CST-agent/src/permissions.c

/* Persistent "always allow" rules: <ws>/.agent/permissions.json
 *   {"tools": ["write_file"], "shell_prefixes": ["make", "git status"]} */
#ifndef _DEFAULT_SOURCE
#define _DEFAULT_SOURCE
#endif
#include <ctype.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <strings.h>

#include "cJSON.h"
#include "cst_perms.h"
#include "cst_util.h"
#include "os_compat.h"

#define PERM_MAX 64

struct cst_perms {
  char path[OS_PATH_MAX];
  char tools[PERM_MAX][64];
  int ntools;
  char prefixes[PERM_MAX][128];
  int nprefixes;
};

static void load(cst_perms_t *p) {
  FILE *fp = fopen(p->path, "rb");
  if (!fp)
    return;
  cst_buf_t b = {0};
  char tmp[4096];
  size_t n;
  while ((n = fread(tmp, 1, sizeof(tmp), fp)) > 0 && b.len < 256 * 1024)
    cst_buf_append(&b, tmp, n);
  fclose(fp);
  cJSON *root = b.buf ? cJSON_Parse(b.buf + cst_bom_len(b.buf, b.len)) : NULL;
  cst_buf_free(&b);
  const cJSON *it = NULL;
  cJSON_ArrayForEach(it, cJSON_GetObjectItemCaseSensitive(root, "tools")) {
    if (cJSON_IsString(it) && p->ntools < PERM_MAX)
      snprintf(p->tools[p->ntools++], 64, "%.63s", it->valuestring);
  }
  cJSON_ArrayForEach(it,
                     cJSON_GetObjectItemCaseSensitive(root, "shell_prefixes")) {
    if (cJSON_IsString(it) && p->nprefixes < PERM_MAX && it->valuestring[0])
      snprintf(p->prefixes[p->nprefixes++], 128, "%.127s", it->valuestring);
  }
  cJSON_Delete(root);
}

cst_perms_t *cst_perms_open(const char *workspace) {
  cst_perms_t *p = calloc(1, sizeof(*p));
  if (!p)
    return NULL;
  if (workspace)
    snprintf(p->path, sizeof(p->path), "%s/.agent/permissions.json",
             workspace);
  load(p);
  return p;
}

void cst_perms_close(cst_perms_t *p) { free(p); }

static int save(const cst_perms_t *p) {
  if (!p->path[0])
    return -1;
  char dir[OS_PATH_MAX];
  snprintf(dir, sizeof(dir), "%s", p->path);
  char *sl = strrchr(dir, '/');
  if (sl) {
    *sl = 0;
    os_mkdir_p(dir, 0755);
  }
  cJSON *root = cJSON_CreateObject();
  cJSON *t = cJSON_AddArrayToObject(root, "tools");
  for (int i = 0; i < p->ntools; i++)
    cJSON_AddItemToArray(t, cJSON_CreateString(p->tools[i]));
  cJSON *s = cJSON_AddArrayToObject(root, "shell_prefixes");
  for (int i = 0; i < p->nprefixes; i++)
    cJSON_AddItemToArray(s, cJSON_CreateString(p->prefixes[i]));
  char *txt = cJSON_Print(root);
  cJSON_Delete(root);
  if (!txt)
    return -1;
  FILE *fp = fopen(p->path, "wb");
  int rc = -1;
  if (fp) {
    rc = fputs(txt, fp) >= 0 && fputs("\n", fp) >= 0 ? 0 : -1;
    if (fclose(fp) != 0)
      rc = -1;
  }
  free(txt);
  return rc;
}

