@oh-my-pi/pi-coding-agent 16.1.18 → 16.1.20

package/src/utils/shell-snapshot-fn-env.sh

@@ -0,0 +1,60 @@
+# Helpers inlined into `generateSnapshotScript` (shell-snapshot.ts).
+#
+# Activation idioms like `mise activate` install a shell function whose body
+# expands a sidecar env var (e.g. `mise() { command "$__MISE_EXE" "$@"; }`).
+# The function survives `declare -f`/`typeset -f` capture, but the helper var
+# is set on the rc-sourced shell and lost when only PATH gets re-exported.
+# The replay shell then calls `command "" …` and dies with
+# `command: command not found:` (issue #3470).
+#
+# `__omp_emit_referenced_exports` reads captured function bodies from stdin,
+# extracts every `$VAR` / `${VAR…}` reference, and emits a single
+# `export VAR='value'` line to stdout for each referenced var that
+# (a) is currently set in this shell and (b) is not a shell-internal name.
+# The script bodies are scanned, not interpreted — over-inclusion (refs inside
+# comments / heredocs) is harmless because we only emit names that are set.
+#
+# Pure POSIX so the same helper works under bash and zsh.
+
+# Wrap $1 in single quotes, escaping every embedded `'` as `'\''`.
+__omp_sq_quote() {
+	__omp_qbuf=$1
+	__omp_qout=
+	__omp_sq=\'
+	while case "$__omp_qbuf" in *$__omp_sq*) true ;; *) false ;; esac; do
+		__omp_qout=$__omp_qout${__omp_qbuf%%$__omp_sq*}"'\\''"
+		__omp_qbuf=${__omp_qbuf#*$__omp_sq}
+	done
+	__omp_qout=$__omp_qout$__omp_qbuf
+	printf "'%s'" "$__omp_qout"
+}
+
+# Emit `export NAME='value'` for $1 unless the name is a shell-internal we
+# must never overwrite, a likely secret (token / key / password / credential
+# patterns — kept conservative, since `__MISE_EXE` and `FOO_DIR` style helper
+# vars never carry secrets), or the var is unset. POSIX `case` patterns are
+# byte-exact so we list common uppercase variants; lowercase secret vars are
+# rare and out of scope.
+__omp_emit_export_for() {
+	case "$1" in
+		_|PATH|HOME|USER|LOGNAME|PWD|OLDPWD|SHELL|SHLVL|TERM|TERMINFO|TERMCAP|IFS|TMPDIR|TMOUT|LANG|RANDOM|LINENO|SECONDS|FUNCNAME|HISTFILE|HISTSIZE|HISTFILESIZE|HISTCMD|PS1|PS2|PS3|PS4|UID|EUID|GROUPS|HOSTNAME|HOSTTYPE|OSTYPE|MACHTYPE|PIPESTATUS|BASH|ZSH|argv|PROMPT|RPROMPT|RPS1|RPS2|status|pipestatus|COLUMNS|LINES|COLORTERM|FUNCNEST) return ;;
+		LC_*|BASH_*|ZSH_*) return ;;
+		# Common secret-name patterns — never materialise these into the
+		# snapshot file even though it's now created 0600 (defence in depth
+		# against the file ending up in a backup, tarball, or NFS share).
+		*TOKEN*|*SECRET*|*PASSWORD*|*PASSWD*|*API_KEY*|*PRIVATE_KEY*|*ACCESS_KEY*|*CREDENTIAL*|*SESSION_KEY*) return ;;
+	esac
+	eval "[ \"\${$1+x}\" = x ]" 2>/dev/null || return
+	eval "__omp_xv=\"\${$1}\"" 2>/dev/null || return
+	printf 'export %s=%s\n' "$1" "$(__omp_sq_quote "$__omp_xv")"
+}
+
+# Read function bodies on stdin, emit dedup'd export lines on stdout.
+__omp_emit_referenced_exports() {
+	grep -oE '\$\{?[A-Za-z_][A-Za-z0-9_]*' \
+		| sed -E 's/^\$\{?//' \
+		| sort -u \
+		| while IFS= read -r __omp_name; do
+			__omp_emit_export_for "$__omp_name"
+		done
+}

