@integrity-labs/agt-cli 0.28.884 → 0.28.886

package/dist/bin/agt.js

@@ -40,12 +40,12 @@ import {
   success,
   table,
   warn
-} from "../chunk-5P4R3IPC.js";
+} from "../chunk-2E7GOSID.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
   readDirectChatSessionState
-} from "../chunk-YNYWVGHB.js";
+} from "../chunk-FP5M5OVX.js";
 import {
   AnchorSessionClient,
   CHANNEL_REGISTRY,
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.884" : "dev";
+var cliVersion = true ? "0.28.886" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6658,7 +6658,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.884" : "dev";
+var cliVersion2 = true ? "0.28.886" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-5P4R3IPC.js → chunk-2E7GOSID.js}

@@ -16,7 +16,7 @@ import {
   parseEnvIntegrations,
   shellQuote,
   summarizeUnanswerablePane
-} from "./chunk-YNYWVGHB.js";
+} from "./chunk-FP5M5OVX.js";
 import {
   BIND_FAILURE_QUARANTINE_THRESHOLD,
   INTEGRATIONS_SECTION_END,
@@ -3327,14 +3327,18 @@ function provisionStopHook(codeName) {
   writeFileSync4(settingsPath, JSON.stringify(settings, null, 2));
 }
 function provisionIsolationHook(codeName, agentId) {
+  const homeDir = getHomeDir();
+  const augmentedBase = join4(homeDir, ".augmented");
+  if (/["'$`\\\n]/.test(augmentedBase)) {
+    throw new Error(`provisionIsolationHook: home directory contains shell metacharacters: ${JSON.stringify(augmentedBase)}`);
+  }
   const projectDir = getProjectDir2(codeName);
   const claudeDir = join4(projectDir, ".claude");
   mkdirSync3(claudeDir, { recursive: true });
   const hasAgentId = agentId !== void 0;
   if (hasAgentId)
     assertValidAgentId(agentId);
-  const homeDir = getHomeDir();
-  const augmentedBase = join4(homeDir, ".augmented");
+  const augmentedBaseRe = augmentedBase.replace(/[.[\]()*+?{}|^$]/g, "\\$&");
   const ownAgentDir = getAgentDir(codeName);
   const logFile = join4(ownAgentDir, "isolation.log");
   const idAllowClause = hasAgentId ? ` && [ "$AGENT_DIR" != "${agentId}" ]` : "";
@@ -3355,82 +3359,154 @@ function provisionIsolationHook(codeName, agentId) {
     "#      disables it. Moving the file elsewhere does not help: a root process",
     "#      on a shared filesystem reaches wherever it is put.",
     "#",
-    "#   2. IT MATCHES RAW PRE-EXPANSION TEXT, and that fails in BOTH directions",
-    "#      depending on WHERE the expansion sits. The two cases are different and",
-    "#      worth keeping apart:",
-    "#",
-    "#      HIDDEN BASE -> under-blocks (the hole). If the expansion hides the base",
-    "#      path itself, the literal text this greps for never appears, the branch",
-    "#      exits 0, and the shell expands afterwards. Verified:",
-    "#          ~/.augmented/<other>/x       does not fire, proceeds",
-    "#          $HOME/.augmented/<other>/x   does not fire, proceeds",
-    "#      The platform's own CLAUDE.md documents working paths in tilde form, so",
-    "#      the spelling agents are taught is the spelling this cannot see.",
+    "#   2. THE BASH BRANCH READS PRE-EXPANSION TEXT. CS-1692 normalises the",
+    "#      spellings of a path that can be resolved from the text alone, so these",
+    "#      now resolve the same way as the literal absolute path and are refused:",
+    '#          ~/.augmented/<other>/x   $HOME/...   ${HOME}/...   "$HOME"/...',
+    "#          <base>//<other>/x   <home>/./.augmented/<other>/x",
+    '#          <base>/<self>/../<other>/x   "<base>"/<other>/x   <base>/oth\\er/x',
