fix(copilot): mirror transactional Python hooks
This commit is contained in:
ZacharyZhang-NY committed
1 parent
af8d227b45
commit
9b67aad113
13 files changed
+2120
-583
No files matched your search
@@ -1,4 +1,4 @@
|
||||
"""GitHub Copilot hook contract, ownership, and rendering."""
|
||||
"""GitHub Copilot CLI hook ownership and rendering."""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
@@ -8,7 +8,11 @@ import os
|
||||
import re
|
||||
import shlex
|
||||
import sys
|
||||
from typing import Any, Dict, List, Optional, Set
|
||||
from typing import Any, Dict, List, Optional, Tuple
|
||||
|
||||
from ._managed_files import FileSnapshot
|
||||
from ._strict_json import parse_json_object
|
||||
from .copilot_schema import CopilotHooks, validate_hooks
|
||||
|
||||
|
||||
AGENT_KEY = "copilot"
|
||||
@@ -18,7 +22,11 @@ CONFIG_FILE = "elydora-audit.json"
|
||||
HOOK_TIMEOUT_SECONDS = 10
|
||||
|
||||
JsonObject = Dict[str, Any]
|
||||
CopilotHooks = Dict[str, List[JsonObject]]
|
||||
MANAGED_EVENTS: Tuple[Tuple[str, str], ...] = (
|
||||
("preToolUse", GUARD_SCRIPT),
|
||||
("postToolUse", AUDIT_SCRIPT),
|
||||
("postToolUseFailure", AUDIT_SCRIPT),
|
||||
)
|
||||
|
||||
|
||||
@dataclass(frozen=True)
|
||||
@@ -27,13 +35,24 @@ class CopilotDocument:
|
||||
file_path: str
|
||||
root: JsonObject
|
||||
hooks: CopilotHooks
|
||||
hooks_disabled: bool
|
||||
raw: Optional[str] = None
|
||||
snapshot: Optional[FileSnapshot] = None
|
||||
|
||||
|
||||
@dataclass(frozen=True)
|
||||
class SourcePrecondition:
|
||||
file_path: str
|
||||
label: str
|
||||
snapshot: Optional[FileSnapshot]
|
||||
|
||||
|
||||
@dataclass(frozen=True)
|
||||
class CopilotSources:
|
||||
user: CopilotDocument
|
||||
legacy: Optional[CopilotDocument]
|
||||
disabled_by: Optional[str]
|
||||
settings_preconditions: Tuple[SourcePrecondition, ...]
|
||||
|
||||
|
||||
@dataclass(frozen=True)
|
||||
@@ -50,16 +69,36 @@ class RuntimeContract:
|
||||
audit_path: str
|
||||
|
||||
|
||||
def _same_path(left: str, right: str) -> bool:
|
||||
@dataclass(frozen=True)
|
||||
class _ParsedArgument:
|
||||
value: str
|
||||
next_index: int
|
||||
|
||||
|
||||
@dataclass(frozen=True)
|
||||
class _ManagedEntry:
|
||||
agent_id: str
|
||||
script_path: str
|
||||
|
||||
|
||||
def runtime_root() -> str:
|
||||
return os.path.join(os.path.expanduser("~"), ".elydora")
|
||||
|
||||
|
||||
def same_path(left: str, right: str) -> bool:
|
||||
return os.path.normcase(os.path.abspath(left)) == os.path.normcase(
|
||||
os.path.abspath(right)
|
||||
)
|
||||
|
||||
|
||||
def _same_agent_id(left: str, right: str) -> bool:
|
||||
def same_agent_id(left: str, right: str) -> bool:
|
||||
return os.path.normcase(left) == os.path.normcase(right)
|
||||
|
||||
|
||||
def _quote_posix(value: str) -> str:
|
||||
return "'" + value.replace("'", "'\"'\"'") + "'"
|
||||
|
||||
|
||||
def _quote_powershell(value: str) -> str:
|
||||
return "'" + value.replace("'", "''") + "'"
|
||||
|
||||
@@ -67,7 +106,7 @@ def _quote_powershell(value: str) -> str:
|
||||
def build_handler(script_path: str) -> JsonObject:
|
||||
return {
|
||||
"type": "command",
|
||||
"bash": shlex.join([sys.executable, script_path]),
|
||||
"bash": f"{_quote_posix(sys.executable)} {_quote_posix(script_path)}",
|
||||
"powershell": (
|
||||
f"& {_quote_powershell(sys.executable)} "
|
||||
f"{_quote_powershell(script_path)}; exit $LASTEXITCODE"
