ummaya 0.2.4 → 0.2.5

package/tui/src/tools/BashTool/call.ts

@@ -0,0 +1,202 @@
+import type { CanUseToolFn } from 'src/hooks/useCanUseTool.js';
+import { type AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS, logEvent } from '../../services/analytics/index.js';
+import type { ToolCallProgress, ToolUseContext } from '../../Tool.js';
+import type { AssistantMessage } from '../../types/message.js';
+import type { BashProgress } from '../../types/tools.js';
+import { extractClaudeCodeHints } from '../../utils/claudeCodeHints.js';
+import { detectCodeIndexingFromCommand } from '../../utils/codeIndexing.js';
+import { ShellError } from '../../utils/errors.js';
+import { EndTruncatingAccumulator } from '../../utils/stringUtils.js';
+import { maybeRecordPluginHint } from '../../utils/plugins/hintRecommendation.js';
+import type { ExecResult } from '../../utils/ShellCommand.js';
+import { resetShellCwdIfOutsideProject } from './cwdReset.js';
+import { resizeShellImageOutput, stdErrAppendShellResetMessage, stripEmptyLines, isImageOutput } from './shellOutputUtils.js';
+import { interpretCommandResult } from './commandSemantics.js';
+import { trackGitOperations } from '../shared/gitOperationTracking.js';
+import { runShellCommand } from './shellExecution.js';
+import { persistLargeShellOutput } from './outputPersistence.js';
+import { applySedEdit } from './sedEditExecution.js';
+import { isSilentBashCommand } from './commandClassification.js';
+import type { BashToolInput, Out } from './schemas.js';
+import { annotateShellStderrWithSandboxFailures } from './sandboxPolicy.js';
+
+const EOL = '\n';
+
+export async function callBashTool(
+  input: BashToolInput,
+  toolUseContext: ToolUseContext,
+  _canUseTool?: CanUseToolFn,
+  parentMessage?: AssistantMessage,
+  onProgress?: ToolCallProgress<BashProgress>
+): Promise<{ readonly data: Out }> {
+  if (input._simulatedSedEdit) {
+    return applySedEdit(input._simulatedSedEdit, toolUseContext, parentMessage);
+  }
+  const { abortController, getAppState, setAppState, setToolJSX } = toolUseContext;
+  const stdoutAccumulator = new EndTruncatingAccumulator();
+  let stderrForShellReset = '';
+  let interpretationResult: ReturnType<typeof interpretCommandResult> | undefined;
+  let wasInterrupted = false;
+  const isMainThread = !toolUseContext.agentId;
+  const preventCwdChanges = !isMainThread;
+  const { execResult } = await consumeBashCommand({
+    input,
+    toolUseContext,
+    preventCwdChanges,
+    isMainThread,
+    onProgress
+  });
+  try {
+    trackGitOperations(input.command, execResult.code, execResult.stdout);
+    const isInterrupt = execResult.interrupted && abortController.signal.reason === 'interrupt';
+    stdoutAccumulator.append((execResult.stdout || '').trimEnd() + EOL);
+    interpretationResult = interpretCommandResult(input.command, execResult.code, execResult.stdout || '', '');
+    if (execResult.stdout && execResult.stdout.includes(".git/index.lock': File exists")) {
+      logEvent('tengu_git_index_lock_error', {});
+    }
+    if (interpretationResult.isError && !isInterrupt && execResult.code !== 0) {
+      stdoutAccumulator.append(`Exit code ${execResult.code}`);
+    }
+    if (!preventCwdChanges) {
+      const appState = getAppState();
+      if (resetShellCwdIfOutsideProject(appState.toolPermissionContext)) {
+        stderrForShellReset = stdErrAppendShellResetMessage('');
+      }
+    }
+    const outputWithSbFailures = annotateShellStderrWithSandboxFailures(input.command, execResult.stdout || '');
+    if (execResult.preSpawnError) {
+      throw new Error(execResult.preSpawnError);
+    }
+    if (interpretationResult.isError && !isInterrupt) {
+      throw new ShellError('', outputWithSbFailures, execResult.code, execResult.interrupted);
+    }
+    wasInterrupted = execResult.interrupted;
+  } finally {
+    if (setToolJSX) setToolJSX(null);
+  }
+  const stdout = stdoutAccumulator.toString();
+  const persisted = await persistLargeShellOutput(execResult);
