@crewhaus/tool-bash 0.1.1 → 0.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crewhaus/tool-bash",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "type": "module",
   "description": "Built-in Bash tool: spawns shell commands via Bun.spawn with a default 30s timeout",
   "main": "src/index.ts",
@@ -12,21 +12,21 @@
     "test": "bun test src"
   },
   "dependencies": {
-    "@crewhaus/errors": "0.1.1",
-    "@crewhaus/tool-builder": "0.1.1",
-    "@crewhaus/tool-catalog": "0.1.1",
+    "@crewhaus/errors": "0.1.2",
+    "@crewhaus/tool-builder": "0.1.2",
+    "@crewhaus/tool-catalog": "0.1.2",
     "zod": "^3.23.8"
   },
   "devDependencies": {
-    "@crewhaus/tool-executor": "0.1.1",
-    "@crewhaus/tool-permission-matcher": "0.1.1",
-    "@crewhaus/tool-validate": "0.1.1"
+    "@crewhaus/tool-executor": "0.1.2",
+    "@crewhaus/tool-permission-matcher": "0.1.2",
+    "@crewhaus/tool-validate": "0.1.2"
   },
   "license": "Apache-2.0",
   "author": {
     "name": "Max Meier",
-    "email": "max@studiomax.io",
-    "url": "https://studiomax.io"
+    "email": "max@crewhaus.ai",
+    "url": "https://crewhaus.ai"
   },
   "repository": {
     "type": "git",
@@ -38,12 +38,7 @@
     "url": "https://github.com/crewhaus/factory/issues"
   },
   "publishConfig": {
-    "access": "restricted"
-  },
-  "files": [
-    "src",
-    "README.md",
-    "LICENSE",
-    "NOTICE"
-  ]
+    "access": "public"
+  },
+  "files": ["src", "README.md", "LICENSE", "NOTICE"]
 }

