@gajae-code/coding-agent 0.2.4 → 0.3.0

package/src/tools/bash-allowed-prefixes.ts

@@ -0,0 +1,169 @@
+export interface BashAllowedPrefixesCheck {
+	allowed: boolean;
+	reason?: string;
+}
+
+const SHELL_CONTROL_CHARS = new Set([";", "|", "&", "<", ">", "(", ")"]);
+const UNSAFE_UNQUOTED_EXPANSION_CHARS = new Set(["$", "*", "?", "[", "]", "{", "}", "~"]);
+const STATE_FLAGS_WITH_VALUES = new Set(["--input", "--mode", "--session-id", "--thread-id", "--turn-id", "--to"]);
+const STATE_ACTIONS = new Set(["read", "write", "clear", "contract", "handoff"]);
+const ALLOWED_STATE_ACTIONS = new Set(["read", "write", "contract"]);
+
+function parseShellWords(command: string): { words: string[]; reason?: string } {
+	const words: string[] = [];
+	let current = "";
+	let quote: "single" | "double" | null = null;
+
+	for (let index = 0; index < command.length; index += 1) {
+		const char = command[index]!;
+		const next = command[index + 1];
+
+		if (quote === "single") {
+			if (char === "'") {
+				quote = null;
+			} else {
+				current += char;
+			}
+			continue;
+		}
+
+		if (quote === "double") {
+			if (char === '"') {
+				quote = null;
+				continue;
+			}
+			if (char === "`" || (char === "$" && next === "(")) {
+				return { words, reason: "command substitution is not allowed in restricted bash commands" };
+			}
+			if (char === "$") {
+				return { words, reason: "shell expansion character '$' is not allowed in restricted bash commands" };
+			}
+			if (char === "\\") {
+				return { words, reason: "backslash escapes are not allowed in restricted bash commands" };
+			}
+			current += char;
+			continue;
+		}
+
+		if (char === "'") {
+			quote = "single";
+			continue;
+		}
+		if (char === '"') {
+			quote = "double";
+			continue;
+		}
+		if (char === "`" || (char === "$" && next === "(")) {
+			return { words, reason: "command substitution is not allowed in restricted bash commands" };
+		}
+		if (char === "\n" || char === "\r") {
+			return { words, reason: "multiple shell commands are not allowed in restricted bash mode" };
+		}
+		if (SHELL_CONTROL_CHARS.has(char)) {
+			return { words, reason: `shell control operator '${char}' is not allowed in restricted bash commands` };
+		}
+		if (UNSAFE_UNQUOTED_EXPANSION_CHARS.has(char)) {
+			return { words, reason: `shell expansion character '${char}' is not allowed in restricted bash commands` };
+		}
+		if (/\s/u.test(char)) {
+			if (current.length > 0) {
+				words.push(current);
+				current = "";
+			}
+			continue;
+		}
+		if (char === "\\") {
+			return { words, reason: "backslash escapes are not allowed in restricted bash commands" };
+		}
+		current += char;
+	}
+
+	if (quote !== null) {
+		return { words, reason: "unterminated quote in restricted bash command" };
+	}
+	if (current.length > 0) words.push(current);
+	return { words };
+}
+
+function prefixWords(prefix: string): string[] {
+	return prefix.trim().split(/\s+/u).filter(Boolean);
+}
+
+function wordsStartWith(words: readonly string[], prefix: readonly string[]): boolean {
+	if (prefix.length === 0 || words.length < prefix.length) return false;
+	return prefix.every((word, index) => words[index] === word);
+}
+
+function parseStateAction(words: readonly string[]): string | undefined {
+	const args = words.slice(2);
+	const positional: string[] = [];
+	let skipNext = false;
+	for (const arg of args) {
+		if (skipNext) {
+			skipNext = false;
+			continue;
+		}
+		if (STATE_FLAGS_WITH_VALUES.has(arg)) {
+			skipNext = true;
+			continue;
+		}
+		if (!arg.startsWith("-")) positional.push(arg);
+	}
+
+	const [first, second, third] = positional;
+	if (!first) return "read";
+	if (STATE_ACTIONS.has(first)) return second ? undefined : first;
+	if (!second) return "read";
+	if (!STATE_ACTIONS.has(second)) return undefined;
+	return third ? undefined : second;
+}
+
+function validateMatchedGjcCommand(words: readonly string[]): BashAllowedPrefixesCheck {
+	if (words[0] !== "gjc") return { allowed: true };
+
+	if (words[1] === "ralplan") {
+		if (!words.includes("--write")) {
+			return { allowed: false, reason: "restricted role-agent bash only allows `gjc ralplan --write ...`" };
+		}
+		return { allowed: true };
+	}
+
+	if (words[1] === "state") {
+		const action = parseStateAction(words);
+		if (!action) {
+			return {
+				allowed: false,
+				reason: "restricted role-agent bash only allows documented `gjc state` action shapes",
+			};
+		}
+		if (!ALLOWED_STATE_ACTIONS.has(action)) {
+			return { allowed: false, reason: `restricted role-agent bash does not allow \`gjc state ${action}\`` };
+		}
+		return { allowed: true };
+	}
+
+	return { allowed: true };
+}
+
+export function checkBashAllowedPrefixes(
+	command: string,
+	allowedPrefixes: readonly string[] | undefined,
+): BashAllowedPrefixesCheck {
+	const normalizedPrefixes = allowedPrefixes?.map(prefix => prefix.trim()).filter(Boolean) ?? [];
+	if (normalizedPrefixes.length === 0) return { allowed: true };
+
+	const parsed = parseShellWords(command.trim());
+	if (parsed.reason) return { allowed: false, reason: parsed.reason };
+	if (parsed.words.length === 0)
+		return { allowed: false, reason: "empty command is not allowed in restricted bash mode" };
+
+	const matched = normalizedPrefixes.some(prefix => wordsStartWith(parsed.words, prefixWords(prefix)));
+	if (!matched) {
+		return {
+			allowed: false,
+			reason: `restricted role-agent bash only allows commands starting with: ${normalizedPrefixes.join(", ")}`,
+		};
+	}
+
+	return validateMatchedGjcCommand(parsed.words);
+}

