@algolia/wizard 0.35.0 → 0.36.0

package/dist/main.js

@@ -253,6 +253,7 @@ var useWizard = create((set, get) => ({
   cliOutput: [],
   targetIndex: null,
   writtenFiles: [],
+  approvedCommands: /* @__PURE__ */ new Set(),
   logs: [],
   error: null,
   inputReq: null,
@@ -348,6 +349,10 @@ var useWizard = create((set, get) => ({
   setTargetIndex: (index) => set({ targetIndex: index }),
   recordWrittenFile: (path) => set((s) => ({ writtenFiles: [...s.writtenFiles, path] })),
   clearWrittenFiles: () => set({ writtenFiles: [] }),
+  isCommandApproved: (command, cwd) => get().approvedCommands.has(`${cwd}\0${command}`),
+  approveCommand: (command, cwd) => set((s) => ({
+    approvedCommands: new Set(s.approvedCommands).add(`${cwd}\0${command}`)
+  })),
   logStart: (kind, name, input) => {
     const id = nanoid();
     set((s) => ({
@@ -396,6 +401,7 @@ var useWizard = create((set, get) => ({
       cliOutput: [],
       targetIndex: null,
       writtenFiles: [],
+      approvedCommands: /* @__PURE__ */ new Set(),
       logs: [],
       error: null,
       inputReq: null,
@@ -1646,8 +1652,8 @@ var selectIndexStep = async (ctx) => {
 };
 
 // src/lib/agent.ts
-import { ToolLoopAgent, hasToolCall, Output as Output2 } from "ai";
-import { createAnthropic as createAnthropic2 } from "@ai-sdk/anthropic";
+import { ToolLoopAgent, hasToolCall, Output as Output3 } from "ai";
+import { createAnthropic as createAnthropic3 } from "@ai-sdk/anthropic";
 import "zod";
 
 // src/lib/tools/index.ts
@@ -2391,7 +2397,8 @@ function searchFilesTool(ctx) {
 }
 
 // src/lib/tools/runShell.ts
-import { tool as tool8 } from "ai";
+import { tool as tool8, generateText, Output } from "ai";
+import { createAnthropic } from "@ai-sdk/anthropic";
 import z15 from "zod";
 import { relative as relative4 } from "node:path";
 
@@ -2500,8 +2507,10 @@ function runShell(command, opts) {
 // src/lib/tools/runShell.ts
 function storeApproval(root) {
   return async (req) => {
+    const store = useWizard.getState();
+    if (store.isCommandApproved(req.command, req.cwd)) return "approve";
     const rel = relative4(root, req.cwd);
-    const answer = await useWizard.getState().requestUserInput({
+    const answer = await store.requestUserInput({
       prompt: "Run this command?",
       promptType: "commandApproval",
       options: [],
@@ -2510,20 +2519,195 @@ function storeApproval(root) {
         cwd: rel === "" || rel.startsWith("..") ? req.cwd : rel
       }
     });
-    return answer === "approve" ? "approve" : "reject";
+    if (answer !== "approve") return "reject";
+    store.approveCommand(req.command, req.cwd);
+    return "approve";
   };
 }
 var EXPLORATORY_COMMANDS = /* @__PURE__ */ new Set(["ls", "find", "tree", "dir"]);
+function commandSegments(command) {
+  return command.split(/&&|;|\|/).map((segment) => segment.trim());
+}
 function isExploratoryCommand(command) {
-  return command.split(/&&|;|\|/).map((segment) => segment.trim().split(/\s+/)[0]).some((word) => word !== void 0 && EXPLORATORY_COMMANDS.has(word));
+  return commandSegments(command).map((segment) => segment.split(/\s+/)[0]).some((word) => word !== void 0 && EXPLORATORY_COMMANDS.has(word));
+}
+var READ_ONLY_BINARIES = /* @__PURE__ */ new Set([
+  "cat",
