super-code-assistant 3.3.6__py3-none-any.whl

core/permissions.py

@@ -0,0 +1,204 @@
+from __future__ import annotations
+
+import os
+import sys
+from typing import Literal, TYPE_CHECKING
+
+from core.tool import Tool
+
+if TYPE_CHECKING:
+    from tui.keylistener import EscListener
+
+PermissionBehavior = Literal["allow", "deny"]
+
+_PLAN_MODE_ALLOWED_TOOLS = {
+    "Read", "Glob", "Grep", "AskUserQuestion",
+    "EnterPlanMode", "ExitPlanMode",
+    "Agent", "SendMessage", "TaskStop",
+}
+_PLAN_MODE_WRITE_TOOLS = {"Edit", "Write"}
+
+
+class PermissionChecker:
+    """Read-only tools are auto-allowed. Bash/writes prompt the user (y/n/always)."""
+
+    def __init__(self, auto_approve: bool = False, sandbox_manager=None):
+        self._auto_approve = auto_approve                   # 是否自动批准所有工具
+        self._sandbox_manager = sandbox_manager              # 沙箱管理器（用于 auto_approve_if_sandboxed）
+        self._always_allow: set[str] = set()                # 用户选择“总是允许”的工具集合
+        self._esc_listener: EscListener | None = None       # ESC监听器
+        self._plan_manager = None                           # 计划管理器
+        self._mode: str = "default"                         # 当前模式
+        self._pre_plan_mode: str | None = None                  # 进入计划模式之前的模式
+        self._pre_plan_always_allow: set[str] | None = None     # 进入计划模式之前的always allow备份
+        self._dream_mode: bool = False                          # 是否dream模式
+        self._dream_memory_dir: str | None = None               # dream模式允许写入的目录
+
+    def set_plan_manager(self, plan_manager) -> None:
+        self._plan_manager = plan_manager
+
+    def enter_dream_mode(self, memory_dir: str) -> None:
+        self._dream_mode = True
+        self._dream_memory_dir = os.path.realpath(memory_dir)
+
+    def exit_dream_mode(self) -> None:
+        self._dream_mode = False
+        self._dream_memory_dir = None
+
+    def set_esc_listener(self, listener) -> None:
+        self._esc_listener = listener
+
+    @property
+    def mode(self) -> str:
+        return self._mode
+
+    def enter_plan_mode(self) -> None:
+        self._pre_plan_mode = self._mode
+        self._pre_plan_always_allow = set(self._always_allow)
+        self._mode = "plan"
+        self._always_allow -= {"Bash", "Edit", "Write", "Agent"}  # 从always_allow中移除这些工具
+
+    def exit_plan_mode(self) -> None:
+        self._mode = self._pre_plan_mode or "default"
+        self._pre_plan_mode = None
+        if self._pre_plan_always_allow is not None:
+            self._always_allow = self._pre_plan_always_allow
+            self._pre_plan_always_allow = None
+
+    def check(self, tool: Tool, inputs: dict) -> PermissionBehavior:
+        if self._dream_mode:
+            return self._check_dream(tool, inputs)
+        if self._mode == "plan":
+            return self._check_plan(tool, inputs)
+        if tool.is_read_only():
+            return "allow"
+        if self._auto_approve:
+            return "allow"
+        # 沙箱激活时自动批准 Bash（命令已被黑名单保护）
+        if (self._sandbox_manager is not None
+                and tool.name == "Bash"
+                and self._sandbox_manager._config is not None
+                and self._sandbox_manager._config.auto_approve_if_sandboxed):
+            return "allow"
+        if tool.name in self._always_allow:
+            return "allow"
+        return self._prompt_user(tool, inputs)
+
+    def _check_plan(self, tool: Tool, inputs: dict) -> PermissionBehavior:
+        if tool.name in _PLAN_MODE_ALLOWED_TOOLS:
+            return "allow"
