@remcp/runtime 0.2.105 → 0.2.107

package/src/extended/documents.mjs

@@ -1,6 +1,8 @@
 import path from 'node:path';
 import process from 'node:process';
-import { copyFile, mkdir, readFile, readdir, rm, stat, writeFile } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
+import { constants } from 'node:fs';
+import { copyFile, lstat, mkdir, mkdtemp, open, readFile, readdir, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { readDocxText, readPdfText } from '../documents.mjs';
 import { resolveSafePath, text } from '../util.mjs';
 import {
@@ -26,6 +28,51 @@ function xmlUnescape(value) {
 
 const MAX_OOXML_ENTRIES = 10_000;
 const MAX_OOXML_UNCOMPRESSED_BYTES = 512 * 1024 * 1024;
+const MAX_DOCUMENT_BYTES = 128 * 1024 * 1024;
+
+async function readDocumentFile(filePath) {
+  const info = await lstat(filePath);
+  if (!info.isFile()) throw new Error('Document path must be a regular file');
+  if (info.size > MAX_DOCUMENT_BYTES) throw new Error(`Document is too large (maximum ${MAX_DOCUMENT_BYTES} bytes)`);
+  return readFile(filePath);
+}
+
+async function copyRegularNoFollow(source, destination) {
+  const sourceHandle = await open(source, constants.O_RDONLY | (constants.O_NOFOLLOW || 0));
+  try {
+    const info = await sourceHandle.stat();
+    if (!info.isFile()) throw new Error('Document path must be a regular file');
+    if (info.size > MAX_DOCUMENT_BYTES) throw new Error(`Document is too large (maximum ${MAX_DOCUMENT_BYTES} bytes)`);
+    const destinationHandle = await open(destination, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+    try {
+      await destinationHandle.writeFile(await sourceHandle.readFile());
+    } finally {
+      await destinationHandle.close();
+    }
+  } finally {
+    await sourceHandle.close();
+  }
+}
+
+async function assertSafeExtractedTree(root, state = { entries: 0 }) {
+  const info = await lstat(root);
+  if (info.isSymbolicLink()) throw new Error('OOXML archive contains a symbolic link');
+  if (!info.isDirectory() && !info.isFile()) throw new Error('OOXML archive contains a special file');
+  state.entries += 1;
+  if (state.entries > MAX_OOXML_ENTRIES) throw new Error('OOXML archive has too many extracted entries');
+  if (!info.isDirectory()) return;
+  for (const entry of await readdir(root, { withFileTypes: true })) {
+    await assertSafeExtractedTree(path.join(root, entry.name), state);
+  }
+}
+
+function safePdfPattern(value, fallback) {
+  const pattern = String(value || fallback);
+  if (!pattern || pattern.length > 240 || pattern.includes('\0') || path.isAbsolute(pattern) || /[\\/]/.test(pattern) || pattern.split(/[\\/]/).includes('..')) {
+    throw new Error('PDF split pattern must be a filename without path separators');
+  }
+  return pattern;
+}
 
 function safeArchiveEntry(name) {
   const normalized = String(name || '').replace(/\\/g, '/');
@@ -51,14 +98,22 @@ async function validateZipArchive(source) {
 }
 
