@plumpslabs/kuma 2.1.1 → 2.1.2

package/dist/index.js

@@ -2057,6 +2057,24 @@ function truncateOutput(output, maxChars) {
 }
 
 // src/tools/safeTerminalExec.ts
+function stripShellObfuscation(cmd) {
+  let result = cmd;
+  let prev;
+  do {
+    prev = result;
+    result = result.replace(/\$\([^()]*\)/g, "");
+  } while (result !== prev);
+  do {
+    prev = result;
+    result = result.replace(/\$\(\([^()]*\)\)/g, "");
+  } while (result !== prev);
+  result = result.replace(/\$\{[^}]*\}/g, " ");
+  result = result.replace(/\$'[^']*'/g, "");
+  result = result.replace(/\$"[^"]*"/g, "");
+  result = result.replace(/\$[a-zA-Z_][a-zA-Z0-9_]*/g, " ");
+  result = result.replace(/\s+/g, " ").trim();
+  return result;
+}
 function buildTaskCommand(task, cwd) {
   const pm = detectPackageManagerForDir(cwd);
   const prefix = pm === "pnpm" ? "pnpm" : pm === "yarn" ? "yarn" : pm === "bun" ? "bun" : "npm";
@@ -2075,24 +2093,59 @@ function buildTaskCommand(task, cwd) {
   }
 }
 var DANGEROUS_PATTERNS = [
+  // RM variants
   "rm -rf",
   "rm -fr",
+  "rm --recursive",
+  "rm --force",
   "del /f",
   "rd /s",
   "rmdir /s",
+  // Git dangerous
   "git push",
   "git commit",
+  "git reset --hard",
+  "git clean -fd",
+  "git checkout -- .",
+  // Publish to registries
   "npm publish",
   "npx publish",
   "yarn publish",
   "pnpm publish",
+  // System destruction
   "> /dev/sda",
-  "format",
   "mkfs",
   "dd if=",
+  "dd of=",
+  "fdisk",
+  "parted",
+  "mkswap",
+  // Fork bomb
   ":(){ :|:& };:",
-  "curl ",
-  "wget "
+  ":(){",
+  // Pipe to shell (remote code execution vector)
+  "| bash",
+  "| sh",
+  // Dangerous eval/exec
+  "eval ",
+  "exec ",
+  "source /dev/stdin",
+  ". /dev/stdin",
+  // Find destruction
+  "find . -delete",
+  "find / -delete",
+  "find . -exec rm",
+  "find / -exec rm",
+  // Chmod abuse
+  "chmod -R 777",
+  "chmod 777 /",
+  "chmod 000",
+  // Alias hijacking
+  "alias rm=",
+  "alias cd=",
+  "alias sudo=",
+  // Overwrite protection
+  "shred"
 ];
 async function handleSafeTerminalExec(params) {
   const { task, customCommand, timeout = 60, cwd: inputCwd, workspace } = params;
@@ -2134,7 +2187,10 @@ Available workspaces: ${workspaces?.map((w) => `"${w.name}" (${w.path})`).join("
 
 Fix the code first before running the task again.`;
   }
-  const dangerousPattern = DANGEROUS_PATTERNS.find((p) => command.toLowerCase().includes(p.toLowerCase()));
+  const deobfuscated = stripShellObfuscation(command);
+  const dangerousPattern = DANGEROUS_PATTERNS.find(
+    (p) => deobfuscated.toLowerCase().includes(p.toLowerCase())
+  );
   if (dangerousPattern) {
     return `\u{1F6AB} BLOCKED: Command contains a dangerous pattern: "${dangerousPattern}".
 This command is not permitted.`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plumpslabs/kuma",
-  "version": "2.1.1",
+  "version": "2.1.2",
   "description": "Zero-setup safety toolkit for AI coding agents. MCP server with code review, git analysis, file editing, session memory, and static analysis — works with Claude Code, Cursor, Gemini CLI.",
   "type": "module",
   "main": "dist/index.js",