fix(parser): handle redirects in command rule matching (#102)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: fohte

src/rules/command_parser.rs

@@ -279,6 +279,23 @@ fn collect_commands(node: tree_sitter::Node, source: &[u8], commands: &mut Vec<S
                 }
             }
         }
+        // redirected_statement: recurse into the body (the actual command),
+        // stripping redirect operators (>, >>, <, 2>&1, etc.).
+        // Redirect target paths are left to the OS-level sandbox to enforce.
+        // Also recurse into redirect children to extract nested commands
+        // (e.g. process substitutions: `cmd > >(nested_cmd)`).
+        "redirected_statement" => {
+            if let Some(body) = node.child_by_field_name("body") {
+                collect_commands(body, source, commands);
+            }
+            for i in 0..node.child_count() {
+                if node.field_name_for_child(i as u32) == Some("redirect")
+                    && let Some(child) = node.child(i)
+                {
+                    collect_substitutions_recursive(child, source, commands);
+                }
+            }
+        }
         // comment: skip shell comments (e.g. `# description`)
         "comment" => {}
         // variable_assignment: transparent container — skip the assignment itself
@@ -295,27 +312,49 @@ fn collect_commands(node: tree_sitter::Node, source: &[u8], commands: &mut Vec<S
             }
         }
         // command node: strip leading variable_assignment children
-        // (environment variable prefixes like `FOO=bar echo hello`), extract
-        // nested command_substitution nodes, and emit the remaining text.
+        // (environment variable prefixes like `FOO=bar echo hello`), strip
+        // redirect children (herestring_redirect, etc. that tree-sitter
+        // attaches directly to a command node), extract nested
+        // command_substitution nodes, and emit the remaining text.
         "command" => {
-            let mut cursor = node.walk();
-            for child in node.named_children(&mut cursor) {
-                match child.kind() {
-                    "command_substitution" => {
-                        collect_commands(child, source, commands);
-                    }
-                    "variable_assignment" => {
-                        collect_substitutions_recursive(child, source, commands);
+            for i in 0..node.child_count() {
+                let Some(child) = node.child(i) else {
+                    continue;
+                };
+                if !child.is_named() {
+                    continue;
+                }
+                if node.field_name_for_child(i as u32) == Some("redirect") {
+                    // Recurse into redirect children for nested substitutions
+                    // (e.g. `cat <<< $(secret_cmd)`)
+                    collect_substitutions_recursive(child, source, commands);
+                } else {
+                    match child.kind() {
+                        "command_substitution" => {
+                            collect_commands(child, source, commands);
+                        }
+                        "variable_assignment" => {
+                            collect_substitutions_recursive(child, source, commands);
+                        }
+                        _ => {}
                     }
-                    _ => {}
                 }
             }
-            // Build command text excluding variable_assignment children
-            let mut cursor = node.walk();
-            let parts: Vec<&str> = node
-                .named_children(&mut cursor)
-                .filter(|child| child.kind() != "variable_assignment")
-                .filter_map(|child| {
+            // Build command text excluding variable_assignment and redirect children.
+            // Redirects (e.g. herestring_redirect) attached directly to a command
+            // node use the field name "redirect".
+            let parts: Vec<&str> = (0..node.child_count())
+                .filter_map(|i| {
+                    let child = node.child(i)?;
+                    if !child.is_named() {
+                        return None;
+                    }
+                    if child.kind() == "variable_assignment" {
+                        return None;
+                    }
+                    if node.field_name_for_child(i as u32) == Some("redirect") {
+                        return None;
+                    }
                     let text = &source[child.start_byte()..child.end_byte()];
                     std::str::from_utf8(text).ok()
                 })
@@ -601,7 +640,50 @@ mod tests {
         "}
         .trim_end();
         let result = extract_commands(input).unwrap();
-        assert_eq!(result, vec![input]);
+        // heredoc is a redirected_statement; only the body command is extracted
+        assert_eq!(result, vec!["cat"]);
+    }
+
+    // ========================================
+    // extract_commands: redirected statements
+    // ========================================
+
+    #[rstest]
+    #[case::stdout_to_file("echo hello > file.txt", vec!["echo hello"])]
+    #[case::append_to_file("echo hello >> file.txt", vec!["echo hello"])]
+    #[case::stdin_from_file("cat < input.txt", vec!["cat"])]
+    #[case::stderr_to_devnull("cmd 2> /dev/null", vec!["cmd"])]
+    #[case::stdout_and_stderr("cmd > out.txt 2>&1", vec!["cmd"])]
+    #[case::fd_redirect_only("echo hello 2>&1", vec!["echo hello"])]
+    #[case::devnull_redirect("curl url > /dev/null", vec!["curl url"])]
+    #[case::herestring("cat <<< hello", vec!["cat"])]
+    #[case::redirect_with_pipeline(
+        "echo hello 2>&1 | grep world",
+        vec!["echo hello", "grep world"],
+    )]
+    #[case::redirect_with_list(
+        "echo hello > file.txt && cat file.txt",
+        vec!["echo hello", "cat file.txt"],
+    )]
+    #[case::redirect_in_compound(
+        r#"X="test" && echo "$X" 2>&1"#,
+        vec![r#"echo "$X""#],
+    )]
+    #[case::process_substitution_in_redirect(
+        "cmd > >(nested_cmd)",
+        vec!["cmd", "nested_cmd"],
+    )]
+    #[case::command_substitution_in_redirect(
+        "cmd > $(echo /tmp/file)",
+        vec!["cmd", "echo /tmp/file"],
+    )]
+    #[case::command_substitution_in_herestring(
+        "cat <<< $(secret_cmd)",
+        vec!["secret_cmd", "cat"],
+    )]
+    fn extract_redirected_statements(#[case] input: &str, #[case] expected: Vec<&str>) {
+        let result = extract_commands(input).unwrap();
+        assert_eq!(result, expected);
     }
 
     // ========================================

tests/integration/compound_command_evaluation.rs

@@ -333,6 +333,53 @@ fn unmatched_sub_command_uses_defaults_action(
     expected(&result.action);
 }
 
+// ========================================
+// Redirected statements: redirects are stripped before rule evaluation
+// ========================================
+
+#[rstest]
+#[case::stdout_redirect(
+    "echo hello > file.txt",
+    assert_allow as ActionAssertion,
+)]
+#[case::stderr_redirect(
+    "git branch --help 2>&1",
+    assert_allow as ActionAssertion,
+)]
+#[case::devnull_redirect(
+    "echo hello > /dev/null 2>&1",
+    assert_allow as ActionAssertion,
+)]
+#[case::compound_with_redirect(
+    r#"X="test" && echo "$X" 2>&1"#,
+    assert_allow as ActionAssertion,
+)]
+#[case::deny_still_works_with_redirect(
+    "rm -rf /tmp/data > /dev/null 2>&1",
+    assert_deny as ActionAssertion,
+)]
+#[case::redirect_in_pipeline(
+    "echo hello 2>&1 | grep world",
+    assert_allow as ActionAssertion,
+)]
+fn redirected_statements_match_rules(
+    #[case] command: &str,
+    #[case] expected: ActionAssertion,
+    empty_context: EvalContext,
+) {
+    let config = parse_config(indoc! {"
+        rules:
+          - allow: 'echo *'
+          - allow: 'git *'
+          - allow: 'grep *'
+          - deny: 'rm -rf *'
+    "})
+    .unwrap();
+
+    let result = evaluate_compound(&config, command, &empty_context).unwrap();
+    expected(&result.action);
+}
+
 // ========================================
 // Execution mode: compound commands are represented as Shell input (sh -c)
 // ========================================