@miphamai/cli 0.38.0 → 0.39.1

package/src/tools/exec/bash.ts

@@ -1,13 +1,9 @@
 import type { ToolDefinition, CredentialMaskingConfig } from '../../shared/index.ts'
 import { sanitizeCommand } from '../../shared/sanitize.ts'
 import { DANGEROUS_GIT_PATTERNS } from './git.ts'
-
-// Injected at startup — set via index.tsx
-let credentialConfig: CredentialMaskingConfig | undefined
-
-export function setCredentialMaskingConfigForBash(config: CredentialMaskingConfig): void {
-  credentialConfig = config
-}
+import type { Service } from '../../vajra'
+import { toolKey } from '../seam'
+import { withValidation } from '../validation'
 
 // ── Dangerous command patterns ──
 const BLOCKED_PATTERNS = [
@@ -15,6 +11,12 @@ const BLOCKED_PATTERNS = [
   /\brm\s+-rf\s+\/(\s|$)/,
   /\brm\s+-rf\s+\/\*\s*$/,
   /\bsudo\s+rm\s+.*\//,
+  // rm -rf on home directory or any absolute path (relative dirs like node_modules stay allowed)
+  /\brm\s+-(?:rf|fr)\s+~(?:$|\s|\/)/,
+  /\brm\s+-(?:rf|fr)\s+\/(?![\s*])/,
+  // rm -rf on dangerous cwd globs
+  /\brm\s+-(?:rf|fr)\s+\*\s*$/,
+  /\brm\s+-(?:rf|fr)\s+\.\s*$/,
   // Filesystem manipulation
   /\bmkfs\./,
   /\bdd\s+if=/,
@@ -125,14 +127,11 @@ export function isBlocked(command: string): string | null {
     return `Command "${sanitizedFirstWord}" rejected by security policy.`
   }
 
-  // Detect dangerous git operations invoked via Bash. The Git tool guards these,
-  // but shelling out with `git push --force` would bypass it — apply the same
-  // pattern list to any Bash command that starts with a git invocation.
-  const gitInvocation = normalized.trim().match(/^(?:sudo\s+)?git(?:\s+|$)(.*)$/i)
-  if (gitInvocation) {
-    const subcommand = gitInvocation[1] || ''
+  // Detect dangerous git operations invoked via Bash — anywhere in the command,
+  // so `echo ok && git push --force` is still caught (not just `^git`).
+  if (/(?:^|[\s;&|])(?:sudo\s+)?(?:git|gh)\s+/.test(normalized)) {
     for (const { pattern, description } of DANGEROUS_GIT_PATTERNS) {
-      if (pattern.test(subcommand)) {
+      if (pattern.test(normalized)) {
         return `Dangerous git command blocked: "${description}". Run manually if intended.`
       }
     }
@@ -298,136 +297,149 @@ function parseErrorLocations(stderr: string): ErrorLocation[] {
   return unique.slice(0, 10)
 }
 
