@persistmemory/cli 0.4.0 → 0.6.0

package/dist/index.js

@@ -1402,7 +1402,7 @@ function shortDate(iso) {
 }
 
 // src/help.ts
-var VERSION = true ? "0.4.0" : versionFromManifest();
+var VERSION = true ? "0.6.0" : versionFromManifest();
 var PACKAGE = "@persistmemory/cli";
 var HELP = `
   pm \u2014 PersistMemory from your terminal
@@ -1444,14 +1444,18 @@ var HELP = `
     remember -                       capture whatever is piped in
     remember --file <path>           capture a file's contents
 
-    agent                            answer file requests from this machine.
-                                     Reads ~/Desktop, ~/Documents and
-                                     ~/Downloads by default, and nothing
-                                     outside them. It stays in the foreground.
-                                     Background it, and stop it later, with:
+    agent                            answer file and command requests from this
+                                     machine. Reads anywhere on it \u2014 you
+                                     approve every request first, and see the
+                                     exact path or command before you do.
+                                     Stays in the foreground; background it
+                                     and stop it later with:
                                        nohup pm agent > ~/agent.log 2>&1 &
                                        pkill -f "pm agent"
-    agent --root <dir> [--root ...]  choose the folders yourself instead
+    agent --root <dir> [--root ...]  narrow it to these folders, for this run
+
+    A command that reaches the network, or that runs a language, is refused by
+    this machine whatever anybody approves.
 
     search <query>                   search your memory
     list memories                    the most recent memories
@@ -2065,8 +2069,8 @@ async function readStdin() {
 // src/commands/agent.ts
 import { hostname } from "node:os";
 import { homedir as homedir2 } from "node:os";
-import { basename, join as join4, resolve as resolve3 } from "node:path";
-import { existsSync as existsSync4, readFileSync as readFileSync4, readdirSync, statSync as statSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { basename, join as join5, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync5, readFileSync as readFileSync5, readdirSync, statSync as statSync3, writeFileSync as writeFileSync4 } from "node:fs";
 
 // src/files.ts
 import { existsSync as existsSync3, readFileSync as readFileSync3, realpathSync, statSync, writeFileSync as writeFileSync3 } from "node:fs";
@@ -2174,6 +2178,250 @@ ${head.join("\n")}`;
   ].join("\n");
 }
 
