@openlines/opl-pi-sht 0.1.18 → 0.1.19

package/README.md

@@ -1,5 +1,11 @@
 # opl-pi-sht
 
+[![gh stars](https://img.shields.io/github/stars/linellazatin/opl-pi-sht?logo=github&color=ffffe0)](https://github.com/linellazatin/opl-pi-sht)
+[![gh release](https://img.shields.io/github/v/release/linellazatin/opl-pi-sht?display_name=release&logo=github&color=ffffe0)](https://github.com/linellazatin/opl-pi-sht)
+[![npm version](https://img.shields.io/npm/v/%40openlines%2Fopl-pi-sht?logo=npm&color=cb3837)](https://www.npmjs.com/package/@openlines/opl-pi-sht)
+[![npm downloads](https://img.shields.io/npm/dm/@openlines/opl-pi-sht?logo=npm&color=cb3837)](https://www.npmjs.com/package/@openlines/opl-pi-sht)
+[![license](https://img.shields.io/npm/l/@openlines/opl-pi-sht)](./LICENSE)
+
 **Cut token cost, run the agent safely, and drop your MCP servers.**
 
 A portable collection of various Pi coding agent extensions. Repository directories and config files use `opl-`; established Pi-facing commands and tool names stay compatible.
@@ -94,7 +100,7 @@ Cold prompt-cache write, measured /init session (opl-modes lazy tools + MCP adap
 
 ### Run the agent without babysitting it
 
-- **`opl-modes`** chat and plan modes swap the active toolset for read-only lists and gate Bash to safe inspection patterns, with destructive-pattern checks that fire even inside otherwise-safe commands. The plan to execute lifecycle keeps exploration and mutation cleanly separated. Add custom modes (like below) for your workflow needs.
+- **`opl-modes`** chat and plan modes swap the active toolset for read-only lists and gate Bash to safe inspection patterns, with destructive-pattern checks that fire even inside otherwise-safe commands (also `find -delete`, `git clean`, `truncate`, `sudo`, and quote-obfuscated `r"m"`; `env`/`printenv` no longer safe-listed). The plan to execute lifecycle keeps exploration and mutation cleanly separated. Add custom modes (like below) for your workflow needs.
 ![custom mode sample](images/ss-mode-custom.png)
 - `load_tools` activation is bounded by the current mode, so a read-only mode cannot be tricked into enabling a write-capable tool.
 
@@ -103,8 +109,8 @@ Cold prompt-cache write, measured /init session (opl-modes lazy tools + MCP adap
 
 - **`opl-init`** writes a fingerprinted `AGENTS.md` so any agent starts already oriented in a repo. It writes a baseline before asking the model to refine the guide, so smaller models cannot leave the update only in chat; it re-runs only when the tree actually changes.
 ![init](images/ss-init.png)
-- **`opl-browser`** gives full Chromium automation (navigate, snapshot, extract rendered-page markdown, interact, screenshot, console/network capture, evaluate) through a single tool, with handle+preview output for large results.
-- **`opl-webaccess`** adds provider-backed search plus readable URL and PDF extraction, with session recovery of earlier results.
+- **`opl-browser`** gives full Chromium automation (navigate, snapshot, extract rendered-page markdown, interact, screenshot, console/network capture, evaluate) through a single tool, with handle+preview output for large results — navigation is http(s)-only and screenshots stay in the project directory.
+- **`opl-webaccess`** adds provider-backed search plus readable URL and PDF extraction, with session recovery of earlier results, an http(s)-only fetch, a 10 MB response cap, and a 30s timeout.
 - **`opl-simplebench`** benchmarks models on deterministic closed-answer contracts, instruction-following, and tool-call generation so you pick a model on evidence, not vibes.
 ![simplebench](images/ss-simplebench.png)
 - **`opl-todo`** tracks branch-aware tasks that persist across a session and reconstruct from history.
@@ -180,7 +186,7 @@ Copy applicable files from [`configs/`](configs/) to `~/.pi/agent/configs/`. For
 - `opl-init` and `opl-questionnaire` have no external configuration.
 - Config files must be valid JSON, with no comments or trailing commas beyond deliberate `_comment` keys.
 - `opl-modes` owns active-mode appearance. Each mode's `appearance.prefix`, `prefixColor`, and `borderColor` style `opl-input`; `appearance.modeColor` styles `opl-footer`'s unified mode label. Renderers retain hardcoded fallbacks.
-  - `opl-modes.bashPatterns` is the shared read-only Bash policy for chat and plan. Use per-mode pattern fields only when those modes intentionally need different policies.
+  - `opl-modes.bashPatterns` is the shared read-only Bash policy now applied to every mode by default; a mode overrides it with its own `safePatterns`/`destructivePatterns` or disables it with `unrestrictedBash: true`.
   - `opl-modes.lazyTools` withholds heavy tool schemas (e.g. `subagent`, `browser`, `simplebench`) from the resting prefix and enables them on demand via `load_tools`, shrinking the per-session prompt-cache write.
 