+        if tool.name in _PLAN_MODE_WRITE_TOOLS:
+            file_path = inputs.get("file_path", "")
+            plan_path = self._plan_manager.plan_file_path if self._plan_manager else None
+            if plan_path and os.path.realpath(file_path) == os.path.realpath(plan_path): # 返回指定路径的规范化绝对路径，并解析所有符号链接（软链接）
+                return "allow"
+            from rich.console import Console
+            Console().print(f"[yellow]Plan mode: can only edit the plan file ({plan_path})[/yellow]")
+            return "deny"
+        from rich.console import Console
+        Console().print(f"[yellow]Plan mode: {tool.name} is not allowed.[/yellow]")
+        return "deny"
+
+    def _check_dream(self, tool: Tool, inputs: dict) -> PermissionBehavior:
+        if tool.is_read_only():
+            return "allow"
+        if tool.name in ("Edit", "Write"):
+            file_path = inputs.get("file_path", "")
+            if (self._dream_memory_dir and isinstance(file_path, str)
+                    and os.path.realpath(file_path).startswith(self._dream_memory_dir)):
+                return "allow"
+        return "deny"
+
+    def _prompt_user(self, tool: Tool, inputs: dict) -> PermissionBehavior:
+        from rich.console import Console
+        from prompt_toolkit.application import Application as PTApp
+        from prompt_toolkit.key_binding import KeyBindings
+        from prompt_toolkit.layout import Layout
+        from prompt_toolkit.layout.containers import Window
+        from prompt_toolkit.layout.controls import FormattedTextControl
+
+        console = Console()
+        console.print(f"\n[bold yellow]Permission required:[/bold yellow] [bold]{tool.name}[/bold]")
+
+        # For Edit tool, show old_string/new_string as a diff in a dashed-border Panel
+        if tool.name == "Edit" and "old_string" in inputs and "new_string" in inputs:
+            old_str = str(inputs.get("old_string", ""))
+            new_str = str(inputs.get("new_string", ""))
+            diff_lines = []
+            if old_str:
+                for line in old_str.splitlines():
+                    diff_lines.append(f"[red]- {line}[/red]")
+            if new_str:
+                for line in new_str.splitlines():
+                    diff_lines.append(f"[green]+ {line}[/green]")
+            from rich.panel import Panel
+            diff_body = "\n".join(diff_lines)
+            if len(diff_body) > 500:
+                diff_body = diff_body[:500] + "\n..."
+            console.print(Panel(diff_body, border_style="dim", padding=(0, 1)))
+            for k, v in inputs.items():
+                if k in ("old_string", "new_string"):
+                    continue
+                val = str(v)[:200] + ("..." if len(str(v)) > 200 else "")
+                console.print(f"  [dim]{k}:[/dim] {val}")
+        else:
+            for k, v in inputs.items():
+                val = str(v)[:200] + ("..." if len(str(v)) > 200 else "")
+                console.print(f"  [dim]{k}:[/dim] {val}")
+
+        if self._esc_listener:
+            self._esc_listener.pause()
+
+        # 选项：(返回值, 显示文本)
+        options = [("allow", "Yes"), ("deny", "No"), ("always", "Always allow")]
+        selected = [0]
+
+        def get_text():
+            lines = []
+            for i, (_, label) in enumerate(options):
+                if i == selected[0]:
+                    lines.append(("bold fg:ansigreen", f" \u276f {label}\n"))
+                else:
+                    lines.append(("", f"   {label}\n"))
+            return lines
+