+  logShellExecution(input.command, stdout, execResult.code, wasInterrupted);
+  let strippedStdout = stripEmptyLines(stdout);
+  const extracted = extractClaudeCodeHints(strippedStdout, input.command);
+  strippedStdout = extracted.stripped;
+  if (isMainThread && extracted.hints.length > 0) {
+    for (const hint of extracted.hints) maybeRecordPluginHint(hint);
+  }
+  const imageResult = await normalizeImageOutput(strippedStdout, execResult.outputFilePath, persisted.size);
+  return {
+    data: {
+      stdout: imageResult.stdout,
+      stderr: stderrForShellReset,
+      interrupted: wasInterrupted,
+      isImage: imageResult.isImage,
+      returnCodeInterpretation: interpretationResult?.message,
+      noOutputExpected: isSilentBashCommand(input.command),
+      backgroundTaskId: execResult.backgroundTaskId,
+      backgroundedByUser: execResult.backgroundedByUser,
+      assistantAutoBackgrounded: execResult.assistantAutoBackgrounded,
+      dangerouslyDisableSandbox: 'dangerouslyDisableSandbox' in input ? input.dangerouslyDisableSandbox : undefined,
+      persistedOutputPath: persisted.path,
+      persistedOutputSize: persisted.size
+    }
+  };
+}
+
+type ConsumeInput = {
+  readonly input: BashToolInput;
+  readonly toolUseContext: ToolUseContext;
+  readonly preventCwdChanges: boolean;
+  readonly isMainThread: boolean;
+  readonly onProgress?: ToolCallProgress<BashProgress>;
+};
+
+type ConsumeResult = {
+  readonly execResult: ExecResult;
+};
+
+async function consumeBashCommand({
+  input,
+  toolUseContext,
+  preventCwdChanges,
+  isMainThread,
+  onProgress
+}: ConsumeInput): Promise<ConsumeResult> {
+  const commandGenerator = runShellCommand({
+    input,
+    abortController: toolUseContext.abortController,
+    setAppState: toolUseContext.setAppStateForTasks ?? toolUseContext.setAppState,
+    setToolJSX: toolUseContext.setToolJSX,
+    preventCwdChanges,
+    isMainThread,
+    toolUseId: toolUseContext.toolUseId,
+    agentId: toolUseContext.agentId
+  });
+  let progressCounter = 0;
+  let generatorResult;
+  do {
+    generatorResult = await commandGenerator.next();
+    if (!generatorResult.done && onProgress) {
+      const progress = generatorResult.value;
+      onProgress({
+        toolUseID: `bash-progress-${progressCounter++}`,
+        data: {
+          type: 'bash_progress',
+          output: progress.output,
+          fullOutput: progress.fullOutput,
+          elapsedTimeSeconds: progress.elapsedTimeSeconds,
+          totalLines: progress.totalLines,
+          totalBytes: progress.totalBytes,
+          taskId: progress.taskId,
+          timeoutMs: progress.timeoutMs
+        }
+      });
+    }
+  } while (!generatorResult.done);
+  return {
+    execResult: generatorResult.value
+  };
+}
+
+function logShellExecution(command: string, stdout: string, code: number, interrupted: boolean): void {
+  const commandType = command.split(' ')[0];
+  logEvent('tengu_bash_tool_command_executed', {
+    command_type: commandType as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+    stdout_length: stdout.length,
+    stderr_length: 0,
+    exit_code: code,
+    interrupted
+  });
+  const codeIndexingTool = detectCodeIndexingFromCommand(command);
+  if (codeIndexingTool) {
+    logEvent('tengu_code_indexing_tool_used', {
+      tool: codeIndexingTool as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+      source: 'cli' as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+      success: code === 0
+    });
+  }
+}
+
+type ImageOutput = {
+  readonly stdout: string;
+  readonly isImage: boolean;
+};
+
+async function normalizeImageOutput(stdout: string, outputFilePath?: string, persistedOutputSize?: number): Promise<ImageOutput> {
+  if (!isImageOutput(stdout)) {
+    return {
+      stdout,
+      isImage: false
+    };
+  }
+  const resized = await resizeShellImageOutput(stdout, outputFilePath, persistedOutputSize);
+  if (resized) {
+    return {
+      stdout: resized,
+      isImage: true
+    };
+  }
+  return {
+    stdout,
+    isImage: false
+  };
+}

