@hunterzhu/pulse-adapters 0.1.11 → 0.2.0

package/dist/tools/shell.js

@@ -1,51 +1,201 @@
+import { createRequire } from 'node:module';
+import { randomUUID } from 'node:crypto';
+import { homedir } from 'node:os';
+import { dirname, parse, resolve, sep } from 'node:path';
+import { realpath } from 'node:fs/promises';
 import { spawn } from 'node:child_process';
+import { SandboxManager, VENDORED_SRT_WIN_EXE } from '@anthropic-ai/sandbox-runtime';
 function shellError(code, retryable = false, cause) {
     return Object.assign(new Error(code), { code, retryable, ...(cause === undefined ? {} : { cause }) });
 }
+// SandboxManager owns process-global proxy and policy state. A per-invocation
+// policy is installed for exactly one child at a time to avoid one concurrent
+// call widening another call's filesystem grants.
+let sandboxTail = Promise.resolve();
+function withSandboxLease(work) {
+    const result = sandboxTail.then(work, work);
+    sandboxTail = result.then(() => undefined, () => undefined);
+    return result;
+}
+function quotePosix(value) {
+    return `'${value.replaceAll("'", "'\\''")}'`;
+}
+export function quoteWindowsArgument(value) {
+    if (value.length > 0 && !/[\s"]/u.test(value))
+        return value;
+    let output = '"';
+    let slashes = 0;
+    for (const character of value) {
+        if (character === '\\') {
+            slashes++;
+            continue;
+        }
+        if (character === '"')
+            output += '\\'.repeat(slashes * 2 + 1) + '"';
+        else
+            output += '\\'.repeat(slashes) + character;
+        slashes = 0;
+    }
+    return output + '\\'.repeat(slashes * 2) + '"';
+}
+const powershellArgvRunner = String.raw `
+$ErrorActionPreference = 'Stop'
+[Console]::OutputEncoding = [System.Text.UTF8Encoding]::new($false)
+$payload = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('__PULSE_ARGV_JSON__'))
+$spec = ConvertFrom-Json -InputObject $payload
+$psi = [System.Diagnostics.ProcessStartInfo]::new()
+$psi.FileName = [string]$spec.command
+$psi.Arguments = [string]$spec.arguments
+$psi.UseShellExecute = $false
+$psi.CreateNoWindow = $true
+$psi.RedirectStandardOutput = $true
+$psi.RedirectStandardError = $true
+$psi.RedirectStandardInput = $true
+$psi.StandardOutputEncoding = [System.Text.Encoding]::UTF8
+$psi.StandardErrorEncoding = [System.Text.Encoding]::UTF8
+$child = [System.Diagnostics.Process]::new()
+$child.StartInfo = $psi
+try { if (-not $child.Start()) { exit 127 } }
+catch {
+  $cause = $_.Exception
+  while ($cause.InnerException) { $cause = $cause.InnerException }
+  [Console]::Error.WriteLine($cause.Message)
+  if ($cause -is [System.ComponentModel.Win32Exception] -and $cause.NativeErrorCode -in 2,3) { exit 127 }
+  exit 126
+}
+$outTask = $child.StandardOutput.ReadToEndAsync()
+$errTask = $child.StandardError.ReadToEndAsync()
+$inTask = [Console]::OpenStandardInput().CopyToAsync($child.StandardInput.BaseStream)
+[void]$inTask.GetAwaiter().GetResult()
+$child.StandardInput.Close()
+$child.WaitForExit()
+try { [Console]::Out.Write([string]$outTask.GetAwaiter().GetResult()) } catch {}
+try { [Console]::Error.Write([string]$errTask.GetAwaiter().GetResult()) } catch {}
+exit $child.ExitCode
+`.trim();
+/** Build the command text expected by srt without interpreting model argv as shell syntax. */
+export function encodeSandboxCommand(command, args, platform = process.platform) {
+    if ([command, ...args].some((value) => value.includes('\0')))
+        throw shellError('INVALID_SHELL_ARGUMENT');
+    if (platform === 'win32') {
+        // The only bytes placed in cmd.exe's command string are fixed tokens and
+        // base64. PowerShell decodes JSON and ProcessStartInfo.Arguments uses a
+        // Windows CRT-compatible encoder, preserving argv without a shell parse.
