@clearlysh/beehaven 0.8.16

package/dist/daemon-path-transform.js

@@ -0,0 +1,120 @@
+/**
+ * Path transformation (#63) — rewrite relative agent-supplied paths
+ * to composition-scoped or project-scoped absolute paths.
+ *
+ * When Claude/Codex/Gemini-CLI run with `cwd: composition-scoped`
+ * (per #47), they emit Read/Write/Edit calls with paths relative to
+ * that cwd. Those paths are fine for the agent's filesystem layer,
+ * but the canvas wants absolute paths so the FAB shows the right
+ * file in the diff view + the user's "Open in Finder" link works.
+ *
+ * This helper is the daemon-side rewriter — every tool call's path
+ * argument runs through `transformPath()` before dispatch.
+ *
+ * Rules:
+ *   - Absolute path that's inside the composition cwd → keep as-is
+ *   - Absolute path outside the composition cwd → flag as "out-of-scope"
+ *     (caller decides: hard fail in strict mode, warn in dev mode)
+ *   - Relative path → resolve against the composition cwd
+ *   - `~/...` paths → expand via os.homedir()
+ *   - `./` or `../` traversal → normalize; if it escapes the cwd, flag
+ */
+import { resolve as resolvePath, relative as relativePath, isAbsolute, normalize } from 'node:path';
+import { homedir } from 'node:os';
+/**
+ * Transform an agent-supplied path. Pure function — no I/O, safe to
+ * call on every tool invocation.
+ */
+export function transformPath(input, ctx) {
+    if (!input || typeof input !== 'string') {
+        return {
+            absolutePath: null,
+            relativeToComposition: null,
+            outOfScope: true,
+            reason: 'empty-path',
+        };
+    }
+    // Expand ~ to homedir. Tilde-prefixed paths are agent-friendly but
+    // need expansion before resolve().
+    let path = input.startsWith('~/')
+        ? input.replace(/^~/, homedir())
+        : input === '~'
+            ? homedir()
+            : input;
+    // Resolve relative to composition cwd. Absolute paths stay absolute.
+    const absolute = isAbsolute(path) ? normalize(path) : resolvePath(ctx.compositionCwd, path);
+    const rel = relativePath(ctx.compositionCwd, absolute);
+    const escapesComposition = rel.startsWith('..') || isAbsolute(rel);
+    if (!escapesComposition) {
+        return {
+            absolutePath: absolute,
+            relativeToComposition: rel || '.',
+            outOfScope: false,
+        };
+    }
+    // Out-of-composition. Check project root before deciding.
+    if (ctx.projectRoot) {
+        const relProject = relativePath(ctx.projectRoot, absolute);
+        const escapesProject = relProject.startsWith('..') || isAbsolute(relProject);
+        if (!escapesProject) {
+            // In-project, out-of-composition — warn but allow.
+            return {
+                absolutePath: absolute,
+                relativeToComposition: rel,
+                outOfScope: true,
+                reason: `outside composition cwd but inside project root (${ctx.projectRoot})`,
+            };
+        }
+    }
+    // Outside everything — strict policy rejects.
+    if (ctx.outOfScopePolicy === 'strict') {
+        return {
+            absolutePath: null,
+            relativeToComposition: null,
+            outOfScope: true,
+            reason: `strict mode — path ${absolute} is outside composition cwd ${ctx.compositionCwd}`,
+        };
+    }
+    return {
+        absolutePath: absolute,
+        relativeToComposition: rel,
+        outOfScope: true,
+        reason: `outside composition cwd ${ctx.compositionCwd}`,
+    };
+}
+/**
+ * Transform every path-shaped argument in a tool input object. Walks
+ * known path-bearing field names (file_path, path, source_path,
+ * dest_path) — schema-driven rather than blanket recursion to keep
+ * false positives down.
+ */
+export function transformToolPaths(toolName, args, ctx) {
+    const PATH_FIELDS_BY_TOOL = {
+        Read: ['file_path', 'path'],
+        Write: ['file_path', 'path'],
+        Edit: ['file_path', 'path'],
+        NotebookEdit: ['notebook_path'],
+        Glob: ['path'],
+        Grep: ['path'],
+        Bash: [], // no path field; cwd handled separately
+    };
+    const fields = PATH_FIELDS_BY_TOOL[toolName] ?? [];
+    const transformedArgs = { ...args };
+    const warnings = [];
+    for (const field of fields) {
+        const value = args[field];
+        if (typeof value !== 'string')
+            continue;
+        const result = transformPath(value, ctx);
+        if (result.absolutePath === null) {
+            warnings.push(`${toolName}.${field}: ${result.reason}`);
+            // Strict-mode rejection — caller should abort the tool call.
