implement dcg

Author: navedmerchant

packages/types/src/global-settings.ts

@@ -137,6 +137,7 @@ export const globalSettingsSchema = z.object({
 	alwaysAllowSubtasks: z.boolean().optional(),
 	alwaysAllowExecute: z.boolean().optional(),
 	alwaysAllowCommandsExceptDenied: z.boolean().optional(),
+	destructiveCommandGuardEnabled: z.boolean().optional(),
 	alwaysAllowFollowupQuestions: z.boolean().optional(),
 	followupAutoApproveTimeoutMs: z.number().optional(),
 	allowedCommands: z.array(z.string()).optional(),

packages/types/src/vscode-extension-host.ts

@@ -275,6 +275,7 @@ export type ExtensionState = Pick<
 	| "alwaysAllowFollowupQuestions"
 	| "alwaysAllowExecute"
 	| "alwaysAllowCommandsExceptDenied"
+	| "destructiveCommandGuardEnabled"
 	| "followupAutoApproveTimeoutMs"
 	| "allowedCommands"
 	| "deniedCommands"

src/core/auto-approval/__tests__/dcg.spec.ts

@@ -0,0 +1,40 @@
+import { checkAutoApproval } from ".."
+
+describe("Destructive Command Guard auto-approval precedence", () => {
+	const baseState = {
+		autoApprovalEnabled: true,
+		alwaysAllowExecute: true,
+		alwaysAllowReadOnly: false,
+		alwaysAllowReadOnlyOutsideWorkspace: false,
+		alwaysAllowWrite: false,
+		alwaysAllowWriteOutsideWorkspace: false,
+		alwaysAllowWriteProtected: false,
+		alwaysAllowMcp: false,
+		alwaysAllowModeSwitch: false,
+		alwaysAllowSubtasks: false,
+		alwaysAllowFollowupQuestions: false,
+		allowedCommands: ["echo"],
+		deniedCommands: ["rm"],
+		alwaysAllowCommandsExceptDenied: false,
+		destructiveCommandGuardEnabled: true,
+		mcpServers: [],
+	}
+
+	it("ignores Zoo's deny list while DCG is enabled", async () => {
+		expect(await checkAutoApproval({ state: baseState, ask: "command", text: "rm file" })).toEqual({
+			decision: "ask",
+		})
+	})
+
+	it("requires explicit approval for a DCG-protected command", async () => {
+		expect(
+			await checkAutoApproval({ state: baseState, ask: "command", text: "echo safe", isProtected: true }),
+		).toEqual({ decision: "ask" })
+	})
+
+	it("retains ordinary allowlist auto-approval for DCG-allowed commands", async () => {
+		expect(await checkAutoApproval({ state: baseState, ask: "command", text: "echo safe" })).toEqual({
+			decision: "approve",
+		})
+	})
+})

src/core/auto-approval/index.ts

@@ -34,6 +34,7 @@ export type AutoApprovalStateOptions =
 	| "allowedCommands" // For `alwaysAllowExecute`.
 	| "deniedCommands"
 	| "alwaysAllowCommandsExceptDenied"
+	| "destructiveCommandGuardEnabled"
 
 export type CheckAutoApprovalResult =
 	| { decision: "approve" }
@@ -116,12 +117,17 @@ export async function checkAutoApproval({
 		if (!text) {
 			return { decision: "ask" }
 		}
+		if (isProtected) {
+			return { decision: "ask" }
+		}
 
+		// DCG only changes commands that its policy blocks. Commands that pass
+		// continue through Zoo's existing allowlist/permission flow.
 		if (state.alwaysAllowExecute === true) {
 			const decision = getCommandDecision(
 				text,
 				state.allowedCommands || [],
-				state.deniedCommands || [],
+				state.destructiveCommandGuardEnabled === true ? [] : state.deniedCommands || [],
 				state.alwaysAllowCommandsExceptDenied === true,
 			)
 

src/core/tools/ExecuteCommandTool.ts

@@ -115,16 +115,42 @@ export class ExecuteCommandTool extends BaseTool<"execute_command"> {
 				return
 			}
 