+        const payload = Buffer.from(JSON.stringify({ command, arguments: args.map(quoteWindowsArgument).join(' ') }), 'utf8').toString('base64');
+        const encoded = Buffer.from(powershellArgvRunner.replace('__PULSE_ARGV_JSON__', payload), 'utf16le').toString('base64');
+        const commandText = `powershell.exe -NoLogo -NoProfile -NonInteractive -EncodedCommand ${encoded}`;
+        if (commandText.length > 24_000)
+            throw shellError('INVALID_SHELL_ARGUMENTS_TOO_LARGE');
+        return commandText;
+    }
+    return `exec ${[command, ...args].map(quotePosix).join(' ')}`;
+}
+async function sandboxConfig(cwd) {
+    // Linux invokes this trusted helper *inside* the read-restricted namespace.
+    // A user-local npm install otherwise hides it together with the home directory.
+    const seccompPath = process.platform === 'linux'
+        ? await realpath(resolve(dirname(createRequire(import.meta.url).resolve('@anthropic-ai/sandbox-runtime')), '..', 'vendor', 'seccomp', process.arch, 'apply-seccomp'))
+        : undefined;
+    const home = homedir();
+    const parent = dirname(cwd);
+    const root = parse(cwd).root;
+    if (cwd === root || cwd === home || home.startsWith(cwd + sep) || parent === root) {
+        throw shellError('SANDBOX_WORKSPACE_TOO_BROAD');
+    }
+    const denyRead = new Set([home]);
+    // Close the common sibling-workspace and temporary-directory escape: deny
+    // the workspace's immediate container, then re-open only this invocation's
+    // cwd. Root workspaces cannot be carved this way and are rejected upstream.
+    if (parent !== parse(cwd).root && parent !== cwd)
+        denyRead.add(parent);
+    // Reads default to the system toolchain plus this workspace. Writes are
+    // limited to the workspace; srt adds only its required stdio/temp paths.
+    return {
+        network: { allowedDomains: [], deniedDomains: [], strictAllowlist: true },
+        filesystem: {
+            denyRead: [...denyRead],
+            allowRead: [cwd, ...(seccompPath ? [seccompPath] : [])],
+            allowWrite: [cwd],
+            denyWrite: [],
+        },
+        ...(seccompPath ? { seccomp: { applyPath: seccompPath } } : {}),
+        ...(process.platform === 'win32' ? { windows: { srtWin: { path: VENDORED_SRT_WIN_EXE } } } : {}),
+    };
+}
+function cleanPath(value) {
+    return resolve(value);
+}
+export function decodeUtf8WithinByteLimit(value, maxBytes) {
+    if (!Number.isFinite(maxBytes) || maxBytes < 0)
+        throw shellError('INVALID_SHELL_OUTPUT_LIMIT');
+    const decoded = value.subarray(0, maxBytes).toString('utf8');
+    let used = 0;
+    const output = [];
+    for (const character of decoded) {
+        const bytes = Buffer.byteLength(character, 'utf8');
+        if (used + bytes > maxBytes)
+            break;
+        output.push(character);
+        used += bytes;
+    }
+    return output.join('');
+}
+function shellEnvironment(env) {
+    const source = env ?? process.env;
+    return Object.fromEntries(Object.entries(source).filter(([key]) => !/(API_KEY|TOKEN|SECRET|PASSWORD|PRIVATE_KEY|AUTHORIZATION|BEARER|CREDENTIAL|COOKIE)/i.test(key) && key !== 'NODE_OPTIONS'));
+}
 export function runShell(command, args = [], options = {}) {
     const max = options.maxOutputBytes ?? 256 * 1024;
     if (!Number.isFinite(max) || max < 0)
         return Promise.reject(shellError('INVALID_SHELL_OUTPUT_LIMIT'));
     if (options.timeoutMs !== undefined && (!Number.isFinite(options.timeoutMs) || options.timeoutMs < 0))
         return Promise.reject(shellError('INVALID_SHELL_TIMEOUT'));
-    return new Promise((resolve, reject) => {
-        const child = spawn(command, args, { cwd: options.cwd, env: options.env, shell: false, detached: process.platform !== 'win32', windowsHide: true });
-        let stdout = '';
-        let stderr = '';
-        let truncated = false;
-        const append = (target, chunk) => { const value = chunk.toString(); const current = target === 'stdout' ? stdout : stderr; const next = current + value; if (Buffer.byteLength(next) > max) {
