ummaya 0.2.4 → 0.2.6

package/tui/src/tools/BashTool/bashCommandHelpers.ts

@@ -1,4 +1,3 @@
-import type { z } from 'zod/v4'
 import {
   isUnsafeCompoundCommand_DEPRECATED,
   splitCommand_DEPRECATED,
@@ -12,7 +11,8 @@ import { type Node, PARSE_ABORTED } from '../../utils/bash/parser.js'
 import type { PermissionResult } from '../../utils/permissions/PermissionResult.js'
 import type { PermissionUpdate } from '../../utils/permissions/PermissionUpdateSchema.js'
 import { createPermissionRequestMessage } from '../../utils/permissions/permissions.js'
-import { BashTool } from './BashTool.js'
+import type { BashToolInput } from './schemas.js'
+import { BASH_TOOL_NAME } from './toolName.js'
 import { bashCommandIsSafeAsync_DEPRECATED } from './bashSecurity.js'
 
 export type CommandIdentityCheckers = {
@@ -21,10 +21,10 @@ export type CommandIdentityCheckers = {
 }
 
 async function segmentedCommandPermissionResult(
-  input: z.infer<typeof BashTool.inputSchema>,
+  input: BashToolInput,
   segments: string[],
   bashToolHasPermissionFn: (
-    input: z.infer<typeof BashTool.inputSchema>,
+    input: BashToolInput,
   ) => Promise<PermissionResult>,
   checkers: CommandIdentityCheckers,
 ): Promise<PermissionResult> {
@@ -42,7 +42,7 @@ async function segmentedCommandPermissionResult(
     return {
       behavior: 'ask',
       decisionReason,
-      message: createPermissionRequestMessage(BashTool.name, decisionReason),
+      message: createPermissionRequestMessage(BASH_TOOL_NAME, decisionReason),
     }
   }
 
@@ -76,7 +76,7 @@ async function segmentedCommandPermissionResult(
       return {
         behavior: 'ask',
         decisionReason,
-        message: createPermissionRequestMessage(BashTool.name, decisionReason),
+        message: createPermissionRequestMessage(BASH_TOOL_NAME, decisionReason),
       }
     }
   }
@@ -149,7 +149,7 @@ async function segmentedCommandPermissionResult(
 
   return {
     behavior: 'ask',
-    message: createPermissionRequestMessage(BashTool.name, decisionReason),
+    message: createPermissionRequestMessage(BASH_TOOL_NAME, decisionReason),
     decisionReason,
     suggestions: suggestions.length > 0 ? suggestions : undefined,
   }
@@ -179,9 +179,9 @@ async function buildSegmentWithoutRedirections(
  * bashToolCheckCommandOperatorPermissions.
  */
 export async function checkCommandOperatorPermissions(
-  input: z.infer<typeof BashTool.inputSchema>,
+  input: BashToolInput,
   bashToolHasPermissionFn: (
-    input: z.infer<typeof BashTool.inputSchema>,
+    input: BashToolInput,
   ) => Promise<PermissionResult>,
   checkers: CommandIdentityCheckers,
   astRoot: Node | null | typeof PARSE_ABORTED,
@@ -206,9 +206,9 @@ export async function checkCommandOperatorPermissions(
  * simple subcommand checking.
  */
 async function bashToolCheckCommandOperatorPermissions(
-  input: z.infer<typeof BashTool.inputSchema>,
+  input: BashToolInput,
   bashToolHasPermissionFn: (
-    input: z.infer<typeof BashTool.inputSchema>,
+    input: BashToolInput,
   ) => Promise<PermissionResult>,
   checkers: CommandIdentityCheckers,
   parsed: IParsedCommand,
@@ -233,7 +233,7 @@ async function bashToolCheckCommandOperatorPermissions(
     }
     return {
       behavior: 'ask',
-      message: createPermissionRequestMessage(BashTool.name, decisionReason),
+      message: createPermissionRequestMessage(BASH_TOOL_NAME, decisionReason),
       decisionReason,
       // This is an unsafe compound command, so we don't want to suggest rules since we wont be able to allow it
     }