+    "#          <base>/<self>/a <base>/<other>/b    (every match is checked,",
+    "#                                               not just the first)",
+    "#          cd <base>/<other> && cat MEMORY.md  (a sibling DIRECTORY with no",
+    "#                                               trailing slash)",
+    "#      What text cannot tell it, it still cannot see. These are NOT closed:",
+    "#          cd <base> && cat <other>/x          (relative to a cd)",
+    "#          cat <symlink-into-other>/x          (symlinks)",
+    "#          cat /root/.augmented/$CN/x, $(...), ~user/, computed paths",
+    "#      And an unexpanded variable or glob as the agent segment is still",
+    "#      refused, because nothing here can know where it will point.",
     "#",
-    "#      EXPANSION AFTER THE BASE -> over-blocks (a false positive). The literal",
-    "#      base IS present, so the branch fires, takes the unexpanded token as the",
-    "#      agent segment, finds it in no allowlist, and refuses. Verified:",
-    "#          /root/.augmented/$CN/x       fires, AGENT_DIR=[$CN]    -> BLOCK",
-    "#          /root/.augmented/${VAR}/x    fires, AGENT_DIR=[${VAR}] -> BLOCK",
-    "#      This refuses commands that were going nowhere near another agent.",
+    "#      The Read/Edit/Write/Glob/Grep branch has a single path to judge, so it",
+    "#      canonicalises it (tilde, relative, dot segments, doubled slashes and",
+    "#      symlinks, via realpath -m) before deciding. Where realpath is missing",
+    "#      it falls back to the raw string, and is back to matching text.",
     "#",
-    "#   3. IT OVER-BLOCKS ON PUNCTUATION TOO. [^/]+ does not stop at a shell",
-    "#      metacharacter, so `ls /root/.augmented/<self> && echo hi` yields an",
-    "#      AGENT_DIR of `<self> && echo hi`, which matches no allowlist entry and",
-    "#      is refused. Agents have been blocked from their OWN directories this",
-    "#      way, repeatedly. Check isolation.log before reading an entry as an",
-    "#      attempted breach: most of them are not.",
+    "#   3. OVER-BLOCKING ON PUNCTUATION IS FIXED (CS-1691, in part). The agent",
+    "#      segment now stops at whitespace and shell metacharacters, so",
+    "#      `cd <base>/<self> && ls x 2>/dev/null` is no longer read as an agent",
+    "#      named `<self> && ls x 2>`. Check isolation.log before reading an entry",
+    "#      as an attempted breach all the same.",
     "#",
     "# Real isolation between co-located agents needs OS enforcement - a uid per",
     "# agent, a mount namespace, or a container per agent (ENG-4745, ENG-6633).",
     "# Do not treat a passing hook as evidence that separation exists.",
     "#",
-    "# Exit 0 = allow, Exit 2 = block (with stderr message shown to agent)",
+    "# Exit 0 = allow, Exit 2 = block (with stderr message shown to agent).",
+    "# Any other exit is a hook ERROR, which Claude Code does not treat as a block:",
+    "# every failure path below must end in 0 or 2, never fall out on set -e.",
     "set -euo pipefail",
     "INPUT=$(cat)",
     `TOOL=$(echo "$INPUT" | jq -r '.tool_name // empty')`,
     "",
     "# Only check file-access tools",
     'case "$TOOL" in',
-    "  Read|Edit|Write|Glob|Grep|MultiEdit) ;;",
-    "  Bash)",
-    "    # For Bash, we can't reliably parse arbitrary commands \u2014 rely on allowedDirectories.",
-    "    # But block obvious attempts to read other agent dirs.",
-    `    CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty')`,
