WHC/Hermit
1
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases 12 Wiki Activity
Files
1b0f14533a0dbcf5deee593374883f3e01064688
Hermit/src/permissions.c
T
WHCandCursor acd6f1d998 fix: keep task completion, cancel, pause, and undo honest 
Pending earlier-revision jobs no longer skip completion repair; late
cancels preserve real exits; begin clears pause; partial undo keeps
snapshots; permissions and worktree failure paths are hardened.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-28 22:09:47 +08:00

527 lines
15 KiB
C
Raw Blame History

/* Persistent "always allow" rules: <ws>/.agent/permissions.json
* {"tools": ["write_file"], "shell_prefixes": ["make", "git status"]} */
#ifndef _DEFAULT_SOURCE
#define _DEFAULT_SOURCE
#endif
#include <ctype.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <strings.h>
#include "cJSON.h"
#include "cst_perms.h"
#include "cst_util.h"
#include "os_compat.h"
#define PERM_MAX 64
struct cst_perms {
char path[OS_PATH_MAX];
char tools[PERM_MAX][64];
int ntools;
char prefixes[PERM_MAX][128];
int nprefixes;
};
static void load(cst_perms_t *p) {
FILE *fp = fopen(p->path, "rb");
if (!fp)
return;
cst_buf_t b = {0};
char tmp[4096];
size_t n;
while ((n = fread(tmp, 1, sizeof(tmp), fp)) > 0 && b.len < 256 * 1024)
cst_buf_append(&b, tmp, n);
fclose(fp);
cJSON *root = b.buf ? cJSON_Parse(b.buf + cst_bom_len(b.buf, b.len)) : NULL;
cst_buf_free(&b);
const cJSON *it = NULL;
cJSON_ArrayForEach(it, cJSON_GetObjectItemCaseSensitive(root, "tools")) {
if (cJSON_IsString(it) && p->ntools < PERM_MAX)
snprintf(p->tools[p->ntools++], 64, "%.63s", it->valuestring);
}
cJSON_ArrayForEach(it,
cJSON_GetObjectItemCaseSensitive(root, "shell_prefixes")) {
if (cJSON_IsString(it) && p->nprefixes < PERM_MAX && it->valuestring[0])
snprintf(p->prefixes[p->nprefixes++], 128, "%.127s", it->valuestring);
}
cJSON_Delete(root);
}
cst_perms_t *cst_perms_open(const char *workspace) {
cst_perms_t *p = calloc(1, sizeof(*p));
if (!p)
return NULL;
if (workspace)
snprintf(p->path, sizeof(p->path), "%s/.agent/permissions.json",
workspace);
load(p);
return p;
}
void cst_perms_close(cst_perms_t *p) { free(p); }
static int save(const cst_perms_t *p) {
if (!p->path[0])
return -1;
char dir[OS_PATH_MAX];
snprintf(dir, sizeof(dir), "%s", p->path);
char *sl = strrchr(dir, '/');
if (sl) {
*sl = 0;
os_mkdir_p(dir, 0755);
}
cJSON *root = cJSON_CreateObject();
cJSON *t = cJSON_AddArrayToObject(root, "tools");
for (int i = 0; i < p->ntools; i++)
cJSON_AddItemToArray(t, cJSON_CreateString(p->tools[i]));
cJSON *s = cJSON_AddArrayToObject(root, "shell_prefixes");
for (int i = 0; i < p->nprefixes; i++)
cJSON_AddItemToArray(s, cJSON_CreateString(p->prefixes[i]));
char *txt = cJSON_Print(root);
cJSON_Delete(root);
if (!txt)
return -1;
char tmp[OS_PATH_MAX + 8];
if (snprintf(tmp, sizeof(tmp), "%s.tmp", p->path) >= (int)sizeof(tmp)) {
free(txt);
return -1;
}