 See each extension README for commands, behavior, configuration fields, runtime constraints, and architecture.

package/configs/opl-modes.json.sample

@@ -17,8 +17,8 @@
   "_comment_lazyTools": "Tool names withheld from the active set at rest and enabled on demand via the load_tools tool. Only affects modes that would otherwise include them (off/execute and custom modes that list them). Core built-ins, plan_complete, and load_tools are protected and ignored. Omit or leave empty to keep all tools always active.",
   "lazyTools": [],
   "bashPatterns": {
-    "_comment_safe": "Replace-only: providing safePatterns replaces ALL defaults for both built-in chat/plan modes (shared base). Omit to keep built-in safe patterns. Shown here with the built-in list.",
-    "_comment_destructive": "Replace-only: providing destructivePatterns replaces ALL defaults for both built-in chat/plan modes (shared base). Omit to keep built-in destructive patterns. Shown here with the built-in list.",
+    "_comment_safe": "Replace-only: providing bashPatterns.safePatterns replaces the built-in safe list. This is the default safe allowlist for every mode; a mode overrides it with its own safePatterns or opts out of Bash gating with unrestrictedBash. Shown here with the built-in list.",
+    "_comment_destructive": "Replace-only: providing bashPatterns.destructivePatterns replaces the built-in destructive list. This is the default destructive blocklist for every mode; a mode overrides it with its own destructivePatterns or opts out of Bash gating with unrestrictedBash. Shown here with the built-in list.",
     "safePatterns": [
       "^\\s*cat\\b",
       "^\\s*head\\b",
@@ -43,8 +43,6 @@
       "^\\s*which\\b",
       "^\\s*whereis\\b",
       "^\\s*type\\b",
-      "^\\s*env\\b",
-      "^\\s*printenv\\b",
       "^\\s*uname\\b",
       "^\\s*whoami\\b",
       "^\\s*date\\b",
@@ -74,12 +72,14 @@
       "\\btee\\b",
       "\\bdd\\b",
       "\\bshred\\b",
+      "\\btruncate\\b",
+      "\\s-(delete|exec|execdir)\\b",
       "(^|[^<])>(?!>|&)",
       ">>",
       "\\bnpm\\s+(install|uninstall|update|ci)",
       "\\byarn\\s+(add|remove|install)",
       "\\bpip\\s+(install|uninstall)",
-      "\\bgit\\s+(add|commit|push|merge|rebase|reset|checkout|branch\\s+-)",
+      "\\bgit\\s+(add|commit|push|merge|rebase|reset|checkout|branch\\s+-|clean|update-ref|tag\\s+-|cherry-pick|revert|am|apply)",
       "\\bsudo\\b",
       "\\bsu\\b",
       "\\bkill\\b",