+// src/commands/run-command.ts
+import { spawn as spawn2 } from "node:child_process";
+import { existsSync as existsSync4, readFileSync as readFileSync4, statSync as statSync2 } from "node:fs";
+import { isAbsolute as isAbsolute2, join as join4, resolve as resolvePath } from "node:path";
+var CLASSES = new Map([
+  // Reads. Report on the filesystem and change nothing.
+  ...[
+    "ls",
+    "cat",
+    "head",
+    "tail",
+    "wc",
+    "file",
+    "stat",
+    "du",
+    "df",
+    "find",
+    "grep",
+    "rg",
+    "fd",
+    "tree",
+    "pwd",
+    "date",
+    "uname",
+    "which",
+    "echo",
+    "sort",
+    "uniq",
+    "diff",
+    "basename",
+    "dirname",
+    "realpath",
+    "ps",
+    "env"
+  ].map((name) => [name, "read"]),
+  // Writes. Recoverable or not, they change the machine.
+  ...[
+    "rm",
+    "mv",
+    "cp",
+    "mkdir",
+    "rmdir",
+    "touch",
+    "chmod",
+    "chown",
+    "ln",
+    "tee",
+    "truncate",
+    "dd",
+    "kill",
+    "killall",
+    "make",
+    "cargo",
+    "swift",
+    "xcodebuild",
+    "gradle",
+    "docker",
+    "brew",
+    "apt",
+    "yum"
+  ].map((name) => [name, "write"]),
+  // A way out. See the trifecta note above.
+  ...["curl", "wget", "nc", "ncat", "telnet", "ssh", "scp", "rsync", "ftp", "http", "httpie"].map((name) => [name, "network"]),
+  // Every command at once, wearing one name.
+  ...["sh", "bash", "zsh", "fish", "python", "python3", "node", "ruby", "perl", "osascript", "eval"].map((name) => [name, "interpreter"])
+]);
+var SUBCOMMAND_READS = /* @__PURE__ */ new Map([
+  [
+    "git",
+    /* @__PURE__ */ new Set([
+      "status",
+      "log",
+      "diff",
+      "show",
+      "branch",
+      "remote",
+      "describe",
+      "blame",
+      "shortlog",
+      "ls-files",
+      "rev-parse",
+      "config"
+    ])
+  ],
+  ["npm", /* @__PURE__ */ new Set(["ls", "list", "view", "outdated", "why", "config"])],
+  ["yarn", /* @__PURE__ */ new Set(["list", "why", "info", "config"])],
+  ["docker", /* @__PURE__ */ new Set(["ps", "images", "logs", "inspect"])]
+]);
+var MAX_OUTPUT_BYTES = 256 * 1024;
+var TIMEOUT_MS = 2e4;
+function describe2(argv) {
+  return argv.join(" ");
+}
+function programOf(argv) {
+  const first = argv[0] ?? "";
+  return first.split("/").pop() ?? first;
+}
+function classify(argv, policy) {
+  const program = programOf(argv);
+  if (policy.allow.includes(program)) return "read";
+  const reads = SUBCOMMAND_READS.get(program);
+  if (reads) {
+    const sub = argv.slice(1).find((one) => !one.startsWith("-"));
+    return sub && reads.has(sub) ? "read" : "write";
+  }
+  return CLASSES.get(program) ?? "unknown";
+}
+function judge(argv, policy) {
+  const program = programOf(argv);
+  if (!argv[0]) {
+    return { commandClass: "unknown", automatic: false, refusal: "No command was given.", reason: "empty" };
+  }
+  if (policy.deny.includes(program)) {
+    return {
+      commandClass: "unknown",
+      automatic: false,
+      refusal: `This machine refuses "${program}".`,
+      reason: "on this machine's deny list"
+    };
+  }
+  const commandClass = classify(argv, policy);
+  if (commandClass === "network") {
+    return {
+      commandClass,
+      automatic: false,
+      refusal: `"${program}" can reach the network. This machine will not run it, and no approval enables it: a command that reads private files and can also send them is the one combination nobody can review by looking at it.`,
+      reason: "reads private data and has a way out"
+    };
+  }
+  if (commandClass === "interpreter") {
+    return {
+      commandClass,
+      automatic: false,
+      refusal: `"${program}" runs a language, which is every command at once. Ask for the specific command instead.`,
+      reason: "an interpreter is not one command"
+    };
+  }
+  const outside = pathOutsideRoots(argv, policy.roots);
+  if (outside) {
+    return {
+      commandClass,
+      automatic: false,
+      refusal: `${outside} is outside the folders this machine may read.`,
+      reason: "outside the roots"
+    };
+  }
+  if (policy.mode === "plan") {
+    return {
+      commandClass,
+      automatic: false,
+      reason: "this machine is in plan mode and runs nothing"
+    };
+  }
+  return {
+    commandClass,
+    automatic: policy.mode === "auto-read" && commandClass === "read",
+    reason: commandClass === "read" ? "reads and changes nothing" : commandClass === "write" ? "changes this machine" : "not a command this machine recognises"
+  };
+}
+function pathOutsideRoots(argv, roots) {
+  for (const argument of argv.slice(1)) {
+    if (argument.startsWith("-")) continue;
+    if (!argument.startsWith("/") && !argument.startsWith("~") && !argument.startsWith(".") && !argument.includes("/")) {
+      continue;
+    }
+    const resolved = expand(argument, roots[0] ?? process.cwd());
+    if (!roots.some((root) => resolved === root || resolved.startsWith(`${root}/`))) {
+      return argument;
+    }
+  }
+  return void 0;
+}
+function expand(argument, base) {
+  const home = process.env["HOME"] ?? "";
+  const withHome = argument.startsWith("~") ? join4(home, argument.slice(1)) : argument;
+  return isAbsolute2(withHome) ? resolvePath(withHome) : resolvePath(base, withHome);
+}
+async function runCommand(argv, policy) {
+  const verdict = judge(argv, policy);
+  if (verdict.refusal) return { ok: false, text: verdict.refusal };
+  if (policy.mode === "plan") {
+    return { ok: false, text: `Plan mode: this machine did not run \`${describe2(argv)}\`.` };
+  }
+  const cwd = policy.roots[0];
+  if (!cwd) return { ok: false, text: "This machine has no folders it may read." };
+  try {
+    if (!statSync2(cwd).isDirectory()) return { ok: false, text: `${cwd} is not a folder.` };
+  } catch {
+    return { ok: false, text: `${cwd} does not exist.` };
+  }
+  return new Promise((resolve8) => {
+    const child = spawn2(argv[0], argv.slice(1), {
+      cwd,
+      // NO shell. With one, every character a model can produce is a character
+      // the shell can act on, and the argument list stops meaning anything.
+      shell: false,
+      /*
+              A bare environment.
+      
+              This process holds the credential that authorises the machine, and
+              handing it to a subprocess a model chose would mean `env` — or anything
+              that prints its environment — returning that key.
+            */
+      env: {
+        PATH: process.env["PATH"] ?? "/usr/bin:/bin",
+        HOME: process.env["HOME"] ?? "",
+        LANG: process.env["LANG"] ?? "C"
+      }
+    });
+    let output = "";
+    let truncated = false;
+    const collect = (chunk) => {
+      if (truncated) return;
+      output += chunk.toString("utf8");
+      if (output.length > MAX_OUTPUT_BYTES) {
+        output = output.slice(0, MAX_OUTPUT_BYTES);
+        truncated = true;
+        child.kill("SIGKILL");
+      }
+    };
+    child.stdout.on("data", collect);