package/tui/src/tools/BashTool/callLoader.ts

@@ -0,0 +1,35 @@
+import { createRequire } from 'node:module'
+import type { CanUseToolFn } from 'src/hooks/useCanUseTool.js'
+import type { ToolCallProgress, ToolUseContext } from '../../Tool.js'
+import type { AssistantMessage } from '../../types/message.js'
+import type { BashProgress } from '../../types/tools.js'
+import type { BashToolInput, Out } from './schemas.js'
+
+type BashCallRuntime = {
+  readonly callBashTool: (
+    input: BashToolInput,
+    toolUseContext: ToolUseContext,
+    canUseTool?: CanUseToolFn,
+    parentMessage?: AssistantMessage,
+    onProgress?: ToolCallProgress<BashProgress>,
+  ) => Promise<{ readonly data: Out }>
+}
+
+const requireModule = createRequire(import.meta.url)
+let cachedRuntime: BashCallRuntime | undefined
+
+function isBashCallRuntime(value: unknown): value is BashCallRuntime {
+  if (typeof value !== 'object' || value === null) return false
+  const module = value as Partial<Record<keyof BashCallRuntime, unknown>>
+  return typeof module.callBashTool === 'function'
+}
+
+export function loadBashCallRuntime(): BashCallRuntime {
+  if (cachedRuntime !== undefined) return cachedRuntime
+  const loaded: unknown = requireModule('./call.js')
+  if (!isBashCallRuntime(loaded)) {
+    throw new Error('Bash call module did not expose expected lifecycle')
+  }
+  cachedRuntime = loaded
+  return loaded
+}

