Claude/fix argument parsing 01 dw1t4 n33m s5g13c sr8u y bw (#10)

* WIP: Improve argument parsing with command-aware extraction

Implements command-specific parsing to correctly distinguish file paths
from other arguments (e.g., grep patterns, echo text).

- Added extractFilePaths() method with per-command parsing logic
- Handles grep (pattern vs files), find (directory vs predicates),
  dd (if=/of= syntax), test commands (operators), etc.
- Fixes issue where any non-flag arg was incorrectly treated as file path

This is work in progress - discussing with user whether command-based
filtering should be removed entirely vs improved.

* Remove command-based argument validation in CI mode

The previous approach of parsing command arguments to validate file access
was fundamentally flawed and caused bugs like incorrectly treating grep
patterns as file paths (e.g., grep "pattern" file.txt).

Changes:
- Removed extractFilePaths() method with command-specific parsing logic
- Removed validateCommand() method that attempted to validate file access
- Updated CI mode to clearly warn that sandboxing is disabled
- Updated security tests to skip when running in CI mode
- Added documentation that CI environments run without sandboxing

The command-based validation was security theater that:
1. Could be bypassed with shell redirections, symlinks, etc.
2. Broke legitimate use cases (grep, echo, find, etc.)
3. Was impossible to maintain for all command syntaxes

Real security comes from bubblewrap isolation. In CI environments
without bubblewrap support, users should use Docker containers.

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: soodoku

src/__tests__/security-validation.test.ts

@@ -12,6 +12,7 @@ import { join } from 'path';
 describe('Security Validation Tests', () => {
   const testDir = process.cwd();
   let sandbox: PlatformSandbox;
+  const isCI = process.env.CI === 'true' || process.env.GITHUB_ACTIONS === 'true';
 
   beforeAll(async () => {
     const isAvailable = await PlatformSandbox.isAvailable();
@@ -21,17 +22,27 @@ describe('Security Validation Tests', () => {
       );
     }
 
+    if (isCI) {
+      console.warn('⚠️  Running in CI mode - sandboxing is disabled, security tests will be skipped');
+    }
+
     const config = getDefaultConfig(testDir);
     sandbox = new PlatformSandbox(config);
   });
 
   /**
    * TEST 1: Block SSH Key Access
    * Claim: "Automatically blocks access to SSH keys (~/.ssh)"
+   *
+   * NOTE: This test is skipped in CI environments where bubblewrap is unavailable.
+   * CI environments run without sandboxing and cannot enforce security boundaries.
    */
   it('TEST 1: Should block access to SSH private keys', async () => {
     const isAvailable = await PlatformSandbox.isAvailable();
-    if (!isAvailable) return;
+    if (!isAvailable || isCI) {
+      console.log('Skipped: Sandboxing not available');
+      return;
+    }
 
     const sshKeyPath = join(homedir(), '.ssh', 'id_rsa');
 

src/filesystem-sandbox.ts

@@ -10,13 +10,15 @@ export class FilesystemSandbox {
 
   constructor(private config: SandboxConfig) {
     // In CI environments without user namespace support, we can't use bubblewrap's
-    // mount isolation features. Fall back to direct execution with permission checking.
+    // mount isolation features. Fall back to direct execution WITHOUT sandboxing.
     const isCI = process.env.CI === 'true' || process.env.GITHUB_ACTIONS === 'true';
     if (isCI) {
       // GitHub Actions and similar CI environments typically don't support user namespaces
       // which are required for bubblewrap's bind mounts. Use direct execution instead.
       this.useDirectExecution = true;
-      console.log('CI environment detected - using direct execution with permission validation');
+      console.warn('⚠️  CI environment detected - bubblewrap sandboxing is DISABLED');
+      console.warn('⚠️  Commands will run with full filesystem access');
+      console.warn('⚠️  For secure sandboxing in CI, use Docker or similar containerization');
     }
   }
 
