@dexto/image-local 1.16.5 → 1.17.0

package/dist/local-workspace-handle-provider.cjs

@@ -31,13 +31,11 @@ __export(local_workspace_handle_provider_exports, {
   LocalWorkspaceHandleProvider: () => LocalWorkspaceHandleProvider
 });
 module.exports = __toCommonJS(local_workspace_handle_provider_exports);
-var import_node_child_process = require("node:child_process");
 var import_promises = require("node:fs/promises");
 var import_node_path = __toESM(require("node:path"), 1);
-var import_node_util = require("node:util");
 var import_glob = require("glob");
 var import_workspace = require("@dexto/core/workspace");
-const exec = (0, import_node_util.promisify)(import_node_child_process.exec);
+var import_run_command = require("./run-command.js");
 class LocalWorkspaceHandleProvider {
   async open(input) {
     const root = import_node_path.default.resolve(input.context.path);
@@ -61,9 +59,21 @@ class LocalWorkspaceFiles {
   constructor(root) {
     this.root = root;
   }
+  realRoot;
   readText = async (filePath) => {
     try {
-      return await (0, import_promises.readFile)(this.resolveInsideRoot(filePath), "utf-8");
+      return await (0, import_promises.readFile)(await this.resolveInsideRoot(filePath), "utf-8");
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        throw import_workspace.WorkspaceError.fileNotFound(filePath);
+      }
+      throw error;
+    }
+  };
+  /** Size in bytes, from the same contained real path `readText` would read. */
+  readFileSize = async (filePath) => {
+    try {
+      return (await (0, import_promises.stat)(await this.resolveInsideRoot(filePath))).size;
     } catch (error) {
       if (error.code === "ENOENT") {
         throw import_workspace.WorkspaceError.fileNotFound(filePath);
@@ -77,7 +87,7 @@ class LocalWorkspaceFiles {
   glob = async (pattern) => {
     this.assertRelativePattern(pattern);
     const files = await (0, import_glob.glob)(pattern, {
-      cwd: this.root,
+      cwd: await this.getRealRoot(),
       absolute: false,
       nodir: true,
       follow: false,
@@ -86,7 +96,7 @@ class LocalWorkspaceFiles {
     return files.sort();
   };
   writeFile = async (filePath, content) => {
-    const resolvedPath = this.resolveInsideRoot(filePath);
+    const resolvedPath = await this.resolveInsideRoot(filePath);
     await (0, import_promises.mkdir)(import_node_path.default.dirname(resolvedPath), { recursive: true });
     try {
       await (0, import_promises.writeFile)(resolvedPath, content, "utf-8");
@@ -98,16 +108,27 @@ class LocalWorkspaceFiles {
     }
   };
   listFiles = async (directoryPath = ".") => {
-    const resolvedPath = this.resolveInsideRoot(directoryPath);
-    const relativePath = import_node_path.default.relative(this.root, resolvedPath);
+    const resolvedPath = await this.resolveInsideRoot(directoryPath);
+    const relativePath = import_node_path.default.relative(await this.getRealRoot(), resolvedPath);
     const pattern = relativePath ? `${relativePath.split(import_node_path.default.sep).join("/")}/**/*` : "**/*";
     return this.glob(pattern);
   };
-  resolveInsideRoot(filePath) {
+  /** The workspace root's real path, resolved once. The root itself may sit behind a symlink. */
+  async getRealRoot() {
+    this.realRoot ??= await (0, import_promises.realpath)(this.root);
+    return this.realRoot;
+  }
+  /**
+   * Resolve a path to its real location and require it to be inside the real workspace root,
+   * so a symlink in the workspace cannot lead out of it.
+   */
+  async resolveInsideRoot(filePath) {
     const resolvedPath = import_node_path.default.isAbsolute(filePath) ? import_node_path.default.resolve(filePath) : import_node_path.default.resolve(this.root, filePath);
-    const relativePath = import_node_path.default.relative(this.root, resolvedPath);
+    const realRoot = await this.getRealRoot();
+    const realPath = await realpathOfPossiblyMissing(resolvedPath, filePath);
+    const relativePath = import_node_path.default.relative(realRoot, realPath);
     if (relativePath === "" || !relativePath.startsWith("..") && !import_node_path.default.isAbsolute(relativePath)) {
-      return resolvedPath;
+      return realPath;
     }
     throw import_workspace.WorkspaceError.pathOutsideWorkspace(filePath);
   }
@@ -123,11 +144,12 @@ class LocalWorkspaceProcesses {
   }
   exec = async (input) => {
     const cwd = input.cwd === void 0 ? this.root : resolveInsideRoot(this.root, input.cwd);
-    const result = await exec(input.command, { cwd });
-    return {
-      stdout: result.stdout,
-      stderr: result.stderr
-    };
+    return (0, import_run_command.runCommand)(input.command, {
+      cwd,
+      env: (0, import_workspace.buildShellEnvironment)(process.env, input.env),
+      ...input.timeout === void 0 ? {} : { timeout: input.timeout },
+      signal: input.signal
+    });
   };
 }
 function resolveCapabilities(input) {
@@ -145,6 +167,25 @@ function resolveInsideRoot(root, filePath) {
   }
   throw import_workspace.WorkspaceError.pathOutsideWorkspace(filePath);
 }
+async function realpathOfPossiblyMissing(target, requestedPath) {
+  try {
+    return await (0, import_promises.realpath)(target);
+  } catch (error) {
+    const code = error.code;
+    if (code !== "ENOENT" && code !== "ENOTDIR") {
+      throw error;
+    }
+  }
+  const stats = await (0, import_promises.lstat)(target).catch(() => void 0);
+  if (stats?.isSymbolicLink()) {
+    throw import_workspace.WorkspaceError.pathOutsideWorkspace(requestedPath);
+  }
+  const parent = import_node_path.default.dirname(target);
+  if (parent === target) {
+    return target;
+  }
+  return import_node_path.default.join(await realpathOfPossiblyMissing(parent, requestedPath), import_node_path.default.basename(target));
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   LocalWorkspaceHandleProvider