package/src/tools/bash.ts

@@ -8,6 +8,7 @@ import { AsyncJobManager } from "../async";
 import { type BashResult, executeBash } from "../exec/bash-executor";
 import type { RenderResultOptions } from "../extensibility/custom-tools/types";
 import { buildGjcRuntimeSessionEnv } from "../gjc-runtime/goal-mode-request";
+import { GJC_RESTRICTED_ROLE_AGENT_BASH_ENV } from "../gjc-runtime/restricted-role-agent-bash";
 import { InternalUrlRouter } from "../internal-urls";
 import { truncateToVisualLines } from "../modes/components/visual-truncate";
 import { highlightCode, type Theme } from "../modes/theme/theme";
@@ -18,6 +19,7 @@ import { renderStatusLine } from "../tui";
 import { CachedOutputBlock } from "../tui/output-block";
 import { getSixelLineMask } from "../utils/sixel";
 import type { ToolSession } from ".";
+import { checkBashAllowedPrefixes } from "./bash-allowed-prefixes";
 import { applyBashFixups } from "./bash-command-fixup";
 import { type BashInteractiveResult, runInteractiveBashPty } from "./bash-interactive";
 import { checkBashInterception } from "./bash-interceptor";
@@ -253,6 +255,7 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 			hasAstEdit: this.session.settings.get("astEdit.enabled"),
 			hasSearch: this.session.settings.get("search.enabled"),
 			hasFind: this.session.settings.get("find.enabled"),
+			restrictedAllowedPrefixes: this.session.bashAllowedPrefixes,
 		});
 	}
 