-			const didApprove = await askApproval("command", canonicalCommand)
+			const provider = await task.providerRef.deref()
+			const providerState = await provider?.getState()
+			let dcgBlocked = false
+			if (providerState?.destructiveCommandGuardEnabled === true) {
+				const { getDcgBinaryPath, runDcg } = await import("../../services/destructive-command-guard")
+				const binaryPath = provider ? getDcgBinaryPath(provider.context.globalStorageUri.fsPath) : undefined
+				if (!binaryPath) {
+					throw new Error("Destructive Command Guard is enabled but is not available for this platform")
+				}
+				const workingDirectory = customCwd
+					? path.isAbsolute(customCwd)
+						? customCwd
+						: path.resolve(task.cwd, customCwd)
+					: task.cwd
+				const dcgResult = await runDcg(binaryPath, canonicalCommand, workingDirectory)
+				dcgBlocked = dcgResult.decision === "deny"
+				if (dcgResult.decision === "deny") {
+					await task.say(
+						"text",
+						`Destructive Command Guard blocked this command${dcgResult.reason ? `: ${dcgResult.reason}` : "."}${dcgResult.ruleId ? ` (Rule: ${dcgResult.ruleId})` : ""}`,
+					)
+				}
+			}
+
+			// A DCG block is intentionally presented as Zoo's normal command approval
+			// prompt. Passing isProtected bypasses command auto-approval so the user
+			// must explicitly choose whether to execute it.
+			const didApprove = dcgBlocked
+				? await askApproval("command", canonicalCommand, undefined, true)
+				: await askApproval("command", canonicalCommand)
 
 			if (!didApprove) {
 				return
 			}
 
 			const executionId = task.lastMessageTs?.toString() ?? Date.now().toString()
-			const provider = await task.providerRef.deref()
-			const providerState = await provider?.getState()
-
 			const { terminalShellIntegrationDisabled = true } = providerState ?? {}
 
 			// Get command execution timeout from VSCode configuration (in seconds)

src/core/webview/ClineProvider.ts

@@ -2311,6 +2311,7 @@ export class ClineProvider
 			alwaysAllowWriteProtected,
 			alwaysAllowExecute,
 			alwaysAllowCommandsExceptDenied,
+			destructiveCommandGuardEnabled,
 			allowedCommands,
 			deniedCommands,
 			alwaysAllowMcp,
@@ -2461,6 +2462,7 @@ export class ClineProvider
 			alwaysAllowWriteProtected: alwaysAllowWriteProtected ?? false,
 			alwaysAllowExecute: alwaysAllowExecute ?? false,
 			alwaysAllowCommandsExceptDenied: alwaysAllowCommandsExceptDenied ?? false,
+			destructiveCommandGuardEnabled: destructiveCommandGuardEnabled ?? false,
 			alwaysAllowMcp: alwaysAllowMcp ?? false,
 			alwaysAllowModeSwitch: alwaysAllowModeSwitch ?? false,
 			alwaysAllowSubtasks: alwaysAllowSubtasks ?? false,
@@ -2694,6 +2696,7 @@ export class ClineProvider
 			alwaysAllowWriteProtected: stateValues.alwaysAllowWriteProtected ?? false,
 			alwaysAllowExecute: stateValues.alwaysAllowExecute ?? false,
 			alwaysAllowCommandsExceptDenied: stateValues.alwaysAllowCommandsExceptDenied ?? false,
+			destructiveCommandGuardEnabled: stateValues.destructiveCommandGuardEnabled ?? false,
 			alwaysAllowMcp: stateValues.alwaysAllowMcp ?? false,
 			alwaysAllowModeSwitch: stateValues.alwaysAllowModeSwitch ?? false,
 			alwaysAllowSubtasks: stateValues.alwaysAllowSubtasks ?? false,

src/core/webview/__tests__/ClineProvider.spec.ts

@@ -1020,6 +1020,15 @@ describe("ClineProvider", () => {
 		expect(state.alwaysAllowCommandsExceptDenied).toBe(true)
 	})
 
+	test("getStateToPostToWebview returns the saved destructive command guard setting", async () => {
+		await provider.resolveWebviewView(mockWebviewView)
+		await provider.contextProxy.setValue("destructiveCommandGuardEnabled", true)
+
+		const state = await provider.getStateToPostToWebview()
+
+		expect(state.destructiveCommandGuardEnabled).toBe(true)
+	})
+
 	test("language is set to VSCode language", async () => {
 		// Mock VSCode language as Spanish
 		;(vscode.env as any).language = "pt-BR"

src/core/webview/webviewMessageHandler.ts

@@ -681,6 +681,18 @@ export const webviewMessageHandler = async (
 
 		case "updateSettings":
 			if (message.updatedSettings) {
+				if (message.updatedSettings.destructiveCommandGuardEnabled === true) {
+					try {
+						const { ensureDcgInstalled } = await import("../../services/destructive-command-guard")
+						await ensureDcgInstalled(provider.context.globalStorageUri.fsPath)
+					} catch (error) {
+						message.updatedSettings.destructiveCommandGuardEnabled = false
+						vscode.window.showErrorMessage(
+							`Unable to enable Destructive Command Guard: ${error instanceof Error ? error.message : String(error)}`,
+						)
+					}
+				}
+
 				for (const [key, value] of Object.entries(message.updatedSettings)) {
 					let newValue = value
 

