@n0zer0d4y/vulcan-file-ops 1.2.13 → 1.3.0

package/dist/utils/command-path-extraction.js

@@ -1,200 +1,195 @@
 import path from "path";
-import { expandHome } from "./path-utils.js";
+import os from "os";
+import fs from "fs/promises";
+import { isPathCanonicallyAllowed } from "./lib.js";
 /**
- * Extract file and directory paths from shell command arguments
+ * Finds file system operands of a parsed shell command that resolve outside
+ * the allowed directories (lexically, through symlinks/junctions, or after
+ * physical "..").
  *
- * This function parses shell commands to identify file/directory paths
- * that need to be validated against allowed directories. It handles:
- * - Windows paths (C:\path, \\server\share\path)
- * - Unix paths (/path, ~/path)
- * - Relative paths (./path, ../path) - resolved to absolute
- * - Quoted paths ("path with spaces")
- * - Environment variables ($HOME, %USERPROFILE%)
- *
- * @param command - The shell command string
- * @param workdir - Working directory for resolving relative paths
- * @returns Array of absolute paths found in the command
+ * An argument is treated as a path if it looks like one (absolute, drive,
+ * UNC, ~, ./ ../, contains a separator) or if it names something that exists
+ * relative to the working directory. Relative operands are checked against
+ * every working directory the command might be in, because a cd/pushd can
+ * fail or (in a pipeline) not persist.
  */
-export function extractPathsFromCommand(command, workdir) {
-    if (!command || !command.trim()) {
-        return [];
+const CD_COMMANDS = new Set([
+    "cd",
+    "chdir",
+    "pushd",
+    "set-location",
+    "sl",
+    "push-location",
+]);
+// PowerShell provider drives that are not the file system.
+const POWERSHELL_PROVIDER_PATH = /^(env|hklm|hkcu|hkcr|hku|hkcc|cert|function|variable|alias|wsman|temp):/i;
+const URL_PATTERN = /^[A-Za-z][A-Za-z0-9+.-]*:\/\//;
+function expandVariables(word) {
+    // Single quotes suppress expansion in both bash and PowerShell.
+    if (word.singleQuoted) {
+        return { value: word.value, unresolved: false };
     }
-    const paths = [];
-    const tokens = tokenizeCommand(command);
-    for (let i = 0; i < tokens.length; i++) {
-        const token = tokens[i];
-        // Skip command name itself (first token)
-        if (i === 0) {
-            continue;
-        }
-        // Skip flags and options
-        if (isFlagOrOption(token)) {
-            // Some flags take arguments (like -o output.txt)
-            // Check if next token might be a path argument
-            if (i + 1 < tokens.length) {
-                const nextToken = tokens[i + 1];
-                if (isLikelyPathArgument(nextToken)) {
-                    const resolvedPath = resolvePath(nextToken, workdir);
-                    if (resolvedPath) {
-                        paths.push(resolvedPath);
-                        i++; // Skip the next token since we processed it
-                    }
-                }
-            }
-            continue;
-        }
-        // Check if token is a path
-        if (isLikelyPathArgument(token)) {
-            const resolvedPath = resolvePath(token, workdir);
-            if (resolvedPath) {
-                paths.push(resolvedPath);
-            }
+    let unresolved = false;
+    const lookup = (name) => {
+        const value = process.env[name];
+        if (value === undefined) {
+            unresolved = true;
+            return "";
         }
+        return value;
+    };
+    let value = word.value
+        .replace(/\$env:([A-Za-z_][A-Za-z0-9_]*)/gi, (_, name) => lookup(name))
+        .replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_, name) => lookup(name))
+        .replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g, (_, name) => lookup(name));
+    // Anything else that still looks like an expansion cannot be validated.