+  "head",
+  "tail",
+  "wc",
+  "pwd",
+  "echo",
+  "date",
+  "whoami",
+  "hostname",
+  "uname",
+  "which",
+  "file",
+  "stat",
+  "grep",
+  "egrep",
+  "fgrep",
+  "rg",
+  "diff"
+]);
+var READ_ONLY_NO_ARGS_BINARIES = /* @__PURE__ */ new Set(["env", "printenv"]);
+var GIT_READ_ONLY_SUBCOMMANDS = /* @__PURE__ */ new Set([
+  "status",
+  "log",
+  "diff",
+  "show",
+  "describe",
+  "blame",
+  "ls-files",
+  "rev-parse",
+  "cat-file",
+  "shortlog",
+  "ls-remote"
+]);
+var VERSION_CHECK_BINARIES = /* @__PURE__ */ new Set([
+  "node",
+  "tsc",
+  "npm",
+  "pnpm",
+  "yarn",
+  "python",
+  "python3",
+  "ruby",
+  "go",
+  "cargo",
+  "rustc",
+  "php",
+  "composer",
+  "java",
+  "mvn",
+  "gradle",
+  "bundle",
+  "git"
+]);
+var VERSION_FLAGS = /* @__PURE__ */ new Set(["--version", "-v", "-V"]);
+var FD_DUP_REDIRECT = /\d*>&\d+/g;
+function stripQuoted(segment) {
+  let result = "";
+  let quote = null;
+  let i = 0;
+  while (i < segment.length) {
+    const char = segment[i];
+    if (quote === "'") {
+      if (char === "'") quote = null;
+      i++;
+    } else if (char === "\\") {
+      i += 2;
+    } else if (quote) {
+      if (char === quote) quote = null;
+      i++;
+    } else if (char === '"' || char === "'") {
+      quote = char;
+      i++;
+    } else {
+      result += char;
+      i++;
+    }
+  }
+  return quote === null ? result : segment;
 }
-async function approveAndRun(ctx, command, cwd, explanation) {
-  const decision = await ctx.shell.approve({ command, cwd, explanation });
-  if (decision === "reject") {
-    ctx.shell.executions.push({ command, cwd, approved: false });
-    logger.info({ command }, "runShell: user rejected the command");
-    return "The user rejected this command. Do not retry it. Propose a different command, or report the limitation via reportStatus.";
+function hasFileRedirect(segment) {
+  return stripQuoted(segment.replace(FD_DUP_REDIRECT, "")).includes(">");
+}
+function hasShellInjectionRisk(segment) {
+  if (segment.includes("$(") || segment.includes("<(") || segment.includes("`")) {
+    return true;
+  }
+  return stripQuoted(segment.replace(FD_DUP_REDIRECT, "")).includes("&");
+}
+function fastPathSegmentSafety(segment) {
+  if (!segment) return true;
+  if (hasFileRedirect(segment)) return false;
+  if (hasShellInjectionRisk(segment)) return false;
+  const [cmd0, ...rest] = segment.split(/\s+/);
+  if (cmd0 === void 0) return true;
+  if (VERSION_CHECK_BINARIES.has(cmd0) && rest.length === 1 && VERSION_FLAGS.has(rest[0])) {
+    return true;
+  }
+  if (READ_ONLY_BINARIES.has(cmd0)) return true;
+  if (READ_ONLY_NO_ARGS_BINARIES.has(cmd0)) {
+    return rest.length === 0 ? true : void 0;
+  }
+  if (cmd0 === "git") {
+    return GIT_READ_ONLY_SUBCOMMANDS.has(rest[0] ?? "") ? true : void 0;
+  }
+  return void 0;
+}
+function fastPathSafety(command) {
+  const results = commandSegments(command).map(fastPathSegmentSafety);
+  if (results.some((r) => r === false)) return false;
+  if (results.every((r) => r === true)) return true;
+  return void 0;
+}
+var CLASSIFIER_MODEL = "claude-haiku-4-5";
+var commandSafetySchema = z15.object({
+  safe: z15.boolean(),
+  reason: z15.string().describe("One short sentence explaining the verdict.")
