@kevin5251984/guild 0.2.18 → 0.2.20

package/src/harness.ts

@@ -156,16 +156,25 @@ export function gateTool(
   if (sandbox === "full_access") return null;
 
   if (sandbox === "read_only") {
-    if (name === "read" || name === "list" || name === "skill") return null;
+    if (
+      name === "read" ||
+      name === "list" ||
+      name === "skill" ||
+      name === "spawn" ||
+      name === "read_spawn"
+    ) {
+      return null;
+    }
     return {
       text: `sandbox=read_only refused ${name}`,
       isError: true,
     };
   }
 
+  // No explicit workspace means the guild checkout, never all of $HOME.
   const workspace = input.workspace?.trim()
     ? resolveToolPath(input.workspace)
-    : HOME;
+    : defaultWorkspace();
 
   if (name.startsWith("mcp__")) {
     return {
@@ -174,7 +183,24 @@ export function gateTool(
     };
   }
 
-  if (name === "read" || name === "list" || name === "skill" || name === "spawn") {
+  if (name === "read" || name === "list") {
+    const raw = typeof args.path === "string" ? args.path : "";
+    if (name === "list" && !raw.trim()) return null;
+    const target = resolveToolPath(raw, workspace);
+    if (!pathInsideWorkspace(target, workspace)) {
+      return {
+        text: `sandbox=workspace_write refused ${name} outside workspace: ${target}`,
+        isError: true,
+      };
+    }
+    return null;
+  }
+
+  if (
+    name === "skill" ||
+    name === "spawn" ||
+    name === "read_spawn"
+  ) {
     return null;
   }
 
@@ -210,7 +236,11 @@ export function gateTool(
     };
   }
 
-  return null;
+  // browser (CDP into the user's Chrome profile) and anything unnamed: refuse.
+  return {
+    text: `sandbox=workspace_write refused ${name}; use full_access`,
+    isError: true,
+  };
 }
 
 export type LoopCall = {
@@ -296,18 +326,17 @@ export async function runAgentLoop(input: {
       if (traces.length) return { text: emptyAfterTools, traces, thinking };
       return input.nullIfNoTraces ? null : { text: emptyAfterTools, traces, thinking };
     }
-    const outcomes: ToolOutcome[] = [];
-    for (const call of asked.calls) {
-      outcomes.push(
-        await executeToolTraced(
+    const outcomes = await Promise.all(
+      asked.calls.map((call) =>
+        executeToolTraced(
           call.name,
           call.args,
           input.toolCtx,
           traces,
           thinking,
         ),
-      );
-    }
+      ),
+    );
     input.onTools?.(asked.calls, outcomes);
   }
 }

package/src/host-browse.ts

@@ -3,10 +3,11 @@ import {
   existsSync,
   readdirSync,
   readFileSync,
+  realpathSync,
   statSync,
 } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join, resolve } from "node:path";
+import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { promisify } from "node:util";
 import { StoreError } from "./store.ts";
 
@@ -31,6 +32,117 @@ function resolveUserPath(input: string): string {
   return resolve(HOME, trimmed);
 }
 