+    if (/\$[A-Za-z_{]/.test(value)) {
+        unresolved = true;
     }
-    return paths;
-}
-/**
- * Tokenize command string, handling quoted arguments
- */
-function tokenizeCommand(command) {
-    const tokens = [];
-    let current = "";
-    let inDoubleQuotes = false;
-    let inSingleQuotes = false;
-    let escaped = false;
-    for (let i = 0; i < command.length; i++) {
-        const char = command[i];
-        if (escaped) {
-            current += char;
-            escaped = false;
-            continue;
-        }
-        if (char === "\\") {
-            escaped = true;
-            current += char;
-            continue;
-        }
-        if (char === '"' && !inSingleQuotes) {
-            inDoubleQuotes = !inDoubleQuotes;
-            current += char;
-            continue;
+    if (!word.quoted) {
+        if (value === "~") {
+            value = os.homedir();
         }
-        if (char === "'" && !inDoubleQuotes) {
-            inSingleQuotes = !inSingleQuotes;
-            current += char;
-            continue;
+        else if (value.startsWith("~/") || value.startsWith("~\\")) {
+            value = path.join(os.homedir(), value.slice(2));
         }
-        if ((char === " " || char === "\t") && !inDoubleQuotes && !inSingleQuotes) {
-            if (current.trim()) {
-                tokens.push(current.trim());
-                current = "";
-            }
-            continue;
-        }
-        current += char;
     }
-    if (current.trim()) {
-        tokens.push(current.trim());
+    return { value, unresolved };
+}
+function looksLikePath(value) {
+    if (!value || URL_PATTERN.test(value)) {
+        return false;
     }
-    return tokens;
+    return (path.isAbsolute(value) ||
+        /^[A-Za-z]:/.test(value) ||
+        value.startsWith("\\\\") ||
+        value === "." ||
+        value === ".." ||
+        value.startsWith("./") ||
+        value.startsWith("../") ||
+        value.startsWith(".\\") ||
+        value.startsWith("..\\") ||
+        value.includes("/") ||
+        value.includes("\\"));
 }
-/**
- * Check if a token is a flag or option (not a path)
- */
-function isFlagOrOption(token) {
-    // Remove surrounding quotes
-    const cleanToken = token.replace(/^["']|["']$/g, "");
-    // Windows: -flag or /flag
-    if (cleanToken.match(/^[-/][^-/]/)) {
+async function exists(p) {
+    try {
+        await fs.lstat(p);
         return true;
     }
-    // Unix: --long-flag or -s
-    if (cleanToken.match(/^--?[a-zA-Z]/)) {
-        return true;
+    catch {
+        return false;
     }
-    return false;
 }
-/**
- * Check if a token is likely a file/directory path argument
- */
-function isLikelyPathArgument(token) {
-    // Remove surrounding quotes
-    const cleanToken = token.replace(/^["']|["']$/g, "");
-    // Windows absolute path: C:\path or \\server\share\path
-    if (cleanToken.match(/^[A-Za-z]:[\\/]/) || cleanToken.startsWith("\\\\")) {
-        return true;
+/** Value attached to an option, e.g. --out=X, -Path:X, -C:\X, -I../X. */
+function attachedOptionValue(flag) {
+    const drive = /^-[A-Za-z]([A-Za-z]:[\\/].*)$/.exec(flag);
+    if (drive) {
+        return drive[1];
     }
-    // Unix absolute path: /path
-    if (cleanToken.startsWith("/") && !cleanToken.match(/^\/[a-zA-Z]\//)) {
-        // Exclude Windows-style paths like /c/path
-        return true;
+    const assigned = /^-{1,2}[A-Za-z][\w-]*[=:](.+)$/.exec(flag);
+    if (assigned && looksLikePath(assigned[1])) {
+        return assigned[1];
     }
-    // Home directory: ~/path or ~
-    if (cleanToken.startsWith("~/") || cleanToken === "~") {
-        return true;
+    const short = /^-[A-Za-z](.+)$/.exec(flag);
+    if (short && looksLikePath(short[1])) {
+        return short[1];
     }
-    // Relative path: ./path or ../path
-    if (cleanToken.startsWith("./") || cleanToken.startsWith("../")) {
-        return true;
-    }
-    // Path with environment variable: $HOME/path or %USERPROFILE%\path
-    if (cleanToken.includes("$") || cleanToken.includes("%")) {
+    return null;
+}
+export async function findDisallowedCommandPaths(parsed, workdir) {
+    const denied = new Set();
+    const possibleCwds = [workdir];
+    const checkPath = async (candidate) => {
+        const bases = path.isAbsolute(candidate) ? [workdir] : possibleCwds;
+        for (const base of bases) {
+            if (!(await isPathCanonicallyAllowed(candidate, base))) {
+                denied.add(path.isAbsolute(candidate) ? candidate : path.join(base, candidate));
+                return false;
+            }
+        }
         return true;
-    }
-    // If it contains path separators, might be a path
-    if (cleanToken.includes("/") || cleanToken.includes("\\")) {
-        // But exclude URLs and other non-path strings
-        if (!cleanToken.match(/^https?:\/\//) &&
-            !cleanToken.match(/^[a-zA-Z]+:\/\//) &&
-            !cleanToken.match(/^[a-zA-Z]+:/) // Exclude single-letter drive-like patterns
