@algolia/wizard 0.32.0 → 0.33.0-rc.126.237

package/dist/main.js

@@ -253,6 +253,7 @@ var useWizard = create((set, get) => ({
   cliOutput: [],
   targetIndex: null,
   writtenFiles: [],
+  approvedCommands: /* @__PURE__ */ new Set(),
   logs: [],
   error: null,
   inputReq: null,
@@ -348,6 +349,10 @@ var useWizard = create((set, get) => ({
   setTargetIndex: (index) => set({ targetIndex: index }),
   recordWrittenFile: (path) => set((s) => ({ writtenFiles: [...s.writtenFiles, path] })),
   clearWrittenFiles: () => set({ writtenFiles: [] }),
+  isCommandApproved: (command, cwd) => get().approvedCommands.has(`${cwd}\0${command}`),
+  approveCommand: (command, cwd) => set((s) => ({
+    approvedCommands: new Set(s.approvedCommands).add(`${cwd}\0${command}`)
+  })),
   logStart: (kind, name, input) => {
     const id = nanoid();
     set((s) => ({
@@ -396,6 +401,7 @@ var useWizard = create((set, get) => ({
       cliOutput: [],
       targetIndex: null,
       writtenFiles: [],
+      approvedCommands: /* @__PURE__ */ new Set(),
       logs: [],
       error: null,
       inputReq: null,
@@ -2710,8 +2716,8 @@ var selectIndexStep = async (ctx) => {
 };
 
 // src/lib/agent.ts
-import { ToolLoopAgent, hasToolCall, Output as Output2 } from "ai";
-import { createAnthropic as createAnthropic2 } from "@ai-sdk/anthropic";
+import { ToolLoopAgent, hasToolCall, Output as Output3 } from "ai";
+import { createAnthropic as createAnthropic3 } from "@ai-sdk/anthropic";
 import "zod";
 
 // src/lib/tools/index.ts
@@ -3393,7 +3399,8 @@ function searchFilesTool(ctx) {
 }
 
 // src/lib/tools/runShell.ts
-import { tool as tool8 } from "ai";
+import { tool as tool8, generateText, Output } from "ai";
+import { createAnthropic } from "@ai-sdk/anthropic";
 import z15 from "zod";
 import { relative as relative4 } from "node:path";
 
@@ -3502,8 +3509,10 @@ function runShell(command, opts) {
 // src/lib/tools/runShell.ts
 function storeApproval(root) {
   return async (req) => {
+    const store = useWizard.getState();
+    if (store.isCommandApproved(req.command, req.cwd)) return "approve";
     const rel = relative4(root, req.cwd);
-    const answer = await useWizard.getState().requestUserInput({
+    const answer = await store.requestUserInput({
       prompt: "Run this command?",
       promptType: "commandApproval",
       options: [],
@@ -3512,20 +3521,159 @@ function storeApproval(root) {
         cwd: rel === "" || rel.startsWith("..") ? req.cwd : rel
       }
     });
-    return answer === "approve" ? "approve" : "reject";
+    if (answer !== "approve") return "reject";
+    store.approveCommand(req.command, req.cwd);
+    return "approve";
   };
 }
 var EXPLORATORY_COMMANDS = /* @__PURE__ */ new Set(["ls", "find", "tree", "dir"]);
+function commandSegments(command) {
+  return command.split(/&&|;|\|/).map((segment) => segment.trim());
+}
 function isExploratoryCommand(command) {
