@hmharness/agent 0.6.6 → 0.6.7

package/dist/runner.d.ts

@@ -62,8 +62,9 @@ export interface ApprovedRule {
 export declare function loadApprovedRules(home: string): ApprovedRule[];
 /** Structured rule matching (review fix: raw string prefix was exploitable -
  *  `node scripts/` prefix was hit by `node scripts/../../evil.js`). Now:
- *  parses the rule as structured args, string values match by prefix BUT the
- *  extension is checked for path traversal (`..` at the boundary blocks). */
+ *  parses the rule as structured args, string values match by prefix AND no
+ *  path SEGMENT of the extension may be `..` (a boundary-only check missed
+ *  `node scripts/sub/../../evil.js`, whose first differing segment is `sub`). */
 export declare function matchesRule(rules: ApprovedRule[], toolName: string, args: Record<string, unknown>): boolean;
 export declare function makeApproval(cfg: HmhConfig, yes: boolean, sharedRl?: readline.Interface): LoopApproval;
 export interface RunnerEvents {

package/dist/runner.js

@@ -157,8 +157,9 @@ function saveApprovedRules(home, rules) {
 }
 /** Structured rule matching (review fix: raw string prefix was exploitable -
  *  `node scripts/` prefix was hit by `node scripts/../../evil.js`). Now:
- *  parses the rule as structured args, string values match by prefix BUT the
- *  extension is checked for path traversal (`..` at the boundary blocks). */
+ *  parses the rule as structured args, string values match by prefix AND no
+ *  path SEGMENT of the extension may be `..` (a boundary-only check missed
+ *  `node scripts/sub/../../evil.js`, whose first differing segment is `sub`). */
 export function matchesRule(rules, toolName, args) {
     return rules.some((r) => {
         if (r.tool !== toolName)
@@ -170,9 +171,7 @@ export function matchesRule(rules, toolName, args) {
                 if (typeof rv === 'string' && typeof av === 'string') {
                     if (!av.startsWith(rv))
                         return false;
-                    // path traversal: the extension after the approved prefix must not
-                    // start with `..` (blocks `node scripts/` → `node scripts/../../x`)
-                    if (av.slice(rv.length).startsWith('..'))
+                    if (av.slice(rv.length).split(/[\\/]+/).includes('..'))
                         return false;
                 }
                 else if (rv !== av) {

package/dist/tools.d.ts

@@ -2,10 +2,13 @@ import { type Tool } from '@hmharness/kernel';
 export declare const readFileTool: Tool;
 export declare const writeFileTool: Tool;
 /** Surgical search-replace tool (adopted from Codex's apply_patch philosophy).
- *  Safer than write_file for targeted edits: only changes the declared fragment,
- *  refuses to run when old_string is not unique (prevents silent wrong-location
- *  edits), and does NOT need approval - the blast radius is bounded to the
- *  declared substring. The model must read the file first to know what to replace. */
+ *  Safer than write_file for targeted edits: only changes the declared fragment
+ *  and refuses to run when old_string is not unique. Approval follows the
+ *  Codex workspace-write tier model: inside the working directory an edit is
+ *  the agent's normal job (no card per edit); anything that resolves into
+ *  HMH_HOME is ALWAYS gated - config.json/workspaces.json/approved-rules.json
+ *  live there, and an ungated edit to them could rewrite approval policy
+ *  itself (e.g. approval:'auto', trusted MCP) and disarm every other gate. */
 export declare const editFileTool: Tool;
 export declare const listDirTool: Tool;
 /** Host-shell pipe preflight: on Windows cmd, Unix-isms fail with cryptic

