@orion-agents/orion-code 0.1.4 → 0.1.6

package/dist/tools/index.js

@@ -10,9 +10,43 @@
  *
  * 使用 buildTool() 工厂模式。
  */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.findDestructiveRmTarget = exports.assessCommandSecurity = exports.isPotentiallyDestructive = exports.checkDangerousCommand = exports.isReadOnlyCommand = exports.POTENTIALLY_DESTRUCTIVE_PATTERNS = exports.DANGEROUS_PATTERNS = exports.READ_ONLY_COMMANDS = exports.TOOLS = exports.BATCH_READ_MAX_STEPS = exports.BATCH_READ_ALLOWED_TOOLS = void 0;
 exports.getRuntimeTools = getRuntimeTools;
+exports.validateRegexPattern = validateRegexPattern;
 exports.executeTool = executeTool;
 exports.getToolNames = getToolNames;
 const child_process_1 = require("child_process");
@@ -20,12 +54,13 @@ const fs_1 = require("fs");
 const path_1 = require("path");
 const readline_1 = require("readline");
 const tool_1 = require("../framework/tool");
+const tool_scheduler_1 = require("../framework/tool-scheduler");
 const external_assertion_1 = require("../framework/external-assertion");
 const tool_state_1 = require("../framework/tool-state");
 const tool_artifacts_1 = require("../core/tool-artifacts");
 const environment_1 = require("../product/environment");
-const memory_1 = require("../memory");
-const semantic_search_1 = require("../memory/semantic-search");
+const storage_1 = require("../memory/storage");
+const semantic_config_1 = require("../memory/semantic-config");
 const session_storage_1 = require("../services/session-storage");
 const web_1 = require("./web");
 const mcp_1 = require("./mcp");
@@ -168,7 +203,6 @@ exports.TOOLS = [
         isDestructive: () => true,
         isFileEdit: () => true,
         checkPermissions: (_args, _context) => {
-            // Destructive operation - ask for confirmation in default mode
             return { behavior: 'ask', reason: 'Write operation may modify existing files' };
         },
         userFacingName: args => `Write ${args.path}`,
@@ -252,7 +286,7 @@ exports.TOOLS = [
         },
         isDestructive: args => {
             const cmd = args.command || '';
-            return /(rm\s+-rf|mkfs|dd\s)/.test(cmd);
+            return (0, bash_security_1.containsRecursiveRm)(cmd) || /(?:^|[;&|]\s*)(?:[^\s]+\/)?(?:mkfs|dd)(?:\s|$)/.test(cmd);
         },
         checkPermissions: (args, context) => {
             const cmd = args.command || '';
@@ -266,11 +300,15 @@ exports.TOOLS = [
             }
             // v0.1.3-2 §1.2: a configured-but-unusable sandbox is a hard deny, decided
             // here so the user sees the reason instead of an opaque execution failure.
-            const workdir = context?.cwd ?? process.cwd();
-            const sandboxSettings = (0, sandbox_1.resolveSandboxSettings)(workdir);
+            const { workdir, projectRoot } = resolveExecCommandPaths(args.cwd, context?.cwd);
+            const sandboxSettings = (0, sandbox_1.resolveSandboxSettings)(projectRoot);
             let sandboxNote = '';
             if ((sandboxSettings.profile ?? 'none') !== 'none') {
-                const plan = (0, sandbox_1.planSandboxedCommand)(cmd, { cwd: workdir, settings: sandboxSettings });
+                const plan = (0, sandbox_1.planSandboxedCommand)(cmd, {
+                    cwd: workdir,
+                    projectRoot,
+                    settings: sandboxSettings,
+                });
                 if (!plan.ok) {
                     return {
                         behavior: 'deny',
@@ -560,12 +598,13 @@ exports.TOOLS = [
                     createdAt: Date.now(),
                     updatedAt: Date.now(),
                 };
-                if ((0, semantic_search_1.isSemanticEnabled)()) {
+                if ((0, semantic_config_1.isSemanticEnabled)()) {
                     // saveAndIndex internally calls saveMemory + vectorStore.upsert
-                    await (0, semantic_search_1.getSemanticSearchService)().saveAndIndex(entry, projectPath);
+                    const { getSemanticSearchService } = await Promise.resolve().then(() => __importStar(require('../memory/semantic-search')));
+                    await getSemanticSearchService().saveAndIndex(entry, projectPath);
                 }
                 else {
-                    (0, memory_1.saveMemory)(entry, projectPath);
+                    (0, storage_1.saveMemory)(entry, projectPath);
                 }
                 return { success: true, output: `Saved memory: ${name} (${type})` };
             }
@@ -607,11 +646,12 @@ exports.TOOLS = [
                 const query = args.query || '';
