ummaya 0.2.4 → 0.2.6

package/tui/src/tools/BashTool/bashPermissions/promptClassifierRules.ts

@@ -0,0 +1,125 @@
+import { feature } from 'bun:bundle'
+import type { ToolUseContext } from '../../../Tool.js'
+import { getCommandSubcommandPrefix } from '../../../utils/bash/commands.js'
+import { getCwd } from '../../../utils/cwd.js'
+import { AbortError } from '../../../utils/errors.js'
+import {
+  classifyBashCommand,
+  getBashPromptAskDescriptions,
+  getBashPromptDenyDescriptions,
+  isClassifierPermissionsEnabled,
+} from '../../../utils/permissions/bashClassifier.js'
+import type { PermissionResult } from '../../../utils/permissions/PermissionResult.js'
+import { createPermissionRequestMessage } from '../../../utils/permissions/permissions.js'
+import type { PermissionUpdate } from '../../../utils/permissions/PermissionUpdateSchema.js'
+import type { BashToolInput } from '../schemas.js'
+import { BASH_TOOL_NAME } from '../toolName.js'
+import {
+  buildPendingClassifierCheck,
+  logClassifierResultForAnts,
+} from './classifierChecks.js'
+import {
+  suggestionForExactCommand,
+  suggestionForPrefix,
+} from './prefixSuggestions.js'
+import type { CommandPrefixResolver } from './types.js'
+
+export async function checkPromptClassifierRules(
+  input: BashToolInput,
+  context: ToolUseContext,
+  getCommandSubcommandPrefixFn: CommandPrefixResolver,
+): Promise<PermissionResult | null> {
+  const appState = context.getAppState()
+  if (
+    !isClassifierPermissionsEnabled() ||
+    (feature('TRANSCRIPT_CLASSIFIER') &&
+      appState.toolPermissionContext.mode === 'auto')
+  ) {
+    return null
+  }
+
+  const denyDescriptions = getBashPromptDenyDescriptions(
+    appState.toolPermissionContext,
+  )
+  const askDescriptions = getBashPromptAskDescriptions(
+    appState.toolPermissionContext,
+  )
+  const hasDeny = denyDescriptions.length > 0
+  const hasAsk = askDescriptions.length > 0
+  if (!hasDeny && !hasAsk) return null
+
+  const [denyResult, askResult] = await Promise.all([
+    hasDeny
+      ? classifyBashCommand(
+          input.command,
+          getCwd(),
+          denyDescriptions,
+          'deny',
+          context.abortController.signal,
+          context.options.isNonInteractiveSession,
+        )
+      : null,
+    hasAsk
+      ? classifyBashCommand(
+          input.command,
+          getCwd(),
+          askDescriptions,
+          'ask',
+          context.abortController.signal,
+          context.options.isNonInteractiveSession,
+        )
+      : null,
+  ])
+  if (context.abortController.signal.aborted) throw new AbortError()
+
+  if (denyResult) {
+    logClassifierResultForAnts(input.command, 'deny', denyDescriptions, denyResult)
+  }
+  if (askResult) {
+    logClassifierResultForAnts(input.command, 'ask', askDescriptions, askResult)
+  }
+  if (denyResult?.matches && denyResult.confidence === 'high') {
+    return {
+      behavior: 'deny',
+      message: `Denied by Bash prompt rule: "${denyResult.matchedDescription}"`,
+      decisionReason: {
+        type: 'other',
+        reason: `Denied by Bash prompt rule: "${denyResult.matchedDescription}"`,
+      },
+    }
+  }
+  if (askResult?.matches && askResult.confidence === 'high') {
+    let suggestions: PermissionUpdate[]
+    if (getCommandSubcommandPrefixFn === getCommandSubcommandPrefix) {
+      suggestions = suggestionForExactCommand(input.command)
+    } else {
+      const commandPrefixResult = await getCommandSubcommandPrefixFn(
+        input.command,
+        context.abortController.signal,
+        context.options.isNonInteractiveSession,
+      )
+      if (context.abortController.signal.aborted) throw new AbortError()
+      suggestions = commandPrefixResult?.commandPrefix
+        ? suggestionForPrefix(commandPrefixResult.commandPrefix)
+        : suggestionForExactCommand(input.command)
+    }
+    return {
+      behavior: 'ask',
+      message: createPermissionRequestMessage(BASH_TOOL_NAME),
+      decisionReason: {
+        type: 'other',
+        reason: `Required by Bash prompt rule: "${askResult.matchedDescription}"`,
+      },
+      suggestions,
+      ...(feature('BASH_CLASSIFIER')
+        ? {
+            pendingClassifierCheck: buildPendingClassifierCheck(
+              input.command,
+              appState.toolPermissionContext,
+            ),
+          }
+        : {}),
+    }
+  }
+  return null
+}

