@bahulam/code 2.6.0

package/src/permissions/injection-check.mjs

@@ -0,0 +1,60 @@
+/**
+ * Command Injection Check — detect dangerous shell patterns.
+ *
+ * Scans commands for common injection vectors before allowing
+ * Bash tool execution.
+ */
+
+const DANGEROUS_PATTERNS = [
+    { pattern: /;\s*rm\s+-rf\s+\//, label: 'rm -rf /' },
+    { pattern: /\|\s*sh\b/, label: 'pipe to sh' },
+    { pattern: /\|\s*bash\b/, label: 'pipe to bash' },
+    { pattern: /`[^`]+`/, label: 'backtick execution' },
+    { pattern: /\$\([^)]+\)/, label: 'command substitution' },
+    { pattern: />\s*\/etc\//, label: 'write to /etc' },
+    { pattern: />\s*\/usr\//, label: 'write to /usr' },
+    { pattern: /curl\s.*\|\s*(bash|sh)/, label: 'curl pipe to shell' },
+    { pattern: /wget\s.*\|\s*(bash|sh)/, label: 'wget pipe to shell' },
+    { pattern: /mkfs\./, label: 'filesystem format' },
+    { pattern: /dd\s+if=.*of=\/dev\//, label: 'dd to device' },
+    { pattern: /:\(\)\s*\{.*\|.*&\s*\}/, label: 'fork bomb' },
+    { pattern: /chmod\s+777\s+\//, label: 'chmod 777 root' },
+    { pattern: />\s*\/dev\/sda/, label: 'write to disk device' },
+    { pattern: /eval\s+"?\$/, label: 'eval variable' },
+];
+
+/**
+ * Check a command string for injection patterns.
+ * @param {string} command - shell command to check
+ * @returns {{ safe: boolean, pattern?: string, label?: string }}
+ */
+export function checkInjection(command) {
+    if (typeof command !== 'string') {
+        return { safe: false, label: 'non-string command' };
+    }
+
+    for (const { pattern, label } of DANGEROUS_PATTERNS) {
+        if (pattern.test(command)) {
+            return { safe: false, pattern: pattern.source, label };
+        }
+    }
+
+    return { safe: true };
+}
+
+/**
+ * Get the list of dangerous patterns (for display/testing).
+ * @returns {Array<{ pattern: RegExp, label: string }>}
+ */
+export function getDangerousPatterns() {
+    return DANGEROUS_PATTERNS.map(({ pattern, label }) => ({ pattern, label }));
+}
+
+/**
+ * Check if a command uses any elevated privilege patterns.
+ * @param {string} command
+ * @returns {boolean}
+ */
+export function usesElevation(command) {
+    return /\bsudo\b/.test(command) || /\bsu\s+-?\s/.test(command) || /\bdoas\b/.test(command);
+}