package/extensions/opl-browser/README.md

@@ -47,6 +47,9 @@ Full action set: `navigate` (url, or `back`/`forward`/`reload`), `snapshot`,
   a whole-document heuristic and mispicks inside small subtrees.
 - **Real Chromium via Playwright.** Navigation with `domcontentloaded` waits,
   CSS-selector interaction, viewport control, multi-page management.
+- **Scheme + path guards.** `navigate`/`new_page` accept http(s) only; `file:`,
+  `data:`, and `javascript:` are rejected. Screenshot paths are confined to the
+  project directory, so a bad `path` cannot overwrite arbitrary files.
 - **Per-page capture.** Console messages and network requests are buffered per
   page as they occur; `console` and `network` actions return the active page's
   buffer.
@@ -82,6 +85,8 @@ index.ts     Pi wiring: registers the single `browser` tool, TTL result store,
              preview/handle logic, and session_shutdown cleanup.
 browser.ts   Playwright driver: browser/context/page lifecycle, per-page console
              and network buffers, and the action switch.
+validate.ts  URL/path guards: http/https-only navigation, screenshot path confined
+             to the project directory.
 extract.ts   Pure rendered-HTML → markdown pipeline (linkedom + Readability +
              turndown), duplicated from opl-webaccess to keep installs independent.
 config.ts    DEFAULT_CONFIG + loadUserConfig (user overrides win via ??).

package/extensions/opl-browser/browser.ts

@@ -1,5 +1,6 @@
 import { chromium, type Browser, type BrowserContext, type Page, type ConsoleMessage } from "playwright";
 import { extractMarkdown } from "./extract.js";
+import { assertHttpUrl, safeScreenshotPath } from "./validate.js";
 import type { BrowserConfig } from "./config.js";
 
 // ponytail: single module-level Chromium instance reused across tool calls.
@@ -80,7 +81,7 @@ export async function runAction(p: BrowserParams, cfg: BrowserConfig): Promise<B
       if (url === "back") { await page().goBack(); }
       else if (url === "forward") { await page().goForward(); }
       else if (url === "reload") { await page().reload(); }
-      else if (url) { await page().goto(url, { waitUntil: "domcontentloaded" }); }
+      else if (url) { await page().goto(assertHttpUrl(url), { waitUntil: "domcontentloaded" }); }
       else throw new Error("navigate requires url (or back|forward|reload)");
       return { text: `${page().url()} — ${await page().title()}` };
     }
@@ -97,7 +98,7 @@ export async function runAction(p: BrowserParams, cfg: BrowserConfig): Promise<B
       return { text: markdown || "(empty extraction)" };
     }
     case "screenshot": {
-      const file = p.path ?? `opl-browser-${Date.now()}.png`;
+      const file = safeScreenshotPath(p.path ?? `opl-browser-${Date.now()}.png`);
       await page().screenshot({ path: file, fullPage: p.fullPage ?? false });
       return { text: `Screenshot saved to ${file}`, file };
     }
@@ -154,7 +155,7 @@ export async function runAction(p: BrowserParams, cfg: BrowserConfig): Promise<B
       const pg = await ctx.newPage();
       track(pg, cfg);
       activeIndex = ctx.pages().length - 1;
-      if (p.url) await pg.goto(p.url, { waitUntil: "domcontentloaded" });
+      if (p.url) await pg.goto(assertHttpUrl(p.url), { waitUntil: "domcontentloaded" });
       return { text: `Opened page [${activeIndex}] ${pg.url()}` };
     }
     case "select_page": {

package/extensions/opl-browser/validate.ts

@@ -0,0 +1,29 @@
+// Pure URL/path guards for the browser tool. No Playwright import so tests load it directly.
+
+import { resolve, sep } from "node:path";
+
+/** Normalize a URL, allowing only http/https so file:/data:/javascript: URLs can't
+ *  be navigated (file:// + evaluate = local file bytes returned into model context). */
+export function assertHttpUrl(url: string): string {
+  let parsed: URL;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error(`invalid URL: ${url}`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error(`only http/https URLs are allowed, got ${parsed.protocol}//`);
+  }
+  return parsed.href;
+}
+
+/** Require a screenshot path to stay within the project directory (guard against
+ *  overwriting absolute or parent-relative user files with PNG bytes). */
+export function safeScreenshotPath(file: string, cwd: string = process.cwd()): string {
+  const root = resolve(cwd);
+  const abs = resolve(cwd, file);
+  if (abs !== root && !abs.startsWith(root + sep)) {
+    throw new Error(`screenshot path must stay within the project directory: ${file}`);
+  }
+  return file;
+}

package/extensions/opl-modes/README.md

@@ -19,7 +19,9 @@ Plans are Markdown files under `.pi/plans/` with the `plan-` filename prefix. `p
 