-            truncated = true;
-            const limited = next.slice(0, max);
-            if (target === 'stdout')
-                stdout = limited;
-            else
-                stderr = limited;
+    if (!command || typeof command !== 'string' || !Array.isArray(args) || args.some((arg) => typeof arg !== 'string'))
+        return Promise.reject(shellError('INVALID_SHELL_ARGUMENT'));
+    try {
+        encodeSandboxCommand(command, args);
+    }
+    catch (error) {
+        return Promise.reject(error);
+    }
+    return withSandboxLease(async () => {
+        if (options.signal?.aborted)
+            return { code: null, stdout: '', stderr: '', truncated: false, timedOut: false, aborted: true };
+        let cwd;
+        try {
+            cwd = await realpath(cleanPath(options.cwd ?? process.cwd()));
         }
-        else if (target === 'stdout')
-            stdout = next;
-        else
-            stderr = next; };
+        catch (cause) {
+            throw shellError('INVALID_SHELL_CWD', false, cause);
+        }
+        const invocationId = randomUUID();
+        const policy = await sandboxConfig(cwd);
+        let child;
+        const outputChunks = { stdout: [], stderr: [] };
+        const outputBytes = { stdout: 0, stderr: 0 };
+        let truncated = false;
         let closed = false;
+        let termination;
+        let timer;
+        let killTimer;
         const signalProcessGroup = (signal) => {
-            if (process.platform !== 'win32' && child.pid) {
+            if (!child?.pid)
+                return;
+            if (process.platform !== 'win32') {
                 try {
                     process.kill(-child.pid, signal);
                     return;
                 }
                 catch { /* process group may already be gone */ }
             }
-            if (process.platform === 'win32' && child.pid) {
-                // child.kill() only terminates the direct process on Windows; kill the
-                // owned process tree so cancelled shell tools cannot leave descendants.
-                const tree = spawn('taskkill.exe', ['/PID', String(child.pid), '/T', '/F'], { stdio: 'ignore', windowsHide: true });
-                tree.once('error', () => child.kill(signal));
+            if (process.platform === 'win32') {
+                const tree = spawn('taskkill.exe', ['/PID', String(child.pid), '/T', '/F'], { stdio: 'ignore', windowsHide: true, env: shellEnvironment(options.env) });
+                tree.once('error', () => child?.kill(signal));
                 tree.unref();
                 return;
             }
             child.kill(signal);
         };
-        let termination;
-        let killTimer;
         const terminate = (reason) => {
             if (closed)
                 return;
@@ -55,27 +205,88 @@ export function runShell(command, args = [], options = {}) {
                 killTimer = setTimeout(() => { if (!closed)
                     signalProcessGroup('SIGKILL'); }, 250);
         };
-        const timer = options.timeoutMs && options.timeoutMs > 0 ? setTimeout(() => terminate('timeout'), options.timeoutMs) : undefined;
-        const abort = () => terminate('aborted');
-        if (options.signal) {
-            if (options.signal.aborted)
-                abort();
-            else
-                options.signal.addEventListener('abort', abort, { once: true });
+        const append = (target, chunk) => {
+            const remaining = Math.max(0, max - outputBytes[target]);
+            const kept = Math.min(chunk.byteLength, remaining);
+            if (kept > 0)
+                outputChunks[target].push(chunk.subarray(0, kept));
+            outputBytes[target] += kept;
+            if (kept < chunk.byteLength)
+                truncated = true;
+        };
+        const outputText = (target) => {
+            return decodeUtf8WithinByteLimit(Buffer.concat(outputChunks[target]), max);
+        };
+        try {
+            // reset first in case an earlier initialize failed part-way through.
