@kortix/agent-tunnel 0.13.50 → 0.13.52

package/README.md

@@ -169,6 +169,12 @@ The local config is the maximum boundary. The server cannot widen configured
 filesystem paths, blocked paths, shell commands, timeouts, file sizes, or desktop
 features.
 
+A `shell` grant is local code execution. The allow list matches the executable
+name exactly and the block list also matches every path ending in that name
+(`/bin/rm` is `rm`). Arguments are not restricted: an allowed `git`, `find`, or
+`python` can run any code through its own flags. Grant `shell` only to a session
+you trust with this computer.
+
 ## Computer Use driver
 
 Agent Tunnel never downloads or executes a desktop driver. Install `cua-driver`

package/dist/agent-cli.js

@@ -19,15 +19,13 @@ var __toESM = (mod, isNodeMode, target) => {
       return cached;
   }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
-  const to = isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
-  if (mod && typeof mod === "object" || typeof mod === "function") {
-    for (let key of __getOwnPropNames(mod))
-      if (!__hasOwnProp.call(to, key))
-        __defProp(to, key, {
-          get: __accessProp.bind(mod, key),
-          enumerable: true
-        });
-  }
+  const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
+  for (let key of __getOwnPropNames(mod))
+    if (!__hasOwnProp.call(to, key))
+      __defProp(to, key, {
+        get: __accessProp.bind(mod, key),
+        enumerable: true
+      });
   if (canCache)
     cache.set(mod, to);
   return to;
@@ -46,21 +44,11 @@ var __export = (target, all) => {
       set: __exportSetter.bind(all, name)
     });
 };
-var __esm = (fn, res, err) => () => {
-  if (fn)
-    try {
-      res = fn(fn = 0);
-    } catch (e) {
-      err = [e];
-    }
-  if (err)
-    throw err[0];
-  return res;
-};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // ../../node_modules/.pnpm/ws@8.21.3/node_modules/ws/lib/constants.js
-var require_constants = __commonJS(function(exports, module) {
+var require_constants = __commonJS((exports, module) => {
   var BINARY_TYPES = ["nodebuffer", "arraybuffer", "fragments"];
   var hasBlob = typeof Blob !== "undefined";
   if (hasBlob)
@@ -80,7 +68,7 @@ var require_constants = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.pnpm/ws@8.21.3/node_modules/ws/lib/buffer-util.js
-var require_buffer_util = __commonJS(function(exports, module) {
+var require_buffer_util = __commonJS((exports, module) => {
   var { EMPTY_BUFFER } = require_constants();
   var FastBuffer = Buffer[Symbol.species];
   function concat(list, totalLength) {
@@ -141,11 +129,11 @@ var require_buffer_util = __commonJS(function(exports, module) {
   if (!process.env.WS_NO_BUFFER_UTIL) {
     try {
       const bufferUtil = (()=>{throw new Error("Cannot require module "+"bufferutil");})();
-      module.exports.mask = function(source, mask2, output, offset, length) {
+      module.exports.mask = function(source, mask, output, offset, length) {
         if (length < 48)
-          _mask(source, mask2, output, offset, length);
+          _mask(source, mask, output, offset, length);
         else
-          bufferUtil.mask(source, mask2, output, offset, length);
+          bufferUtil.mask(source, mask, output, offset, length);
       };
       module.exports.unmask = function(buffer, mask) {
         if (buffer.length < 32)
@@ -158,7 +146,7 @@ var require_buffer_util = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.pnpm/ws@8.21.3/node_modules/ws/lib/limiter.js
-var require_limiter = __commonJS(function(exports, module) {
+var require_limiter = __commonJS((exports, module) => {
   var kDone = Symbol("kDone");
   var kRun = Symbol("kRun");
 