 Chat and plan modes replace the active tools with configurable read-only tool lists and restrict Bash to safe inspection patterns. Destructive patterns are checked even when a command matches a safe pattern. User-provided safe and destructive pattern arrays replace the built-in lists, rather than extending them.
 
-Custom modes can add or override modes with prompts, tool lists, Bash patterns, model overrides, visibility, enabled state, `plan_complete` permission, execute-handoff permission, labels, and `appearance`. Appearance is published to `opl-input` and `opl-footer`, so every mode owns its input prefix/border and footer identity color.
+The shared destructive base also blocks file mutation primitives (`rm`, `find -delete`/`-exec`, `truncate`, `git clean`/`update-ref`/`tag -d`, `sudo`, shell spawns, and output redirects). `env` and `printenv` are no longer safe-listed, since they could dump provider API keys into the model context. Destructive matching also runs against a quote/backslash-stripped command skeleton, so `r"m"` cannot dodge `\brm\b`; this is still a heuristic backstop, not a process-isolation boundary.
+
+Custom modes can add or override modes with prompts, tool lists, Bash patterns, model overrides, visibility, enabled state, `plan_complete` permission, execute-handoff permission, labels, and `appearance`. Appearance is published to `opl-input` and `opl-footer`, so every mode owns its input prefix/border and footer identity color. A custom mode that omits its own `safePatterns`/`destructivePatterns` inherits the whole shared base; a mode overrides a component with its own array or disables all gating with `unrestrictedBash: true`. Built-in `off` and `execute` stay unrestricted.
 
 ### Execute handoff
 
@@ -31,7 +33,7 @@ Any mode can start plan execution via the mode picker's `Execute:` entries or `/
 
 A custom mode with no `tools` array inherits **all** tools, including `write` and `edit` — it is write-capable by default. Always specify an explicit read-only tool list for restrictive modes.
 
-Mode state is persisted in session entries and restored on session resume or branch changes. The `mode-switcher` entry type and legacy chat/plan event identifiers are compatibility contracts.
+Mode state is persisted in session entries and restored on session resume or branch changes. The `mode-switcher` entry type and legacy chat/plan event identifiers are compatibility contracts. On resume, an unknown mode name in a session entry is ignored (falling back to normal), and plan filenames containing path separators or `..` are dropped, so a stale or foreign branch cannot leave the session unrestricted or point plan reads outside `.pi/plans/`.
 
 ## Configuration
 
@@ -80,7 +82,8 @@ Create `~/.pi/agent/configs/opl-modes.json` or copy [`configs/opl-modes.json.sam
 | `defaultNotifyTemplate` | Notification template for custom modes; `{Name}` is capitalized mode name. |
 | `modes.chat.tools` / `modes.plan.tools` | Replace the respective built-in read-only tool lists. |
 | `chatAllowedTools` / `planAllowedTools` | **Deprecated compatibility aliases** for the built-in tool lists. They are used only when the corresponding `modes.<name>.tools` is omitted; migrate to `modes.chat.tools` or `modes.plan.tools`. |
-| `bashPatterns.safePatterns` / `bashPatterns.destructivePatterns` | Replace the shared Bash policy for built-in chat and plan. Per-mode pattern fields intentionally override this shared policy when those modes need to differ. |
+| `bashPatterns.safePatterns` / `bashPatterns.destructivePatterns` | Shared Bash policy applied to every mode by default; a mode overrides with its own `modes.<name>.safePatterns`/`destructivePatterns` or disables gating with `modes.<name>.unrestrictedBash: true`. |
+| `modes.<name>.unrestrictedBash` | Set `true` to exempt a custom mode from the Bash policy entirely (no safe/destructive patterns). |
 | `lazyTools` | Tool names withheld from the active set at rest and enabled on demand (see Lazy tool loading below). |
 | `modes.<name>` | Add or override a mode, including `model`, `tools`, patterns, `allowPlanComplete`, `allowExecute`, `visible`, `enabled`, `prompt`, `labels`, and `appearance`. |
 