-    `    if echo "$CMD" | grep -qE '${augmentedBase}/[^/]+/' 2>/dev/null; then`,
-    `      MATCH=$(echo "$CMD" | grep -oE '${augmentedBase}/[^/]+' | head -1)`,
-    `      AGENT_DIR=$(basename "$MATCH")`,
-    `      if [ "$AGENT_DIR" != "${codeName}" ]${idAllowClause} && [ "$AGENT_DIR" != "_mcp" ]; then`,
-    `        echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) BLOCKED bash targeting $MATCH" >> "${logFile}"`,
-    `        echo "Access denied: you cannot access other agents' directories." >&2`,
-    "        exit 2",
-    "      fi",
-    "    fi",
-    "    exit 0 ;;",
+    "  Read|Edit|Write|Glob|Grep|MultiEdit|Bash) ;;",
     "  *) exit 0 ;;",
     "esac",
     "",
-    "# Extract file_path from tool input",
-    `FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // .tool_input.path // empty')`,
-    '[ -z "$FILE_PATH" ] && exit 0',
+    `HOME_DIR="${homeDir}"`,
+    `AUGMENTED_BASE="${augmentedBase}"`,
+    `AUGMENTED_BASE_RE='${augmentedBaseRe}'`,
+    `LOG_FILE="${logFile}"`,
+    "# The directory this agent's codename actually resolves to. Under the",
+    "# id-keyed layout the codename is a symlink to the agent_id, and a legacy-",
+    "# provisioned hook has no agent_id baked in to recognise it by. Unlike the",
+    "# codename and agent_id above, this is read from the filesystem on every",
+    "# call: repoint the codename symlink and the allowlist moves with it. Fine",
+    "# for an accident-guard; not something to lean on as a boundary.",
+    `OWN_REAL=$(basename -- "$(realpath -m -- "$AUGMENTED_BASE/${codeName}" 2>/dev/null || printf '%s' "${codeName}")")`,
+    "",
+    "deny() {",
+    '  echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) BLOCKED $1" >> "$LOG_FILE" 2>/dev/null || true',
+    `  echo "Access denied: you cannot access other agents' directories." >&2`,
+    "  exit 2",
+    "}",
     "",
-    "# Resolve to absolute path",
-    'if [[ "$FILE_PATH" != /* ]]; then',
-    `  CWD=$(echo "$INPUT" | jq -r '.cwd // empty')`,
-    '  [ -n "$CWD" ] && FILE_PATH="$CWD/$FILE_PATH"',
+    "# An agent segment that will be expanded later: nothing here can know where",
+    "# it points, so it is treated as another agent.",
+    "has_expansion() {",
+    `  case "$1" in *'*'*|*'?'*|*'['*|*'{'*|*'$'*) return 0 ;; esac`,
+    "  return 1",
+    "}",
+    "",
+    'if [ "$TOOL" = "Bash" ]; then',
+    `  CMD=$(echo "$INPUT" | jq -r '.tool_input.command // empty')`,
+    "  # CS-1692: rewrite every spelling of a path that the TEXT can resolve into",
+    "  # the literal form, then judge that. Quotes and backslashes only split a",
+    "  # word, so they are dropped; home spellings become the home directory.",
+    "  NORM=$CMD",
+    '  NORM=${NORM//\\"/}',
+    "  NORM=${NORM//\\'/}",
+    "  NORM=${NORM//\\\\/}",
+    '  NORM=${NORM//\\$\\{HOME\\}/"$HOME_DIR"}',
+    '  NORM=${NORM//\\$HOME/"$HOME_DIR"}',
+    '  NORM=${NORM//\\~\\//"$HOME_DIR/"}',
+    "  # Doubled slashes, /./ and <segment>/.. collapse lexically. Each step only",
+    "  # ever shortens the string, so the loop terminates.",
+    "  DOTDOT_RE='/[^/[:space:]]+/\\.\\.(/|$)'",
+    "  PREV=",
+    '  while [ "$NORM" != "$PREV" ]; do',
+    "    PREV=$NORM",
+    "    NORM=${NORM//\\/\\//\\/}",
+    "    NORM=${NORM//\\/.\\//\\/}",
+    '    if [[ "$NORM" =~ $DOTDOT_RE ]]; then NORM=${NORM/"${BASH_REMATCH[0]}"/\\/}; fi',
+    "  done",
+    "  # EVERY occurrence is judged. The agent segment stops at whitespace and",
+    "  # shell metacharacters, so trailing redirects are not read as its name.",