 async function extractZip(source, destination) {
-  await validateZipArchive(source);
-  await mkdir(destination, { recursive:true });
-  if (process.platform === 'win32') {
-    await runPowerShell(`Add-Type -AssemblyName System.IO.Compression.FileSystem;[IO.Compression.ZipFile]::ExtractToDirectory('${escapePowerShellSingle(source)}','${escapePowerShellSingle(destination)}')`, { label:'extract OOXML archive', timeout:30_000 });
-    return;
+  const sourceDirectory = await tempDir('remcp-ooxml-source-');
+  const sourceCopy = path.join(sourceDirectory, 'source.zip');
+  try {
+    await copyRegularNoFollow(source, sourceCopy);
+    await validateZipArchive(sourceCopy);
+    await mkdir(destination, { recursive:true });
+    if (process.platform === 'win32') {
+      await runPowerShell(`Add-Type -AssemblyName System.IO.Compression.FileSystem;[IO.Compression.ZipFile]::ExtractToDirectory('${escapePowerShellSingle(sourceCopy)}','${escapePowerShellSingle(destination)}')`, { label:'extract OOXML archive', timeout:30_000 });
+    } else {
+      if (!commandExists('unzip')) unavailable('OOXML document editing', 'unzip is required');
+      await runFile('unzip', ['-qq',sourceCopy,'-d',destination], { label:'extract OOXML archive', timeout:30_000 });
+    }
+    await assertSafeExtractedTree(destination);
+  } finally {
+    await removeTemp(sourceDirectory);
   }
-  if (!commandExists('unzip')) unavailable('OOXML document editing', 'unzip is required');
-  await runFile('unzip', ['-qq',source,'-d',destination], { label:'extract OOXML archive', timeout:30_000 });
 }
 
 async function createZip(sourceDir, destination) {
@@ -71,6 +126,26 @@ async function createZip(sourceDir, destination) {
   await runFile('zip', ['-qr',destination,'.'], { cwd:sourceDir, label:'create OOXML archive', timeout:30_000 });
 }
 