FILE *fp = fopen(tmp, "wb");
int rc = -1;
if (fp) {
rc = fputs(txt, fp) >= 0 && fputs("\n", fp) >= 0 ? 0 : -1;
if (fclose(fp) != 0)
rc = -1;
if (rc == 0)
rc = os_rename_replace(tmp, p->path);
if (rc != 0)
remove(tmp);
}
free(txt);
return rc;
}
/* Commands chained or substituted can hide anything behind an allowed
* prefix, so they always ask. */
static int has_shell_meta(const char *cmd) {
return strpbrk(cmd, ";&|`$<>\n\r(){}") != NULL;
}
int cst_perms_shell_allowed(const cst_perms_t *p, const char *cmd) {
if (!p || !cmd)
return 0;
while (*cmd == ' ' || *cmd == '\t')
cmd++;
if (!*cmd || has_shell_meta(cmd))
return 0;
for (int i = 0; i < p->nprefixes; i++) {
size_t n = strlen(p->prefixes[i]);
if (strncmp(cmd, p->prefixes[i], n) == 0 &&
(cmd[n] == 0 || cmd[n] == ' ' || cmd[n] == '\t'))
return 1;
}
return 0;
}
int cst_perms_tool_allowed(const cst_perms_t *p, const char *tool) {
if (!p || !tool)
return 0;
for (int i = 0; i < p->ntools; i++) {
if (strcmp(p->tools[i], tool) == 0)
return 1;
}
return 0;
}
int cst_perms_allow_tool(cst_perms_t *p, const char *tool) {
if (!p || !tool || !tool[0])
return -1;
if (cst_perms_tool_allowed(p, tool))
return 0;
if (p->ntools >= PERM_MAX)
return -1;
snprintf(p->tools[p->ntools++], 64, "%.63s", tool);
return save(p);
}
int cst_perms_allow_prefix(cst_perms_t *p, const char *prefix) {
if (!p || !prefix)
return -1;
while (*prefix == ' ')
prefix++;
if (!prefix[0] || has_shell_meta(prefix))
return -1;
for (int i = 0; i < p->nprefixes; i++) {
if (strcmp(p->prefixes[i], prefix) == 0)
return 0;
}
if (p->nprefixes >= PERM_MAX)
return -1;
snprintf(p->prefixes[p->nprefixes++], 128, "%.127s", prefix);
return save(p);
}
int cst_perms_reset(cst_perms_t *p) {
if (!p)
return -1;
p->ntools = p->nprefixes = 0;
return save(p);
}
char *cst_perms_describe(const cst_perms_t *p) {
cst_buf_t b = {0};
cst_buf_puts(&b, "always allowed tools: ");
if (!p || !p->ntools)
cst_buf_puts(&b, "(none)");
for (int i = 0; p && i < p->ntools; i++)
cst_buf_printf(&b, "%s%s", i ? ", " : "", p->tools[i]);
cst_buf_puts(&b, "\nallowed shell prefixes: ");
if (!p || !p->nprefixes)
cst_buf_puts(&b, "(none)");
for (int i = 0; p && i < p->nprefixes; i++)
cst_buf_printf(&b, "%s`%s`", i ? ", " : "", p->prefixes[i]);
cst_buf_puts(&b, "\n");
return cst_buf_steal(&b);
}
/* "git status -s" → "git status"; "make -j8" → "make"; "./run.sh x" →
* "./run.sh". Tools with sub-commands keep two words. */
void cst_perms_suggest_prefix(const char *cmd, char *out, size_t out_sz) {
static const char *const two_word[] = {"git", "npm", "pnpm", "yarn",
"cargo", "go", "docker", "kubectl",
"pip", "python", "python3", "uv",
"bun", "dotnet", "mvn", "gradle"};
/* A prefix rule for these would allow almost anything. */
static const char *const never[] = {
"sudo", "su", "doas", "rm", "dd", "mkfs", "shutdown", "reboot",
"sh", "bash", "zsh", "fish", "dash", "env", "xargs", "eval",
