@ai-support-agent/cli 0.1.9-beta.0 → 0.1.10-beta.0

package/dist/security.js

@@ -37,6 +37,8 @@ exports.SAFE_ENV_KEYS = exports.ALLOWED_SIGNALS = exports.BLOCKED_PATH_PREFIXES
 exports.getSensitiveHomePaths = getSensitiveHomePaths;
 exports.buildSafeEnv = buildSafeEnv;
 exports.validateCommand = validateCommand;
+exports.isProjectCodeSafe = isProjectCodeSafe;
+exports.assertProjectCodeIsSafe = assertProjectCodeIsSafe;
 exports.validateBindMountPathSync = validateBindMountPathSync;
 exports.validateFilePath = validateFilePath;
 exports.resolveAndValidatePath = resolveAndValidatePath;
@@ -44,6 +46,7 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const constants_1 = require("./constants");
+const i18n_1 = require("./i18n");
 const utils_1 = require("./utils");
 exports.BLOCKED_COMMAND_PATTERNS = [
     /\brm\s+-rf\s+\/(?!\w)/,
@@ -97,6 +100,36 @@ function validateCommand(command) {
     }
     return null;
 }
+/**
+ * Pure predicate variant of `assertProjectCodeIsSafe`. Use this when you
+ * only need a yes/no answer (e.g. pre-pass filters) without paying the
+ * i18n + Error construction cost the assert variant incurs on every
+ * rejected input.
+ */
+function isProjectCodeSafe(projectCode) {
+    return /^[A-Za-z0-9_-]+$/.test(projectCode);
+}
+/**
+ * Reject projectCodes / tenantCodes whose characters would break the
+ * `AI_SUPPORT_AGENT_PROJECT_DIR_MAP` env format.
+ *
+ * The env value uses `;` as entry separator and `=` as key/value separator;
+ * a code containing either would silently truncate the map and let
+ * `resolveProjectDir()` fall back to the default template, silently
+ * re-introducing the doubly-nested layout the recent fixes prevent.
+ * Allow `[A-Za-z0-9_-]` only — matching the naming convention
+ * (UPPER_SNAKE_CASE for project, lower_snake_case for tenant).
+ *
+ * Lives in `security.ts` (not `cli/service/wrapper-helpers.ts`) because
+ * it's called by both the install path (cli/service/*) AND the docker
+ * supervisor path (docker/volume-mount-builder.ts). Keeping it here
+ * avoids a layering inversion where `docker/*` reaches into `cli/*`.
+ */
+function assertProjectCodeIsSafe(projectCode) {
+    if (!isProjectCodeSafe(projectCode)) {
+        throw new Error((0, i18n_1.t)('service.invalidProjectCode', { projectCode }));
+    }
+}
 /**
  * Synchronous variant of `validateFilePath`'s blocked-prefix check, for use
  * at script-generation / install time where async fs APIs aren't available.
@@ -105,6 +138,14 @@ function validateCommand(command) {
  * is OK to bind-mount into a container.
  */
 function validateBindMountPathSync(hostPath) {
+    // Empty / falsy / whitespace-only path: reject up front. `fs.realpathSync('')`
+    // returns the process cwd (and `realpathSync(' ')` throws → falls back to
+    // `path.resolve(' ')` = `<cwd>/ `) which then likely passes the
+    // blocked-prefix check, making the function answer "safe" for what is
+    // clearly a misconfigured value.
+    if (!hostPath || !hostPath.trim()) {
+        return 'Access denied: empty path';
+    }
     let resolved;
     try {
         const real = fs.realpathSync(hostPath);

