@arnilo/prism-coding-agent 0.0.16 → 0.0.18

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.0.18] - 2026-07-30
+
+### Changed
+- `repo_search` is literal-only: `mode: "regex"` removed from the tool schema; `compileSearchPattern` no longer compiles `RegExp` (ReDoS mitigation).
+- Default `write`/`edit` local `writeFile` uses same-directory temp + `rename` for crash-safe replacement.
+
+## [0.0.17] - 2026-07-29
+
+### Added
+- `ShellToolOptions.envAllowlist` restricts the environment the spawn hook and child process see (secret scrubbing without re-implementing the hook).
+
+### Changed
+- Released with exact 0.0.17 graph.
+
 ## [0.0.16] - 2026-07-26
 
 ### Changed

package/README.md

@@ -73,7 +73,7 @@ const askUser = createAskUserDecisionTool({
 | `write` | `{ path, content }` | Bounded UTF-8 input; `Successfully wrote N bytes (M lines) to <abs>`. |
 | `edit` | `{ path, edits: [{oldText,newText}] }` | Bounded target/input/count; `Successfully replaced N block(s)` + diff metadata. |
 | `repo_list` | `{ path?, includeHidden?, maxDepth?, maxResults?, offset? }` | Deterministic relative entries; skips hidden/excluded basenames; does not follow symlinks; paginates with `nextOffset`. |
-| `repo_search` | `{ query, path?, mode?, caseSensitive?, includeHidden?, context?, maxMatches? }` | Literal (default) or bounded regex matches with context; skips binary/excluded paths; finite scan/match/time caps. |
+| `repo_search` | `{ query, path?, mode?, caseSensitive?, includeHidden?, context?, maxMatches? }` | Literal substring matches with context; skips binary/excluded paths; finite scan/match/time caps. |
 | `git_*` / `coding_check` | via `createGitTools(cwd, { commitIdentity, checks? })` | Opt-in structured Git status/diff/branch/worktree/apply/commit/PR-handoff and named checks. Not in `createCodingTools()`. |
 | `ask_user_decision` | via `createAskUserDecisionTool({ ask })` | Opt-in user choice: question + options (3 pros/3 cons); `selectionMode` single\|multiple; `allowCustom` for XOR free-text; host `ask` returns `selectedId` / `selectedIds` / `customText`. Durable: `suspendAskUserDecision` + resume validators. Not in default aggregators. |
 

package/dist/atomic-write.d.ts

@@ -0,0 +1,3 @@
+export declare function atomicWriteUtf8File(targetPath: string, content: string, options?: {
+    signal?: AbortSignal;
+}): Promise<void>;

package/dist/atomic-write.js

@@ -0,0 +1,24 @@
+/**
+ * Same-directory temp + rename for crash-safe UTF-8 file replacement.
+ * Custom WriteOperations/EditOperations should provide equivalent durability.
+ */
+import { randomBytes } from "node:crypto";
+import { rename as fsRename, unlink as fsUnlink, writeFile as fsWriteFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+export async function atomicWriteUtf8File(targetPath, content, options) {
+    const dir = dirname(targetPath);
+    const tempPath = join(dir, `.prism-write-${randomBytes(8).toString("hex")}`);
+    try {
+        await fsWriteFile(tempPath, content, { encoding: "utf-8", signal: options?.signal });
+        if (options?.signal?.aborted) {
+            await fsUnlink(tempPath).catch(() => { });
+            throw new Error("Operation aborted");
+        }
+        await fsRename(tempPath, targetPath);
+    }
+    catch (error) {
+        await fsUnlink(tempPath).catch(() => { });
+        throw error;
+    }
+}
+//# sourceMappingURL=atomic-write.js.map