package/tui/src/tools/BashTool/bashPermissions/astPreflight.ts

@@ -0,0 +1,173 @@
+import { feature } from 'bun:bundle'
+import { getFeatureValue_CACHED_MAY_BE_STALE } from '../../../services/analytics/growthbook.js'
+import { logEvent } from '../../../services/analytics/index.js'
+import type { ToolPermissionContext } from '../../../Tool.js'
+import {
+  checkSemantics,
+  nodeTypeId,
+  parseForSecurityFromAst,
+  type ParseForSecurityResult,
+} from '../../../utils/bash/ast.js'
+import { splitCommand_DEPRECATED } from '../../../utils/bash/commands.js'
+import { parseCommandRaw } from '../../../utils/bash/parser.js'
+import { tryParseShellCommand } from '../../../utils/bash/shellQuote.js'
+import { logForDebugging } from '../../../utils/debug.js'
+import { isEnvTruthy } from '../../../utils/envUtils.js'
+import type { PermissionDecisionReason } from '../../../utils/permissions/PermissionResult.js'
+import { createPermissionRequestMessage } from '../../../utils/permissions/permissions.js'
+import type { BashToolInput } from '../schemas.js'
+import { BASH_TOOL_NAME } from '../toolName.js'
+import { buildPendingClassifierCheck } from './classifierChecks.js'
+import {
+  checkEarlyExitDeny,
+  checkSemanticsDeny,
+} from './subcommandGuards.js'
+import type { AstPreflightResult } from './types.js'
+
+const splitCommand = splitCommand_DEPRECATED
+
+export async function prepareAstPermissionState(
+  input: BashToolInput,
+  toolPermissionContext: ToolPermissionContext,
+): Promise<AstPreflightResult> {
+  const injectionCheckDisabled = isEnvTruthy(
+    process.env.CLAUDE_CODE_DISABLE_COMMAND_INJECTION_CHECK,
+  )
+  const shadowEnabled = feature('TREE_SITTER_BASH_SHADOW')
+    ? getFeatureValue_CACHED_MAY_BE_STALE('tengu_birch_trellis', true)
+    : false
+  let astRoot = injectionCheckDisabled
+    ? null
+    : feature('TREE_SITTER_BASH_SHADOW') && !shadowEnabled
+      ? null
+      : await parseCommandRaw(input.command)
+  let astResult: ParseForSecurityResult = astRoot
+    ? parseForSecurityFromAst(input.command, astRoot)
+    : { kind: 'parse-unavailable' }
+  let astSubcommands: string[] | null = null
+  let astRedirects
+  let astCommands
+  let shadowLegacySubs: string[] | undefined
+
+  if (feature('TREE_SITTER_BASH_SHADOW')) {
+    const available = astResult.kind !== 'parse-unavailable'
+    let tooComplex = false
+    let semanticFail = false
+    let subsDiffer = false
+    if (available) {
+      tooComplex = astResult.kind === 'too-complex'
+      semanticFail =
+        astResult.kind === 'simple' && !checkSemantics(astResult.commands).ok
+      const tsSubs =
+        astResult.kind === 'simple'
+          ? astResult.commands.map(c => c.text)
+          : undefined
+      const legacySubs = splitCommand(input.command)
+      shadowLegacySubs = legacySubs
+      subsDiffer =
+        tsSubs !== undefined &&
+        (tsSubs.length !== legacySubs.length ||
+          tsSubs.some((s, i) => s !== legacySubs[i]))
+    }
+    logEvent('tengu_tree_sitter_shadow', {
+      available,
+      astTooComplex: tooComplex,
+      astSemanticFail: semanticFail,
+      subsDiffer,
+      injectionCheckDisabled,
+      killswitchOff: !shadowEnabled,
+      cmdOverLength: input.command.length > 10000,
+    })
+    astResult = { kind: 'parse-unavailable' }
+    astRoot = null
+  }
+
+  if (astResult.kind === 'too-complex') {
+    const earlyExit = checkEarlyExitDeny(input, toolPermissionContext)
+    if (earlyExit !== null) return { kind: 'return', result: earlyExit }
+    const decisionReason: PermissionDecisionReason = {
+      type: 'other',
+      reason: astResult.reason,
+    }
+    logEvent('tengu_bash_ast_too_complex', {
+      nodeTypeId: nodeTypeId(astResult.nodeType),
+    })
+    return {
+      kind: 'return',
+      result: {
+        behavior: 'ask',
+        decisionReason,
+        message: createPermissionRequestMessage(BASH_TOOL_NAME, decisionReason),
+        suggestions: [],
+        ...(feature('BASH_CLASSIFIER')
+          ? {
+              pendingClassifierCheck: buildPendingClassifierCheck(
+                input.command,
+                toolPermissionContext,
+              ),
+            }
+          : {}),
+      },
+    }
+  }
+
+  if (astResult.kind === 'simple') {
+    const sem = checkSemantics(astResult.commands)
+    if (!sem.ok) {
+      const earlyExit = checkSemanticsDeny(
+        input,
+        toolPermissionContext,
+        astResult.commands,
+      )
+      if (earlyExit !== null) return { kind: 'return', result: earlyExit }
+      const decisionReason: PermissionDecisionReason = {
+        type: 'other',
+        reason: sem.reason,
+      }
+      return {
+        kind: 'return',
+        result: {
+          behavior: 'ask',
+          decisionReason,
+          message: createPermissionRequestMessage(
+            BASH_TOOL_NAME,
+            decisionReason,
+          ),
+          suggestions: [],
+        },
+      }
+    }
+    astSubcommands = astResult.commands.map(c => c.text)
+    astRedirects = astResult.commands.flatMap(c => c.redirects)
+    astCommands = astResult.commands
+  }
+
+  if (astResult.kind === 'parse-unavailable') {
+    logForDebugging(
+      'bashToolHasPermission: tree-sitter unavailable, using legacy shell-quote path',
+    )
+    const parseResult = tryParseShellCommand(input.command)
+    if (!parseResult.success) {
+      const decisionReason = {
+        type: 'other' as const,
+        reason: `Command contains malformed syntax that cannot be parsed: ${parseResult.error}`,
+      }
+      return {
+        kind: 'return',
+        result: {
+          behavior: 'ask',
+          decisionReason,
+          message: createPermissionRequestMessage(
+            BASH_TOOL_NAME,
+            decisionReason,
+          ),
+        },
+      }
+    }
+  }
+
+  return {
+    kind: 'continue',
+    state: { astRoot, astSubcommands, astRedirects, astCommands, shadowLegacySubs },
+  }
+}

