Skip to content

Add --restricted mode to block dangerous commands for AI agents #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
scottgl9 merged 1 commit into from
Jan 21, 2026
Merged

Add --restricted mode to block dangerous commands for AI agents #4

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
142 changes: 77 additions & 65 deletions PROGRESS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,30 +1,31 @@
# thop Implementation Progress

**Architecture**: Shell Wrapper (v0.2.0)
**Languages**: Evaluating Go and Rust
**Languages**: Go (primary), Rust (maintained)

## Overview

| Phase | Status | Progress |
|-------|--------|----------|
| Phase 0: Language Evaluation | Complete | 100% |
| Phase 1: Core MVP | Not Started | 0% |
| Phase 2: Robustness | Not Started | 0% |
| Phase 3: Polish | Not Started | 0% |
| Phase 4: Advanced | Not Started | 0% |
| Testing | In Progress | 50% |
| Documentation | In Progress | 60% |
| Phase 1: Core MVP | Complete | 100% |
| Phase 2: Robustness | Complete | 100% |
| Phase 3: Polish | Complete | 100% |
| Phase 4: Advanced | Complete | 90% |
| Testing | Complete | 90% |
| Documentation | Complete | 80% |

**Overall Progress**: 30%
**Overall Progress**: 95%

---

## Phase 0: Language Evaluation
## Phase 0: Language Evaluation ✅

### Go Prototype (`thop-go/`) - COMPLETE

**Binary Size**: 4.8MB (release), 7.2MB (debug)
**Build Time**: Fast (~2s)
**Tests**: 105 passing

#### Project Setup
| Task | Status | Notes |
Expand Down Expand Up @@ -90,8 +91,8 @@
| Task | Status | Notes |
|------|--------|-------|
| Initialize Cargo project | Complete | Cargo.toml |
| Add dependencies | Complete | clap, toml, serde, ssh2, chrono |
| Create project structure | Complete | src/{cli,config,session,state}/ |
| Add dependencies | Complete | clap, toml, serde, ssh2, chrono, regex |
| Create project structure | Complete | src/{cli,config,session,state,restriction}/ |

#### Interactive Mode
| Task | Status | Notes |
Expand Down Expand Up @@ -128,6 +129,7 @@
| Task | Status | Notes |
|------|--------|-------|
| `--proxy` flag | Complete | SHELL compatible |
| `--restricted` flag | Complete | Blocks dangerous commands |
| Stdin reading | Complete | Line-by-line |
| Session routing | Complete | To active session |
| Output handling | Complete | Passthrough |
Expand All @@ -140,81 +142,85 @@

---

### Evaluation
### Evaluation ✅
| Task | Status | Notes |
|------|--------|-------|
| Code complexity comparison | Complete | Both are similar in complexity |
| Binary size measurement | Complete | Go: 4.8MB, Rust: 1.4MB |
| Startup time measurement | Complete | Both fast (<100ms) |
| SSH library evaluation | Complete | Both work well |
| Developer experience notes | Complete | Go faster to write, Rust more explicit |
| Language selection decision | Pending | Both prototypes complete, user can choose |
| Language selection decision | Complete | Go chosen for faster development |

---

## Phase 1: Core MVP

*Blocked until Phase 0 complete and language selected*
## Phase 1: Core MVP ✅

| Component | Status | Notes |
|-----------|--------|-------|
| Interactive Mode | Not Started | |
| Local Session | Not Started | |
| SSH Session | Not Started | |
| Slash Commands | Not Started | |
| Proxy Mode | Not Started | |
| State Management | Not Started | |
| Configuration | Not Started | |
| Error Handling | Not Started | |
| Interactive Mode | Complete | Full readline, prompt with cwd |
| Local Session | Complete | State tracking, env vars |
| SSH Session | Complete | Key auth, agent support |
| Slash Commands | Complete | All commands implemented |
| Proxy Mode | Complete | SHELL compatible |
| State Management | Complete | File-based with locking |
| Configuration | Complete | TOML with env overrides |
| Error Handling | Complete | Structured JSON errors |

---

## Phase 2: Robustness

*Blocked until Phase 1 complete*
## Phase 2: Robustness ✅

| Component | Status | Notes |
|-----------|--------|-------|
| Multiple Sessions | Not Started | |
| Reconnection | Not Started | |
| State Persistence | Not Started | |
| Command Handling | Not Started | |
| Multiple Sessions | Complete | Concurrent SSH sessions |
| Reconnection | Complete | Exponential backoff |
| State Persistence | Complete | Survives restart |
| Command Handling | Complete | Timeout, signal forwarding |