-  return command.split(/&&|;|\|/).map((segment) => segment.trim().split(/\s+/)[0]).some((word) => word !== void 0 && EXPLORATORY_COMMANDS.has(word));
+  return commandSegments(command).map((segment) => segment.split(/\s+/)[0]).some((word) => word !== void 0 && EXPLORATORY_COMMANDS.has(word));
+}
+var READ_ONLY_BINARIES = /* @__PURE__ */ new Set([
+  "cat",
+  "head",
+  "tail",
+  "wc",
+  "pwd",
+  "echo",
+  "date",
+  "whoami",
+  "hostname",
+  "uname",
+  "which",
+  "file",
+  "stat",
+  "grep",
+  "egrep",
+  "fgrep",
+  "rg",
+  "diff"
+]);
+var READ_ONLY_NO_ARGS_BINARIES = /* @__PURE__ */ new Set(["env", "printenv"]);
+var GIT_READ_ONLY_SUBCOMMANDS = /* @__PURE__ */ new Set([
+  "status",
+  "log",
+  "diff",
+  "show",
+  "describe",
+  "blame",
+  "ls-files",
+  "rev-parse",
+  "cat-file",
+  "shortlog",
+  "ls-remote"
+]);
+var VERSION_CHECK_BINARIES = /* @__PURE__ */ new Set([
+  "node",
+  "tsc",
+  "npm",
+  "pnpm",
+  "yarn",
+  "python",
+  "python3",
+  "ruby",
+  "go",
+  "cargo",
+  "rustc",
+  "php",
+  "composer",
+  "java",
+  "mvn",
+  "gradle",
+  "bundle",
+  "git"
+]);
+var VERSION_FLAGS = /* @__PURE__ */ new Set(["--version", "-v", "-V"]);
+function hasFileRedirect(segment) {
+  return segment.replace(/\d>&\d/g, "").includes(">");
 }
-async function approveAndRun(ctx, command, cwd, explanation) {
-  const decision = await ctx.shell.approve({ command, cwd, explanation });
-  if (decision === "reject") {
-    ctx.shell.executions.push({ command, cwd, approved: false });
-    logger.info({ command }, "runShell: user rejected the command");
-    return "The user rejected this command. Do not retry it. Propose a different command, or report the limitation via reportStatus.";
+function hasShellInjectionRisk(segment) {
+  if (segment.includes("$(") || segment.includes("<(") || segment.includes("`")) {
+    return true;
+  }
+  return segment.replace(/\d>&\d/g, "").includes("&");
+}
+function fastPathSegmentSafety(segment) {
+  if (!segment) return true;
+  if (hasFileRedirect(segment)) return false;
+  if (hasShellInjectionRisk(segment)) return false;
+  const [cmd0, ...rest] = segment.split(/\s+/);
+  if (cmd0 === void 0) return true;
+  if (VERSION_CHECK_BINARIES.has(cmd0) && rest.length === 1 && VERSION_FLAGS.has(rest[0])) {
+    return true;
+  }
+  if (READ_ONLY_BINARIES.has(cmd0)) return true;
+  if (READ_ONLY_NO_ARGS_BINARIES.has(cmd0)) {
+    return rest.length === 0 ? true : void 0;
+  }
+  if (cmd0 === "git") {
+    return GIT_READ_ONLY_SUBCOMMANDS.has(rest[0] ?? "") ? true : void 0;
+  }
+  return void 0;
+}
+function fastPathSafety(command) {
+  const results = commandSegments(command).map(fastPathSegmentSafety);
+  if (results.some((r) => r === false)) return false;
+  if (results.every((r) => r === true)) return true;
+  return void 0;
+}
+var CLASSIFIER_MODEL = "claude-haiku-4-5";
+var commandSafetySchema = z15.object({
+  safe: z15.boolean(),
+  reason: z15.string().describe("One short sentence explaining the verdict.")