|
||||
@@ -76,109 +115,205 @@ def build_handler(script_path: str) -> JsonObject:
|
||||
}
|
||||
|
||||
|
||||
def _generated_script_path(handler: JsonObject) -> Optional[str]:
|
||||
if set(handler) != {"type", "bash", "powershell", "timeoutSec"}:
|
||||
def _read_posix_argument(command: str, start: int) -> Optional[_ParsedArgument]:
|
||||
if start >= len(command) or command[start] != "'":
|
||||
return None
|
||||
if handler.get("type") != "command":
|
||||
apostrophe = "'\"'\"'"
|
||||
value = ""
|
||||
index = start + 1
|
||||
while index < len(command):
|
||||
if command.startswith(apostrophe, index):
|
||||
value += "'"
|
||||
index += len(apostrophe)
|
||||
continue
|
||||
if command[index] == "'":
|
||||
return _ParsedArgument(value, index + 1)
|
||||
value += command[index]
|
||||
index += 1
|
||||
return None
|
||||
|
||||
|
||||
def _parse_generated_bash(command: Any) -> Optional[Tuple[str, str]]:
|
||||
if not isinstance(command, str):
|
||||
return None
|
||||
if handler.get("timeoutSec") != HOOK_TIMEOUT_SECONDS:
|
||||
executable = _read_posix_argument(command, 0)
|
||||
if executable is None or command[executable.next_index:executable.next_index + 1] != " ":
|
||||
return None
|
||||
bash = handler.get("bash")
|
||||
if not isinstance(bash, str):
|
||||
script = _read_posix_argument(command, executable.next_index + 1)
|
||||
if script is None or script.next_index != len(command):
|
||||
return None
|
||||
return executable.value, script.value
|
||||
|
||||
|
||||
def _read_powershell_argument(
|
||||
command: str, start: int
|
||||
) -> Optional[_ParsedArgument]:
|
||||
if start >= len(command) or command[start] != "'":
|
||||
return None
|
||||
value = ""
|
||||
index = start + 1
|
||||
while index < len(command):
|
||||
if command[index] != "'":
|
||||
value += command[index]
|
||||
index += 1
|
||||
continue
|
||||
if index + 1 < len(command) and command[index + 1] == "'":
|
||||
value += "'"
|
||||
index += 2
|
||||
continue
|
||||
return _ParsedArgument(value, index + 1)
|
||||
return None
|
||||
|
||||
|
||||
def _parse_generated_powershell(command: Any) -> Optional[Tuple[str, str]]:
|
||||
if not isinstance(command, str) or not command.startswith("& "):
|
||||
return None
|
||||
executable = _read_powershell_argument(command, 2)
|
||||
if executable is None or command[executable.next_index:executable.next_index + 1] != " ":
|
||||
return None
|
||||
script = _read_powershell_argument(command, executable.next_index + 1)
|
||||
if script is None or command[script.next_index:] != "; exit $LASTEXITCODE":
|
||||
return None
|
||||
return executable.value, script.value
|
||||
|
||||
|
||||
def _exact_handler_keys(handler: JsonObject) -> bool:
|
||||
return set(handler) == {"type", "bash", "powershell", "timeoutSec"}
|
||||
|
||||
|
||||
def _is_python_executable(file_path: str) -> bool:
|
||||
return os.path.isabs(file_path) and re.fullmatch(
|
||||
r"(?:python|pypy)(?:[0-9]+(?:\.[0-9]+)*)?(?:\.exe)?",
|
||||
os.path.basename(file_path),
|
||||
re.IGNORECASE,
|
||||
) is not None
|
||||
|
||||
|
||||
def _current_script_path(handler: JsonObject) -> Optional[str]:
|
||||
if (
|
||||
not _exact_handler_keys(handler)
|
||||
or handler.get("type") != "command"
|
||||
or handler.get("timeoutSec") != HOOK_TIMEOUT_SECONDS
|
||||
):
|
||||
return None
|
||||
bash = _parse_generated_bash(handler.get("bash"))
|
||||