package/extensions/opl-modes/config.ts

@@ -46,13 +46,13 @@ const DEFAULT_CHAT_MODE_TOOLS: string[] = [
 // ─── Bash Safety ─────────────────────────────────────────────────────────────
 
 /** Default safe command patterns — only these are allowed in read-only modes (chat and plan). */
-const DEFAULT_SAFE_PATTERNS: RegExp[] = [
+export const DEFAULT_SAFE_PATTERNS: RegExp[] = [
   /^\s*cat\b/, /^\s*head\b/, /^\s*tail\b/, /^\s*less\b/, /^\s*more\b/,
   /^\s*grep\b/, /^\s*find\b/, /^\s*ls\b/, /^\s*pwd\b/, /^\s*cd\b/,
   /^\s*echo\b/, /^\s*printf\b/, /^\s*wc\b/, /^\s*sort\b/,
   /^\s*diff\b/, /^\s*file\b/, /^\s*stat\b/, /^\s*du\b/, /^\s*df\b/,
   /^\s*tree\b/, /^\s*which\b/, /^\s*whereis\b/, /^\s*type\b/,
-  /^\s*env\b/, /^\s*printenv\b/, /^\s*uname\b/, /^\s*whoami\b/,
+  /^\s*uname\b/, /^\s*whoami\b/,
   /^\s*date\b/, /^\s*uptime\b/, /^\s*ps\b/, /^\s*free\b/,
   /^\s*rg\b/, /^\s*fd\b/, /^\s*bat\b/, /^\s*jq\b/,
   /^\s*git\s+(status|log|diff|show|branch|remote)/i,
@@ -63,15 +63,16 @@ const DEFAULT_SAFE_PATTERNS: RegExp[] = [
 ];
 
 /** Default destructive command patterns — always blocked in read-only modes, even if matching a safe pattern. */
-const DEFAULT_DESTRUCTIVE_PATTERNS: RegExp[] = [
+export const DEFAULT_DESTRUCTIVE_PATTERNS: RegExp[] = [
   /\brm\b/i, /\brmdir\b/i, /\bmv\b/i, /\bcp\b/i,
   /\bmkdir\b/i, /\btouch\b/i, /\bchmod\b/i, /\bchown\b/i,
-  /\btee\b/i, /\bdd\b/i, /\bshred\b/i,
+  /\btee\b/i, /\bdd\b/i, /\bshred\b/i, /\btruncate\b/i,
+  /\s-(delete|exec|execdir)\b/i,
   /(^|[^<])>(?!>|&)/, />>/,
   /\bnpm\s+(install|uninstall|update|ci)/i,
   /\byarn\s+(add|remove|install)/i,
   /\bpip\s+(install|uninstall)/i,
-  /\bgit\s+(add|commit|push|merge|rebase|reset|checkout|branch\s+-)/i,
+  /\bgit\s+(add|commit|push|merge|rebase|reset|checkout|branch\s+-|clean|update-ref|tag\s+-|cherry-pick|revert|am|apply)/i,
   /\bsudo\b/i, /\bsu\b/i, /\bkill\b/i, /\bpkill\b/i,
   /\b(sh|bash|zsh)\b/i,
   /\b(vim?|nano|emacs|code|subl)\b/i,
@@ -362,6 +363,22 @@ function compilePatterns(patterns: string[] | undefined): RegExp[] | undefined {
   return patterns.map((p) => new RegExp(p, "i"));
 }
 
