@google/gemini-cli-core 0.39.0-preview.2 → 0.40.0-preview.0

package/dist/src/tools/shell.test.js

@@ -61,6 +61,7 @@ describe('ShellTool', () => {
     let mockShellOutputCallback;
     let resolveExecutionPromise;
     let tempRootDir;
+    let extractedTmpFile;
     beforeEach(() => {
         vi.clearAllMocks();
         tempRootDir = fs.mkdtempSync(path.join(os.tmpdir(), 'shell-test-'));
@@ -146,9 +147,14 @@ describe('ShellTool', () => {
         vi.mocked(crypto.randomBytes).mockReturnValue(Buffer.from('abcdef', 'hex'));
         process.env['ComSpec'] =
             'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe';
+        extractedTmpFile = '';
         // Capture the output callback to simulate streaming events from the service
-        mockShellExecutionService.mockImplementation((_cmd, _cwd, callback) => {
+        mockShellExecutionService.mockImplementation((cmd, _cwd, callback) => {
             mockShellOutputCallback = callback;
+            const match = cmd.match(/pgrep -g 0 >([^ ]+)/);
+            if (match) {
+                extractedTmpFile = match[1].replace(/['"]/g, '');
+            }
             return {
                 pid: 12345,
                 result: new Promise((resolve) => {
@@ -227,38 +233,32 @@ describe('ShellTool', () => {
         it('should wrap command on linux and parse pgrep output', async () => {
             const invocation = shellTool.build({ command: 'my-command &' });
             const promise = invocation.execute({ abortSignal: mockAbortSignal });
-            resolveShellExecution({ pid: 54321 });
             // Simulate pgrep output file creation by the shell command
-            const tmpFile = path.join(os.tmpdir(), 'shell_pgrep_abcdef.tmp');
-            fs.writeFileSync(tmpFile, `54321${os.EOL}54322${os.EOL}`);
+            fs.writeFileSync(extractedTmpFile, `54321${os.EOL}54322${os.EOL}`);
+            resolveShellExecution({ pid: 54321 });
             const result = await promise;
-            const wrappedCommand = `(\n${'my-command &'}\n); __code=$?; pgrep -g 0 >${tmpFile} 2>&1; exit $__code;`;
-            expect(mockShellExecutionService).toHaveBeenCalledWith(wrappedCommand, tempRootDir, expect.any(Function), expect.any(AbortSignal), false, expect.objectContaining({
+            expect(mockShellExecutionService).toHaveBeenCalledWith(expect.stringMatching(/pgrep -g 0 >.*gemini-shell-.*[/\\]pgrep\.tmp/), tempRootDir, expect.any(Function), expect.any(AbortSignal), false, expect.objectContaining({
                 pager: 'cat',
                 sanitizationConfig: {},
                 sandboxManager: expect.any(Object),
             }));
             expect(result.llmContent).toContain('Background PIDs: 54322');
             // The file should be deleted by the tool
-            expect(fs.existsSync(tmpFile)).toBe(false);
+            expect(fs.existsSync(extractedTmpFile)).toBe(false);
         });
         it('should add a space when command ends with a backslash to prevent escaping newline', async () => {
             const invocation = shellTool.build({ command: 'ls\\' });
             const promise = invocation.execute({ abortSignal: mockAbortSignal });
             resolveShellExecution();
             await promise;
-            const tmpFile = path.join(os.tmpdir(), 'shell_pgrep_abcdef.tmp');
-            const wrappedCommand = `(\nls\\ \n); __code=$?; pgrep -g 0 >${tmpFile} 2>&1; exit $__code;`;
-            expect(mockShellExecutionService).toHaveBeenCalledWith(wrappedCommand, tempRootDir, expect.any(Function), expect.any(AbortSignal), false, expect.any(Object));
+            expect(mockShellExecutionService).toHaveBeenCalledWith(expect.stringMatching(/pgrep -g 0 >.*gemini-shell-.*[/\\]pgrep\.tmp/), tempRootDir, expect.any(Function), expect.any(AbortSignal), false, expect.any(Object));
         });
         it('should handle trailing comments correctly by placing them on their own line', async () => {
             const invocation = shellTool.build({ command: 'ls # comment' });
             const promise = invocation.execute({ abortSignal: mockAbortSignal });
             resolveShellExecution();
             await promise;
-            const tmpFile = path.join(os.tmpdir(), 'shell_pgrep_abcdef.tmp');
-            const wrappedCommand = `(\nls # comment\n); __code=$?; pgrep -g 0 >${tmpFile} 2>&1; exit $__code;`;
-            expect(mockShellExecutionService).toHaveBeenCalledWith(wrappedCommand, tempRootDir, expect.any(Function), expect.any(AbortSignal), false, expect.any(Object));