package/tui/src/tools/BashTool/commandClassification.ts

@@ -0,0 +1,151 @@
+import type { AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS } from '../../services/analytics/index.js';
+import { splitCommand_DEPRECATED, splitCommandWithOperators } from '../../utils/bash/commands.js';
+
+const BASH_SEARCH_COMMANDS = new Set(['find', 'grep', 'rg', 'ag', 'ack', 'locate', 'which', 'whereis']);
+const BASH_READ_COMMANDS = new Set(['cat', 'head', 'tail', 'less', 'more', 'wc', 'stat', 'file', 'strings', 'jq', 'awk', 'cut', 'sort', 'uniq', 'tr']);
+const BASH_LIST_COMMANDS = new Set(['ls', 'tree', 'du']);
+const BASH_SEMANTIC_NEUTRAL_COMMANDS = new Set(['echo', 'printf', 'true', 'false', ':']);
+const BASH_SILENT_COMMANDS = new Set(['mv', 'cp', 'rm', 'mkdir', 'rmdir', 'chmod', 'chown', 'chgrp', 'touch', 'ln', 'cd', 'export', 'unset', 'wait']);
+const DISALLOWED_AUTO_BACKGROUND_COMMANDS = ['sleep'];
+const COMMON_BACKGROUND_COMMANDS = ['npm', 'yarn', 'pnpm', 'node', 'python', 'python3', 'go', 'cargo', 'make', 'docker', 'terraform', 'webpack', 'vite', 'jest', 'pytest', 'curl', 'wget', 'build', 'test', 'serve', 'watch', 'dev'] as const;
+
+type SearchReadClassification = {
+  readonly isSearch: boolean;
+  readonly isRead: boolean;
+  readonly isList: boolean;
+};
+
+const NOT_SEARCH_OR_READ: SearchReadClassification = {
+  isSearch: false,
+  isRead: false,
+  isList: false
+};
+
+export function isSearchOrReadBashCommand(command: string): SearchReadClassification {
+  let partsWithOperators: string[];
+  try {
+    partsWithOperators = splitCommandWithOperators(command);
+  } catch (error) {
+    if (error instanceof Error) {
+      return NOT_SEARCH_OR_READ;
+    }
+    throw error;
+  }
+  if (partsWithOperators.length === 0) {
+    return NOT_SEARCH_OR_READ;
+  }
+  let hasSearch = false;
+  let hasRead = false;
+  let hasList = false;
+  let hasNonNeutralCommand = false;
+  let skipNextAsRedirectTarget = false;
+  for (const part of partsWithOperators) {
+    if (skipNextAsRedirectTarget) {
+      skipNextAsRedirectTarget = false;
+      continue;
+    }
+    if (part === '>' || part === '>>' || part === '>&') {
+      skipNextAsRedirectTarget = true;
+      continue;
+    }
+    if (part === '||' || part === '&&' || part === '|' || part === ';') {
+      continue;
+    }
+    const baseCommand = part.trim().split(/\s+/)[0];
+    if (!baseCommand || BASH_SEMANTIC_NEUTRAL_COMMANDS.has(baseCommand)) {
+      continue;
+    }
+    hasNonNeutralCommand = true;
+    const isPartSearch = BASH_SEARCH_COMMANDS.has(baseCommand);
+    const isPartRead = BASH_READ_COMMANDS.has(baseCommand);
+    const isPartList = BASH_LIST_COMMANDS.has(baseCommand);
+    if (!isPartSearch && !isPartRead && !isPartList) {
+      return NOT_SEARCH_OR_READ;
+    }
+    if (isPartSearch) hasSearch = true;
+    if (isPartRead) hasRead = true;
+    if (isPartList) hasList = true;
+  }
+  if (!hasNonNeutralCommand) {
+    return NOT_SEARCH_OR_READ;
+  }
+  return {
+    isSearch: hasSearch,
+    isRead: hasRead,
+    isList: hasList
+  };
+}
+
+export function isSilentBashCommand(command: string): boolean {
+  let partsWithOperators: string[];
+  try {
+    partsWithOperators = splitCommandWithOperators(command);
+  } catch (error) {
+    if (error instanceof Error) {
+      return false;
+    }
+    throw error;
+  }
+  if (partsWithOperators.length === 0) {
+    return false;
+  }
+  let hasNonFallbackCommand = false;
+  let lastOperator: string | null = null;
+  let skipNextAsRedirectTarget = false;
+  for (const part of partsWithOperators) {
+    if (skipNextAsRedirectTarget) {
+      skipNextAsRedirectTarget = false;
+      continue;
+    }
+    if (part === '>' || part === '>>' || part === '>&') {
+      skipNextAsRedirectTarget = true;
+      continue;
+    }
+    if (part === '||' || part === '&&' || part === '|' || part === ';') {
+      lastOperator = part;
+      continue;
+    }
+    const baseCommand = part.trim().split(/\s+/)[0];
+    if (!baseCommand || (lastOperator === '||' && BASH_SEMANTIC_NEUTRAL_COMMANDS.has(baseCommand))) {
+      continue;
+    }
+    hasNonFallbackCommand = true;
+    if (!BASH_SILENT_COMMANDS.has(baseCommand)) {
+      return false;
+    }
+  }
+  return hasNonFallbackCommand;
+}
+
+export function isAutobackgroundingAllowed(command: string): boolean {
+  const parts = splitCommand_DEPRECATED(command);
+  if (parts.length === 0) return true;
+  const baseCommand = parts[0]?.trim();
+  if (!baseCommand) return true;
+  return !DISALLOWED_AUTO_BACKGROUND_COMMANDS.includes(baseCommand);
+}
+
+export function detectBlockedSleepPattern(command: string): string | null {
+  const parts = splitCommand_DEPRECATED(command);
+  if (parts.length === 0) return null;
+  const first = parts[0]?.trim() ?? '';
+  const match = /^sleep\s+(\d+)\s*$/.exec(first);
+  const secondsText = match?.[1];
+  if (!secondsText) return null;
+  const seconds = parseInt(secondsText, 10);
+  if (seconds < 2) return null;
+  const rest = parts.slice(1).join(' ').trim();
+  return rest ? `sleep ${seconds} followed by: ${rest}` : `standalone sleep ${seconds}`;
+}
+
+export function getCommandTypeForLogging(command: string): AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS {
+  const parts = splitCommand_DEPRECATED(command);
+  if (parts.length === 0) return 'other' as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS;
+  for (const part of parts) {
+    const baseCommand = part.split(' ')[0] || '';
+    if (COMMON_BACKGROUND_COMMANDS.includes(baseCommand as (typeof COMMON_BACKGROUND_COMMANDS)[number])) {
+      return baseCommand as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS;
+    }
+  }
+  return 'other' as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS;
+}