---

## Phase 3: Polish

*Blocked until Phase 2 complete*
## Phase 3: Polish ✅

| Component | Status | Notes |
|-----------|--------|-------|
| SSH Integration | Not Started | |
| Authentication | Not Started | |
| Logging | Not Started | |
| CLI Polish | Not Started | |
| SSH Integration | Complete | Full ~/.ssh/config, jump hosts |
| Authentication | Complete | /auth, /trust, password_env |
| Logging | Complete | Configurable levels |
| CLI Polish | Complete | --status, --json, --restricted, completions |

---
### Restricted Mode (NEW)
| Task | Status | Notes |
|------|--------|-------|
| `--restricted` flag (Go) | Complete | Blocks dangerous commands |
| `--restricted` flag (Rust) | Complete | Blocks dangerous commands |
| Privilege escalation blocking | Complete | sudo, su, doas, pkexec |
| Destructive file ops blocking | Complete | rm, rmdir, shred, dd, etc. |
| System modification blocking | Complete | chmod, chown, mkfs, systemctl, etc. |
| Structured error messages | Complete | Category + suggestion |

## Phase 4: Advanced Features
---

*Blocked until Phase 3 complete*
## Phase 4: Advanced Features ✅

| Component | Status | Notes |
|-----------|--------|-------|
| PTY Support | Not Started | |
| Async Execution | Not Started | |
| MCP Server | Not Started | |
| PTY Support | Complete | /shell command |
| Window Resize | Complete | SIGWINCH handling |
| Command History | Complete | Per-session history |
| Async Execution | Complete | /bg, /jobs, /fg, /kill |
| MCP Server | Complete | 77.1% test coverage |

---

## Testing Progress

| Category | Status | Notes |
|----------|--------|-------|
| Unit Tests | Complete | Go: 34 tests, Rust: 32 tests |
| Integration Tests | Not Started | |
| E2E Tests | Not Started | |
| Test Infrastructure | Complete | make test in both projects |
| Unit Tests | Complete | Go: 105 tests, Rust: 32 tests |
| Integration Tests | Complete | Docker-based SSH tests |
| E2E Tests | In Progress | Proxy mode testing needed |
| Test Infrastructure | Complete | GitHub Actions CI |

---

Expand All @@ -228,16 +234,31 @@
| PROGRESS.md | Complete | This file |
| CLAUDE.md | Complete | Development guide |
| AGENTS.md | Complete | Agent development guide |
| README.md | Not Started | |
| Installation guide | Not Started | |
| Configuration reference | Not Started | |
| README.md | Complete | Quick start guide |
| Installation guide | Complete | In README |
| Configuration reference | Complete | In README |
| MCP_IMPROVEMENTS.md | Complete | Future enhancements |

---

## Changelog

### 2026-01-16 (latest)
- Completed Go prototype with full test suite (34 tests)
### 2026-01-19 (latest)
- Added `--restricted` mode to both Go and Rust implementations
- Blocks dangerous commands for AI agent safety:
- Privilege escalation (sudo, su, doas)
- Destructive file operations (rm, rmdir, shred, dd)
- System modifications (chmod, chown, mkfs, systemctl)
- Usage: `SHELL="thop --proxy --restricted" claude`

### 2026-01-17
- Added MCP server mode with full JSON-RPC 2.0 support
- Achieved 77.1% test coverage on MCP server
- Added async command execution (/bg, /jobs, /fg, /kill)
- Added PTY support via /shell command

### 2026-01-16
- Completed Go prototype with full test suite (105 tests)
- Completed Rust prototype with full test suite (32 tests)
- Both implementations working:
- Interactive mode with slash commands
Expand All @@ -247,22 +268,13 @@
- State persistence
- TOML configuration
- Binary sizes: Go 4.8MB, Rust 1.4MB
- Added macOS cross-platform compatibility
- Set up GitHub Actions CI with Codecov integration

### 2026-01-16
### 2026-01-16 (earlier)
- Updated architecture from daemon to shell wrapper
- Added Phase 0 for Go/Rust language evaluation
- Created RESEARCH.md with architecture decisions
- Updated all documentation for new approach:
- PRD.md v0.2.0
- TODO.md reorganized by phase
- CLAUDE.md updated
- AGENTS.md updated
- PROGRESS.md updated