+/** Resolve the Bash pattern pair for a newly registered custom mode from the shared
+ *  base (top-level bashPatterns), with per-mode overrides and an explicit opt-out.
+ *  Omitted components inherit; explicit arrays (even empty) replace; `unrestrictedBash`
+ *  disables Bash gating entirely for that mode. */
+export function resolveCustomPatterns(def: {
+  safePatterns?: string[];
+  destructivePatterns?: string[];
+  unrestrictedBash?: boolean;
+}): { safe?: RegExp[]; destructive?: RegExp[] } {
+  if (def.unrestrictedBash) return { safe: undefined, destructive: undefined };
+  return {
+    safe: def.safePatterns !== undefined ? compilePatterns(def.safePatterns) : SAFE_COMMAND_PATTERNS,
+    destructive: def.destructivePatterns !== undefined ? compilePatterns(def.destructivePatterns) : DESTRUCTIVE_PATTERNS,
+  };
+}
+
 /** Register a mode with the registry. Called by extensions at startup. */
 export function registerMode(name: string, definition: ModeDefinition): void {
   MODE_REGISTRY.set(name, definition);
@@ -447,11 +464,12 @@ function initModeRegistry(): void {
           appearance: def.appearance ?? existing.appearance,
         });
       } else {
+        const patterns = resolveCustomPatterns(def);
         registerMode(name, {
           prompt: def.prompt ?? "",
           tools: def.tools,
-          safePatterns: compilePatterns(def.safePatterns),
-          destructivePatterns: compilePatterns(def.destructivePatterns),
+          safePatterns: patterns.safe,
+          destructivePatterns: patterns.destructive,
           allowPlanComplete: def.allowPlanComplete ?? false,
           allowExecute: def.allowExecute ?? true,
           visible: def.visible ?? true,

package/extensions/opl-modes/index.ts

@@ -52,6 +52,7 @@ import {
 } from "./config.js";
 import {
   isSafeCommand,
+  isDestructive,
   extractPlanText,
   isPlanLike,
   ensurePlanDir,
@@ -575,10 +576,10 @@ export default function modeSwitcher(pi: ExtensionAPI) {
       }
     }
 
-    // Check destructive patterns (if defined, must not match any)
+    // Check destructive patterns (if defined, must not match any) — also against
+    // a quote/backslash-stripped skeleton so r"m"/r\m obfuscation can't dodge \brm\b.
     if (modeDef.destructivePatterns && modeDef.destructivePatterns.length > 0) {
-      const matchesDestructive = modeDef.destructivePatterns.some((pattern) => pattern.test(command));
-      if (matchesDestructive) {
+      if (isDestructive(command, modeDef.destructivePatterns)) {
         return {
           block: true,
           reason: `[mode-switcher] Command blocked — destructive pattern in ${mode} mode: ${command}`,

package/extensions/opl-modes/state.ts

@@ -88,6 +88,13 @@ function persist(pi: { appendEntry: (type: string, data?: unknown) => void }): v
   } satisfies AgentModeBlob);
 }
 
+/** Reject activePlanFile values that could escape PLAN_DIR via path components or traversal. */
+function normalizePlanFile(file: string | null | undefined): string | null {
+  if (!file) return null;
+  if (file.includes("/") || file.includes("\\") || file.includes("..")) return null;
+  return file;
+}
+
 /**
  * Restore state from the most recent relevant session entry on the current branch.
  * Checks for native mode-switcher entries first; falls back to legacy plan-mode/chat-mode entries
@@ -102,9 +109,11 @@ export function restore(
 