+    child.stderr.on("data", collect);
+    const timer = setTimeout(() => child.kill("SIGKILL"), TIMEOUT_MS);
+    child.on("error", (error) => {
+      clearTimeout(timer);
+      resolve8({ ok: false, text: `Could not run it: ${error.message}` });
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      const notes = [
+        truncated ? `
+
+[output cut off at ${MAX_OUTPUT_BYTES} bytes]` : "",
+        code !== 0 && code !== null ? `
+
+[exit code ${code}]` : ""
+      ].join("");
+      resolve8({ ok: code === 0, text: `$ ${describe2(argv)}
+
+${output}${notes}` });
+    });
+  });
+}
+
 // src/commands/agent.ts
 async function said(response, fallback) {
   const body = await response.json().catch(() => void 0);
@@ -2197,18 +2445,32 @@ function locate(roots, requested) {
   throw new Error(`${requested} is not inside any allowed folder (${roots.join(", ")})`);
 }
 function uncontested(target) {
-  if (!existsSync4(target)) return target;
+  if (!existsSync5(target)) return target;
   const dot = target.lastIndexOf(".");
   const stem = dot > target.lastIndexOf("/") && dot !== -1 ? target.slice(0, dot) : target;
   const extension = stem === target ? "" : target.slice(dot);
   for (let n = 1; n < 1e3; n += 1) {
     const candidate = `${stem} (${n})${extension}`;
-    if (!existsSync4(candidate)) return candidate;
+    if (!existsSync5(candidate)) return candidate;
   }
   throw new Error(`${target} and a thousand names beside it are taken.`);
 }
 async function answer(context, apiUrl, token, roots, request) {
   let located;
+  if (request.kind === "run_command") {
+    if (!request.argv || request.argv.length === 0) {
+      return { ok: false, error: "No command was given." };
+    }
+    const policy = { mode: "ask", allow: [], deny: [], roots };
+    const outcome = await runCommand(request.argv, policy);
+    if (!outcome.ok) return { ok: false, error: outcome.text };
+    return upload(
+      apiUrl,
+      token,
+      `${(request.argv[0] ?? "output").split("/").pop()}.txt`,
+      Buffer.from(outcome.text, "utf8")
+    );
+  }
   try {
     located = locate(roots, request.path);
   } catch (error) {
@@ -2229,10 +2491,10 @@ async function answer(context, apiUrl, token, roots, request) {
     }
     try {
       let target = located;
-      if (existsSync4(located) && statSync2(located).isDirectory()) {
+      if (existsSync5(located) && statSync3(located).isDirectory()) {
         const disposition = fetched.headers.get("content-disposition") ?? "";
         const named = /filename="([^"]+)"/.exec(disposition)?.[1];
-        target = join4(located, basename(named ?? "file"));
+        target = join5(located, basename(named ?? "file"));
       }
       target = uncontested(target);
       writeFileSync4(target, downloaded, { flag: "wx" });
@@ -2255,12 +2517,12 @@ ${downloaded.length} bytes
   let filename = request.path.split("/").pop() ?? "file";
   if (request.kind === "list_dir") {
     try {
-      const stats = statSync2(located);
+      const stats = statSync3(located);
       if (!stats.isDirectory()) return { ok: false, error: `${request.path} is not a folder.` };
       const entries = readdirSync(located, { withFileTypes: true }).filter((entry) => !entry.name.startsWith(".")).slice(0, MAX_LISTED).map((entry) => {
         if (entry.isDirectory()) return `${entry.name}/`;
         try {
-          return `${entry.name}  ${sizeOf(join4(located, entry.name))}`;
+          return `${entry.name}  ${sizeOf(join5(located, entry.name))}`;
         } catch {
           return entry.name;
         }
@@ -2278,9 +2540,9 @@ ${listing}
     }
   }
   try {
-    const stats = statSync2(located);
+    const stats = statSync3(located);
     if (!stats.isFile()) return { ok: false, error: `${request.path} is not a file.` };
-    bytes = readFileSync4(located);
+    bytes = readFileSync5(located);
   } catch (error) {
     return { ok: false, error: error instanceof Error ? error.message : "could not read it" };
   }
@@ -2320,18 +2582,9 @@ async function upload(apiUrl, token, filename, bytes) {
   if (!stored.attachToken) return { ok: false, error: "the upload returned no reference" };
   return { ok: true, attachToken: stored.attachToken, bytes: bytes.length };
 }
-function defaultRoots(home = homedir2(), isDirectory = (path) => {
-  try {
-    return statSync2(path).isDirectory();
-  } catch {
-    return false;
-  }
-}) {
-  return ["Desktop", "Documents", "Downloads"].map((name) => join4(home, name)).filter(isDirectory);
-}
 var MAX_LISTED = 200;
 function sizeOf(path) {
-  const size = statSync2(path).size;
+  const size = statSync3(path).size;
   if (size < 1024) return `${size} B`;
   if (size < 1024 * 1024) return `${Math.round(size / 1024)} KB`;
   return `${(size / (1024 * 1024)).toFixed(1)} MB`;
@@ -2345,24 +2598,14 @@ async function agentCommand(context) {
   const roots = (listFlag(context.args, "root") ?? []).map(
     (one) => resolve3(one.startsWith("~") ? resolve3(homedir2(), one.slice(1).replace(/^[/\\]/, "")) : one)
   );
-  if (roots.length === 0) {
-    const usual = defaultRoots();
-    if (usual.length === 0) {
-      context.error(
-        "This machine has no Desktop, Documents or Downloads folder, so there is nothing to offer by default. Say which folders it may read from:"
-      );
-      context.error("");
-      context.error("  pm agent --root ~/projects");
-      return 1;
-    }
-    roots.push(...usual);
-    context.print(
-      `Reading from ${usual.map((path) => path.replace(homedir2(), "~")).join(", ")} \u2014 nothing outside them. Use --root to choose your own.`
-    );
-  }
+  const everywhere = roots.length === 0;
+  if (everywhere) roots.push("/");
+  context.print(
+    everywhere ? "Reading anywhere on this machine. You approve every request first, and see the exact path or command before you do. Narrow it with --root if you want to." : `Reading ${roots.map((path) => path.replace(homedir2(), "~")).join(", ")} \u2014 nothing outside them.`
+  );
   for (const root of roots) {
     try {
-      if (!statSync2(root).isDirectory()) {
+      if (!statSync3(root).isDirectory()) {
         context.error(`${root} is not a folder.`);
         return 1;
       }
@@ -2459,7 +2702,7 @@ async function agentCommand(context) {
 // src/commands/google.ts
 import { writeFileSync as writeFileSync5 } from "node:fs";
 import { basename as basename2, resolve as resolve4 } from "node:path";
-import { readFileSync as readFileSync5 } from "node:fs";
+import { readFileSync as readFileSync6 } from "node:fs";
 async function callApi(context, path, init = {}) {
   const credential = context.resolved.credential;
   if (!credential) {
@@ -2536,7 +2779,7 @@ async function drivePut(context, path) {
   }
   let bytes;
   try {
-    bytes = readFileSync5(resolve4(path));
+    bytes = readFileSync6(resolve4(path));
   } catch {
     context.error(`Cannot read ${path}.`);
     return 1;
@@ -2620,7 +2863,7 @@ async function mailCommand(context) {
 }
 