package/tui/src/tools/BashTool/bashPermissions/classifierChecks.ts

@@ -0,0 +1,199 @@
+import { feature } from 'bun:bundle'
+import { APIUserAbortError } from '@anthropic-ai/sdk'
+import {
+  type AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+  logEvent,
+} from '../../../services/analytics/index.js'
+import { getCwd } from '../../../utils/cwd.js'
+import { AbortError } from '../../../utils/errors.js'
+import type {
+  ClassifierBehavior,
+  ClassifierResult,
+} from '../../../utils/permissions/bashClassifier.js'
+import {
+  classifyBashCommand,
+  getBashPromptAllowDescriptions,
+  isClassifierPermissionsEnabled,
+} from '../../../utils/permissions/bashClassifier.js'
+import type { PermissionDecisionReason } from '../../../utils/permissions/PermissionResult.js'
+import { jsonStringify } from '../../../utils/slowOperations.js'
+import type { ToolPermissionContext } from '../../../Tool.js'
+import type { PendingClassifierCheck } from '../../../types/permissions.js'
+
+export function logClassifierResultForAnts(
+  command: string,
+  behavior: ClassifierBehavior,
+  descriptions: string[],
+  result: ClassifierResult,
+): void {
+  if (process.env.USER_TYPE !== 'ant') return
+  logEvent('tengu_internal_bash_classifier_result', {
+    behavior:
+      behavior as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+    descriptions: jsonStringify(
+      descriptions,
+    ) as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+    matches: result.matches,
+    matchedDescription: (result.matchedDescription ??
+      '') as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+    confidence:
+      result.confidence as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+    reason:
+      result.reason as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+    command:
+      command as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS,
+  })
+}
+
+export function buildPendingClassifierCheck(
+  command: string,
+  toolPermissionContext: ToolPermissionContext,
+): { command: string; cwd: string; descriptions: string[] } | undefined {
+  if (!isClassifierPermissionsEnabled()) return undefined
+  if (feature('TRANSCRIPT_CLASSIFIER') && toolPermissionContext.mode === 'auto')
+    return undefined
+  if (toolPermissionContext.mode === 'bypassPermissions') return undefined
+
+  const allowDescriptions = getBashPromptAllowDescriptions(
+    toolPermissionContext,
+  )
+  if (allowDescriptions.length === 0) return undefined
+  return { command, cwd: getCwd(), descriptions: allowDescriptions }
+}
+
+const speculativeChecks = new Map<string, Promise<ClassifierResult>>()
+
+function ignoreSpeculativeClassifierRejection(error: unknown): void {
+  if (error instanceof Error) return
+}
+
+export function peekSpeculativeClassifierCheck(
+  command: string,
+): Promise<ClassifierResult> | undefined {
+  return speculativeChecks.get(command)
+}
+
+export function startSpeculativeClassifierCheck(
+  command: string,
+  toolPermissionContext: ToolPermissionContext,
+  signal: AbortSignal,
+  isNonInteractiveSession: boolean,
+): boolean {
+  if (!isClassifierPermissionsEnabled()) return false
+  if (feature('TRANSCRIPT_CLASSIFIER') && toolPermissionContext.mode === 'auto')
+    return false
+  if (toolPermissionContext.mode === 'bypassPermissions') return false