package/dist/edit.js

@@ -21,7 +21,8 @@
  */
 import { Buffer } from "node:buffer";
 import { constants } from "node:fs";
-import { access as fsAccess, stat as fsStat, writeFile as fsWriteFile } from "node:fs/promises";
+import { access as fsAccess, stat as fsStat } from "node:fs/promises";
+import { atomicWriteUtf8File } from "./atomic-write.js";
 import { readFileBounded } from "./bounded-file.js";
 import { applyEditsToNormalizedContent, detectLineEnding, generateDiffString, generateUnifiedPatch, normalizeToLF, restoreLineEndings, stripBom, } from "./edit-diff.js";
 import { enforceExecutionPolicy } from "./execution-policy.js";
@@ -30,7 +31,7 @@ import { DEFAULT_MAX_EDIT_FILE_BYTES, DEFAULT_MAX_EDIT_INPUT_BYTES, DEFAULT_MAX_
 import { resolveToCwd } from "./path-utils.js";
 const defaultEditOperations = {
     readFile: (path, options) => readFileBounded(path, options.maxBytes, options.signal),
-    writeFile: (path, content, options) => fsWriteFile(path, content, { encoding: "utf-8", signal: options?.signal }),
+    writeFile: (path, content, options) => atomicWriteUtf8File(path, content, { signal: options?.signal }),
     access: (path) => fsAccess(path, constants.R_OK | constants.W_OK),
     statFile: async (path) => ({ size: (await fsStat(path)).size }),
 };

package/dist/repository.d.ts

@@ -85,7 +85,7 @@ export interface RepositorySearchRequest {
     readonly root: string;
     readonly query: string;
     readonly path?: string;
-    readonly mode?: "literal" | "regex";
+    readonly mode?: "literal";
     readonly caseSensitive?: boolean;
     readonly includeHidden?: boolean;
     readonly exclude?: readonly string[];
@@ -116,7 +116,7 @@ export declare function resolveRepoPath(root: string, inputPath: string | undefi
     rootReal: string;
 }>;
 export declare function isBinaryBuffer(buffer: Buffer): boolean;
-export declare function compileSearchPattern(query: string, mode: "literal" | "regex", caseSensitive: boolean, maxPatternBytes: number): {
+export declare function compileSearchPattern(query: string, caseSensitive: boolean, maxPatternBytes: number): {
     testLine: (line: string) => {
         column: number;
     } | null;

package/dist/repository.js

@@ -119,46 +119,28 @@ export function isBinaryBuffer(buffer) {
     }
     return false;
 }
-export function compileSearchPattern(query, mode, caseSensitive, maxPatternBytes) {
+export function compileSearchPattern(query, caseSensitive, maxPatternBytes) {
     const patternBytes = Buffer.byteLength(query, "utf8");
     if (patternBytes < 1)
         throw new RepositoryError("query must be non-empty");
     if (patternBytes > maxPatternBytes) {
         throw new RepositoryError(`query exceeds ${maxPatternBytes} byte pattern limit`);
     }
-    if (mode === "literal") {
-        if (caseSensitive) {
-            return {
-                patternBytes,
-                testLine: (line) => {
-                    const column = line.indexOf(query);
-                    return column >= 0 ? { column: column + 1 } : null;
-                },
-            };
-        }
-        const needle = query.toLowerCase();
+    if (caseSensitive) {
         return {
             patternBytes,
             testLine: (line) => {
-                const column = line.toLowerCase().indexOf(needle);
+                const column = line.indexOf(query);
                 return column >= 0 ? { column: column + 1 } : null;
             },
         };
     }
-    let regex;
-    try {
-        regex = new RegExp(query, caseSensitive ? "u" : "iu");
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        throw new RepositoryError(`invalid regular expression: ${message}`);
-    }
+    const needle = query.toLowerCase();
     return {
         patternBytes,
         testLine: (line) => {
-            regex.lastIndex = 0;
-            const match = regex.exec(line);
-            return match && match.index !== undefined ? { column: match.index + 1 } : null;
+            const column = line.toLowerCase().indexOf(needle);
+            return column >= 0 ? { column: column + 1 } : null;
         },
     };
 }
@@ -477,11 +459,11 @@ async function searchFileLines(absolutePath, relativePath, testLine, options) {
 }
 async function searchLocal(request, defaults) {
     const mode = request.mode ?? "literal";
-    if (mode !== "literal" && mode !== "regex") {
-        throw new RepositoryError(`unsupported search mode: ${String(mode)}`);
+    if (mode !== "literal") {
+        throw new RepositoryError(`unsupported search mode: ${String(mode)} (literal only)`);
     }
     const caseSensitive = request.caseSensitive === true;
-    const { testLine } = compileSearchPattern(request.query, mode, caseSensitive, defaults.maxPatternBytes);
+    const { testLine } = compileSearchPattern(request.query, caseSensitive, defaults.maxPatternBytes);
     const resolved = await resolveRepoPath(request.root, request.path);
     const maxMatches = validateCodingLimit("maxMatches", request.maxMatches ?? defaults.maxMatches, HARD_MAX_SEARCH_MATCHES);
     const context = validateCodingLimitAllowZero("context", request.context ?? defaults.maxContextLines, HARD_MAX_SEARCH_CONTEXT_LINES);