-export const bashTool: ToolDefinition = {
-  name: 'Bash',
-  description:
-    'Execute a bash command. Returns stdout and stderr. Timeout: 120s. Use with caution.',
-  category: 'exec',
-  permission: 'ask',
-  parameters: {
-    type: 'object',
-    properties: {
-      command: { type: 'string', description: 'The bash command to execute' },
-      description: {
-        type: 'string',
-        description: 'What this command does (for audit log)',
-      },
-      timeout: {
-        type: 'integer',
-        description: 'Timeout in milliseconds (max 600000)',
+export function createBashTool(credentialConfig?: CredentialMaskingConfig): ToolDefinition {
+  return {
+    name: 'Bash',
+    description:
+      'Execute a bash command. Returns stdout and stderr. Timeout: 120s. Use with caution.',
+    category: 'exec',
+    permission: 'ask',
+    parameters: {
+      type: 'object',
+      properties: {
+        command: { type: 'string', description: 'The bash command to execute' },
+        description: {
+          type: 'string',
+          description: 'What this command does (for audit log)',
+        },
+        timeout: {
+          type: 'integer',
+          description: 'Timeout in milliseconds (max 600000)',
+        },
       },
+      required: ['command'],
     },
-    required: ['command'],
-  },
-  async execute(params, ctx) {
-    const command = params.command as string
-    const timeout = Math.min((params.timeout as number) || 120_000, 600_000)
-
-    // P0-4: Worktree isolation — block cd escape attempts
-    const WORKTREE_MARKER = '.claude/worktrees/'
-    if (ctx.cwd.includes(WORKTREE_MARKER)) {
-      const worktreeRoot = ctx.cwd.substring(0, ctx.cwd.indexOf(WORKTREE_MARKER))
-      // Detect cd to absolute paths outside the worktree
-      const cdEscapePattern = /\bcd\s+(?:"([^"]+)"|'([^']+)'|([^\s;|&]+))/
-      const cdMatch = command.match(cdEscapePattern)
-      if (cdMatch) {
-        const target = cdMatch[1] || cdMatch[2] || cdMatch[3] || ''
-        // Resolve relative to cwd
-        const resolved = target.startsWith('/')
-          ? target
-          : `${ctx.cwd}/${target}`.replace(/\/\.\//g, '/')
-        if (!resolved.startsWith(ctx.cwd) && !resolved.startsWith(worktreeRoot + '/')) {
-          return {
-            success: false,
-            content: '',
-            error:
-              `Worktree isolation: cannot cd outside worktree directory. ` +
-              `Attempted: ${target}. Use tools within the worktree only.`,
+    async execute(params, ctx) {
+      const command = params.command as string
+      const timeout = Math.min((params.timeout as number) || 120_000, 600_000)
+
+      // P0-4: Worktree isolation — block cd escape attempts
+      const WORKTREE_MARKER = '.claude/worktrees/'
+      if (ctx.cwd.includes(WORKTREE_MARKER)) {
+        const worktreeRoot = ctx.cwd.substring(0, ctx.cwd.indexOf(WORKTREE_MARKER))
+        // Detect cd to absolute paths outside the worktree
+        const cdEscapePattern = /\bcd\s+(?:"([^"]+)"|'([^']+)'|([^\s;|&]+))/
+        const cdMatch = command.match(cdEscapePattern)
+        if (cdMatch) {
+          const target = cdMatch[1] || cdMatch[2] || cdMatch[3] || ''
+          // Resolve relative to cwd
+          const resolved = target.startsWith('/')
+            ? target
+            : `${ctx.cwd}/${target}`.replace(/\/\.\//g, '/')
+          if (!resolved.startsWith(ctx.cwd) && !resolved.startsWith(worktreeRoot + '/')) {
+            return {
+              success: false,
+              content: '',
+              error:
+                `Worktree isolation: cannot cd outside worktree directory. ` +
+                `Attempted: ${target}. Use tools within the worktree only.`,
+            }
           }
         }
       }
-    }
-
-    // Security: check command against deny list
-    const blockedReason = isBlocked(command)
-    if (blockedReason) {
-      return { success: false, content: '', error: blockedReason }
-    }
 
-    try {
-      // ── Credential masking: filter sensitive env vars ──
-      let spawnEnv: Record<string, string | undefined> | undefined
-      if (credentialConfig?.enabled && credentialConfig.env_filter.enabled) {
-        const { filterEnv } = await import('../../core/credential-masker')
-        spawnEnv = filterEnv(process.env as Record<string, string | undefined>, credentialConfig)
+      // Security: check command against deny list
+      const blockedReason = isBlocked(command)
+      if (blockedReason) {
+        return { success: false, content: '', error: blockedReason }
       }
 
-      const proc = Bun.spawn(['bash', '-c', command], {
-        cwd: ctx.cwd,
-        stdout: 'pipe',
-        stderr: 'pipe',
-        env: spawnEnv,
-      })
-
-      const timer = setTimeout(() => proc.kill(), timeout)
-      const rawOutput = await new Response(proc.stdout).text()
-      const exitCode = await proc.exited
-      clearTimeout(timer)
-
-      // Read stderr for violation detection and error reporting
-      const rawStderr = await new Response(proc.stderr).text()
-
-      // ── Credential masking: scrub output ──
-      let output = rawOutput
-      if (credentialConfig?.enabled && credentialConfig.output_scrubbing.enabled) {
-        const { maskOutput } = await import('../../core/credential-masker')
-        output = maskOutput(rawOutput, credentialConfig)
-      }
+      try {
+        // ── Credential masking: filter sensitive env vars ──
+        let spawnEnv: Record<string, string | undefined> | undefined
+        if (credentialConfig?.enabled && credentialConfig.env_filter.enabled) {
+          const { filterEnv } = await import('../../core/credential-masker')
+          spawnEnv = filterEnv(process.env as Record<string, string | undefined>, credentialConfig)
+        }
 
