@amenophis1er/foreman 0.1.9 → 0.1.12

package/README.md

@@ -230,7 +230,7 @@ result.
 ```sh
 npm ci && npm run setup      # dependencies, then the dashboard build
 npm start                    # serves http://localhost:4177
-npm test                     # 363 tests, node:test
+npm test                     # 365 tests, node:test
 npm run typecheck            # server and dashboard
 npm run dev                  # API + Vite together
 scripts/dev-restart.sh       # restarts the server only when nothing would be lost

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amenophis1er/foreman",
-  "version": "0.1.9",
+  "version": "0.1.12",
   "description": "Autonomous mission runner on the Claude Agent SDK: a director plans, delegates to workers, verifies, and reports — from one dashboard, your phone, or the CLI.",
   "keywords": [
     "claude",

package/src/policy.test.ts

@@ -167,6 +167,21 @@ test('operators inside quotes are text: a perl program with => is not a redirect
   assert.equal(bashEscapesFolder(`echo hi > "${ROOT}/o u t.txt"`, FOLDER, [ROOT]), null);
 });
 
+test('the shell keeps its cwd between commands: a cd in one call places the next', () => {
+  const shell = { cwd: FOLDER };
+  assert.equal(bashEscape('cd examples/demo', FOLDER, [], shell), null);
+  assert.equal(shell.cwd, path.join(FOLDER, 'examples/demo'));
+  // The exact shape from a real mission: a log two levels up is inside the folder.
+  assert.equal(bashEscape('(npx tsx server.ts > ../../.foreman/work/demo/run1.log 2>&1 &) ; sleep 1', FOLDER, [], shell), null);
+  // A cd inside a subshell does not move the shell.
+  assert.equal(bashEscape('(cd .. && ls) && echo ok', FOLDER, [], shell), null);
+  assert.equal(shell.cwd, path.join(FOLDER, 'examples/demo'));
+  // From there, three levels up is out, and says so.
+  assert.match(bashEscape('touch ../../../x', FOLDER, [], shell)!.reason, /outside the mission folder/);
+  // Without a shell, the analysis starts at the folder as before.
+  assert.match(bashEscape('echo hi > ../../.foreman/work/demo/run1.log', FOLDER)!.reason, /redirects output outside/);
+});
+
 test('a shell -c body is analysed as a command, so quoting cannot hide a cd', () => {
   assert.ok(bashEscapesFolder(`sh -c 'cd /tmp && npm install'`, FOLDER, [ROOT]));
   assert.match(bashEscapesFolder(`bash -c "mkdir -p /tmp/x/y"`, FOLDER, [ROOT])!, /creates a path outside/);

package/src/policy.ts

@@ -297,6 +297,7 @@ export interface BashEscape {
  */
 export function bashEscape(
   command: string, folder: string, extraRoots: Iterable<string> = [],
+  shell?: { cwd?: string },
 ): BashEscape | null {
   const root = path.resolve(folder);
   // Snapshot the grants once per call: the caller's set is mutable and may be
@@ -310,7 +311,15 @@ export function bashEscape(
     grant: isDir ? p : path.dirname(p),
   });
 
-  let cwd = root; // virtual cwd, so `cd sub && rm -rf ../../x` resolves correctly
+  // The virtual cwd, so `cd sub && rm -rf ../../x` resolves correctly. It
+  // starts where the agent's shell actually is: Claude Code's Bash tool keeps
+  // its working directory between commands, so a director that ran
+  // `cd examples/demo` one call ago and now writes `../../.foreman/work/x.log`
+  // is writing inside the folder — read from the root that looked like two
+  // levels out, and put an approval card in front of an in-folder log.
+  let cwd = shell?.cwd ? path.resolve(shell.cwd) : root;
+  // `cd` inside a subshell does not outlive it; only top-level moves persist.
+  let depth = 0;
 
   const segments = maskQuoted(command)
     .split(/&&|\|\||;|\n|\|(?!\|)|(?<![&>\d])&(?![&>])/)
@@ -323,7 +332,13 @@ export function bashEscape(
       const p = asPath(m[1], cwd);
       if (p !== null && outside(p)) return hit(segment, 'redirects output', p, false);
     }
+    const opens = (segment.match(/\(/g) ?? []).length;
+    const closes = (segment.match(/\)/g) ?? []).length;
     const words = segment.replace(REDIRECT_RE, ' ').split(/\s+/).filter(Boolean).map(bare);
+    // Depth as seen at this segment's verb: an opening paren on the segment
+    // itself puts its `cd` inside the subshell.
+    const depthHere = depth + (segment.trimStart().startsWith('(') ? 1 : 0);
+    depth = Math.max(0, depth + opens - closes);
     // Peel wrappers and leading VAR=value assignments to reach the real verb.
     let i = 0;
     while (i < words.length && (WRAPPERS.has(words[i]) || /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i]))) i++;
@@ -352,6 +367,7 @@ export function bashEscape(
       // Enough on its own: whatever follows (relative writes, `npm install`,
       // `git init`) lands there, so we need not look at later segments.
       if (outside(p)) return hit(segment, 'writes after this land', p, true);
+      if (depthHere === 0 && shell) shell.cwd = p;
       continue;
     }
 
@@ -532,6 +548,10 @@ export function makePolicy(
   const foremanDir = path.join(folder, '.foreman') + path.sep;
   const toolPolicy = { ...DEFAULT_TOOL_POLICY, ...settings?.toolPolicy };
   const autoReadOnly = settings?.autoAllowReadOnly !== false;
+  // Where this agent's shell is. One policy per agent session, and the SDK's
+  // Bash keeps its cwd across calls, so a top-level `cd` in an allowed
+  // command is where the next command starts. Reset only with the session.