@@ -78,25 +80,16 @@ export class FilesystemSandbox {
 
   /**
    * Execute command directly without bubblewrap (for CI environments)
-   * Validates paths and blocks forbidden access
+   *
+   * WARNING: This mode does NOT provide security sandboxing.
+   * Commands run with full access to the filesystem.
+   * For secure sandboxing in CI, use Docker or similar containerization.
    */
   private executeDirectly(
     command: string[],
     options: ExecuteOptions,
     startTime: number
   ): Promise<CommandResult> {
-    // Validate command for forbidden file access
-    const validation = this.validateCommand(command);
-    if (!validation.allowed) {
-      const duration = Date.now() - startTime;
-      return Promise.resolve({
-        exitCode: 1,
-        stdout: '',
-        stderr: `Permission denied: ${validation.reason}`,
-        duration,
-      });
-    }
-
     return new Promise((resolve, reject) => {
       const [cmd, ...args] = command;
       const proc = spawn(cmd, args, {
@@ -139,83 +132,6 @@ export class FilesystemSandbox {
     });
   }
 
-  /**
-   * Validate command for forbidden file access
-   */
-  private validateCommand(command: string[]): { allowed: boolean; reason?: string } {
-    if (command.length === 0) {
-      return { allowed: true };
-    }
-
-    const [cmd, ...args] = command;
-
-    // Commands that read files
-    const readCommands = ['cat', 'head', 'tail', 'less', 'more', 'grep', 'find'];
-    // Commands that write files
-    const writeCommands = ['touch', 'echo', 'tee', 'dd'];
-    // Commands that check file existence
-    const testCommands = ['test', '[', '[['];
-
-    // Check direct file access commands
-    if (readCommands.includes(cmd)) {
-      for (const arg of args) {
-        if (!arg.startsWith('-') && !this.isReadAllowed(arg)) {
-          return { allowed: false, reason: `Read access denied to ${arg}` };
-        }
-      }
-    }
-
-    if (writeCommands.includes(cmd)) {
-      for (const arg of args) {
-        if (!arg.startsWith('-') && !this.isWriteAllowed(arg)) {
-          return { allowed: false, reason: `Write access denied to ${arg}` };
-        }
-      }
-    }
-
-    if (testCommands.includes(cmd)) {
-      // Test commands check file existence - treat as read
-      for (const arg of args) {
-        if (!arg.startsWith('-') && arg !== ']' && !this.isReadAllowed(arg)) {
-          return { allowed: false, reason: `Access denied to ${arg}` };
-        }
-      }
-    }
-
-    // Check shell commands (sh -c "...")
-    if (cmd === 'sh' && args.length >= 2 && args[0] === '-c') {
-      const shellScript = args[1];
-
-      // Parse shell script for file operations
-      // Look for output redirections (>, >>)
-      const writeRedirects = shellScript.match(/>\s*([^\s;&|]+)/g);
-      if (writeRedirects) {
-        for (const match of writeRedirects) {
-          const path = match.replace(/^>\s*/, '').replace(/^"([^"]+)"$/, '$1');
-          if (!this.isWriteAllowed(path)) {
-            return { allowed: false, reason: `Write access denied to ${path}` };
-          }
-        }
-      }
-
-      // Look for file read operations (cat, head, tail, etc.)
-      for (const readCmd of readCommands) {
-        const pattern = new RegExp(`${readCmd}\\s+([^\\s;&|]+)`, 'g');
-        const matches = shellScript.matchAll(pattern);
-        for (const match of matches) {
-          if (match[1]) {
-            const path = match[1].replace(/^"([^"]+)"$/, '$1').replace(/^'([^']+)'$/, '$1');
-            if (!path.startsWith('-') && !this.isReadAllowed(path)) {
-              return { allowed: false, reason: `Read access denied to ${path}` };
-            }
-          }
-        }
-      }
-    }
-
-    return { allowed: true };
-  }
-
   /**
    * Build resource-limited command wrapper
    */