@probelabs/probe 0.6.0-rc105 → 0.6.0-rc107

package/build/agent/bashExecutor.js

@@ -0,0 +1,319 @@
+/**
+ * Bash command executor with security and timeout controls
+ * @module agent/bashExecutor
+ */
+
+import { spawn } from 'child_process';
+import { resolve, join } from 'path';
+import { existsSync } from 'fs';
+import { parseCommandForExecution } from './bashCommandUtils.js';
+
+/**
+ * Execute a bash command with security controls
+ * @param {string} command - Command to execute
+ * @param {Object} options - Execution options
+ * @param {string} [options.workingDirectory] - Working directory for command execution
+ * @param {number} [options.timeout=120000] - Timeout in milliseconds
+ * @param {Object} [options.env={}] - Additional environment variables
+ * @param {number} [options.maxBuffer=10485760] - Maximum buffer size (10MB)
+ * @param {boolean} [options.debug=false] - Enable debug logging
+ * @returns {Promise<Object>} Execution result
+ */
+export async function executeBashCommand(command, options = {}) {
+  const {
+    workingDirectory = process.cwd(),
+    timeout = 120000, // 2 minutes default
+    env = {},
+    maxBuffer = 10 * 1024 * 1024, // 10MB
+    debug = false
+  } = options;
+
+  // Validate working directory
+  let cwd = workingDirectory;
+  try {
+    cwd = resolve(cwd);
+    if (!existsSync(cwd)) {
+      throw new Error(`Working directory does not exist: ${cwd}`);
+    }
+  } catch (error) {
+    return {
+      success: false,
+      error: `Invalid working directory: ${error.message}`,
+      stdout: '',
+      stderr: '',
+      exitCode: 1,
+      command,
+      workingDirectory: cwd,
+      duration: 0
+    };
+  }
+
+  const startTime = Date.now();
+
+  if (debug) {
+    console.log(`[BashExecutor] Executing command: "${command}"`);
+    console.log(`[BashExecutor] Working directory: "${cwd}"`);
+    console.log(`[BashExecutor] Timeout: ${timeout}ms`);
+  }
+
+  return new Promise((resolve, reject) => {
+    // Create environment
+    const processEnv = {
+      ...process.env,
+      ...env
+    };
+
+    // Parse command for shell execution
+    // We use shell: false for security, so we need to parse manually
+    const args = parseCommandForExecution(command);
+    if (!args || args.length === 0) {
+      resolve({
+        success: false,
+        error: 'Failed to parse command',
+        stdout: '',
+        stderr: '',
+        exitCode: 1,
+        command,
+        workingDirectory: cwd,
+        duration: Date.now() - startTime
+      });
+      return;
+    }
+
+    const [cmd, ...cmdArgs] = args;
+
+    // Spawn the process
+    const child = spawn(cmd, cmdArgs, {
+      cwd,
+      env: processEnv,
+      stdio: ['ignore', 'pipe', 'pipe'], // stdin ignored, capture stdout/stderr
+      shell: false, // For security
+      windowsHide: true
+    });
+
+    let stdout = '';
+    let stderr = '';
+    let killed = false;
+    let timeoutHandle;
+
+    // Set timeout
+    if (timeout > 0) {
+      timeoutHandle = setTimeout(() => {
+        if (!killed) {
+          killed = true;
+          child.kill('SIGTERM');
+          
+          // Force kill after 5 seconds if still running
+          setTimeout(() => {
+            if (child.exitCode === null) {
+              child.kill('SIGKILL');
+            }
+          }, 5000);
+        }
+      }, timeout);
+    }
+
+    // Handle stdout
+    child.stdout.on('data', (data) => {
+      const chunk = data.toString();
+      if (stdout.length + chunk.length <= maxBuffer) {
+        stdout += chunk;
+      } else {
+        // Buffer overflow
+        if (!killed) {
+          killed = true;
+          child.kill('SIGTERM');
+        }
+      }
+    });
+
+    // Handle stderr
+    child.stderr.on('data', (data) => {
+      const chunk = data.toString();
+      if (stderr.length + chunk.length <= maxBuffer) {
+        stderr += chunk;
+      } else {
+        // Buffer overflow
+        if (!killed) {
+          killed = true;
+          child.kill('SIGTERM');