-        ) {
-            return true;
+    };
+    const resolveWord = (word) => {
+        const expanded = expandVariables(word);
+        if (expanded.unresolved) {
+            denied.add(`${word.value} (contains a variable reference that cannot be resolved for validation)`);
+            return null;
         }
-    }
-    return false;
-}
-/**
- * Resolve a path token to an absolute path
- */
-function resolvePath(token, workdir) {
-    try {
-        // Remove surrounding quotes
-        let cleanToken = token.replace(/^["']|["']$/g, "");
-        // Expand environment variables
-        cleanToken = expandEnvironmentVariables(cleanToken);
-        // Expand home directory
-        cleanToken = expandHome(cleanToken);
-        // Resolve to absolute path
-        let absolute;
-        if (path.isAbsolute(cleanToken)) {
-            absolute = path.resolve(cleanToken);
+        if (process.platform === "win32" &&
+            (POWERSHELL_PROVIDER_PATH.test(expanded.value) ||
+                expanded.value.includes("::"))) {
+            denied.add(`${expanded.value} (PowerShell provider paths are not allowed)`);
+            return null;
         }
-        else {
-            absolute = path.resolve(workdir, cleanToken);
+        return expanded.value;
+    };
+    for (const segment of parsed.segments) {
+        const [rootWord, ...args] = segment.words;
+        const root = rootWord ? rootWord.value.toLowerCase() : "";
+        const candidates = [];
+        const operands = [];
+        for (const word of args) {
+            const value = resolveWord(word);
+            if (value === null || value === "" || URL_PATTERN.test(value)) {
+                continue;
+            }
+            if (value.startsWith("-")) {
+                const attached = attachedOptionValue(value);
+                if (attached) {
+                    candidates.push(attached);
+                }
+                continue;
+            }
+            operands.push(value);
+            // On Windows "/x" is either a switch or a path on the current drive.
+            if (process.platform === "win32" &&
+                value.startsWith("/") &&
+                !/[\\/]/.test(value.slice(1))) {
+                if (await exists(path.resolve(value))) {
+                    candidates.push(value);
+                }
+                continue;
+            }
+            if (looksLikePath(value)) {
+                candidates.push(value);
+                continue;
+            }
+            for (const base of possibleCwds) {
+                if (await exists(path.join(base, value))) {
+                    candidates.push(value);
+                    break;
+                }
+            }
+        }
+        for (const redirect of segment.redirects) {
+            if (!redirect.target) {
+                continue;
+            }
+            const value = resolveWord(redirect.target);
+            if (value) {
+                candidates.push(value);
+            }
+        }
+        for (const candidate of candidates) {
+            await checkPath(candidate);
+        }
+        if (CD_COMMANDS.has(root)) {
+            const target = operands[0] ?? os.homedir();
+            if (target === "-") {
+                denied.add("cd - (previous directory cannot be validated)");
+                continue;
+            }
+            if (await checkPath(target)) {
+                for (const base of [...possibleCwds]) {
+                    const next = path.resolve(base, target);
+                    if (!possibleCwds.includes(next)) {
+                        possibleCwds.push(next);
+                    }
+                }
+            }
         }
-        // Normalize the path
-        return path.normalize(absolute);
-    }
-    catch {
-        // If resolution fails, return null (don't block, but don't validate)
-        return null;
     }
-}
-/**
- * Expand environment variables in a path string
- */
-function expandEnvironmentVariables(pathStr) {
-    // Windows: %VAR%
-    pathStr = pathStr.replace(/%([^%]+)%/g, (match, varName) => {
-        return process.env[varName] || match;
-    });
-    // Unix: $VAR or ${VAR}
-    pathStr = pathStr.replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g, (match, varName) => {
-        return process.env[varName] || match;
-    });
-    pathStr = pathStr.replace(/\${([^}]+)}/g, (match, varName) => {
-        return process.env[varName] || match;
-    });
-    return pathStr;
+    return [...denied];
 }
 //# sourceMappingURL=command-path-extraction.js.map

package/dist/utils/command-validation.js

@@ -1,12 +1,18 @@
 import os from "os";
+import { parseShellCommand, getRootCommands, ShellSyntaxError, } from "./shell-parser.js";
 /**
- * Dangerous command patterns that should trigger approval
+ * Dangerous command patterns. Matching commands are blocked unless the
+ * operator allowed the root command with --allow-dangerous-commands.