+  const allowDescriptions = getBashPromptAllowDescriptions(
+    toolPermissionContext,
+  )
+  if (allowDescriptions.length === 0) return false
+
+  const promise = classifyBashCommand(
+    command,
+    getCwd(),
+    allowDescriptions,
+    'allow',
+    signal,
+    isNonInteractiveSession,
+  )
+  promise.catch(ignoreSpeculativeClassifierRejection)
+  speculativeChecks.set(command, promise)
+  return true
+}
+
+export function consumeSpeculativeClassifierCheck(
+  command: string,
+): Promise<ClassifierResult> | undefined {
+  const promise = speculativeChecks.get(command)
+  if (promise) speculativeChecks.delete(command)
+  return promise
+}
+
+export function clearSpeculativeChecks(): void {
+  speculativeChecks.clear()
+}
+
+export async function awaitClassifierAutoApproval(
+  pendingCheck: PendingClassifierCheck,
+  signal: AbortSignal,
+  isNonInteractiveSession: boolean,
+): Promise<PermissionDecisionReason | undefined> {
+  const { command, cwd, descriptions } = pendingCheck
+  const speculativeResult = consumeSpeculativeClassifierCheck(command)
+  const classifierResult = speculativeResult
+    ? await speculativeResult
+    : await classifyBashCommand(
+        command,
+        cwd,
+        descriptions,
+        'allow',
+        signal,
+        isNonInteractiveSession,
+      )
+  logClassifierResultForAnts(command, 'allow', descriptions, classifierResult)
+
+  if (
+    feature('BASH_CLASSIFIER') &&
+    classifierResult.matches &&
+    classifierResult.confidence === 'high'
+  ) {
+    return {
+      type: 'classifier',
+      classifier: 'bash_allow',
+      reason: `Allowed by prompt rule: "${classifierResult.matchedDescription}"`,
+    }
+  }
+  return undefined
+}
+
+type AsyncClassifierCheckCallbacks = {
+  shouldContinue: () => boolean
+  onAllow: (decisionReason: PermissionDecisionReason) => void
+  onComplete?: () => void
+}
+
+export async function executeAsyncClassifierCheck(
+  pendingCheck: { command: string; cwd: string; descriptions: string[] },
+  signal: AbortSignal,
+  isNonInteractiveSession: boolean,
+  callbacks: AsyncClassifierCheckCallbacks,
+): Promise<void> {
+  const { command, cwd, descriptions } = pendingCheck
+  const speculativeResult = consumeSpeculativeClassifierCheck(command)
+  let classifierResult: ClassifierResult
+  try {
+    classifierResult = speculativeResult
+      ? await speculativeResult
+      : await classifyBashCommand(
+          command,
+          cwd,
+          descriptions,
+          'allow',
+          signal,
+          isNonInteractiveSession,
+        )
+  } catch (error: unknown) {
+    if (error instanceof APIUserAbortError || error instanceof AbortError) {
+      callbacks.onComplete?.()
+      return
+    }
+    callbacks.onComplete?.()
+    throw error
+  }
+
+  logClassifierResultForAnts(command, 'allow', descriptions, classifierResult)
+  if (!callbacks.shouldContinue()) return
+  if (
+    feature('BASH_CLASSIFIER') &&
+    classifierResult.matches &&
+    classifierResult.confidence === 'high'
+  ) {
+    callbacks.onAllow({
+      type: 'classifier',
+      classifier: 'bash_allow',
+      reason: `Allowed by prompt rule: "${classifierResult.matchedDescription}"`,
+    })
+  } else {
+    callbacks.onComplete?.()
+  }
+}