+        }
+      }
+    });
+
+    // Handle process exit
+    child.on('close', (code, signal) => {
+      if (timeoutHandle) {
+        clearTimeout(timeoutHandle);
+      }
+
+      const duration = Date.now() - startTime;
+      
+      if (debug) {
+        console.log(`[BashExecutor] Command completed - Code: ${code}, Signal: ${signal}, Duration: ${duration}ms`);
+        console.log(`[BashExecutor] Stdout length: ${stdout.length}, Stderr length: ${stderr.length}`);
+      }
+
+      let success = true;
+      let error = '';
+
+      if (killed) {
+        success = false;
+        if (stdout.length + stderr.length > maxBuffer) {
+          error = `Command output exceeded maximum buffer size (${maxBuffer} bytes)`;
+        } else {
+          error = `Command timed out after ${timeout}ms`;
+        }
+      } else if (code !== 0) {
+        success = false;
+        error = `Command exited with code ${code}`;
+      }
+
+      resolve({
+        success,
+        error,
+        stdout: stdout.trim(),
+        stderr: stderr.trim(),
+        exitCode: code,
+        signal,
+        command,
+        workingDirectory: cwd,
+        duration,
+        killed
+      });
+    });
+
+    // Handle spawn errors
+    child.on('error', (error) => {
+      if (timeoutHandle) {
+        clearTimeout(timeoutHandle);
+      }
+
+      if (debug) {
+        console.log(`[BashExecutor] Spawn error:`, error);
+      }
+
+      resolve({
+        success: false,
+        error: `Failed to execute command: ${error.message}`,
+        stdout: '',
+        stderr: '',
+        exitCode: 1,
+        command,
+        workingDirectory: cwd,
+        duration: Date.now() - startTime
+      });
+    });
+  });
+}
+
+
+/**
+ * Format execution result for display
+ * @param {Object} result - Execution result
+ * @param {boolean} [includeMetadata=false] - Include metadata in output
+ * @returns {string} Formatted result
+ */
+export function formatExecutionResult(result, includeMetadata = false) {
+  if (!result) {
+    return 'No result available';
+  }
+
+  let output = '';
+
+  // Add command info if metadata requested
+  if (includeMetadata) {
+    output += `Command: ${result.command}\n`;
+    output += `Working directory: ${result.workingDirectory}\n`;
+    output += `Duration: ${result.duration}ms\n`;
+    output += `Exit Code: ${result.exitCode}\n`;
+    if (result.signal) {
+      output += `Signal: ${result.signal}\n`;
+    }
+    output += '\n';
+  }
+
+  // Add stdout if present
+  if (result.stdout) {
+    if (includeMetadata) {
+      output += '--- STDOUT ---\n';
+    }
+    output += result.stdout;
+    if (includeMetadata && result.stderr) {
+      output += '\n';
+    }
+  }
+
+  // Add stderr if present
+  if (result.stderr) {
+    if (includeMetadata) {
+      if (result.stdout) output += '\n';
+      output += '--- STDERR ---\n';
+    } else if (result.stdout) {
+      output += '\n--- STDERR ---\n';
+    }
+    output += result.stderr;
+  }
+
+  // Add error message if failed and no stderr
+  if (!result.success && result.error && !result.stderr) {
+    if (output) output += '\n';
+    output += `Error: ${result.error}`;
+  }
+
+  // Add exit code for failed commands
+  if (!result.success && result.exitCode !== undefined && result.exitCode !== 0) {
+    if (output) output += '\n';
+    output += `Exit code: ${result.exitCode}`;
+  }
+
+  return output || (result.success ? 'Command completed successfully (no output)' : 'Command failed (no output)');
+}
+
+/**
+ * Validate execution options
+ * @param {Object} options - Options to validate
+ * @returns {Object} Validation result
+ */
+export function validateExecutionOptions(options = {}) {
+  const errors = [];
+  const warnings = [];
+
+  // Check timeout
+  if (options.timeout !== undefined) {
+    if (typeof options.timeout !== 'number' || options.timeout < 0) {
+      errors.push('timeout must be a non-negative number');
+    } else if (options.timeout > 600000) { // 10 minutes