  */
 const DANGEROUS_PATTERNS = [
     // Destructive operations
     /\brm\b.*-rf?\b/i,
     /\bdel\b.*\/s\b/i,
-    /\bformat\b/i,
+    /\b(rd|rmdir)\b.*\/s\b/i,
+    /\bremove-item\b.*-recurse\b/i,
+    /\bformat(\.com)?\s+[a-z]:/i,
+    /\bformat-volume\b/i,
+    /\bclear-disk\b/i,
     /\bmkfs\b/i,
     // System modifications
     /\bsudo\b/i,
@@ -33,22 +39,32 @@ const COMMAND_SUBSTITUTION_PATTERNS = [
     />\([^)]*\)/, // >(command)
 ];
 /**
- * Extract root command from shell command string
+ * Extract the root command of every segment of a shell command.
  * Examples:
- *   "ls -la" -> "ls"
- *   "npm install && npm start" -> ["npm", "npm"]
- *   "sudo apt install" -> ["sudo", "apt"]
+ *   "ls -la" -> ["ls"]
+ *   "npm install && npm start" -> ["npm"]
+ *   'echo "a; b"' -> ["echo"]   (quoted text is an argument, not a command)
+ *
+ * Uses the conservative shell parser. If the command is outside the accepted
+ * grammar (validateCommand rejects those), falls back to splitting on every
+ * separator, including newlines, so the result never under-reports commands.
  */
 export function extractRootCommands(command) {
+    try {
+        return getRootCommands(parseShellCommand(command));
+    }
+    catch (error) {
+        if (!(error instanceof ShellSyntaxError)) {
+            throw error;
+        }
+    }
     const roots = [];
-    // Split by common shell operators
     const segments = command
-        .split(/[;&|]/)
+        .split(/[;&|\r\n\u0085\u2028\u2029]/)
         .map((s) => s.trim())
         .filter(Boolean);
     for (const segment of segments) {
-        // Remove leading/trailing whitespace and extract first word
-        const firstWord = segment.trim().split(/\s+/)[0];
+        const firstWord = segment.split(/\s+/)[0];
         if (firstWord && !roots.includes(firstWord)) {
             roots.push(firstWord);
         }
@@ -61,6 +77,26 @@ export function extractRootCommands(command) {
 export function isDangerousCommand(command) {
     return DANGEROUS_PATTERNS.some((pattern) => pattern.test(command));
 }
+/**
+ * Root commands of the segments that match a dangerous pattern. If the
+ * pattern only matches across segments (e.g. a download piped into a shell),
+ * every root command is returned.
+ */
+export function getDangerousRoots(parsed) {
+    const roots = new Set();
+    for (const segment of parsed.segments) {
+        if (isDangerousCommand(segment.raw) && segment.words[0]) {
+            roots.add(segment.words[0].value);
+        }
+    }
+    if (roots.size === 0) {
+        const whole = parsed.segments.map((s) => s.raw).join(" | ");
+        if (isDangerousCommand(whole)) {
+            return getRootCommands(parsed);
+        }
+    }
+    return [...roots];
+}
 /**
  * Check if command contains command substitution
  */
@@ -81,6 +117,22 @@ export function validateCommand(command, allowCommandSubstitution = false) {
             reason: "Command substitution using $(), ``, <(), or >() is not allowed for security reasons",
         };
     }
+    // Structural check: only the conservative grammar is accepted. (Skipped
+    // when substitution is explicitly allowed, which execute_shell never does.)