package/tui/src/tools/BashTool/bashPermissions/ruleDelegates.ts

@@ -0,0 +1,19 @@
+import {
+  parsePermissionRule,
+  type ShellPermissionRule,
+  matchWildcardPattern as sharedMatchWildcardPattern,
+  permissionRuleExtractPrefix as sharedPermissionRuleExtractPrefix,
+} from '../../../utils/permissions/shellRuleMatching.js'
+
+export const permissionRuleExtractPrefix = sharedPermissionRuleExtractPrefix
+
+export function matchWildcardPattern(
+  pattern: string,
+  command: string,
+): boolean {
+  return sharedMatchWildcardPattern(pattern, command)
+}
+
+export const bashPermissionRule: (
+  permissionRule: string,
+) => ShellPermissionRule = parsePermissionRule

package/tui/src/tools/BashTool/bashPermissions/ruleMatching.ts

@@ -0,0 +1,145 @@
+import type { ToolPermissionContext } from '../../../Tool.js'
+import {
+  extractOutputRedirections,
+  splitCommand_DEPRECATED,
+} from '../../../utils/bash/commands.js'
+import type { PermissionRule } from '../../../utils/permissions/PermissionRule.js'
+import { getRuleByContentsForToolName } from '../../../utils/permissions/permissions.js'
+import type { BashToolInput } from '../schemas.js'
+import { BASH_TOOL_NAME } from '../toolName.js'
+import { bashPermissionRule, matchWildcardPattern } from './ruleDelegates.js'
+import {
+  stripAllLeadingEnvVars,
+  stripSafeWrappers,
+} from './wrapperStripping.js'
+
+const splitCommand = splitCommand_DEPRECATED
+
+function filterRulesByContentsMatchingInput(
+  input: BashToolInput,
+  rules: Map<string, PermissionRule>,
+  matchMode: 'exact' | 'prefix',
+  {
+    stripAllEnvVars = false,
+    skipCompoundCheck = false,
+  }: { stripAllEnvVars?: boolean; skipCompoundCheck?: boolean } = {},
+): PermissionRule[] {
+  const command = input.command.trim()
+  const commandWithoutRedirections =
+    extractOutputRedirections(command).commandWithoutRedirections
+  const commandsForMatching =
+    matchMode === 'exact'
+      ? [command, commandWithoutRedirections]
+      : [commandWithoutRedirections]
+  const commandsToTry = commandsForMatching.flatMap(cmd => {
+    const strippedCommand = stripSafeWrappers(cmd)
+    return strippedCommand !== cmd ? [cmd, strippedCommand] : [cmd]
+  })
+
+  if (stripAllEnvVars) {
+    const seen = new Set(commandsToTry)
+    let startIdx = 0
+    while (startIdx < commandsToTry.length) {
+      const endIdx = commandsToTry.length
+      for (let i = startIdx; i < endIdx; i++) {
+        const cmd = commandsToTry[i]
+        if (!cmd) continue
+        const envStripped = stripAllLeadingEnvVars(cmd)
+        if (!seen.has(envStripped)) {
+          commandsToTry.push(envStripped)
+          seen.add(envStripped)
+        }
+        const wrapperStripped = stripSafeWrappers(cmd)
+        if (!seen.has(wrapperStripped)) {
+          commandsToTry.push(wrapperStripped)
+          seen.add(wrapperStripped)
+        }
+      }
+      startIdx = endIdx
+    }
+  }
+
+  const isCompoundCommand = new Map<string, boolean>()
+  if (matchMode === 'prefix' && !skipCompoundCheck) {
+    for (const cmd of commandsToTry) {
+      if (!isCompoundCommand.has(cmd)) {
+        isCompoundCommand.set(cmd, splitCommand(cmd).length > 1)
+      }
+    }
+  }
+
+  return Array.from(rules.entries())
+    .filter(([ruleContent]) => {
+      const bashRule = bashPermissionRule(ruleContent)
+      return commandsToTry.some(cmdToMatch => {
+        switch (bashRule.type) {
+          case 'exact':
+            return bashRule.command === cmdToMatch
+          case 'prefix':
+            switch (matchMode) {
+              case 'exact':
+                return bashRule.prefix === cmdToMatch
+              case 'prefix': {
+                if (isCompoundCommand.get(cmdToMatch)) return false
+                if (cmdToMatch === bashRule.prefix) return true
+                if (cmdToMatch.startsWith(bashRule.prefix + ' ')) return true
+                const xargsPrefix = 'xargs ' + bashRule.prefix
+                if (cmdToMatch === xargsPrefix) return true
+                return cmdToMatch.startsWith(xargsPrefix + ' ')
+              }
+            }
+            break
+          case 'wildcard':
+            if (matchMode === 'exact') return false
+            if (isCompoundCommand.get(cmdToMatch)) return false
+            return matchWildcardPattern(bashRule.pattern, cmdToMatch)
+        }
+      })
+    })
+    .map(([, rule]) => rule)
+}
+
+export function matchingRulesForInput(
+  input: BashToolInput,
+  toolPermissionContext: ToolPermissionContext,
+  matchMode: 'exact' | 'prefix',
+  { skipCompoundCheck = false }: { skipCompoundCheck?: boolean } = {},
+) {
+  const denyRuleByContents = getRuleByContentsForToolName(
+    toolPermissionContext,
+    BASH_TOOL_NAME,
+    'deny',
+  )
+  const matchingDenyRules = filterRulesByContentsMatchingInput(
+    input,
+    denyRuleByContents,
+    matchMode,
+    { stripAllEnvVars: true, skipCompoundCheck: true },
+  )
+
+  const askRuleByContents = getRuleByContentsForToolName(
+    toolPermissionContext,
+    BASH_TOOL_NAME,
+    'ask',
+  )
+  const matchingAskRules = filterRulesByContentsMatchingInput(
+    input,
+    askRuleByContents,
+    matchMode,
+    { stripAllEnvVars: true, skipCompoundCheck: true },
+  )
+
+  const allowRuleByContents = getRuleByContentsForToolName(
+    toolPermissionContext,
+    BASH_TOOL_NAME,
+    'allow',
+  )
+  const matchingAllowRules = filterRulesByContentsMatchingInput(
+    input,
+    allowRuleByContents,
+    matchMode,
+    { skipCompoundCheck },
+  )
+
+  return { matchingDenyRules, matchingAskRules, matchingAllowRules }
+}