-      // ── Sandbox violation detection ──
-      const violations = detectViolations(rawStderr)
+        const proc = Bun.spawn(['bash', '-c', command], {
+          cwd: ctx.cwd,
+          stdout: 'pipe',
+          stderr: 'pipe',
+          env: spawnEnv,
+        })
+
+        const timer = setTimeout(() => proc.kill(), timeout)
+        const rawOutput = await new Response(proc.stdout).text()
+        const exitCode = await proc.exited
+        clearTimeout(timer)
+
+        // Read stderr for violation detection and error reporting
+        const rawStderr = await new Response(proc.stderr).text()
+
+        // ── Credential masking: scrub output ──
+        let output = rawOutput
+        if (credentialConfig?.enabled && credentialConfig.output_scrubbing.enabled) {
+          const { maskOutput } = await import('../../core/credential-masker')
+          output = maskOutput(rawOutput, credentialConfig)
+        }
 
-      if (exitCode !== 0) {
-        const stderr =
-          credentialConfig?.enabled && credentialConfig.output_scrubbing.enabled
-            ? (await import('../../core/credential-masker')).maskOutput(rawStderr, credentialConfig)
-            : rawStderr
-        let errorContent = output.slice(0, 5_000)
-        if (violations.length > 0) {
-          errorContent += '\n\n── Sandbox Violations ──\n' + violations.join('\n')
+        // ── Sandbox violation detection ──
+        const violations = detectViolations(rawStderr)
+
+        if (exitCode !== 0) {
+          const stderr =
+            credentialConfig?.enabled && credentialConfig.output_scrubbing.enabled
+              ? (await import('../../core/credential-masker')).maskOutput(
+                  rawStderr,
+                  credentialConfig,
+                )
+              : rawStderr
+          let errorContent = output.slice(0, 5_000)
+          if (violations.length > 0) {
+            errorContent += '\n\n── Sandbox Violations ──\n' + violations.join('\n')
+          }
+          // Vibe coding fix: auto-parse error locations from stderr
+          const errorLocations = parseErrorLocations(rawStderr)
+          if (errorLocations.length > 0) {
+            errorContent +=
+              '\n\n── Error Locations (for quick fix) ──\n' +
+              errorLocations
+                .map(
+                  (l) =>
+                    `  ${l.file}:${l.line}` +
+                    (l.col ? `:${l.col}` : '') +
+                    (l.message ? ` — ${l.message}` : ''),
+                )
+                .join('\n')
+          }
+          return {
+            success: false,
+            content: errorContent,
+            error: `Exit code ${exitCode}: ${stderr.slice(0, 1_000)}`,
+          }
         }
-        // Vibe coding fix: auto-parse error locations from stderr
-        const errorLocations = parseErrorLocations(rawStderr)
-        if (errorLocations.length > 0) {
-          errorContent +=
-            '\n\n── Error Locations (for quick fix) ──\n' +
-            errorLocations
-              .map(
-                (l) =>
-                  `  ${l.file}:${l.line}` +
-                  (l.col ? `:${l.col}` : '') +
-                  (l.message ? ` — ${l.message}` : ''),
-              )
-              .join('\n')
+
+        let successContent = output.slice(0, 100_000) || '(no output)'
+        if (violations.length > 0) {
+          successContent += '\n\n── Sandbox Violations ──\n' + violations.join('\n')
         }
+        return { success: true, content: successContent }
+      } catch (err) {
         return {
           success: false,
-          content: errorContent,
-          error: `Exit code ${exitCode}: ${stderr.slice(0, 1_000)}`,
+          content: '',
+          error: `Command failed: ${String(err)}`,
         }
       }
+    },
+  }
+}
 
