@gaunt-sloth/agent 2.0.0-alpha.4 → 2.0.0-alpha.40

package/dist/tools/shell/hardline.js

@@ -1,88 +0,0 @@
-/**
- * @module tools/shell/hardline
- *
- * Unbypassable hardline blocklist for the shell tool. These are catastrophic,
- * non-recoverable commands (wipe the root filesystem, format a disk, overwrite a
- * raw block device, fork-bomb, take the host down). They are refused inside
- * `executeCommand` itself — BEFORE spawn — so the refusal fires regardless of
- * yolo (`shellYolo`), any allow-list, or the confirmation path. yolo deliberately
- * bypasses the *confirmation*; it does NOT bypass this floor.
- *
- * Recoverable-but-costly operations (e.g. `git reset --hard`, `rm -rf ./build`,
- * `chmod -R 777 ./dir`, `curl | sh`) are intentionally NOT here — those are what
- * the confirmation dialog / yolo are for.
- *
- * Patterns match the NORMALIZED command ({@link ./normalize.js}) so obfuscation
- * (ANSI/fullwidth/backslash splits/whitespace padding) cannot bypass them.
- *
- * Patterned after hermes-agent `tools/approval.py` HARDLINE_PATTERNS.
- */
-import { normalizeCommand } from '#src/tools/shell/normalize.js';
-// Matches a position where the shell would begin parsing a NEW command: start of
-// string, after a separator (; & | newline), after `$(` or backtick, optionally
-// consuming leading wrappers (sudo/env VAR=VAL/exec/nohup/setsid/time). Used by
-// the shutdown-family patterns so they don't false-positive on `echo reboot`.
-const CMD_POS = '(?:^|[;&|\\n`]|\\$\\()' +
-    '\\s*' +
-    '(?:sudo\\s+(?:-[^\\s]+\\s+)*)?' +
-    '(?:env\\s+(?:\\w+=\\S*\\s+)*)?' +
-    '(?:(?:exec|nohup|setsid|time)\\s+)*' +
-    '\\s*';
-/**
- * Hardline patterns: [regex, human description]. Matched case-insensitively
- * against the normalized command.
- */
-export const HARDLINE_PATTERNS = [
-    // rm -rf targeting the root filesystem (`/`, `/*`).
-    [/\brm\s+(?:-[^\s]*\s+)*\/\s*\*?\s*(?:$|[;&|])/, 'recursive delete of root filesystem'],
-    // rm -rf targeting protected system directories (with optional /* suffix).
-    [
-        /\brm\s+(?:-[^\s]*\s+)*(?:\/(?:home|root|etc|usr|var|bin|sbin|boot|lib|lib64|opt|sys|proc))(?:\/\*)?\s*(?:$|[;&|])/,
-        'recursive delete of system directory',
-    ],
-    // rm -rf targeting the home directory (~ or $HOME).
-    // Note: patterns match the LOWERCASED normalized command, so $HOME → $home.
-    [
-        /\brm\s+(?:-[^\s]*\s+)*(?:~|\$home)(?:\/\*)?\s*(?:$|[;&|])/,
-        'recursive delete of home directory',
-    ],
-    // Filesystem format.
-    [/\bmkfs(?:\.[a-z0-9]+)?\b/, 'format filesystem (mkfs)'],
-    // dd writing to a raw block device.
-    [/\bdd\b[^\n]*\bof=\/dev\/(?:sd|nvme|hd|mmcblk|vd|xvd)[a-z0-9]*/, 'dd to raw block device'],
-    // Shell redirection to a raw block device (`> /dev/sda`).
-    [/>\s*\/dev\/(?:sd|nvme|hd|mmcblk|vd|xvd)[a-z0-9]*\b/, 'redirect to raw block device'],
-    // Classic fork bomb `:(){ :|:& };:`.
-    [/:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/, 'fork bomb'],
-    // chmod -R 777 / (recursive world-writable on root).
-    [
-        /\bchmod\s+(?:-[^\s]*\s+)*(?:-r|--recursive)\s+(?:-[^\s]*\s+)*777\s+\//,
-        'recursive chmod 777 of root',
-    ],
-    // Kill every process on the system (`kill -1`, `kill -9 -1`).
-    [/\bkill\s+(?:-[^\s]+\s+)*-1\b/, 'kill all processes'],
-    // System shutdown / reboot — anchored to a command position so `echo reboot`
-    // and `grep shutdown log` don't trip it.
-    [new RegExp(CMD_POS + '(?:shutdown|reboot|halt|poweroff)\\b'), 'system shutdown/reboot'],
-    [new RegExp(CMD_POS + 'init\\s+[06]\\b'), 'init 0/6 (shutdown/reboot)'],
-    [
-        new RegExp(CMD_POS + 'systemctl\\s+(?:poweroff|reboot|halt|kexec)\\b'),
-        'systemctl poweroff/reboot',
-    ],
-    [new RegExp(CMD_POS + 'telinit\\s+[06]\\b'), 'telinit 0/6 (shutdown/reboot)'],
-];
-/**
- * Check a raw command against the hardline blocklist. Normalizes first so
- * obfuscated variants are caught. Returns the match (with a description) when the
- * command is catastrophic, or `null` when it is allowed to proceed.
- */
-export function checkHardline(command) {
-    const normalized = normalizeCommand(command).toLowerCase();
-    for (const [pattern, description] of HARDLINE_PATTERNS) {
-        if (pattern.test(normalized)) {
-            return { description };
-        }
-    }
-    return null;
-}
-//# sourceMappingURL=hardline.js.map