+      warnings.push('timeout is very high (>10 minutes)');
+    }
+  }
+
+  // Check maxBuffer
+  if (options.maxBuffer !== undefined) {
+    if (typeof options.maxBuffer !== 'number' || options.maxBuffer < 1024) {
+      errors.push('maxBuffer must be at least 1024 bytes');
+    } else if (options.maxBuffer > 100 * 1024 * 1024) { // 100MB
+      warnings.push('maxBuffer is very high (>100MB)');
+    }
+  }
+
+  // Check working directory
+  if (options.workingDirectory) {
+    if (typeof options.workingDirectory !== 'string') {
+      errors.push('workingDirectory must be a string');
+    } else if (!existsSync(options.workingDirectory)) {
+      errors.push(`workingDirectory does not exist: ${options.workingDirectory}`);
+    }
+  }
+
+  // Check environment
+  if (options.env && typeof options.env !== 'object') {
+    errors.push('env must be an object');
+  }
+
+  return {
+    valid: errors.length === 0,
+    errors,
+    warnings
+  };
+}

package/build/agent/bashPermissions.js

@@ -0,0 +1,228 @@
+/**
+ * Simplified bash command permission checker (aligned with executor capabilities)
+ * @module agent/bashPermissions
+ */
+
+import { DEFAULT_ALLOW_PATTERNS, DEFAULT_DENY_PATTERNS } from './bashDefaults.js';
+import { parseCommand, isComplexCommand } from './bashCommandUtils.js';
+
+/**
+ * Check if a pattern matches a parsed command
+ * @param {Object} parsedCommand - Parsed command with command and args
+ * @param {string} pattern - Pattern to match against (e.g., "git:status", "npm:*")
+ * @returns {boolean} True if pattern matches
+ */
+function matchesPattern(parsedCommand, pattern) {
+  if (!parsedCommand || !pattern) return false;
+  
+  const { command, args } = parsedCommand;
+  if (!command) return false;
+  
+  // Split pattern into parts separated by ':'
+  const patternParts = pattern.split(':');
+  const commandName = patternParts[0];
+  
+  // Check if command name matches (with wildcard support)
+  if (commandName === '*') {
+    // Wildcard matches any command
+    return true;
+  } else if (commandName !== command) {
+    // Command name doesn't match
+    return false;
+  }
+  
+  // If only command name specified, it matches
+  if (patternParts.length === 1) {
+    return true;
+  }
+  
+  // Check arguments
+  for (let i = 1; i < patternParts.length; i++) {
+    const patternArg = patternParts[i];
+    const argIndex = i - 1;
+    
+    if (patternArg === '*') {
+      // Wildcard matches any argument (or no argument)
+      continue;
+    }
+    
+    if (argIndex >= args.length) {
+      // Not enough arguments to match pattern
+      return false;
+    }
+    
+    const actualArg = args[argIndex];
+    if (patternArg !== actualArg) {
+      // Argument doesn't match
+      return false;
+    }
+  }
+  
+  return true;
+}
+
+/**
+ * Check if any pattern in a list matches the command
+ * @param {Object} parsedCommand - Parsed command
+ * @param {string[]} patterns - Array of patterns to check
+ * @returns {boolean} True if any pattern matches
+ */
+function matchesAnyPattern(parsedCommand, patterns) {
+  if (!patterns || patterns.length === 0) return false;
+  return patterns.some(pattern => matchesPattern(parsedCommand, pattern));
+}
+
+/**
+ * Bash permission checker for simple commands only
+ * Rejects complex shell constructs for security and alignment with executor
+ */
+export class BashPermissionChecker {
+  /**
+   * Create a permission checker
+   * @param {Object} config - Configuration options
+   * @param {string[]} [config.allow] - Additional allow patterns
+   * @param {string[]} [config.deny] - Additional deny patterns
+   * @param {boolean} [config.disableDefaultAllow] - Disable default allow list
+   * @param {boolean} [config.disableDefaultDeny] - Disable default deny list
+   * @param {boolean} [config.debug] - Enable debug logging
+   */
+  constructor(config = {}) {
+    this.debug = config.debug || false;
+    
+    // Build allow patterns
+    this.allowPatterns = [];