@@ -377,6 +380,13 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 							latestText = tailBuffer.text();
 							void reportProgress(latestText, { async: { state: "running", jobId, type: "bash" } });
 						},
+						onRawChunk: chunk => {
+							// Forward the unthrottled sanitized chunk to the async-job
+							// substrate so the Monitor tool can read the complete process
+							// stream by byte offset, independent of the throttled preview
+							// path above.
+							manager.appendOutput(jobId, chunk);
+						},
 						onMinimizedSave: originalText => saveBashOriginalArtifact(this.session, originalText),
 					});
 					const finalResult = this.#buildCompletedResult(result, options.timeoutSec, {
@@ -454,27 +464,29 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 		return Math.max(0, Math.min(this.#autoBackgroundThresholdMs, timeoutMs - timeoutBufferMs));
 	}
 
-	async execute(
-		_toolCallId: string,
-		{
-			command: rawCommand,
-			env: rawEnv,
-			timeout: rawTimeout = 300,
-			cwd,
-
-			async: asyncRequested = false,
-			pty = false,
-		}: BashToolInput,
-		signal?: AbortSignal,
-		onUpdate?: AgentToolUpdateCallback<BashToolDetails>,
+	/**
+	 * Build the fully-prepared parameters for a `bash`-flavored execution
+	 * (interceptors, internal URL expansion, env resolution, cwd validation,
+	 * timeout clamp). Used by both `execute()` and the public `startMonitorJob`
+	 * helper after `AgentSession` has applied the public-tool permission gate, so
+	 * Monitor inherits Bash's cwd / env / artifact / interceptor pipeline 1:1.
+	 */
+	async #prepareBashExecution(
+		input: { command: string; env?: Record<string, string>; timeout?: number; cwd?: string },
 		ctx?: AgentToolContext,
-	): Promise<AgentToolResult<BashToolDetails>> {
-		let command = rawCommand;
-		const env = normalizeBashEnv(rawEnv);
+	): Promise<{
+		command: string;
+		commandCwd: string;
+		resolvedEnv: Record<string, string>;
+		requestedTimeoutSec: number;
+		timeoutSec: number;
+		timeoutMs: number;
+		notices: string[];
+	}> {
+		let command = input.command;
+		let cwd = input.cwd;
+		const env = normalizeBashEnv(input.env);
 
-		// Apply conservative bash fixups (strip trailing `| head|tail` and redundant
-		// `2>&1`). The helper is single-line only and refuses anything that could
-		// change semantics.
 		if (this.session.settings.get("bash.stripTrailingHeadTail")) {
 			const fixup = applyBashFixups(command);
 			if (fixup.stripped.length > 0) {
@@ -482,9 +494,6 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 			}
 		}
 
-		// Extract leading `cd <path> && ...` into cwd when the model ignores the cwd parameter.
-		// Constrained to a single line so a `&&` that sits on a later line of a multiline
-		// script can't pull the entire script into the "cwd" capture.
 		if (!cwd) {
 			const cdMatch = command.match(/^cd[ \t]+((?:[^&\\\n\r]|\\.)+?)[ \t]*&&[ \t]*/);
 			if (cdMatch) {
@@ -492,8 +501,20 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 				command = command.slice(cdMatch[0].length);
 			}
 		}
-		if (asyncRequested && !this.#asyncEnabled) {
-			throw new ToolError("Async bash execution is disabled. Enable async.enabled to use async mode.");
+
+		const rawCommand = input.command;
+		const allowedPrefixes = this.session.bashAllowedPrefixes;
+		if (allowedPrefixes && allowedPrefixes.length > 0) {
+			if (env && Object.keys(env).length > 0) {
+				throw new ToolError("Restricted role-agent bash does not allow per-command env overrides.");
+			}
+			const commandsToCheck = rawCommand === command ? [command] : [rawCommand, command];
+			for (const commandToCheck of commandsToCheck) {
+				const allowlist = checkBashAllowedPrefixes(commandToCheck, allowedPrefixes);
+				if (!allowlist.allowed) {
+					throw new ToolError(allowlist.reason ?? "Command blocked by restricted role-agent bash allowlist.");
+				}
+			}
 		}
 