@@ -190,7 +178,7 @@ var require_limiter = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.pnpm/ws@8.21.3/node_modules/ws/lib/permessage-deflate.js
-var require_permessage_deflate = __commonJS(function(exports, module) {
+var require_permessage_deflate = __commonJS((exports, module) => {
   var zlib = __require("zlib");
   var bufferUtil = require_buffer_util();
   var Limiter = require_limiter();
@@ -378,7 +366,7 @@ var require_permessage_deflate = __commonJS(function(exports, module) {
           callback(err);
           return;
         }
-        const data = bufferUtil.concat(this._inflate[kBuffers], this._inflate[kTotalLength]);
+        const data2 = bufferUtil.concat(this._inflate[kBuffers], this._inflate[kTotalLength]);
         if (this._inflate._readableState.endEmitted) {
           this._inflate.close();
           this._inflate = null;
@@ -389,7 +377,7 @@ var require_permessage_deflate = __commonJS(function(exports, module) {
             this._inflate.reset();
           }
         }
-        callback(null, data);
+        callback(null, data2);
       });
     }
     _compress(data, fin, callback) {
@@ -411,9 +399,9 @@ var require_permessage_deflate = __commonJS(function(exports, module) {
         if (!this._deflate) {
           return;
         }
-        let data = bufferUtil.concat(this._deflate[kBuffers], this._deflate[kTotalLength]);
+        let data2 = bufferUtil.concat(this._deflate[kBuffers], this._deflate[kTotalLength]);
         if (fin) {
-          data = new FastBuffer(data.buffer, data.byteOffset, data.length - 4);
+          data2 = new FastBuffer(data2.buffer, data2.byteOffset, data2.length - 4);
         }
         this._deflate[kCallback] = null;
         this._deflate[kTotalLength] = 0;
@@ -421,7 +409,7 @@ var require_permessage_deflate = __commonJS(function(exports, module) {
         if (fin && this.params[`${endpoint}_no_context_takeover`]) {
           this._deflate.reset();
         }
-        callback(null, data);
+        callback(null, data2);
       });
     }
   }
@@ -454,7 +442,7 @@ var require_permessage_deflate = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.pnpm/ws@8.21.3/node_modules/ws/lib/validation.js
-var require_validation = __commonJS(function(exports, module) {
+var require_validation = __commonJS((exports, module) => {
   var { isUtf8 } = __require("buffer");
   var { hasBlob } = require_constants();
   var tokenChars = [
@@ -641,7 +629,7 @@ var require_validation = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.pnpm/ws@8.21.3/node_modules/ws/lib/receiver.js
-var require_receiver = __commonJS(function(exports, module) {
+var require_receiver = __commonJS((exports, module) => {
   var { Writable } = __require("stream");
   var PerMessageDeflate = require_permessage_deflate();
   var {
@@ -1035,7 +1023,7 @@ var require_receiver = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.pnpm/ws@8.21.3/node_modules/ws/lib/sender.js
-var require_sender = __commonJS(function(exports, module) {
+var require_sender = __commonJS((exports, module) => {
   var { Duplex } = __require("stream");
   var { randomFillSync } = __require("crypto");
   var {
@@ -1394,7 +1382,7 @@ var require_sender = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.pnpm/ws@8.21.3/node_modules/ws/lib/event-target.js
-var require_event_target = __commonJS(function(exports, module) {
+var require_event_target = __commonJS((exports, module) => {
   var { kForOnEventAttribute, kListener } = require_constants();
   var kCode = Symbol("kCode");
   var kData = Symbol("kData");
@@ -1545,7 +1533,7 @@ var require_event_target = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.pnpm/ws@8.21.3/node_modules/ws/lib/extension.js
-var require_extension = __commonJS(function(exports, module) {
+var require_extension = __commonJS((exports, module) => {
   var { tokenChars } = require_validation();
   function push(dest, name, elem) {
     if (dest[name] === undefined)
@@ -1710,7 +1698,7 @@ var require_extension = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.pnpm/ws@8.21.3/node_modules/ws/lib/websocket.js
-var require_websocket = __commonJS(function(exports, module) {
+var require_websocket = __commonJS((exports, module) => {
   var EventEmitter = __require("events");
   var https = __require("https");
   var http = __require("http");
@@ -2133,7 +2121,7 @@ var require_websocket = __commonJS(function(exports, module) {
     }
     const defaultPort = isSecure ? 443 : 80;
     const key = randomBytes(16).toString("base64");
-    const request3 = isSecure ? https.request : http.request;
+    const request = isSecure ? https.request : http.request;
     const protocolSet = new Set;
     let perMessageDeflate;
     opts.createConnection = opts.createConnection || (isSecure ? tlsConnect : netConnect);
@@ -2192,8 +2180,8 @@ var require_websocket = __commonJS(function(exports, module) {
         const headers = options && options.headers;
         options = { ...options, headers: {} };
         if (headers) {
-          for (const [key, value] of Object.entries(headers)) {
-            options.headers[key.toLowerCase()] = value;
+          for (const [key2, value] of Object.entries(headers)) {
+            options.headers[key2.toLowerCase()] = value;
           }
         }
       } else if (websocket.listenerCount("redirect") === 0) {
@@ -2209,12 +2197,12 @@ var require_websocket = __commonJS(function(exports, module) {
       if (opts.auth && !options.headers.authorization) {
         options.headers.authorization = "Basic " + Buffer.from(opts.auth).toString("base64");
       }
-      req = websocket._req = request3(opts);
+      req = websocket._req = request(opts);
       if (websocket._redirects) {
         websocket.emit("redirect", websocket.url, req);
       }
     } else {
-      req = websocket._req = request3(opts);
+      req = websocket._req = request(opts);
     }
     if (opts.timeout) {
       req.on("timeout", () => {
@@ -2482,7 +2470,7 @@ var require_websocket = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.pnpm/ws@8.21.3/node_modules/ws/lib/stream.js
-var require_stream = __commonJS(function(exports, module) {
+var require_stream = __commonJS((exports, module) => {
   var WebSocket2 = require_websocket();
   var { Duplex } = __require("stream");
   function emitClose(stream) {
@@ -2532,9 +2520,9 @@ var require_stream = __commonJS(function(exports, module) {
         return;
       }
       let called = false;
-      ws.once("error", function error(err) {
+      ws.once("error", function error(err2) {
         called = true;
-        callback(err);
+        callback(err2);
       });
       ws.once("close", function close() {
         if (!called)
@@ -2585,7 +2573,7 @@ var require_stream = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.pnpm/ws@8.21.3/node_modules/ws/lib/subprotocol.js
-var require_subprotocol = __commonJS(function(exports, module) {
+var require_subprotocol = __commonJS((exports, module) => {
   var { tokenChars } = require_validation();
   function parse(header) {
     const protocols = new Set;
@@ -2606,11 +2594,11 @@ var require_subprotocol = __commonJS(function(exports, module) {
         }
         if (end === -1)
           end = i;
-        const protocol = header.slice(start, end);
-        if (protocols.has(protocol)) {
-          throw new SyntaxError(`The "${protocol}" subprotocol is duplicated`);
+        const protocol2 = header.slice(start, end);
+        if (protocols.has(protocol2)) {
+          throw new SyntaxError(`The "${protocol2}" subprotocol is duplicated`);
         }
-        protocols.add(protocol);
+        protocols.add(protocol2);
         start = end = -1;
       } else {
         throw new SyntaxError(`Unexpected character at index ${i}`);
@@ -2630,7 +2618,7 @@ var require_subprotocol = __commonJS(function(exports, module) {
 });
 
