rafter-cli 0.10.0__tar.gz → 0.10.2__tar.gz

{rafter_cli-0.10.0 → rafter_cli-0.10.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rafter-cli
-Version: 0.10.0
+Version: 0.10.2
 Summary: Rafter CLI — the default security agent for AI workflows. Free for individuals and open source.
 License: MIT
 Author: Rafter Team

{rafter_cli-0.10.0 → rafter_cli-0.10.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "rafter-cli"
-version = "0.10.0"
+version = "0.10.2"
 description = "Rafter CLI — the default security agent for AI workflows. Free for individuals and open source."
 authors = ["Rafter Team <hello@rafter.so>"]
 license = "MIT"

{rafter_cli-0.10.0 → rafter_cli-0.10.2}/rafter_cli/commands/agent.py

@@ -1711,6 +1711,31 @@ def _scan_file(file_path: str, engine: str, custom_patterns=None) -> list[ScanRe
     return run_patterns()
 
 
+def _output_empty_diff_scan(
+    empty_message: str,
+    json_output: bool,
+    quiet: bool,
+    context_label: str,
+    format: str,
+    suppressions,
+) -> None:
+    """Emit the result of a diff scan that had no files to scan.
+
+    ``empty_message`` ("No files changed since <ref>") is a *status* line, so it
+    goes to stderr — stdout has to stay parseable as JSON under ``--json``, and
+    ``_output_scan_results`` owns the single stdout success line. Mirrors the
+    empty branches of ``runGitAddedLineScan`` in
+    node/src/commands/agent/scan.ts — keep the two in sync.
+    """
+    if not quiet:
+        # rprint, not print — fmt.success returns rich markup that plain print
+        # would emit literally as "[green]...[/green]".
+        rprint(fmt.success(empty_message), file=sys.stderr)
+    _output_scan_results(
+        [], json_output, quiet, context_label, format=format, suppressions=suppressions
+    )
+
+
 def _run_git_added_line_scan(
     git_args: list[str],
     git_cwd: str | None,
@@ -1743,14 +1768,16 @@ def _run_git_added_line_scan(
         raise typer.Exit(code=2)
 
     if not patch.strip():
-        if not quiet:
-            rprint(fmt.success(empty_message))
+        _output_empty_diff_scan(
+            empty_message, json_output, quiet, context_label, format, suppressions
+        )
         raise typer.Exit(code=0)
 
     added = parse_unified_diff_added_lines(patch)
     if not added:
-        if not quiet:
-            rprint(fmt.success(empty_message))
+        _output_empty_diff_scan(
+            empty_message, json_output, quiet, context_label, format, suppressions
+        )
         raise typer.Exit(code=0)
 
     try:
@@ -2397,16 +2424,65 @@ def _audit_share() -> None:
 # ── exec ─────────────────────────────────────────────────────────────
 
 
+# Approval model (rf-ss67): the only party who can approve a command that the
+# policy says needs approval is a person at an interactive terminal. No flag,
+# env var or stdin trick stands in for that, because every one of those can be
+# produced by the agent whose command is being gated:
+#   * `--force` used to skip the prompt. Combined with the PreToolUse hook
+#     treating a quoted argument as prose, `rafter agent exec --force "<cmd>"`
+#     ran any HIGH-tier command unprompted with the hook blind. The flag is
+#     kept only so old invocations parse; it changes nothing.
+#   * A piped "yes" is not a person. Approval is offered only when stdin is a
+#     TTY; otherwise the command is denied and says why.
+# The machine owner widens policy in ~/.rafter/config.json, not per call.
+
+_DRY_RUN_EXIT = {"allowed": 0, "blocked": 1, "approval": 2}
+
+
+def _join_command_parts(parts: list[str]) -> str:
+    """One quoted argument is the command verbatim; several (the `-- rm -rf x`
+    form the docs show) are re-joined with shell quoting so the classifier sees
+    what will run — `-- echo "a b"` becomes `echo 'a b'`, not `echo a b`."""
+    import shlex
+
+    if len(parts) == 1:
+        return parts[0]
+    return shlex.join(parts)
+
+
 @agent_app.command("exec")
 def exec_cmd(
-    command: str = typer.Argument(..., help="Command to execute"),
+    command: list[str] = typer.Argument(..., help="Command to execute (quote it, or pass it after --)"),
     skip_scan: bool = typer.Option(False, "--skip-scan", help="Skip pre-execution file scanning"),
-    force: bool = typer.Option(False, "--force", help="Skip approval prompts"),
+    dry_run: bool = typer.Option(
+        False, "--dry-run",
+        help="Classify the command and exit without running it (exit 0 allowed, 1 blocked, 2 needs approval)",
+    ),
+    force: bool = typer.Option(False, "--force", hidden=True, help="Deprecated: no longer skips approval (rf-ss67)"),
 ):
     """Execute command with security validation."""
+    command = _join_command_parts(command)
     interceptor = CommandInterceptor()
     evaluation = interceptor.evaluate(command)
 