+        kb = KeyBindings()
+
+        @kb.add("up")
+        def _(event):
+            selected[0] = (selected[0] - 1) % len(options)
+            event.app.invalidate()
+
+        @kb.add("down")
+        def _(event):
+            selected[0] = (selected[0] + 1) % len(options)
+            event.app.invalidate()
+
+        @kb.add("enter")
+        def _(event):
+            event.app.exit(result=options[selected[0]][0])
+
+        @kb.add("c-c")
+        def _(event):
+            event.app.exit(result="deny")
+
+        try:
+            app = PTApp(
+                layout=Layout(Window(FormattedTextControl(get_text))),
+                key_bindings=kb,
+                full_screen=False,
+                refresh_interval=None,
+            )
+            choice = app.run()
+        except Exception:
+            choice = "deny"
+        finally:
+            if self._esc_listener:
+                self._esc_listener.resume()
+
+        if choice == "always":
+            self._always_allow.add(tool.name)
+            return "allow"
+        if choice == "allow":
+            return "allow"
+        return "deny"

core/sandbox/__init__.py

@@ -0,0 +1,15 @@
+"""沙箱模块：命令黑名单过滤（非 OS 级隔离）。
+
+启用方式：--sandbox CLI 参数，或 super-code.json 中 sandbox.enabled = true。
+
+目录结构：
+    config.py          — SandboxConfig dataclass，从 super-code.json 解析
+    blacklist.py       — 命令黑名单规则 + SandboxManager
+    path_protection.py — 文件路径保护（禁止写入/读取的目录）
+"""
+from __future__ import annotations
+
+from .blacklist import SandboxManager
+from .config import SandboxConfig
+
+__all__ = ["SandboxManager", "SandboxConfig"]

core/sandbox/blacklist.py

@@ -0,0 +1,176 @@
+"""命令黑名单：规则编译 + 检查入口。
+
+内置规则按类别组织，每项 (re.Pattern, description)。
+外部可通过 SandboxConfig.extra_patterns 追加更多规则。
+"""
+from __future__ import annotations
+
+import re
+import logging
+
+from .config import SandboxConfig
+from .path_protection import check_path as _check_path
+from .network import check_network as _check_network
+
+logger = logging.getLogger(__name__)
+
+# ============================================================
+# 内置黑名单规则（30+ 条，按类别分组）
+# ============================================================
+
+_BUILTIN_RULES: list[tuple[re.Pattern[str], str]] = []
+
+def _add(pattern: str, desc: str) -> None:
+    _BUILTIN_RULES.append((re.compile(pattern, re.I), desc))
+
+# ---- 文件系统破坏 ----
+_add(r'\brm\b[^|;&]*-(?:[a-z]*r[a-z]*f|[a-z]*f[a-z]*r)', "recursive force delete (rm -rf)")
+_add(r'\brm\b[^|;&]*/(?:\s|$)', "delete root /")
+_add(r'\b(?:rd|rmdir)\b[^|;&]*/[sS]', "recursive rmdir (Windows)")
+_add(r'\bdel\b[^|;&]*/[sSq]', "recursive del (Windows)")
+_add(r'>\s*(?:\w:)?[/\\](?:[Ww]indows[/\\]?)?[Ss]ystem32', "overwrite System32")
+_add(r'>\s*/etc/(?:passwd|shadow|sudoers|hosts)\b', "overwrite system file")
+_add(r'>\s*/dev/(?:sd|hd|nvme|mmcblk|disk|loop)\w*', "overwrite disk device")
+
+# ---- 磁盘/分区操作 ----
+_add(r'\b(?:newfs|mkfs|fsck)\b', "filesystem create/check")
+_add(r'\bdiskutil\s+eraseDisk\b', "disk format (macOS)")
+_add(r'\bformat\s+[a-zA-Z]:', "disk format (Windows)")
+_add(r'\bdd\b.*\bof=/dev/(?:sd|hd|nvme|mmcblk)\w*', "raw disk write (dd)")
+
+# ---- 系统配置修改 ----
+_add(r'\bchmod\b[^|;&]*[47]77', "chmod 777 (world-writable)")
+_add(r'\bchmod\b[^|;&]*/(?:etc|usr|bin|sbin|boot)\b', "chmod on system dir")
+_add(r'\bchown\b[^|;&]*/(?:etc|usr|bin|sbin|boot)\b', "chown on system dir")
+
+# ---- 代码执行 / 环境变量注入 ----
+# eval + 网络下载/远程执行才算危险；bare eval "$(brew shellenv)" 是合法初始化
+_add(r'\beval\b.*\b(?:curl|wget|nc|ssh|bash\s+-c|sh\s+-c)\b', "eval with remote code")