package/tui/src/tools/BashTool/commandClassificationLoader.ts

@@ -0,0 +1,40 @@
+import { createRequire } from 'node:module'
+
+type SearchReadClassification = {
+  readonly isSearch: boolean
+  readonly isRead: boolean
+  readonly isList: boolean
+}
+
+type BashCommandClassificationRuntime = {
+  readonly isSearchOrReadBashCommand: (
+    command: string,
+  ) => SearchReadClassification
+  readonly detectBlockedSleepPattern: (command: string) => string | null
+}
+
+const requireModule = createRequire(import.meta.url)
+let cachedRuntime: BashCommandClassificationRuntime | undefined
+
+function isBashCommandClassificationRuntime(
+  value: unknown,
+): value is BashCommandClassificationRuntime {
+  if (typeof value !== 'object' || value === null) return false
+  const module = value as Partial<
+    Record<keyof BashCommandClassificationRuntime, unknown>
+  >
+  return (
+    typeof module.isSearchOrReadBashCommand === 'function' &&
+    typeof module.detectBlockedSleepPattern === 'function'
+  )
+}
+
+export function loadBashCommandClassificationRuntime(): BashCommandClassificationRuntime {
+  if (cachedRuntime !== undefined) return cachedRuntime
+  const loaded: unknown = requireModule('./commandClassification.js')
+  if (!isBashCommandClassificationRuntime(loaded)) {
+    throw new Error('Bash command classification module shape mismatch')
+  }
+  cachedRuntime = loaded
+  return loaded
+}

package/tui/src/tools/BashTool/cwdReset.ts

@@ -0,0 +1,33 @@
+import { createRequire } from 'node:module'
+import type { ToolPermissionContext } from '../../Tool.js'
+
+type CwdResetRuntime = {
+  readonly resetCwdIfOutsideProject: (
+    toolPermissionContext: ToolPermissionContext,
+  ) => boolean
+}
+
+const requireModule = createRequire(import.meta.url)
+let cachedRuntime: CwdResetRuntime | undefined
+
+function isCwdResetRuntime(value: unknown): value is CwdResetRuntime {
+  if (typeof value !== 'object' || value === null) return false
+  const module = value as Partial<Record<keyof CwdResetRuntime, unknown>>
+  return typeof module.resetCwdIfOutsideProject === 'function'
+}
+
+function loadCwdResetRuntime(): CwdResetRuntime {
+  if (cachedRuntime !== undefined) return cachedRuntime
+  const loaded: unknown = requireModule('./utils.js')
+  if (!isCwdResetRuntime(loaded)) {
+    throw new Error('Bash utility module did not expose cwd reset helper')
+  }
+  cachedRuntime = loaded
+  return loaded
+}
+
+export function resetShellCwdIfOutsideProject(
+  toolPermissionContext: ToolPermissionContext,
+): boolean {
+  return loadCwdResetRuntime().resetCwdIfOutsideProject(toolPermissionContext)
+}

package/tui/src/tools/BashTool/lineTruncation.ts

@@ -0,0 +1,11 @@
+const MAX_LINES_TO_SHOW = 3
+
+export function isShellOutputLineTruncated(content: string): boolean {
+  let position = 0
+  for (let line = 0; line <= MAX_LINES_TO_SHOW; line++) {
+    position = content.indexOf('\n', position)
+    if (position === -1) return false
+    position++
+  }
+  return position < content.length
+}