package/dist/local-workspace-handle-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-workspace-handle-provider.d.ts","sourceRoot":"","sources":["../src/local-workspace-handle-provider.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACR,kBAAkB,EAElB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EAC1B,MAAM,uBAAuB,CAAC;AAI/B,qBAAa,4BAA6B,YAAW,uBAAuB;IAClE,IAAI,CAAC,KAAK,EAAE;QACd,OAAO,EAAE,gBAAgB,CAAC;QAC1B,KAAK,CAAC,EAAE,kBAAkB,CAAC;KAC9B,GAAG,OAAO,CAAC,eAAe,CAAC;CAoB/B"}
+{"version":3,"file":"local-workspace-handle-provider.d.ts","sourceRoot":"","sources":["../src/local-workspace-handle-provider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACR,kBAAkB,EAElB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EAE1B,MAAM,uBAAuB,CAAC;AAG/B,qBAAa,4BAA6B,YAAW,uBAAuB;IAClE,IAAI,CAAC,KAAK,EAAE;QACd,OAAO,EAAE,gBAAgB,CAAC;QAC1B,KAAK,CAAC,EAAE,kBAAkB,CAAC;KAC9B,GAAG,OAAO,CAAC,eAAe,CAAC;CAoB/B"}

package/dist/local-workspace-handle-provider.js

@@ -1,10 +1,8 @@
-import { exec as execCallback } from "node:child_process";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { lstat, mkdir, readFile, realpath, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { promisify } from "node:util";
 import { glob } from "glob";
-import { WorkspaceError } from "@dexto/core/workspace";
-const exec = promisify(execCallback);
+import { WorkspaceError, buildShellEnvironment } from "@dexto/core/workspace";
+import { runCommand } from "./run-command.js";
 class LocalWorkspaceHandleProvider {
   async open(input) {
     const root = path.resolve(input.context.path);
@@ -28,9 +26,21 @@ class LocalWorkspaceFiles {
   constructor(root) {
     this.root = root;
   }
+  realRoot;
   readText = async (filePath) => {
     try {
-      return await readFile(this.resolveInsideRoot(filePath), "utf-8");
+      return await readFile(await this.resolveInsideRoot(filePath), "utf-8");
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        throw WorkspaceError.fileNotFound(filePath);
+      }
+      throw error;
+    }
+  };
+  /** Size in bytes, from the same contained real path `readText` would read. */
+  readFileSize = async (filePath) => {
+    try {
+      return (await stat(await this.resolveInsideRoot(filePath))).size;
     } catch (error) {
       if (error.code === "ENOENT") {
         throw WorkspaceError.fileNotFound(filePath);
@@ -44,7 +54,7 @@ class LocalWorkspaceFiles {
   glob = async (pattern) => {
     this.assertRelativePattern(pattern);
     const files = await glob(pattern, {
-      cwd: this.root,
+      cwd: await this.getRealRoot(),
       absolute: false,
       nodir: true,
       follow: false,
@@ -53,7 +63,7 @@ class LocalWorkspaceFiles {
     return files.sort();
   };
   writeFile = async (filePath, content) => {
-    const resolvedPath = this.resolveInsideRoot(filePath);
+    const resolvedPath = await this.resolveInsideRoot(filePath);
     await mkdir(path.dirname(resolvedPath), { recursive: true });
     try {
       await writeFile(resolvedPath, content, "utf-8");
@@ -65,16 +75,27 @@ class LocalWorkspaceFiles {
     }
   };
   listFiles = async (directoryPath = ".") => {
-    const resolvedPath = this.resolveInsideRoot(directoryPath);
-    const relativePath = path.relative(this.root, resolvedPath);
+    const resolvedPath = await this.resolveInsideRoot(directoryPath);
+    const relativePath = path.relative(await this.getRealRoot(), resolvedPath);
     const pattern = relativePath ? `${relativePath.split(path.sep).join("/")}/**/*` : "**/*";
     return this.glob(pattern);
   };
-  resolveInsideRoot(filePath) {
+  /** The workspace root's real path, resolved once. The root itself may sit behind a symlink. */
+  async getRealRoot() {
+    this.realRoot ??= await realpath(this.root);
+    return this.realRoot;
+  }
+  /**
+   * Resolve a path to its real location and require it to be inside the real workspace root,
+   * so a symlink in the workspace cannot lead out of it.
+   */
+  async resolveInsideRoot(filePath) {
     const resolvedPath = path.isAbsolute(filePath) ? path.resolve(filePath) : path.resolve(this.root, filePath);
-    const relativePath = path.relative(this.root, resolvedPath);
+    const realRoot = await this.getRealRoot();
+    const realPath = await realpathOfPossiblyMissing(resolvedPath, filePath);
+    const relativePath = path.relative(realRoot, realPath);
     if (relativePath === "" || !relativePath.startsWith("..") && !path.isAbsolute(relativePath)) {
-      return resolvedPath;
+      return realPath;
     }
     throw WorkspaceError.pathOutsideWorkspace(filePath);
   }
@@ -90,11 +111,12 @@ class LocalWorkspaceProcesses {
   }
   exec = async (input) => {
     const cwd = input.cwd === void 0 ? this.root : resolveInsideRoot(this.root, input.cwd);
-    const result = await exec(input.command, { cwd });
-    return {
-      stdout: result.stdout,
-      stderr: result.stderr
-    };
+    return runCommand(input.command, {
+      cwd,
+      env: buildShellEnvironment(process.env, input.env),
+      ...input.timeout === void 0 ? {} : { timeout: input.timeout },
+      signal: input.signal
+    });
   };
 }
 function resolveCapabilities(input) {
@@ -112,6 +134,25 @@ function resolveInsideRoot(root, filePath) {
   }
   throw WorkspaceError.pathOutsideWorkspace(filePath);
 }
+async function realpathOfPossiblyMissing(target, requestedPath) {
+  try {
+    return await realpath(target);
+  } catch (error) {
+    const code = error.code;
+    if (code !== "ENOENT" && code !== "ENOTDIR") {
+      throw error;
+    }
+  }
+  const stats = await lstat(target).catch(() => void 0);
+  if (stats?.isSymbolicLink()) {
+    throw WorkspaceError.pathOutsideWorkspace(requestedPath);
+  }
+  const parent = path.dirname(target);
+  if (parent === target) {
+    return target;
+  }
+  return path.join(await realpathOfPossiblyMissing(parent, requestedPath), path.basename(target));
+}
 export {
   LocalWorkspaceHandleProvider
 };