+_add(r'\bLD_PRELOAD\b', "LD_PRELOAD injection")
+_add(r'\bDYLD_INSERT_LIBRARIES\b', "DYLD_INSERT_LIBRARIES injection")
+_add(r'\bLD_LIBRARY_PATH\b.*=', "LD_LIBRARY_PATH override")
+
+# source with command substitution（动态路径）；不拦 source /path/to/venv/bin/activate
+_add(r'\bsource\s+(?:\$\(|`|\$\{)', "source with dynamic path")
+
+# ---- 包管理器全局安装 ----
+_add(r'\bpip3?\b.*install\b(?!.*--user)', "pip install (global)")
+_add(r'\bnpm\b.*install\b.*-g\b', "npm install -g")
+_add(r'\bapt\b.*install\b', "apt install")
+_add(r'\byum\b.*install\b', "yum install")
+_add(r'\bbrew\b.*install\b', "brew install")
+
+# ---- 远程传输 / 数据外泄 ----
+_add(r'\bssh\b.*\b(?:root|admin)@', "ssh to privileged user")
+_add(r'\bscp\b', "scp (remote file copy)")
+_add(r'\brsync\b.*(?:@|::|rsync://)', "rsync to remote host")
+_add(r'\bnc\b\s+-[lL]', "netcat listen mode")
+_add(r'\bnc\b.*\s+-e\b', "netcat exec mode")
+
+# ---- 持久化 / 定时任务 ----
+_add(r'\bcrontab\b', "crontab modification")
+_add(r'\bat\b\s', "at job scheduling")
+_add(r'\bsystemctl\b\s+enable\b', "systemctl enable")
+
+# ---- 网络/防火墙 ----
+_add(r'\biptables\b', "iptables modification")
+_add(r'\bnft\b\s', "nftables modification")
+
+# ---- 挂载操作 ----
+_add(r'\bmount\b\s', "mount filesystem")
+_add(r'\bumount\b\s', "unmount filesystem")
+
+# ---- 裸设备/内存访问 ----
+_add(r'>\s*/dev/(?:mem|kmem|port)\b', "raw memory/port access")
+
+# ---- 编码混淆绕过 ----
+_add(r'base64\s+(?:-d|--decode).*\|?\s*(?:bash|sh|zsh|python|perl|ruby)\b', "base64 decode → execute")
+_add(r'xxd\s+-r\b.*\|?\s*(?:bash|sh|zsh)\b', "xxd decode → execute")
+
+# ---- Fork bomb ----
+_add(r':\(\)\s*\{.*:\s*\|.*:.*&.*\}', "fork bomb")
+
+del _add  # 清理辅助函数，避免污染模块命名空间
+
+
+# ============================================================
+# SandboxManager
+# ============================================================
+
+class SandboxManager:
+    """命令黑名单过滤器。
+
+    使用方式：
+        config = SandboxConfig(enabled=True, excluded_commands=["docker"])
+        sandbox = SandboxManager(config)
+        allowed, reason = sandbox.check("rm -rf /")
+    """
+
+    def __init__(self, config: SandboxConfig | None = None) -> None:
+        self._config = config
+
+    def check(self, command: str) -> tuple[bool, str]:
+        """检查命令是否允许执行。
+
+        返回 (True, "") 表示允许，(False, reason) 表示拒绝。
+        """
+        config = self._config
+
+        if config:
+            # 1. 排除列表优先：excluded_commands 开头的命令跳过所有检查（白名单豁免）
+            for exc in config.excluded_commands:
+                if command.strip().startswith(exc):
+                    return True, ""
+
+            # 2. 命令精确黑名单（blocked_commands）
+            cmd_name = command.strip().split()[0] if command.strip() else ""
+            if cmd_name and cmd_name in config.blocked_commands:
+                preview = _preview(command)
+                reason = f"Sandbox blocked: forbidden command '{cmd_name}': {preview}"
+                logger.info(reason)
+                return False, reason
+
+        # 3. 内置正则规则
+        for pattern, desc in _BUILTIN_RULES:
+            if pattern.search(command):
+                preview = _preview(command)
+                reason = f"Sandbox blocked: {desc}: {preview}"
+                logger.info(reason)
+                return False, reason
+
+        # 4. 用户追加的正则规则
+        if config and config.extra_patterns:
+            for pat_str, desc in config.extra_patterns:
+                try:
+                    if re.search(pat_str, command, re.I):
+                        preview = _preview(command)