                 const type = args.type;
                 let memories;
-                if (query && (0, semantic_search_1.isSemanticEnabled)()) {
+                if (query && (0, semantic_config_1.isSemanticEnabled)()) {
                     // Semantic path: ask the vector store, then fall back to keywords if it
                     // returns nothing (e.g. embedding provider unreachable, empty index)
                     try {
-                        const result = await (0, semantic_search_1.getSemanticSearchService)().search({
+                        const { getSemanticSearchService } = await Promise.resolve().then(() => __importStar(require('../memory/semantic-search')));
+                        const result = await getSemanticSearchService().search({
                             query,
                             projectPath,
                             type,
@@ -625,26 +665,26 @@ exports.TOOLS = [
                             updatedAt: m.createdAt,
                         }));
                         if (memories.length === 0) {
-                            memories = (0, memory_1.searchMemories)(query, projectPath);
+                            memories = (0, storage_1.searchMemories)(query, projectPath);
                             if (type)
                                 memories = memories.filter(m => m.type === type);
                         }
                     }
                     catch (error) {
                         (0, debug_log_1.debugError)('tools.memory.semanticSearch', error, query);
-                        memories = (0, memory_1.searchMemories)(query, projectPath);
+                        memories = (0, storage_1.searchMemories)(query, projectPath);
                         if (type)
                             memories = memories.filter(m => m.type === type);
                     }
                 }
                 else if (type) {
-                    memories = (0, memory_1.loadAllMemories)(projectPath).filter(m => m.type === type);
+                    memories = (0, storage_1.loadAllMemories)(projectPath).filter(m => m.type === type);
                 }
                 else if (query) {
-                    memories = (0, memory_1.searchMemories)(query, projectPath);
+                    memories = (0, storage_1.searchMemories)(query, projectPath);
                 }
                 else {
-                    memories = (0, memory_1.loadAllMemories)(projectPath);
+                    memories = (0, storage_1.loadAllMemories)(projectPath);
                 }
                 if (memories.length === 0) {
                     return { success: true, output: 'No memories found' };
@@ -694,12 +734,12 @@ exports.TOOLS = [
             }
             try {
                 const projectPath = context?.cwd || process.cwd();
-                const existing = (0, memory_1.loadMemory)(name, projectPath);
+                const existing = (0, storage_1.loadMemory)(name, projectPath);
                 if (!existing) {
                     return { success: false, output: '', error: `Memory not found: ${name}` };
                 }
-                (0, memory_1.deleteMemory)(name, projectPath);
-                if ((0, semantic_search_1.isSemanticEnabled)()) {
+                (0, storage_1.deleteMemory)(name, projectPath);
+                if ((0, semantic_config_1.isSemanticEnabled)()) {
                     try {
                         const { getVectorStore } = require('../memory/vector-store');
                         getVectorStore().delete(name, projectPath);
@@ -916,6 +956,56 @@ function safeReadFileSync(resolved) {
 function safePath(input, cwd = process.cwd()) {
     return (0, path_1.resolve)(cwd, normalizeToolPath(input));
 }
+/**
+ * Return true when `p` resolves (after following symlinks) to a location at or
+ * under `rootReal`. Used to enforce that a realpath is still inside the
+ * workspace even when directories along the path are themselves symlinks.
+ */
+function isUnderRealRoot(p, rootReal) {
+    const rel = (0, path_1.relative)(rootReal, p);
+    return rel === '' || (!rel.startsWith('..') && !(0, path_1.isAbsolute)(rel));
+}
+/**
+ * Contain a tool-resolved path inside the workspace root (cwd).
+ *
+ * Blocks `../` traversal and absolute paths outside the workspace, which would
+ * otherwise let `write_file`/`edit_file` scribble over `~/.bashrc`, SSH config
+ * or other projects — especially dangerous under `acceptEdits` auto-approval,
+ * where the write runs without a confirmation prompt (issue #65).
