refactor(shell): share transparent command peeling

Author: TheGreatAxios

src/permission/classify-security.test.ts

@@ -780,6 +780,16 @@ describe("content inside an env -S payload never receives a weaker tier than it
     );
     expect(rule?.name).toBe("dependency-install");
   });
+
+  test("trailing env terminal flags remain arguments to split payloads", () => {
+    expect(
+      autoShellRuleForCall(shellCall(`env -S "rm -rf /" --version`))?.name,
+    ).toBe("recursive-rm");
+    expect(
+      autoShellRuleForCall(shellCall(`env -S "npm install left-pad" --help`))
+        ?.name,
+    ).toBe("dependency-install");
+  });
 });
 
 describe("upload-shaped network shell commands force ask in auto mode", () => {

src/shell/run-shell-authz.test.ts

@@ -388,6 +388,35 @@ describe("authz hard-deny peels glued and trailing env -S forms", () => {
     );
   });
 
+  test("split payloads own trailing terminal-looking arguments", () => {
+    const cases = [
+      {
+        command: `env -S "find ." --help`,
+        subject: "find . --help",
+        reason: openEnded,
+      },
+      {
+        command: `env -S "rm -rf /" --version`,
+        subject: "rm -rf / --version",
+        reason: destructive,
+      },
+      {
+        command: `env -S "npm install left-pad" --help`,
+        subject: "npm install left-pad --help",
+      },
+    ];
+
+    for (const { command, subject, reason } of cases) {
+      expect(expandShellSubjects(command)).toEqual({
+        subjects: [command, subject],
+        opaque: false,
+      });
+      if (reason !== undefined) {
+        expect(runShellAuthzBlockReason(command)).toMatch(reason);
+      }
+    }
+  });
+
   test("G7: soft-allow non-catastrophic rm inside -S is not hard-denied", () => {
     expect(
       runShellAuthzBlockReason(`env -S "rm -rf node_modules"`),
@@ -433,6 +462,71 @@ describe("authz hard-deny peels glued and trailing env -S forms", () => {
     );
   });
 
+  test("transparent time options and end-of-options expose hard-denied utilities", () => {
+    expect(runShellAuthzBlockReason(`time -p find .`)).toMatch(openEnded);
+    expect(runShellAuthzBlockReason(`time -- find .`)).toMatch(openEnded);
+    expect(runShellAuthzBlockReason(`/usr/bin/time -o report find .`)).toMatch(
+      openEnded,
+    );
+    expect(runShellAuthzBlockReason(`/usr/bin/time -ao report find .`)).toMatch(
+      openEnded,
+    );
+    expect(runShellAuthzBlockReason(`time -f %e find .`)).toMatch(openEnded);
+  });
+
+  test("clustered env and timeout value options expose hard-denied utilities", () => {
+    expect(runShellAuthzBlockReason(`env -iu PATH find .`)).toMatch(openEnded);
+    expect(runShellAuthzBlockReason(`timeout -vs KILL 1 find .`)).toMatch(
+      openEnded,
+    );
+  });
+
+  test("valid GNU timeout durations expose hard-denied utilities", () => {
+    for (const duration of [
+      ".5s",
+      "1",
+      "1e3",
+      "1e3s",
+      "0x1p4",
+      "2m",
+      "3h",
+      "4d",
+      "inf",
+      "infinity",
+    ]) {
+      expect(runShellAuthzBlockReason(`timeout ${duration} find .`)).toMatch(
+        openEnded,
+      );
+    }
+  });
+
+  test("env value operands are parsed before terminal modes", () => {
+    expect(runShellAuthzBlockReason(`env -u --help find .`)).toMatch(openEnded);
+    expect(runShellAuthzBlockReason(`env -C --version find .`)).toMatch(
+      openEnded,
+    );
+  });
+
+  test("env continues assignment parsing after end-of-options", () => {
+    expect(runShellAuthzBlockReason(`env -- FILE=x find .`)).toMatch(openEnded);
+    expect(runShellAuthzBlockReason(`env -i -- FILE=x find .`)).toMatch(
+      openEnded,
+    );
+  });
+
+  test("terminal wrapper modes do not peel their operands as commands", () => {
+    for (const command of [
+      "command --help find .",
+      "command -p -v find",
+      "command -pv find",
+      "env --help find",
+      "nice --help find",
+      "timeout --help find",
+    ]) {
+      expect(runShellAuthzBlockReason(command)).toBeUndefined();
+    }
+  });
+
   test("G13: empty/whitespace -S payload with trailing utility is hard-denied", () => {
     // Runtime still executes the trailing utility; do not opaque-drop it.
     expect(runShellAuthzBlockReason(`env -S " " find /`)).toMatch(openEnded);

src/shell/run-shell-authz.ts

@@ -2,6 +2,12 @@
 // enforcement owner (hard deny at the top of its verdict path).
 