powershell = _parse_generated_powershell(handler.get("powershell"))
|
||||
if (
|
||||
bash is None
|
||||
or powershell is None
|
||||
or not _is_python_executable(bash[0])
|
||||
or not same_path(bash[0], powershell[0])
|
||||
or not same_path(bash[1], powershell[1])
|
||||
):
|
||||
return None
|
||||
return bash[1]
|
||||
|
||||
|
||||
def _prior_script_path(handler: JsonObject) -> Optional[str]:
|
||||
if (
|
||||
not _exact_handler_keys(handler)
|
||||
or handler.get("type") != "command"
|
||||
or handler.get("timeoutSec") != HOOK_TIMEOUT_SECONDS
|
||||
or not isinstance(handler.get("bash"), str)
|
||||
):
|
||||
return None
|
||||
bash_command = str(handler["bash"])
|
||||
try:
|
||||
arguments = shlex.split(bash)
|
||||
arguments = shlex.split(bash_command)
|
||||
except ValueError:
|
||||
return None
|
||||
if len(arguments) != 2 or not _same_path(arguments[0], sys.executable):
|
||||
powershell = _parse_generated_powershell(handler.get("powershell"))
|
||||
if (
|
||||
len(arguments) != 2
|
||||
or shlex.join(arguments) != bash_command
|
||||
or powershell is None
|
||||
or not _is_python_executable(arguments[0])
|
||||
or not same_path(arguments[0], powershell[0])
|
||||
or not same_path(arguments[1], powershell[1])
|
||||
):
|
||||
return None
|
||||
script_path = arguments[1]
|
||||
expected_powershell = (
|
||||
f"& {_quote_powershell(sys.executable)} "
|
||||
f"{_quote_powershell(script_path)}; exit $LASTEXITCODE"
|
||||
)
|
||||
return script_path if handler.get("powershell") == expected_powershell else None
|
||||
return arguments[1]
|
||||
|
||||
|
||||
def _legacy_script_path(handler: JsonObject) -> Optional[str]:
|
||||
if set(handler) != {"type", "bash", "powershell", "timeoutSec"}:
|
||||
if (
|
||||
not _exact_handler_keys(handler)
|
||||
or handler.get("type") != "command"
|
||||
or handler.get("timeoutSec") != 5
|
||||
or not isinstance(handler.get("bash"), str)
|
||||
or handler.get("bash") != handler.get("powershell")
|
||||
):
|
||||
return None
|
||||
if handler.get("type") != "command" or handler.get("timeoutSec") != 5:
|
||||
return None
|
||||
bash = handler.get("bash")
|
||||
powershell = handler.get("powershell")
|
||||
if not isinstance(bash, str) or bash != powershell:
|
||||
return None
|
||||
command = re.fullmatch(r'"[^"]+"\s+(.+)', bash)
|
||||
return command.group(1) if command else bash
|
||||
command = str(handler["bash"])
|
||||
match = re.fullmatch(r'"[^"\r\n]+"\s+(.+)', command)
|
||||
return match.group(1) if match else command
|
||||
|
||||
|
||||
def _managed_agent_id(
|
||||
handler: JsonObject,
|
||||
script_name: str,
|
||||
runtime_root: str,
|
||||
) -> Optional[str]:
|
||||
script_path = _generated_script_path(handler) or _legacy_script_path(handler)
|
||||
if not script_path or os.path.basename(script_path) != script_name:
|
||||
def _managed_entry(
|
||||
handler: JsonObject, script_name: str
|
||||
) -> Optional[_ManagedEntry]:
|
||||
script_path = (
|
||||
_current_script_path(handler)
|
||||
or _prior_script_path(handler)
|
||||
or _legacy_script_path(handler)
|
||||
)
|
||||
if (
|
||||
not script_path
|
||||
or os.path.normcase(os.path.basename(script_path))
|
||||
!= os.path.normcase(script_name)
|
||||
):
|
||||
return None
|
||||
agent_directory = os.path.dirname(script_path)
|
||||
if not _same_path(os.path.dirname(agent_directory), runtime_root):
|
||||
if not same_path(os.path.dirname(agent_directory), runtime_root()):
