M3.1: action classes and the fast path
Every execution tool call, the driver's and a helper's, gets a verdict from code before it runs (P3, P4, D6). - nisse_core.actions, nisse-core's first code: Action and Verdict, and reading shell commands statically, segment by segment (cd, wrappers, sh -c). What can't be read that way is unknown; a line is as bad as its worst command. - nisse_dev.loop.actions, the rule table: reading, checks and tests are harmless; workspace edits, local git and installs on the build VM are contained; pushing, other hosts, uploads, publishing, the forge's own tools, deleting outside the workspace and wrecking the VM are dangerous; changing branches by hand is refused (the harness owns branches) with a pointer to the milestone tools. - A dangerous call isn't run. The item waits on the operator with a question rendered from the action, and `allow` lets exactly that action run once. A helper can't ask, so it is refused and told to hand back. Unknown actions run, logged, until the classifier (M3.2). - Every verdict is an action_verdict event, which no model sees, and an oplog line; `details` shows the counts and every action not simply run. - The property walk gains dangerous_only_when_allowed (checked against a mutant that doesn't use the allow up); the slice e2e checks every call was judged and none needed an allow. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE
This commit is contained in:
dongarandClaude Opus 5.5 committed
1 parent
d0fde2f136
commit
ea4376eaa1
16 files changed
+1400
-17
No files matched your search
@@ -0,0 +1,359 @@
|
||||
"""nisse-dev's fast-path rules (architecture D6, P4): what its tool calls
|
||||
do, judged by code before anything runs.
|
||||
|
||||
- **Harmless:** reading the repository, running builds, tests and linters on
|
||||
the build VM, querying.
|
||||
- **Contained:** editing the workspace, local commits, installing on the build
|
||||
VM and otherwise changing it (D3).
|
||||
- **Dangerous:** anything reaching beyond the item's repository or build VM
|
||||
(pushing, other hosts, uploads, publishing, the forge's own tools), deleting
|
||||
outside the workspace, or wrecking the build VM itself. Discussed with the
|
||||
operator first.
|
||||
- **Refused:** changing branches by hand. The harness owns branches (D4), so
|
||||
the model is told to use its milestone tools instead.
|
||||
- **Unknown:** everything else, for the classifier (M3.2); until then it runs,
|
||||
and is logged.
|
||||
|
||||
A rule never makes a command less severe than its worst part; what can't be
|
||||
read statically is unknown (nisse_core.actions).
|
||||
"""
|
||||
|
||||
import posixpath
|
||||
from collections.abc import Callable
|
||||
|
||||
from nisse_core.actions import (
|
||||
CONTAINED,
|
||||
DANGEROUS,
|
||||
HARMLESS,
|
||||
REFUSED,
|
||||
UNKNOWN,
|
||||
Action,
|
||||
Command,
|
||||
Verdict,
|
||||
classify_shell,
|
||||
inside,
|
||||
resolve,
|
||||
worst,
|
||||
)
|
||||
|
||||
READING_TOOLS = frozenset({"read_file", "list_dir"})
|
||||
|
||||
_READ = frozenset(
|
||||
{
|
||||
"ls", "cat", "head", "tail", "wc", "grep", "egrep", "fgrep", "rg", "echo",
|
||||
"printf", "pwd", "which", "file", "stat", "diff", "sort", "uniq", "tree",
|
||||
"du", "df", "true", "false", "test", "[", "awk", "cut", "tr", "jq",
|
||||
"date", "uname", "whoami", "id", "basename", "dirname", "realpath",
|
||||
"readlink", "less", "more", "nl", "column", "xxd", "od", "sha256sum",
|
||||
"md5sum", "printenv", "type", "hostname", "ps", "free", "uptime",
|
||||
"nproc", "seq", "sleep", "cmp", "comm", "env",
|
||||
}
|
||||
) # fmt: skip
|
||||
_CHECKS = frozenset(
|
||||
{
|
||||
"pytest", "py.test", "ruff", "mypy", "pyright", "black", "isort",
|
||||
"flake8", "pylint", "tox", "nox", "coverage", "eslint", "prettier",
