1package tools
2
3import (
4 "fmt"
5 "path/filepath"
6 "strings"
7)
8
9// PermissionSet is the local-runtime permission contract for a packaged .zut agent.
10type PermissionSet struct {
11 FS struct {
12 Read []string `json:"read"`
13 Write []string `json:"write"`
14 } `json:"fs"`
15 Bash struct {
16 Mode string `json:"mode"`
17 Allow []string `json:"allow"`
18 } `json:"bash"`
19 Net struct {
20 Allow []string `json:"allow"`
21 } `json:"net"`
22 Env struct {
23 Read []string `json:"read"`
24 } `json:"env"`
25}
26
27// Expand resolves manifest variables into absolute local paths.
28func (p PermissionSet) Expand(workspace, agentData string) PermissionSet {
29 expand := func(s string) string {
30 s = strings.ReplaceAll(s, "${workspace}", workspace)
31 s = strings.ReplaceAll(s, "${agent_data}", agentData)
32 if !filepath.IsAbs(s) && s != "" {
33 s = filepath.Join(workspace, s)
34 }
35 return s
36 }
37 // Clone the slices before expanding them. PermissionSet is copied by value,
38 // but slices otherwise still alias the manifest and repeated expansion (for
39 // example after /cd) would mutate the original declaration.
40 p.FS.Read = append([]string(nil), p.FS.Read...)
41 p.FS.Write = append([]string(nil), p.FS.Write...)
42 for i, v := range p.FS.Read {
43 p.FS.Read[i] = expand(v)
44 }
45 for i, v := range p.FS.Write {
46 p.FS.Write[i] = expand(v)
47 }
48 return p
49}
50
51func (s *Sandbox) SetPermissions(p *PermissionSet) {
52 if s == nil {
53 return
54 }
55 s.Permissions = p
56}
57
58func (s *Sandbox) CheckReadPath(path string) error {
59 if err := s.CheckPath(path); err != nil {
60 return err
61 }
62 if s == nil || s.Permissions == nil {
63 return nil
64 }
65 if len(s.Permissions.FS.Read) == 0 {
66 return fmt.Errorf("permission denied: this agent has no filesystem read permission")
67 }
68 return checkScopedPath("read", path, s.Permissions.FS.Read)
69}
70
71func (s *Sandbox) CheckWritePath(path string) error {
72 if err := s.CheckPath(path); err != nil {
73 return err
74 }
75 if s == nil || s.Permissions == nil {
76 return nil
77 }
78 if len(s.Permissions.FS.Write) == 0 {
79 return fmt.Errorf("permission denied: this agent has no filesystem write permission")
80 }
81 return checkScopedPath("write", path, s.Permissions.FS.Write)
82}
83
84func checkScopedPath(op, path string, scopes []string) error {
85 target, err := canonicalOrParent(path)
86 if err != nil {
87 return fmt.Errorf("permission path: %w", err)
88 }
89 for _, scope := range scopes {
90 root, err := canonicalOrParent(scope)
91 if err != nil {
92 continue
93 }
94 if isUnder(root, target) {
95 return nil
96 }
97 }
98 return fmt.Errorf("permission denied: %s %q is outside declared scopes", op, path)
99}
100
101func (s *Sandbox) CheckBashPermission(cmd string) error {
102 if s == nil || s.Permissions == nil {
103 return nil
104 }
105 mode := strings.ToLower(strings.TrimSpace(s.Permissions.Bash.Mode))
106 if mode == "" {
107 mode = "none"
108 }
109 switch mode {
110 case "none":
111 return fmt.Errorf("permission denied: this agent has no bash permission")
112 case "ask":
113 // The local runtime obtains explicit consent for this capability at
114 // every launch. Unlike durable consent, ask mode is never cached.
115 return nil
116 case "allowlist":
117 if strings.ContainsAny(cmd, "`\n\r<>") || strings.Contains(cmd, "$(") {
118 return fmt.Errorf("permission denied: bash allowlist does not permit substitution or redirection")
119 }
120 names := commandNames(cmd)
121 if len(names) == 0 {
122 return fmt.Errorf("permission denied: empty command")
123 }
124 allowed := map[string]bool{}
125 for _, name := range s.Permissions.Bash.Allow {
126 allowed[filepath.Base(strings.TrimSpace(name))] = true
127 }
128 for _, name := range names {
129 if !allowed[name] {
130 return fmt.Errorf("permission denied: bash command %q is not in allowlist", name)
131 }
132 }
133 return nil
134 default:
135 return fmt.Errorf("permission denied: unsupported bash mode %q", mode)
136 }
137}
138
139func commandNames(cmd string) []string {
140 cmd = strings.NewReplacer("&&", ";", "||", ";", "|", ";").Replace(cmd)
141 parts := strings.Split(cmd, ";")
142 var out []string
143 for _, part := range parts {
144 name := firstCommandName(part)
145 if name == "" || name == "cd" {
146 continue
147 }
148 out = append(out, name)
149 }
150 return out
151}
152
153func firstCommandName(cmd string) string {
154 cmd = strings.TrimSpace(cmd)
155 if cmd == "" {
156 return ""
157 }
158 fields := strings.Fields(cmd)
159 if len(fields) == 0 {
160 return ""
161 }
162 name := fields[0]
163 for strings.Contains(name, "=") && len(fields) > 1 {
164 fields = fields[1:]
165 name = fields[0]
166 }
167 return filepath.Base(strings.Trim(name, "'\""))
168}