-      let successContent = output.slice(0, 100_000) || '(no output)'
-      if (violations.length > 0) {
-        successContent += '\n\n── Sandbox Violations ──\n' + violations.join('\n')
-      }
-      return { success: true, content: successContent }
-    } catch (err) {
-      return {
-        success: false,
-        content: '',
-        error: `Command failed: ${String(err)}`,
-      }
-    }
+export const bashToolService: Service = {
+  inject: ['credentials'],
+  apply(ctx) {
+    const credentialConfig = ctx.get<CredentialMaskingConfig>('credentials')
+    ctx.provide(toolKey('Bash'), withValidation(createBashTool(credentialConfig)))
   },
 }

package/src/tools/exec/git.ts

@@ -28,6 +28,23 @@ export const DANGEROUS_GIT_PATTERNS: Array<{ pattern: RegExp; description: strin
   { pattern: /\bstash\s+clear\b/, description: 'stash clear' },
   // Identity spoofing via config
   { pattern: /\bconfig\s+.*user\./, description: 'config user.* (identity spoofing)' },
+  // Remote manipulation (repo redirection / exfiltration)
+  { pattern: /\bremote\s+(?:add|set-url|rename)\b/, description: 'remote add/set-url/rename' },
+  // History rewrite
+  { pattern: /\bcommit\s+.*--amend\b/, description: 'commit --amend (history rewrite)' },
+  {
+    pattern: /\bcommit\s+.*(?:--no-verify|-n)\b/,
+    description: 'commit --no-verify/-n (hook bypass)',
+  },
+  // Command-execution vectors via git config
+  {
+    pattern: /(?:-c\s+|--config[=\s]|config\s+)core\.(?:sshCommand|pager|askpass|editor)/,
+    description: 'git core.* command execution (sshCommand/pager/askpass/editor)',
+  },
+  {
+    pattern: /(?:-c\s+|--config[=\s]|config\s+)(?:alias\.|credential\.helper)/,
+    description: 'git alias/credential.helper command execution',
+  },
 ]
 
 /**

package/src/tools/file/read.ts

@@ -1,79 +1,86 @@
 import { readFileSync, existsSync, statSync } from 'node:fs'
 import type { ToolDefinition, CredentialMaskingConfig } from '../../shared/index.ts'
 import { resolveSafe } from '../../security/path'
+import type { Service } from '../../vajra'
+import { toolKey } from '../seam'
+import { withValidation } from '../validation'
 
-// Injected at startup — set via index.tsx
-let credentialConfig: CredentialMaskingConfig | undefined
-
-export function setCredentialMaskingConfigForRead(config: CredentialMaskingConfig): void {
-  credentialConfig = config
-}
-
-export const readTool: ToolDefinition = {
-  name: 'Read',
-  description: 'Read a file from the local filesystem. Supports offset and limit for large files.',
-  category: 'file',
-  permission: 'auto',
-  parameters: {
-    type: 'object',
-    properties: {
-      file_path: { type: 'string', description: 'Absolute path to the file to read' },
-      offset: { type: 'integer', description: 'Line number to start reading from' },
-      limit: { type: 'integer', description: 'Number of lines to read' },
+export function createReadTool(credentialConfig?: CredentialMaskingConfig): ToolDefinition {
+  return {
+    name: 'Read',
+    description:
+      'Read a file from the local filesystem. Supports offset and limit for large files.',
+    category: 'file',
+    permission: 'auto',
+    parameters: {
+      type: 'object',
+      properties: {
+        file_path: { type: 'string', description: 'Absolute path to the file to read' },
+        offset: { type: 'integer', description: 'Line number to start reading from' },
+        limit: { type: 'integer', description: 'Number of lines to read' },
+      },
+      required: ['file_path'],
     },
-    required: ['file_path'],
-  },
-  async execute(params, ctx) {
-    const filePath = resolveSafe(ctx.cwd, params.file_path as string)
-    if (!existsSync(filePath)) {
-      return { success: false, content: '', error: `File not found: ${filePath}` }
-    }
-    const stat = statSync(filePath)
-    if (stat.isDirectory()) {
-      return { success: false, content: '', error: `Path is a directory: ${filePath}` }
-    }
-    // Prevent OOM on single-line files (e.g. 500MB JSON blob)
-    const MAX_FILE_SIZE = 50_000_000 // 50 MB
-    if (stat.size > MAX_FILE_SIZE) {
-      return {
-        success: false,
-        content: '',
-        error: `File too large (${(stat.size / 1e6).toFixed(1)} MB). Max: 50 MB. Use offset/limit for large files.`,
+    async execute(params, ctx) {
+      const filePath = resolveSafe(ctx.cwd, params.file_path as string)
+      if (!existsSync(filePath)) {
+        return { success: false, content: '', error: `File not found: ${filePath}` }
+      }
+      const stat = statSync(filePath)
+      if (stat.isDirectory()) {
+        return { success: false, content: '', error: `Path is a directory: ${filePath}` }
       }
-    }
-    const offset = (params.offset as number) || 0
-    const limit = (params.limit as number) || 2000
-    const content = readFileSync(filePath, 'utf-8')
+      // Prevent OOM on single-line files (e.g. 500MB JSON blob)
+      const MAX_FILE_SIZE = 50_000_000 // 50 MB
+      if (stat.size > MAX_FILE_SIZE) {
+        return {
+          success: false,
+          content: '',
+          error: `File too large (${(stat.size / 1e6).toFixed(1)} MB). Max: 50 MB. Use offset/limit for large files.`,
+        }
+      }
+      const offset = (params.offset as number) || 0
+      const limit = (params.limit as number) || 2000
+      const content = readFileSync(filePath, 'utf-8')
 