|
||||
"tsc", "jest", "vitest", "shellcheck", "gofmt",
|
||||
}
|
||||
) # fmt: skip
|
||||
_CHANGES = frozenset(
|
||||
{
|
||||
"mkdir", "touch", "cp", "mv", "chmod", "chown", "ln", "tee", "truncate",
|
||||
"patch", "tar", "unzip", "gzip", "gunzip", "zip", "kill", "pkill",
|
||||
"systemctl", "service", "crontab", "useradd", "groupadd",
|
||||
}
|
||||
) # fmt: skip
|
||||
_DELETES = frozenset({"rm", "rmdir", "unlink", "shred"})
|
||||
_OTHER_HOSTS = frozenset(
|
||||
{"ssh", "scp", "sftp", "telnet", "nc", "ncat", "netcat", "ftp", "mosh"}
|
||||
)
|
||||
_FORGE_TOOLS = frozenset({"gh", "tea", "hub", "glab", "twine"})
|
||||
_WRECKS_THE_VM = frozenset(
|
||||
{
|
||||
"dd", "fdisk", "parted", "shutdown", "reboot", "halt", "poweroff",
|
||||
"iptables", "ip6tables", "nft", "ufw", "mount", "umount",
|
||||
}
|
||||
) # fmt: skip
|
||||
_PACKAGE_MANAGERS = frozenset({"apt", "apt-get", "dnf", "yum", "apk", "zypper"})
|
||||
|
||||
_TEST_TARGETS = frozenset({"", "test", "tests", "check", "lint", "build", "all", "fmt"})
|
||||
_NPM_CHECKS = frozenset({"test", "lint", "build", "check", "typecheck", "format"})
|
||||
|
||||
_BRANCHES = (
|
||||
"the harness owns branches: work stays on the milestone's branch, and "
|
||||
"start_milestone and finish_milestone make and publish it"
|
||||
)
|
||||
|
||||
|
||||
def classify(action: Action, root: str) -> Verdict:
|
||||
"""The fast path's verdict on one execution tool call in the workspace
|
||||
at ``root``."""
|
||||
if action.tool in READING_TOOLS:
|
||||
return Verdict(HARMLESS, "read", "reads the workspace")
|
||||
if action.tool == "write_file":
|
||||
# Writes outside the workspace are refused by the workspace itself.
|
||||
return Verdict(CONTAINED, "workspace-edit", "edits the workspace")
|
||||
if action.tool == "run_command":
|
||||
line = str(action.arguments.get("command", ""))
|
||||
return classify_shell(line, root, lambda c: judge(c, root))
|
||||
return Verdict(UNKNOWN, "no-rule", f"no rule for {action.tool}")
|
||||
|
||||
|
||||
def judge(command: Command, root: str) -> Verdict:
|
||||
"""One simple command, and what its redirections write."""
|
||||
verdicts = [_program(command, root)]
|
||||
for target in command.redirects:
|
||||
if target not in ("/dev/null", "/dev/stdout", "/dev/stderr"):
|
||||
verdicts.append(Verdict(CONTAINED, "writes-file", f"writes {target}"))
|
||||
return worst(verdicts)
|
||||
|
||||
|
||||
def _program(command: Command, root: str) -> Verdict:
|
||||
argv = list(command.argv)
|
||||
name = argv[0]
|
||||
if "/" in name:
|
||||
if name.startswith(("/usr/", "/bin/", "/sbin/")):
|
||||
name = posixpath.basename(name) # /usr/bin/git is git
|
||||
else:
|
||||
return Verdict(UNKNOWN, "script", f"runs {name}")
|
||||
args = argv[1:]
|
||||
if name.startswith("mkfs"):
|
||||
name = "dd"
|
||||
if name in _RULES:
|
||||
return _RULES[name](args, command, root)
|
||||
if name in _READ:
|
||||
return Verdict(HARMLESS, "read-only", f"{name} only reads")
|
||||
if name in _CHECKS:
|
||||
return Verdict(HARMLESS, "checks", f"{name} checks the code")
|
||||
if name in _CHANGES:
|
||||
return Verdict(CONTAINED, "changes-vm", f"{name} changes files on the build VM")
|
||||
if name in _DELETES:
|
||||
return _deletes(name, args, command, root)
|
||||
if name in _OTHER_HOSTS:
|
||||
return Verdict(DANGEROUS, "other-host", f"{name} reaches another host")
|
||||
if name in _FORGE_TOOLS:
|
||||
return Verdict(
|
||||
DANGEROUS, "forge-tool", f"{name} acts on a forge or index directly"
|
||||
)
|
||||
if name in _WRECKS_THE_VM:
|
||||
return Verdict(
|
||||
DANGEROUS, "wrecks-vm", f"{name} can break the build VM or its network"
|
||||
)
|
||||
if name in _PACKAGE_MANAGERS:
|
||||
return Verdict(CONTAINED, "install", "installs on the build VM")
|
||||