package/dist/local-workspace-handle-provider.test.cjs

@@ -0,0 +1,107 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var import_promises = require("node:fs/promises");
+var import_node_os = require("node:os");
+var import_node_path = __toESM(require("node:path"), 1);
+var import_vitest = require("vitest");
+var import_local_workspace_handle_provider = require("./local-workspace-handle-provider.js");
+(0, import_vitest.describe)("LocalWorkspaceHandleProvider files", () => {
+  let base;
+  let root;
+  let outside;
+  (0, import_vitest.beforeEach)(async () => {
+    base = await (0, import_promises.mkdtemp)(import_node_path.default.join((0, import_node_os.tmpdir)(), "workspace-handle-"));
+    root = import_node_path.default.join(base, "root");
+    outside = import_node_path.default.join(base, "outside");
+    await (0, import_promises.mkdir)(root);
+    await (0, import_promises.mkdir)(outside);
+    await (0, import_promises.writeFile)(import_node_path.default.join(outside, "private.txt"), "private");
+  });
+  (0, import_vitest.afterEach)(async () => {
+    await (0, import_promises.rm)(base, { recursive: true, force: true });
+  });
+  async function openFiles() {
+    const context = { path: root };
+    const handle = await new import_local_workspace_handle_provider.LocalWorkspaceHandleProvider().open({ context });
+    return handle.files;
+  }
+  (0, import_vitest.it)("reads and writes regular files inside the workspace", async () => {
+    const files = await openFiles();
+    await files.writeFile("sub/a.txt", "hello");
+    (0, import_vitest.expect)(await files.readText("sub/a.txt")).toBe("hello");
+  });
+  (0, import_vitest.it)("refuses to read through a symlink that leaves the workspace", async () => {
+    await (0, import_promises.symlink)(import_node_path.default.join(outside, "private.txt"), import_node_path.default.join(root, "link.txt"));
+    const files = await openFiles();
+    await (0, import_vitest.expect)(files.readText("link.txt")).rejects.toThrow();
+  });
+  (0, import_vitest.it)("refuses to write through a symlink that leaves the workspace", async () => {
+    await (0, import_promises.symlink)(import_node_path.default.join(outside, "private.txt"), import_node_path.default.join(root, "link.txt"));
+    const files = await openFiles();
+    await (0, import_vitest.expect)(files.writeFile("link.txt", "changed")).rejects.toThrow();
+    (0, import_vitest.expect)(await (0, import_promises.readFile)(import_node_path.default.join(outside, "private.txt"), "utf-8")).toBe("private");
+  });
+  (0, import_vitest.it)("refuses to create files through a symlinked directory that leaves the workspace", async () => {
+    await (0, import_promises.symlink)(outside, import_node_path.default.join(root, "linked-dir"));
+    const files = await openFiles();
+    await (0, import_vitest.expect)(files.writeFile("linked-dir/new.txt", "x")).rejects.toThrow();
+    await (0, import_vitest.expect)((0, import_promises.readFile)(import_node_path.default.join(outside, "new.txt"))).rejects.toThrow();
+  });
+  (0, import_vitest.it)("allows a symlink that stays inside the workspace", async () => {
+    await (0, import_promises.writeFile)(import_node_path.default.join(root, "real.txt"), "inside");
+    await (0, import_promises.symlink)(import_node_path.default.join(root, "real.txt"), import_node_path.default.join(root, "link.txt"));
+    const files = await openFiles();
+    (0, import_vitest.expect)(await files.readText("link.txt")).toBe("inside");
+  });
+  (0, import_vitest.describe)("when the workspace root is reached through a symlink", () => {
+    async function openThroughLink() {
+      const linkRoot = import_node_path.default.join(base, "link-root");
+      await (0, import_promises.symlink)(root, linkRoot);
+      const context = { path: linkRoot };
+      const handle = await new import_local_workspace_handle_provider.LocalWorkspaceHandleProvider().open({ context });
+      return { files: handle.files, linkRoot };
+    }
+    (0, import_vitest.it)("reads, writes, lists and globs files", async () => {
+      const { files } = await openThroughLink();
+      await files.writeFile("sub/a.txt", "hello");
+      (0, import_vitest.expect)(await files.readText("sub/a.txt")).toBe("hello");
+      (0, import_vitest.expect)(await files.listFiles(".")).toEqual(["sub/a.txt"]);
+      (0, import_vitest.expect)(await files.listFiles("sub")).toEqual(["sub/a.txt"]);
+      (0, import_vitest.expect)(await files.glob("**/*.txt")).toEqual(["sub/a.txt"]);
+    });
+    (0, import_vitest.it)("accepts an absolute path under the linked or the real root", async () => {
+      const { files, linkRoot } = await openThroughLink();
+      await files.writeFile(import_node_path.default.join(linkRoot, "a.txt"), "one");
+      (0, import_vitest.expect)(await files.readText(import_node_path.default.join(root, "a.txt"))).toBe("one");
+    });
+    (0, import_vitest.it)("still refuses links that leave the workspace", async () => {
+      await (0, import_promises.symlink)(import_node_path.default.join(outside, "private.txt"), import_node_path.default.join(root, "link.txt"));
+      await (0, import_promises.symlink)(outside, import_node_path.default.join(root, "linked-dir"));
+      const { files } = await openThroughLink();
+      await (0, import_vitest.expect)(files.readText("link.txt")).rejects.toThrow();
+      await (0, import_vitest.expect)(files.writeFile("linked-dir/new.txt", "x")).rejects.toThrow();
+      await (0, import_vitest.expect)(files.listFiles("linked-dir")).rejects.toThrow();
+    });
+  });
+});

package/dist/local-workspace-handle-provider.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=local-workspace-handle-provider.test.d.ts.map

package/dist/local-workspace-handle-provider.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-workspace-handle-provider.test.d.ts","sourceRoot":"","sources":["../src/local-workspace-handle-provider.test.ts"],"names":[],"mappings":""}