 		// Check both the original command and the cwd-normalized command so
@@ -541,9 +562,9 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 				cwd: this.session.cwd,
 			}),
 			...expandedEnv,
+			...(allowedPrefixes && allowedPrefixes.length > 0 ? { [GJC_RESTRICTED_ROLE_AGENT_BASH_ENV]: "1" } : {}),
 		};
 
-		// Resolve protocol URLs (agent://, artifact://, etc.) in extracted cwd.
 		if (cwd?.includes("://") || cwd?.includes("local:/")) {
 			cwd = await expandInternalUrls(cwd, { ...internalUrlOptions, noEscape: true });
 		}
@@ -562,13 +583,153 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 			throw new ToolError(`Working directory is not a directory: ${commandCwd}`);
 		}
 
-		// Clamp to reasonable range: 1s - 3600s (1 hour)
-		const requestedTimeoutSec = rawTimeout;
+		const requestedTimeoutSec = input.timeout ?? 300;
 		const timeoutSec = clampTimeout("bash", requestedTimeoutSec);
 		const timeoutMs = timeoutSec * 1000;
-		const pendingNotices: string[] = [];
+		const notices: string[] = [];
 		const timeoutClampNotice = formatTimeoutClampNotice(requestedTimeoutSec, timeoutSec);
-		if (timeoutClampNotice) pendingNotices.push(timeoutClampNotice);
+		if (timeoutClampNotice) notices.push(timeoutClampNotice);
+
+		return { command, commandCwd, resolvedEnv, requestedTimeoutSec, timeoutSec, timeoutMs, notices };
+	}
+
+	/**
+	 * Start a background bash job for the Monitor tool. Reuses the full Bash
+	 * pipeline (interceptors, internal-URL expansion, env, cwd, timeout); the
+	 * public `monitor` tool itself is ACP-gated by `AgentSession` before this
+	 * helper is called. The caller-supplied `onRawLine` callback is invoked once
+	 * per newline-terminated stdout chunk, between turns, so the upstream Claude
+	 * Code "Each stdout line is a task-notification event" semantics are preserved
+	 * through the agent's existing background-task delivery path.
+	 */
+	async startMonitorJob(
+		input: { command: string; cwd?: string; timeout?: number; env?: Record<string, string> },
+		opts: {
+			ownerId?: string;
+			label?: string;
+			ctx?: AgentToolContext;
+			onRawLine?: (line: string, jobId: string) => void;
+		} = {},
+	): Promise<{ jobId: string; label: string; commandCwd: string }> {
+		const manager = AsyncJobManager.instance();
+		if (!manager) {
+			throw new ToolError("Async job manager unavailable for this session.");
+		}
+		const prepared = await this.#prepareBashExecution(input, opts.ctx);
+		const label =
+			opts.label ?? (prepared.command.length > 120 ? `${prepared.command.slice(0, 117)}...` : prepared.command);
+		const monitorTimeoutMs = input.timeout === undefined ? null : prepared.timeoutMs;
+		const onRawLine = opts.onRawLine;
+		let currentJobId = "";
+		let cursorOffset = 0;
+		let lineBuffer = "";
+		const dispatchLines = (chunk: string) => {
+			if (!onRawLine) return;
+			lineBuffer += chunk;
+			let newlineIndex = lineBuffer.indexOf("\n");
+			while (newlineIndex !== -1) {
+				const line = lineBuffer.slice(0, newlineIndex);
+				lineBuffer = lineBuffer.slice(newlineIndex + 1);
+				try {
+					onRawLine(line, currentJobId);
+				} catch (error) {
+					logger.warn("Monitor onRawLine callback failed", {
+						error: error instanceof Error ? error.message : String(error),
+					});
+				}
+				newlineIndex = lineBuffer.indexOf("\n");
+			}
+		};
+		const flushTrailingLine = () => {
+			if (!onRawLine) return;