+});
+function defaultCreateModel() {
+  const token = getAuthToken();
+  if (!token) {
+    throw new Error("Not authenticated: no user token available");
+  }
+  return createAnthropic({
+    apiKey: token,
+    baseURL: PROXY_BASE_URL,
+    fetch: proxyFetch
+  });
+}
+function approvedCommandHistory(approvedCommands) {
+  return Array.from(approvedCommands).map((entry) => {
+    const sep2 = entry.indexOf("\0");
+    return { cwd: entry.slice(0, sep2), command: entry.slice(sep2 + 1) };
+  });
+}
+async function classifyCommandSafety(createModel, command, cwd, explanation, approvedHistory) {
+  try {
+    const anthropic = createModel();
+    const { output } = await generateText({
+      model: anthropic(CLASSIFIER_MODEL),
+      temperature: 0,
+      output: Output.object({ schema: commandSafetySchema }),
+      prompt: [
+        "A coding agent wants to run this shell command in a user's project without asking for approval first. The command may be in any programming language or ecosystem.",
+        "Judge it SAFE only if it cannot modify, delete, move, rename, or install anything the project cares about, cannot push/publish/deploy/commit anything, and cannot make a network request that changes remote state.",
+        "Three broad categories are safe, and most commands you will see fall into one of them:",
+        "(1) Reporting or listing existing state, with no side effect \u2014 e.g. `git status`, `npm ls`, `npm outdated`, `pip show`, `pip freeze`, `cargo tree`, `docker ps`, `docker images`, `kubectl get pods`, `terraform state list`. This includes a read-only GET-style query to a remote registry or API that only fetches public metadata and changes nothing remote (e.g. `npm view <package>`, `pip index versions <package>`, `curl` with no -X/--request other than GET and no -d/--data) \u2014 safe because nothing changes, not because it stays local.",
+        '(2) A "preview" or "check" mode that reports what a change WOULD do, or reports a problem, without making the change. This is a general pattern, not a fixed list \u2014 ANY command that takes a dry-run/check/plan/validate/diff/list-only flag is safe when that flag is present, regardless of whether the same flag would normally appear on a "safe" kind of command: `terraform plan`, `terraform validate`, `terraform fmt -check`, `black --check`, `prettier --check`, `isort --check`, `gofmt -l` (list-only), `stylelint` with no `--fix`, and equally `git push --dry-run`, `npm publish --dry-run`, `kubectl apply --dry-run=client` \u2014 these last three are otherwise-unsafe operations (push, publish, cluster changes) that the dry-run flag turns into a report. The corresponding command WITHOUT that flag (e.g. `terraform apply`, `black .`, `gofmt -w`, `git push`) is a different, unsafe command \u2014 the flag is what makes the difference, for any tool, not just the ones named here. This cuts both ways, so do not assume a bare invocation is the safe one: `cargo fmt`, `black`, `prettier`, `isort`, `rustfmt`, and `terraform fmt` all REWRITE FILES by default and need an explicit check/diff/dry-run flag to become safe, while `gofmt`, `eslint`, `stylelint`, `rubocop`, and `ruff check` default to a safe check-only mode and need an explicit fix/write flag to become unsafe \u2014 the same-looking bare command is safe for one group and unsafe for the other, so judge each by what its own flags actually say, not by resemblance to a tool you already judged.',
+        "(3) Running the project's own tests, type checker, linter, or build/compile step (e.g. `npm run build`, `yarn build`, `vite build`, `webpack`, `tsc`, `cargo build`, `go build`, `mvn compile`), as long as it is not passed an autofix/write/update flag (e.g. --fix, -u, --write, rubocop -a) \u2014 this holds even though the point of a build step is to write compiled output to a build/dist/target directory inside the project (e.g. a target/, build/, dist/, or __pycache__ directory): writing that output does not make the command unsafe. It stops being safe the moment the command chain goes past building \u2014 a step that also deploys, publishes, uploads, or pushes the build (e.g. `next build && vercel deploy`, `npm run build && npm publish`) is unsafe for that later segment even though the build segment itself is fine; judge each chained segment on its own, same as elsewhere in this list.",
+        "Deleting or removing anything is unsafe, even something in a cache or build directory (e.g. `rm -rf __pycache__`, `cargo clean`, `git clean`), and even if the command otherwise fits one of the three categories above. Installing, uninstalling, or upgrading a dependency, changing a database schema, or writing to a path outside the project is also unsafe. A command chained with && or ; is only safe if every part of the chain is safe on its own.",