+async function commitDocumentOutput(staged, destination) {
+  try {
+    await rename(staged, destination);
+    return;
+  } catch (error) {
+    if (!['EEXIST', 'EPERM', 'ENOTEMPTY'].includes(error?.code)) throw error;
+  }
+  const backup = `${destination}.remcp-old-${randomUUID()}`;
+  let moved = false;
+  try {
+    await rename(destination, backup);
+    moved = true;
+    await rename(staged, destination);
+    await rm(backup, { force: true }).catch(() => {});
+  } catch (error) {
+    if (moved && !await lstat(destination).catch(() => null)) await rename(backup, destination).catch(() => {});
+    throw error;
+  }
+}
+
 async function ensureCreateTargetIsNew(filePath) {
   try {
     await stat(filePath);
@@ -188,7 +263,7 @@ async function readPdfDocument(filePath, data) {
 export async function readDocument(args) {
   const filePath = await resolveSafePath(args.path,'path');
   const lower = filePath.toLowerCase();
-  const data = await readFile(filePath);
+  const data = await readDocumentFile(filePath);
   if (lower.endsWith('.docx')) return text(readDocxText(data));
   if (lower.endsWith('.pdf')) return text(await readPdfDocument(filePath,data));
   if (lower.endsWith('.xlsx')) return jsonResult(await readXlsx(filePath,args));
@@ -275,8 +350,12 @@ export async function editSpreadsheet(args) {
   const edits = expandSpreadsheetEdits(requestedEdits);
   const output = args.output ? await resolveSafePath(args.output,'output') : filePath;
   const dir = await tempDir(create ? 'remcp-xlsx-create-' : 'remcp-xlsx-edit-');
-  const tempOut = path.join(path.dirname(output), `.remcp-${Date.now()}-${path.basename(output)}`);
+  let outputStage = '';
+  let tempOut = '';
   try {
+    await mkdir(path.dirname(output), { recursive:true });
+    outputStage = await mkdtemp(path.join(path.dirname(output), '.remcp-xlsx-output-'));
+    tempOut = path.join(outputStage, path.basename(output));
     if (create) {
       await ensureCreateTargetIsNew(filePath);
       await createBlankXlsxTree(dir, optionalString(args.sheet));
@@ -290,12 +369,12 @@ export async function editSpreadsheet(args) {
     let xml = await readFile(worksheetPath,'utf8');
     for (const edit of edits) xml = setWorksheetCell(xml,String(edit.cell || '').toUpperCase(),edit.value,edit.formula);
     await writeFile(worksheetPath,xml,'utf8');
-    await mkdir(path.dirname(output), { recursive:true });
     await createZip(dir,tempOut);
-    await copyFile(tempOut,output);
+    await commitDocumentOutput(tempOut,output);
     return jsonResult({ path:output, sheet:sheet.name, edited_cells:edits.length, bytes:(await stat(output)).size, created:create });
   } finally {
-    await rm(tempOut,{force:true}).catch(() => {});
+    if (tempOut) await rm(tempOut,{force:true}).catch(() => {});
+    if (outputStage) await rm(outputStage,{recursive:true, force:true}).catch(() => {});
     await removeTemp(dir);
   }
 }
@@ -356,9 +435,13 @@ export async function editDocument(args) {
   if (!operations.length || operations.length > 100) throw new Error('operations must contain 1..100 edits');
   const output = args.output ? await resolveSafePath(args.output,'output') : filePath;
   const dir = await tempDir(create ? 'remcp-docx-create-' : 'remcp-docx-edit-');
-  const tempOut = path.join(path.dirname(output), `.remcp-${Date.now()}-${path.basename(output)}`);
+  let outputStage = '';
+  let tempOut = '';
   let changes = 0;
   try {
+    await mkdir(path.dirname(output), { recursive:true });
+    outputStage = await mkdtemp(path.join(path.dirname(output), '.remcp-docx-output-'));
+    tempOut = path.join(outputStage, path.basename(output));
     if (create) {
       await ensureCreateTargetIsNew(filePath);
       await createBlankDocxTree(dir);
@@ -383,12 +466,12 @@ export async function editDocument(args) {
       }
     }
     await writeFile(documentPath,xml,'utf8');
-    await mkdir(path.dirname(output), { recursive:true });
     await createZip(dir,tempOut);
-    await copyFile(tempOut,output);
+    await commitDocumentOutput(tempOut,output);
     return jsonResult({ path:output, operations:operations.length, changes, bytes:(await stat(output)).size, created:create });
   } finally {
-    await rm(tempOut,{force:true}).catch(() => {});
+    if (tempOut) await rm(tempOut,{force:true}).catch(() => {});
+    if (outputStage) await rm(outputStage,{recursive:true, force:true}).catch(() => {});
     await removeTemp(dir);
   }
 }
@@ -437,12 +520,12 @@ export async function pdfAction(args) {
   const action = requireEnum(args.action,'action',['merge','split','extract_pages','annotations','info']);
   if (action === 'annotations') {
     const source = await resolveSafePath(args.path,'path');
-    return jsonResult({ path:source, annotations:pdfAnnotations(await readFile(source)) });
+    return jsonResult({ path:source, annotations:pdfAnnotations(await readDocumentFile(source)) });
   }
   if (action === 'info') {
     const source = await resolveSafePath(args.path,'path');
     if (commandExists('pdfinfo')) return text((await runFile('pdfinfo',[source],{label:'pdfinfo'})).stdout);
-    const data = await readFile(source); return jsonResult({ path:source, bytes:data.length, annotation_count:pdfAnnotations(data).length });
+    const data = await readDocumentFile(source); return jsonResult({ path:source, bytes:data.length, annotation_count:pdfAnnotations(data).length });
   }
   if (action === 'merge') {
     const requested = Array.isArray(args.paths) ? args.paths : [];
@@ -456,8 +539,11 @@ export async function pdfAction(args) {
   }
   const source=await resolveSafePath(args.path,'path');
   if(action==='split'){
-    const outputDir=await resolveSafePath(args.output_dir || path.dirname(source),'output_dir'); await mkdir(outputDir,{recursive:true});
-    const pattern=path.join(outputDir,optionalString(args.pattern)||`${path.basename(source,path.extname(source))}-%d.pdf`);
+    const requestedOutputDir=await resolveSafePath(args.output_dir || path.dirname(source),'output_dir');
+    await mkdir(requestedOutputDir,{recursive:true});
+    const outputDir=await resolveSafePath(requestedOutputDir,'output_dir');
+    const patternName=safePdfPattern(optionalString(args.pattern),`${path.basename(source,path.extname(source))}-%d.pdf`);
+    const pattern=path.join(outputDir,patternName);
     if(commandExists('pdfseparate')) await runFile('pdfseparate',[source,pattern],{label:'PDF split',timeout:60_000});
     else unavailable('PDF split','install poppler-utils (pdfseparate)');
     return jsonResult({action,output_dir:outputDir,files:(await readdir(outputDir)).filter(name=>name.toLowerCase().endsWith('.pdf')).sort()});