package/src/permissions/path-check.mjs

@@ -0,0 +1,102 @@
+/**
+ * File Path Sanitization — validate file paths before allowing access.
+ *
+ * Prevents directory traversal, blocks sensitive files, and normalizes paths.
+ */
+
+import path from 'path';
+
+/** File patterns that should never be read or written. */
+const SENSITIVE_PATTERNS = [
+    /\.env$/,
+    /\.env\..+$/,
+    /credentials\.json$/,
+    /credentials\.yaml$/,
+    /\.pem$/,
+    /\.key$/,
+    /id_rsa$/,
+    /id_ed25519$/,
+    /\.ssh\/config$/,
+    /\.netrc$/,
+    /\.pgpass$/,
+    /\.aws\/credentials$/,
+    /\.docker\/config\.json$/,
+    /secrets\.yaml$/,
+    /secrets\.json$/,
+];
+
+/** Directories that should never be written to. */
+const PROTECTED_DIRS = [
+    '/etc',
+    '/usr',
+    '/sbin',
+    '/boot',
+    '/sys',
+    '/proc',
+];
+
+/**
+ * Validate a file path for safety.
+ * @param {string} filePath - the path to validate
+ * @param {object} [options]
+ * @param {string} [options.cwd] - current working directory (default: process.cwd())
+ * @param {boolean} [options.write] - whether this is a write operation
+ * @returns {{ safe: boolean, resolved: string, reason?: string, warning?: string }}
+ */
+export function validatePath(filePath, options = {}) {
+    if (typeof filePath !== 'string' || filePath.trim().length === 0) {
+        return { safe: false, resolved: '', reason: 'Empty or invalid path' };
+    }
+
+    const resolved = path.resolve(filePath);
+    const cwd = options.cwd || process.cwd();
+
+    // Check for null bytes (path injection)
+    if (filePath.includes('\0')) {
+        return { safe: false, resolved, reason: 'Null byte in path' };
+    }
+
+    // Check sensitive file patterns
+    for (const pattern of SENSITIVE_PATTERNS) {
+        if (pattern.test(resolved) || pattern.test(path.basename(resolved))) {
+            return { safe: false, resolved, reason: 'Sensitive file' };
+        }
+    }
+
+    // Check protected directories for writes
+    if (options.write) {
+        for (const dir of PROTECTED_DIRS) {
+            if (resolved.startsWith(dir + '/') || resolved === dir) {
+                return { safe: false, resolved, reason: `Protected directory: ${dir}` };
+            }
+        }
+    }
+
+    // Check for traversal outside cwd
+    let warning;
+    if (!resolved.startsWith(cwd) && !resolved.startsWith('/tmp')) {
+        warning = 'Path is outside the current working directory';
+    }
+
+    return { safe: true, resolved, warning };
+}
+
+/**
+ * Check if a filename matches sensitive patterns.
+ * @param {string} filename
+ * @returns {boolean}
+ */
+export function isSensitiveFile(filename) {
+    for (const pattern of SENSITIVE_PATTERNS) {
+        if (pattern.test(filename)) return true;
+    }
+    return false;
+}
+
+/**
+ * Get list of sensitive patterns (for display/testing).
+ * @returns {RegExp[]}
+ */
+export function getSensitivePatterns() {
+    return [...SENSITIVE_PATTERNS];
+}

package/src/permissions/prompt.mjs

@@ -0,0 +1,73 @@
+/**
+ * Permission Prompts — interactive yes/no for dangerous operations.
+ *
+ * Used in "default" permission mode to ask the user before executing
+ * potentially dangerous tool calls (Bash, Edit, Write, Agent).
+ */
+
+/**
+ * Prompt the user for permission to execute a tool.
+ * @param {string} toolName - tool being invoked
+ * @param {object} input - tool input
+ * @param {object} rl - readline interface with .question()
+ * @returns {Promise<boolean>} true if allowed
+ */
+export async function promptPermission(toolName, input, rl) {
+    if (!rl || typeof rl.question !== 'function') {
+        // No readline available — deny by default
+        return false;
+    }
+
+    const summary = formatToolSummary(toolName, input);
+    return new Promise(resolve => {
+        rl.question(`Allow ${summary}? [y/N] `, answer => {
+            resolve(answer.trim().toLowerCase() === 'y');
+        });
+    });
+}
+
+/**
+ * Format a human-readable summary of a tool call.
+ * @param {string} toolName
+ * @param {object} input
+ * @returns {string}
+ */
+export function formatToolSummary(toolName, input) {
+    switch (toolName) {
+        case 'Bash':
+            return `Bash: ${truncate(input.command || '', 60)}`;
+        case 'Edit':
+            return `Edit: ${input.file_path || 'unknown file'}`;
+        case 'Write':
+            return `Write: ${input.file_path || 'unknown file'} (${(input.content || '').length} chars)`;
+        case 'MultiEdit':
+            return `MultiEdit: ${input.file_path || 'unknown file'} (${(input.edits || []).length} edits)`;
+        case 'Agent':
+            return `Agent: ${truncate(input.prompt || '', 40)}`;
+        case 'WebFetch':
+            return `WebFetch: ${truncate(input.url || '', 50)}`;
+        case 'RemoteTrigger':
+            return `RemoteTrigger: ${input.url || 'unknown'}`;
+        default:
+            return `${toolName}`;
+    }
+}
+
+/**
+ * Check if a tool requires interactive permission in default mode.
+ * Read-only tools are always allowed.
+ * @param {string} toolName
+ * @returns {boolean}
+ */
+export function requiresPermission(toolName) {
+    const SAFE_TOOLS = new Set([
+        'Read', 'Glob', 'Grep', 'LS', 'ToolSearch',
+        'AskUser', 'CronList', 'TodoWrite',
+    ]);
+    return !SAFE_TOOLS.has(toolName);
+}
+
+function truncate(str, maxLen) {
+    if (str.length <= maxLen) return str;
+    return str.substring(0, maxLen - 3) + '...';
+}