package/src/utils/shell-snapshot.ts

@@ -9,6 +9,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { logger, postmortem } from "@oh-my-pi/pi-utils";
+import fnEnvHelper from "./shell-snapshot-fn-env.sh" with { type: "text" };
 
 const cachedSnapshotPaths = new Map<string, string>();
 const SNAPSHOT_TIMEOUT_MS = 2_000;
@@ -83,9 +84,13 @@ function sanitizeSnapshotEnv(env: Record<string, string | undefined>): Record<st
 
 /**
  * Get the user's shell config file path.
+ *
+ * Honours `env.HOME` when present so a caller can target a sandboxed/test
+ * home, falling back to `os.homedir()` (which Bun resolves once at startup
+ * and caches — `process.env.HOME` overrides don't affect it).
  */
-function getShellConfigFile(shell: string): string {
-	const home = os.homedir();
+function getShellConfigFile(shell: string, env: Record<string, string | undefined>): string {
+	const home = env.HOME || os.homedir();
 	if (shell.includes("zsh")) return path.join(home, ".zshrc");
 	if (shell.includes("bash")) return path.join(home, ".bashrc");
 	return path.join(home, ".profile");
@@ -105,26 +110,22 @@ function generateSnapshotScript(shell: string, snapshotPath: string, rcFile: str
 	// Escape the snapshot path for shell
 	const escapedPath = snapshotPath.replace(/'/g, "'\\''");
 
-	// Function extraction differs between bash and zsh
-	const functionScript = isZsh
-		? `
-echo "# Functions" >> "$SNAPSHOT_FILE"
-# Force autoload all functions first
+	// Function extraction differs between bash and zsh. Each form prints function
+	// bodies on stdout so we can both persist them AND scan their bodies for
+	// referenced env vars (issue #3470).
+	const functionExtractor = isZsh
+		? `# Force autoload all functions first
 typeset -f > /dev/null 2>&1
 # Get user function names - filter system/private ones
 typeset +f 2>/dev/null | grep -vE '^(_|__)' | grep -vE '${commonToolsRegex}' | while read func; do
-   typeset -f "$func" >> "$SNAPSHOT_FILE" 2>/dev/null
-done
-`
-		: `
-echo "# Functions" >> "$SNAPSHOT_FILE"
-# Force autoload all functions first
+   typeset -f "$func" 2>/dev/null
+done`
+		: `# Force autoload all functions first
 declare -f > /dev/null 2>&1
 # Get user function names - filter system/private ones
 declare -F 2>/dev/null | cut -d' ' -f3 | grep -vE '^(_|__)' | grep -vE '${commonToolsRegex}' | while read func; do
-   declare -f "$func" >> "$SNAPSHOT_FILE" 2>/dev/null
-done
-`;
+   declare -f "$func" 2>/dev/null
+done`;
 
 	// Shell options extraction
 	const optionsScript = isZsh
@@ -142,16 +143,45 @@ echo "shopt -s expand_aliases" >> "$SNAPSHOT_FILE"
 	return `
 SNAPSHOT_FILE='${escapedPath}'
 
+# Snapshot may inline env-var values referenced by captured functions (#3470).
+# Defence in depth: (a) JS caller pre-creates the file at 0600 so the shell's
+# \`>|\`/\`>>\` redirections truncate/append without changing the inode mode,
+# (b) we \`umask 077\` before AND after sourcing the rc so any other file the
+# script creates is private even when the rc resets umask to 022, (c) JS
+# caller chmods file + dir after the script exits.
+umask 077
+
 # Source user's rc file if it exists
 ${hasRcFile ? `source "${rcFile}" < /dev/null 2>/dev/null` : "# No user config file to source"}
 
+# Re-tighten umask in case the rc reset it (common \`.bashrc\`/\`.zshrc\` set
+# \`umask 022\` for the interactive shell).
+umask 077
+
 # Create/clear the snapshot file
 echo "# Shell snapshot - generated by omp agent" >| "$SNAPSHOT_FILE"
 