+        "One specific, narrow exception to all of the above: when the command literally invokes one of these runner programs BY NAME as the leading command \u2014 npx, bunx, pnpm dlx, yarn dlx, pipx run, uvx \u2014 it is unsafe regardless of what it then runs, even something that looks like a harmless test/lint/typecheck command (e.g. `npx tsc --noEmit`, `uvx ruff check .`), because that runner can fetch and execute a different, unreviewed version of a package from a registry each time. This exception is about that specific syntax, not a general doubt about whether a tool is installed: a plain `ruff check .`, `pytest`, or any other bare command name is NOT this exception merely because you cannot verify from the string alone that it is installed \u2014 judge those the same as any other already-installed project tool, per the categories above. If you are unsure, judge it unsafe.",
+        ...approvedHistory.length > 0 ? [
+          "The user has already explicitly approved these exact commands earlier in this session (working directory in parentheses, then the command):",
+          approvedHistory.map((h) => `- (${h.cwd}) ${h.command}`).join("\n"),
+          "If the new command performs the same action and side-effect profile as one of these \u2014 differing only in a trivial way, such as a different file path, package name, or argument value that does not change what kind of action it is \u2014 judge it SAFE on that precedent, even if it would not otherwise fit categories (1)-(3) above. Do not stretch this to a command that merely shares a binary name, or superficially resembles one on the list while doing something riskier or of a different kind (e.g. an approved `rm build/tmp.log` does not license a new `rm -rf src/`, and an approved `git push origin feature-x` does not license `git push --force`)."
+        ] : [],
+        `Command: ${command}`,
+        `Working directory: ${cwd}`,
+        `Stated purpose: ${explanation}`
+      ].join("\n")
+    });
+    if (!output.safe) {
+      logger.info(
+        { command, reason: output.reason },
+        "runShell: classifier judged command unsafe, requiring approval"
+      );
+    }
+    return output.safe;
+  } catch (err) {
+    logger.warn(
+      { err, command },
+      "runShell: command safety classifier failed, requiring approval"
+    );
+    return false;
   }
+}
+async function runAndRecord(ctx, command, cwd) {
   useWizard.getState().pushNotice({ messages: [`Running: ${command}`] });
   const env = await ctx.shell.env().catch((err) => {
     logger.warn({ err, command }, "runShell: could not resolve command env");
@@ -2559,9 +2743,18 @@ async function approveAndRun(ctx, command, cwd, explanation) {
     output: run2.output
   };
 }
-function runShellTool(ctx) {
+async function approveAndRun(ctx, command, cwd, explanation) {
+  const decision = await ctx.shell.approve({ command, cwd, explanation });
+  if (decision === "reject") {
+    ctx.shell.executions.push({ command, cwd, approved: false });
+    logger.info({ command }, "runShell: user rejected the command");
+    return "The user rejected this command. Do not retry it. Propose a different command, or report the limitation via reportStatus.";
+  }
+  return runAndRecord(ctx, command, cwd);
+}
+function runShellTool(ctx, createModel = defaultCreateModel) {
   return tool8({
-    description: "Run a shell command in the project. Use this for anything the project needs done in its own ecosystem: installing dependencies, running a script you wrote, running the project's lint/typecheck/test commands. To inspect the project, use listFiles or searchFiles instead of ls/find \u2014 this tool refuses those. The user sees and approves every command before it runs, so write a clear `explanation`. If the user rejects a command, do not retry it \u2014 propose a different approach.",
+    description: "Run a shell command in the project. Use this for anything the project needs done in its own ecosystem: installing dependencies, running a script you wrote, running the project's lint/typecheck/test commands. Do not use this to find or read files \u2014 use listFiles, searchFiles, and readFile instead of ls/find/cat/head/tail/grep/rg. This tool refuses ls/find/tree/dir outright; a read command like cat is not refused (some read-only commands run without approval, see below), but it's still the wrong tool for reading a file \u2014 the dedicated tools exist for that and won't count against this tool's command budget. The user approves any command that could change the project before it runs, so write a clear `explanation`. A command judged read-only (inspection, or running tests/typecheck/lint without an autofix flag, in any language) runs immediately without approval. If the user rejects a command, do not retry it \u2014 propose a different approach.",
     inputSchema: z15.object({
       command: z15.string().describe(
         "The command to run, exactly as it would be typed in a shell. Pipes, && and redirects are allowed."