 import { splitChainedCommand, tokenize } from "../permission/command.js";
+import {
+  peelTransparentCommand,
+  programBasename,
+} from "./transparent-command.js";
+
+export { programBasename } from "./transparent-command.js";
 
 function skipMatching(
   tokens: readonly string[],
@@ -318,16 +324,6 @@ const RECURSIVE_FLAG = /^(--recursive|-[A-Za-z]*[rR][A-Za-z]*)$/;
 // Interpreters whose `-c` / `--command` payload is an independent shell subject.
 // Exported so tests and callers share one explicit list with the peeler.
 export const SHELL_INTERPRETERS = new Set(["bash", "sh", "zsh", "dash", "ksh"]);
-// Transparent prefixes that sit in front of a real program without changing it.
-const PREFIX_WRAPPERS = new Set([
-  "command",
-  "env",
-  "builtin",
-  "time",
-  "nice",
-  "nohup",
-  "timeout",
-]);
 // Max recursive peel depth for nested wrappers. Exported so the depth cap is a
 // named policy knob tests can assert against, not a magic number.
 export const MAX_PEEL_DEPTH = 4;
@@ -375,12 +371,6 @@ function isDangerousTarget(token: string): boolean {
   return false;
 }
 
-export function programBasename(token: string): string {
-  const bare = token.replace(/['"]/g, "");
-  const slash = bare.lastIndexOf("/");
-  return slash >= 0 ? bare.slice(slash + 1) : bare;
-}
-
 // Payload we cannot statically inspect: empty, a bare expansion, or a leading
 // command substitution. Argument-position expansions like `rm -rf $HOME` stay
 // parseable so catastrophic-target checks still fire.
@@ -684,7 +674,8 @@ function finishEnvSplitPayload(
     raw = payload;
   } else {
     if (isOpaquePayload(rest.join(" "))) return { kind: "opaque" };
-    raw = rejoinTokens([payload, ...rest]);
+    const trailing = rejoinTokens(rest);
+    raw = trailing === null ? null : `${payload} ${trailing}`;
   }
   if (raw === null) return { kind: "opaque" };
   return peelEnvSplitUtility(raw);
@@ -811,66 +802,14 @@ function skipEnvFlagsAndAssignments(tokens: string[], start: number): number {
 // single segment.
 function peelOnce(segment: string): PeelOutcome {
   const tokens = tokenize(segment);
-  let i = 0;
-  i = skipMatching(tokens, i, (t) => ENV_ASSIGNMENT.test(t));
-
-  let strippedPrefix = false;
-  while (i < tokens.length) {
-    const current = tokens[i];
-    if (current === undefined) break;
-    const base = programBasename(current);
-    if (base === "env") {
-      // Prefer split-string peel: the whole payload is one quoted argument
-      // that env re-splits itself, so the transparent-prefix path below
-      // would only rejoin `-S '…'` and leave the real command invisible.
-      const splitPeel = peelEnvSplitString(tokens, i + 1);
-      if (splitPeel.kind !== "none") return splitPeel;
-      strippedPrefix = true;
-      i = skipEnvFlagsAndAssignments(tokens, i + 1);
-      continue;
-    }
-    if (base === "timeout") {
-      strippedPrefix = true;
-      i++;
-      // Optional duration (10, 30s, 1m, …) and common long/short flags.
-      while (i < tokens.length) {
-        const t = tokens[i];
-        if (t === undefined) break;
-        if (/^\d/.test(t)) {
-          i++;
-          continue;
-        }
-        if (t.startsWith("-") && t !== "-") {
-          // Flags that take a value: -k / --kill-after / -s / --signal.
-          if (
-            t === "-k" ||
-            t === "--kill-after" ||
-            t === "-s" ||
-            t === "--signal" ||
-            t.startsWith("--kill-after=") ||
-            t.startsWith("--signal=")
-          ) {
-            i++;
-            if (!t.includes("=") && i < tokens.length) {
-              const next = tokens[i];
-              if (next !== undefined && !next.startsWith("-")) i++;
-            }
-            continue;
-          }
-          i++;
-          continue;
-        }
-        break;
-      }
-      continue;
-    }
-    if (PREFIX_WRAPPERS.has(base) && base !== "env" && base !== "timeout") {
-      strippedPrefix = true;
-      i++;
-      continue;
-    }
-    break;
+  const transparent = peelTransparentCommand(tokens);
+  for (const wrapperIndex of transparent.wrapperIndexes) {
+    if (programBasename(tokens[wrapperIndex] ?? "") !== "env") continue;
+    const splitPeel = peelEnvSplitString(tokens, wrapperIndex + 1);
+    if (splitPeel.kind !== "none") return splitPeel;
   }
+  const i = transparent.executableIndex;
+  const strippedPrefix = transparent.wrapperIndexes.length > 0;
 
   if (i >= tokens.length)
     return strippedPrefix ? { kind: "opaque" } : { kind: "none" };