/* Commands chained or substituted can hide anything behind an allowed
 * prefix, so they always ask. */
static int has_shell_meta(const char *cmd) {
  return strpbrk(cmd, ";&|`$<>\n\r(){}") != NULL;
}

int cst_perms_shell_allowed(const cst_perms_t *p, const char *cmd) {
  if (!p || !cmd)
    return 0;
  while (*cmd == ' ' || *cmd == '\t')
    cmd++;
  if (!*cmd || has_shell_meta(cmd))
    return 0;
  for (int i = 0; i < p->nprefixes; i++) {
    size_t n = strlen(p->prefixes[i]);
    if (strncmp(cmd, p->prefixes[i], n) == 0 &&
        (cmd[n] == 0 || cmd[n] == ' ' || cmd[n] == '\t'))
      return 1;
  }
  return 0;
}

int cst_perms_tool_allowed(const cst_perms_t *p, const char *tool) {
  if (!p || !tool)
    return 0;
  for (int i = 0; i < p->ntools; i++) {
    if (strcmp(p->tools[i], tool) == 0)
      return 1;
  }
  return 0;
}

int cst_perms_allow_tool(cst_perms_t *p, const char *tool) {
  if (!p || !tool || !tool[0])
    return -1;
  if (cst_perms_tool_allowed(p, tool))
    return 0;
  if (p->ntools >= PERM_MAX)
    return -1;
  snprintf(p->tools[p->ntools++], 64, "%.63s", tool);
  return save(p);
}

int cst_perms_allow_prefix(cst_perms_t *p, const char *prefix) {
  if (!p || !prefix)
    return -1;
  while (*prefix == ' ')
    prefix++;
  if (!prefix[0] || has_shell_meta(prefix))
    return -1;
  for (int i = 0; i < p->nprefixes; i++) {
    if (strcmp(p->prefixes[i], prefix) == 0)
      return 0;
  }
  if (p->nprefixes >= PERM_MAX)
    return -1;
  snprintf(p->prefixes[p->nprefixes++], 128, "%.127s", prefix);
  return save(p);
}

int cst_perms_reset(cst_perms_t *p) {
  if (!p)
    return -1;
  p->ntools = p->nprefixes = 0;
  return save(p);
}

char *cst_perms_describe(const cst_perms_t *p) {
  cst_buf_t b = {0};
  cst_buf_puts(&b, "always allowed tools: ");
  if (!p || !p->ntools)
    cst_buf_puts(&b, "(none)");
  for (int i = 0; p && i < p->ntools; i++)
    cst_buf_printf(&b, "%s%s", i ? ", " : "", p->tools[i]);
  cst_buf_puts(&b, "\nallowed shell prefixes: ");
  if (!p || !p->nprefixes)
    cst_buf_puts(&b, "(none)");
  for (int i = 0; p && i < p->nprefixes; i++)
    cst_buf_printf(&b, "%s`%s`", i ? ", " : "", p->prefixes[i]);
  cst_buf_puts(&b, "\n");
  return cst_buf_steal(&b);
}

/* "git status -s" → "git status"; "make -j8" → "make"; "./run.sh x" →
 * "./run.sh". Tools with sub-commands keep two words. */
void cst_perms_suggest_prefix(const char *cmd, char *out, size_t out_sz) {
  static const char *const two_word[] = {"git", "npm", "pnpm", "yarn",
                                         "cargo", "go", "docker", "kubectl",
                                         "pip", "python", "python3", "uv",
                                         "bun", "dotnet", "mvn", "gradle"};
  /* A prefix rule for these would allow almost anything. */
  static const char *const never[] = {
      "sudo", "su",   "doas",  "rm",   "dd",    "mkfs", "shutdown", "reboot",
      "sh",   "bash", "zsh",   "fish", "dash",  "env",  "xargs",    "eval",
      "exec", "nohup", "time", "nice", "timeout", "find", "chmod",  "chown",
      "curl", "wget", "ssh",   "scp",  "node",  "perl", "ruby",     "busybox"};
  out[0] = 0;
  if (!cmd)
    return;
  while (*cmd == ' ' || *cmd == '\t')
    cmd++;
  size_t w1 = strcspn(cmd, " \t");
  if (w1 == 0)
    return;
  for (size_t i = 0; i < sizeof(never) / sizeof(never[0]); i++) {
    if (strlen(never[i]) == w1 && strncmp(cmd, never[i], w1) == 0)
      return;
  }
  size_t take = w1;
  for (size_t i = 0; i < sizeof(two_word) / sizeof(two_word[0]); i++) {
    if (strlen(two_word[i]) == w1 && strncmp(cmd, two_word[i], w1) == 0) {
      const char *r = cmd + w1;
      while (*r == ' ' || *r == '\t')
        r++;
      size_t w2 = strcspn(r, " \t");
      if (w2 == 0 || r[0] == '-')
        return; /* "python3 -c ..." / bare "git": no safe rule */
      take = (size_t)(r - cmd) + w2;
      break;
    }
  }
  if (take >= out_sz)
    take = out_sz - 1;
  memcpy(out, cmd, take);
  out[take] = 0;
  if (has_shell_meta(out))
    out[0] = 0;
}

