ڎj}dZddlZddlmZmZmZddlZddlmZddl m Z m Z ddl m Z mZd d lmZmZmZmZmZd d lmZmZdd lmZdd lmZGdde ZdS)zThe bash tool in agentscope.N)AsyncGeneratorAnyList)BashCommandParser)ToolBaseToolMiddlewareBase)DEFAULT_DANGEROUS_FILESDEFAULT_DANGEROUS_DIRECTORIES)PermissionContextPermissionDecisionPermissionBehaviorPermissionModePermissionRule) TextBlockToolResultState) ToolChunk) BackendBasec TeZdZUdZdZeed< dZeed< dddddd dd d d d ddddgdZe ee fed<dZ e ed<dZ e ed<dZe ed<dZe ed<dZe ed<eedddfdeedeedeejezdzdeedzdedzd df fd! Zd"e ee fd e fd#Zd"e ee fd$ed efd%Zd&edzd"e ee fd e fd'Zd"e ee fd ed(fd)Zded eefd*Z ded edzfd+Z!d,ed e fd-Z" d1deded/e#d e$e%dffd0Z&xZ'S)2BashzThe bash tool.nameuf Executes a bash command and returns its output. The working directory persists between commands, but shell state does not. The shell environment is initialized from the user's profile (bash or zsh). IMPORTANT: Avoid using this tool to run `find`, `grep`, `cat`, `head`, `tail`, `sed`, `awk`, or `echo` commands, unless explicitly instructed or after you have verified that a dedicated tool cannot accomplish your task. Instead, use the appropriate dedicated tool as this will provide a much better experience for the user: - File search: Use Glob (NOT find or ls) - Content search: Use Grep (NOT grep or rg) - Read files: Use Read (NOT cat/head/tail) - Edit files: Use Edit (NOT sed/awk) - Write files: Use Write (NOT echo >/cat <> tool_inputcK|dd}|s|jS|j|rdS|j|S)aDecide whether this specific bash invocation is read-only. Inspects the command and returns ``True`` for known-safe read-only commands (e.g. ``ls``, ``cat``, ``grep``, ``git status``). The static :attr:`is_read_only` class attribute is ``False`` because Bash can execute arbitrary commands; this method overrides that with a per-invocation answer. r$F)getr*r9check_injection_riskis_read_only_command)r>rBr$s r@check_read_onlyzBash.check_read_onlysc..B// %$ $   1 1' : : 5 55g>>>rAcontextc>K|dd}|sttjdSj|}|r ttjd|ddSj|rttjd d Sj |}|r ttjd |d dSj |j }|r ttjd|ddS |}|r5d |}ttjd|ddS|d{V} | r!ttjd| dddSjt jt jfvrhd} |r,|dnd} | | vrfdj|D} | r@t-fd| Dr$ttjd| dd| d Sttjd|S)uCheck permissions for bash command execution. This method implements Bash-specific permission checks: 0. Injection risk check (bypass-immune safety ASK if command contains dynamic expansion like ``$(...)`` or ``<(...)``) 1. Read-only command check — auto-ALLOW in **every mode** (including DEFAULT) for known-safe read-only commands (``ls``, ``pwd``, ``git status``, ``cat``, etc.). This is the static counterpart to :meth:`check_read_only`. 2. Dangerous command pattern check (bypass-immune safety ASK) 3. Sed in-place constraint check (bypass-immune safety ASK) 4. Dangerous path check for config files (bypass-immune safety ASK) 5. Dangerous removal path check for system dirs (bypass-immune safety ASK) 6. ACCEPT_EDITS auto-allow for ``mkdir``/``touch``/``rm``/ ``rmdir``/``mv``/``cp``/``sed`` — only when **every** target path resolves inside a working directory 7. PASSTHROUGH (engine continues with rule matching) "Bypass-immune" decisions set :attr:`PermissionDecision.bypass_immune` so they cannot be silenced by allow rules in DEFAULT mode. In BYPASS mode all bypass-immune ASKs are intentionally skipped — see :attr:`PermissionMode.BYPASS`. Args: tool_input (`dict[str, Any]`): The tool input containing "command" key context (`PermissionContext`): The permission context with mode and rules Returns: `PermissionDecision`: ALLOW for safe operations, ASK for dangerous operations, PASSTHROUGH to let Engine continue with rule matching r$rDz Empty