package/tui/src/tools/BashTool/modeValidation.ts

@@ -3,6 +3,9 @@ import type { ToolPermissionContext } from '../../Tool.js'
 import { splitCommand_DEPRECATED } from '../../utils/bash/commands.js'
 import type { PermissionResult } from '../../utils/permissions/PermissionResult.js'
 import type { BashTool } from './BashTool.js'
+import { getDestructiveCommandWarning } from './destructiveCommandWarning.js'
+import { getBypassImmuneShellPermissionResult } from './shellPermissionGauntlet.js'
+import { BASH_TOOL_NAME } from './toolName.js'
 
 const ACCEPT_EDITS_ALLOWED_COMMANDS = [
   'mkdir',
@@ -73,8 +76,17 @@ export function checkPermissionMode(
   input: z.infer<typeof BashTool.inputSchema>,
   toolPermissionContext: ToolPermissionContext,
 ): PermissionResult {
-  // Skip if in bypass mode (handled elsewhere)
   if (toolPermissionContext.mode === 'bypassPermissions') {
+    const bypassImmuneResult = getBypassImmuneShellPermissionResult(
+      input.command,
+      BASH_TOOL_NAME,
+      toolPermissionContext,
+      getDestructiveCommandWarning,
+    )
+    if (bypassImmuneResult !== null) {
+      return bypassImmuneResult
+    }
+
     return {
       behavior: 'passthrough',
       message: 'Bypass mode is handled in main permission flow',

package/tui/src/tools/BashTool/outputPersistence.ts

@@ -0,0 +1,42 @@
+import { copyFile, link, stat as fsStat, truncate as fsTruncate } from 'fs/promises';
+import { ensureToolResultsDir, getToolResultPath } from '../../utils/toolResultStorage.js';
+import type { ExecResult } from '../../utils/ShellCommand.js';
+
+const MAX_PERSISTED_SIZE = 64 * 1024 * 1024;
+
+type PersistedOutput = {
+  readonly path?: string;
+  readonly size?: number;
+};
+
+export async function persistLargeShellOutput(result: ExecResult): Promise<PersistedOutput> {
+  if (!result.outputFilePath || !result.outputTaskId) {
+    return {};
+  }
+  try {
+    const fileStat = await fsStat(result.outputFilePath);
+    await ensureToolResultsDir();
+    const dest = getToolResultPath(result.outputTaskId, false);
+    if (fileStat.size > MAX_PERSISTED_SIZE) {
+      await fsTruncate(result.outputFilePath, MAX_PERSISTED_SIZE);
+    }
+    try {
+      await link(result.outputFilePath, dest);
+    } catch (error) {
+      if (error instanceof Error) {
+        await copyFile(result.outputFilePath, dest);
+      } else {
+        throw error;
+      }
+    }
+    return {
+      path: dest,
+      size: fileStat.size
+    };
+  } catch (error) {
+    if (error instanceof Error) {
+      return {};
+    }
+    throw error;
+  }
+}