return Verdict(UNKNOWN, "no-rule", f"no rule for {name}")
|
||||
|
||||
|
||||
def _deletes(name: str, args: list[str], command: Command, root: str) -> Verdict:
|
||||
targets = [a for a in args if not a.startswith("-")]
|
||||
outside = [t for t in targets if not inside(resolve(t, command.cwd), root)]
|
||||
if outside:
|
||||
return Verdict(
|
||||
DANGEROUS,
|
||||
"deletes-outside",
|
||||
f"{name} deletes outside the workspace: {', '.join(outside)}",
|
||||
)
|
||||
return Verdict(CONTAINED, "deletes-inside", f"{name} deletes in the workspace")
|
||||
|
||||
|
||||
def _git(args: list[str], command: Command, root: str) -> Verdict:
|
||||
while args and args[0] in ("-C", "-c"):
|
||||
args = args[2:] # global options and their values
|
||||
sub, rest = (args[0], args[1:]) if args else ("", [])
|
||||
flags = [a for a in rest if a.startswith("-")]
|
||||
names = [a for a in rest if not a.startswith("-")]
|
||||
if sub in ("push", "send-email", "request-pull"):
|
||||
return Verdict(DANGEROUS, "git-push", "pushes beyond the workspace")
|
||||
if sub == "remote" and names and names[0] in (
|
||||
"add", "set-url", "remove", "rm", "rename",
|
||||
): # fmt: skip
|
||||
return Verdict(DANGEROUS, "git-remote", "changes where the clone pushes")
|
||||
if sub in ("switch", "merge", "rebase", "pull") or (
|
||||
sub == "worktree" and names[:1] == ["add"]
|
||||
):
|
||||
return Verdict(REFUSED, "branches", _BRANCHES)
|
||||
if sub == "checkout":
|
||||
if "--" in rest or (names and all(n == "." for n in names)):
|
||||
return Verdict(CONTAINED, "git-local", "restores files in the workspace")
|
||||
return Verdict(REFUSED, "branches", _BRANCHES + "; git restore puts files back")
|
||||
if sub == "branch":
|
||||
listing = {"-a", "-r", "-v", "-vv", "--list", "-l", "--show-current"}
|
||||
if not names and set(flags) <= listing:
|
||||
return Verdict(HARMLESS, "git-read", "lists branches")
|
||||
if flags and set(flags) & {"--contains", "--merged", "--no-merged"}:
|
||||
return Verdict(HARMLESS, "git-read", "lists branches")
|
||||
return Verdict(REFUSED, "branches", _BRANCHES)
|
||||
if sub in (
|
||||
"status", "diff", "log", "show", "blame", "rev-parse", "ls-files",
|
||||
"grep", "describe", "shortlog", "reflog", "rev-list", "cat-file",
|
||||
"ls-tree", "whatchanged", "version", "help",
|
||||
): # fmt: skip
|
||||
return Verdict(HARMLESS, "git-read", f"git {sub} only reads")
|
||||
if sub == "config" and (not names or set(flags) & {"--get", "--list", "-l"}):
|
||||
return Verdict(HARMLESS, "git-read", "reads git configuration")
|
||||
if sub == "remote" and not names:
|
||||
return Verdict(HARMLESS, "git-read", "lists remotes")
|
||||
if sub == "tag" and not names:
|
||||
return Verdict(HARMLESS, "git-read", "lists tags")
|
||||
if sub == "stash" and names[:1] in (["list"], ["show"]):
|
||||
return Verdict(HARMLESS, "git-read", "lists stashes")
|
||||
if sub in (
|
||||
"add", "commit", "restore", "rm", "mv", "reset", "clean", "stash",
|
||||
"apply", "tag", "init", "fetch", "cherry-pick", "revert", "notes", "am",
|
||||
"config",
|
||||
): # fmt: skip
|
||||
return Verdict(CONTAINED, "git-local", f"git {sub} changes the local clone")
|
||||
return Verdict(UNKNOWN, "no-rule", f"no rule for git {sub}")
|
||||
|
||||
|
||||
def _python(args: list[str], command: Command, root: str) -> Verdict:
|
||||
if args[:1] in (["--version"], ["-V"]):
|
||||
return Verdict(HARMLESS, "read-only", "prints the version")
|
||||
if args[:1] == ["-m"] and len(args) > 1:
|
||||
return judge(Command(tuple(args[1:]), command.cwd), root)
|
||||
return Verdict(UNKNOWN, "script", "runs Python code")
|
||||
|
||||
|
||||
def _runner(args: list[str], command: Command, root: str) -> Verdict:
|
||||
"""uv, poetry and friends: `run X` is X; installing changes the VM."""