package/tui/src/tools/BashTool/bashPermissions/compoundGuards.ts

@@ -0,0 +1,53 @@
+import { createPermissionRequestMessage } from '../../../utils/permissions/permissions.js'
+import type { PermissionResult } from '../../../utils/permissions/PermissionResult.js'
+import type { BashToolInput } from '../schemas.js'
+import { BASH_TOOL_NAME } from '../toolName.js'
+import {
+  isNormalizedCdCommand,
+  isNormalizedGitCommand,
+} from './normalizedCommands.js'
+
+export function checkSubcommandDirectoryGuards(
+  input: BashToolInput,
+  subcommands: readonly string[],
+): { result: PermissionResult | null; compoundCommandHasCd: boolean } {
+  const cdCommands = subcommands.filter(subCommand =>
+    isNormalizedCdCommand(subCommand),
+  )
+  if (cdCommands.length > 1) {
+    const decisionReason = {
+      type: 'other' as const,
+      reason:
+        'Multiple directory changes in one command require approval for clarity',
+    }
+    return {
+      result: {
+        behavior: 'ask',
+        decisionReason,
+        message: createPermissionRequestMessage(BASH_TOOL_NAME, decisionReason),
+      },
+      compoundCommandHasCd: false,
+    }
+  }
+
+  const compoundCommandHasCd = cdCommands.length > 0
+  if (
+    compoundCommandHasCd &&
+    subcommands.some(cmd => isNormalizedGitCommand(cmd.trim()))
+  ) {
+    const decisionReason = {
+      type: 'other' as const,
+      reason:
+        'Compound commands with cd and git require approval to prevent bare repository attacks',
+    }
+    return {
+      result: {
+        behavior: 'ask',
+        decisionReason,
+        message: createPermissionRequestMessage(BASH_TOOL_NAME, decisionReason),
+      },
+      compoundCommandHasCd,
+    }
+  }
+  return { result: null, compoundCommandHasCd }
+}