package/tui/src/tools/BashTool/bashPermissions/sandboxAutoAllow.ts

@@ -0,0 +1,75 @@
+import type { ToolPermissionContext } from '../../../Tool.js'
+import { splitCommand_DEPRECATED } from '../../../utils/bash/commands.js'
+import type { PermissionRule } from '../../../utils/permissions/PermissionRule.js'
+import type { PermissionResult } from '../../../utils/permissions/PermissionResult.js'
+import { createPermissionRequestMessage } from '../../../utils/permissions/permissions.js'
+import type { BashToolInput } from '../schemas.js'
+import { BASH_TOOL_NAME } from '../toolName.js'
+import { matchingRulesForInput } from './ruleMatching.js'
+
+const splitCommand = splitCommand_DEPRECATED
+
+function denyResult(
+  input: BashToolInput,
+  rule: PermissionRule,
+): PermissionResult {
+  return {
+    behavior: 'deny',
+    message: `Permission to use ${BASH_TOOL_NAME} with command ${input.command.trim()} has been denied.`,
+    decisionReason: { type: 'rule', rule },
+  }
+}
+
+export function checkSandboxAutoAllow(
+  input: BashToolInput,
+  toolPermissionContext: ToolPermissionContext,
+): PermissionResult {
+  const command = input.command.trim()
+  const { matchingDenyRules, matchingAskRules } = matchingRulesForInput(
+    input,
+    toolPermissionContext,
+    'prefix',
+  )
+  if (matchingDenyRules[0] !== undefined) {
+    return denyResult(input, matchingDenyRules[0])
+  }
+
+  const subcommands = splitCommand(command)
+  if (subcommands.length > 1) {
+    let firstAskRule: PermissionRule | undefined
+    for (const sub of subcommands) {
+      const subResult = matchingRulesForInput(
+        { command: sub },
+        toolPermissionContext,
+        'prefix',
+      )
+      if (subResult.matchingDenyRules[0] !== undefined) {
+        return denyResult(input, subResult.matchingDenyRules[0])
+      }
+      firstAskRule ??= subResult.matchingAskRules[0]
+    }
+    if (firstAskRule) {
+      return {
+        behavior: 'ask',
+        message: createPermissionRequestMessage(BASH_TOOL_NAME),
+        decisionReason: { type: 'rule', rule: firstAskRule },
+      }
+    }
+  }
+
+  if (matchingAskRules[0] !== undefined) {
+    return {
+      behavior: 'ask',
+      message: createPermissionRequestMessage(BASH_TOOL_NAME),
+      decisionReason: { type: 'rule', rule: matchingAskRules[0] },
+    }
+  }
+  return {
+    behavior: 'allow',
+    updatedInput: input,
+    decisionReason: {
+      type: 'other',
+      reason: 'Auto-allowed with sandbox (autoAllowBashIfSandboxed enabled)',
+    },
+  }
+}