+                        reason = f"Sandbox blocked: {desc}: {preview}"
+                        logger.info(reason)
+                        return False, reason
+                except re.error:
+                    logger.warning("Invalid sandbox extra pattern: %s", pat_str)
+
+        return True, ""
+
+    def check_path(self, file_path: str, operation: str = "write") -> tuple[bool, str]:
+        """检查文件路径是否受保护（禁止写入/读取的目录）。
+
+        operation: "write" 或 "read"
+        返回 (True, "") 表示允许，(False, reason) 表示拒绝。
+        """
+        return _check_path(file_path, operation)
+
+    def check_network(self, command: str) -> tuple[bool, str]:
+        """检查命令中网络外发操作的目标域名是否合规。
+
+        依赖 config 中的 allowed_domains / denied_domains 配置。
+        两者都为空时不做任何限制（向后兼容）。
+        返回 (True, "") 表示允许，(False, reason) 表示拒绝。
+        """
+        if self._config is None:
+            return True, ""
+        return _check_network(command, self._config.allowed_domains, self._config.denied_domains)
+
+
+def _preview(command: str, max_len: int = 80) -> str:
+    return command[:max_len] + ("..." if len(command) > max_len else "")

core/sandbox/config.py

@@ -0,0 +1,38 @@
+"""沙箱配置：SandboxConfig dataclass + 从 super-code.json 解析。"""
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+
+
+@dataclass
+class SandboxConfig:
+    """沙箱所有可配置项。"""
+
+    enabled: bool = False
+    # 命令级黑名单（精确匹配命令名，如 "mkfs"）
+    blocked_commands: list[str] = field(default_factory=list)
+    # 正则黑名单（额外规则，追加到内置规则之后）
+    extra_patterns: list[tuple[str, str]] = field(default_factory=list)
+    # 跳过沙箱检查的命令前缀（如 "docker", "bazel"）
+    excluded_commands: list[str] = field(default_factory=list)
+    # 沙箱激活时自动批准 Bash 调用（因为命令已被黑名单保护）
+    auto_approve_if_sandboxed: bool = False
+    # 网络外发域名白名单（非空时：只允许列表内的域名外发）
+    allowed_domains: list[str] = field(default_factory=list)
+    # 网络外发域名黑名单（命中直接拒绝，优先级高于白名单）
+    denied_domains: list[str] = field(default_factory=list)
+
+    @classmethod
+    def from_dict(cls, d: dict | None) -> "SandboxConfig":
+        """从 super-code.json 的 sandbox 段创建配置。"""
+        if not d:
+            return cls()
+        return cls(
+            enabled=bool(d.get("enabled", False)),
+            blocked_commands=list(d.get("blocked_commands") or []),
+            extra_patterns=list(d.get("extra_patterns") or []),
+            excluded_commands=list(d.get("excluded_commands") or []),
+            auto_approve_if_sandboxed=bool(d.get("auto_approve_if_sandboxed", False)),
+            allowed_domains=list(d.get("allowed_domains") or []),
+            denied_domains=list(d.get("denied_domains") or []),
+        )

core/sandbox/network.py

@@ -0,0 +1,136 @@
+"""网络外发控制：从命令中提取目标域名，按黑白名单过滤。
+
+Phase 4 — 防止 curl/wget/Invoke-WebRequest 将数据外泄到未授权域名。
+"""
+from __future__ import annotations
+
+import re
+import logging
+from urllib.parse import urlparse
+
+logger = logging.getLogger(__name__)
+
+# 网络外发命令匹配（curl、wget、PowerShell Invoke-WebRequest/iwr）
+# 使用 \b 单词边界匹配，覆盖 /usr/bin/curl 这类带路径的调用
+_NET_CMD_RE = re.compile(
+    r'\b(?:curl(?:\.exe)?|wget(?:\.exe)?|Invoke-WebRequest|iwr)\b',
+    re.I,
+)
+
+# 从命令中提取 URL（带 scheme 的完整 URL，或带路径/端口的裸域名）
+_URL_RE = re.compile(
+    r'(?:https?|ftp)://[^\s"\';&|`$()<>]+'              # http(s)://host/path
+    r'|'                                                  # 或
+    r'(?:^|\s)(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}'  # 裸域名
+    r'(?::\d+(?:/\S*)?|/\S+)',                           # 必须有路径或端口（区分文件参数）
+    re.I,
+)
+