"exec", "nohup", "time", "nice", "timeout", "find", "chmod", "chown",
"curl", "wget", "ssh", "scp", "node", "perl", "ruby", "busybox"};
out[0] = 0;
if (!cmd)
return;
while (*cmd == ' ' || *cmd == '\t')
cmd++;
size_t w1 = strcspn(cmd, " \t");
if (w1 == 0)
return;
for (size_t i = 0; i < sizeof(never) / sizeof(never[0]); i++) {
if (strlen(never[i]) == w1 && strncmp(cmd, never[i], w1) == 0)
return;
}
size_t take = w1;
for (size_t i = 0; i < sizeof(two_word) / sizeof(two_word[0]); i++) {
if (strlen(two_word[i]) == w1 && strncmp(cmd, two_word[i], w1) == 0) {
const char *r = cmd + w1;
while (*r == ' ' || *r == '\t')
r++;
size_t w2 = strcspn(r, " \t");
if (w2 == 0 || r[0] == '-')
return; /* "python3 -c ..." / bare "git": no safe rule */
take = (size_t)(r - cmd) + w2;
break;
}
}
if (take >= out_sz)
take = out_sz - 1;
memcpy(out, cmd, take);
out[take] = 0;
if (has_shell_meta(out))
out[0] = 0;
}
/* --- network commands ------------------------------------------------------ */
static int net_word_eq(const char *w, size_t n, const char *name) {
size_t k = strlen(name);
if (n == k + 4 && strncasecmp(w + k, ".exe", 4) == 0)
n = k;
return n == k && strncasecmp(w, name, k) == 0;
}
int cst_shell_uses_network(const char *cmd) {
static const char *const TOOLS[] = {
"curl", "wget", "ssh", "scp", "sftp", "rsync",
"ftp", "tftp", "telnet", "nc", "ncat", "netcat",
"socat", "npx", "invoke-webrequest", "iwr", "invoke-restmethod",
"irm", "start-bitstransfer", "bitsadmin", "certutil"};
/* tool + sub-command that downloads or uploads */
static const char *const PAIRS[][2] = {
{"git", "clone"}, {"git", "fetch"}, {"git", "pull"},
{"git", "push"}, {"git", "ls-remote"}, {"git", "submodule"},
{"npm", "install"}, {"npm", "i"}, {"npm", "ci"},
{"npm", "update"}, {"npm", "publish"}, {"npm", "exec"},
{"pnpm", "install"}, {"pnpm", "add"}, {"pnpm", "dlx"},
{"yarn", "install"}, {"yarn", "add"}, {"bun", "install"},
{"bun", "add"}, {"pip", "install"}, {"pip", "download"},
{"pip3", "install"}, {"uv", "pip"}, {"uv", "add"},
{"uv", "sync"}, {"cargo", "install"}, {"cargo", "fetch"},
{"cargo", "update"}, {"cargo", "publish"}, {"go", "get"},
{"go", "install"}, {"go", "mod"}, {"gem", "install"},
{"dotnet", "restore"}, {"dotnet", "add"}, {"winget", "install"},
{"choco", "install"}, {"scoop", "install"}, {"apt", "install"},
{"apt-get", "install"}, {"pkg", "install"}, {"brew", "install"}};
if (!cmd)
return 0;
const char *prev = NULL;
size_t prev_n = 0;
for (const char *p = cmd; *p;) {
while (*p && strchr(" \t\r\n;|&()<>`'\"$=", *p))
p++;
const char *w = p;
while (*p && !strchr(" \t\r\n;|&()<>`'\"$=", *p))
p++;
size_t n = (size_t)(p - w);
if (!n)
break;
/* /usr/bin/curl, C:\tools\curl.exe */
for (size_t i = n; i > 0; i--) {
if (w[i - 1] == '/' || w[i - 1] == '\\') {
n -= i;
w += i;
break;
}
}
for (size_t i = 0; i < sizeof(TOOLS) / sizeof(TOOLS[0]); i++)
if (net_word_eq(w, n, TOOLS[i]))
return 1;