 # Unalias everything first to avoid conflicts when sourced
 echo "unalias -a 2>/dev/null || true" >> "$SNAPSHOT_FILE"
 
-${functionScript}
+# Capture function definitions into a variable so we can both persist them
+# and scan their bodies for env-var references (issue #3470).
+__omp_funcs=$(
+${functionExtractor}
+)
+echo "# Functions" >> "$SNAPSHOT_FILE"
+printf '%s\\n' "$__omp_funcs" >> "$SNAPSHOT_FILE"
+
+# Re-export uppercase identifiers referenced by snapshotted functions whose
+# value is set in the rc-sourced shell. Without this, activation idioms like
+# mise's \`mise()\` -> \`command "$__MISE_EXE" "$@"\` blow up because the helper
+# var is lost (issue #3470). Helper definitions are POSIX-shell so the same
+# block works for both bash and zsh.
+echo "# Captured function environment" >> "$SNAPSHOT_FILE"
+${fnEnvHelper}
+printf '%s\\n' "$__omp_funcs" | __omp_emit_referenced_exports >> "$SNAPSHOT_FILE"
+unset -f __omp_sq_quote __omp_emit_export_for __omp_emit_referenced_exports 2>/dev/null
+unset __omp_funcs __omp_qbuf __omp_qout __omp_sq __omp_xv __omp_name 2>/dev/null
 
 ${optionsScript}
 
@@ -198,16 +228,35 @@ export async function getOrCreateSnapshot(
 		return null;
 	}
 
-	const rcFile = getShellConfigFile(shell);
+	const rcFile = getShellConfigFile(shell, env);
 
-	// Create snapshot directory
+	// Create snapshot directory with owner-only perms — the script may inline
+	// env vars referenced by captured functions (#3470) and `os.tmpdir()` is
+	// shared on Linux. `mode: 0o700` applies to a fresh mkdir; an existing dir
+	// keeps its mode, so chmod it defensively. Ignore EPERM (dir owned by
+	// another user on a shared box).
 	const snapshotDir = path.join(os.tmpdir(), "omp-shell-snapshots");
-	fs.mkdirSync(snapshotDir, { recursive: true });
+	fs.mkdirSync(snapshotDir, { recursive: true, mode: 0o700 });
+	try {
+		fs.chmodSync(snapshotDir, 0o700);
+	} catch {
+		// best-effort
+	}
 
 	// Generate unique snapshot path
 	const shellName = shell.includes("zsh") ? "zsh" : shell.includes("bash") ? "bash" : "sh";
 	const snapshotPath = path.join(snapshotDir, `snapshot-${shellName}-${crypto.randomUUID()}.sh`);
 
+	// Pre-create the snapshot file at 0600 so the shell's `>|` (truncate) and
+	// `>>` (append) redirections inside `generateSnapshotScript` operate on an
+	// existing inode and preserve the private mode, regardless of the umask
+	// state inside the spawned shell. Without this, a `.bashrc` that sets
+	// `umask 022` (the typical interactive default) before the script's first
+	// redirection would create the file world-readable; the JS-side post-spawn
+	// chmod would tighten it, but only after the shell finished writing every
+	// captured env value to disk.
+	fs.writeFileSync(snapshotPath, "", { mode: 0o600 });
+
 	// Generate and execute snapshot script
 	const script = generateSnapshotScript(shell, snapshotPath, rcFile);
 
@@ -230,6 +279,14 @@ export async function getOrCreateSnapshot(
 
 		await child.exited;
 		if (child.exitCode === 0 && fs.existsSync(snapshotPath)) {
+			// Defence-in-depth: the script's `umask 077` already locks the file at
+			// first write, but chmod again in case the umask didn't take (exotic
+			// shells) or a postmortem-restored file ended up looser.
+			try {
+				fs.chmodSync(snapshotPath, 0o600);
+			} catch {
+				// best-effort
+			}
 			scrubSnapshotInPlace(snapshotPath);
 			cachedSnapshotPaths.set(cacheKey, snapshotPath);
 			return snapshotPath;