 // ../../node_modules/.pnpm/ws@8.21.3/node_modules/ws/lib/websocket-server.js
-var require_websocket_server = __commonJS(function(exports, module) {
+var require_websocket_server = __commonJS((exports, module) => {
   var EventEmitter = __require("events");
   var http = __require("http");
   var { Duplex } = __require("stream");
@@ -2942,8 +2930,15 @@ var require_websocket_server = __commonJS(function(exports, module) {
 // ../../node_modules/.pnpm/ws@8.21.3/node_modules/ws/wrapper.mjs
 var exports_wrapper = {};
 __export(exports_wrapper, {
+  subprotocol: () => import_subprotocol.default,
+  extension: () => import_extension.default,
+  default: () => wrapper_default,
+  createWebSocketStream: () => import_stream.default,
+  WebSocketServer: () => import_websocket_server.default,
   WebSocket: () => import_websocket.default,
-  default: () => wrapper_default
+  Sender: () => import_sender.default,
+  Receiver: () => import_receiver.default,
+  PerMessageDeflate: () => import_permessage_deflate.default
 });
 var import_stream, import_extension, import_permessage_deflate, import_receiver, import_sender, import_subprotocol, import_websocket, import_websocket_server, wrapper_default;
 var init_wrapper = __esm(() => {
@@ -2962,7 +2957,7 @@ var init_wrapper = __esm(() => {
 if (typeof globalThis.WebSocket === "undefined") {
   try {
     const ws = await Promise.resolve().then(() => (init_wrapper(), exports_wrapper));
-    const WebSocketImpl = ws.WebSocket ?? wrapper_default;
+    const WebSocketImpl = ws.WebSocket ?? ws.default;
     globalThis.WebSocket = WebSocketImpl;
   } catch {
     console.error('[agent-tunnel] WebSocket is not available. Install the "ws" package or use Node.js 22+.');
@@ -3928,7 +3923,7 @@ function visibleLength(value) {
 function clearScreen() {
   process.stdout.write("\x1B[2J\x1B[3J\x1B[H");
 }
-var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var sleep = (ms) => new Promise((resolve2) => setTimeout(resolve2, ms));
 var glyph = {
   on: `${c.green}●${c.reset}`,
   off: `${c.gray}○${c.reset}`,
@@ -4449,7 +4444,7 @@ class TunnelAgent {
     } catch {}
     const deadline = Date.now() + hold;
     while (Date.now() < deadline) {
-      await new Promise((resolve) => setTimeout(resolve, Math.min(100, hold / 4)));
+      await new Promise((resolve2) => setTimeout(resolve2, Math.min(100, hold / 4)));
       const decision = decideAccess(readAccess(this.home));
       if (decision === "ask")
         continue;
@@ -4747,7 +4742,7 @@ function hostBundleId() {
   }
 }
 function execFile(cmd, args, timeoutMs = 30000, env = driverEnvironment()) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     const proc = spawn4(cmd, args, {
       stdio: ["ignore", "pipe", "pipe"],
       env
@@ -4792,7 +4787,7 @@ function execFile(cmd, args, timeoutMs = 30000, env = driverEnvironment()) {
         const detail = stderr.trim() || stdout.trim();
         reject(new Error(`${cmd} failed (${code})${detail ? `: ${detail}` : ""}`));
       } else {
-        resolve({ stdout, stderr });
+        resolve2({ stdout, stderr });
       }
     });
     proc.on("error", (err) => {
@@ -4814,7 +4809,7 @@ function isDaemonProxyFallback(message) {
   return message.includes("daemon proxy") && message.includes("Resource temporarily unavailable");
 }
 async function sleep2(ms) {
-  await new Promise((resolve) => setTimeout(resolve, ms));
+  await new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 function sanitizeArgs(args) {
   const sanitized = {};
@@ -5395,7 +5390,8 @@ function validateCommand(command, allowedCommands, blockedCommands) {
     throw new Error(`Command contains disallowed characters: "${trimmed}"`);
   }
   const executable = trimmed;
-  if (blockedCommands.length > 0 && blockedCommands.includes(executable)) {
+  const name = executable.slice(executable.lastIndexOf("/") + 1);
+  if (blockedCommands.length > 0 && (blockedCommands.includes(executable) || blockedCommands.includes(name))) {
     throw new Error(`Command "${executable}" is blocked`);
   }
   if (allowedCommands.length > 0) {
@@ -5446,7 +5442,7 @@ function createShellCapability(config) {
         safeEnv[key] = process.env[key];
       }
     }
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve3, reject) => {
       const proc = spawn5(executable, args, {
         cwd,
         shell: false,
@@ -5489,7 +5485,7 @@ function createShellCapability(config) {
         reject(new Error(`Command failed to start: ${err.message}`));
       });
       proc.on("close", (code, signal) => {
-        resolve({
+        resolve3({
           exitCode: code,
           signal,
           stdout,
@@ -5578,12 +5574,12 @@ function clearSavedCredentials() {
 // src/agent/credential-probe.ts
 var DEFAULT_PROBE_TIMEOUT_MS = 1e4;
 function probeCredentials(config, options = {}) {
-  return new Promise((resolve) => {
+  return new Promise((resolve3) => {
     let socket;
     try {
       socket = new WebSocket(new URL(buildTunnelWsUrl(config)));
     } catch {
-      resolve("unreachable");
+      resolve3("unreachable");
       return;
     }
     const settle = (result) => {
@@ -5591,7 +5587,7 @@ function probeCredentials(config, options = {}) {
       try {
         socket.close(1000, "probe complete");
       } catch {}
-      resolve(result);
+      resolve3(result);
     };
     const timer = setTimeout(() => settle("unreachable"), options.timeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS);
     socket.addEventListener("open", () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kortix/agent-tunnel",
-  "version": "0.13.50",
+  "version": "0.13.52",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/kortix-ai/suna.git",