package/dist/local-workspace-handle-provider.test.js

@@ -0,0 +1,84 @@
+import { mkdir, mkdtemp, readFile, rm, symlink, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { LocalWorkspaceHandleProvider } from "./local-workspace-handle-provider.js";
+describe("LocalWorkspaceHandleProvider files", () => {
+  let base;
+  let root;
+  let outside;
+  beforeEach(async () => {
+    base = await mkdtemp(path.join(tmpdir(), "workspace-handle-"));
+    root = path.join(base, "root");
+    outside = path.join(base, "outside");
+    await mkdir(root);
+    await mkdir(outside);
+    await writeFile(path.join(outside, "private.txt"), "private");
+  });
+  afterEach(async () => {
+    await rm(base, { recursive: true, force: true });
+  });
+  async function openFiles() {
+    const context = { path: root };
+    const handle = await new LocalWorkspaceHandleProvider().open({ context });
+    return handle.files;
+  }
+  it("reads and writes regular files inside the workspace", async () => {
+    const files = await openFiles();
+    await files.writeFile("sub/a.txt", "hello");
+    expect(await files.readText("sub/a.txt")).toBe("hello");
+  });
+  it("refuses to read through a symlink that leaves the workspace", async () => {
+    await symlink(path.join(outside, "private.txt"), path.join(root, "link.txt"));
+    const files = await openFiles();
+    await expect(files.readText("link.txt")).rejects.toThrow();
+  });
+  it("refuses to write through a symlink that leaves the workspace", async () => {
+    await symlink(path.join(outside, "private.txt"), path.join(root, "link.txt"));
+    const files = await openFiles();
+    await expect(files.writeFile("link.txt", "changed")).rejects.toThrow();
+    expect(await readFile(path.join(outside, "private.txt"), "utf-8")).toBe("private");
+  });
+  it("refuses to create files through a symlinked directory that leaves the workspace", async () => {
+    await symlink(outside, path.join(root, "linked-dir"));
+    const files = await openFiles();
+    await expect(files.writeFile("linked-dir/new.txt", "x")).rejects.toThrow();
+    await expect(readFile(path.join(outside, "new.txt"))).rejects.toThrow();
+  });
+  it("allows a symlink that stays inside the workspace", async () => {
+    await writeFile(path.join(root, "real.txt"), "inside");
+    await symlink(path.join(root, "real.txt"), path.join(root, "link.txt"));
+    const files = await openFiles();
+    expect(await files.readText("link.txt")).toBe("inside");
+  });
+  describe("when the workspace root is reached through a symlink", () => {
+    async function openThroughLink() {
+      const linkRoot = path.join(base, "link-root");
+      await symlink(root, linkRoot);
+      const context = { path: linkRoot };
+      const handle = await new LocalWorkspaceHandleProvider().open({ context });
+      return { files: handle.files, linkRoot };
+    }
+    it("reads, writes, lists and globs files", async () => {
+      const { files } = await openThroughLink();
+      await files.writeFile("sub/a.txt", "hello");
+      expect(await files.readText("sub/a.txt")).toBe("hello");
+      expect(await files.listFiles(".")).toEqual(["sub/a.txt"]);
+      expect(await files.listFiles("sub")).toEqual(["sub/a.txt"]);
+      expect(await files.glob("**/*.txt")).toEqual(["sub/a.txt"]);
+    });
+    it("accepts an absolute path under the linked or the real root", async () => {
+      const { files, linkRoot } = await openThroughLink();