-    // ── Read tracking: mark file as read for Write tool safety ──
-    ctx.readFiles?.add(filePath)
+      // ── Read tracking: mark file as read for Write tool safety ──
+      ctx.readFiles?.add(filePath)
 
-    // ── Credential masking ──
-    if (credentialConfig) {
-      const { matchCredentialFile, maskContent, CREDENTIAL_SENTINEL } =
-        await import('../../core/credential-masker')
-      const rule = matchCredentialFile(filePath, credentialConfig)
-      if (rule) {
-        const masked = maskContent(content, rule)
-        // Full-file mask: return sentinel immediately (offset/limit don't apply)
-        if (masked === CREDENTIAL_SENTINEL) {
-          return { success: true, content: masked }
+      // ── Credential masking ──
+      if (credentialConfig) {
+        const { matchCredentialFile, maskContent, CREDENTIAL_SENTINEL } =
+          await import('../../core/credential-masker')
+        const rule = matchCredentialFile(filePath, credentialConfig)
+        if (rule) {
+          const masked = maskContent(content, rule)
+          // Full-file mask: return sentinel immediately (offset/limit don't apply)
+          if (masked === CREDENTIAL_SENTINEL) {
+            return { success: true, content: masked }
+          }
+          // Extract mode: apply offset/limit on masked content
+          const maskedLines = masked.split('\n')
+          const maskedSlice = maskedLines.slice(offset, offset + limit)
+          const maskedResult = maskedSlice
+            .map((l, i) => `${String(offset + i + 1).padStart(6, ' ')}\t${l}`)
+            .join('\n')
+          return { success: true, content: maskedResult }
         }
-        // Extract mode: apply offset/limit on masked content
-        const maskedLines = masked.split('\n')
-        const maskedSlice = maskedLines.slice(offset, offset + limit)
-        const maskedResult = maskedSlice
-          .map((l, i) => `${String(offset + i + 1).padStart(6, ' ')}\t${l}`)
-          .join('\n')
-        return { success: true, content: maskedResult }
       }
-    }
 
-    const lines = content.split('\n')
-    const slice = lines.slice(offset, offset + limit)
-    const result = slice
-      .map((l, i) => `${String(offset + i + 1).padStart(6, ' ')}\t${l}`)
-      .join('\n')
-    return { success: true, content: result }
+      const lines = content.split('\n')
+      const slice = lines.slice(offset, offset + limit)
+      const result = slice
+        .map((l, i) => `${String(offset + i + 1).padStart(6, ' ')}\t${l}`)
+        .join('\n')
+      return { success: true, content: result }
+    },
+  }
+}
+
+export const readToolService: Service = {
+  inject: ['credentials'],
+  apply(ctx) {
+    const credentialConfig = ctx.get<CredentialMaskingConfig>('credentials')
+    ctx.provide(toolKey('Read'), withValidation(createReadTool(credentialConfig)))
   },
 }

package/src/tools/file/write.ts

@@ -32,7 +32,7 @@ export const writeTool: ToolDefinition = {
 
     // ── Read-before-write safety check ──
     const fileExists = existsSync(filePath)
-    const wasRead = ctx.readFiles?.has(filePath) ?? true // if no tracking, allow
+    const wasRead = ctx.readFiles?.has(filePath) ?? false // fail closed: no tracking = not read
     if (fileExists && !wasRead) {
       return {
         success: false,