package/tui/src/tools/BashTool/bashPermissions/subcommandFlow.ts

@@ -0,0 +1,205 @@
+import { feature } from 'bun:bundle'
+import type { ToolUseContext } from '../../../Tool.js'
+import type { Redirect, SimpleCommand } from '../../../utils/bash/ast.js'
+import { getCommandSubcommandPrefix } from '../../../utils/bash/commands.js'
+import { getCwd } from '../../../utils/cwd.js'
+import { isEnvTruthy } from '../../../utils/envUtils.js'
+import { AbortError } from '../../../utils/errors.js'
+import type { PermissionResult } from '../../../utils/permissions/PermissionResult.js'
+import { createPermissionRequestMessage } from '../../../utils/permissions/permissions.js'
+import { count } from '../../../utils/array.js'
+import { checkPathConstraints } from '../pathValidation.js'
+import type { BashToolInput } from '../schemas.js'
+import { BASH_TOOL_NAME } from '../toolName.js'
+import { buildPendingClassifierCheck } from './classifierChecks.js'
+import {
+  bashToolCheckPermission,
+  checkCommandAndSuggestRules,
+} from './permissionChecks.js'
+import {
+  allowedSubcommandsResult,
+  collectSuggestedRuleUpdates,
+  deniedSubcommandResult,
+  hasLegacyCommandInjection,
+} from './subcommandResultHelpers.js'
+import type { CommandPrefixResolver } from './types.js'
+
+type ResolveSubcommandPermissionFlowParams = {
+  readonly input: BashToolInput
+  readonly context: ToolUseContext
+  readonly exactMatchResult: PermissionResult
+  readonly subcommands: readonly string[]
+  readonly astCommandsByIdx: readonly (SimpleCommand | undefined)[]
+  readonly astRedirects?: Redirect[]
+  readonly astCommands?: SimpleCommand[]
+  readonly astSubcommands: readonly string[] | null
+  readonly compoundCommandHasCd: boolean
+  readonly getCommandSubcommandPrefixFn: CommandPrefixResolver
+}
+
+export async function resolveSubcommandPermissionFlow({
+  input,
+  context,
+  exactMatchResult,
+  subcommands,
+  astCommandsByIdx,
+  astRedirects,
+  astCommands,
+  astSubcommands,
+  compoundCommandHasCd,
+  getCommandSubcommandPrefixFn,
+}: ResolveSubcommandPermissionFlowParams): Promise<PermissionResult> {
+  let appState = context.getAppState()
+  const subcommandPermissionDecisions = subcommands.map((command, i) =>
+    bashToolCheckPermission(
+      { command },
+      appState.toolPermissionContext,
+      compoundCommandHasCd,
+      astCommandsByIdx[i],
+    ),
+  )
+  if (subcommandPermissionDecisions.some(_ => _.behavior === 'deny')) {
+    return deniedSubcommandResult(input, subcommands, subcommandPermissionDecisions)
+  }
+
+  const pathResult = checkPathConstraints(
+    input,
+    getCwd(),
+    appState.toolPermissionContext,
+    compoundCommandHasCd,
+    astRedirects,
+    astCommands,
+  )
+  if (pathResult.behavior === 'deny') return pathResult
+  const askSubresult = subcommandPermissionDecisions.find(
+    _ => _.behavior === 'ask',
+  )
+  const nonAllowCount = count(
+    subcommandPermissionDecisions,
+    _ => _.behavior !== 'allow',
+  )
+  if (pathResult.behavior === 'ask' && askSubresult === undefined) {
+    return pathResult
+  }
+  if (askSubresult !== undefined && nonAllowCount === 1) {
+    return {
+      ...askSubresult,
+      ...(feature('BASH_CLASSIFIER')
+        ? {
+            pendingClassifierCheck: buildPendingClassifierCheck(
+              input.command,