package/src/index.drain-fallback.test.ts

@@ -0,0 +1,119 @@
+/**
+ * Isolated coverage for the stream **drain-fallback** path in the Bash tool.
+ *
+ * On Linux, when the spawned `sh` forks a long-running grandchild and is
+ * SIGKILLed, the orphan keeps the pipe's write-end open, so
+ * `new Response(proc.stdout).text()` never EOFs. The tool guards against this
+ * by racing each stream read against a fixed `DRAIN_GRACE_MS` fallback that
+ * resolves to `""`. That fallback closure (`() => resolve("")`) cannot be
+ * reached with a real, well-behaved subprocess — both pipes EOF immediately —
+ * so we exercise it here with a fully mocked `Bun.spawn` whose streams never
+ * close, plus a synchronous `setTimeout` so there is zero wall-clock delay and
+ * no leaked timer handle.
+ *
+ * Everything (spawn + timers) is mocked and restored in `afterEach`, and this
+ * lives in its own file so the stubs never leak into the real-subprocess
+ * suites in `index.test.ts` / `integration.test.ts`.
+ */
+import { afterEach, describe, expect, mock, spyOn, test } from "bun:test";
+import { bash } from "./index";
+
+/** A ReadableStream that emits one chunk and then NEVER closes — modelling the
+ * orphaned-grandchild pipe that keeps the write-end alive. `Response.text()`
+ * on this stream never resolves, forcing the drain fallback to win the race. */
+function neverClosingStream(): ReadableStream<Uint8Array> {
+  return new ReadableStream<Uint8Array>({
+    start(controller) {
+      controller.enqueue(new TextEncoder().encode("partial-output-no-eof"));
+      // Deliberately no controller.close() → the stream hangs open forever.
+    },
+  });
+}
+
+const spies: Array<{ mockRestore: () => void }> = [];
+
+afterEach(() => {
+  for (const s of spies.splice(0)) s.mockRestore();
+});
+
+describe("Bash tool — stream drain fallback (orphaned-pipe guard)", () => {
+  test("falls back to empty streams when neither pipe EOFs before the grace window", async () => {
+    const killMock = mock((_sig?: unknown) => {});
+    // Fake proc: exits cleanly, but its stdout/stderr never close.
+    spies.push(
+      spyOn(Bun, "spawn").mockImplementation(
+        ((): ReturnType<typeof Bun.spawn> =>
+          ({
+            stdout: neverClosingStream(),
+            stderr: neverClosingStream(),
+            exited: Promise.resolve(0),
+            kill: killMock,
+          }) as unknown as ReturnType<typeof Bun.spawn>) as unknown as typeof Bun.spawn,
+      ),
+    );
+    // Fire ONLY the short DRAIN_GRACE (500ms) fallback timers synchronously —
+    // their `() => resolve("")` bodies are the target of this test. The long
+    // command-timeout timer (30s default) must NOT fire, or the run would be
+    // wrongly marked timed-out; for it we return an inert handle.
+    spies.push(
+      spyOn(globalThis, "setTimeout").mockImplementation(((
+        fn: (...a: unknown[]) => void,
+        ms?: number,
+      ) => {
+        if (ms !== undefined && ms <= 500) fn();
+        return 0 as unknown as ReturnType<typeof setTimeout>;
+      }) as unknown as typeof setTimeout),
+    );
+    spies.push(
+      spyOn(globalThis, "clearTimeout").mockImplementation(
+        (() => {}) as unknown as typeof clearTimeout,
+      ),
+    );
+
+    const out = await bash.execute({ command: "sleep 999" });
+
+    // Both streams drained to "" via the fallback, so the formatted result is
+    // just the exit line (no stdout/stderr sections) and the run is not marked
+    // as timed out (the process `exited` resolved on its own).
+    expect(out).toBe("[exit] 0");
+    expect(out).not.toContain("partial-output-no-eof");
+    expect(out).not.toContain("[stderr]");
+    expect(out).not.toContain("timed out");
+  });
+
+  test("drain fallback still reports a non-zero exit code from a hung-pipe process", async () => {
+    const killMock = mock((_sig?: unknown) => {});
+    spies.push(
+      spyOn(Bun, "spawn").mockImplementation(
+        ((): ReturnType<typeof Bun.spawn> =>
+          ({
+            stdout: neverClosingStream(),
+            stderr: neverClosingStream(),
+            exited: Promise.resolve(42),
+            kill: killMock,
+          }) as unknown as ReturnType<typeof Bun.spawn>) as unknown as typeof Bun.spawn,
+      ),
+    );
+    // Same selective firing as the first test: only the short DRAIN_GRACE
+    // (≤500ms) fallback timers run synchronously; the 30s command-timeout timer
+    // must stay inert, otherwise the run would be wrongly flagged as timed out
+    // and the exit line would read "[exit] 42 (timed out after 30000ms)".
+    spies.push(
+      spyOn(globalThis, "setTimeout").mockImplementation(((
+        fn: (...a: unknown[]) => void,
+        ms?: number,
+      ) => {
+        if (ms !== undefined && ms <= 500) fn();
+        return 0 as unknown as ReturnType<typeof setTimeout>;
+      }) as unknown as typeof setTimeout),
+    );
+    spies.push(
+      spyOn(globalThis, "clearTimeout").mockImplementation(
+        (() => {}) as unknown as typeof clearTimeout,
+      ),
+    );
+
+    const out = await bash.execute({ command: "exit 42" });
+    expect(out).toBe("[exit] 42");
+  });
+});

package/src/index.test.ts

@@ -8,6 +8,11 @@ describe("Bash tool metadata", () => {
     expect(bash.readOnly).toBe(false);
     expect(bash.concurrencySafe).toBe(false);
   });
+
+  test("crosses a process boundary → external scope + process io-capability (#146)", () => {
+    expect(bash.scope).toBe("external");
+    expect(bash.ioCapability).toBe("process");
+  });
 });
 
 describe("Bash tool execution", () => {

package/src/index.ts

@@ -55,6 +55,12 @@ export const bash: RegisteredTool = buildTool({
     "Run a shell command via `sh -c`. Captures stdout and stderr; default timeout 30s, max 10min.",
   inputSchema: bashSchema,
   destructive: true,
+  // Pillar 3 sink-side: Bash spawns a host process and its command string is an
+  // exfiltration channel (curl, nc, `base64 | sh`, …). Mark it external +
+  // process so runtime-core runs classifyEgress on the command payload and the
+  // substring matcher can flag tagged secrets on the command line (#146).
+  scope: "external",
+  ioCapability: "process",
   execute: async (input, ctx) => {
     const timeoutMs = input.timeout ?? DEFAULT_TIMEOUT_MS;
     const proc = Bun.spawn(["sh", "-c", input.command], {