|
||||
return None
|
||||
agent_id = os.path.basename(agent_directory)
|
||||
return agent_id if agent_id not in {"", ".", ".."} else None
|
||||
if agent_id in ("", ".", ".."):
|
||||
return None
|
||||
return _ManagedEntry(agent_id, script_path)
|
||||
|
||||
|
||||
def _validate_hooks(value: Any, label: str) -> CopilotHooks:
|
||||
if value is None:
|
||||
raise ValueError(f'{label} field "hooks" must be an object')
|
||||
if not isinstance(value, dict):
|
||||
raise ValueError(f'{label} field "hooks" must be an object')
|
||||
hooks: CopilotHooks = {}
|
||||
for event, handlers in value.items():
|
||||
if not isinstance(event, str):
|
||||
raise ValueError(f"{label} hook event names must be strings")
|
||||
if not isinstance(handlers, list):
|
||||
raise ValueError(f'{label} field "hooks.{event}" must be an array')
|
||||
if not all(isinstance(handler, dict) for handler in handlers):
|
||||
raise ValueError(
|
||||
f'{label} field "hooks.{event}" must contain objects'
|
||||
)
|
||||
hooks[event] = list(handlers)
|
||||
return hooks
|
||||
|
||||
|
||||
def parse_document(file_path: str, raw: str, label: str) -> CopilotDocument:
|
||||
try:
|
||||
value = json.loads(raw)
|
||||
except json.JSONDecodeError as error:
|
||||
raise ValueError(f"Failed to parse {label} at {file_path}: {error}") from error
|
||||
if not isinstance(value, dict):
|
||||
raise ValueError(f"{label} at {file_path} must contain a JSON object")
|
||||
if value.get("version") != 1:
|
||||
raise ValueError(f"{label} at {file_path} must declare version 1")
|
||||
hooks = _validate_hooks(value.get("hooks", {}), label)
|
||||
return CopilotDocument(True, file_path, value, hooks, raw)
|
||||
def parse_document(
|
||||
file_path: str,
|
||||
snapshot: FileSnapshot,
|
||||
label: str,
|
||||
) -> CopilotDocument:
|
||||
document_label = f"{label} at {file_path}"
|
||||
root = parse_json_object(snapshot.contents, document_label)
|
||||
version = root.get("version")
|
||||
if isinstance(version, bool) or version != 1:
|
||||
raise ValueError(f"{document_label} must declare version 1")
|
||||
if "disableAllHooks" in root and not isinstance(
|
||||
root["disableAllHooks"], bool
|
||||
):
|
||||
raise ValueError(
|
||||
f'{document_label} field "disableAllHooks" must be a boolean'
|
||||
)
|
||||
hooks = validate_hooks(root["hooks"], document_label) if "hooks" in root else {}
|
||||
return CopilotDocument(
|
||||
True,
|
||||
file_path,
|
||||
root,
|
||||
hooks,
|
||||
root.get("disableAllHooks") is True,
|
||||
snapshot.contents,
|
||||
snapshot,
|
||||
)
|
||||
|
||||
|
||||
def create_document(file_path: str) -> CopilotDocument:
|
||||
return CopilotDocument(False, file_path, {}, {})
|
||||
return CopilotDocument(False, file_path, {}, {}, False)
|
||||
|
||||
|
||||
def remove_managed_hooks(
|
||||
hooks: CopilotHooks,
|
||||
runtime_root: str,
|
||||
agent_id: str = "",
|
||||
hooks: CopilotHooks, agent_id: str = ""
|
||||
) -> CopilotHooks:
|
||||
result = dict(hooks)
|
||||
for event, script_name in (
|
||||
("preToolUse", GUARD_SCRIPT),
|
||||
("postToolUse", AUDIT_SCRIPT),
|
||||
):
|
||||
result = {event: list(handlers) for event, handlers in hooks.items()}
|
||||
for event, script_name in MANAGED_EVENTS:
|
||||
handlers = []
|
||||
for handler in result.get(event, []):
|
||||
managed_id = _managed_agent_id(handler, script_name, runtime_root)
|
||||
remove = managed_id is not None and (