+    if (!config.disableDefaultAllow) {
+      this.allowPatterns.push(...DEFAULT_ALLOW_PATTERNS);
+      if (this.debug) {
+        console.log(`[BashPermissions] Added ${DEFAULT_ALLOW_PATTERNS.length} default allow patterns`);
+      }
+    }
+    if (config.allow && Array.isArray(config.allow)) {
+      this.allowPatterns.push(...config.allow);
+      if (this.debug) {
+        console.log(`[BashPermissions] Added ${config.allow.length} custom allow patterns:`, config.allow);
+      }
+    }
+
+    // Build deny patterns
+    this.denyPatterns = [];
+    if (!config.disableDefaultDeny) {
+      this.denyPatterns.push(...DEFAULT_DENY_PATTERNS);
+      if (this.debug) {
+        console.log(`[BashPermissions] Added ${DEFAULT_DENY_PATTERNS.length} default deny patterns`);
+      }
+    }
+    if (config.deny && Array.isArray(config.deny)) {
+      this.denyPatterns.push(...config.deny);
+      if (this.debug) {
+        console.log(`[BashPermissions] Added ${config.deny.length} custom deny patterns:`, config.deny);
+      }
+    }
+
+    if (this.debug) {
+      console.log(`[BashPermissions] Total patterns - Allow: ${this.allowPatterns.length}, Deny: ${this.denyPatterns.length}`);
+    }
+  }
+
+  /**
+   * Check if a simple command is allowed (rejects complex commands for security)
+   * @param {string} command - Command to check
+   * @returns {Object} Permission result
+   */
+  check(command) {
+    if (!command || typeof command !== 'string') {
+      return {
+        allowed: false,
+        reason: 'Invalid or empty command',
+        command: command
+      };
+    }
+
+    // First check if this is a complex command - reject immediately for security
+    if (isComplexCommand(command)) {
+      return {
+        allowed: false,
+        reason: 'Complex shell commands with pipes, operators, or redirections are not supported for security reasons',
+        command: command,
+        isComplex: true
+      };
+    }
+
+    // Parse the simple command
+    const parsed = parseCommand(command);
+    
+    if (parsed.error) {
+      return {
+        allowed: false,
+        reason: parsed.error,
+        command: command
+      };
+    }
+
+    if (!parsed.command) {
+      return {
+        allowed: false,
+        reason: 'No valid command found',
+        command: command
+      };
+    }
+
+    if (this.debug) {
+      console.log(`[BashPermissions] Checking simple command: "${command}"`);
+      console.log(`[BashPermissions] Parsed: ${parsed.command} with args: [${parsed.args.join(', ')}]`);
+    }
+
+    // Check deny patterns first (deny takes precedence)
+    if (matchesAnyPattern(parsed, this.denyPatterns)) {
+      const matchedPatterns = this.denyPatterns.filter(pattern => matchesPattern(parsed, pattern));
+      return {
+        allowed: false,
+        reason: `Command matches deny pattern: ${matchedPatterns[0]}`,
+        command: command,
+        parsed: parsed,
+        matchedPatterns: matchedPatterns
+      };
+    }
+
+    // Check allow patterns
+    if (this.allowPatterns.length > 0) {
+      if (!matchesAnyPattern(parsed, this.allowPatterns)) {
+        return {
+          allowed: false,
+          reason: 'Command not in allow list',
+          command: command,
+          parsed: parsed
+        };
+      }
+    }
+
+    // Command passed all checks
+    const result = {
+      allowed: true,
+      command: command,
+      parsed: parsed,
+      isComplex: false
+    };
+    
+    if (this.debug) {
+      console.log(`[BashPermissions] ALLOWED - command passed all checks`);
+    }
+    
+    return result;
+  }
+
+  /**
+   * Get configuration summary
+   * @returns {Object} Configuration info
+   */
+  getConfig() {
+    return {
+      allowPatterns: this.allowPatterns.length,
+      denyPatterns: this.denyPatterns.length,
+      totalPatterns: this.allowPatterns.length + this.denyPatterns.length
+    };
+  }
+}
+
+// Export utility functions for testing
+export { parseCommand, matchesPattern, matchesAnyPattern };