+            continue;
+        }
+        transformedArgs[field] = result.absolutePath;
+        if (result.outOfScope && result.reason) {
+            warnings.push(`${toolName}.${field}: ${result.reason}`);
+        }
+    }
+    return { transformedArgs, warnings };
+}

package/dist/daemon-write-sandbox.js

@@ -0,0 +1,191 @@
+/**
+ * Sandbox-then-commit Write policy (#62) — gate destructive Write tool
+ * calls behind a temp-directory sandbox so a buggy agent can't
+ * irrecoverably trash the user's filesystem.
+ *
+ * The pattern:
+ *   1. Agent calls `Write` with file_path X + new content.
+ *   2. canUseTool wrapper intercepts:
+ *      - mkdtemp under `~/.beehaven/sandbox/<sessionId>/`
+ *      - mirror the file (or its containing dir) into the sandbox
+ *      - write to the sandboxed copy
+ *      - return ok to the agent (it sees the write as "successful")
+ *   3. On agent:done OR explicit `commit-sandbox` IPC verb, atomically
+ *      promote the sandbox into the real path.
+ *   4. On `discard-sandbox` (timeout / agent error), rm -rf the
+ *      sandbox dir.
+ *
+ * Wins:
+ *   - One buggy agent turn doesn't permanently corrupt the user's
+ *     project. Diffs are reviewable before commit.
+ *   - Pair with `git-vfs.ts` (#103 Claude→Codex handoff) — the sandbox
+ *     dir is a git working tree, so the agent's edits show as
+ *     untracked changes the user can `git diff` against.
+ *
+ * Wiring (Mac app rebuild required after this lands):
+ *   - daemon-omni-hooks.ts: add a PreToolUse hook for `Write` that
+ *     calls `wrapInSandbox()` before the agent SDK dispatches.
+ *   - daemon-omni.ts: on agent:done, fire `commitSandbox(sessionId)`.
+ *   - Add `commit-sandbox` + `discard-sandbox` IPC verbs in
+ *     packages/cli/src/ipc-server.ts so the FAB can drive a "Review
+ *     changes → Apply" approval card (#59).
+ */
+import { mkdir, copyFile, rename, rm, stat, readFile, writeFile } from 'node:fs/promises';
+import { dirname, join, normalize as normalizePath, isAbsolute, } from 'node:path';
+import { homedir } from 'node:os';
+import { existsSync } from 'node:fs';
+const SANDBOX_ROOT = join(homedir(), '.beehaven', 'sandbox');
+/**
+ * Defense-in-depth path check (note from 2.19.0 audit). Callers today
+ * pre-normalize realPath via the path-transform layer, so escape-via-`..`
+ * isn't reachable in the current wiring. But this module is library
+ * code — future callers may invoke it directly. Reject anything that
+ * isn't an absolute, normalized path with no `..` segments.
+ */
+function assertSafeRealPath(realPath) {
+    if (typeof realPath !== 'string' || realPath.length === 0) {
+        throw new Error('wrapInSandbox: realPath must be a non-empty string');
+    }
+    if (!isAbsolute(realPath)) {
+        throw new Error(`wrapInSandbox: realPath must be absolute (got '${realPath}')`);
+    }
+    const normalized = normalizePath(realPath);
+    if (normalized !== realPath) {
+        throw new Error(`wrapInSandbox: realPath must be normalized — '${realPath}' normalizes to '${normalized}'`);
+    }
+    if (normalized.split('/').includes('..')) {
+        throw new Error(`wrapInSandbox: realPath must not contain '..' segments (got '${realPath}')`);
+    }
+}
+const _activeSandboxes = new Map();
+/**
+ * Wrap a Write call in a sandbox. Returns the sandboxed path the
+ * agent should actually write to. The caller is responsible for
+ * subbing that path into the agent's tool-input before dispatch.
+ */
+export async function wrapInSandbox(args) {
+    assertSafeRealPath(args.realPath);
+    // Per-session sandbox dir. Same session reuses the dir so multi-file
+    // writes share a coherent staging area.
+    const sessionDir = await ensureSessionDir(args.sessionId);
+    // Mirror the realPath structure inside the sandbox. For a real path
+    // `/Users/me/proj/src/foo.ts` we land at
+    // `~/.beehaven/sandbox/<sid>/Users/me/proj/src/foo.ts`. Absolute-path
+    // preservation lets the commit step paths-back-1-to-1.