+ *
+ * Containment is lexical first, then re-checked after resolving symlinks
+ * (issue #99): a workspace symlink that points outside the workspace must not
+ * be followed into an arbitrary write target. We resolve the realpath of the
+ * parent directory (which also collapses any intermediate symlinked dirs) and,
+ * if the target already exists, the target itself; if either escapes the
+ * workspace we refuse. The workspace root is also realpath-resolved so a
+ * symlinked cwd does not produce false rejections. Fail-closed on any
+ * filesystem error.
+ */
+function isWithinWorkspace(resolved, cwd) {
+    const root = (0, path_1.resolve)(cwd);
+    const rel = (0, path_1.relative)(root, resolved);
+    if (!(rel === '' || (!rel.startsWith('..') && !(0, path_1.isAbsolute)(rel))))
+        return false;
+    try {
+        const rootReal = (0, fs_1.realpathSync)(root);
+        const realParent = (0, fs_1.realpathSync)((0, path_1.dirname)(resolved));
+        if (!isUnderRealRoot(realParent, rootReal))
+            return false;
+        // Only the existing target needs its own realpath check; a brand-new file
+        // inherits the (already-validated) containment of its parent directory.
+        if ((0, fs_1.existsSync)(resolved)) {
+            const realTarget = (0, fs_1.realpathSync)(resolved);
+            if (!isUnderRealRoot(realTarget, rootReal))
+                return false;
+        }
+    }
+    catch {
+        // A missing/unknowable realpath means we cannot prove containment — refuse.
+        return false;
+    }
+    return true;
+}
 /**
  * Truncate text to at most maxBytes UTF-8 bytes, cutting on a character
  * boundary (never inside a multi-byte sequence or surrogate pair). Returns the
@@ -1015,6 +1105,14 @@ async function writeFileSync_(path, content, cwd) {
     try {
         const normalizedPath = normalizeToolPath(path);
         const resolved = safePath(path, cwd);
+        const workspaceRoot = cwd ?? process.cwd();
+        if (!isWithinWorkspace(resolved, workspaceRoot)) {
+            return {
+                success: false,
+                output: '',
+                error: `Refusing to write outside the workspace: ${normalizedPath}`,
+            };
+        }
         (0, fs_1.writeFileSync)(resolved, content, 'utf-8');
         return {
             success: true,
@@ -1069,14 +1167,22 @@ async function listFiles_(path, maxDepth, cwd) {
     return { success: true, output };
 }
 // Issue #32 #3.2: execCommand_ 支持 abortSignal
+function resolveExecCommandPaths(cwd, baseCwd) {
+    const projectRoot = baseCwd ?? process.cwd();
+    return {
+        workdir: cwd ? safePath(cwd, projectRoot) : projectRoot,
+        projectRoot,
+    };
+}
 async function execCommand_(command, cwd, timeout, maxOutput, abortSignal, baseCwd, sandbox) {
-    const workdir = cwd ? safePath(cwd, baseCwd) : (baseCwd ?? process.cwd());
+    const { workdir, projectRoot } = resolveExecCommandPaths(cwd, baseCwd);
     // v0.1.3-2 §1.2: plan the (possibly sandboxed) argv before spawning. A
     // configured sandbox that cannot be honoured must refuse the command rather
     // than silently degrade into an unsandboxed run.
     const plan = (0, sandbox_1.planSandboxedCommand)(command, {
         cwd: workdir,
-        settings: sandbox ?? (0, sandbox_1.resolveSandboxSettings)(baseCwd ?? process.cwd()),
+        projectRoot,
+        settings: sandbox ?? (0, sandbox_1.resolveSandboxSettings)(projectRoot),
     });
     if (!plan.ok) {
         return {
@@ -1108,6 +1214,11 @@ async function execCommand_(command, cwd, timeout, maxOutput, abortSignal, baseC
             cwd: workdir,
             detached: useProcessGroup,
         });
+        // Issue #53: exec_command runs a complete command as a single argv element
+        // and never pipes input into it. If stdin stays open, stdin-reading commands
+        // (cat, sort, grep, `python3 -`, ...) block waiting for EOF until the timeout.
+        // Close it immediately so the child receives EOF and can proceed.
+        child.stdin?.end();
         let stdoutData = '';
         let stderrData = '';
         let stdoutTruncated = false;
@@ -1189,13 +1300,19 @@ async function execCommand_(command, cwd, timeout, maxOutput, abortSignal, baseC
         child.stdout.on('data', (data) => {
             if (!stdoutTruncated) {
                 const chunk = data.toString();
-                stdoutBytes += chunk.length;
-                if (stdoutBytes > maxBytes) {
+                // Issue #30: count UTF-8 bytes, not UTF-16 code units, so CJK/emoji
+                // output is bounded by `maxBytes` (a UTF-16 count could exceed it ~2x).