@@ -2580,9 +2773,29 @@ function runShellTool(ctx) {
       const resolved2 = resolveInRoot(ctx, cwd ?? ".");
       if (!resolved2.ok) return resolved2.error;
       if (isExploratoryCommand(command)) {
-        return "Refused: use listFiles or searchFiles to inspect the project instead of ls/find/tree.";
+        return "Refused: use listFiles or searchFiles to find files, and readFile to read one, instead of ls/find/tree/dir.";
       }
       logger.info({ command, cwd: resolved2.target }, "called runShell tool");
+      const fast = fastPathSafety(command);
+      let isSafe = fast;
+      if (isSafe === void 0) {
+        const store = useWizard.getState();
+        isSafe = store.isCommandApproved(command, resolved2.target);
+        if (!isSafe) {
+          isSafe = await classifyCommandSafety(
+            createModel,
+            command,
+            resolved2.target,
+            explanation,
+            approvedCommandHistory(store.approvedCommands)
+          );
+        }
+      }
+      if (isSafe) {
+        return serializePrompt(
+          () => runAndRecord(ctx, command, resolved2.target)
+        );
+      }
       return serializePrompt(
         () => approveAndRun(ctx, command, resolved2.target, explanation)
       );
@@ -2632,8 +2845,8 @@ function reviewScriptTool(ctx) {
 }
 
 // src/lib/tools/generateRecord.ts
-import { tool as tool10, generateText, Output, NoObjectGeneratedError } from "ai";
-import { createAnthropic } from "@ai-sdk/anthropic";
+import { tool as tool10, generateText as generateText2, Output as Output2, NoObjectGeneratedError } from "ai";
+import { createAnthropic as createAnthropic2 } from "@ai-sdk/anthropic";
 import { nanoid as nanoid2 } from "nanoid";
 import { mkdir as mkdir5, writeFile as writeFile6 } from "node:fs/promises";
 import { dirname as dirname5 } from "node:path";
@@ -2643,18 +2856,18 @@ var RECORD_MODEL = "claude-haiku-4-5";
 var MAX_RECORDS = 100;
 var BATCH_SIZE = 10;
 var MAX_BATCH_ATTEMPTS = 3;
-function defaultCreateModel() {
+function defaultCreateModel2() {
   const token = getAuthToken();
   if (!token) {
     throw new Error("Not authenticated: no user token available");
   }
-  return createAnthropic({
+  return createAnthropic2({
     apiKey: token,
     baseURL: PROXY_BASE_URL,
     fetch: proxyFetch
   });
 }
-function generateRecordTool(ctx, createModel = defaultCreateModel) {
+function generateRecordTool(ctx, createModel = defaultCreateModel2) {
   return tool10({
     description: "Generate realistic sample records for an entity and write them to a JSON file. Provide the entity name and its attributes; this tool asks a model to invent varied, realistic values, each with a unique objectID, and returns the file path to read them from at runtime. Do not invent the record values or objectIDs yourself, and do not inline the returned records into the script \u2014 call this tool and read the file it writes.",
     inputSchema: z17.object({
@@ -2675,9 +2888,9 @@ function generateRecordTool(ctx, createModel = defaultCreateModel) {
           let lastError;
           for (let attempt = 1; attempt <= MAX_BATCH_ATTEMPTS; attempt++) {
             try {
-              const { output } = await generateText({
+              const { output } = await generateText2({
                 model: anthropic(RECORD_MODEL),