|
||||
not agent_id or _same_agent_id(managed_id, agent_id)
|
||||
managed = _managed_entry(handler, script_name)
|
||||
remove = managed is not None and (
|
||||
not agent_id or same_agent_id(managed.agent_id, agent_id)
|
||||
)
|
||||
if not remove:
|
||||
handlers.append(handler)
|
||||
@@ -190,7 +325,7 @@ def remove_managed_hooks(
|
||||
|
||||
|
||||
def _empty_owned_document(root: JsonObject, hooks: CopilotHooks) -> bool:
|
||||
return not hooks and all(key in {"version", "hooks"} for key in root)
|
||||
return not hooks and all(key in ("version", "hooks") for key in root)
|
||||
|
||||
|
||||
def render_document(
|
||||
@@ -206,37 +341,47 @@ def render_document(
|
||||
root["hooks"] = hooks
|
||||
else:
|
||||
root.pop("hooks", None)
|
||||
next_source = json.dumps(root, indent=2) + "\n"
|
||||
return RenderedDocument(document, next_source != document.raw, next_source)
|
||||
next_source = json.dumps(root, indent=2, ensure_ascii=False) + "\n"
|
||||
parse_document(
|
||||
document.file_path,
|
||||
FileSnapshot(next_source, 0, 0, 0),
|
||||
"GitHub Copilot rendered hooks",
|
||||
)
|
||||
return RenderedDocument(
|
||||
document,
|
||||
next_source != document.raw,
|
||||
next_source,
|
||||
)
|
||||
|
||||
|
||||
def _managed_ids(
|
||||
handlers: List[JsonObject],
|
||||
script_name: str,
|
||||
runtime_root: str,
|
||||
) -> Set[str]:
|
||||
result: Set[str] = set()
|
||||
def _managed_entries(
|
||||
handlers: List[JsonObject], script_name: str
|
||||
) -> Dict[str, List[_ManagedEntry]]:
|
||||
result: Dict[str, List[_ManagedEntry]] = {}
|
||||
for handler in handlers:
|
||||
agent_id = _managed_agent_id(handler, script_name, runtime_root)
|
||||
if agent_id:
|
||||
result.add(agent_id)
|
||||
entry = _managed_entry(handler, script_name)
|
||||
if entry is not None:
|
||||
result.setdefault(os.path.normcase(entry.agent_id), []).append(entry)
|
||||
return result
|
||||
|
||||
|
||||
def runtime_contracts(
|
||||
hooks: CopilotHooks,
|
||||
runtime_root: str,
|
||||
) -> List[RuntimeContract]:
|
||||
guards = _managed_ids(hooks.get("preToolUse", []), GUARD_SCRIPT, runtime_root)
|
||||
audits = _managed_ids(hooks.get("postToolUse", []), AUDIT_SCRIPT, runtime_root)
|
||||
contracts: List[RuntimeContract] = []
|
||||
for agent_id in sorted(guards):
|
||||
if not any(_same_agent_id(agent_id, audit_id) for audit_id in audits):
|
||||
def runtime_contracts(hooks: CopilotHooks) -> List[RuntimeContract]:
|
||||
guards = _managed_entries(hooks.get("preToolUse", []), GUARD_SCRIPT)
|
||||
successes = _managed_entries(hooks.get("postToolUse", []), AUDIT_SCRIPT)
|
||||
failures = _managed_entries(
|
||||
hooks.get("postToolUseFailure", []), AUDIT_SCRIPT
|
||||
)
|
||||
contracts = []
|
||||
for key, guard in guards.items():
|
||||
success = successes.get(key, [])
|
||||
failure = failures.get(key, [])
|
||||
if len(guard) != 1 or len(success) != 1 or len(failure) != 1:
|
||||
continue
|
||||
if not same_path(success[0].script_path, failure[0].script_path):
|
||||
continue
|
||||
agent_directory = os.path.join(runtime_root, agent_id)
|
||||
contracts.append(RuntimeContract(
|
||||
agent_id,
|
||||
os.path.join(agent_directory, GUARD_SCRIPT),
|
||||
os.path.join(agent_directory, AUDIT_SCRIPT),
|
||||
guard[0].agent_id,
|
||||
guard[0].script_path,
|
||||
success[0].script_path,
|
||||
))
|
||||
return contracts
|
||||
Reference in new issue
Block a user