package/src/permissions/sandbox.mjs

@@ -0,0 +1,112 @@
+/**
+ * Sandbox — wrap commands in platform-specific sandboxes.
+ *
+ * Linux: bubblewrap (bwrap)
+ * macOS: sandbox-exec (seatbelt)
+ * Windows/other: passthrough (no sandbox)
+ */
+
+export class Sandbox {
+    /**
+     * @param {string} [platform] - override process.platform
+     */
+    constructor(platform) {
+        this.platform = platform || process.platform;
+    }
+
+    /**
+     * Wrap a command to run inside a sandbox.
+     * @param {string} command - the command to sandbox
+     * @param {object} [options]
+     * @param {string[]} [options.allowWrite] - directories to allow writes
+     * @param {string[]} [options.allowNet] - allow network access (macOS)
+     * @param {boolean} [options.allowDevices] - allow device access
+     * @returns {string} sandboxed command
+     */
+    wrapCommand(command, options = {}) {
+        if (this.platform === 'linux') return this.bubblewrap(command, options);
+        if (this.platform === 'darwin') return this.seatbelt(command, options);
+        return command; // fallback: no sandbox
+    }
+
+    /**
+     * Linux sandbox using bubblewrap.
+     * Creates a minimal read-only root with /dev, /proc, /tmp.
+     */
+    bubblewrap(command, opts = {}) {
+        const args = [
+            '--ro-bind', '/', '/',
+            '--dev', '/dev',
+            '--proc', '/proc',
+            '--tmpfs', '/tmp',
+        ];
+
+        // Allow specific writable directories
+        if (opts.allowWrite) {
+            for (const dir of opts.allowWrite) {
+                if (typeof dir === 'string' && dir.length > 0) {
+                    args.push('--bind', dir, dir);
+                }
+            }
+        }
+
+        // Allow /dev access if requested
+        if (opts.allowDevices) {
+            args.push('--dev-bind', '/dev', '/dev');
+        }
+
+        return `bwrap ${args.join(' ')} -- ${command}`;
+    }
+
+    /**
+     * macOS sandbox using sandbox-exec with a seatbelt profile.
+     * Returns a sandbox-exec wrapped command with a generated profile.
+     */
+    seatbelt(command, opts = {}) {
+        const rules = [
+            '(version 1)',
+            '(deny default)',
+            '(allow process-exec)',
+            '(allow process-fork)',
+            '(allow file-read*)',
+            '(allow sysctl-read)',
+            '(allow mach-lookup)',
+        ];
+
+        // Allow writes to specific directories
+        if (opts.allowWrite) {
+            for (const dir of opts.allowWrite) {
+                if (typeof dir === 'string' && dir.length > 0) {
+                    rules.push(`(allow file-write* (subpath "${dir}"))`);
+                }
+            }
+        }
+
+        // Allow /tmp writes by default
+        rules.push('(allow file-write* (subpath "/tmp"))');
+
+        // Allow network if requested
+        if (opts.allowNet) {
+            rules.push('(allow network*)');
+        }
+
+        const profile = rules.join('\n');
+        // Escape single quotes in profile for shell
+        const escaped = profile.replace(/'/g, "'\\''");
+        return `sandbox-exec -p '${escaped}' ${command}`;
+    }
+
+    /**
+     * Check if sandbox tooling is available on this platform.
+     * @returns {{ available: boolean, tool: string }}
+     */
+    check() {
+        if (this.platform === 'linux') {
+            return { available: true, tool: 'bwrap' };
+        }
+        if (this.platform === 'darwin') {
+            return { available: true, tool: 'sandbox-exec' };
+        }
+        return { available: false, tool: 'none' };
+    }
+}