+            expect(mockShellExecutionService).toHaveBeenCalledWith(expect.stringMatching(/pgrep -g 0 >.*gemini-shell-.*[/\\]pgrep\.tmp/), tempRootDir, expect.any(Function), expect.any(AbortSignal), false, expect.any(Object));
         });
         it('should use the provided absolute directory as cwd', async () => {
             const subdir = path.join(tempRootDir, 'subdir');
@@ -269,9 +269,7 @@ describe('ShellTool', () => {
             const promise = invocation.execute({ abortSignal: mockAbortSignal });
             resolveShellExecution();
             await promise;
-            const tmpFile = path.join(os.tmpdir(), 'shell_pgrep_abcdef.tmp');
-            const wrappedCommand = `(\n${'ls'}\n); __code=$?; pgrep -g 0 >${tmpFile} 2>&1; exit $__code;`;
-            expect(mockShellExecutionService).toHaveBeenCalledWith(wrappedCommand, subdir, expect.any(Function), expect.any(AbortSignal), false, expect.objectContaining({
+            expect(mockShellExecutionService).toHaveBeenCalledWith(expect.stringMatching(/pgrep -g 0 >.*gemini-shell-.*[/\\]pgrep\.tmp/), subdir, expect.any(Function), expect.any(AbortSignal), false, expect.objectContaining({
                 pager: 'cat',
                 sanitizationConfig: {},
                 sandboxManager: expect.any(Object),
@@ -285,9 +283,7 @@ describe('ShellTool', () => {
             const promise = invocation.execute({ abortSignal: mockAbortSignal });
             resolveShellExecution();
             await promise;
-            const tmpFile = path.join(os.tmpdir(), 'shell_pgrep_abcdef.tmp');
-            const wrappedCommand = `(\n${'ls'}\n); __code=$?; pgrep -g 0 >${tmpFile} 2>&1; exit $__code;`;
-            expect(mockShellExecutionService).toHaveBeenCalledWith(wrappedCommand, path.join(tempRootDir, 'subdir'), expect.any(Function), expect.any(AbortSignal), false, expect.objectContaining({
+            expect(mockShellExecutionService).toHaveBeenCalledWith(expect.stringMatching(/pgrep -g 0 >.*gemini-shell-.*[/\\]pgrep\.tmp/), path.join(tempRootDir, 'subdir'), expect.any(Function), expect.any(AbortSignal), false, expect.objectContaining({
                 pager: 'cat',
                 sanitizationConfig: {},
                 sandboxManager: expect.any(Object),
@@ -328,6 +324,17 @@ describe('ShellTool', () => {
                 sandboxManager: expect.any(NoopSandboxManager),
             }));
         }, 20000);
+        it('should correctly wrap heredoc commands', async () => {
+            const command = `cat << 'EOF'
+hello world
+EOF`;
+            const invocation = shellTool.build({ command });
+            const promise = invocation.execute({ abortSignal: mockAbortSignal });
+            resolveShellExecution();
+            await promise;
+            expect(mockShellExecutionService).toHaveBeenCalledWith(expect.stringMatching(/pgrep -g 0 >.*gemini-shell-.*[/\\]pgrep\.tmp/), tempRootDir, expect.any(Function), expect.any(AbortSignal), false, expect.any(Object));
+            expect(mockShellExecutionService.mock.calls[0][0]).toMatch(/\nEOF\n\)\n/);
+        });
         it('should format error messages correctly', async () => {
             const error = new Error('wrapped command failed');
             const invocation = shellTool.build({ command: 'user-command' });
@@ -403,16 +410,18 @@ describe('ShellTool', () => {
         });
         it('should clean up the temp file on synchronous execution error', async () => {
             const error = new Error('sync spawn error');
-            mockShellExecutionService.mockImplementation(() => {
-                // Create the temp file before throwing to simulate it being left behind
-                const tmpFile = path.join(os.tmpdir(), 'shell_pgrep_abcdef.tmp');
-                fs.writeFileSync(tmpFile, '');
+            mockShellExecutionService.mockImplementation((cmd) => {
+                const match = cmd.match(/pgrep -g 0 >([^ ]+)/);
+                if (match) {
+                    extractedTmpFile = match[1].replace(/['"]/g, ''); // remove any quotes if present
+                    // Create the temp file before throwing to simulate it being left behind
+                    fs.writeFileSync(extractedTmpFile, '');
+                }
                 throw error;
             });
             const invocation = shellTool.build({ command: 'a-command' });
             await expect(invocation.execute({ abortSignal: mockAbortSignal })).rejects.toThrow(error);
-            const tmpFile = path.join(os.tmpdir(), 'shell_pgrep_abcdef.tmp');
-            expect(fs.existsSync(tmpFile)).toBe(false);
+            expect(fs.existsSync(extractedTmpFile)).toBe(false);