package/dist/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CA,sDAKC;AAED,oCAMC;AAED,0CAOC;AASD,8DAgBC;AAED,4CAwBC;AAED,wDAkBC;AAzID,uCAAwB;AACxB,uCAAwB;AACxB,2CAA4B;AAE5B,2CAAwD;AAExD,mCAAqC;AAExB,QAAA,wBAAwB,GAAG;IACtC,uBAAuB;IACvB,2CAA2C,EAAG,qBAAqB;IACnE,UAAU;IACV,UAAU;IACV,qBAAqB;IACrB,uBAAuB,EAA0B,qCAAqC;IACtF,oBAAoB;IACpB,qBAAqB;IACrB,yBAAyB,EAAwB,gBAAgB;IACjE,yBAAyB,EAAwB,gBAAgB;IACjE,wDAAwD;IACxD,gFAAgF;IAChF,kEAAkE;IAClE,uCAAuC,EAAS,sCAAsC;IACtF,8DAA8D,EAAG,+BAA+B;IAChG,8DAA8D,EAAG,+BAA+B;CACjG,CAAA;AAEY,QAAA,qBAAqB,GAAG;IACnC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO;IACnC,mCAAmC;IACnC,eAAe,EAAE,kBAAkB;CACpC,CAAA;AAEY,QAAA,eAAe,GAAwB,IAAI,GAAG,CAAC;IAC1D,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ;CACpD,CAAC,CAAA;AAEW,QAAA,aAAa,GAAsB;IAC9C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa;IAChE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU;IAC3C,UAAU;IACV,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;CAC7D,CAAA;AAED,SAAgB,qBAAqB;IACnC,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAA;IACzB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC,GAAG,CACrD,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CACpC,CAAA;AACH,CAAC;AAED,SAAgB,YAAY;IAC1B,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,GAAG,IAAI,qBAAa,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAE,CAAA;IAClE,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAgB,eAAe,CAAC,OAAe;IAC7C,KAAK,MAAM,OAAO,IAAI,gCAAwB,EAAE,CAAC;QAC/C,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO,gDAAgD,CAAA;QACzD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,yBAAyB,CAAC,QAAgB;IACxD,IAAI,QAAgB,CAAA;IACpB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;QACtC,QAAQ,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IACnC,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,GAAG,6BAAqB,EAAE,GAAG,qBAAqB,EAAE,CAAC,CAAA;IACzE,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QACpD,IAAI,QAAQ,KAAK,kBAAkB,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,kBAAkB,MAAM,oBAAoB,CAAA;QACrD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAEM,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,OAAgB;IACvE,2EAA2E;IAC3E,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;IACpG,IAAI,QAAgB,CAAA;IACpB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;QAChF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC,CAAA;QACtE,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;YACxD,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,EAAE,SAAS,CAAC,CAAA;QACnD,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,GAAG,6BAAqB,EAAE,GAAG,qBAAqB,EAAE,CAAC,CAAA;IACzE,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QACpD,IAAI,QAAQ,KAAK,kBAAkB,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,kBAAkB,MAAM,oBAAoB,CAAA;QACrD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAEM,KAAK,UAAU,sBAAsB,CAC1C,OAA2B,EAC3B,WAAoB,EACpB,OAAgB;IAEhB,MAAM,QAAQ,GAAG,IAAA,mBAAW,EAAC,OAAO,CAAC,IAAI,CAAC,IAAI,WAAW,IAAI,IAAI,CAAA;IACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sCAA0B,EAAE,CAAA;IAC9D,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC3D,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;IAC7C,CAAC;IACD,yDAAyD;IACzD,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IACxC,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,sDAKC;AAED,oCAMC;AAED,0CAOC;AAQD,8CAEC;AAkBD,0DAIC;AASD,8DAwBC;AAED,4CAwBC;AAED,wDAkBC;AAlLD,uCAAwB;AACxB,uCAAwB;AACxB,2CAA4B;AAE5B,2CAAwD;AACxD,iCAA0B;AAE1B,mCAAqC;AAExB,QAAA,wBAAwB,GAAG;IACtC,uBAAuB;IACvB,2CAA2C,EAAG,qBAAqB;IACnE,UAAU;IACV,UAAU;IACV,qBAAqB;IACrB,uBAAuB,EAA0B,qCAAqC;IACtF,oBAAoB;IACpB,qBAAqB;IACrB,yBAAyB,EAAwB,gBAAgB;IACjE,yBAAyB,EAAwB,gBAAgB;IACjE,wDAAwD;IACxD,gFAAgF;IAChF,kEAAkE;IAClE,uCAAuC,EAAS,sCAAsC;IACtF,8DAA8D,EAAG,+BAA+B;IAChG,8DAA8D,EAAG,+BAA+B;CACjG,CAAA;AAEY,QAAA,qBAAqB,GAAG;IACnC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO;IACnC,mCAAmC;IACnC,eAAe,EAAE,kBAAkB;CACpC,CAAA;AAEY,QAAA,eAAe,GAAwB,IAAI,GAAG,CAAC;IAC1D,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ;CACpD,CAAC,CAAA;AAEW,QAAA,aAAa,GAAsB;IAC9C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa;IAChE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU;IAC3C,UAAU;IACV,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;CAC7D,CAAA;AAED,SAAgB,qBAAqB;IACnC,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAA;IACzB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC,GAAG,CACrD,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CACpC,CAAA;AACH,CAAC;AAED,SAAgB,YAAY;IAC1B,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,GAAG,IAAI,qBAAa,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAE,CAAA;IAClE,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAgB,eAAe,CAAC,OAAe;IAC7C,KAAK,MAAM,OAAO,IAAI,gCAAwB,EAAE,CAAC;QAC/C,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO,gDAAgD,CAAA;QACzD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAgB,iBAAiB,CAAC,WAAmB;IACnD,OAAO,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;AAC7C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,uBAAuB,CAAC,WAAmB;IACzD,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,IAAA,QAAC,EAAC,4BAA4B,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;IACnE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,yBAAyB,CAAC,QAAgB;IACxD,+EAA+E;IAC/E,0EAA0E;IAC1E,gEAAgE;IAChE,sEAAsE;IACtE,iCAAiC;IACjC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAClC,OAAO,2BAA2B,CAAA;IACpC,CAAC;IACD,IAAI,QAAgB,CAAA;IACpB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;QACtC,QAAQ,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IACnC,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,GAAG,6BAAqB,EAAE,GAAG,qBAAqB,EAAE,CAAC,CAAA;IACzE,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QACpD,IAAI,QAAQ,KAAK,kBAAkB,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,kBAAkB,MAAM,oBAAoB,CAAA;QACrD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAEM,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,OAAgB;IACvE,2EAA2E;IAC3E,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;IACpG,IAAI,QAAgB,CAAA;IACpB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;QAChF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC,CAAA;QACtE,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;YACxD,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;QAC5D,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,EAAE,SAAS,CAAC,CAAA;QACnD,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,GAAG,6BAAqB,EAAE,GAAG,qBAAqB,EAAE,CAAC,CAAA;IACzE,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QACpD,IAAI,QAAQ,KAAK,kBAAkB,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,kBAAkB,MAAM,oBAAoB,CAAA;QACrD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAEM,KAAK,UAAU,sBAAsB,CAC1C,OAA2B,EAC3B,WAAoB,EACpB,OAAgB;IAEhB,MAAM,QAAQ,GAAG,IAAA,mBAAW,EAAC,OAAO,CAAC,IAAI,CAAC,IAAI,WAAW,IAAI,IAAI,CAAA;IACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sCAA0B,EAAE,CAAA;IAC9D,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC3D,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;IAC7C,CAAC;IACD,yDAAyD;IACzD,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IACxC,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-support-agent/cli",
-  "version": "0.1.9-beta.0",
+  "version": "0.1.10-beta.0",
   "description": "AI Support Agent CLI client",
   "main": "dist/index.js",
   "bin": {