src/services/destructive-command-guard/__tests__/manager.spec.ts

@@ -0,0 +1,28 @@
+import { DCG_ARCHIVES } from "../constants"
+import { getDcgArchiveInfo, getDcgBinaryPath, isDcgSupportedPlatform } from "../manager"
+
+describe("Destructive Command Guard manager", () => {
+	it("maps all supported platform and architecture combinations", () => {
+		expect(Object.keys(DCG_ARCHIVES).sort()).toEqual([
+			"darwin-arm64",
+			"darwin-x64",
+			"linux-arm64",
+			"linux-x64",
+			"win32-arm64",
+			"win32-x64",
+		])
+		expect(getDcgArchiveInfo("darwin", "arm64")?.archive).toBe("dcg-aarch64-apple-darwin.tar.xz")
+		expect(getDcgArchiveInfo("win32", "x64")?.binary).toBe("dcg.exe")
+	})
+
+	it("rejects unsupported platforms", () => {
+		expect(isDcgSupportedPlatform("freebsd", "x64")).toBe(false)
+		expect(getDcgBinaryPath("/storage", "freebsd", "x64")).toBeUndefined()
+	})
+
+	it("returns a versioned managed binary path", () => {
+		expect(getDcgBinaryPath("/storage", "linux", "x64")).toMatch(
+			/[/\\]destructive-command-guard[/\\]v0\.7\.7[/\\]dcg$/,
+		)
+	})
+})

src/services/destructive-command-guard/constants.ts

@@ -0,0 +1,53 @@
+export const DCG_VERSION = "v0.7.7"
+
+export type DcgArchiveInfo = {
+	archive: string
+	binary: "dcg" | "dcg.exe"
+	sha256: string
+}
+
+export const DCG_ARCHIVES: Readonly<Record<string, DcgArchiveInfo>> = {
+	"darwin-arm64": {
+		archive: "dcg-aarch64-apple-darwin.tar.xz",
+		binary: "dcg",
+		sha256: "a63cf82bd3584055112d5ec7a4ab3d7e0619a9f806a53930c27aa0e6297484de",
+	},
+	"darwin-x64": {
+		archive: "dcg-x86_64-apple-darwin.tar.xz",
+		binary: "dcg",
+		sha256: "15b42fbbbeab47123899e6328d90cd593e14999f3d275f71294815ad8ed9479c",
+	},
+	"linux-arm64": {
+		archive: "dcg-aarch64-unknown-linux-gnu.tar.xz",
+		binary: "dcg",
+		sha256: "abb0d94f23ab50f9edc16f8ca6939ff8eec23e1831d3ad7a28d9f03252c3306d",
+	},
+	"linux-x64": {
+		archive: "dcg-x86_64-unknown-linux-musl.tar.xz",
+		binary: "dcg",
+		sha256: "472b130a9b235edc57e6cb7566641da5fef905e9dbefd3a46f9ad1e33205fa04",
+	},
+	"win32-arm64": {
+		archive: "dcg-aarch64-pc-windows-msvc.zip",
+		binary: "dcg.exe",
+		sha256: "93d4c71860086db00bea3aa957051cef38eac572422fa40b2a045c8cd578c3b5",
+	},
+	"win32-x64": {
+		archive: "dcg-x86_64-pc-windows-msvc.zip",
+		binary: "dcg.exe",
+		sha256: "435127410eabc53e772be4f5c668a875b45fbaf806654b577c2d975bd0e38964",
+	},
+}
+
+export const DCG_DOWNLOAD_BASE_URL = `https://github.com/Dicklesworthstone/destructive_command_guard/releases/download/${DCG_VERSION}`
+
+export const DCG_MAX_ARCHIVE_BYTES = 16 * 1024 * 1024
+export const DCG_DOWNLOAD_TIMEOUT_MS = 60_000
+export const DCG_RUN_TIMEOUT_MS = 3_000
+export const DCG_MAX_OUTPUT_BYTES = 256 * 1024
+
+export const DCG_TRUSTED_DOWNLOAD_DOMAINS = [
+	"github.com",
+	"objects.githubusercontent.com",
+	"release-assets.githubusercontent.com",
+] as const