@algolia/wizard 0.23.0 → 0.24.0

package/dist/main.js

@@ -3178,6 +3178,10 @@ function storeApproval(root) {
     return answer === "approve" ? "approve" : "reject";
   };
 }
+var EXPLORATORY_COMMANDS = /* @__PURE__ */ new Set(["ls", "find", "tree", "dir"]);
+function isExploratoryCommand(command) {
+  return command.split(/&&|;|\|/).map((segment) => segment.trim().split(/\s+/)[0]).some((word) => word !== void 0 && EXPLORATORY_COMMANDS.has(word));
+}
 async function approveAndRun(ctx, command, cwd, explanation) {
   const decision = await ctx.shell.approve({ command, cwd, explanation });
   if (decision === "reject") {
@@ -3222,7 +3226,7 @@ async function approveAndRun(ctx, command, cwd, explanation) {
 }
 function runShellTool(ctx) {
   return tool8({
-    description: "Run a shell command in the project. Use this for anything the project needs done in its own ecosystem: installing dependencies, running a script you wrote, running the project's lint/typecheck/test commands. The user sees and approves every command before it runs, so write a clear `explanation`. If the user rejects a command, do not retry it \u2014 propose a different approach.",
+    description: "Run a shell command in the project. Use this for anything the project needs done in its own ecosystem: installing dependencies, running a script you wrote, running the project's lint/typecheck/test commands. To inspect the project, use listFiles or searchFiles instead of ls/find \u2014 this tool refuses those. The user sees and approves every command before it runs, so write a clear `explanation`. If the user rejects a command, do not retry it \u2014 propose a different approach.",
     inputSchema: z15.object({
       command: z15.string().describe(
         "The command to run, exactly as it would be typed in a shell. Pipes, && and redirects are allowed."
@@ -3240,6 +3244,9 @@ function runShellTool(ctx) {
       }
       const resolved2 = resolveInRoot(ctx, cwd ?? ".");
       if (!resolved2.ok) return resolved2.error;
+      if (isExploratoryCommand(command)) {
+        return "Refused: use listFiles or searchFiles to inspect the project instead of ls/find/tree.";
+      }
       logger.info({ command, cwd: resolved2.target }, "called runShell tool");
       return serializePrompt(
         () => approveAndRun(ctx, command, resolved2.target, explanation)
@@ -3700,7 +3707,7 @@ async function runAnalysis(mode, extraInstructions = []) {
 // package.json
 var package_default = {
   name: "@algolia/wizard",
-  version: "0.23.0",
+  version: "0.24.0",
   description: "Magically implement Algolia functionality in your codebase",
   type: "module",
   engines: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@algolia/wizard",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "description": "Magically implement Algolia functionality in your codebase",
   "type": "module",
   "engines": {