for (size_t i = 0; prev && i < sizeof(PAIRS) / sizeof(PAIRS[0]); i++)
if (net_word_eq(prev, prev_n, PAIRS[i][0]) &&
net_word_eq(w, n, PAIRS[i][1]))
return 1;
if (n && w[0] != '-') {
prev = w;
prev_n = n;
}
}
return 0;
}
/* --- read-only command rules ---------------------------------------------- */
#define SAFE_MAX_WORDS 64
#define SAFE_WORD_MAX 256
typedef struct {
char w[SAFE_MAX_WORDS][SAFE_WORD_MAX];
int n;
} seg_t;
static int word_in(const char *w, const char *const *list, size_t n) {
for (size_t i = 0; i < n; i++)
if (strcmp(w, list[i]) == 0)
return 1;
return 0;
}
static int has_prefix(const char *s, const char *p) {
return strncmp(s, p, strlen(p)) == 0;
}
static int git_safe(const seg_t *s) {
static const char *const SUB[] = {"status", "diff", "log", "show", "branch"};
static const char *const BRANCH_OK[] = {
"-a", "-r", "-v", "-vv", "-l",
"--list", "--all", "--remotes", "--verbose", "--show-current",
"--merged", "--no-merged", "--contains", "--no-contains",
"--no-color", "--color"};
int i = 1;
while (i < s->n && strcmp(s->w[i], "--no-pager") == 0)
i++;
if (i >= s->n || !word_in(s->w[i], SUB, sizeof(SUB) / sizeof(SUB[0])))
return 0;
int branch = strcmp(s->w[i], "branch") == 0, listing = 0;
for (int j = i + 1; j < s->n; j++) {
const char *a = s->w[j];
if (has_prefix(a, "--output") || has_prefix(a, "--ext-diff") ||
has_prefix(a, "--textconv"))
return 0;
if (!branch)
continue;
if (a[0] == '-') {
if (!word_in(a, BRANCH_OK, sizeof(BRANCH_OK) / sizeof(BRANCH_OK[0])) &&
!has_prefix(a, "--sort=") && !has_prefix(a, "--format="))
return 0;
if (strcmp(a, "-l") == 0 || strcmp(a, "--list") == 0 ||
strcmp(a, "-a") == 0 || strcmp(a, "-r") == 0 ||
strcmp(a, "--all") == 0 || strcmp(a, "--remotes") == 0 ||
has_prefix(a, "--contains") || has_prefix(a, "--merged") ||
has_prefix(a, "--no-merged") || has_prefix(a, "--no-contains"))
listing = 1;
} else if (!listing) {
return 0; /* "git branch NAME" creates a branch */
}
}
return 1;
}
static int seg_safe(const seg_t *s) {
static const char *const CMDS[] = {
"ls", "cat", "head", "tail", "wc", "grep", "rg",
"find", "git", "pwd", "echo", "which", "file", "stat",
"du", "tree", "true", "false"};
static const char *const FIND_BAD[] = {"-exec", "-execdir", "-delete",
"-ok", "-okdir", "-fprint",
"-fprint0", "-fprintf", "-fls"};
if (s->n == 0)
return 0;
const char *c = s->w[0];
if (!word_in(c, CMDS, sizeof(CMDS) / sizeof(CMDS[0])))
return 0;
if (strcmp(c, "git") == 0)
return git_safe(s);
for (int i = 1; i < s->n; i++) {
const char *a = s->w[i];
if (strcmp(c, "find") == 0 &&
word_in(a, FIND_BAD, sizeof(FIND_BAD) / sizeof(FIND_BAD[0])))
return 0;
if (strcmp(c, "rg") == 0 && has_prefix(a, "--pre"))
return 0;
if (strcmp(c, "tree") == 0 && strcmp(a, "-o") == 0)
return 0;
if (strcmp(c, "file") == 0 && (strcmp(a, "-C") == 0 ||
strcmp(a, "--compile") == 0))
return 0;
}
return 1;
}
/* Accepts "2>&1", ">&2", ">/dev/null", "2>/dev/null", "&>/dev/null".