/* --- network commands ------------------------------------------------------ */

static int net_word_eq(const char *w, size_t n, const char *name) {
  size_t k = strlen(name);
  if (n == k + 4 && strncasecmp(w + k, ".exe", 4) == 0)
    n = k;
  return n == k && strncasecmp(w, name, k) == 0;
}

int cst_shell_uses_network(const char *cmd) {
  static const char *const TOOLS[] = {
      "curl",   "wget",     "ssh",   "scp",     "sftp",    "rsync",
      "ftp",    "tftp",     "telnet", "nc",     "ncat",    "netcat",
      "socat",  "npx",      "invoke-webrequest", "iwr",    "invoke-restmethod",
      "irm",    "start-bitstransfer", "bitsadmin", "certutil"};
  /* tool + sub-command that downloads or uploads */
  static const char *const PAIRS[][2] = {
      {"git", "clone"},     {"git", "fetch"},     {"git", "pull"},
      {"git", "push"},      {"git", "ls-remote"}, {"git", "submodule"},
      {"npm", "install"},   {"npm", "i"},         {"npm", "ci"},
      {"npm", "update"},    {"npm", "publish"},   {"npm", "exec"},
      {"pnpm", "install"},  {"pnpm", "add"},      {"pnpm", "dlx"},
      {"yarn", "install"},  {"yarn", "add"},      {"bun", "install"},
      {"bun", "add"},       {"pip", "install"},   {"pip", "download"},
      {"pip3", "install"},  {"uv", "pip"},        {"uv", "add"},
      {"uv", "sync"},       {"cargo", "install"}, {"cargo", "fetch"},
      {"cargo", "update"},  {"cargo", "publish"}, {"go", "get"},
      {"go", "install"},    {"go", "mod"},        {"gem", "install"},
      {"dotnet", "restore"}, {"dotnet", "add"},   {"winget", "install"},
      {"choco", "install"}, {"scoop", "install"}, {"apt", "install"},
      {"apt-get", "install"}, {"pkg", "install"}, {"brew", "install"}};
  if (!cmd)
    return 0;
  const char *prev = NULL;
  size_t prev_n = 0;
  for (const char *p = cmd; *p;) {
    while (*p && strchr(" \t\r\n;|&()<>`'\"$=", *p))
      p++;
    const char *w = p;
    while (*p && !strchr(" \t\r\n;|&()<>`'\"$=", *p))
      p++;
    size_t n = (size_t)(p - w);
    if (!n)
      break;
    /* /usr/bin/curl, C:\tools\curl.exe */
    for (size_t i = n; i > 0; i--) {
      if (w[i - 1] == '/' || w[i - 1] == '\\') {
        n -= i;
        w += i;
        break;
      }
    }
    for (size_t i = 0; i < sizeof(TOOLS) / sizeof(TOOLS[0]); i++)
      if (net_word_eq(w, n, TOOLS[i]))
        return 1;
    for (size_t i = 0; prev && i < sizeof(PAIRS) / sizeof(PAIRS[0]); i++)
      if (net_word_eq(prev, prev_n, PAIRS[i][0]) &&
          net_word_eq(w, n, PAIRS[i][1]))
        return 1;
    if (n && w[0] != '-') {
      prev = w;
      prev_n = n;
    }
  }
  return 0;
}