package/dist/tools.js

@@ -8,7 +8,7 @@ import { exec } from 'node:child_process';
 import { copyFile, readFile, readdir, writeFile } from 'node:fs/promises';
 import { isAbsolute, join, resolve } from 'node:path';
 import { promisify } from 'node:util';
-import { chatVision, homeDir, isVisionRefusal, loadConfig, visionProviderChain } from '@hmharness/kernel';
+import { chatVision, homeDir, isBareProbe, isVisionRefusal, loadConfig, visionProviderChain } from '@hmharness/kernel';
 const execCb = promisify(exec);
 const DENY_PATTERNS = [
     // recursive deletes aimed at ROOT/HOME/SYSTEM targets only - relative
@@ -74,10 +74,13 @@ export const writeFileTool = {
     },
 };
 /** Surgical search-replace tool (adopted from Codex's apply_patch philosophy).
- *  Safer than write_file for targeted edits: only changes the declared fragment,
- *  refuses to run when old_string is not unique (prevents silent wrong-location
- *  edits), and does NOT need approval - the blast radius is bounded to the
- *  declared substring. The model must read the file first to know what to replace. */
+ *  Safer than write_file for targeted edits: only changes the declared fragment
+ *  and refuses to run when old_string is not unique. Approval follows the
+ *  Codex workspace-write tier model: inside the working directory an edit is
+ *  the agent's normal job (no card per edit); anything that resolves into
+ *  HMH_HOME is ALWAYS gated - config.json/workspaces.json/approved-rules.json
+ *  live there, and an ungated edit to them could rewrite approval policy
+ *  itself (e.g. approval:'auto', trusted MCP) and disarm every other gate. */
 export const editFileTool = {
     name: 'edit_file',
     description: 'Surgical search-replace edit. Provide old_string (must appear exactly once in the file) and new_string to replace it. Prefer this over write_file for changes to existing files. old_string must be unique - if it appears more than once, the edit is refused (make it more specific).',
@@ -85,11 +88,25 @@ export const editFileTool = {
         type: 'object',
         properties: {
             path: { type: 'string', description: 'file path' },
-            old_string: { type: 'string', description: 'the exact string to find and replace (must appear exactly once in the file)' },
+            old_string: { type: 'string', description: 'the exact string to find and replace (must appear exactly once)' },
             new_string: { type: 'string', description: 'the replacement string' },
         },
         required: ['path', 'old_string', 'new_string'],
     },
+    needsApproval(args, ctx) {
+        if (!ctx)
+            return true; // no context to bound the blast radius - gate it
+        const p = safePath(String(args.path ?? ''), ctx.cwd).replace(/\\/g, '/').toLowerCase();
+        const under = (base) => {
+            const b = base.replace(/\\/g, '/').toLowerCase();
+            return p === b || p.startsWith(b + '/');
+        };
+        if (under(ctx.home))
+            return true; // the agent's own state: always a card
+        if (under(ctx.cwd))
+            return false; // workspace-write: silent within cwd
+        return true; // outside the workspace: a card
+    },
     async execute(args, ctx) {
         try {
             const p = safePath(String(args.path), ctx.cwd);
@@ -523,11 +540,12 @@ export const sshRunTool = {
         required: ['host', 'command'],
     },
     needsApproval(args) {
-        const cmd = String(args.command ?? '');
-        // read-only probe allowlist - no destructive verbs, no pipes into writes
-        const probe = /^(ls|cat|head|tail|df|du|free|uptime|whoami|hostname|uname|systemctl (status|list-units)|ps|grep|find|wc|date|echo|id|ip |ifconfig|nmap --version)/.test(cmd);
-        const writes = /rm|mv|dd|mkfs|reboot|shutdown|kill|pkill|systemctl (start|stop|restart|enable|disable)|apt|yum|docker (rm|rmi|prune)|truncate|>||/i;
-        return !(probe && !writes);
+        // shared fast path (kernel shellgate): a BARE read-only probe runs without
+        // the card; everything else - substitution, redirects, find -exec,
+        // date -s, unknown verbs - asks. The old local regex ended in an empty
+        // alternation (`|>||`) which matched the empty string, so EVERY command
+        // tripped the card and the documented probe fast path was dead code.
+        return !isBareProbe(String(args.command ?? ''));
     },
     async execute(args) {
         const cfg = await loadConfig();
@@ -641,4 +659,7 @@ export const seeImageTool = {
         };
     },
 };
-export const baseTools = [readFileTool, editFileTool, writeFileTool, listDirTool, runCommandTool, rememberTool, seeImageTool];
+export const baseTools = [
+    readFileTool, editFileTool, writeFileTool, listDirTool, runCommandTool, rememberTool, seeImageTool,
+    webSearchTool, webFetchTool, browserOpenTool, desktopScreenshotTool, desktopClickTool, desktopTypeTool, sshRunTool,
+];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hmharness/agent",
-  "version": "0.6.6",
+  "version": "0.6.7",
   "description": "hmharness agent execution layer: base tools, system prompt, sub-agent spawn, and the shared task runner that frontends (cli, web) drive.",
   "type": "module",
   "main": "dist/index.js",
@@ -15,10 +15,10 @@
     "build": "tsc -p tsconfig.build.json"
   },
   "dependencies": {
-    "@hmharness/kernel": "0.6.6",
-    "@hmharness/evolution": "0.6.6",
-    "@hmharness/domain-harmony": "0.6.6",
-    "@hmharness/domain-ops": "0.6.6"
+    "@hmharness/kernel": "0.6.7",
+    "@hmharness/evolution": "0.6.7",
+    "@hmharness/domain-harmony": "0.6.7",
+    "@hmharness/domain-ops": "0.6.7"
   },
   "files": [
     "dist"