package/src/plugins/loader.mjs

@@ -0,0 +1,138 @@
+/**
+ * Plugin Loader — load plugins from directory, git, or npm.
+ *
+ * Plugins can provide: tools, agents, skills, hooks.
+ * Plugin format: a directory with a plugin.json manifest.
+ */
+
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import { execSync } from 'child_process';
+
+export class PluginLoader {
+    /**
+     * @param {string} [pluginDir] - directory to scan for plugins
+     */
+    constructor(pluginDir) {
+        this.pluginDir = pluginDir ||
+            path.join(os.homedir(), '.claude', 'plugins');
+        this.plugins = new Map();
+    }
+
+    /**
+     * Load plugins from the plugin directory.
+     * @returns {Array<object>} loaded plugin manifests
+     */
+    async loadFromDirectory(dir) {
+        const targetDir = dir || this.pluginDir;
+        const loaded = [];
+
+        try {
+            if (!fs.existsSync(targetDir)) return loaded;
+
+            const entries = fs.readdirSync(targetDir, { withFileTypes: true });
+            for (const entry of entries) {
+                if (!entry.isDirectory()) continue;
+
+                const manifestPath = path.join(targetDir, entry.name, 'plugin.json');
+                if (!fs.existsSync(manifestPath)) continue;
+
+                try {
+                    const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf-8'));
+                    manifest._dir = path.join(targetDir, entry.name);
+                    manifest._name = entry.name;
+                    this.plugins.set(manifest.name || entry.name, manifest);
+                    loaded.push(manifest);
+                } catch {
+                    // Skip malformed plugins
+                }
+            }
+        } catch {
+            // Directory not readable
+        }
+
+        return loaded;
+    }
+
+    /**
+     * Clone a plugin from a git repo and load it.
+     * @param {string} repoUrl - git repository URL
+     * @param {string} [name] - plugin name (default: repo name)
+     * @returns {object|null} loaded manifest
+     */
+    async loadFromGit(repoUrl, name) {
+        const pluginName = name || repoUrl.split('/').pop()?.replace('.git', '') || 'plugin';
+        const targetDir = path.join(this.pluginDir, pluginName);
+
+        try {
+            fs.mkdirSync(this.pluginDir, { recursive: true });
+
+            if (fs.existsSync(targetDir)) {
+                // Update existing
+                execSync('git pull', { cwd: targetDir, stdio: 'pipe' });
+            } else {
+                // Clone new
+                execSync(`git clone --depth 1 ${repoUrl} ${targetDir}`, { stdio: 'pipe' });
+            }
+
+            const manifestPath = path.join(targetDir, 'plugin.json');
+            if (fs.existsSync(manifestPath)) {
+                const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf-8'));
+                manifest._dir = targetDir;
+                manifest._name = pluginName;
+                this.plugins.set(manifest.name || pluginName, manifest);
+                return manifest;
+            }
+        } catch {
+            // Git operation failed
+        }
+
+        return null;
+    }
+
+    /**
+     * Get all installed plugins.
+     * @returns {Array<object>}
+     */
+    getInstalledPlugins() {
+        return [...this.plugins.values()];
+    }
+
+    /**
+     * Get a plugin by name.
+     * @param {string} name
+     * @returns {object|undefined}
+     */
+    getPlugin(name) {
+        return this.plugins.get(name);
+    }
+
+    /**
+     * Remove a plugin by name.
+     * @param {string} name
+     * @returns {boolean}
+     */
+    removePlugin(name) {
+        const plugin = this.plugins.get(name);
+        if (!plugin) return false;
+
+        try {
+            if (plugin._dir && fs.existsSync(plugin._dir)) {
+                fs.rmSync(plugin._dir, { recursive: true, force: true });
+            }
+        } catch {
+            // Best effort
+        }
+
+        return this.plugins.delete(name);
+    }
+
+    /**
+     * Get plugin count.
+     * @returns {number}
+     */
+    count() {
+        return this.plugins.size;
+    }
+}

