import { detectPolicyInlineEval } from "../infra/command-analysis/policy.js";

import {

type ExecApprovalsFile,

type ExecAllowlistEntry,

type ExecAsk,

type ExecSecurity,

type SystemRunApprovalPlan,

parsePreparedSystemRunPayload,

type PreparedRunExecPolicy,

} from "../infra/system-run-approval-context.js";

import { formatExecCommand, resolveSystemRunCommandRequest } from "../infra/system-run-command.js";

import {

extractShellCommandFromArgv,

formatExecCommand,

resolveSystemRunCommandRequest,

} from "../infra/system-run-command.js";

import { normalizeNullableString } from "../shared/string-coerce.js";

import { resolveSafeTimeoutDelayMs } from "../utils/timer-delay.js";

import type { ExecuteNodeHostCommandParams } from "./bash-tools.exec-host-node.types.js";

: 0;

}

type NodePolicyCommandEval = {

command: string;

cwd: string | undefined;

allowlistEval: ReturnType<typeof evaluateShellAllowlist>;

};

function hasExactCommandDurableApproval(params: {

allowlist: readonly ExecAllowlistEntry[];

commandText: string;

}): boolean {

const normalizedCommand = params.commandText.trim();

if (!normalizedCommand) {

return false;

}

const commandPattern = `=command:${crypto

.createHash("sha256")

.update(normalizedCommand)

.digest("hex")

.slice(0, 16)}`;

return params.allowlist.some(

(entry) =>

entry.source === "allow-always" &&

(entry.pattern === commandPattern ||

(typeof entry.commandText === "string" && entry.commandText.trim() === normalizedCommand)),

);

}

function extractPreparedNodeShellPayload(argv: readonly string[]): string | null {

const extracted = extractShellCommandFromArgv([...argv]);

if (extracted) {

return extracted;

}

const executable = argv[0]?.split(/[\\/]/).pop()?.toLowerCase();

const flag = argv[1]?.trim();

const payload = argv[2]?.trim();

if (argv.length === 3 && executable === "sh" && flag === "-lc" && payload) {

return payload;

}

return null;

}

export function shouldSkipNodeApprovalPrepare(params: {

hostSecurity: ExecSecurity;

hostAsk: ExecAsk;

hostSecurity: ExecSecurity;

hostAsk: ExecAsk;

}): Promise<NodeApprovalAnalysis> {

const approvalCommand = params.prepared.rawCommand;

const approvalCwd = params.prepared.cwd ?? params.request.workdir;

const baseAllowlistEval = evaluateShellAllowlist({

command: params.request.command,

command: approvalCommand,

allowlist: [],

safeBins: new Set(),

cwd: params.request.workdir,

cwd: approvalCwd,

env: params.request.env,

platform: params.target.platform,

trustedSafeBinDirs: params.request.trustedSafeBinDirs,

});

const bindingCommandEvals: NodePolicyCommandEval[] = [

{

command: approvalCommand,

cwd: approvalCwd,

allowlistEval: baseAllowlistEval,

},

];

const addCommandEval = (

entries: NodePolicyCommandEval[],

command: string | null | undefined,

cwd: string | undefined,

) => {

const normalizedCommand = command?.trim();

if (!normalizedCommand) {

return;

}

if (entries.some((entry) => entry.command.trim() === normalizedCommand && entry.cwd === cwd)) {

return;

}

entries.push({

command: normalizedCommand,

cwd,

allowlistEval: evaluateShellAllowlist({

command: normalizedCommand,

allowlist: [],

safeBins: new Set(),

cwd,

env: params.request.env,

platform: params.target.platform,

trustedSafeBinDirs: params.request.trustedSafeBinDirs,

}),

});

};

const preparedCommand = resolveSystemRunCommandRequest({

command: params.prepared.argv,

rawCommand: params.prepared.rawCommand,

});

const preparedShellPayload =

extractPreparedNodeShellPayload(params.prepared.argv) ??

(preparedCommand.ok ? preparedCommand.shellPayload : null);

addCommandEval(bindingCommandEvals, preparedShellPayload, approvalCwd);

const autoReviewBindingCommand = preparedShellPayload?.trim() || approvalCommand;

const autoReviewBindingEval =

bindingCommandEvals.find(

(entry) =>

entry.command.trim() === autoReviewBindingCommand.trim() && entry.cwd === approvalCwd,

)?.allowlistEval ?? baseAllowlistEval;

const policyCommandEvals = [...bindingCommandEvals];

addCommandEval(policyCommandEvals, params.prepared.plan.commandPreview, approvalCwd);

addCommandEval(policyCommandEvals, params.request.command, params.request.workdir);

let analysisOk = baseAllowlistEval.analysisOk;

let allowlistSatisfied = false;

let durableApprovalSatisfied = false;

let nodeApprovalsFileKnown = false;

const inlineEvalHit =

params.request.strictInlineEval === true

? detectPolicyInlineEval(baseAllowlistEval.segments)