package/dist/search.d.ts

@@ -1,5 +1,5 @@
 /**
- * `repo_search` tool: bounded native literal/regex repository text search.
+ * `repo_search` tool: bounded native literal repository text search.
  */
 import type { ExecutionPolicy, ToolDefinition } from "@arnilo/prism";
 import { type RepositoryLimitOptions, type RepositoryOperations } from "./repository.js";

package/dist/search.js

@@ -43,19 +43,19 @@ export function createRepoSearchTool(cwd, options) {
     const ops = options?.operations ?? createLocalRepositoryOperations(limits);
     return {
         name: "repo_search",
-        description: `Search text files under the workspace. Default mode is literal substring match; set mode=regex for bounded regular expressions. Skips binary files, excluded basenames (default: ${limits.exclude.join(", ")}), and hidden names unless includeHidden is true. Does not follow symlinks. Caps matches/scanned bytes/time.`,
+        description: `Search text files under the workspace using literal substring match. Skips binary files, excluded basenames (default: ${limits.exclude.join(", ")}), and hidden names unless includeHidden is true. Does not follow symlinks. Caps matches/scanned bytes/time.`,
         parameters: {
             type: "object",
             properties: {
-                query: { type: "string", description: "Literal text or regular expression to search for (required)" },
+                query: { type: "string", description: "Literal text to search for (required)" },
                 path: {
                     type: "string",
                     description: "Workspace-relative directory or file to search (default: workspace root)",
                 },
                 mode: {
                     type: "string",
-                    description: 'Search mode: "literal" (default) or "regex"',
-                    enum: ["literal", "regex"],
+                    description: "Search mode: literal substring match only",
+                    enum: ["literal"],
                 },
                 caseSensitive: {
                     type: "boolean",
@@ -85,7 +85,13 @@ export function createRepoSearchTool(cwd, options) {
             if (query.length === 0)
                 return errorResult(toolCallId, "query is required and must be a non-empty string.");
             const path = typeof args.path === "string" ? args.path : undefined;
-            const mode = args.mode === "regex" ? "regex" : "literal";
+            if (args.mode === "regex") {
+                return errorResult(toolCallId, 'repo_search no longer supports mode "regex"; use literal substring search.');
+            }
+            if (args.mode !== undefined && args.mode !== "literal") {
+                return errorResult(toolCallId, `unsupported search mode: ${String(args.mode)}`);
+            }
+            const mode = "literal";
             const caseSensitive = args.caseSensitive === true;
             const includeHidden = args.includeHidden === true;
             let contextLines;

package/dist/shell.d.ts

@@ -55,6 +55,9 @@ export interface ShellToolOptions {
     shellPath?: string;
     /** Hook to adjust command, cwd, or env before execution. */
     spawnHook?: BashSpawnHook;
+    /** Restrict the process environment cloned for the spawn hook / child process to these
+     *  names (e.g. scrub secrets). Unset keeps the full `process.env` clone. */
+    envAllowlist?: readonly string[];
     /** Max lines kept in the tail snapshot (default 2000). */
     maxLines?: number;
     /** Max bytes kept in the tail snapshot (default 50KB). */