+                const chunkBytes = Buffer.byteLength(chunk, 'utf8');
+                if (stdoutBytes + chunkBytes > maxBytes) {
                     stdoutTruncated = true;
-                    stdoutData += chunk.slice(0, maxBytes - stdoutData.length);
+                    const room = Math.max(0, maxBytes - stdoutBytes);
+                    // Byte-accurate truncation that respects multi-byte character boundaries.
+                    stdoutData += truncateToBytes(chunk, room).text;
+                    stdoutBytes = maxBytes;
                 }
                 else {
                     stdoutData += chunk;
+                    stdoutBytes += chunkBytes;
                 }
             }
         });
@@ -1203,13 +1320,17 @@ async function execCommand_(command, cwd, timeout, maxOutput, abortSignal, baseC
         child.stderr.on('data', (data) => {
             if (!stderrTruncated) {
                 const chunk = data.toString();
-                stderrBytes += chunk.length;
-                if (stderrBytes > maxBytes) {
+                // Issue #30: count UTF-8 bytes, not UTF-16 code units.
+                const chunkBytes = Buffer.byteLength(chunk, 'utf8');
+                if (stderrBytes + chunkBytes > maxBytes) {
                     stderrTruncated = true;
-                    stderrData += chunk.slice(0, maxBytes - stderrData.length);
+                    const room = Math.max(0, maxBytes - stderrBytes);
+                    stderrData += truncateToBytes(chunk, room).text;
+                    stderrBytes = maxBytes;
                 }
                 else {
                     stderrData += chunk;
+                    stderrBytes += chunkBytes;
                 }
             }
         });
@@ -1217,7 +1338,7 @@ async function execCommand_(command, cwd, timeout, maxOutput, abortSignal, baseC
             if (interrupted === 'aborted') {
                 finish({
                     success: false,
-                    output: stdoutData.slice(0, maxBytes),
+                    output: truncateToBytes(stdoutData, maxBytes).text,
                     error: 'Command aborted by user',
                 });
                 return;
@@ -1225,7 +1346,7 @@ async function execCommand_(command, cwd, timeout, maxOutput, abortSignal, baseC
             if (interrupted === 'timeout') {
                 finish({
                     success: false,
-                    output: stdoutData.slice(0, maxBytes),
+                    output: truncateToBytes(stdoutData, maxBytes).text,
                     error: `Command timed out after ${timeoutMs}ms`,
                 });
                 return;
@@ -1375,6 +1496,14 @@ async function editFile_(path, old_string, new_string, replace_all, fuzzy_match,
     try {
         const normalizedPath = normalizeToolPath(path);
         const resolved = safePath(path, cwd);
+        const workspaceRoot = cwd ?? process.cwd();
+        if (!isWithinWorkspace(resolved, workspaceRoot)) {
+            return {
+                success: false,
+                output: '',
+                error: `Refusing to edit outside the workspace: ${normalizedPath}`,
+            };
+        }
         if (!(0, fs_1.existsSync)(resolved)) {
             return { success: false, output: '', error: `File not found: ${normalizedPath}` };
         }
@@ -1511,6 +1640,33 @@ async function editFile_(path, old_string, new_string, replace_all, fuzzy_match,
 function escapeRegExp(str) {
     return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
+/**
+ * Validate a caller-supplied regular expression pattern before compiling it.
+ *
+ * Issue #79: `grep_` compiles user/model-supplied patterns with `new RegExp`
+ * directly. A pathological pattern with a quantified group that itself contains
+ * a quantifier (e.g. `(a+)+`, `(\d+)*`) triggers catastrophic backtracking
+ * (ReDoS) and can hang the process on adversarial input (prompt injection).
+ * Reject empty/oversized patterns and the classic nested-quantifier shapes.
+ */
+function validateRegexPattern(pattern) {
+    if (!pattern)
+        return 'pattern must not be empty';
+    if (pattern.length > 2000)
+        return 'pattern is too long (max 2000 characters)';
+    // A group containing an internal quantifier, then quantified again: the
+    // canonical exponential-backtracking construction.