+});
+function defaultCreateModel() {
+  const token = getAuthToken();
+  if (!token) {
+    throw new Error("Not authenticated: no user token available");
+  }
+  return createAnthropic({
+    apiKey: token,
+    baseURL: PROXY_BASE_URL,
+    fetch: proxyFetch
+  });
+}
+async function classifyCommandSafety(createModel, command, cwd, explanation) {
+  try {
+    const anthropic = createModel();
+    const { output } = await generateText({
+      model: anthropic(CLASSIFIER_MODEL),
+      temperature: 0,
+      output: Output.object({ schema: commandSafetySchema }),
+      prompt: [
+        "A coding agent wants to run this shell command in a user's project without asking for approval first. The command may be in any programming language or ecosystem.",
+        "Judge it SAFE only if it cannot modify, delete, move, rename, or install anything the project cares about, cannot push/publish/deploy/commit anything, and cannot make a network request that changes remote state.",
+        "Three broad categories are safe, and most commands you will see fall into one of them:",
+        "(1) Reporting or listing existing state, with no side effect \u2014 e.g. `git status`, `npm ls`, `npm outdated`, `pip show`, `pip freeze`, `cargo tree`, `docker ps`, `docker images`, `kubectl get pods`, `terraform state list`. This includes a read-only GET-style query to a remote registry or API that only fetches public metadata and changes nothing remote (e.g. `npm view <package>`, `pip index versions <package>`, `curl` with no -X/--request other than GET and no -d/--data) \u2014 safe because nothing changes, not because it stays local.",
+        '(2) A "preview" or "check" mode that reports what a change WOULD do, or reports a problem, without making the change. This is a general pattern, not a fixed list \u2014 ANY command that takes a dry-run/check/plan/validate/diff/list-only flag is safe when that flag is present, regardless of whether the same flag would normally appear on a "safe" kind of command: `terraform plan`, `terraform validate`, `terraform fmt -check`, `black --check`, `prettier --check`, `isort --check`, `gofmt -l` (list-only), `stylelint` with no `--fix`, and equally `git push --dry-run`, `npm publish --dry-run`, `kubectl apply --dry-run=client` \u2014 these last three are otherwise-unsafe operations (push, publish, cluster changes) that the dry-run flag turns into a report. The corresponding command WITHOUT that flag (e.g. `terraform apply`, `black .`, `gofmt -w`, `git push`) is a different, unsafe command \u2014 the flag is what makes the difference, for any tool, not just the ones named here. This cuts both ways, so do not assume a bare invocation is the safe one: `cargo fmt`, `black`, `prettier`, `isort`, `rustfmt`, and `terraform fmt` all REWRITE FILES by default and need an explicit check/diff/dry-run flag to become safe, while `gofmt`, `eslint`, `stylelint`, `rubocop`, and `ruff check` default to a safe check-only mode and need an explicit fix/write flag to become unsafe \u2014 the same-looking bare command is safe for one group and unsafe for the other, so judge each by what its own flags actually say, not by resemblance to a tool you already judged.',
+        "(3) Running the project's own tests, type checker, or linter, as long as it is not passed an autofix/write/update flag (e.g. --fix, -u, --write, rubocop -a) \u2014 this holds even for a compiled language, where running tests or a linter incidentally compiles code and writes build/cache/coverage output (e.g. a target/, build/, or __pycache__ directory): CREATING that incidental output does not make the command unsafe.",
+        "Deleting or removing anything is unsafe, even something in a cache or build directory (e.g. `rm -rf __pycache__`, `cargo clean`, `git clean`), and even if the command otherwise fits one of the three categories above. Installing, uninstalling, or upgrading a dependency, changing a database schema, or writing to a path outside the project is also unsafe. A command chained with && or ; is only safe if every part of the chain is safe on its own.",