command)behaviormessagezPermission required: zSSafety check: command contains dynamic expansion that cannot be statically analyzedT)rKrLdecision_reason bypass_immunez(Permission granted for read-only commandzRead-only command is allowed)rKrLrMz9Permission required: Command contains dangerous pattern: z0Safety check: dangerous command pattern detectedz9Safety check: sed in-place modification of dangerous filez, z?Permission required: Bash command operates on sensitive paths: z9Safety check: dangerous file or directory in bash commandNz'Dangerous removal operation detected: 'z' This command would remove a critical system directory. This requires explicit approval and cannot be auto-allowed by permission rules.z7Safety check: dangerous removal of critical system path>cpmvrmsedmkdirrmdirtouchrcg|]\}}|SrW).0_cmdpaths r@ z*Bash.check_permissions..js,   "d   rAc3DK|]}|VdS)N)_path_in_allowed_working_path)rXrZrIr>s r@ z)Bash.check_permissions..vsG((66tWEE((((((rAzPermission granted for 'z@' command (filesystem command, all targets in working directory)zFilesystem command 'zI' is auto-allowed because all target paths are within a working directoryzExecute bash command: )rErr PASSTHROUGHr9rFASKrGALLOWcheck_dangerous_commandcheck_sed_constraintsr."_extract_dangerous_paths_from_bashjoin_check_dangerous_removal_pathmoder ACCEPT_EDITSDONT_ASKstripsplitextract_file_pathsall) r>rBrIr$injection_reasondangerous_pattern sed_errordangerous_paths paths_str removal_pathfilesystem_commands base_command target_pathss ` ` r@check_permissionszBash.check_permissionssX..B// %+7'  ,AA'JJ  %+/B0@BB!?"     1 1' : : %+1B > !-EEgNN  %+/0-00!"  %;;       %+/; ;;!$"  AA'JJ   /22I%+/0$-00!,"  "??HHHHHHHH  %+/? ???!'"    $ <  '  #   ### /6mmooE %%''**2 222  &*&7&J&J''     C((((( ,(((%%.!3!9!.<!.!.!.:<:::    "'36W66    rA rule_contentcK|dS|dd}|dr:|dd}||dzp||kSdtd t fd }||sH|}|d d }|d d}|d d}||vSd}d}|}|d |}|d |}d} | D]} || d| z}|dd}||d }||d }|dr5|dd} | } tj | |rdS t tj ||S#tj $r|dd|vcYSwxYw)a$Match Bash command using regex-based wildcard matching. Implements wildcard matching with escape sequences: - Supports \* for literal asterisk and \\ for literal backslash - Special optimization: "git *" matches both "git" and "git add" - Prefix pattern (e.g., "git:*"): matches commands starting with "git " - Wildcard pattern: converts to regex with proper escape handling - Substring pattern: exact substring matching - If rule_content is None, matches all invocations (tool-name-level rule) Args: rule_content: The command pattern to match, or None to match all tool_input: Must contain a "command" key with the command string Returns: True if pattern matches the command NTr$rD:* patternr3cd}|t|kr8||dkr|dz }n||dkrdS|dz }|t|k8dS)z0Check if pattern contains unescaped * wildcards.r\r*TrF)len)r}is r@ has_wildcardsz&Bash.match_rule..has_wildcardssiAc'll""1:%%FAAQZ3&&4FA c'll""5rAz\\z BACKSLASH\*rrzESCAPED_STARzESCAPED_BACKSLASHz .^$+?{}[]|()z.*) rEendswithrj startswithstrboolreplacerstripre fullmatcherror) r>rxrBr$prefixrr} ESCAPED_STARESCAPED_BACKSLASH special_charschar base_patterns r@ match_rulezBash.match_rulesP0  4..B//   & & I!#2#&,,..F%%fsl33Hw&7H H 3 4    }\** &#Goof.ABBGooeS11Goo&94@@Gg% %. 7//&*;<<//%66( ! 