
+export { BINARY_HIJACK_VARS }