package/src/skills/installer.mjs

@@ -0,0 +1,188 @@
+/**
+ * Portable skill installation and lock metadata.
+ *
+ * Bundles are copied as data. No scripts or hooks from a skill are executed.
+ */
+
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { discoverSkillDirectories, parseSkill } from './loader.mjs';
+
+function isGitSource(source) {
+    return /^(https?:\/\/|ssh:\/\/|git@|github:)/.test(source) || source.endsWith('.git');
+}
+
+function normalizeGitSource(source) {
+    if (source.startsWith('github:')) {
+        return `https://github.com/${source.slice('github:'.length).replace(/\.git$/, '')}.git`;
+    }
+    return source;
+}
+
+function discoverInstallableSkills(root, maxDepth = 4) {
+    const direct = discoverSkillDirectories(root);
+    if (direct.length) return direct;
+
+    const found = [];
+    const queue = [{ dir: root, depth: 0 }];
+    const ignored = new Set(['.git', 'node_modules', '.venv', 'venv', 'dist', 'build']);
+    while (queue.length) {
+        const { dir, depth } = queue.shift();
+        if (depth >= maxDepth) continue;
+        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+            if (!entry.isDirectory() || entry.isSymbolicLink() || ignored.has(entry.name)) continue;
+            const child = path.join(dir, entry.name);
+            if (fs.existsSync(path.join(child, 'SKILL.md'))) {
+                found.push(child);
+            } else {
+                queue.push({ dir: child, depth: depth + 1 });
+            }
+        }
+    }
+    return found.sort();
+}
+
+function rejectSymlinks(root) {
+    const queue = [root];
+    while (queue.length) {
+        const current = queue.shift();
+        for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+            const fullPath = path.join(current, entry.name);
+            if (entry.isSymbolicLink()) throw new Error(`Symlinked skill resource is not allowed: ${fullPath}`);
+            if (entry.isDirectory()) queue.push(fullPath);
+        }
+    }
+}
+
+function copyDirectory(source, destination) {
+    fs.mkdirSync(destination, { recursive: true });
+    for (const entry of fs.readdirSync(source, { withFileTypes: true })) {
+        const from = path.join(source, entry.name);
+        const to = path.join(destination, entry.name);
+        if (entry.isDirectory()) copyDirectory(from, to);
+        else if (entry.isFile()) fs.copyFileSync(from, to);
+    }
+}
+
+function readJson(file, fallback) {
+    try { return JSON.parse(fs.readFileSync(file, 'utf-8')); } catch { return fallback; }
+}
+
+function writeJson(file, value) {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`, 'utf-8');
+}
+
+export class SkillInstaller {
+    constructor({ cwd = process.cwd(), homeDir = os.homedir() } = {}) {
+        this.cwd = path.resolve(cwd);
+        this.homeDir = homeDir;
+    }
+
+    paths(scope = 'global') {
+        const base = scope === 'project'
+            ? path.join(this.cwd, '.bahulam')
+            : path.join(this.homeDir, '.bahulam');
+        return {
+            skillsDir: path.join(base, 'skills'),
+            lockFile: path.join(base, 'skills.lock.json'),
+        };
+    }
+
+    install(source, { scope = 'global', force = false, onlyNames = null } = {}) {
+        if (!source) throw new Error('A local directory or Git repository is required');
+        const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'bahulam-code-skill-'));
+        let resolvedSource;
+        let commit = null;
+        try {
+            if (isGitSource(source)) {
+                resolvedSource = path.join(tempRoot, 'repository');
+                execFileSync(
+                    'git',
+                    ['clone', '--depth', '1', normalizeGitSource(source), resolvedSource],