* *pp points at '>'; on success it is advanced past the target. */
static int redirect_ok(const char **pp) {
const char *p = *pp + 1;
if (*p == '>')
return 0; /* append */
while (*p == ' ' || *p == '\t')
p++;
if (*p == '&' && (p[1] == '1' || p[1] == '2')) {
p += 2;
} else if (strncmp(p, "/dev/null", 9) == 0) {
p += 9;
} else {
return 0;
}
if (*p && !strchr(" \t;|&", *p))
return 0;
*pp = p;
return 1;
}
static int seg_push_word(seg_t *s, char *word, size_t *wl, int *in_word) {
if (!*in_word)
return 1;
if (s->n >= SAFE_MAX_WORDS)
return 0;
word[*wl] = 0;
memcpy(s->w[s->n++], word, *wl + 1);
*wl = 0;
*in_word = 0;
return 1;
}
int cst_shell_is_safe(const char *cmd) {
if (!cmd)
return 0;
if (strstr(cmd, "$(") || strchr(cmd, '`') || strstr(cmd, "<(") ||
strstr(cmd, ">(") || strchr(cmd, '\n') || strchr(cmd, '\r'))
return 0;
seg_t *s = calloc(1, sizeof(*s));
if (!s)
return 0;
char word[SAFE_WORD_MAX];
size_t wl = 0;
int in_word = 0, nseg = 0, ok = 1;
char q = 0;
for (const char *p = cmd;; p++) {
char ch = *p;
if (q) {
if (ch == 0) {
ok = 0;
break;
}
if (ch == q) {
q = 0;
continue;
}
if (q == '"' && ch == '\\' && p[1]) {
ch = *++p;
}
if (wl + 1 >= sizeof(word)) {
ok = 0;
break;
}
word[wl++] = ch;
continue;
}
if (ch == '\'' || ch == '"') {
q = ch;
in_word = 1;
continue;
}
if (ch == '\\' && p[1]) {
if (wl + 1 >= sizeof(word)) {
ok = 0;
break;
}
word[wl++] = *++p;
in_word = 1;
continue;
}
int sep = ch == 0 || ch == ';' || ch == '|' ||
(ch == '&' && p[1] == '&');
if (ch == '>' || (ch == '&' && p[1] == '>') ||
((ch >= '0' && ch <= '9') && !in_word && p[1] == '>')) {
if (ch != '>')
p++;
if (!redirect_ok(&p)) {
ok = 0;
break;
}
p--;
continue;
}
if (ch == '&' && !sep) {
ok = 0; /* background job */
break;
}
if (ch == '<' && p[1] == '<') {
ok = 0; /* heredoc */
break;
}
if (sep || ch == ' ' || ch == '\t' || ch == '<') {
if (!seg_push_word(s, word, &wl, &in_word)) {
ok = 0;
break;
}
if (sep) {
if (s->n > 0) {
if (!seg_safe(s)) {
ok = 0;
break;
}
nseg++;
} else if (ch == '|' || ch == '&') {
ok = 0; /* "| x" or "a && && b" */
break;
}
s->n = 0;
if (ch == 0)
break;
if ((ch == '|' && p[1] == '|') || ch == '&')
p++;
}
continue;
}
if (wl + 1 >= sizeof(word)) {
ok = 0;
break;
}
word[wl++] = ch;
in_word = 1;
}
free(s);
return ok && nseg > 0;
}
Reference in New Issue View Git Blame Copy Permalink