package/tui/src/tools/BashTool/bashPermissions/constants.ts

@@ -0,0 +1,99 @@
+export const ENV_VAR_ASSIGN_RE = /^[A-Za-z_]\w*=/
+
+export const MAX_SUBCOMMANDS_FOR_SECURITY_CHECK = 50
+
+export const MAX_SUGGESTED_RULES_FOR_COMPOUND = 5
+
+export const BARE_SHELL_PREFIXES = new Set([
+  'sh',
+  'bash',
+  'zsh',
+  'fish',
+  'csh',
+  'tcsh',
+  'ksh',
+  'dash',
+  'cmd',
+  'powershell',
+  'pwsh',
+  'env',
+  'xargs',
+  'nice',
+  'stdbuf',
+  'nohup',
+  'timeout',
+  'time',
+  'sudo',
+  'doas',
+  'pkexec',
+])
+
+export const SAFE_ENV_VARS = new Set([
+  'GOEXPERIMENT',
+  'GOOS',
+  'GOARCH',
+  'CGO_ENABLED',
+  'GO111MODULE',
+  'RUST_BACKTRACE',
+  'RUST_LOG',
+  'NODE_ENV',
+  'PYTHONUNBUFFERED',
+  'PYTHONDONTWRITEBYTECODE',
+  'PYTEST_DISABLE_PLUGIN_AUTOLOAD',
+  'PYTEST_DEBUG',
+  'ANTHROPIC_API_KEY',
+  'LANG',
+  'LANGUAGE',
+  'LC_ALL',
+  'LC_CTYPE',
+  'LC_TIME',
+  'CHARSET',
+  'TERM',
+  'COLORTERM',
+  'NO_COLOR',
+  'FORCE_COLOR',
+  'TZ',
+  'LS_COLORS',
+  'LSCOLORS',
+  'GREP_COLOR',
+  'GREP_COLORS',
+  'GCC_COLORS',
+  'TIME_STYLE',
+  'BLOCK_SIZE',
+  'BLOCKSIZE',
+])
+
+export const ANT_ONLY_SAFE_ENV_VARS = new Set([
+  'KUBECONFIG',
+  'DOCKER_HOST',
+  'AWS_PROFILE',
+  'CLOUDSDK_CORE_PROJECT',
+  'CLUSTER',
+  'COO_CLUSTER',
+  'COO_CLUSTER_NAME',
+  'COO_NAMESPACE',
+  'COO_LAUNCH_YAML_DRY_RUN',
+  'SKIP_NODE_VERSION_CHECK',
+  'EXPECTTEST_ACCEPT',
+  'CI',
+  'GIT_LFS_SKIP_SMUDGE',
+  'CUDA_VISIBLE_DEVICES',
+  'JAX_PLATFORMS',
+  'COLUMNS',
+  'TMUX',
+  'POSTGRESQL_VERSION',
+  'FIRESTORE_EMULATOR_HOST',
+  'HARNESS_QUIET',
+  'TEST_CROSSCHECK_LISTS_MATCH_UPDATE',
+  'DBT_PER_DEVELOPER_ENVIRONMENTS',
+  'STATSIG_FORD_DB_CHECKS',
+  'ANT_ENVIRONMENT',
+  'ANT_SERVICE',
+  'MONOREPO_ROOT_DIR',
+  'PYENV_VERSION',
+  'PGPASSWORD',
+  'GH_TOKEN',
+  'GROWTHBOOK_API_KEY',
+])
+
+export const BINARY_HIJACK_VARS = /^(LD_|DYLD_|PATH$)/

package/tui/src/tools/BashTool/bashPermissions/index.ts

@@ -0,0 +1,38 @@
+export {
+  BINARY_HIJACK_VARS,
+  MAX_SUBCOMMANDS_FOR_SECURITY_CHECK,
+  MAX_SUGGESTED_RULES_FOR_COMPOUND,
+} from './constants.js'
+export {
+  awaitClassifierAutoApproval,
+  clearSpeculativeChecks,
+  consumeSpeculativeClassifierCheck,
+  executeAsyncClassifierCheck,
+  peekSpeculativeClassifierCheck,
+  startSpeculativeClassifierCheck,
+} from './classifierChecks.js'
+export { bashToolHasPermission } from './main.js'
+export {
+  commandHasAnyCd,
+  isNormalizedCdCommand,
+  isNormalizedGitCommand,
+} from './normalizedCommands.js'
+export {
+  bashToolCheckExactMatchPermission,
+  bashToolCheckPermission,
+  checkCommandAndSuggestRules,
+} from './permissionChecks.js'
+export {
+  getFirstWordPrefix,
+  getSimpleCommandPrefix,
+} from './prefixSuggestions.js'
+export {
+  bashPermissionRule,
+  matchWildcardPattern,
+  permissionRuleExtractPrefix,
+} from './ruleDelegates.js'
+export {
+  stripAllLeadingEnvVars,
+  stripSafeWrappers,
+  stripWrappersFromArgv,
+} from './wrapperStripping.js'