+                    { stdio: 'pipe' },
+                );
+                commit = execFileSync('git', ['-C', resolvedSource, 'rev-parse', 'HEAD'], { encoding: 'utf-8' }).trim();
+            } else {
+                resolvedSource = fs.realpathSync(path.resolve(this.cwd, source));
+            }
+
+            const skillDirs = discoverInstallableSkills(resolvedSource);
+            if (!skillDirs.length) throw new Error(`No SKILL.md bundles found in ${source}`);
+
+            const { skillsDir, lockFile } = this.paths(scope);
+            const lock = readJson(lockFile, { version: 1, skills: {} });
+            const installed = [];
+            fs.mkdirSync(skillsDir, { recursive: true });
+
+            const plans = [];
+            for (const skillDir of skillDirs) {
+                rejectSymlinks(skillDir);
+                const content = fs.readFileSync(path.join(skillDir, 'SKILL.md'), 'utf-8');
+                const name = parseSkill(content, path.basename(skillDir)).name;
+                if (onlyNames && !onlyNames.includes(name)) continue;
+                if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name)) throw new Error(`Unsafe skill name: ${name}`);
+                const destination = path.join(skillsDir, name);
+                if (fs.existsSync(destination)) {
+                    if (!force) throw new Error(`Skill already installed: ${name} (use --force to replace)`);
+                }
+                plans.push({ skillDir, content, name, destination });
+            }
+            if (!plans.length) {
+                throw new Error(
+                    onlyNames
+                        ? `Requested skill not found in source: ${onlyNames.join(', ')}`
+                        : `No installable skills found in ${source}`,
+                );
+            }
+
+            for (const { skillDir, content, name, destination } of plans) {
+                if (fs.existsSync(destination)) fs.rmSync(destination, { recursive: true, force: true });
+                copyDirectory(skillDir, destination);
+
+                const digest = crypto.createHash('sha256')
+                    .update(content)
+                    .digest('hex');
+                lock.skills[name] = {
+                    source,
+                    scope,
+                    commit,
+                    destination,
+                    installed_at: new Date().toISOString(),
+                    manifest_hash: `sha256:${digest}`,
+                };
+                installed.push(name);
+            }
+            writeJson(lockFile, lock);
+            return { installed, scope, lock_file: lockFile };
+        } finally {
+            fs.rmSync(tempRoot, { recursive: true, force: true });
+        }
+    }
+
+    remove(name, { scope = 'global' } = {}) {
+        const { skillsDir, lockFile } = this.paths(scope);
+        const destination = path.join(skillsDir, name);
+        if (!fs.existsSync(destination)) throw new Error(`Skill is not installed: ${name}`);
+        fs.rmSync(destination, { recursive: true, force: true });
+        const lock = readJson(lockFile, { version: 1, skills: {} });
+        delete lock.skills[name];
+        writeJson(lockFile, lock);
+        return { removed: name, scope };
+    }
+
+    update(name, { scope = 'global' } = {}) {
+        const { lockFile } = this.paths(scope);
+        const lock = readJson(lockFile, { version: 1, skills: {} });
+        const entry = lock.skills[name];
+        if (!entry?.source) throw new Error(`No locked source for skill: ${name}`);
+        return this.install(entry.source, { scope, force: true, onlyNames: [name] });
+    }
+
+    lock(scope = 'global') {
+        return readJson(this.paths(scope).lockFile, { version: 1, skills: {} });
+    }
+}