+              appState.toolPermissionContext,
+            ),
+          }
+        : {}),
+    }
+  }
+  if (exactMatchResult.behavior === 'allow') return exactMatchResult
+
+  const hasPossibleCommandInjection =
+    astSubcommands === null &&
+    !isEnvTruthy(process.env.CLAUDE_CODE_DISABLE_COMMAND_INJECTION_CHECK)
+      ? await hasLegacyCommandInjection(subcommands)
+      : false
+  if (
+    subcommandPermissionDecisions.every(_ => _.behavior === 'allow') &&
+    !hasPossibleCommandInjection
+  ) {
+    return allowedSubcommandsResult(
+      input,
+      subcommands,
+      subcommandPermissionDecisions,
+    )
+  }
+
+  let commandSubcommandPrefix: Awaited<
+    ReturnType<typeof getCommandSubcommandPrefixFn>
+  > = null
+  if (getCommandSubcommandPrefixFn !== getCommandSubcommandPrefix) {
+    commandSubcommandPrefix = await getCommandSubcommandPrefixFn(
+      input.command,
+      context.abortController.signal,
+      context.options.isNonInteractiveSession,
+    )
+    if (context.abortController.signal.aborted) throw new AbortError()
+  }
+
+  appState = context.getAppState()
+  if (subcommands.length === 1) {
+    const onlySubcommand = subcommands[0]
+    if (onlySubcommand === undefined) {
+      return {
+        behavior: 'deny',
+        message: `Permission to use ${BASH_TOOL_NAME} with command ${input.command} has been denied.`,
+      }
+    }
+    const result = await checkCommandAndSuggestRules(
+      { command: onlySubcommand },
+      appState.toolPermissionContext,
+      commandSubcommandPrefix,
+      compoundCommandHasCd,
+      astSubcommands !== null,
+    )
+    if (result.behavior === 'ask' || result.behavior === 'passthrough') {
+      return {
+        ...result,
+        ...(feature('BASH_CLASSIFIER')
+          ? {
+              pendingClassifierCheck: buildPendingClassifierCheck(
+                input.command,
+                appState.toolPermissionContext,
+              ),
+            }
+          : {}),
+      }
+    }
+    return result
+  }
+
+  const subcommandResults: Map<string, PermissionResult> = new Map()
+  for (const subcommand of subcommands) {
+    subcommandResults.set(
+      subcommand,
+      await checkCommandAndSuggestRules(
+        { ...input, command: subcommand },
+        appState.toolPermissionContext,
+        commandSubcommandPrefix?.subcommandPrefixes.get(subcommand),
+        compoundCommandHasCd,
+        astSubcommands !== null,
+      ),
+    )
+  }
+  if (
+    subcommands.every(
+      subcommand => subcommandResults.get(subcommand)?.behavior === 'allow',
+    )
+  ) {
+    return {
+      behavior: 'allow',
+      updatedInput: input,
+      decisionReason: {
+        type: 'subcommandResults',
+        reasons: subcommandResults,
+      },
+    }
+  }
+
+  const decisionReason = {
+    type: 'subcommandResults' as const,
+    reasons: subcommandResults,
+  }
+  return {
+    behavior: askSubresult !== undefined ? 'ask' : 'passthrough',
+    message: createPermissionRequestMessage(BASH_TOOL_NAME, decisionReason),
+    decisionReason,
+    suggestions: collectSuggestedRuleUpdates(subcommandResults),
+    ...(feature('BASH_CLASSIFIER')
+      ? {
+          pendingClassifierCheck: buildPendingClassifierCheck(
+            input.command,
+            appState.toolPermissionContext,
+          ),
+        }
+      : {}),
+  }
+}