### 2026-01-16 (earlier)
- Created initial project documentation
- PRD.md v0.1.0 (daemon architecture)
- Initial TODO.md, PROGRESS.md, CLAUDE.md, AGENTS.md

---

Expand Down
1 change: 1 addition & 0 deletions TODO.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,6 +158,7 @@ After language selection, implement full MVP in chosen language.
- [x] Shell completions for bash
- [x] Shell completions for zsh
- [x] Shell completions for fish
- [x] `--restricted` flag to block dangerous commands for AI agents

---

Expand Down
53 changes: 36 additions & 17 deletions thop-go/internal/cli/app.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,25 +34,26 @@ type App struct {
GitCommit string
BuildTime string

config *config.Config
state *state.Manager
sessions *session.Manager
configPath string
proxyMode bool
proxyCommand string // Command to execute in proxy mode (-c flag)
mcpMode bool // Run as MCP server
jsonOutput bool
showStatus bool
completions string // Shell name for completions
verbose bool
quiet bool
config *config.Config
state *state.Manager
sessions *session.Manager
configPath string
proxyMode bool
proxyCommand string // Command to execute in proxy mode (-c flag)
mcpMode bool // Run as MCP server
restrictedMode bool // Restrict dangerous/destructive operations for AI agents
jsonOutput bool
showStatus bool
completions string // Shell name for completions
verbose bool
quiet bool

// readline instance for interactive mode (nil when not in interactive mode)
rl *readline.Instance

// Background job tracking
bgJobs map[int]*BackgroundJob
bgJobsMu sync.RWMutex
bgJobs map[int]*BackgroundJob
bgJobsMu sync.RWMutex
nextJobID int
}

Expand Down Expand Up @@ -120,7 +121,8 @@ func (a *App) Run(args []string) error {

// Initialize session manager
a.sessions = session.NewManager(cfg, a.state)
logger.Debug("session manager initialized with %d sessions", len(cfg.Sessions))
a.sessions.SetRestrictedMode(a.restrictedMode)
logger.Debug("session manager initialized with %d sessions, restricted=%v", len(cfg.Sessions), a.restrictedMode)

// Handle special flags
if a.showStatus {
Expand All @@ -146,6 +148,7 @@ func (a *App) parseFlags(args []string) error {

flags.BoolVar(&a.proxyMode, "proxy", false, "Run in proxy mode (for AI agents)")
flags.BoolVar(&a.mcpMode, "mcp", false, "Run as MCP server")
flags.BoolVar(&a.restrictedMode, "restricted", false, "Restrict dangerous/destructive operations (for AI agents)")
flags.StringVar(&a.proxyCommand, "c", "", "Execute command (for shell compatibility)")
flags.BoolVar(&a.showStatus, "status", false, "Show status and exit")
flags.StringVar(&a.configPath, "config", "", "Path to config file")
Expand Down Expand Up @@ -210,6 +213,7 @@ USAGE:
OPTIONS:
--proxy Run in proxy mode (SHELL compatible)
--mcp Run as MCP (Model Context Protocol) server
--restricted Block dangerous/destructive commands (for AI agents)
-c <command> Execute command and exit with its exit code
--status Show all sessions and exit
--config <path> Use alternate config file
Expand All @@ -220,6 +224,21 @@ OPTIONS:
-h, --help Print help information
-V, --version Print version

RESTRICTED MODE:
When --restricted is enabled, the following command categories are blocked:

Privilege Escalation:
sudo, su, doas, pkexec

Destructive File Operations:
rm, rmdir, shred, wipe, srm, unlink, dd, truncate (to 0)

System Modifications:
chmod, chown, chgrp, chattr, mkfs, fdisk, parted, mount, umount,
shutdown, reboot, poweroff, halt, useradd, userdel, usermod,
groupadd, groupdel, passwd, systemctl, service, insmod, rmmod,
modprobe, setenforce, aa-enforce, aa-complain

INTERACTIVE MODE COMMANDS:
/connect <session> Establish SSH connection
/switch <session> Change active context
Expand All @@ -241,8 +260,8 @@ EXAMPLES:
# Execute single command
thop -c "ls -la"

# Use as shell for AI agent
SHELL="thop --proxy" claude
# Use as shell for AI agent with safety restrictions
SHELL="thop --proxy --restricted" claude

# Check status
thop --status
Expand Down
Loading
Loading