+      await files.writeFile(path.join(linkRoot, "a.txt"), "one");
+      expect(await files.readText(path.join(root, "a.txt"))).toBe("one");
+    });
+    it("still refuses links that leave the workspace", async () => {
+      await symlink(path.join(outside, "private.txt"), path.join(root, "link.txt"));
+      await symlink(outside, path.join(root, "linked-dir"));
+      const { files } = await openThroughLink();
+      await expect(files.readText("link.txt")).rejects.toThrow();
+      await expect(files.writeFile("linked-dir/new.txt", "x")).rejects.toThrow();
+      await expect(files.listFiles("linked-dir")).rejects.toThrow();
+    });
+  });
+});

package/dist/run-command.cjs

@@ -0,0 +1,108 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var run_command_exports = {};
+__export(run_command_exports, {
+  runCommand: () => runCommand
+});
+module.exports = __toCommonJS(run_command_exports);
+var import_node_child_process = require("node:child_process");
+const MAX_OUTPUT_CHARS = 10 * 1024 * 1024;
+const KILL_GRACE_MS = 1e3;
+const ABORTED_EXIT_CODE = 130;
+function runCommand(command, options) {
+  const { cwd, env, timeout, signal } = options;
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      resolve({ exitCode: ABORTED_EXIT_CODE, stdout: "", stderr: "(Command was cancelled)" });
+      return;
+    }
+    const child = (0, import_node_child_process.spawn)(command, {
+      cwd,
+      env,
+      shell: true,
+      detached: process.platform !== "win32"
+    });
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    let aborted = false;
+    let killTimer;
+    const stop = () => {
+      signalProcessGroup(child, "SIGTERM");
+      killTimer ??= setTimeout(() => signalProcessGroup(child, "SIGKILL"), KILL_GRACE_MS);
+    };
+    const timeoutTimer = timeout === void 0 ? void 0 : setTimeout(() => {
+      timedOut = true;
+      stop();
+    }, timeout);
+    const onAbort = () => {
+      aborted = true;
+      stop();
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    const cleanUp = () => {
+      clearTimeout(timeoutTimer);
+      clearTimeout(killTimer);
+      signal?.removeEventListener("abort", onAbort);
+    };
+    child.stdout?.on("data", (chunk) => {
+      stdout = appendCapped(stdout, chunk.toString());
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr = appendCapped(stderr, chunk.toString());
+    });
+    child.once("error", (error) => {
+      cleanUp();
+      reject(error);
+    });
+    child.once("close", (code) => {
+      if (timedOut || aborted) signalProcessGroup(child, "SIGKILL");
+      cleanUp();
+      if (aborted) {
+        resolve({
+          exitCode: ABORTED_EXIT_CODE,
+          stdout: `${stdout}
+
+(Command was cancelled)`,
+          stderr
+        });
+        return;
+      }
+      resolve({ exitCode: code ?? 1, stdout, stderr, ...timedOut && { timedOut } });
+    });
+  });
+}
+function appendCapped(current, chunk) {
+  return current.length >= MAX_OUTPUT_CHARS ? current : (current + chunk).slice(0, MAX_OUTPUT_CHARS);
+}
+function signalProcessGroup(child, signal) {
+  if (child.pid === void 0) return;
+  if (process.platform === "win32") {
+    (0, import_node_child_process.spawn)("taskkill", ["/pid", String(child.pid), "/f", "/t"], { stdio: "ignore" });
+    return;
+  }
+  try {
+    process.kill(-child.pid, signal);
+  } catch {
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  runCommand
+});

