@hachej/boring-execution 0.4.7 → 0.4.9

package/dist/aws-code-interpreter.js

@@ -378,14 +378,34 @@ export function createCodeInterpreterEnv(options) {
         readTextLines: (path, lines, context) => guarded([[path, true]], file => local.readTextLines(file, lines, context)),
         openTextLineReader: (path, context) => guarded([[path, true]], file => local.openTextLineReader(file, context)),
         openBinaryReader: (path, readerOptions, context) => guarded([[path, !readerOptions?.noFollow]], file => local.openBinaryReader(file, readerOptions, context)),
-        openDirReader: (path, context) => guarded([[path, true]], directory => local.openDirReader(directory, context)),
-        // The mount's own watcher, with its paths reported in the workspace's namespace.
+        // The reader's entries carry host paths; map them into the workspace namespace like `listDir`.
+        openDirReader: async (path, context) => {
+            const opened = await guarded([[path, true]], directory => local.openDirReader(directory, context));
+            if (!opened.ok)
+                return opened;
+            const reader = opened.value;
+            return ok({
+                next: async (maxEntries, readContext) => {
+                    const page = await reader.next(maxEntries, readContext);
+                    return page.ok ? ok({ ...page.value, entries: page.value.entries.map(mapInfo) }) : err(mapError(page.error));
+                },
+                close: readContext => reader.close(readContext),
+            });
+        },
+        // The mount's own watcher, confined like every file tool, with its paths reported in the workspace's namespace.
         watch: async (targets, onChange, context) => {
             const mapped = [];
             for (const target of targets) {
                 const path = toLocal(target.path);
                 if (path === undefined)
                     return err(outside(target.path));
+                try {
+                    if (!await confined(path, true))
+                        return err(outside(target.path));
+                }
+                catch (error) {
+                    return err(new FileError('unknown', errorText(error), namespace(target.path)));
+                }
                 mapped.push({ ...target, path });
             }
             const watcher = await local.watch(mapped, change => onChange('paths' in change ? { paths: change.paths.map(path => fromLocal(path)) } : 'error' in change ? { error: mapError(change.error) } : change), context);

package/dist/remote-shell-handler.d.ts

@@ -20,6 +20,12 @@ export interface RemoteShellHandlerOptions {
     readonly maxRequestBytes?: number;
     readonly maxFrameBytes?: number;
     readonly maxQueuedBytes?: number;
+    /**
+     * A client-chosen `env` may not set loader or shell-startup variables (`LD_*`, `DYLD_*`, `BASH_ENV`, `ENV`, `NODE_OPTIONS`,
+     * `PYTHONSTARTUP`, `PERL5OPT` and a few `GIT_*` command hooks): they run code before the command, which a host that authorizes
+     * only the command string would not see. The request is refused (403) before `authorize`. Set true to let clients pass them.
+     */
+    readonly allowLoaderEnv?: boolean;
 }
 export declare function createRemoteShellHandler(options: RemoteShellHandlerOptions): (request: Request) => Promise<Response>;
 //# sourceMappingURL=remote-shell-handler.d.ts.map

package/dist/remote-shell-handler.js

@@ -3,6 +3,7 @@ import { ExecutionError, err } from '@earendil-works/pi-durable/env';
 import { guardStatus, hasJsonContentType, readJsonBody } from '@hachej/boring-files/request-guard';
 import { windowedOutput } from './remote-shell-window.js';
 import { contentType, identity, nativeVersion, positiveLimit, requestInput, sameIdentity, schema, version, wireResult } from './remote-shell-protocol.js';
+const LOADER_ENV = /^(LD_|DYLD_)|^(BASH_ENV|ENV|NODE_OPTIONS|PYTHONSTARTUP|PERL5OPT|GIT_SSH_COMMAND|GIT_SSH|GIT_ASKPASS|GIT_EXTERNAL_DIFF|GIT_PROXY_COMMAND)$/;
 function failure(status) {
     return new Response(null, { status, headers: { 'cache-control': 'no-store' } });
 }
@@ -40,6 +41,8 @@ export function createRemoteShellHandler(options) {
             return failure(409);
         if (input.options.timeout !== undefined && supports.timeout !== true || input.options.spill !== undefined && supports.spill !== true)
             return failure(422);
+        if (!options.allowLoaderEnv && Object.keys(input.options.env ?? {}).some(key => LOADER_ENV.test(key)))
+            return failure(403);
         try {
             if (signal?.aborted || await awaitWithContext(Promise.resolve(authorize(input.command, structuredClone(input.options))), context) !== true || signal?.aborted)
                 return failure(403);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hachej/boring-execution",
-  "version": "0.4.7",
+  "version": "0.4.9",
   "license": "MIT",
   "private": false,
   "type": "module",
@@ -56,7 +56,7 @@
     "@earendil-works/chord": "~1.2.0",
     "just-bash": "^3.6.0",
     "isomorphic-git": "^1.42.6",
-    "@hachej/boring-files": "^0.4.7",
+    "@hachej/boring-files": "^0.4.9",
     "zod": "^4.6.5",
     "@aws-sdk/client-bedrock-agentcore": "^3.1146.0"
   },