+        "One specific, narrow exception to all of the above: when the command literally invokes one of these runner programs BY NAME as the leading command \u2014 npx, bunx, pnpm dlx, yarn dlx, pipx run, uvx \u2014 it is unsafe regardless of what it then runs, even something that looks like a harmless test/lint/typecheck command (e.g. `npx tsc --noEmit`, `uvx ruff check .`), because that runner can fetch and execute a different, unreviewed version of a package from a registry each time. This exception is about that specific syntax, not a general doubt about whether a tool is installed: a plain `ruff check .`, `pytest`, or any other bare command name is NOT this exception merely because you cannot verify from the string alone that it is installed \u2014 judge those the same as any other already-installed project tool, per the categories above. If you are unsure, judge it unsafe.",
+        `Command: ${command}`,
+        `Working directory: ${cwd}`,
+        `Stated purpose: ${explanation}`
+      ].join("\n")
+    });
+    if (!output.safe) {
+      logger.info(
+        { command, reason: output.reason },
+        "runShell: classifier judged command unsafe, requiring approval"
+      );
+    }
+    return output.safe;
+  } catch (err) {
+    logger.warn(
+      { err, command },
+      "runShell: command safety classifier failed, requiring approval"
+    );
+    return false;
   }
+}
+async function runAndRecord(ctx, command, cwd) {
   useWizard.getState().pushNotice({ messages: [`Running: ${command}`] });
   const env = await ctx.shell.env().catch((err) => {
     logger.warn({ err, command }, "runShell: could not resolve command env");
@@ -3561,9 +3709,18 @@ async function approveAndRun(ctx, command, cwd, explanation) {
     output: run2.output
   };
 }
-function runShellTool(ctx) {
+async function approveAndRun(ctx, command, cwd, explanation) {
+  const decision = await ctx.shell.approve({ command, cwd, explanation });
+  if (decision === "reject") {
+    ctx.shell.executions.push({ command, cwd, approved: false });
+    logger.info({ command }, "runShell: user rejected the command");
+    return "The user rejected this command. Do not retry it. Propose a different command, or report the limitation via reportStatus.";
+  }
+  return runAndRecord(ctx, command, cwd);
+}
+function runShellTool(ctx, createModel = defaultCreateModel) {
   return tool8({
-    description: "Run a shell command in the project. Use this for anything the project needs done in its own ecosystem: installing dependencies, running a script you wrote, running the project's lint/typecheck/test commands. To inspect the project, use listFiles or searchFiles instead of ls/find \u2014 this tool refuses those. The user sees and approves every command before it runs, so write a clear `explanation`. If the user rejects a command, do not retry it \u2014 propose a different approach.",
+    description: "Run a shell command in the project. Use this for anything the project needs done in its own ecosystem: installing dependencies, running a script you wrote, running the project's lint/typecheck/test commands. Do not use this to find or read files \u2014 use listFiles, searchFiles, and readFile instead of ls/find/cat/head/tail/grep/rg. This tool refuses ls/find/tree/dir outright; a read command like cat is not refused (some read-only commands run without approval, see below), but it's still the wrong tool for reading a file \u2014 the dedicated tools exist for that and won't count against this tool's command budget. The user approves any command that could change the project before it runs, so write a clear `explanation`. A command judged read-only (inspection, or running tests/typecheck/lint without an autofix flag, in any language) runs immediately without approval. If the user rejects a command, do not retry it \u2014 propose a different approach.",
     inputSchema: z15.object({
       command: z15.string().describe(
         "The command to run, exactly as it would be typed in a shell. Pipes, && and redirects are allowed."