/* --- read-only command rules ---------------------------------------------- */

#define SAFE_MAX_WORDS 64
#define SAFE_WORD_MAX 256

typedef struct {
  char w[SAFE_MAX_WORDS][SAFE_WORD_MAX];
  int n;
} seg_t;

static int word_in(const char *w, const char *const *list, size_t n) {
  for (size_t i = 0; i < n; i++)
    if (strcmp(w, list[i]) == 0)
      return 1;
  return 0;
}

static int has_prefix(const char *s, const char *p) {
  return strncmp(s, p, strlen(p)) == 0;
}

static int git_safe(const seg_t *s) {
  static const char *const SUB[] = {"status", "diff", "log", "show", "branch"};
  static const char *const BRANCH_OK[] = {
      "-a",       "-r",       "-v",         "-vv",       "-l",
      "--list",   "--all",    "--remotes",  "--verbose", "--show-current",
      "--merged", "--no-merged", "--contains", "--no-contains",
      "--no-color", "--color"};
  int i = 1;
  while (i < s->n && strcmp(s->w[i], "--no-pager") == 0)
    i++;
  if (i >= s->n || !word_in(s->w[i], SUB, sizeof(SUB) / sizeof(SUB[0])))
    return 0;
  int branch = strcmp(s->w[i], "branch") == 0, listing = 0;
  for (int j = i + 1; j < s->n; j++) {
    const char *a = s->w[j];
    if (has_prefix(a, "--output") || has_prefix(a, "--ext-diff") ||
        has_prefix(a, "--textconv"))
      return 0;
    if (!branch)
      continue;
    if (a[0] == '-') {
      if (!word_in(a, BRANCH_OK, sizeof(BRANCH_OK) / sizeof(BRANCH_OK[0])) &&
          !has_prefix(a, "--sort=") && !has_prefix(a, "--format="))
        return 0;
      if (strcmp(a, "-l") == 0 || strcmp(a, "--list") == 0 ||
          strcmp(a, "-a") == 0 || strcmp(a, "-r") == 0 ||
          strcmp(a, "--all") == 0 || strcmp(a, "--remotes") == 0 ||
          has_prefix(a, "--contains") || has_prefix(a, "--merged") ||
          has_prefix(a, "--no-merged") || has_prefix(a, "--no-contains"))
        listing = 1;
    } else if (!listing) {
      return 0; /* "git branch NAME" creates a branch */
    }
  }
  return 1;
}

static int seg_safe(const seg_t *s) {
  static const char *const CMDS[] = {
      "ls",   "cat",  "head", "tail", "wc",   "grep",  "rg",
      "find", "git",  "pwd",  "echo", "which", "file", "stat",
      "du",   "tree", "true", "false"};
  static const char *const FIND_BAD[] = {"-exec",  "-execdir", "-delete",
                                         "-ok",    "-okdir",   "-fprint",
                                         "-fprint0", "-fprintf", "-fls"};
  if (s->n == 0)
    return 0;
  const char *c = s->w[0];
  if (!word_in(c, CMDS, sizeof(CMDS) / sizeof(CMDS[0])))
    return 0;
  if (strcmp(c, "git") == 0)
    return git_safe(s);
  for (int i = 1; i < s->n; i++) {
    const char *a = s->w[i];
    if (strcmp(c, "find") == 0 &&
        word_in(a, FIND_BAD, sizeof(FIND_BAD) / sizeof(FIND_BAD[0])))
      return 0;
    if (strcmp(c, "rg") == 0 && has_prefix(a, "--pre"))
      return 0;
    if (strcmp(c, "tree") == 0 && strcmp(a, "-o") == 0)
      return 0;
    if (strcmp(c, "file") == 0 && (strcmp(a, "-C") == 0 ||
                                   strcmp(a, "--compile") == 0))
      return 0;
  }
  return 1;
}

