@hanzlaa/rcode 4.4.2 → 4.4.3

package/server/lib/html/client/orchestrator.js

@@ -303,6 +303,17 @@ function _poll() {
  * @param {{ runner?: string, model?: string }} [opts] — agent CLI selection
  */
 export function runAndOpenTerm(storyId, cmd, title, opts) {
+  // #916 — spawning an orchestrator session launches a real agent with
+  // permissions skipped. Gate it behind an explicit confirmation dialog
+  // instead of running on the first click. The dialog calls execRunAndOpenTerm
+  // on confirm.
+  setState({
+    runConfirm: { kind: 'story', storyId, cmd, title: title || storyId, opts: opts || null },
+  });
+}
+
+/** The actual spawn — invoked only after the user confirms (see #916). */
+export function execRunAndOpenTerm(storyId, cmd, title, opts) {
   // Open the panel immediately (it shows "connecting" while the session starts).
   setState({
     terminal: {
@@ -362,9 +373,19 @@ export function stopStory(storyId) {
 
 // ── Command runner ────────────────────────────────────────────────────────────
 /**
- * Client-side allowlist — mirrors the server COMMAND_ALLOWLIST.
- * The server always re-validates; this list drives the picker dropdown only.
- * Update both when adding a new command.
+ * Client-side command-runner allowlist — mirrors the server COMMAND_ALLOWLIST.
+ *
+ * #932 — this is INTENTIONALLY a small, curated subset of the ~117 rcode
+ * commands, NOT the full set. The command runner spawns a real agent with
+ * permissions skipped straight from the browser, so only commands that are
+ * SAFE to run unattended are exposed here: read-only status/inspection
+ * (status, progress, stats, health, diff, show, list-plans, help) plus the two
+ * idempotent setup commands (init, config). Destructive or long-running
+ * commands (execute, autonomous, ship, dev-story, …) are deliberately omitted
+ * — run those from your IDE where you can supervise them. The server
+ * re-validates against COMMAND_ALLOWLIST regardless; this list only drives the
+ * picker dropdown. Keep both in sync when adding a command, and only add one
+ * here if it is safe to run unattended.
  */
 export const ALLOWED_COMMANDS = [
   { cmd: '/rcode-init',          label: 'init — initialise project workspace',    category: 'Project'  },
@@ -397,6 +418,16 @@ export const ALLOWED_COMMANDS = [
  * @param {{ runner?: string, model?: string }} [opts] — agent CLI selection
  */
 export function runCommandFromUI(cmd, opts) {
+  if (!cmd) return;
+  // #916 — gate command-runner spawns behind the same confirmation dialog.
+  const title = cmd + ' (command runner)';
+  setState({
+    runConfirm: { kind: 'command', cmd, title, opts: opts || null },
+  });
+}
+
+/** The actual command-runner spawn — invoked only after the user confirms. */
+export function execRunCommandFromUI(cmd, opts) {
   if (!cmd) return;
   const slug    = cmd.replace(/^\//, '').replace(/\//g, '-');
   const storyId = 'cmd-' + slug;
@@ -418,3 +449,20 @@ export function runCommandFromUI(cmd, opts) {
     })
     .catch(() => showToast('Could not reach orchestrator'));
 }
+
+/** Confirm the pending run (from the #916 dialog) and dispatch the real spawn. */
+export function confirmPendingRun() {
+  const rc = getState().runConfirm;
+  setState({ runConfirm: null });
+  if (!rc) return;
+  if (rc.kind === 'command') {
+    execRunCommandFromUI(rc.cmd, rc.opts);
+  } else {
+    execRunAndOpenTerm(rc.storyId, rc.cmd, rc.title, rc.opts);
+  }
+}
+
+/** Dismiss the pending-run confirmation without spawning. */
+export function cancelPendingRun() {
+  setState({ runConfirm: null });
+}

package/server/lib/html/client/store.js

@@ -77,6 +77,10 @@ let _state = {
   // Runner-picker popover state (driven by components/RunnerPicker.js)
   // { open, x, y, run: { kind: 'session'|'command', storyId?, cmd, title? } }
   runnerPicker:     null,
+  // #916 — pending orchestrator-run confirmation. When set, RunConfirmDialog
+  // renders and the spawn waits for explicit user approval.
+  // { kind: 'story'|'command', storyId?, cmd, title, opts }
+  runConfirm:       null,
 };
 
 /** Registered subscriber functions. */

package/server/lib/html/css.js

@@ -4573,6 +4573,13 @@ summary:focus-visible,
   padding: var(--space-6) var(--space-4);
   font-size: var(--text-sm);
 }
+.cmd-palette-footer {
+  border-top: 1px solid var(--border);
+  padding: var(--space-2) var(--space-3);
+  color: var(--text-muted);
+  font-size: var(--text-xs);
+  line-height: 1.4;
+}
 /* ════════ Command palette (END) ════════ */
 