-                output: Output.object({
+                output: Output2.object({
                   schema: z17.object({
                     records: z17.array(recordSchema).length(batchCount)
                   })
@@ -2842,7 +3055,7 @@ async function runAgentAttempt(req, attempt) {
   if (!token) {
     throw new Error("Not authenticated: no user token available");
   }
-  const anthropic = createAnthropic2({
+  const anthropic = createAnthropic3({
     apiKey: token,
     baseURL: PROXY_BASE_URL,
     fetch: proxyFetch
@@ -2879,7 +3092,7 @@ async function runAgentAttempt(req, attempt) {
         }
       };
     }),
-    output: Output2.object({ schema: req.outputSchema }),
+    output: Output3.object({ schema: req.outputSchema }),
     tools: createTools(toolContext, {
       output: req.outputSchema,
       tools: req.tools
@@ -3062,7 +3275,7 @@ async function runAnalysis(mode, extraInstructions = []) {
 // package.json
 var package_default = {
   name: "@algolia/wizard",
-  version: "0.35.0",
+  version: "0.36.0",
   description: "Magically implement Algolia functionality in your codebase",
   type: "module",
   engines: {
@@ -3468,6 +3681,7 @@ ${formatCompletedSteps(ctx.completedSteps)}`,
 
 // src/actions/implement.ts
 import z29 from "zod";
+import { mkdir as mkdir7 } from "node:fs/promises";
 import { join as join10, relative as relative6 } from "node:path";
 
 // src/lib/git.ts
@@ -3757,7 +3971,7 @@ function algoliaClientDoc(input) {
 function ingestionInstructions(input) {
   return [
     ...input.confirmed && input.confirmed.length ? [
-      `Create an ingestion script under "${input.ingestDir}/" at the repo root.`,
+      `Create an ingestion script under "${input.ingestDir}/" at the repo root. That directory already exists \u2014 writeFile creates any nested path itself, so never run a shell command just to create a directory.`,
       `Ingest only the confirmed entity (name, source paths, attributes): ${JSON.stringify(input.confirmed)}.`,
       `Ingesting writes to Algolia, so the script needs a write API key and App ID \u2014 read them from the ${API_KEY_VAR} and ${APP_ID_VAR} environment variables rather than hardcoding them. The wizard sets these when it runs the script.`,
       `Read the index name from the ${INDEX_NAME_VAR} environment variable, which the wizard sets to "${input.targetIndex}". Never hardcode an index name or derive one from the project, file, or entity name \u2014 the write key only works for that exact index. Exit with an error if ${INDEX_NAME_VAR} is unset.`,
@@ -3992,6 +4206,9 @@ async function implement(ctx, useCases = DEFAULT_IMPLEMENT_USE_CASES) {
   const targetIndex = selected?.selection;
   useWizard.getState().setTargetIndex(targetIndex ?? null);
   await assertGitRepoWithHead(repoRoot);
+  if (useCases.includes("ingestion")) {
+    await mkdir7(join10(repoRoot, INGEST_DIR), { recursive: true });
+  }
   const normalized = normalizeFindingPaths(findings);
   const confirmed2 = normalized.confirmedEntities;
   const searchLocation = normalized.searchImplementationAnalysis;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@algolia/wizard",
-  "version": "0.35.0",
+  "version": "0.36.0",
   "description": "Magically implement Algolia functionality in your codebase",
   "type": "module",
   "engines": {