package/dist/run-command.d.ts

@@ -0,0 +1,17 @@
+export interface RunCommandResult {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+    timedOut?: boolean;
+}
+/**
+ * Run a shell command in its own process group. A timeout or abort stops the whole group, so
+ * commands started by the shell stop too. Exits, including non-zero ones, are returned.
+ */
+export declare function runCommand(command: string, options: {
+    cwd: string;
+    env: Record<string, string>;
+    timeout?: number;
+    signal?: AbortSignal | undefined;
+}): Promise<RunCommandResult>;
+//# sourceMappingURL=run-command.d.ts.map

package/dist/run-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-command.d.ts","sourceRoot":"","sources":["../src/run-command.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,gBAAgB;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;GAGG;AACH,wBAAgB,UAAU,CACtB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;IACL,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CACpC,GACF,OAAO,CAAC,gBAAgB,CAAC,CAqE3B"}

package/dist/run-command.js

@@ -0,0 +1,84 @@
+import { spawn } from "node:child_process";
+const MAX_OUTPUT_CHARS = 10 * 1024 * 1024;
+const KILL_GRACE_MS = 1e3;
+const ABORTED_EXIT_CODE = 130;
+function runCommand(command, options) {
+  const { cwd, env, timeout, signal } = options;
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      resolve({ exitCode: ABORTED_EXIT_CODE, stdout: "", stderr: "(Command was cancelled)" });
+      return;
+    }
+    const child = spawn(command, {
+      cwd,
+      env,
+      shell: true,
+      detached: process.platform !== "win32"
+    });
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    let aborted = false;
+    let killTimer;
+    const stop = () => {
+      signalProcessGroup(child, "SIGTERM");
+      killTimer ??= setTimeout(() => signalProcessGroup(child, "SIGKILL"), KILL_GRACE_MS);
+    };
+    const timeoutTimer = timeout === void 0 ? void 0 : setTimeout(() => {
+      timedOut = true;
+      stop();
+    }, timeout);
+    const onAbort = () => {
+      aborted = true;
+      stop();
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    const cleanUp = () => {
+      clearTimeout(timeoutTimer);
+      clearTimeout(killTimer);
+      signal?.removeEventListener("abort", onAbort);
+    };
+    child.stdout?.on("data", (chunk) => {
+      stdout = appendCapped(stdout, chunk.toString());
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr = appendCapped(stderr, chunk.toString());
+    });
+    child.once("error", (error) => {
+      cleanUp();
+      reject(error);
+    });
+    child.once("close", (code) => {
+      if (timedOut || aborted) signalProcessGroup(child, "SIGKILL");
+      cleanUp();
+      if (aborted) {
+        resolve({
+          exitCode: ABORTED_EXIT_CODE,
+          stdout: `${stdout}
+
+(Command was cancelled)`,
+          stderr
+        });
+        return;
+      }
+      resolve({ exitCode: code ?? 1, stdout, stderr, ...timedOut && { timedOut } });
+    });
+  });
+}
+function appendCapped(current, chunk) {
+  return current.length >= MAX_OUTPUT_CHARS ? current : (current + chunk).slice(0, MAX_OUTPUT_CHARS);
+}
+function signalProcessGroup(child, signal) {
+  if (child.pid === void 0) return;
+  if (process.platform === "win32") {
+    spawn("taskkill", ["/pid", String(child.pid), "/f", "/t"], { stdio: "ignore" });
+    return;
+  }
+  try {
+    process.kill(-child.pid, signal);
+  } catch {
+  }
+}
+export {
+  runCommand
+};