 /* ── Reject dialog ── */
@@ -4613,6 +4620,20 @@ summary:focus-visible,
   box-sizing: border-box;
 }
 .reject-dialog-input:focus { outline: none; border-color: var(--accent-primary); }
+.run-confirm-body {
+  color: var(--text-secondary);
+  font-size: var(--text-xs);
+  line-height: 1.5;
+}
+.run-confirm-body p { margin: 0 0 var(--space-2); }
+.run-confirm-cmd {
+  background: var(--bg-input);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-2);
+  padding: var(--space-2);
+  word-break: break-all;
+}
+.run-confirm-cmd code { font-family: var(--font-mono, monospace); color: var(--text-primary); }
 .reject-dialog-actions {
   display: flex;
   justify-content: flex-end;

package/server/orchestrator.js

@@ -116,6 +116,12 @@ const RUNNERS = [
     // alias ('fable', 'opus', 'sonnet') or a full model id like fable-5.
     id: 'claude', label: 'Claude Code', bin: CLAUDE_BIN, modelFlag: '--model',
     models: ['fable-5', 'opus', 'sonnet', 'haiku'],
+    // #918 — orchestrated sessions run in a detached PTY with no human at the
+    // keyboard to answer permission prompts, so the agent is launched with
+    // --dangerously-skip-permissions. This is a real privilege grant: the
+    // agent can run any local command without a gate. Containment relies on
+    // (a) the loopback-only + token-gated API and (b) running in the project
+    // CWD. A visible warning is emitted at spawn time (see handleRun).
     args: (model, prompt) => model
       ? [prompt, '--dangerously-skip-permissions', '--model', model]
       : [prompt, '--dangerously-skip-permissions'],
@@ -332,11 +338,30 @@ function validStoryId(id) {
     && STORY_ID_RE.test(id);
 }
 
+// Cap request bodies so a malicious or buggy caller can't exhaust memory by
+// streaming an unbounded payload (#921). 1 MB is far more than any legitimate
+// run/stop/reject body. On overflow we destroy the socket and resolve {} —
+// the handler then rejects it as an invalid body.
+const MAX_BODY_BYTES = 1 * 1024 * 1024;
+
 function parseBody(req) {
   return new Promise(resolve => {
     let buf = '';
-    req.on('data', c => buf += c);
-    req.on('end', () => { try { resolve(JSON.parse(buf)); } catch { resolve({}); } });
+    let size = 0;
+    let aborted = false;
+    req.on('data', c => {
+      if (aborted) return;
+      size += c.length;
+      if (size > MAX_BODY_BYTES) {
+        aborted = true;
+        try { req.destroy(); } catch {}
+        resolve({});
+        return;
+      }
+      buf += c;
+    });
+    req.on('end', () => { if (!aborted) { try { resolve(JSON.parse(buf)); } catch { resolve({}); } } });
+    req.on('error', () => { if (!aborted) { aborted = true; resolve({}); } });
   });
 }
 
@@ -492,6 +517,17 @@ async function handleRun(req, res) {
       json(res, 403, { error: 'command not in allowlist', cmd: reqCmd });
       return;
     }
+  } else if (typeof body.cmd === 'string' && body.cmd.trim() !== '') {
+    // #919 — non-cmd sessions (dev-runs: phase-N, sprint-N.M, task ids) may
+    // supply an explicit cmd, but it MUST be a slash command (e.g.
+    // "/rcode-dev-story phase-3"). Free-form prompt text is rejected so the
+    // allowlist isn't trivially bypassed by using a non-cmd- storyId. The
+    // default path (no body.cmd) uses "/rcode-dev-story <storyId>" — also a
+    // slash command — so this never blocks the normal flow.
+    if (!body.cmd.trim().startsWith('/')) {
+      json(res, 403, { error: 'non-command sessions must run a slash command (got free-form prompt)' });
+      return;
+    }
   }
 
   // Runner + model selection — STRICT validation against the registry.
@@ -533,6 +569,11 @@ async function handleRun(req, res) {
   const cmd  = String(body.cmd || `/rcode-dev-story ${storyId}`);
   const cols = 120, rows = 30;
 
+  // #918 — make the privilege grant audible. Every orchestrated run launches
+  // the agent with permissions skipped; surface it in the server log so it's
+  // never silent.
+  console.warn(`[orchestrator] ⚠ spawning ${runner.id} for "${storyId}" with permissions SKIPPED — agent can run any local command in ${PROJECT_ROOT}`);
+
   let proc;
   try {
     proc = pty.spawn(runner.bin, runner.args(model, cmd), {