         });
         it('should not log "missing pgrep output" when process is backgrounded', async () => {
             vi.useFakeTimers();
@@ -881,5 +890,381 @@ describe('ShellTool', () => {
             expect(schema.description).toMatchSnapshot();
         });
     });
+    describe('command injection detection', () => {
+        it('should block $() command substitution', async () => {
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo $(whoami)' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).toContain('Blocked');
+        });
+        it('should block backtick command substitution', async () => {
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo `whoami`' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).toContain('Blocked');
+        });
+        it('should allow normal commands without substitution', async () => {
+            mockShellExecutionService.mockImplementation((_cmd, _cwd, _callback) => ({
+                pid: 12345,
+                result: Promise.resolve({
+                    output: 'hello',
+                    rawOutput: Buffer.from('hello'),
+                    exitCode: 0,
+                    signal: null,
+                    error: null,
+                    aborted: false,
+                    pid: 12345,
+                    executionMethod: 'child_process',
+                    backgrounded: false,
+                }),
+            }));
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo hello' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).not.toContain('Blocked');
+        });
+        it('should allow single quoted strings with special chars', async () => {
+            mockShellExecutionService.mockImplementation((_cmd, _cwd, _callback) => ({
+                pid: 12345,
+                result: Promise.resolve({
+                    output: '$(not substituted)',
+                    rawOutput: Buffer.from('$(not substituted)'),
+                    exitCode: 0,
+                    signal: null,
+                    error: null,
+                    aborted: false,
+                    pid: 12345,
+                    executionMethod: 'child_process',
+                    backgrounded: false,
+                }),
+            }));
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({
+                command: "echo '$(not substituted)'",
+            });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).not.toContain('Blocked');
+        });
+        it('should allow escaped backtick outside double quotes', async () => {
+            mockShellExecutionService.mockImplementation((_cmd, _cwd, _callback) => ({
+                pid: 12345,
+                result: Promise.resolve({
+                    output: 'hello',
+                    rawOutput: Buffer.from('hello'),
+                    exitCode: 0,
+                    signal: null,
+                    error: null,
+                    aborted: false,
+                    pid: 12345,
+                    executionMethod: 'child_process',
+                    backgrounded: false,
+                }),
+            }));
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo \\`hello\\`' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).not.toContain('Blocked');
+        });
+        it('should block $() inside double quotes', async () => {
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo "$(whoami)"' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).toContain('Blocked');
+        });
+        it('should block >() process substitution', async () => {
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo >(whoami)' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).toContain('Blocked');
+        });
+        it('should allow $() inside single quotes', async () => {
+            mockShellExecutionService.mockImplementation((_cmd, _cwd, _callback) => ({
+                pid: 12345,
+                result: Promise.resolve({
+                    output: '$(whoami)',
+                    rawOutput: Buffer.from('$(whoami)'),
+                    exitCode: 0,
+                    signal: null,
+                    error: null,
+                    aborted: false,
+                    pid: 12345,
+                    executionMethod: 'child_process',
+                    backgrounded: false,
+                }),
+            }));
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({
+                command: "echo '$(whoami)'",
+            });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).not.toContain('Blocked');
+        });