+    if (/\([^()]*[*+?][^()]*\)\s*[*+?]/.test(pattern)) {
+        return 'pattern contains a quantified group with an internal quantifier — this risks catastrophic backtracking (ReDoS)';
+    }
+    try {
+        new RegExp(pattern);
+    }
+    catch {
+        return 'pattern is not a valid regular expression';
+    }
+    return null;
+}
 // ============================================================================
 // Glob/Grep 工具实现
 // ============================================================================
@@ -1614,6 +1770,10 @@ async function grep_(pattern, basePath, globPattern, contextLines, cwd) {
         if (!(0, fs_1.existsSync)(base)) {
             return { success: false, output: '', error: `Path not found: ${normalizedBasePath}` };
         }
+        const patternError = validateRegexPattern(pattern);
+        if (patternError) {
+            return { success: false, output: '', error: `Invalid grep pattern: ${patternError}` };
+        }
         const regex = new RegExp(pattern);
         const context = contextLines ?? 0;
         const results = [];
@@ -1841,6 +2001,72 @@ async function executeBatchRead(args, context) {
                 },
             ], error);
         }
+        // The scheduler resolved permissions for `batch_read` itself, not for the
+        // tools it fans out to. Without re-running the gate here, a project
+        // `deny: read_file(*.env)` rule -- and the plan-mode block -- apply to the
+        // flat call but not to the batched one, so the model can read a denied path
+        // simply by wrapping it in `batch_read`.
+        const stepPermission = (0, tool_1.getToolMetadataPresence)(tool).hasPermissionCheck && tool.checkPermissions
+            ? tool.checkPermissions(step.args, context)
+            : undefined;
+        const effective = (0, tool_scheduler_1.resolveEffectivePermission)({
+            toolName: step.tool,
+            tool,
+            args: step.args,
+            permission: stepPermission,
+            permissionMode: context.permissionMode,
+            allowlist: context.toolAllowlist?.(step.tool, step.args),
+        });
+        if (effective.outcome === 'deny' || effective.outcome === 'block') {
+            const error = effective.reason || `Tool ${step.tool} is not permitted (${effective.source ?? 'policy'})`;
+            return buildBatchReadPayload(false, error, [
+                {
+                    index: i + 1,
+                    tool: step.tool,
+                    args: step.args,
+                    success: false,
+                    error,
+                    output: '',
+                },
+            ], error);
+        }
+        if (effective.outcome === 'confirm') {
+            const confirmation = context.toolConfirmation ?? 'ask';
+            if (confirmation === 'deny' || !context.confirmToolUse) {
+                const error = confirmation === 'deny'
+                    ? `Tool ${step.tool} requires confirmation and was denied by toolConfirmation=deny.`
+                    : effective.reason || `Tool ${step.tool} requires user confirmation.`;
+                return buildBatchReadPayload(false, error, [
+                    {
+                        index: i + 1,
+                        tool: step.tool,
+                        args: step.args,
+                        success: false,
+                        error,
+                        output: '',
+                    },
+                ], error);
+            }
+            const approved = await context.confirmToolUse({
+                name: step.tool,
+                args: step.args,
+                reason: effective.reason,
+                abortSignal: context.abortSignal,
+            });
+            if (!approved) {
+                const error = `Tool ${step.tool} requires user confirmation and was denied by user.`;
+                return buildBatchReadPayload(false, error, [
+                    {
+                        index: i + 1,
+                        tool: step.tool,
+                        args: step.args,
+                        success: false,
+                        error,
+                        output: '',
+                    },
+                ], error);
+            }
+        }
     }
     const stepResults = [];
     for (let i = 0; i < parsed.steps.length; i++) {
@@ -1902,6 +2128,12 @@ async function executeTool(name, args, abortSignal, toolContext) {
         abortSignal, // Issue #32 #3.2: 透传 abortSignal
         sessionId: toolContext?.sessionId,
         turnId: toolContext?.turnId,
+        // Must survive the rebuild: batch_read re-runs the permission gate on its
+        // sub-steps and reads both of these off the context.
+        permissionMode: toolContext?.permissionMode,
+        toolAllowlist: toolContext?.toolAllowlist,
+        toolConfirmation: toolContext?.toolConfirmation,
+        confirmToolUse: toolContext?.confirmToolUse,
     };
     const result = await tool.execute(args, context);
     // Assertions are generated by the runtime allowlist, never accepted from a