+  const shell: { cwd?: string } = { cwd: folder };
 
   return async (toolName, input, opts) => {
     // An explicit grant (Settings policy or the human's "Always" click) is a
@@ -557,10 +577,15 @@ export function makePolicy(
     // The shell is the other door out of the job site: a command that would
     // write outside the folder prompts under the same rule, so a blanket
     // `Bash: allow` (or an "Always" click) cannot quietly `cd /tmp && npm i`.
+    // Analysed from the shell's current directory; the walk records where a
+    // top-level `cd` leaves it. A command that escapes is not run unless the
+    // human allows it, so its `cd` is remembered only after an allow below.
+    const shellAfter = { cwd: shell.cwd };
     const escape =
       toolName === 'Bash' && typeof input.command === 'string'
-        ? bashEscape(input.command, folder, allowedRoots)
+        ? bashEscape(input.command, folder, allowedRoots, shellAfter)
         : null;
+    const rememberCwd = () => { if (toolName === 'Bash') shell.cwd = shellAfter.cwd; };
     const leavesFolder = outsideFolder || escape !== null;
     // What "always" on this card grants — see `PendingPermission.escapedPath`.
     // For a file tool the parent directory: the worker that wrote
@@ -590,6 +615,7 @@ export function makePolicy(
     ) {
       // Carry the reason through so the log shows what was waved past.
       hooks.onAutoAllow(agent, toolName, opts.decisionReason);
+      rememberCwd();
       return { behavior: 'allow' };
     }
 
@@ -632,13 +658,21 @@ export function makePolicy(
       input,
       title,
       description,
-      decisionReason: opts.decisionReason ??
-        (leavesFolder ? `Path is outside the mission folder (${folder})` : undefined),
+      // The card's one warning line. When the folder boundary is the reason,
+      // say that — the SDK's own heuristic ("contains shell syntax (&) that
+      // cannot be statically analyzed") is true of most real commands and
+      // tells the reader nothing about why THIS one stopped.
+      decisionReason: leavesFolder
+        ? (escape?.reason ?? `${filePath} is outside the mission folder`)
+        : opts.decisionReason,
       escapedPath,
     });
 
     return new Promise<PermissionResult>((resolve) => {
-      hooks.register(id, { resolve, toolName, suggestions: opts.suggestions, escapedPath });
+      hooks.register(id, {
+        resolve: (r) => { if (r.behavior === 'allow') rememberCwd(); resolve(r); },
+        toolName, suggestions: opts.suggestions, escapedPath,
+      });
       opts.signal.addEventListener('abort', () => {
         if (hooks.unregister(id)) {
           resolve({ behavior: 'deny', message: 'Run was interrupted.' });

package/src/provider.test.ts

@@ -364,3 +364,19 @@ test('a role provider carries the role’s model, so every alias resolves on its
   assert.equal(withRoleModel(bare, '').model, undefined);
   assert.equal(withRoleModel(bare, undefined), bare, 'no change returns the same object');
 });
+
+
+test('agents do not inherit the server\'s own environment: PORT and FOREMAN_* are dropped', async () => {
+  const saved = { PORT: process.env.PORT, FOREMAN_HOME: process.env.FOREMAN_HOME, FOREMAN_BIND: process.env.FOREMAN_BIND };
+  process.env.PORT = '4177'; process.env.FOREMAN_HOME = '/tmp/fh'; process.env.FOREMAN_BIND = 'all';
+  try {
+    const p = await resolveProvider({ kind: 'claude-code' }, '/tmp/foreman-test-root');
+    const env = providerEnv(p).env ?? {};
+    assert.equal(env.PORT, undefined, 'a dev server a worker starts must not bind the dashboard port');
+    assert.equal(env.FOREMAN_HOME, undefined);
+    assert.equal(env.FOREMAN_BIND, undefined);
+    assert.ok(env.PATH, 'the rest of the environment survives');
+  } finally {
+    for (const [k, v] of Object.entries(saved)) { if (v === undefined) delete process.env[k]; else process.env[k] = v; }
+  }
+});

package/src/provider.ts

@@ -427,8 +427,22 @@ export interface AgentEnv {
  * programming error rather than a user error, and the failure mode it guards
  * against is a leaked token, so it fails loudly instead of degrading.
  */
+/**
+ * The server's own knobs, which an agent must not inherit. `PORT` is the one
+ * that bit: the service sets it for the dashboard, an agent's dev server
+ * honoured it, bound Foreman's port on a wildcard address and shadowed the
+ * dashboard on localhost until it exited. The rest are Foreman's operating
+ * settings — none of them means anything to a project's own tooling, and a
+ * worker reading `FOREMAN_HOME` would only find somewhere it should not be.
+ */
+const SERVER_ONLY_VARS = [
+  'PORT', 'FOREMAN_SERVICES_PORT', 'FOREMAN_HOME', 'FOREMAN_BIND', 'FOREMAN_BROWSER',
+  'FOREMAN_AUTH_MODE', 'FOREMAN_CLAUDE_CONFIG_DIR', 'FOREMAN_CLAUDE_EXECUTABLE', 'FOREMAN_NO_TELEGRAM', 'FOREMAN_LOG',
+];
+
 export function providerEnv(p: ResolvedProvider, gatewayUrl?: string): AgentEnv {
   const env: Record<string, string | undefined> = { ...process.env };
+  for (const v of SERVER_ONLY_VARS) delete env[v];
   env.CLAUDE_CONFIG_DIR = p.configDir;
 
   if (p.wire === 'anthropic-native') {