Skip to content

Commit ecb4ea9

Browse files
vincentkocvincentkoc
committed
fix(ci): restore exec approval masking semantics
1 parent 0e9a9da commit ecb4ea9

1 file changed

Lines changed: 35 additions & 13 deletions

File tree

‎src/infra/exec-approvals.ts‎

Lines changed: 35 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -299,10 +299,19 @@ function stripAllowlistCommandText(
299299
function sanitizeExecApprovalPolicy(
300300
policy: ExecApprovalsDefaults | ExecApprovalsAgent | undefined,
301301
): ExecApprovalsDefaults {
302+
const security = toStringOrUndefined(policy?.security)?.trim();
303+
const ask = toStringOrUndefined(policy?.ask)?.trim();
304+
const askFallback = toStringOrUndefined(policy?.askFallback)?.trim();
302305
return {
303-
security: normalizeExecSecurity(toStringOrUndefined(policy?.security)) ?? undefined,
304-
ask: normalizeExecAsk(toStringOrUndefined(policy?.ask)) ?? undefined,
305-
askFallback: normalizeExecSecurity(toStringOrUndefined(policy?.askFallback)) ?? undefined,
306+
security:
307+
security === "deny" || security === "allowlist" || security === "full"
308+
? security
309+
: undefined,
310+
ask: ask === "off" || ask === "on-miss" || ask === "always" ? ask : undefined,
311+
askFallback:
312+
askFallback === "deny" || askFallback === "allowlist" || askFallback === "full"
313+
? askFallback
314+
: undefined,
306315
autoAllowSkills: policy?.autoAllowSkills,
307316
};
308317
}
@@ -509,7 +518,9 @@ function resolveAgentSecurityField(params: {
509518
field: "security" | "askFallback";
510519
defaults: ExecApprovalsDefaults;
511520
agent: ExecApprovalsAgent;
521+
rawAgent: ExecApprovalsAgent;
512522
wildcard: ExecApprovalsAgent;
523+
rawWildcard: ExecApprovalsAgent;
513524
agentKey: string;
514525
fallback: ExecSecurity;
515526
}): ResolvedExecPolicyField<ExecSecurity> {
@@ -518,21 +529,21 @@ function resolveAgentSecurityField(params: {
518529
defaults: params.defaults,
519530
fallback: params.fallback,
520531
});
521-
const agentValue = params.agent[params.field];
522-
if (agentValue != null) {
523-
if (isExecSecurity(agentValue)) {
532+
const rawAgentValue = params.rawAgent[params.field];
533+
if (rawAgentValue != null) {
534+
if (isExecSecurity(params.agent[params.field])) {
524535
return {
525-
value: agentValue,
536+
value: params.agent[params.field] as ExecSecurity,
526537
source: `agents.${params.agentKey}.${params.field}`,
527538
};
528539
}
529540
return fallbackField;
530541
}
531-
const wildcardValue = params.wildcard[params.field];
532-
if (wildcardValue != null) {
533-
if (isExecSecurity(wildcardValue)) {
542+
const rawWildcardValue = params.rawWildcard[params.field];
543+
if (rawWildcardValue != null) {
544+
if (isExecSecurity(params.wildcard[params.field])) {
534545
return {
535-
value: wildcardValue,
546+
value: params.wildcard[params.field] as ExecSecurity,
536547
source: `agents.*.${params.field}`,
537548
};
538549
}
@@ -544,15 +555,17 @@ function resolveAgentSecurityField(params: {
544555
function resolveAgentAskField(params: {
545556
defaults: ExecApprovalsDefaults;
546557
agent: ExecApprovalsAgent;
558+
rawAgent: ExecApprovalsAgent;
547559
wildcard: ExecApprovalsAgent;
560+
rawWildcard: ExecApprovalsAgent;
548561
agentKey: string;
549562
fallback: ExecAsk;
550563
}): ResolvedExecPolicyField<ExecAsk> {
551564
const fallbackField = resolveDefaultAskField({
552565
defaults: params.defaults,
553566
fallback: params.fallback,
554567
});
555-
if (params.agent.ask != null) {
568+
if (params.rawAgent.ask != null) {
556569
if (isExecAsk(params.agent.ask)) {
557570
return {
558571
value: params.agent.ask,
@@ -561,7 +574,7 @@ function resolveAgentAskField(params: {
561574
}
562575
return fallbackField;
563576
}
564-
if (params.wildcard.ask != null) {
577+
if (params.rawWildcard.ask != null) {
565578
if (isExecAsk(params.wildcard.ask)) {
566579
return {
567580
value: params.wildcard.ask,
@@ -603,11 +616,14 @@ export function resolveExecApprovalsFromFile(params: {
603616
socketPath?: string;
604617
token?: string;
605618
}): ExecApprovalsResolved {
619+
const rawFile = params.file;
606620
const file = normalizeExecApprovals(params.file);
607621
const defaults = file.defaults ?? {};
608622
const agentKey = params.agentId ?? DEFAULT_AGENT_ID;
609623
const agent = file.agents?.[agentKey] ?? {};
610624
const wildcard = file.agents?.["*"] ?? {};
625+
const rawAgent = rawFile.agents?.[agentKey] ?? {};
626+
const rawWildcard = rawFile.agents?.["*"] ?? {};
611627
const fallbackSecurity = params.overrides?.security ?? DEFAULT_SECURITY;
612628
const fallbackAsk = params.overrides?.ask ?? DEFAULT_ASK;
613629
const fallbackAskFallback = params.overrides?.askFallback ?? DEFAULT_EXEC_APPROVAL_ASK_FALLBACK;
@@ -625,22 +641,28 @@ export function resolveExecApprovalsFromFile(params: {
625641
field: "security",
626642
defaults,
627643
agent,
644+
rawAgent,
628645
wildcard,
646+
rawWildcard,
629647
agentKey,
630648
fallback: resolvedDefaults.security,
631649
});
632650
const resolvedAgentAsk = resolveAgentAskField({
633651
defaults,
634652
agent,
653+
rawAgent,
635654
wildcard,
655+
rawWildcard,
636656
agentKey,
637657
fallback: resolvedDefaults.ask,
638658
});
639659
const resolvedAgentAskFallback = resolveAgentSecurityField({
640660
field: "askFallback",
641661
defaults,
642662
agent,
663+
rawAgent,
643664
wildcard,
665+
rawWildcard,
644666
agentKey,
645667
fallback: resolvedDefaults.askFallback,
646668
});

0 commit comments

Comments
 (0)