+    if (!allowCommandSubstitution) {
+        try {
+            parseShellCommand(command);
+        }
+        catch (error) {
+            if (error instanceof ShellSyntaxError) {
+                return {
+                    allowed: false,
+                    reason: `Unsupported shell syntax: ${error.message}`,
+                };
+            }
+            throw error;
+        }
+    }
     // Extract root commands for approval checking
     const roots = extractRootCommands(command);
     if (roots.length === 0) {

package/dist/utils/document-parser.js

@@ -1,5 +1,7 @@
 import path from "path";
 import { promises as fs } from "fs";
+import { MAX_DOCUMENT_FILE_BYTES, ZIP_MAX_TOTAL_UNCOMPRESSED_BYTES, ZIP_MAX_ENTRIES, } from "./limits.js";
+import { assertSafeZipFile, UnsafeZipError } from "./zip-guard.js";
 // Lazy-loaded parsers (imported only when needed)
 let pdfParse = null;
 let mammoth = null;
@@ -13,6 +15,15 @@ const DOCUMENT_EXTENSIONS = [
     ".odp",
     ".ods",
 ];
+/** Document formats that are ZIP containers (guarded against zip bombs). */
+const ZIP_DOCUMENT_EXTENSIONS = [
+    ".docx",
+    ".pptx",
+    ".xlsx",
+    ".odt",
+    ".odp",
+    ".ods",
+];
 /**
  * Checks if file is a supported document format
  */
@@ -27,10 +38,25 @@ export async function parseDocument(filePath) {
     const ext = path.extname(filePath).toLowerCase();
     const stats = await fs.stat(filePath);
     // File size validation
-    const MAX_SIZE = 50 * 1024 * 1024; // 50MB
-    if (stats.size > MAX_SIZE) {
+    if (stats.size > MAX_DOCUMENT_FILE_BYTES) {
         throw new Error(`Document too large (${(stats.size / 1024 / 1024).toFixed(1)}MB). ` +
-            `Maximum: 50MB`);
+            `Maximum: ${Math.round(MAX_DOCUMENT_FILE_BYTES / 1024 / 1024)}MB`);
+    }
+    // ZIP-based formats: reject decompression bombs before any parser (or the
+    // officeparser fallback below) inflates the archive (VFO-15).
+    if (ZIP_DOCUMENT_EXTENSIONS.includes(ext)) {
+        try {
+            await assertSafeZipFile(filePath);
+        }
+        catch (error) {
+            if (error instanceof UnsafeZipError) {
+                const label = ext.slice(1).toUpperCase();
+                throw new DocumentParseError(filePath, ext, error.reason === "invalid"
+                    ? `File appears to be corrupted or is not a valid ${label} document (${error.message}).`
+                    : `Refusing to parse ${label} document: ${error.message}.`, error);
+            }
+            throw error;
+        }
     }
     // Check for legacy .doc format
     if (ext === ".doc") {
@@ -121,15 +147,27 @@ async function parseOfficeDocument(filePath, ext) {
     // Lazy load officeparser
     if (!officeParser) {
         const module = await import("officeparser");
-        officeParser = module.parseOfficeAsync;
+        officeParser = module.parseOffice;
     }
     const config = {
         outputErrorToConsole: false,
         newlineDelimiter: "\n",
         ignoreNotes: false,
         putNotesAtLast: false,
+        // Text extraction only: never run OCR (which would load tesseract.js and
+        // download language data), extract embedded files, or keep raw XML.
+        ocr: false,
+        extractAttachments: false,
+        includeRawContent: false,
+        // Same limits as the zip-guard pre-check; officeparser additionally caps
+        // ODF repeated table cells, which the ZIP headers cannot reveal.
+        decompressionLimits: {
+            maxUncompressedBytes: ZIP_MAX_TOTAL_UNCOMPRESSED_BYTES,
+            maxZipEntries: ZIP_MAX_ENTRIES,
+        },
     };
-    const text = await officeParser(filePath, config);
+    const ast = await officeParser(filePath, config);
+    const text = ast.toText();
     return {
         text,
         metadata: {