? (policyCommandEvals

.map((entry) => detectPolicyInlineEval(entry.allowlistEval.segments))

.find((hit) => hit !== null) ?? null)

: null;

if (inlineEvalHit) {

params.request.warnings.push(

)}.`,

);

}

const suppressionCommandEvals =

preparedShellPayload && preparedShellPayload.trim().length > 0

? policyCommandEvals.filter(

(entry) => entry.command.trim() !== approvalCommand.trim() || entry.cwd !== approvalCwd,

)

: policyCommandEvals;

const requiresSecurityAuditSuppressionApproval =

commandRequiresSecurityAuditSuppressionApproval({

command: params.request.command,

cwd: params.request.workdir,

env: params.request.env,

segments: baseAllowlistEval.segments,

}) && !(params.hostSecurity === "full" && params.hostAsk === "off");

suppressionCommandEvals.some((entry) =>

commandRequiresSecurityAuditSuppressionApproval({

command: entry.command,

cwd: entry.cwd,

env: params.request.env,

segments: entry.allowlistEval.segments,

}),

) && !(params.hostSecurity === "full" && params.hostAsk === "off");

if (

(params.hostAsk === "always" ||

params.hostSecurity === "allowlist" ||

nodeApprovalsFileKnown = true;

const resolved = resolveExecApprovalsFromFile({

file: approvalsFile as ExecApprovalsFile,

agentId: params.request.agentId,

agentId: params.prepared.agentId,

overrides: { security: "full" },

});

// Allowlist-only precheck; safe bins are node-local and may diverge.

const allowlistEval = evaluateShellAllowlist({

command: params.request.command,

allowlist: resolved.allowlist,

safeBins: new Set(),

cwd: params.request.workdir,

env: params.request.env,

platform: params.target.platform,

trustedSafeBinDirs: params.request.trustedSafeBinDirs,

});

durableApprovalSatisfied = hasDurableExecApproval({

analysisOk: allowlistEval.analysisOk,

segmentAllowlistEntries: allowlistEval.segmentAllowlistEntries,

allowlist: resolved.allowlist,

commandText: params.prepared.rawCommand,

// POSIX node transport wraps commands, so mirror node policy by

// accepting either the prepared wrapper or its semantic inner command.

const allowlistEvals = bindingCommandEvals.map((entry) => {

const allowlistEval = evaluateShellAllowlist({

command: entry.command,

allowlist: resolved.allowlist,

safeBins: new Set(),

cwd: entry.cwd,

env: params.request.env,

platform: params.target.platform,

trustedSafeBinDirs: params.request.trustedSafeBinDirs,

});

return {

command: entry.command,

allowlistEligible:

!preparedShellPayload || entry.command.trim() === preparedShellPayload.trim(),

exactDurableApprovalSatisfied: hasExactCommandDurableApproval({

allowlist: resolved.allowlist,

commandText: entry.command,

}),

allowlistEval,

durableApprovalSatisfied: hasDurableExecApproval({

analysisOk: allowlistEval.analysisOk,

segmentAllowlistEntries: allowlistEval.segmentAllowlistEntries,

allowlist: resolved.allowlist,

commandText: entry.command,

}),

};

});

allowlistSatisfied = allowlistEval.allowlistSatisfied;

analysisOk = allowlistEval.analysisOk;

durableApprovalSatisfied = allowlistEvals.some(

(entry) =>

entry.durableApprovalSatisfied &&

(entry.allowlistEligible || entry.exactDurableApprovalSatisfied),

);

allowlistSatisfied = allowlistEvals.some(

(entry) => entry.allowlistEligible && entry.allowlistEval.allowlistSatisfied,

);

analysisOk = allowlistEvals.some((entry) => entry.allowlistEval.analysisOk);

}

} catch {

// Fall back to requiring approval if node approvals cannot be fetched.

inlineEvalHit,

requiresSecurityAuditSuppressionApproval,

autoReviewArgv:

baseAllowlistEval.segments.length === 1 &&

(baseAllowlistEval.segments[0]?.raw === undefined ||

baseAllowlistEval.segments[0].raw.trim() === params.request.command.trim())

? baseAllowlistEval.segments[0].argv

autoReviewBindingEval.segments.length === 1 &&

(autoReviewBindingEval.segments[0]?.raw === undefined ||

autoReviewBindingEval.segments[0].raw.trim() === autoReviewBindingCommand.trim())

? autoReviewBindingEval.segments[0].argv

: undefined,

};

}