+			if (lineBuffer.length === 0) return;
+			const remainder = lineBuffer;
+			lineBuffer = "";
+			try {
+				onRawLine(remainder, currentJobId);
+			} catch (error) {
+				logger.warn("Monitor onRawLine callback failed (trailing)", {
+					error: error instanceof Error ? error.message : String(error),
+				});
+			}
+		};
+
+		const ownerId = opts.ownerId ?? this.session.getAgentId?.() ?? undefined;
+		const jobId = manager.register(
+			"bash",
+			label,
+			async ({ jobId: id, signal, reportProgress }) => {
+				const { path: artifactPath, id: artifactId } = (await this.session.allocateOutputArtifact?.("bash")) ?? {};
+				const tailBuffer = new TailBuffer(DEFAULT_MAX_BYTES);
+				try {
+					const result = await executeBash(prepared.command, {
+						cwd: prepared.commandCwd,
+						sessionKey: `${this.session.getSessionId?.() ?? ""}:monitor:${id}`,
+						timeout: monitorTimeoutMs,
+						signal,
+						env: prepared.resolvedEnv,
+						artifactPath,
+						artifactId,
+						onChunk: chunk => {
+							tailBuffer.append(chunk);
+							void reportProgress(tailBuffer.text(), {
+								async: { state: "running", jobId: id, type: "bash" },
+							});
+						},
+						onRawChunk: chunk => {
+							manager.appendOutput(id, chunk);
+							const slice = manager.readOutputSince(id, cursorOffset, ownerId ? { ownerId } : undefined);
+							if (!slice) return;
+							cursorOffset = slice.nextOffset;
+							dispatchLines(slice.text);
+						},
+						onMinimizedSave: originalText => saveBashOriginalArtifact(this.session, originalText),
+					});
+					flushTrailingLine();
+					this.#buildResultText(result, prepared.timeoutSec, result.output || "(no output)");
+					return result.output;
+				} catch (error) {
+					flushTrailingLine();
+					throw error instanceof Error ? error : new Error(String(error));
+				}
+			},
+			{ ownerId },
+		);
+		currentJobId = jobId;
+		return { jobId, label, commandCwd: prepared.commandCwd };
+	}
+
+	async execute(
+		_toolCallId: string,
+		{
+			command: rawCommand,
+			env: rawEnv,
+			timeout: rawTimeout = 300,
+			cwd,
+
+			async: asyncRequested = false,
+			pty = false,
+		}: BashToolInput,
+		signal?: AbortSignal,
+		onUpdate?: AgentToolUpdateCallback<BashToolDetails>,
+		ctx?: AgentToolContext,
+	): Promise<AgentToolResult<BashToolDetails>> {
+		if (asyncRequested && !this.#asyncEnabled) {
+			throw new ToolError("Async bash execution is disabled. Enable async.enabled to use async mode.");
+		}
+		const prepared = await this.#prepareBashExecution(
+			{ command: rawCommand, env: rawEnv, timeout: rawTimeout, cwd },
+			ctx,
+		);
+		const {
+			command,
+			commandCwd,
+			resolvedEnv,
+			requestedTimeoutSec,
+			timeoutSec,
+			timeoutMs,
+			notices: pendingNotices,
+		} = prepared;
 
 		if (asyncRequested) {
 			if (!AsyncJobManager.instance()) {

package/src/tools/browser/tab-worker.ts

@@ -916,7 +916,7 @@ export class WorkerCore {
 						dispatchEvent: (event: unknown) => boolean;
 					}
 					const select = el as unknown as SelectLike;
-					if (!select || select.tagName !== "SELECT") throw new Error("tab.select() requires a <select> element");
+					if (select?.tagName !== "SELECT") throw new Error("tab.select() requires a <select> element");
 					const EventCtor = (
 						globalThis as unknown as { Event: new (type: string, init?: { bubbles: boolean }) => unknown }
 					).Event;