+/** Guild data dirs: `~/.guild` plus an explicit `GUILD_HOME` if set. */
+function guildHomes(): string[] {
+  const homes = [join(HOME, ".guild")];
+  const extra = process.env.GUILD_HOME?.trim();
+  if (extra) homes.push(resolveUserPath(extra));
+  return homes;
+}
+
+const SSH_DIR = join(HOME, ".ssh");
+/** Files whose *contents* are credentials, wherever the guild home lives. */
+const SECRET_GUILD_FILES = new Set(["oauth.json", "models.json", "mcp.json"]);
+/** Credential dotfiles that live directly in `$HOME`. */
+const SECRET_HOME_FILES = new Set([
+  ".claude.json",
+  ".netrc",
+  "_netrc",
+  ".npmrc",
+  ".yarnrc.yml",
+  ".git-credentials",
+  ".env",
+  ".env.local",
+  ".env.production",
+  ".pgpass",
+  ".pypirc",
+  ".my.cnf",
+  "credentials.json",
+]);
+/** `$HOME` folders that are credential stores: the folder and everything below. */
+const SECRET_HOME_DIRS = [
+  ".aws",
+  ".docker",
+  ".gnupg",
+  ".claude",
+  ".codex",
+  ".cursor",
+  ".kube",
+  ".azure",
+  join(".config", "gcloud"),
+  join(".config", "gh"),
+  join("Library", "Keychains"),
+].map((relative) => join(HOME, relative));
+const SSH_KEY_NAME = /^(id_rsa|id_dsa|id_ecdsa|id_ed25519|id_xmss)$/i;
+const SECRET_SUFFIXES = [
+  ".pem",
+  ".p12",
+  ".pfx",
+  ".key",
+  ".p8",
+  ".jks",
+  ".keystore",
+];
+
+function under(path: string, dir: string): boolean {
+  const prefix = dir.endsWith(sep) ? dir : `${dir}${sep}`;
+  return path === dir || path.startsWith(prefix);
+}
+
+/** Longest existing ancestor resolved through symlinks, tail re-joined. */
+function canonicalPath(target: string): string {
+  let abs = resolve(target);
+  const tail: string[] = [];
+  for (;;) {
+    try {
+      const real = realpathSync(abs);
+      return tail.length ? resolve(real, ...tail) : real;
+    } catch {
+      const parent = dirname(abs);
+      if (parent === abs) return tail.length ? resolve(abs, ...tail) : abs;
+      tail.unshift(basename(abs));
+      abs = parent;
+    }
+  }
+}
+
+function isSecretPath(abs: string): boolean {
+  const name = basename(abs);
+  const lower = name.toLowerCase();
+  const publicKey = lower.endsWith(".pub");
+  for (const home of guildHomes()) {
+    if (under(abs, join(home, "browser-profile"))) return true;
+    if (under(abs, home) && SECRET_GUILD_FILES.has(lower)) return true;
+  }
+  if (dirname(abs) === HOME && SECRET_HOME_FILES.has(lower)) return true;
+  if (name === ".env" || name.startsWith(".env.")) return true;
+  if (lower === "credentials.json" || lower === "service-account.json") {
+    return true;
+  }
+  if (SECRET_HOME_DIRS.some((dir) => under(abs, dir))) return true;
+  if (under(abs, SSH_DIR) && abs !== SSH_DIR && !publicKey) return true;
+  if (SSH_KEY_NAME.test(name)) return true;
+  if (!publicKey && SECRET_SUFFIXES.some((suffix) => lower.endsWith(suffix))) {
+    return true;
+  }
+  return false;
+}
+
+/**
+ * The attach picker browses `$HOME` on purpose, so /host/* is not confined to a
+ * workspace. Secrets still have to stay shut: OAuth tokens, model keys, the MCP
+ * store, the cloned browser profile, private keys, and the usual credential
+ * dotfiles / folders (`.aws`, `.claude`, `.codex`, `.npmrc`, `.netrc`, …).
+ * This is a denylist over the picker, not a chroot: non-secret `$HOME` and
+ * system files such as `/etc/passwd` stay readable.
+ */
+export function assertHostPathAllowed(target: string): void {
+  const abs = isAbsolute(target) ? resolve(target) : resolveUserPath(target);
+  if (isSecretPath(canonicalPath(abs))) {
+    throw new StoreError(403, "host path refused");
+  }
+}
+
 function parentOf(path: string): string | null {
   const parent = dirname(path);
   if (parent === path) return null;
@@ -52,6 +164,7 @@ export function hostList(rawPath: string): {
 } {
   try {
     const target = resolveUserPath(rawPath);
+    assertHostPathAllowed(target);
     const st = statSync(target);
     if (!st.isDirectory()) throw new StoreError(400, "not a directory");
     const entries = readdirSync(target, { withFileTypes: true })
@@ -94,6 +207,7 @@ export function hostRead(rawPath: string): {
 } {
   try {
     const target = resolveUserPath(rawPath);
+    assertHostPathAllowed(target);
     const st = statSync(target);
     if (!st.isFile()) throw new StoreError(400, "not a file");
     const raw = readFileSync(target);
@@ -146,6 +260,7 @@ function walkTree(
 export function hostTree(rawPath: string): { path: string; text: string } {
   try {
     const target = resolveUserPath(rawPath);
+    assertHostPathAllowed(target);
     const st = statSync(target);
     if (!st.isDirectory()) throw new StoreError(400, "not a directory");
     const lines = [target];
@@ -158,6 +273,25 @@ export function hostTree(rawPath: string): { path: string; text: string } {
   }
 }
 
+/**
+ * Git runs inside the user's tree: ignore their global/system config (hooks,
+ * fsmonitor, credential helpers) and never prompt on a TTY-less daemon.
+ */
+const GIT_GUARD = [
+  "-c",
+  "core.fsmonitor=false",
+  "-c",
+  "core.untrackedCache=false",
+  "--no-optional-locks",
+] as const;
+
+const GIT_ENV: NodeJS.ProcessEnv = {
+  ...process.env,
+  GIT_CONFIG_GLOBAL: "/dev/null",
+  GIT_CONFIG_NOSYSTEM: "1",
+  GIT_TERMINAL_PROMPT: "0",
+};
+
 function findGitRoot(start: string): string | null {
   let dir = start;
   for (let i = 0; i < 12; i += 1) {
@@ -176,14 +310,25 @@ export async function hostGit(rawPath: string): Promise<{
 }> {
   try {
     const start = resolveUserPath(rawPath);
+    assertHostPathAllowed(start);
     const base = statSync(start).isDirectory() ? start : dirname(start);
     const root = findGitRoot(base);
     if (!root) throw new StoreError(404, "not a git repository");
-    const opts = { cwd: root, timeout: 8_000, maxBuffer: GIT_CAP * 2 };
-    const status = await execFileAsync("git", ["status", "-sb"], opts);
+    assertHostPathAllowed(root);
+    const opts = {
+      cwd: root,
+      timeout: 8_000,
+      maxBuffer: GIT_CAP * 2,
+      env: GIT_ENV,
+    };
+    const status = await execFileAsync("git", [...GIT_GUARD, "status", "-sb"], opts);
     let diff = "";
     try {
-      const out = await execFileAsync("git", ["diff", "--stat", "HEAD"], opts);
+      const out = await execFileAsync(
+        "git",
+        [...GIT_GUARD, "diff", "--stat", "HEAD"],
+        opts,
+      );
       diff = String(out.stdout || "");
     } catch {
       diff = "";

package/src/image-gen.ts

@@ -218,7 +218,7 @@ export async function generateImage(input: {
   aspectRatio?: string;
   dataDir?: string;
   env?: NodeJS.ProcessEnv;
-}): Promise<{ text: string; isError: boolean }> {
+}): Promise<{ text: string; isError: boolean; publicPath?: string }> {
   const prompt = String(input.prompt || "").trim();
   if (!prompt) return { text: "prompt is required", isError: true };
   const aspect = String(input.aspectRatio || "").trim();
@@ -252,6 +252,7 @@ export async function generateImage(input: {
             `markdown: ![${prompt.slice(0, 80)}](${saved.publicPath})`,
           ].join("\n"),
           isError: false,
+          publicPath: saved.publicPath,
         };
       }
       errors.push(`${route.model} @ ${route.url}: ${hit.error}`);