     if (entry.customType === ENTRY_TYPE) {
       const data = entry.data as AgentModeBlob | undefined;
-      if (data?.mode) {
+      // Fail closed: only apply modes the registry actually knows, otherwise a stale or
+      // foreign-branch entry would leave the session unrestricted (no tools, no patterns).
+      if (data?.mode && getModeDefinition(data.mode)) {
         state.mode = data.mode;
-        state.activePlanFile = data.activePlanFile ?? null;
+        state.activePlanFile = normalizePlanFile(data.activePlanFile);
         state.refining = false;
         syncGlobalThis();
         return true;
@@ -121,7 +130,7 @@ export function restore(
       const data = entry.data as { mode?: string; activePlanFile?: string | null } | undefined;
       if (data?.mode === "plan" || data?.mode === "execute") {
         state.mode = data.mode as AgentMode;
-        state.activePlanFile = data.activePlanFile ?? null;
+        state.activePlanFile = normalizePlanFile(data.activePlanFile);
         state.refining = false;
         syncGlobalThis();
         return true;

package/extensions/opl-modes/types.ts

@@ -125,6 +125,8 @@ export interface UserModeDefinition {
   tools?: string[];
   safePatterns?: string[];
   destructivePatterns?: string[];
+  /** Set true to skip Bash gating entirely for this mode (no safe/destructive patterns). */
+  unrestrictedBash?: boolean;
   labels?: ModeLabelConfig;
   appearance?: ModeAppearanceConfig;
   allowPlanComplete?: boolean;

package/extensions/opl-modes/utils.ts

@@ -10,7 +10,14 @@ import type { PlanFileSummary } from "./types.js";
 /** Check if command matches safe patterns and not destructive patterns. */
 export function isSafeCommand(command: string): boolean {
   return SAFE_COMMAND_PATTERNS.some((p) => p.test(command))
-    && !DESTRUCTIVE_PATTERNS.some((p) => p.test(command));
+    && !isDestructive(command, DESTRUCTIVE_PATTERNS);
+}
+
+/** Whether a command, or its quote/backslash-stripped skeleton, matches any destructive
+ *  pattern. Stripping defeats shell expands like `r"m"` -> `rm` that dodge \brm\b. */
+export function isDestructive(command: string, patterns: RegExp[]): boolean {
+  const skeleton = command.replace(/["'\\]/g, "");
+  return patterns.some((p) => p.test(command) || p.test(skeleton));
 }
 
 const PLAN_ACTION_VERB = /^\s*\d+\.\s+(?:\*{1,2})?(?:add|creat|updat|fix|remov|refactor|implement|modif|chang|edit|writ|build|run|install|configur|set\s+up|delet|mov|renam|inject|migrat|replac|extract|test|deploy|integrat|convert)/i;

package/extensions/opl-webaccess/README.md

@@ -14,6 +14,7 @@ Provides configurable web search and readable URL/PDF retrieval with session-bac
 
 - Searches through `gemini`, `tavily`, `ddgs`, `searxng`, or `exa`; multiple queries run concurrently and results include citations where available.
 - Extracts HTML with Readability and Markdown conversion, falls back to full-document Turndown conversion, passes PDF responses to the PDF extractor, and returns plain text, Markdown, and JSON directly.
+- Restricts `fetch_content` to http/https, caps each response at 10 MB, and applies a 30s timeout; Gemini keys are sent via the `x-goog-api-key` header rather than the query string.
 - Caps initial tool output at 30,000 characters, then keeps it for retrieval for one hour or until the session ends.
 - Honors abort signals and returns provider, HTTP, and per-result failures through the tool boundary rather than throwing.
 

package/extensions/opl-webaccess/extract.ts

@@ -2,16 +2,45 @@ import { Readability } from "@mozilla/readability";
 import { parseHTML } from "linkedom";
 import TurndownService from "turndown";
 import { extractPdfBuffer } from "./pdf.js";
-import { errorMessage, isAbortError, isPdfUrl, isPdfContentType } from "./utils.js";
+import { errorMessage, isAbortError, isPdfUrl, isPdfContentType, assertHttpUrl } from "./utils.js";
 import type { ExtractedContent } from "./types.js";
 
 const CONCURRENT_LIMIT = 3;
+const MAX_FETCH_BYTES = 10 * 1024 * 1024; // 10 MB response cap
+const FETCH_TIMEOUT_MS = 30_000;
 
 const td = new TurndownService({
   headingStyle: "atx",
   codeBlockStyle: "fenced",
 });
 