|
||||
sub = args[0] if args else ""
|
||||
if sub == "run" and len(args) > 1:
|
||||
rest = args[1:]
|
||||
while rest and rest[0].startswith("-"):
|
||||
rest = rest[1:]
|
||||
if rest:
|
||||
return judge(Command(tuple(rest), command.cwd), root)
|
||||
if sub == "publish":
|
||||
return Verdict(DANGEROUS, "publish", "publishes a package")
|
||||
if sub in ("pip", "add", "remove", "sync", "lock", "venv", "install", "update"):
|
||||
return Verdict(CONTAINED, "install", "installs on the build VM")
|
||||
if sub in ("--version", "version", "tree", "show"):
|
||||
return Verdict(HARMLESS, "read-only", "only reads")
|
||||
return Verdict(UNKNOWN, "no-rule", f"no rule for that {sub}")
|
||||
|
||||
|
||||
def _pip(args: list[str], command: Command, root: str) -> Verdict:
|
||||
sub = args[0] if args else ""
|
||||
if sub in ("install", "uninstall", "download"):
|
||||
return Verdict(CONTAINED, "install", "installs on the build VM")
|
||||
if sub in ("list", "show", "freeze", "check", "--version"):
|
||||
return Verdict(HARMLESS, "read-only", "only reads")
|
||||
return Verdict(UNKNOWN, "no-rule", f"no rule for pip {sub}")
|
||||
|
||||
|
||||
def _npm(args: list[str], command: Command, root: str) -> Verdict:
|
||||
sub = args[0] if args else ""
|
||||
if sub == "publish":
|
||||
return Verdict(DANGEROUS, "publish", "publishes a package")
|
||||
if sub in ("test", "t") or (sub == "run" and args[1:2] and args[1] in _NPM_CHECKS):
|
||||
return Verdict(HARMLESS, "checks", "runs the project's checks")
|
||||
if sub in ("install", "i", "ci", "add", "remove", "uninstall", "update"):
|
||||
return Verdict(CONTAINED, "install", "installs on the build VM")
|
||||
if sub in ("ls", "list", "view", "outdated", "--version"):
|
||||
return Verdict(HARMLESS, "read-only", "only reads")
|
||||
return Verdict(UNKNOWN, "no-rule", f"no rule for {sub or 'that'}")
|
||||
|
||||
|
||||
def _make(args: list[str], command: Command, root: str) -> Verdict:
|
||||
targets = [a for a in args if not a.startswith("-") and "=" not in a]
|
||||
if all(t in _TEST_TARGETS for t in targets):
|
||||
return Verdict(HARMLESS, "checks", "builds or checks the code")
|
||||
return Verdict(UNKNOWN, "no-rule", f"make {' '.join(targets)}")
|
||||
|
||||
|
||||
def _cargo_go(args: list[str], command: Command, root: str) -> Verdict:
|
||||
sub = args[0] if args else ""
|
||||
if sub == "publish":
|
||||
return Verdict(DANGEROUS, "publish", "publishes a package")
|
||||
if sub in ("test", "build", "check", "clippy", "fmt", "vet", "doc", "version"):
|
||||
return Verdict(HARMLESS, "checks", "builds or checks the code")
|
||||
if sub in ("add", "fetch", "get", "mod", "install", "update"):
|
||||
return Verdict(CONTAINED, "install", "installs on the build VM")
|
||||
return Verdict(UNKNOWN, "no-rule", f"no rule for {sub or 'that'}")
|
||||
|
||||
|
||||
_UPLOADS = (
|
||||
"-T", "--upload-file", "-d", "--data", "--data-raw", "--data-binary",
|
||||
"--data-urlencode", "-F", "--form", "--json", "--post-data", "--post-file",
|
||||
"--body-data", "--body-file",
|
||||
) # fmt: skip
|
||||
|
||||
|
||||
def _fetches(args: list[str], command: Command, root: str) -> Verdict:
|
||||
"""curl and wget: sending data out is dangerous, fetching is not."""