+            await SandboxManager.reset();
+            await SandboxManager.initialize(policy, undefined, false);
+            const commandText = encodeSandboxCommand(command, args);
+            const descriptor = await SandboxManager.wrapWithSandboxArgv(commandText, undefined, undefined, options.signal, cwd, { commandId: invocationId, commandText: 'shell.exec' });
+            if (options.signal?.aborted) {
+                SandboxManager.cleanupAfterCommand();
+                await SandboxManager.reset();
+                return { code: null, stdout: '', stderr: '', truncated: false, timedOut: false, aborted: true };
+            }
+            child = spawn(descriptor.argv[0], descriptor.argv.slice(1), {
+                cwd,
+                env: shellEnvironment(options.env ?? descriptor.env),
+                shell: false,
+                detached: process.platform !== 'win32',
+                windowsHide: true,
+            });
+        }
+        catch (cause) {
+            try {
+                await SandboxManager.reset();
+            }
+            catch { /* preserve the setup failure */ }
+            throw shellError('SANDBOX_SETUP_FAILED', false, cause);
         }
-        child.stdout.on('data', (chunk) => append('stdout', chunk));
-        child.stderr.on('data', (chunk) => append('stderr', chunk));
-        child.on('error', (cause) => {
-            closed = true;
-            if (timer)
-                clearTimeout(timer);
-            if (killTimer)
-                clearTimeout(killTimer);
-            const code = cause && typeof cause === 'object' && typeof cause.code === 'string' ? String(cause.code) : 'SHELL_EXECUTION_ERROR';
-            reject(shellError(code === 'ENOENT' || code === 'EACCES' ? code : 'SHELL_EXECUTION_ERROR', false, cause));
+        // This API has no stdin payload; deliver EOF to readers inside the sandbox.
+        child.stdin?.end();
+        return await new Promise((resolve, reject) => {
+            const cleanup = () => {
+                if (timer)
+                    clearTimeout(timer);
+                if (killTimer)
+                    clearTimeout(killTimer);
+                options.signal?.removeEventListener('abort', abort);
+            };
+            const abort = () => terminate('aborted');
+            timer = options.timeoutMs && options.timeoutMs > 0 ? setTimeout(() => terminate('timeout'), options.timeoutMs) : undefined;
+            if (options.signal)
+                options.signal.addEventListener('abort', abort, { once: true });
+            if (options.signal?.aborted)
+                abort();
+            child.stdout?.on('data', (chunk) => append('stdout', chunk));
+            child.stderr?.on('data', (chunk) => append('stderr', chunk));
+            child.once('error', (cause) => {
+                closed = true;
+                cleanup();
+                const errorCode = cause && typeof cause === 'object' ? cause.code : undefined;
+                const code = typeof errorCode === 'string' ? errorCode : 'SHELL_EXECUTION_ERROR';
+                reject(shellError(code === 'ENOENT' || code === 'EACCES' ? code : 'SHELL_EXECUTION_ERROR', false, cause));
+            });
+            child.once('close', (code) => {
+                closed = true;
+                cleanup();
+                const stdout = outputText('stdout');
+                const stderr = outputText('stderr');
+                const annotated = SandboxManager.annotateStderrWithSandboxFailures(invocationId, stderr);
+                const boundedStderr = decodeUtf8WithinByteLimit(Buffer.from(annotated, 'utf8'), max);
+                const outputWasTruncated = truncated || Buffer.byteLength(annotated, 'utf8') > max;
+                resolve({ code, stdout, stderr: boundedStderr, truncated: outputWasTruncated, timedOut: termination === 'timeout', aborted: termination === 'aborted' });
+            });
+        }).finally(async () => {
+            try {
+                SandboxManager.cleanupAfterCommand();
+                await SandboxManager.reset();
+            }
+            catch (cause) {
+                // A teardown failure must be visible and fail closed for the next call.
+                throw shellError('SANDBOX_CLEANUP_FAILED', false, cause);
+            }
         });
-        child.on('close', (code) => { closed = true; if (timer)
-            clearTimeout(timer); if (killTimer)
-            clearTimeout(killTimer); resolve({ code, stdout, stderr, truncated, timedOut: termination === 'timeout', aborted: termination === 'aborted' }); });
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hunterzhu/pulse-adapters",
-  "version": "0.1.11",
+  "version": "0.2.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/zhuhengtan/Pulse"
@@ -16,7 +16,10 @@
     "registry": "https://registry.npmjs.org"
   },
   "dependencies": {
-    "@hunterzhu/pulse-runtime": "0.1.11",
-    "@hunterzhu/pulse-tool-sdk": "0.1.11"
+    "@anthropic-ai/sandbox-runtime": "0.0.77",
+    "@hunterzhu/pulse-runtime": "0.2.0",
+    "@hunterzhu/pulse-tool-sdk": "0.2.0",
+    "exceljs": "4.4.0",
+    "pdfjs-dist": "4.10.38"
   }
 }