+# 检测 curl/wget 的文件上传参数（-d @file、--data @file、-T file、--upload-file file、--post-file file）
+# 上传本地文件是数据外泄的关键指标
+_FILE_UPLOAD_RE = re.compile(
+    r'(?:-d|--data(?:-raw|-binary|-urlencode)?)[\s=]*@\S|'   # -d@file、-d @file、--data=@file
+    r'(?:-T|--upload-file)\s+\S|'                              # -T file、--upload-file file
+    r'--post-file[=\s]\S',                                     # --post-file=path、--post-file path
+    re.I,
+)
+
+
+def check_network(command: str, allowed: list[str], denied: list[str]) -> tuple[bool, str]:
+    """检查命令中网络外发操作的目标域名是否合规。
+
+    Args:
+        command: 完整的 shell 命令
+        allowed: 域名白名单（非空时只允许列表中的域名）
+        denied: 域名黑名单（命中直接拒绝）
+
+    Returns:
+        (True, "") 允许执行，(False, reason) 拒绝。
+    """
+    # 1. 判断是否为网络外发命令
+    if not _NET_CMD_RE.search(command):
+        return True, ""
+
+    # 2. 文件上传检查（独立于域名配置，始终生效）
+    if _FILE_UPLOAD_RE.search(command):
+        preview = command[:80] + ("..." if len(command) > 80 else "")
+        reason = f"Sandbox blocked: file upload via network command: {preview}"
+        logger.info(reason)
+        return False, reason
+
+    # 3. 无域名配置 → 不限制（文件上传已在上一步拦截）
+    if not allowed and not denied:
+        return True, ""
+
+    # 4. 提取命令中所有 URL（用 finditer，避免 capturing group 导致 findall 只返回 scheme）
+    urls = [m.group(0) for m in _URL_RE.finditer(command)]
+    if not urls:
+        return True, ""
+
+    # 5. 对每个 URL 提取域名并检查
+    for raw_url in urls:
+        url_str = raw_url.strip()
+        hostname = _extract_hostname(url_str)
+
+        if not hostname:
+            continue
+
+        # 记录请求 URL（用于日志和错误信息，脱敏处理 query 参数）
+        preview = _safe_url_preview(url_str)
+
+        # 6. 黑名单优先
+        for denied_domain in denied:
+            if _domain_match(hostname, denied_domain):
+                reason = f"Sandbox blocked: network request to denied domain '{hostname}': {preview}"
+                logger.info(reason)
+                return False, reason
+
+        # 7. 白名单检查（白名单非空时，未命中 = 拒绝）
+        if allowed:
+            matched = any(_domain_match(hostname, a) for a in allowed)
+            if not matched:
+                reason = f"Sandbox blocked: network request to unlisted domain '{hostname}': {preview}"
+                logger.info(reason)
+                return False, reason
+
+    return True, ""
+
+
+def _extract_hostname(url_str: str) -> str:
+    """从 URL 中提取主机名。
+
+    处理两种格式：
+      - http(s)://host/path  → urlparse 正常解析
+      - host/path, host:8080/path  → 裸域名，需手动提取
+    """
+    if "://" in url_str:
+        try:
+            parsed = urlparse(url_str)
+            return parsed.hostname or ""
+        except Exception:
+            return ""
+    # 裸域名：取第一个 '/' 或 ':' 之前的部分作为 hostname
+    bare = url_str.split("/")[0]  # "host:8080" or "host"
+    return bare.split(":")[0]      # "host"
+
+
+def _domain_match(hostname: str, rule: str) -> bool:
+    """域名匹配：精确匹配或子域名匹配。
+
+    rule="example.com" 匹配 example.com 和 *.example.com
+    rule=".example.com" 等价于 rule="example.com"
+    """
+    rule = rule.lstrip(".")
+    return hostname == rule or hostname.endswith("." + rule)
+
+
+def _safe_url_preview(url: str, max_len: int = 80) -> str:
+    """URL 预览（截断前先尝试去掉 query 参数，避免 token 信息泄漏到日志）。"""
+    try:
+        parsed = urlparse(url)
+        clean = f"{parsed.scheme}://{parsed.hostname}{parsed.path or ''}"
+        if clean and len(clean) > 20:
+            return clean[:max_len] + ("..." if len(clean) > max_len else "")
+    except Exception:
+        pass
+    return url[:max_len] + ("..." if len(url) > max_len else "")