9 9DoodD4K88GG//#t,,//,66//"3U;;   D ! ! "3B3rBr$prefixesrulesrs r@generate_suggestionszBash.generate_suggestionss$..B// I$== >    I  F LL$$*/5&      rAcg}|j|}|D]/\}}||r||0|S)aExtract dangerous paths from a bash command using tree-sitter. Checks for dangerous paths in: - File-manipulating commands (rm, mv, cp, chmod, chown, sed, touch) - Output redirections (>, >>) Args: command (`str`): The bash command string Returns: `list[str]`: List of dangerous paths found in the command )r9rl_is_dangerous_pathr)r>r$rq file_paths _cmd_namerZs r@rdz'Bash._extract_dangerous_paths_from_bashse$&99'BB ) - -OIt&&t,, -&&t,,,rAcK|}|sdS |jjt |d}|j|j|}n#t$r|g}YnwxYw|D]}|}|s+|d}|dvr8d}|t|kro||} | dr|dz }6| d} | | d{Vr| cS|dz }|t|kodS)a>Check if a rm/rmdir command targets a critical system path. Detects commands like `rm -rf /`, `rm -rf /usr`, `rmdir ~` that would destroy critical system directories. Unlike _is_dangerous_path (which checks against a configurable list of sensitive config files), this checks against a fixed set of system-level paths that must never be removed regardless of user configuration. Dangerous paths are: - Root directory (/) - Home directory (~) - Wildcard alone (*) or as dir/* (removes everything) - Direct children of root (/usr, /etc, /tmp, /var, etc.) Args: command (`str`): The bash command string Returns: `str | None`: The dangerous path if found, None otherwise Nutf8r)rQrTr-z'") rjrkr9parserparsebytessplit_compound_command root_node Exceptionrr_is_dangerous_removal_path) r>r$tokenstree subcommandssubcmd subcmd_tokensbasertokrZs r@rfz"Bash._check_dangerous_removal_path8s.&&(( 4 $$+11%2H2HIID+BBKK $ $ $")KKK $"  F"LLNN0022M   #D?**Ac-((((#A&>>#&&FAyy''88>>>>>>>> KKKQc-((((tsA A<< B  B rZcK|dvrdS|ds|drdS|j|d{V}|jd{V}|j||}|jdd{V}||krdS|j|}||krdS|j||krdSdS) aCheck if a path is a critical system directory that must not be removed. All path resolution is performed via the backend so that the check operates on the **backend environment's** ``$HOME`` / ``cwd`` / path semantics, not the host process's. Args: path (`str`): The path to check (may be relative, absolute, or contain ~) Returns: `bool`: True if removing this path would be catastrophic )rz./*/Tz/*rN)r0~F)rr6 expandusergetcwdabspathdirname)r>rZexpanded backend_cwdabs_pathhomeparents r@rzBash._is_dangerous_removal_pathus4$ $ $ $4 ==   $--"6"6 4 11$77777777 M0022222222 =(({(CC]--c22222222 t  4 &&x00 v  4 =  ( (F 2 24urArDr%cKt|d}|dz } tjdkrdd|g}ndd|g}|j||j|d {V}|jd d d d}|j d d d d} |j dkrC|j dkr8d|d|} tt| gtjdWVd S|} | r | r| dz } | | z } t| dkr | d ddz} |sjd|d} |r| d|z } | r| d| z } t| dkr | d ddz} tt| gtjdWVd Stt| gtjdWVd S#t$$rN} d|dt'| } tt| gtjdWVYd } ~ d Sd } ~ wwxYw)adExecute the bash and return the output. Args: command: The bash command to execute. description: Optional description of what the command does. timeout: Timeout in milliseconds (default: 120000, max: 600000). Yields: ToolChunk: The tool execution result with stdout/stderr content. r g@@ntcmdz/cz/bin/shz-c)r0r%Nzutf-8r)errorsz  s timed outzCommand timed out after zms: )textT)contentstateis_lasti0uz ... (output truncated)zCommand failed: z Stdout: z Stderr: z Error: )minr;rr6 exec_shellr=stdoutdecoderstderr exit_coderrrERRORrokRUNNINGrr)r>r$rr% timeout_ms timeout_sec shell_commandresultrr error_msgoutput error_resultes r@callz Bash.calls$&))  6) W w$!&g 6 !*D' : =33I#4F])) *gfd## ])) *gfd## 2%%&-<*G*GHzHHwHH &I6667)/  F !#dNF& 6{{U""*DD99;; ='=== ; $:&$:$::L; $:&$:$::L|$$u,,$VeV,/II! &L999:)/  &F3334)1     E7EESVVEEI" 2223%+           s&C/G( B,G(8.G(( I2AH;;I)rDr)(__name__ __module__ __qualname____doc__rr__annotations__rr(dictrr)rr*r+r,r-r r r:r;PathLikerr rr8rHrrrwrrrdrfrintrrr __classcell__)r?s@r@rrsD#/CKCCCH2!= !"5"!    2K7$$L$sCx.<FDL$ %%%%"d"""#t###&=+H-17;&* (2(2c(2 $Cy(22;s# #d * (2 ,-4 (2 t# (2 (2(2(2(2(2(2T?cN? ????2~ cN~ #~   ~ ~ ~ ~ @_<Dj_<cN_<  _<_<_<_rsO"" ,,,,,,,,,, ++++++0000000021111111!!!!!!!!!!!!| | | | | 8| | | | | rA