package/dist/tools/shell/hardline.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"hardline.js","sourceRoot":"","sources":["../../../src/tools/shell/hardline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,iFAAiF;AACjF,gFAAgF;AAChF,gFAAgF;AAChF,8EAA8E;AAC9E,MAAM,OAAO,GACX,wBAAwB;IACxB,MAAM;IACN,gCAAgC;IAChC,gCAAgC;IAChC,qCAAqC;IACrC,MAAM,CAAC;AAET;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA6C;IACzE,oDAAoD;IACpD,CAAC,8CAA8C,EAAE,qCAAqC,CAAC;IACvF,2EAA2E;IAC3E;QACE,mHAAmH;QACnH,sCAAsC;KACvC;IACD,oDAAoD;IACpD,4EAA4E;IAC5E;QACE,2DAA2D;QAC3D,oCAAoC;KACrC;IACD,qBAAqB;IACrB,CAAC,0BAA0B,EAAE,0BAA0B,CAAC;IACxD,oCAAoC;IACpC,CAAC,+DAA+D,EAAE,wBAAwB,CAAC;IAC3F,0DAA0D;IAC1D,CAAC,oDAAoD,EAAE,8BAA8B,CAAC;IACtF,qCAAqC;IACrC,CAAC,gDAAgD,EAAE,WAAW,CAAC;IAC/D,qDAAqD;IACrD;QACE,uEAAuE;QACvE,6BAA6B;KAC9B;IACD,8DAA8D;IAC9D,CAAC,8BAA8B,EAAE,oBAAoB,CAAC;IACtD,6EAA6E;IAC7E,yCAAyC;IACzC,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,sCAAsC,CAAC,EAAE,wBAAwB,CAAC;IACxF,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,iBAAiB,CAAC,EAAE,4BAA4B,CAAC;IACvE;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,gDAAgD,CAAC;QACtE,2BAA2B;KAC5B;IACD,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,oBAAoB,CAAC,EAAE,+BAA+B,CAAC;CAC9E,CAAC;AAOF;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,iBAAiB,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,WAAW,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/tools/shell/normalize.d.ts

@@ -1,10 +0,0 @@
-/**
- * @module tools/shell/normalize
- *
- * Re-export of the canonical command normalizer, which now lives in
- * `@gaunt-sloth/core` (`core/shell/normalize`) so the core runner's EXT-9 Tier-2
- * allow-list classifier and the agent's Tier-1 hardline blocklist share ONE
- * implementation. Kept as a stable import path for existing agent-side consumers
- * (`tools/shell/hardline`, specs).
- */
-export { normalizeCommand } from '@gaunt-sloth/core/core/shell/normalize.js';

package/dist/tools/shell/normalize.js

@@ -1,11 +0,0 @@
-/**
- * @module tools/shell/normalize
- *
- * Re-export of the canonical command normalizer, which now lives in
- * `@gaunt-sloth/core` (`core/shell/normalize`) so the core runner's EXT-9 Tier-2
- * allow-list classifier and the agent's Tier-1 hardline blocklist share ONE
- * implementation. Kept as a stable import path for existing agent-side consumers
- * (`tools/shell/hardline`, specs).
- */
-export { normalizeCommand } from '@gaunt-sloth/core/core/shell/normalize.js';
-//# sourceMappingURL=normalize.js.map

package/dist/tools/shell/normalize.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../../../src/tools/shell/normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC"}