+/** Read a response body into bytes, aborting past maxBytes (guards memory against huge payloads). */
+async function readBufferCapped(response: Response, maxBytes: number): Promise<ArrayBuffer> {
+  const declared = Number(response.headers.get("content-length") ?? "0");
+  if (declared > maxBytes) throw new Error(`Response too large (${declared} bytes)`);
+  const reader = response.body?.getReader();
+  if (!reader) return await response.arrayBuffer();
+  const chunks: Uint8Array[] = [];
+  let total = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > maxBytes) {
+      await reader.cancel().catch(() => {});
+      throw new Error(`Response exceeds ${maxBytes} byte limit`);
+    }
+    chunks.push(value);
+  }
+  const merged = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    merged.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return merged.buffer;
+}
+
 export async function fetchAllContent(
   urls: string[],
   signal?: AbortSignal
@@ -28,8 +57,12 @@ export async function fetchAllContent(
 
 async function fetchOne(url: string, signal?: AbortSignal): Promise<ExtractedContent> {
   try {
-    const response = await fetch(url, {
-      signal,
+    const target = assertHttpUrl(url);
+    const fetchSignal = signal
+      ? AbortSignal.any([signal, AbortSignal.timeout(FETCH_TIMEOUT_MS)])
+      : AbortSignal.timeout(FETCH_TIMEOUT_MS);
+    const response = await fetch(target, {
+      signal: fetchSignal,
       headers: {
         "User-Agent": "Mozilla/5.0 (compatible; pi-web-access/1.0)",
         Accept: "text/html,application/xhtml+xml,application/pdf,*/*",
@@ -43,7 +76,7 @@ async function fetchOne(url: string, signal?: AbortSignal): Promise<ExtractedCon
     const contentType = response.headers.get("content-type") ?? "";
 
     if (isPdfUrl(url) || isPdfContentType(contentType)) {
-      const buffer = await response.arrayBuffer();
+      const buffer = await readBufferCapped(response, MAX_FETCH_BYTES);
       const content = await extractPdfBuffer(buffer);
       return { url, title: url, content, error: null };
     }
@@ -51,7 +84,7 @@ async function fetchOne(url: string, signal?: AbortSignal): Promise<ExtractedCon
     const isHtml =
       contentType.includes("text/html") || contentType.includes("application/xhtml");
 
-    const body = await response.text();
+    const body = new TextDecoder().decode(await readBufferCapped(response, MAX_FETCH_BYTES));
 
     if (!isHtml) {
       // Plain text, markdown, JSON, etc. — return as-is

package/extensions/opl-webaccess/providers/gemini.ts

@@ -27,9 +27,9 @@ export async function searchGemini(
 
   let response: Response;
   try {
-    response = await fetch(`${base}/models/${model}:generateContent?key=${apiKey}`, {
+    response = await fetch(`${base}/models/${model}:generateContent`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: { "Content-Type": "application/json", "x-goog-api-key": apiKey },
       body: JSON.stringify({
         contents: [{ role: "user", parts: [{ text: query }] }],
         tools: [{ google_search: {} }],

package/extensions/opl-webaccess/utils.ts

@@ -26,3 +26,17 @@ export function isPdfUrl(url: string): boolean {
 export function isPdfContentType(contentType: string): boolean {
   return contentType.toLowerCase().includes("application/pdf");
 }
+
+/** Normalize a URL, allowing only http/https (file:/data:/etc. are rejected). */
+export function assertHttpUrl(url: string): string {
+  let parsed: URL;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error(`Invalid URL: ${url}`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error(`Unsupported protocol "${parsed.protocol}//" — only http/https`);
+  }
+  return parsed.href;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openlines/opl-pi-sht",
-  "version": "0.1.18",
+  "version": "0.1.19",
   "description": "Pi coding-agent extension kit: token-efficient context, safe modes, fingerprinted /init, model benchmarking, web access, and browser automation.",
   "repository": {
     "type": "git",