package/src/agent/security/command-validator.test.ts

@@ -0,0 +1,17 @@
+import { describe, expect, test } from 'bun:test';
+import { validateCommand } from './command-validator';
+
+describe('validateCommand blocked commands', () => {
+  test('a blocked name blocks its absolute and relative path spellings', () => {
+    for (const spelling of ['rm', '/bin/rm', '/usr/bin/rm', './rm']) {
+      expect(() => validateCommand(spelling, [], ['rm'])).toThrow(/is blocked/);
+    }
+  });
+  test('an unrelated command with the blocked name inside a directory still runs', () => {
+    expect(validateCommand('/opt/rm-tools/ls', [], ['rm'])).toBe('/opt/rm-tools/ls');
+  });
+  test('an allowlist stays an exact match', () => {
+    expect(() => validateCommand('/usr/bin/git', ['git'], [])).toThrow(/not in the allowed/);
+    expect(validateCommand('git', ['git'], [])).toBe('git');
+  });
+});

package/src/agent/security/command-validator.ts

@@ -17,7 +17,11 @@ export function validateCommand(
 
   const executable = trimmed;
 
-  if (blockedCommands.length > 0 && blockedCommands.includes(executable)) {
+  // A blocked name also blocks every path that ends in it: `/bin/rm` is `rm`.
+  // Arguments stay unrestricted: an allowed `git` or `python` runs code through
+  // its own flags, so a `shell` grant is local code execution, not a sandbox.
+  const name = executable.slice(executable.lastIndexOf('/') + 1);
+  if (blockedCommands.length > 0 && (blockedCommands.includes(executable) || blockedCommands.includes(name))) {
     throw new Error(`Command "${executable}" is blocked`);
   }