safety-net

1import type { Register } from 'claude-code'
2
3export type Verdict = { level: 'deny' | 'ask'; why: string }
4
5type Rule = [level: Verdict['level'], pattern: RegExp, why: string]
6
7// ponytail: regex screening, not a shell parser; obfuscated commands (eval, base64, aliases) get through. It's a net, not a sandbox.
8const BASH_RULES: Rule[] = [
9  ['deny', /:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/, 'fork bomb'],
10  ['deny', /\bmkfs(\.\w+)?\s/, 'formats a filesystem'],
11  ['deny', /\bdd\b[^;&|]*\bof=\/dev\/(r?disk|sd|nvme|hd|mmcblk)/, 'writes raw bytes over a disk'],
12  ['deny', />\s*\/dev\/(r?disk|sd|nvme|hd)\w*/, 'overwrites a disk device'],
13  ['deny', /\bchmod\s+(-\S+\s+)*-\w*R\w*\s+(0?777|a\+rwx)\s+\/(\s|$)/, 'makes the whole filesystem world-writable'],
14  ['ask', /\bgit\s+push\b[^;&|]*\s(--force(?!-with-lease)|-f)\b/, 'force-push rewrites remote history'],
15  ['ask', /\bgit\s+reset\s+[^;&|]*--hard\b/, 'git reset --hard discards uncommitted work'],
16  ['ask', /\bgit\s+clean\s+[^;&|]*-\w*f/, 'git clean deletes untracked files'],
17  ['ask', /\bgit\s+(checkout\s+--\s+\.|restore\s+(-\S+\s+)*\.)(\s|$)/, 'discards all uncommitted changes'],
18  ['ask', /\bgit\s+(branch\s+[^;&|]*-D\b|stash\s+(drop|clear)\b)/, 'deletes branches or stashes for good'],
19  ['ask', /\b(curl|wget)\b[^;&]*\|\s*(sudo\s+)?(ba|z|da|k)?sh\b/, 'pipes a downloaded script straight into a shell'],
20  ['ask', /\b(drop\s+(table|database|schema)|truncate\s+table)\b/i, 'drops or truncates database objects'],
21  ['ask', /\bdelete\s+from\s+[\w."`]+\s*(;|"|'|$)/i, 'DELETE without a WHERE clause'],
22  ['ask', /\bterraform\s+(destroy\b|apply\b[^;&|]*-auto-approve)/, 'changes infrastructure without a plan review'],
23  ['ask', /\b(kubectl\s+delete|helm\s+uninstall|docker\s+(system|volume)\s+prune|gh\s+repo\s+delete)\b/, 'deletes cluster, container or repository resources'],
24  ['ask', /\baws\s+s3\s+(rm|rb)\b[^;&|]*--(recursive|force)/, 'bulk-deletes S3 data'],
25  ['ask', /\b(npm|pnpm|yarn)\s+publish\b|\bcargo\s+publish\b|\btwine\s+upload\b|\bgem\s+push\b/, 'publishes a package publicly'],
26  ['ask', /(^|[;&|(]\s*)sudo\s/, 'runs as root'],
27]
28
29const ROOTISH = /^["']?(\/|\/\*|~|~\/|~\/\*|\$\{?HOME\}?\/?\*?|\*|\.|\.\/|\.\/\*|\.\.|\.\.\/|\/(usr|etc|bin|sbin|var|opt|home|Users|System|Library|Applications)\/?)["']?$/
30
31// rm needs real argument handling: `rm -rf node_modules` is routine, `rm -rf ~` is not.
32function judgeRm(command: string): Verdict | undefined {
33  for (const segment of command.split(/[;&|\n]+/)) {
34    const words = segment.trim().split(/\s+/)
35    if (words[0] === 'sudo') words.shift()
36    if (words[0] !== 'rm') continue
37    const flags = words.filter(w => w.startsWith('-'))
38    const targets = words.slice(1).filter(w => !w.startsWith('-'))
39    const isRecursive = flags.some(f => f === '--recursive' || /^-[a-zA-Z]*[rR]/.test(f))
40    if (!isRecursive) continue
41    if (targets.some(t => ROOTISH.test(t))) return { level: 'deny', why: 'recursive delete of a root, home or whole-project directory' }
42    if (targets.some(t => /^["']?\$/.test(t))) return { level: 'ask', why: 'recursive delete of a path built from a variable (empty variable = wrong directory)' }
43  }
44  return undefined
45}
46
47export function judgeBash(command: string): Verdict | undefined {
48  const rm = judgeRm(command)
49  if (rm) return rm
50  const hit = BASH_RULES.find(([, pattern]) => pattern.test(command))
51  return hit && { level: hit[0], why: hit[2] }
52}
53
54const PATH_RULES: [RegExp, string][] = [
55  [/(^|\/)\.env(\.(?!example$|sample$|template$|dist$)[\w.-]+)?$/, 'an environment/secrets file'],
56  [/\.(pem|key|p12|pfx|keystore|jks)$/, 'a key or certificate file'],
57  [/(^|\/)(id_(rsa|ed25519|ecdsa|dsa)(\.pub)?|\.ssh\/|\.gnupg\/|\.aws\/credentials|\.netrc|\.npmrc|\.pypirc)/, 'a credentials file'],
58  [/(^|\/)\.git\//, "git's internal database"],
59  [/(^|\/)\.(zshrc|bashrc|bash_profile|profile|zprofile)$/, 'your shell startup file'],
60]
61
62export function judgePath(path: string): Verdict | undefined {
63  const hit = PATH_RULES.find(([pattern]) => pattern.test(path))
64  return hit && { level: 'ask', why: `edits ${hit[1]} (${path})` }
65}
66
67export function judge(tool: string, input: unknown): Verdict | undefined {
68  const args = (input ?? {}) as Record<string, unknown>
69  if (tool === 'Bash') return judgeBash(String(args.command ?? ''))
70  const path = args.file_path ?? args.notebook_path
71  if (['Edit', 'Write', 'NotebookEdit', 'MultiEdit'].includes(tool) && typeof path === 'string') return judgePath(path)
72  return undefined
73}
74
75export const register: Register = (on, options) => {
76  on('tool.check', async ($, e, next) => {
77    const verdict = judge(String(e.tool), e.input)
78    if (!verdict) return next(e)
79    const reason = `safety-net: ${verdict.why}.`
80    if (verdict.level === 'deny' || options.strict === true) {
81      return { decision: 'deny', reason: `${reason} Blocked; if this is really intended, ask the user to run it themselves.` }
82    }
83    const below = await next(e)
84    return below.decision === 'deny' ? below : { decision: 'ask', reason }
85  }).catch(() => ({ decision: 'ask', reason: 'safety-net could not check this call; please review it.' }))
86}
87