|
||||
for i, arg in enumerate(args):
|
||||
if arg.startswith(_UPLOADS) or arg.startswith("--method"):
|
||||
return Verdict(DANGEROUS, "upload", "sends data to another host")
|
||||
method = args[i + 1].upper() if i + 1 < len(args) else ""
|
||||
if arg in ("-X", "--request") and method not in ("GET", "HEAD"):
|
||||
return Verdict(DANGEROUS, "upload", "sends data to another host")
|
||||
return Verdict(CONTAINED, "download", "downloads to the build VM")
|
||||
|
||||
|
||||
def _docker(args: list[str], command: Command, root: str) -> Verdict:
|
||||
sub = args[0] if args else ""
|
||||
if sub in ("push", "login"):
|
||||
return Verdict(DANGEROUS, "publish", f"docker {sub} reaches a registry")
|
||||
if sub in ("ps", "images", "inspect", "logs", "version", "info"):
|
||||
return Verdict(HARMLESS, "read-only", "only reads")
|
||||
if sub in ("build", "pull"):
|
||||
return Verdict(CONTAINED, "changes-vm", "builds on the build VM")
|
||||
return Verdict(UNKNOWN, "no-rule", f"no rule for docker {sub}")
|
||||
|
||||
|
||||
def _rsync(args: list[str], command: Command, root: str) -> Verdict:
|
||||
if any(":" in a and not a.startswith("-") for a in args):
|
||||
return Verdict(DANGEROUS, "other-host", "rsync reaches another host")
|
||||
return Verdict(CONTAINED, "changes-vm", "copies files on the build VM")
|
||||
|
||||
|
||||
def _sed(args: list[str], command: Command, root: str) -> Verdict:
|
||||
if any(a.startswith("-i") or a == "--in-place" for a in args):
|
||||
return Verdict(CONTAINED, "changes-vm", "edits files in place")
|
||||
return Verdict(HARMLESS, "read-only", "sed only reads")
|
||||
|
||||
|
||||
def _find(args: list[str], command: Command, root: str) -> Verdict:
|
||||
if set(args) & {"-delete", "-exec", "-execdir", "-ok", "-okdir"}:
|
||||
return Verdict(UNKNOWN, "no-rule", "find runs or deletes things")
|
||||
return Verdict(HARMLESS, "read-only", "find only reads")
|
||||
|
||||
|
||||
def _interpreter(args: list[str], command: Command, root: str) -> Verdict:
|
||||
if args[:1] in (["--version"], ["-v"], ["-V"]):
|
||||
return Verdict(HARMLESS, "read-only", "prints the version")
|
||||
return Verdict(UNKNOWN, "script", "runs a program")
|
||||
|
||||
|
||||
def _dangerous_vm(args: list[str], command: Command, root: str) -> Verdict:
|
||||
return Verdict(DANGEROUS, "wrecks-vm", "can break the build VM")
|
||||
|
||||
|
||||
Rule = Callable[[list[str], Command, str], Verdict]
|
||||
|
||||
_RULES: dict[str, Rule] = {
|
||||
"git": _git,
|
||||
"python": _python,
|
||||
"python3": _python,
|
||||
"uv": _runner,
|
||||
"poetry": _runner,
|
||||
"pipenv": _runner,
|
||||
"pip": _pip,
|
||||
"pip3": _pip,
|
||||
"npm": _npm,
|
||||
"yarn": _npm,
|
||||
"pnpm": _npm,
|
||||
"make": _make,
|
||||
"cargo": _cargo_go,
|
||||
"go": _cargo_go,
|
||||
"curl": _fetches,
|
||||
"wget": _fetches,
|
||||
"docker": _docker,
|
||||
"rsync": _rsync,
|
||||
"sed": _sed,
|
||||
"find": _find,
|
||||
"node": _interpreter,
|
||||
"ruby": _interpreter,
|
||||
"perl": _interpreter,
|
||||
"dd": _dangerous_vm,
|
||||
}
|
||||
Reference in new issue
Block a user