package/dist/workspace-bash-environment.test.cjs

@@ -0,0 +1,121 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var import_promises = require("node:fs/promises");
+var import_node_os = require("node:os");
+var import_node_path = __toESM(require("node:path"), 1);
+var import_vitest = require("vitest");
+var import_workspace = require("@dexto/core/workspace");
+var import_tools_process = require("@dexto/tools-process");
+var import_local_workspace_handle_provider = require("./local-workspace-handle-provider.js");
+function createLogger() {
+  const logger = {
+    debug: () => {
+    },
+    info: () => {
+    },
+    warn: () => {
+    },
+    error: () => {
+    },
+    createChild: () => createLogger()
+  };
+  return logger;
+}
+function createWorkspaceStore() {
+  const workspaces = /* @__PURE__ */ new Map();
+  let currentId;
+  return {
+    saveWorkspace: async ({ workspace }) => {
+      workspaces.set(workspace.id, workspace);
+    },
+    getWorkspace: async ({ id }) => workspaces.get(id),
+    findWorkspaceByPath: async ({ path: workspacePath }) => [...workspaces.values()].find((workspace) => workspace.path === workspacePath),
+    listWorkspaces: async () => [...workspaces.values()],
+    setCurrentWorkspace: async ({ id }) => {
+      currentId = id;
+    },
+    getCurrentWorkspaceId: async () => currentId,
+    clearCurrentWorkspace: async () => {
+      currentId = void 0;
+    }
+  };
+}
+(0, import_vitest.describe)("bash_exec in a workspace", () => {
+  let directory;
+  (0, import_vitest.beforeEach)(async () => {
+    directory = await (0, import_promises.mkdtemp)(import_node_path.default.join((0, import_node_os.tmpdir)(), "workspace-bash-"));
+  });
+  (0, import_vitest.afterEach)(async () => {
+    import_vitest.vi.unstubAllEnvs();
+    await (0, import_promises.rm)(directory, { recursive: true, force: true });
+  });
+  async function runForeground(command, config = {}) {
+    const workspaceManager = new import_workspace.WorkspaceManager(
+      createWorkspaceStore(),
+      { emit: () => true },
+      createLogger(),
+      new import_local_workspace_handle_provider.LocalWorkspaceHandleProvider()
+    );
+    await workspaceManager.setWorkspace({ path: directory });
+    const bashExec = import_tools_process.processToolsFactory.create(
+      import_tools_process.processToolsFactory.configSchema.parse({
+        type: "process-tools",
+        securityLevel: "permissive",
+        ...config
+      })
+    ).find((tool) => tool.id === "bash_exec");
+    if (bashExec === void 0) {
+      throw new Error("Expected bash_exec tool to be registered.");
+    }
+    const context = {
+      logger: createLogger(),
+      services: { workspaceManager }
+    };
+    return await bashExec.execute(
+      { command, run_in_background: false, timeout: 2e4 },
+      context
+    );
+  }
+  const printVariables = 'echo "${DEXTO_TEST_HOST_MARKER:-absent}|${DEXTO_TEST_CONFIGURED:-absent}|${DEXTO_TEST_FORWARDED:-absent}"';
+  (0, import_vitest.it)("does not pass host variables to the command, but passes configured ones", async () => {
+    import_vitest.vi.stubEnv("DEXTO_TEST_HOST_MARKER", "leaked-host-value");
+    import_vitest.vi.stubEnv("DEXTO_TEST_FORWARDED", "forwarded-host-value");
+    const result = await runForeground(printVariables, {
+      environment: { DEXTO_TEST_CONFIGURED: "configured-value" }
+    });
+    (0, import_vitest.expect)(result).toMatchObject({ stdout: "absent|configured-value|absent\n" });
+  });
+  (0, import_vitest.it)("forwards host variables the user names in passEnvironment", async () => {
+    import_vitest.vi.stubEnv("DEXTO_TEST_HOST_MARKER", "leaked-host-value");
+    import_vitest.vi.stubEnv("DEXTO_TEST_FORWARDED", "forwarded-host-value");
+    const result = await runForeground(printVariables, {
+      passEnvironment: ["DEXTO_TEST_FORWARDED"]
+    });
+    (0, import_vitest.expect)(result).toMatchObject({ stdout: "absent|absent|forwarded-host-value\n" });
+  });
+  (0, import_vitest.it)("still finds commands on PATH", async () => {
+    const result = await runForeground("echo ready");
+    (0, import_vitest.expect)(result).toMatchObject({ stdout: "ready\n" });
+  });
+});

package/dist/workspace-bash-environment.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=workspace-bash-environment.test.d.ts.map

package/dist/workspace-bash-environment.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-bash-environment.test.d.ts","sourceRoot":"","sources":["../src/workspace-bash-environment.test.ts"],"names":[],"mappings":""}