 // src/commands/requests.ts
-import { existsSync as existsSync5, writeFileSync as writeFileSync6 } from "node:fs";
+import { existsSync as existsSync6, writeFileSync as writeFileSync6 } from "node:fs";
 import { resolve as resolve5 } from "node:path";
 async function requestsCommand(context) {
   if (context.args.words[1] === "get") return collectCommand(context);
@@ -2690,7 +2933,7 @@ async function collectCommand(context) {
   }
   const name = stringFlag(context.args, "output", "o") ?? filename;
   const target = resolve5(name);
-  if (existsSync5(target)) {
+  if (existsSync6(target)) {
     context.error(`${target} already exists. Pass --output to write somewhere else.`);
     return 1;
   }
@@ -2700,14 +2943,14 @@ async function collectCommand(context) {
 }
 
 // src/workspace.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname3, join as join5, resolve as resolvePath } from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "node:fs";
+import { dirname as dirname3, join as join6, resolve as resolvePath2 } from "node:path";
 var WORKSPACE_FILE = ".persistmemory.json";
 function findWorkspace(from = process.cwd()) {
-  let dir = resolvePath(from);
+  let dir = resolvePath2(from);
   for (; ; ) {
-    const file = join5(dir, WORKSPACE_FILE);
-    if (existsSync6(file)) {
+    const file = join6(dir, WORKSPACE_FILE);
+    if (existsSync7(file)) {
       const config = readWorkspace(file);
       if (config) return { file, dir, config };
     }
@@ -2718,7 +2961,7 @@ function findWorkspace(from = process.cwd()) {
 }
 function readWorkspace(file) {
   try {
-    const parsed = JSON.parse(readFileSync6(file, "utf8"));
+    const parsed = JSON.parse(readFileSync7(file, "utf8"));
     const space = parsed.space;
     if (space && typeof space === "object" && typeof space.id === "string" && space.id !== "" && typeof space.name === "string") {
       return { space: { id: space.id, name: space.name } };
@@ -2729,7 +2972,7 @@ function readWorkspace(file) {
   }
 }
 function writeWorkspace(dir, config) {
-  const file = join5(dir, WORKSPACE_FILE);
+  const file = join6(dir, WORKSPACE_FILE);
   writeFileSync7(file, `${JSON.stringify(config, null, 2)}
 `, "utf8");
   return file;
@@ -2999,7 +3242,7 @@ function message(error) {
 }
 