@@ -3582,9 +3739,27 @@ function runShellTool(ctx) {
       const resolved2 = resolveInRoot(ctx, cwd ?? ".");
       if (!resolved2.ok) return resolved2.error;
       if (isExploratoryCommand(command)) {
-        return "Refused: use listFiles or searchFiles to inspect the project instead of ls/find/tree.";
+        return "Refused: use listFiles or searchFiles to find files, and readFile to read one, instead of ls/find/tree/dir.";
       }
       logger.info({ command, cwd: resolved2.target }, "called runShell tool");
+      const fast = fastPathSafety(command);
+      let isSafe = fast;
+      if (isSafe === void 0) {
+        isSafe = useWizard.getState().isCommandApproved(command, resolved2.target);
+        if (!isSafe) {
+          isSafe = await classifyCommandSafety(
+            createModel,
+            command,
+            resolved2.target,
+            explanation
+          );
+        }
+      }
+      if (isSafe) {
+        return serializePrompt(
+          () => runAndRecord(ctx, command, resolved2.target)
+        );
+      }
       return serializePrompt(
         () => approveAndRun(ctx, command, resolved2.target, explanation)
       );
@@ -3634,8 +3809,8 @@ function reviewScriptTool(ctx) {
 }
 
 // src/lib/tools/generateRecord.ts
-import { tool as tool10, generateText, Output, NoObjectGeneratedError } from "ai";
-import { createAnthropic } from "@ai-sdk/anthropic";
+import { tool as tool10, generateText as generateText2, Output as Output2, NoObjectGeneratedError } from "ai";
+import { createAnthropic as createAnthropic2 } from "@ai-sdk/anthropic";
 import { nanoid as nanoid2 } from "nanoid";
 import { mkdir as mkdir5, writeFile as writeFile6 } from "node:fs/promises";
 import { dirname as dirname6 } from "node:path";
@@ -3645,18 +3820,18 @@ var RECORD_MODEL = "claude-haiku-4-5";
 var MAX_RECORDS = 100;
 var BATCH_SIZE = 10;
 var MAX_BATCH_ATTEMPTS = 3;
-function defaultCreateModel() {
+function defaultCreateModel2() {
   const token = getAuthToken();
   if (!token) {
     throw new Error("Not authenticated: no user token available");
   }
-  return createAnthropic({
+  return createAnthropic2({
     apiKey: token,
     baseURL: PROXY_BASE_URL,
     fetch: proxyFetch
   });
 }
-function generateRecordTool(ctx, createModel = defaultCreateModel) {
+function generateRecordTool(ctx, createModel = defaultCreateModel2) {
   return tool10({
     description: "Generate realistic sample records for an entity and write them to a JSON file. Provide the entity name and its attributes; this tool asks a model to invent varied, realistic values, each with a unique objectID, and returns the file path to read them from at runtime. Do not invent the record values or objectIDs yourself, and do not inline the returned records into the script \u2014 call this tool and read the file it writes.",
     inputSchema: z17.object({
@@ -3677,9 +3852,9 @@ function generateRecordTool(ctx, createModel = defaultCreateModel) {
           let lastError;
           for (let attempt = 1; attempt <= MAX_BATCH_ATTEMPTS; attempt++) {
             try {
-              const { output } = await generateText({
+              const { output } = await generateText2({
                 model: anthropic(RECORD_MODEL),
-                output: Output.object({
+                output: Output2.object({
                   schema: z17.object({
                     records: z17.array(recordSchema).length(batchCount)
                   })
@@ -3844,7 +4019,7 @@ async function runAgentAttempt(req, attempt) {
   if (!token) {
     throw new Error("Not authenticated: no user token available");
   }
-  const anthropic = createAnthropic2({
+  const anthropic = createAnthropic3({
     apiKey: token,
     baseURL: PROXY_BASE_URL,
     fetch: proxyFetch
@@ -3881,7 +4056,7 @@ async function runAgentAttempt(req, attempt) {
         }
       };
     }),
-    output: Output2.object({ schema: req.outputSchema }),
+    output: Output3.object({ schema: req.outputSchema }),
     tools: createTools(toolContext, {
       output: req.outputSchema,
       tools: req.tools
@@ -4064,7 +4239,7 @@ async function runAnalysis(mode, extraInstructions = []) {
 // package.json
 var package_default = {
   name: "@algolia/wizard",
-  version: "0.32.0",
+  version: "0.33.0-rc.126.237",
   description: "Magically implement Algolia functionality in your codebase",
   type: "module",
   engines: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@algolia/wizard",
-  "version": "0.32.0",
+  "version": "0.33.0-rc.126.237",
   "description": "Magically implement Algolia functionality in your codebase",
   "type": "module",
   "engines": {