package/dist/workspace-bash-environment.test.js

@@ -0,0 +1,98 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { WorkspaceManager } from "@dexto/core/workspace";
+import { processToolsFactory } from "@dexto/tools-process";
+import { LocalWorkspaceHandleProvider } from "./local-workspace-handle-provider.js";
+function createLogger() {
+  const logger = {
+    debug: () => {
+    },
+    info: () => {
+    },
+    warn: () => {
+    },
+    error: () => {
+    },
+    createChild: () => createLogger()
+  };
+  return logger;
+}
+function createWorkspaceStore() {
+  const workspaces = /* @__PURE__ */ new Map();
+  let currentId;
+  return {
+    saveWorkspace: async ({ workspace }) => {
+      workspaces.set(workspace.id, workspace);
+    },
+    getWorkspace: async ({ id }) => workspaces.get(id),
+    findWorkspaceByPath: async ({ path: workspacePath }) => [...workspaces.values()].find((workspace) => workspace.path === workspacePath),
+    listWorkspaces: async () => [...workspaces.values()],
+    setCurrentWorkspace: async ({ id }) => {
+      currentId = id;
+    },
+    getCurrentWorkspaceId: async () => currentId,
+    clearCurrentWorkspace: async () => {
+      currentId = void 0;
+    }
+  };
+}
+describe("bash_exec in a workspace", () => {
+  let directory;
+  beforeEach(async () => {
+    directory = await mkdtemp(path.join(tmpdir(), "workspace-bash-"));
+  });
+  afterEach(async () => {
+    vi.unstubAllEnvs();
+    await rm(directory, { recursive: true, force: true });
+  });
+  async function runForeground(command, config = {}) {
+    const workspaceManager = new WorkspaceManager(
+      createWorkspaceStore(),
+      { emit: () => true },
+      createLogger(),
+      new LocalWorkspaceHandleProvider()
+    );
+    await workspaceManager.setWorkspace({ path: directory });
+    const bashExec = processToolsFactory.create(
+      processToolsFactory.configSchema.parse({
+        type: "process-tools",
+        securityLevel: "permissive",
+        ...config
+      })
+    ).find((tool) => tool.id === "bash_exec");
+    if (bashExec === void 0) {
+      throw new Error("Expected bash_exec tool to be registered.");
+    }
+    const context = {
+      logger: createLogger(),
+      services: { workspaceManager }
+    };
+    return await bashExec.execute(
+      { command, run_in_background: false, timeout: 2e4 },
+      context
+    );
+  }
+  const printVariables = 'echo "${DEXTO_TEST_HOST_MARKER:-absent}|${DEXTO_TEST_CONFIGURED:-absent}|${DEXTO_TEST_FORWARDED:-absent}"';
+  it("does not pass host variables to the command, but passes configured ones", async () => {
+    vi.stubEnv("DEXTO_TEST_HOST_MARKER", "leaked-host-value");
+    vi.stubEnv("DEXTO_TEST_FORWARDED", "forwarded-host-value");
+    const result = await runForeground(printVariables, {
+      environment: { DEXTO_TEST_CONFIGURED: "configured-value" }
+    });
+    expect(result).toMatchObject({ stdout: "absent|configured-value|absent\n" });
+  });
+  it("forwards host variables the user names in passEnvironment", async () => {
+    vi.stubEnv("DEXTO_TEST_HOST_MARKER", "leaked-host-value");
+    vi.stubEnv("DEXTO_TEST_FORWARDED", "forwarded-host-value");
+    const result = await runForeground(printVariables, {
+      passEnvironment: ["DEXTO_TEST_FORWARDED"]
+    });
+    expect(result).toMatchObject({ stdout: "absent|absent|forwarded-host-value\n" });
+  });
+  it("still finds commands on PATH", async () => {
+    const result = await runForeground("echo ready");
+    expect(result).toMatchObject({ stdout: "ready\n" });
+  });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dexto/image-local",
-  "version": "1.16.5",
+  "version": "1.17.0",
   "description": "Local development base image for Dexto agents with filesystem and process tools",
   "type": "module",
   "main": "./dist/index.js",
@@ -22,17 +22,17 @@
   "dependencies": {
     "glob": "^14.0.3",
     "zod": "^4.3.6",
-    "@dexto/agent-config": "1.16.5",
-    "@dexto/agent-management": "1.16.5",
-    "@dexto/core": "1.16.5",
-    "@dexto/storage": "1.16.5",
-    "@dexto/tools-builtins": "1.16.5",
-    "@dexto/tools-filesystem": "1.16.5",
-    "@dexto/tools-lifecycle": "1.16.5",
-    "@dexto/tools-plan": "1.16.5",
-    "@dexto/tools-process": "1.16.5",
-    "@dexto/tools-scheduler": "1.16.5",
-    "@dexto/tools-todo": "1.16.5"
+    "@dexto/agent-config": "1.17.0",
+    "@dexto/agent-management": "1.17.0",
+    "@dexto/core": "1.17.0",
+    "@dexto/storage": "1.17.0",
+    "@dexto/tools-builtins": "1.17.0",
+    "@dexto/tools-filesystem": "1.17.0",
+    "@dexto/tools-lifecycle": "1.17.0",
+    "@dexto/tools-plan": "1.17.0",
+    "@dexto/tools-process": "1.17.0",
+    "@dexto/tools-scheduler": "1.17.0",
+    "@dexto/tools-todo": "1.17.0"
   },
   "devDependencies": {
     "tsup": "^8.0.0",