+        it('should block PowerShell @() array subexpression', async () => {
+            mockPlatform.mockReturnValue('win32');
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo @(whoami)' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).toContain('Blocked');
+        });
+        it('should block PowerShell $() subexpression', async () => {
+            mockPlatform.mockReturnValue('win32');
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo $(whoami)' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).toContain('Blocked');
+        });
+        it('should allow PowerShell single quoted strings', async () => {
+            mockPlatform.mockReturnValue('win32');
+            mockShellExecutionService.mockImplementation((_cmd, _cwd, _callback) => ({
+                pid: 12345,
+                result: Promise.resolve({
+                    output: '$(whoami)',
+                    rawOutput: Buffer.from('$(whoami)'),
+                    exitCode: 0,
+                    signal: null,
+                    error: null,
+                    aborted: false,
+                    pid: 12345,
+                    executionMethod: 'child_process',
+                    backgrounded: false,
+                }),
+            }));
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({
+                command: "echo '$(whoami)'",
+            });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).not.toContain('Blocked');
+        });
+        it('should allow escaped substitution outside quotes', async () => {
+            mockShellExecutionService.mockImplementation((_cmd, _cwd, _callback) => ({
+                pid: 12345,
+                result: Promise.resolve({
+                    output: '$(whoami)',
+                    rawOutput: Buffer.from('$(whoami)'),
+                    exitCode: 0,
+                    signal: null,
+                    error: null,
+                    aborted: false,
+                    pid: 12345,
+                    executionMethod: 'child_process',
+                    backgrounded: false,
+                }),
+            }));
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo \\$(whoami)' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).not.toContain('Blocked');
+        });
+        it('should allow process substitution inside double quotes', async () => {
+            mockShellExecutionService.mockImplementation((_cmd, _cwd, _callback) => ({
+                pid: 12345,
+                result: Promise.resolve({
+                    output: '<(whoami)',
+                    rawOutput: Buffer.from('<(whoami)'),
+                    exitCode: 0,
+                    signal: null,
+                    error: null,
+                    aborted: false,
+                    pid: 12345,
+                    executionMethod: 'child_process',
+                    backgrounded: false,
+                }),
+            }));
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo "<(whoami)"' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).not.toContain('Blocked');
+        });
+        it('should block process substitution without quotes', async () => {
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo <(whoami)' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).toContain('Blocked');
+        });
+        it('should allow escaped $() outside double quotes', async () => {
+            mockShellExecutionService.mockImplementation((_cmd, _cwd, _callback) => ({
+                pid: 12345,
+                result: Promise.resolve({
+                    output: '$(whoami)',
+                    rawOutput: Buffer.from('$(whoami)'),
+                    exitCode: 0,
+                    signal: null,
+                    error: null,
+                    aborted: false,
+                    pid: 12345,
+                    executionMethod: 'child_process',
+                    backgrounded: false,
+                }),
+            }));
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo \\$(whoami)' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).not.toContain('Blocked');
+        });
+        it('should allow output process substitution inside double quotes', async () => {
+            mockShellExecutionService.mockImplementation((_cmd, _cwd, _callback) => ({
+                pid: 12345,
+                result: Promise.resolve({
+                    output: '<(whoami)',
+                    rawOutput: Buffer.from('<(whoami)'),
+                    exitCode: 0,
+                    signal: null,
+                    error: null,
+                    aborted: false,