package/tui/src/tools/BashTool/bashPermissions/subcommandGuards.ts

@@ -0,0 +1,73 @@
+import type { ToolPermissionContext } from '../../../Tool.js'
+import type { SimpleCommand } from '../../../utils/bash/ast.js'
+import type { PermissionResult } from '../../../utils/permissions/PermissionResult.js'
+import type { BashToolInput } from '../schemas.js'
+import { BASH_TOOL_NAME } from '../toolName.js'
+import { bashToolCheckExactMatchPermission } from './permissionChecks.js'
+import { matchingRulesForInput } from './ruleMatching.js'
+
+export function filterCdCwdSubcommands(
+  rawSubcommands: string[],
+  astCommands: SimpleCommand[] | undefined,
+  cwd: string,
+  cwdMingw: string,
+): { subcommands: string[]; astCommandsByIdx: (SimpleCommand | undefined)[] } {
+  const subcommands: string[] = []
+  const astCommandsByIdx: (SimpleCommand | undefined)[] = []
+  for (let i = 0; i < rawSubcommands.length; i++) {
+    const cmd = rawSubcommands[i]
+    if (cmd === undefined) continue
+    if (cmd === `cd ${cwd}` || cmd === `cd ${cwdMingw}`) continue
+    subcommands.push(cmd)
+    astCommandsByIdx.push(astCommands?.[i])
+  }
+  return { subcommands, astCommandsByIdx }
+}
+
+export function checkEarlyExitDeny(
+  input: BashToolInput,
+  toolPermissionContext: ToolPermissionContext,
+): PermissionResult | null {
+  const exactMatchResult = bashToolCheckExactMatchPermission(
+    input,
+    toolPermissionContext,
+  )
+  if (exactMatchResult.behavior !== 'passthrough') return exactMatchResult
+  const denyMatch = matchingRulesForInput(
+    input,
+    toolPermissionContext,
+    'prefix',
+  ).matchingDenyRules[0]
+  if (denyMatch !== undefined) {
+    return {
+      behavior: 'deny',
+      message: `Permission to use ${BASH_TOOL_NAME} with command ${input.command} has been denied.`,
+      decisionReason: { type: 'rule', rule: denyMatch },
+    }
+  }
+  return null
+}
+
+export function checkSemanticsDeny(
+  input: BashToolInput,
+  toolPermissionContext: ToolPermissionContext,
+  commands: readonly { text: string }[],
+): PermissionResult | null {
+  const fullCmd = checkEarlyExitDeny(input, toolPermissionContext)
+  if (fullCmd !== null) return fullCmd
+  for (const cmd of commands) {
+    const subDeny = matchingRulesForInput(
+      { ...input, command: cmd.text },
+      toolPermissionContext,
+      'prefix',
+    ).matchingDenyRules[0]
+    if (subDeny !== undefined) {
+      return {
+        behavior: 'deny',
+        message: `Permission to use ${BASH_TOOL_NAME} with command ${input.command} has been denied.`,
+        decisionReason: { type: 'rule', rule: subDeny },
+      }
+    }
+  }
+  return null
+}