@hmharness/agent 0.5.2 → 0.5.3

package/dist/runner.d.ts

@@ -56,6 +56,11 @@ export interface ApprovedRule {
     time: string;
 }
 export declare function loadApprovedRules(home: string): ApprovedRule[];
+/** Structured rule matching (review fix: raw string prefix was exploitable -
+ *  `node scripts/` prefix was hit by `node scripts/../../evil.js`). Now:
+ *  parses the rule as structured args, string values match by prefix BUT the
+ *  extension is checked for path traversal (`..` at the boundary blocks). */
+export declare function matchesRule(rules: ApprovedRule[], toolName: string, args: Record<string, unknown>): boolean;
 export declare function makeApproval(cfg: HmhConfig, yes: boolean, sharedRl?: readline.Interface): LoopApproval;
 export interface RunnerEvents {
     onLine?(line: string): void;

package/dist/runner.js

@@ -131,9 +131,36 @@ function saveApprovedRules(home, rules) {
     }
     catch { /* best effort */ }
 }
-function matchesRule(rules, toolName, args) {
-    const argsStr = JSON.stringify(args);
-    return rules.some((r) => r.tool === toolName && argsStr.startsWith(r.argPrefix));
+/** Structured rule matching (review fix: raw string prefix was exploitable -
+ *  `node scripts/` prefix was hit by `node scripts/../../evil.js`). Now:
+ *  parses the rule as structured args, string values match by prefix BUT the
+ *  extension is checked for path traversal (`..` at the boundary blocks). */
+export function matchesRule(rules, toolName, args) {
+    return rules.some((r) => {
+        if (r.tool !== toolName)
+            return false;
+        try {
+            const ruleArgs = JSON.parse(r.argPrefix);
+            for (const [k, rv] of Object.entries(ruleArgs)) {
+                const av = args[k];
+                if (typeof rv === 'string' && typeof av === 'string') {
+                    if (!av.startsWith(rv))
+                        return false;
+                    // path traversal: the extension after the approved prefix must not
+                    // start with `..` (blocks `node scripts/` → `node scripts/../../x`)
+                    if (av.slice(rv.length).startsWith('..'))
+                        return false;
+                }
+                else if (rv !== av) {
+                    return false;
+                }
+            }
+            return true;
+        }
+        catch {
+            return false;
+        }
+    });
 }
 export function makeApproval(cfg, yes, sharedRl) {
     const t = strings(cfg.locale ?? 'zh');
@@ -201,6 +228,11 @@ export async function runAgentTask(opts) {
         locale: cfg.locale,
         agentsMd: agentsMd ?? undefined,
     });
+    // system prompt token count: the prompt has been quietly growing (Codex 9
+    // instructions + AGENTS.md + memory + skills + insights) while no cost gate
+    // watches IT - this makes the size visible every run (review finding #5)
+    const systemTokens = Math.ceil(system.length / 4);
+    events.onLine?.(`  [prompt] system: ${system.length} chars (~${systemTokens} tokens) · ${agentsMd ? 'AGENTS.md: yes' : 'no AGENTS.md'}`);
     await session.user(opts.task);
     // YOLO fix: when yes=true the caller's approvalAsk (TUI dialog, web remote
     // gate) must NOT override the auto-approve gate - it used to take

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hmharness/agent",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "description": "hmharness agent execution layer: base tools, system prompt, sub-agent spawn, and the shared task runner that frontends (cli, web) drive.",
   "type": "module",
   "main": "dist/index.js",
@@ -15,15 +15,15 @@
     "build": "tsc -p tsconfig.build.json"
   },
   "dependencies": {
-    "@hmharness/kernel": "0.5.2",
-    "@hmharness/evolution": "0.5.2",
-    "@hmharness/domain-harmony": "0.5.2",
-    "@hmharness/domain-ops": "0.5.2"
+    "@hmharness/kernel": "0.5.3",
+    "@hmharness/evolution": "0.5.3",
+    "@hmharness/domain-harmony": "0.5.3",
+    "@hmharness/domain-ops": "0.5.3"
   },
   "files": [
     "dist"
   ],
-  "license": "Apache-2.0",
+  "license": "MIT",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/swsgbl/hmharness.git"