T20 — 6-layer hierarchical permission evaluation + path normalization

{`
class PermissionChecker:
    def check(
        self,
        tool_name: str,
        path: str | None,
        command: str | None,
        context: PermissionContext,
    ) -> CheckResult:
        # Layer 1: sensitive path (unconditional)
        if path and is_sensitive_path(path):
            return CheckResult.BLOCK("Sensitive path")

        # Layer 2: deny tool list
        if tool_name in self._deny_tools:
            return CheckResult.BLOCK(f"Tool {tool_name!r} is denied")

        # Layer 3: allow tool list (early exit — skip remaining layers)
        if tool_name in self._allow_tools:
            return CheckResult.ALLOW()

        # Layer 4: path rules
        if path:
            result = self._check_path_rules(path)
            if result is not None:
                return result

        # Layer 5: command deny patterns
        if command:
            result = self._check_command_deny(command)
            if result is not None:
                return result

        # Layer 6: permission mode (fallback)
        return self._check_mode(tool_name, context.mode)
`}

{`
def _normalize_path_variants(path: str) -> list[str]:
    """
    Generate normalized variants to prevent bypass via trailing slash.
    '/secret/' vs '/secret' both checked.
    """
    stripped = path.rstrip("/")
    return [stripped, stripped + "/"]

def _check_path_rules(self, path: str) -> CheckResult | None:
    variants = _normalize_path_variants(path)
    for rule in self._path_rules:
        for variant in variants:
            if fnmatch.fnmatch(variant, rule.pattern):
                if rule.action == "deny":
                    return CheckResult.BLOCK(f"Path denied by rule: {rule.pattern}")
                if rule.action == "allow":
                    return CheckResult.ALLOW()
    return None  # no rule matched, continue to next layer
`}

{`
# Adversa CC-643: 50-subcommand bypass
# Attack: instead of "rm -rf /important", agent uses:
# "echo x | cmd1 | cmd2 | ... | cmd49 | rm -rf /important"
# Each subcommand individually matched "allowed" patterns
# The full pipeline was never checked as a unit

# OpenHarness mitigation: check ALL subcommands in pipeline
import shlex

def check_full_pipeline(command: str) -> bool:
    """Check each segment of a piped command."""
    segments = command.split("|")
    for seg in segments:
        tokens = shlex.split(seg.strip(), posix=True)
        if tokens and _is_dangerous_command(tokens[0]):
            return False  # block entire pipeline
    return True

# Khi _check_command_deny() nhận command, nó gọi check_full_pipeline()
# thay vì chỉ check whole string một lần.
# "echo x | cat /etc/passwd" → segment 2 fail → toàn pipeline bị block
`}

{`
# check_full_pipeline() split theo "|" — nhưng Bash có nhiều cách
# compose commands không dùng pipe:

# Semicolon: "safe_cmd; rm -rf /important"
# split("|") → ["safe_cmd; rm -rf /important"] — 1 segment, pass check
# shlex sees: ["safe_cmd;", "rm", "-rf", "/important"]
# _is_dangerous_command("safe_cmd;") → False

# Subshell: "safe_cmd $(rm -rf /important)"
# Nested command substitution không bị detect bởi simple split

# Fix: parse với shlex.split() + check từng token,
# hoặc dùng AST bash parser (bashlex library)
# Đây là lý do tại sao "deny rules block tool invocations, not Bash subprocesses"
`}

{`
# Cấu hình: allow_tools = {"bash_tool", "read_file", "glob_tool"}
# Agent call: bash_tool(command="rm -rf /project/src")

# Layer 1: path=None → skip T19
# Layer 2: "bash_tool" not in deny_tools → continue
# Layer 3: "bash_tool" IN allow_tools → ALLOW (short-circuit)
# Layers 4-5: SKIPPED — never reached
# Command "rm -rf /project/src" không bao giờ được check

# Nguyên tắc: NEVER put bash_tool in allow_tools
# Thay vào đó: để bash_tool fall through đến layer 5 (command deny)
# và define DANGEROUS_CMDS patterns đủ rộng
`}

{`
# Rules (theo thứ tự iteration):
# rule 1: pattern="/project/src/*", action="allow"
# rule 2: pattern="/project/*",     action="deny"

# Request: path="/project/src/secret.ts"
# _check_path_rules() iterate rules theo thứ tự:
# - rule 1: fnmatch("/project/src/secret.ts", "/project/src/*") → True
#   → action="allow" → ALLOW (return ngay)
# - rule 2: never reached

# Ý định: deny toàn bộ /project/ trừ src/
# Kết quả: correct IF rule order is [deny /project/*, allow /project/src/*]
# Nhưng nếu thứ tự ngược lại → allow rule match trước → bypass deny

# Fix: document rõ "first-match wins" và sort rules: specific trước, broad sau
# Hoặc implement priority field trong rule definition
`}

{`
import fnmatch

DANGEROUS_CMDS = {"rm", "dd", "mkfs", "curl", "wget", "nc", "python", "python3"}

def check_permission(
    tool: str, path: str | None, cmd: str | None,
    deny_tools: set, allow_tools: set, path_rules: list, mode: str
) -> str:  # "allow" | "block" | "ask"

    # L1: sensitive paths (từ T19)
    if path and is_sensitive(path):
        return "block"

    # L2: explicit deny
    if tool in deny_tools:
        return "block"

    # L3: explicit allow (short-circuit — skip L4-L5)
    if tool in allow_tools:
        return "allow"

    # L4: path rules (first-match wins, specific rules first)
    if path:
        variants = [path.rstrip("/"), path.rstrip("/") + "/"]
        for rule in path_rules:
            for v in variants:
                if fnmatch.fnmatch(v, rule["pattern"]):
                    return rule["action"]  # "allow" or "block"

    # L5: command deny (check full pipeline)
    if cmd:
        for seg in cmd.split("|"):
            import shlex
            try:
                tokens = shlex.split(seg.strip(), posix=True)
            except ValueError:
                return "block"  # unparseable → block
            if tokens and tokens[0] in DANGEROUS_CMDS:
                return "block"

    # L6: mode fallback (từ T18)
    if mode == "full_auto":
        return "allow"
    if mode == "plan":
        # block mutations, allow reads
        WRITE_OPS = {"bash_tool", "write_file", "delete_file"}
        return "block" if tool in WRITE_OPS else "allow"
    return "ask"  # DEFAULT: ask user

# Lưu ý triển khai:
# - L3 allow_tools KHÔNG nên bao gồm bash_tool (bypass L4-L5)
# - path_rules nên sort: specific (dài hơn) trước broad (ngắn hơn)
# - L5 split("|") chưa handle semicolon hay subshell — cần bashlex cho full coverage
`}