+    const sandboxPath = join(sessionDir, args.realPath.replace(/^\//, ''));
+    await mkdir(dirname(sandboxPath), { recursive: true });
+    // Snapshot existing content (for restore-on-discard). Skip for
+    // files > 5 MB — we don't want to balloon disk on a large file
+    // sandbox. Those skip restore, and discard becomes "delete only."
+    let originalContent;
+    let preExisting = false;
+    if (existsSync(args.realPath)) {
+        preExisting = true;
+        try {
+            const s = await stat(args.realPath);
+            if (s.size < 5 * 1024 * 1024) {
+                originalContent = await readFile(args.realPath, 'utf8');
+            }
+            // Pre-populate the sandbox with the current file so partial
+            // edits (e.g. agent appending) start from real state.
+            await copyFile(args.realPath, sandboxPath);
+        }
+        catch {
+            // Source unreadable — let the agent write its content fresh
+            // into the sandbox.
+        }
+    }
+    // If the agent supplied content, write it to the sandbox up-front
+    // so the inspector RPC can show it without waiting for the agent
+    // to finish.
+    if (args.content !== undefined) {
+        await writeFile(sandboxPath, args.content, 'utf8');
+    }
+    const sandboxedWrite = {
+        sessionId: args.sessionId,
+        realPath: args.realPath,
+        sandboxPath,
+        preExisting,
+        originalContent,
+        ts: Date.now(),
+    };
+    const list = _activeSandboxes.get(args.sessionId) ?? [];
+    list.push(sandboxedWrite);
+    _activeSandboxes.set(args.sessionId, list);
+    return { sandboxPath, sandboxedWrite };
+}
+/**
+ * Atomically promote a session's sandboxed writes into their real
+ * paths. Uses fs.rename which is atomic on the same filesystem.
+ *
+ * Returns the list of {realPath, ok, error?} per file so the UI can
+ * surface which writes landed cleanly.
+ */
+export async function commitSandbox(sessionId) {
+    const writes = _activeSandboxes.get(sessionId) ?? [];
+    const results = [];
+    for (const w of writes) {
+        try {
+            await mkdir(dirname(w.realPath), { recursive: true });
+            // rename is atomic on same FS; if cross-FS, fall back to copy.
+            try {
+                await rename(w.sandboxPath, w.realPath);
+            }
+            catch {
+                await copyFile(w.sandboxPath, w.realPath);
+                await rm(w.sandboxPath, { force: true });
+            }
+            results.push({ realPath: w.realPath, ok: true });
+        }
+        catch (err) {
+            results.push({ realPath: w.realPath, ok: false, error: err?.message ?? 'commit-failed' });
+        }
+    }
+    _activeSandboxes.delete(sessionId);
+    // Best-effort: nuke the session dir so the next session starts clean.
+    try {
+        await rm(await sessionDirPath(sessionId), { recursive: true, force: true });
+    }
+    catch { }
+    return results;
+}
+/**
+ * Discard a session's sandboxed writes. Restores any pre-existing
+ * content from `originalContent` snapshots; deletes new files.
+ */
+export async function discardSandbox(sessionId) {
+    const writes = _activeSandboxes.get(sessionId) ?? [];
+    let restored = 0;
+    for (const w of writes) {
+        if (w.preExisting && w.originalContent !== undefined) {
+            try {
+                await writeFile(w.realPath, w.originalContent, 'utf8');
+                restored++;
+            }
+            catch { }
+        }
+    }
+    _activeSandboxes.delete(sessionId);
+    try {
+        await rm(await sessionDirPath(sessionId), { recursive: true, force: true });
+    }
+    catch { }
+    return { discarded: writes.length, restored };
+}
+/**
+ * List a session's pending writes. Powers the FAB approval card's
+ * "Review N changes" affordance.
+ */
+export function listPendingWrites(sessionId) {
+    return _activeSandboxes.get(sessionId) ?? [];
+}
+async function ensureSessionDir(sessionId) {
+    const dir = await sessionDirPath(sessionId);
+    await mkdir(dir, { recursive: true });
+    return dir;
+}
+async function sessionDirPath(sessionId) {
+    // Sanitize sessionId — agent-supplied. Anything outside [a-z0-9-_] becomes _.
+    const safe = sessionId.replace(/[^a-z0-9\-_]/gi, '_').slice(0, 64);
+    return join(SANDBOX_ROOT, safe);
+}