Fix Bash approval analysis gaps - #1753
Conversation
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
aa6b5b0 to
31d58b5
Compare
| Bash("echo safe | netclaw daemon stop"), | ||
| Approvals.None, | ||
| ExpectedApproval.Require(["echo", "netclaw daemon stop"])), | ||
| ExpectedApproval.Deny("hard_deny_self_destructive")), |
There was a problem hiding this comment.
This case now blocks the complete pipeline. Netclaw checks each pipeline command, so a safe first command cannot hide a blocked command.
| Bash("bash -lc \"git push\""), | ||
| Approvals.None, | ||
| ExpectedApproval.Require(["bash"])), | ||
| ExpectedApproval.Require(["git push"])), |
There was a problem hiding this comment.
Netclaw now checks the text inside bash -lc. The prompt and saved approvals now use git push, not the Bash wrapper.
| Bash("bash -lc \"git push\""), | ||
| Approvals.PersistentAnywhere("bash"), | ||
| ExpectedApproval.Allow(ToolAllowReason.StoredApproval, 1, "persistent:bash")), | ||
| ExpectedApproval.Require(["git push"])), |
There was a problem hiding this comment.
A saved bash approval no longer covers every command inside Bash. Netclaw now asks for approval for git push.
| Bash("echo $(git push)"), | ||
| Approvals.None, | ||
| ExpectedApproval.Allow(ToolAllowReason.ApprovalExemptShellCandidates)), | ||
| ExpectedApproval.Require([], isMessy: true, approvalChecks: 0)), |
There was a problem hiding this comment.
This command no longer runs without approval. Netclaw cannot safely identify all actions inside $(), so it asks for approval for this run.
| Bash("cat \"$FILE\""), | ||
| Approvals.None, | ||
| ExpectedApproval.Allow(ToolAllowReason.SafeVerbInTrustedScope)), | ||
| ExpectedApproval.Require([], isMessy: true, approvalChecks: 0)), |
There was a problem hiding this comment.
The cat command is safe, but the file path is unknown. Netclaw now asks for approval instead of assuming a safe path.
| Bash("git status & git push"), | ||
| Approvals.None, | ||
| ExpectedApproval.Allow(ToolAllowReason.SafeVerbInTrustedScope)), | ||
| ExpectedApproval.Require([], isMessy: true, approvalChecks: 0)), |
There was a problem hiding this comment.
The syntax parser does not return every command after &. Netclaw asks for approval and does not create a broad saved approval.
| Bash("echo done"), | ||
| Approvals.None, | ||
| ExpectedApproval.Require(["echo"], isMessy: true, approvalChecks: 0)), | ||
| ExpectedApproval.Allow(ToolAllowReason.ApprovalExemptShellCandidates)), |
There was a problem hiding this comment.
The syntax parser shows that done is plain text here. Netclaw now treats this as a safe echo command.
| Bash("cat <(git push)"), | ||
| Approvals.PersistentAnywhere("cat", "git push"), | ||
| ExpectedApproval.Require([], approvalChecks: 0)), | ||
| ExpectedApproval.Require([], isMessy: true, approvalChecks: 0)), |
There was a problem hiding this comment.
This shell form is not fully supported. Netclaw asks for approval for this run, even when saved approvals cover both named commands.
Aaronontheweb
added
security
Summary
0.2.0-alpha.Security results
bashapproval no longer authorizes a nestedgit push.git pushapproval now matches the nested command.Scope
This pull request does not change the runtime shell selection.
It does not add PowerShell support.
Pull request #1733 retains that work.
Tests
dotnet test Netclaw.slnxdotnet slopwatch analyzepwsh ./scripts/Add-FileHeaders.ps1 -Verifygit diff --checkCloses #1693
Closes #1751