/* Accepts "2>&1", ">&2", ">/dev/null", "2>/dev/null", "&>/dev/null".
 * *pp points at '>'; on success it is advanced past the target. */
static int redirect_ok(const char **pp) {
  const char *p = *pp + 1;
  if (*p == '>')
    return 0; /* append */
  while (*p == ' ' || *p == '\t')
    p++;
  if (*p == '&' && (p[1] == '1' || p[1] == '2')) {
    p += 2;
  } else if (strncmp(p, "/dev/null", 9) == 0) {
    p += 9;
  } else {
    return 0;
  }
  if (*p && !strchr(" \t;|&", *p))
    return 0;
  *pp = p;
  return 1;
}

static int seg_push_word(seg_t *s, char *word, size_t *wl, int *in_word) {
  if (!*in_word)
    return 1;
  if (s->n >= SAFE_MAX_WORDS)
    return 0;
  word[*wl] = 0;
  memcpy(s->w[s->n++], word, *wl + 1);
  *wl = 0;
  *in_word = 0;
  return 1;
}

int cst_shell_is_safe(const char *cmd) {
  if (!cmd)
    return 0;
  if (strstr(cmd, "$(") || strchr(cmd, '`') || strstr(cmd, "<(") ||
      strstr(cmd, ">(") || strchr(cmd, '\n') || strchr(cmd, '\r'))
    return 0;
  seg_t *s = calloc(1, sizeof(*s));
  if (!s)
    return 0;
  char word[SAFE_WORD_MAX];
  size_t wl = 0;
  int in_word = 0, nseg = 0, ok = 1;
  char q = 0;
  for (const char *p = cmd;; p++) {
    char ch = *p;
    if (q) {
      if (ch == 0) {
        ok = 0;
        break;
      }
      if (ch == q) {
        q = 0;
        continue;
      }
      if (q == '"' && ch == '\\' && p[1]) {
        ch = *++p;
      }
      if (wl + 1 >= sizeof(word)) {
        ok = 0;
        break;
      }
      word[wl++] = ch;
      continue;
    }
    if (ch == '\'' || ch == '"') {
      q = ch;
      in_word = 1;
      continue;
    }
    if (ch == '\\' && p[1]) {
      if (wl + 1 >= sizeof(word)) {
        ok = 0;
        break;
      }
      word[wl++] = *++p;
      in_word = 1;
      continue;
    }
    int sep = ch == 0 || ch == ';' || ch == '|' ||
              (ch == '&' && p[1] == '&');
    if (ch == '>' || (ch == '&' && p[1] == '>') ||
        ((ch >= '0' && ch <= '9') && !in_word && p[1] == '>')) {
      if (ch != '>')
        p++;
      if (!redirect_ok(&p)) {
        ok = 0;
        break;
      }
      p--;
      continue;
    }
    if (ch == '&' && !sep) {
      ok = 0; /* background job */
      break;
    }
    if (ch == '<' && p[1] == '<') {
      ok = 0; /* heredoc */
      break;
    }
    if (sep || ch == ' ' || ch == '\t' || ch == '<') {
      if (!seg_push_word(s, word, &wl, &in_word)) {
        ok = 0;
        break;
      }
      if (sep) {
        if (s->n > 0) {
          if (!seg_safe(s)) {
            ok = 0;
            break;
          }
          nseg++;
        } else if (ch == '|' || ch == '&') {
          ok = 0; /* "| x" or "a && && b" */
          break;
        }
        s->n = 0;
        if (ch == 0)
          break;
        if ((ch == '|' && p[1] == '|') || ch == '&')
          p++;
      }
      continue;
    }
    if (wl + 1 >= sizeof(word)) {
      ok = 0;
      break;
    }
    word[wl++] = ch;
    in_word = 1;
  }
  free(s);
  return ok && nseg > 0;
}