 // src/commands/maintain.ts
-import { existsSync as existsSync7, rmSync } from "node:fs";
+import { existsSync as existsSync8, rmSync } from "node:fs";
 import { spawnSync } from "node:child_process";
 import { dirname as dirname4, resolve as resolve7 } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -3065,7 +3308,7 @@ Delete the file it runs from: ${processPath()}`
   return 0;
 }
 async function deleteCommand(context) {
-  if (!existsSync7(context.paths.dir)) {
+  if (!existsSync8(context.paths.dir)) {
     context.print(`Nothing to delete: ${context.paths.dir} does not exist.`);
     return 0;
   }
@@ -3118,12 +3361,12 @@ import { randomUUID } from "node:crypto";
 import { relative as relative2 } from "node:path";
 
 // src/events.ts
-import { appendFileSync, existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync7 } from "node:fs";
-import { join as join6 } from "node:path";
+import { appendFileSync, existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync8 } from "node:fs";
+import { join as join7 } from "node:path";
 function openSessionLog(paths, id) {
-  const directory = join6(paths.dir, "sessions");
+  const directory = join7(paths.dir, "sessions");
   mkdirSync3(directory, { recursive: true, mode: 448 });
-  const path = join6(directory, `${id}.jsonl`);
+  const path = join7(directory, `${id}.jsonl`);
   return {
     id,
     path,
@@ -3135,8 +3378,8 @@ function openSessionLog(paths, id) {
       }
     },
     read() {
-      if (!existsSync8(path)) return [];
-      return readFileSync7(path, "utf8").split("\n").filter((line) => line.trim() !== "").flatMap((line) => {
+      if (!existsSync9(path)) return [];
+      return readFileSync8(path, "utf8").split("\n").filter((line) => line.trim() !== "").flatMap((line) => {
         try {
           return [JSON.parse(line)];
         } catch {
@@ -3399,7 +3642,7 @@ async function write2(args) {
 }
 
 // src/commands/memory.ts
-import { readFileSync as readFileSync8 } from "node:fs";
+import { readFileSync as readFileSync9 } from "node:fs";
 
 // src/spaces.ts
 async function spacesFor(context, client, env = process.env) {
@@ -3463,7 +3706,7 @@ async function rememberCommand(context) {
   let text;
   if (file) {
     try {
-      text = readFileSync8(file, "utf8");
+      text = readFileSync9(file, "utf8");
     } catch {
       context.error(`Could not read ${file}.`);
       return 1;