+    '  OCC_RE="${AUGMENTED_BASE_RE}/[^/[:space:];&|<>()]+/?"',
+    `  OCCURRENCES=$(printf '%s\\n' "$NORM" | grep -oE "$OCC_RE" || true)`,
+    "  while IFS= read -r OCC; do",
+    '    [ -z "$OCC" ] && continue',
+    '    REST=${OCC#"$AUGMENTED_BASE"/}',
+    "    AGENT_DIR=${REST%/}",
+    '    case "$AGENT_DIR" in .|..) continue ;; esac',
+    `    if [ "$AGENT_DIR" != "${codeName}" ]${idAllowClause} && [ "$AGENT_DIR" != "$OWN_REAL" ] && [ "$AGENT_DIR" != "_mcp" ]; then`,
+    "      # Refuse a path INTO the segment, a segment that is a directory (an",
+    "      # agent dir named with no trailing slash), or one still to be expanded.",
+    "      # A plain file at the base, such as manager.log, is not an agent.",
+    '      if [ "$REST" != "$AGENT_DIR" ] || [ -d "$AUGMENTED_BASE/$AGENT_DIR" ] || has_expansion "$AGENT_DIR"; then',
+    '        deny "bash targeting $AUGMENTED_BASE/$AGENT_DIR"',
+    "      fi",
+    "    fi",
+    '  done <<< "$OCCURRENCES"',
+    "  exit 0",
     "fi",
     "",
-    "# Check if path targets another agent's directory",
-    `AUGMENTED_BASE="${augmentedBase}"`,
-    'case "$FILE_PATH" in',
-    '  "$AUGMENTED_BASE"/*/*)  ',
-    '    AGENT_DIR=$(echo "$FILE_PATH" | sed "s|$AUGMENTED_BASE/||" | cut -d/ -f1)',
-    `    if [ "$AGENT_DIR" != "${codeName}" ]${idAllowClause} && [ "$AGENT_DIR" != "_mcp" ]; then`,
-    `      echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) BLOCKED $TOOL on $FILE_PATH" >> "${logFile}"`,
-    `      echo "Access denied: you cannot access other agents' directories." >&2`,
-    "      exit 2",
-    "    fi ;;",
-    "esac",
+    `CWD=$(echo "$INPUT" | jq -r '.cwd // empty')`,
+    `CANON_BASE=$(realpath -m -- "$AUGMENTED_BASE" 2>/dev/null || printf '%s' "$AUGMENTED_BASE")`,
+    "",
+    "# check_path PATH [RELATIVE_TO]: canonicalise one tool path, then judge it.",
+    "check_path() {",
+    "  local P=$1",
+    "  local REL=${2:-$CWD}",
+    '  [ -z "$P" ] && return 0',
+    '  case "$P" in',
+    '    "~") P=$HOME_DIR ;;',
+    '    "~/"*) P="$HOME_DIR/${P#"~/"}" ;;',
+    "  esac",
+    '  if [[ "$P" != /* ]] && [ -n "$REL" ]; then P="$REL/$P"; fi',
+    `  P=$(realpath -m -- "$P" 2>/dev/null || printf '%s' "$P")`,
+    '  case "$P" in',
+    '    "$CANON_BASE"/?*)',
+    '      local REST=${P#"$CANON_BASE"/}',
+    "      local AGENT_DIR=${REST%%/*}",
+    `      if [ "$AGENT_DIR" != "${codeName}" ]${idAllowClause} && [ "$AGENT_DIR" != "$OWN_REAL" ] && [ "$AGENT_DIR" != "_mcp" ]; then`,
+    '        if [ "$REST" != "$AGENT_DIR" ] || [ -d "$CANON_BASE/$AGENT_DIR" ] || has_expansion "$AGENT_DIR"; then',
+    '          deny "$TOOL on $P"',
+    "        fi",
+    "      fi ;;",
+    "  esac",
+    "  return 0",
+    "}",
+    "",
+    `TOOL_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // .tool_input.path // empty')`,
+    'check_path "$TOOL_PATH"',
+    "# Glob also takes the path in its pattern. Grep's pattern is a regex, not a",
+    "# path, so it is deliberately not judged.",
+    'if [ "$TOOL" = "Glob" ]; then',
+    `  PATTERN=$(echo "$INPUT" | jq -r '.tool_input.pattern // empty')`,
+    '  check_path "$PATTERN" "${TOOL_PATH:-$CWD}"',
+    "fi",
     "",
     "exit 0"
   ].join("\n") + "\n";
@@ -6765,7 +6841,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.884" : "dev";
+var agtCliVersion = true ? "0.28.886" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -11375,4 +11451,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-5P4R3IPC.js.map
+//# sourceMappingURL=chunk-2E7GOSID.js.map