+                    pid: 12345,
+                    executionMethod: 'child_process',
+                    backgrounded: false,
+                }),
+            }));
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo "<(whoami)"' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).not.toContain('Blocked');
+        });
+        it('should block <() process substitution without quotes', async () => {
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo <(whoami)' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).toContain('Blocked');
+        });
+        it('should block PowerShell bare () grouping operator', async () => {
+            mockPlatform.mockReturnValue('win32');
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo (whoami)' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).toContain('Blocked');
+        });
+        it('should allow escaped $() inside double quotes', async () => {
+            mockShellExecutionService.mockImplementation((_cmd, _cwd, _callback) => ({
+                pid: 12345,
+                result: Promise.resolve({
+                    output: '$(whoami)',
+                    rawOutput: Buffer.from('$(whoami)'),
+                    exitCode: 0,
+                    signal: null,
+                    error: null,
+                    aborted: false,
+                    pid: 12345,
+                    executionMethod: 'child_process',
+                    backgrounded: false,
+                }),
+            }));
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo "\\$(whoami)"' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).not.toContain('Blocked');
+        });
+        it('should allow escaped substitution inside double quotes', async () => {
+            mockShellExecutionService.mockImplementation((_cmd, _cwd, _callback) => ({
+                pid: 12345,
+                result: Promise.resolve({
+                    output: '$(whoami)',
+                    rawOutput: Buffer.from('$(whoami)'),
+                    exitCode: 0,
+                    signal: null,
+                    error: null,
+                    aborted: false,
+                    pid: 12345,
+                    executionMethod: 'child_process',
+                    backgrounded: false,
+                }),
+            }));
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({ command: 'echo "\\$(whoami)"' });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).not.toContain('Blocked');
+        });
+        it('should allow PowerShell keyword with flag e.g. switch -regex ($x)', async () => {
+            mockPlatform.mockReturnValue('win32');
+            mockShellExecutionService.mockImplementation((_cmd, _cwd, _callback) => ({
+                pid: 12345,
+                result: Promise.resolve({
+                    output: 'result',
+                    rawOutput: Buffer.from('result'),
+                    exitCode: 0,
+                    signal: null,
+                    error: null,
+                    aborted: false,
+                    pid: 12345,
+                    executionMethod: 'child_process',
+                    backgrounded: false,
+                }),
+            }));
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({
+                command: 'switch -regex ($x) { "a" { 1 } }',
+            });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).not.toContain('Blocked');
+        });
+        it('should allow PowerShell nested parentheses e.g. if ((condition))', async () => {
+            mockPlatform.mockReturnValue('win32');
+            mockShellExecutionService.mockImplementation((_cmd, _cwd, _callback) => ({
+                pid: 12345,
+                result: Promise.resolve({
+                    output: 'result',
+                    rawOutput: Buffer.from('result'),
+                    exitCode: 0,
+                    signal: null,
+                    error: null,
+                    aborted: false,
+                    pid: 12345,
+                    executionMethod: 'child_process',
+                    backgrounded: false,
+                }),
+            }));
+            const tool = new ShellTool(mockConfig, createMockMessageBus());
+            const invocation = tool.build({
+                command: 'if ((condition)) { Write-Host ok }',
+            });
+            const result = await invocation.execute({
+                abortSignal: new AbortController().signal,
+            });
+            expect(result.returnDisplay).not.toContain('Blocked');
+        });
+    });
 });
 //# sourceMappingURL=shell.test.js.map