package/dist/shell.js

@@ -29,6 +29,18 @@ import { OutputAccumulator } from "./output-accumulator.js";
 import { formatSize } from "./truncate.js";
 const EXIT_STDIO_GRACE_MS = 100;
 // --- spawn internals (re-ported from pi utils/shell.js + utils/child-process.js) ---
+/** Clone the process environment, optionally restricted to an allowlist of names. */
+function pickSpawnEnv(allowlist) {
+    if (!allowlist)
+        return { ...process.env };
+    const env = {};
+    for (const name of allowlist) {
+        const value = process.env[name];
+        if (value !== undefined)
+            env[name] = value;
+    }
+    return env;
+}
 /** Resolve the shell binary + args. shellPath → SHELL env → /bin/bash → sh. */
 export function getShellConfig(customShellPath) {
     if (customShellPath) {
@@ -284,9 +296,10 @@ export function createShellTool(cwd, options) {
                 return { toolCallId, name: "shell", content: [{ type: "text", text: message }], error: { message } };
             }
             const resolvedCommand = commandPrefix ? `${commandPrefix}\n${command}` : command;
+            const baseEnv = pickSpawnEnv(options?.envAllowlist);
             let spawnContext = spawnHook
-                ? spawnHook({ command: resolvedCommand, cwd, env: { ...process.env } })
-                : { command: resolvedCommand, cwd, env: { ...process.env } };
+                ? spawnHook({ command: resolvedCommand, cwd, env: baseEnv })
+                : { command: resolvedCommand, cwd, env: baseEnv };
             const policyCheck = await enforceExecutionPolicy(options?.executionPolicy, {
                 kind: "shell",
                 operation: "execute",

package/dist/write.js

@@ -15,14 +15,15 @@
  *    (pi would throw "Operation aborted" even after a successful write — misleading, so dropped).
  */
 import { Buffer } from "node:buffer";
-import { mkdir as fsMkdir, writeFile as fsWriteFile } from "node:fs/promises";
+import { mkdir as fsMkdir } from "node:fs/promises";
 import { dirname } from "node:path";
+import { atomicWriteUtf8File } from "./atomic-write.js";
 import { enforceExecutionPolicy } from "./execution-policy.js";
 import { withFileMutationQueue } from "./file-mutation-queue.js";
 import { DEFAULT_MAX_WRITE_BYTES, HARD_MAX_WRITE_BYTES, validateCodingLimit } from "./limits.js";
 import { resolveToCwd } from "./path-utils.js";
 const defaultWriteOperations = {
-    writeFile: (path, content, options) => fsWriteFile(path, content, { encoding: "utf-8", signal: options?.signal }),
+    writeFile: (path, content, options) => atomicWriteUtf8File(path, content, { signal: options?.signal }),
     mkdir: (dir) => fsMkdir(dir, { recursive: true }).then(() => { }),
 };
 function errorResult(toolCallId, message) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arnilo/prism-coding-agent",
-  "version": "0.0.16",
+  "version": "0.0.18",
   "description": "Optional coding-agent tools (shell, read, write, edit, repo_list, repo_search, opt-in Git/check/ask-user-decision, and durable plan/checkpoint helpers) package for Prism.",
   "type": "module",
   "main": "./dist/index.js",
@@ -28,8 +28,8 @@
     "diff": "^9.0.0"
   },
   "peerDependencies": {
-    "@arnilo/prism": "0.0.16",
-    "@arnilo/prism-workflows": "0.0.16"
+    "@arnilo/prism": "0.0.18",
+    "@arnilo/prism-workflows": "0.0.18"
   },
   "devDependencies": {
     "@arnilo/prism": "file:../..",