+    # --dry-run reports the classification and stops. Nothing runs, nothing is
+    # scanned, nothing is logged as executed.
+    if dry_run:
+        blocked = not evaluation.allowed and not evaluation.requires_approval
+        verdict = "BLOCKED" if blocked else ("REQUIRES APPROVAL" if evaluation.requires_approval else "ALLOWED")
+        print(f"Dry run: {verdict}")
+        print(f"Risk Level: {evaluation.risk_level.upper()}")
+        print(f"Requires approval: {'yes' if evaluation.requires_approval else 'no'}")
+        if evaluation.reason:
+            print(f"Reason: {evaluation.reason}")
+        print(f"Command: {command}")
+        print("Not executed (--dry-run).")
+        raise typer.Exit(
+            code=_DRY_RUN_EXIT["blocked"] if blocked
+            else _DRY_RUN_EXIT["approval"] if evaluation.requires_approval
+            else _DRY_RUN_EXIT["allowed"]
+        )
+
     # Blocked
     if not evaluation.allowed and not evaluation.requires_approval:
         rprint(f"\n{fmt.error('Command BLOCKED')}\n")
@@ -2446,8 +2522,10 @@ def exec_cmd(
         except (subprocess.CalledProcessError, FileNotFoundError):
             pass
 
-    # Requires approval
-    if evaluation.requires_approval and not force:
+    # Requires approval — only a person at a terminal can give it.
+    if evaluation.requires_approval:
+        if force:
+            rprint(f"\n{fmt.warning('--force no longer skips approval (rf-ss67); approval needs a person at an interactive terminal')}\n")
         rprint(f"\n{fmt.warning('Command requires approval')}\n")
         print(f"Risk Level: {evaluation.risk_level.upper()}")
         print(f"Command: {command}")
@@ -2455,6 +2533,15 @@ def exec_cmd(
             print(f"Reason: {evaluation.reason}")
         print()
 
+        if not sys.stdin.isatty():
+            rprint(fmt.error("Command denied: approval needs an interactive terminal, and stdin is not one"))
+            print(
+                "Run the command yourself at a terminal, or have the machine owner adjust "
+                "commandPolicy in ~/.rafter/config.json.\n"
+            )
+            interceptor.log_evaluation(evaluation, "blocked")
+            raise typer.Exit(code=1)
+
         answer = input("Approve this command? (yes/no): ").strip().lower()
         if answer not in ("yes", "y"):
             rprint(f"\n{fmt.error('Command cancelled')}\n")
@@ -2463,9 +2550,6 @@ def exec_cmd(
 
         rprint(f"\n{fmt.success('Command approved by user')}\n")
         interceptor.log_evaluation(evaluation, "overridden")
-    elif force and evaluation.requires_approval:
-        rprint(f"\n{fmt.warning('Forcing execution (--force flag)')}\n")
-        interceptor.log_evaluation(evaluation, "overridden")
     else:
         interceptor.log_evaluation(evaluation, "allowed")