package/tui/src/tools/BashTool/permissionClassification.ts

@@ -0,0 +1,66 @@
+import { feature } from 'bun:bundle';
+import type { ToolUseContext, ValidationResult } from '../../Tool.js';
+import type { PermissionResult } from '../../utils/permissions/PermissionResult.js';
+import { parseForSecurity } from '../../utils/bash/ast.js';
+import { bashToolHasPermission, commandHasAnyCd, matchWildcardPattern, permissionRuleExtractPrefix } from './bashPermissions.js';
+import { checkReadOnlyConstraints } from './readOnlyValidation.js';
+import { getDestructiveCommandWarning } from './destructiveCommandWarning.js';
+import { getBypassImmuneShellPermissionResult } from './shellPermissionGauntlet.js';
+import { BASH_TOOL_NAME } from './toolName.js';
+import { detectBlockedSleepPattern } from './commandClassification.js';
+import { isBackgroundTasksDisabled } from './schemas.js';
+import type { BashToolInput } from './schemas.js';
+
+export async function validateBashInput(input: BashToolInput): Promise<ValidationResult> {
+  if (feature('MONITOR_TOOL') && !isBackgroundTasksDisabled && !input.run_in_background) {
+    const sleepPattern = detectBlockedSleepPattern(input.command);
+    if (sleepPattern !== null) {
+      return {
+        result: false,
+        message: `Blocked: ${sleepPattern}. Run blocking commands in the background with run_in_background: true — you'll get a completion notification when done. For streaming events (watching logs, polling APIs), use the Monitor tool. If you genuinely need a delay (rate limiting, deliberate pacing), keep it under 2 seconds.`,
+        errorCode: 10
+      };
+    }
+  }
+  return {
+    result: true
+  };
+}
+
+export function isBashReadOnly(input: BashToolInput): boolean {
+  const compoundCommandHasCd = commandHasAnyCd(input.command);
+  const result = checkReadOnlyConstraints(input, compoundCommandHasCd);
+  return result.behavior === 'allow';
+}
+
+export async function prepareBashPermissionMatcher({
+  command
+}: BashToolInput): Promise<(pattern: string) => boolean> {
+  const parsed = await parseForSecurity(command);
+  if (parsed.kind !== 'simple') {
+    return () => true;
+  }
+  const subcommands = parsed.commands.map(c => c.argv.join(' '));
+  return pattern => {
+    const prefix = permissionRuleExtractPrefix(pattern);
+    return subcommands.some(cmd => {
+      if (prefix !== null) {
+        return cmd === prefix || cmd.startsWith(`${prefix} `);
+      }
+      return matchWildcardPattern(pattern, cmd);
+    });
+  };
+}
+
+export async function checkBashPermissions(input: BashToolInput, context: ToolUseContext): Promise<PermissionResult> {
+  const bypassImmuneResult = getBypassImmuneShellPermissionResult(
+    input.command,
+    BASH_TOOL_NAME,
+    context.getAppState().toolPermissionContext,
+    getDestructiveCommandWarning
+  );
+  if (bypassImmuneResult !== null) {
+    return bypassImmuneResult;
+  }
+  return bashToolHasPermission(input, context);
+}

package/tui/src/tools/BashTool/permissionLoader.ts

@@ -0,0 +1,44 @@
+import { createRequire } from 'node:module'
+import type { ToolUseContext, ValidationResult } from '../../Tool.js'
+import type { PermissionResult } from '../../utils/permissions/PermissionResult.js'
+import type { BashToolInput } from './schemas.js'
+
+type BashPermissionRuntime = {
+  readonly validateBashInput: (
+    input: BashToolInput,
+  ) => Promise<ValidationResult>
+  readonly isBashReadOnly: (input: BashToolInput) => boolean
+  readonly prepareBashPermissionMatcher: (
+    input: BashToolInput,
+  ) => Promise<(pattern: string) => boolean>
+  readonly checkBashPermissions: (
+    input: BashToolInput,
+    context: ToolUseContext,
+  ) => Promise<PermissionResult>
+}
+
+const requireModule = createRequire(import.meta.url)
+let cachedRuntime: BashPermissionRuntime | undefined
+
+function isBashPermissionRuntime(
+  value: unknown,
+): value is BashPermissionRuntime {
+  if (typeof value !== 'object' || value === null) return false
+  const module = value as Partial<Record<keyof BashPermissionRuntime, unknown>>
+  return (
+    typeof module.validateBashInput === 'function' &&
+    typeof module.isBashReadOnly === 'function' &&
+    typeof module.prepareBashPermissionMatcher === 'function' &&
+    typeof module.checkBashPermissions === 'function'
+  )
+}
+
+export function loadBashPermissionRuntime(): BashPermissionRuntime {
+  if (cachedRuntime !== undefined) return cachedRuntime
+  const loaded: unknown = requireModule('./permissionClassification.js')
+  if (!isBashPermissionRuntime(loaded)) {
+    throw new Error('Bash permission module did not expose expected functions')
+  }
+  cachedRuntime = loaded
+  return loaded
+}