package/src/helpers/wayland-eis-helper.py

@@ -248,6 +248,9 @@ class EiSender:
         self.connected = False
         self.pointer_device_key = None
         self.pointer_position = None
+        # A press/release pair must stay on the same emulated device even if
+        # absolute motion crosses an EIS region and changes pointer_device_key.
+        self.button_device_keys = {}
 
     def _device_key(self, ptr):
         return int(ptr or 0)
@@ -267,6 +270,9 @@ class EiSender:
         if key == self.pointer_device_key:
             self.pointer_device_key = None
             self.pointer_position = None
+        for button, device_key in list(self.button_device_keys.items()):
+            if device_key == key:
+                self.button_device_keys.pop(button, None)
         if state:
             if state["emulating"]:
                 try:
@@ -313,10 +319,14 @@ class EiSender:
                             state["emulating"] = True
                 elif event_type == EI_EVENT_DEVICE_PAUSED:
                     device = self.lib.ei_event_get_device(event)
-                    state = self.devices.get(self._device_key(device))
+                    key = self._device_key(device)
+                    state = self.devices.get(key)
                     if state:
                         state["resumed"] = False
                         state["emulating"] = False
+                    for button, device_key in list(self.button_device_keys.items()):
+                        if device_key == key:
+                            self.button_device_keys.pop(button, None)
                 elif event_type == EI_EVENT_DEVICE_REMOVED:
                     self._drop_device(self.lib.ei_event_get_device(event))
             finally:
@@ -419,8 +429,24 @@ class EiSender:
             self.remember_pointer(device, (x, y))
             self.frame(device)
         elif op == "button":
-            device = self.device_for_pointer_context(EI_CAP_BUTTON)
-            self.lib.ei_device_button_button(device, int(payload["button"]), bool(payload.get("pressed")))
+            button = int(payload["button"])
+            pressed = bool(payload.get("pressed"))
+            if pressed:
+                device = self.device_for_pointer_context(EI_CAP_BUTTON)
+                self.button_device_keys[button] = self._device_key(device)
+            else:
+                key = self.button_device_keys.pop(button, None)
+                state = self.devices.get(key) if key else None
+                if (
+                    state
+                    and state["resumed"]
+                    and state["emulating"]
+                    and self.lib.ei_device_has_capability(state["ptr"], EI_CAP_BUTTON)
+                ):
+                    device = state["ptr"]
+                else:
+                    device = self.device_for_pointer_context(EI_CAP_BUTTON)
+            self.lib.ei_device_button_button(device, button, pressed)
             self.frame(device)
         elif op == "scroll":
             device = self.device_for_pointer_context(EI_CAP_SCROLL)
@@ -446,6 +472,7 @@ class EiSender:
             except Exception:
                 pass
         self.devices.clear()
+        self.button_device_keys.clear()
         if self.ei:
             self.lib.ei_unref(self.ei)
             self.ei = None

package/src/policy.mjs

@@ -1,3 +1,4 @@
+import path from 'node:path';
 import { runtimeConfig } from './config.mjs';
 import { recordEvent } from './telemetry.mjs';
 import { fail } from './util.mjs';
@@ -10,7 +11,10 @@ import { fail } from './util.mjs';
 // Rules are matched against the *command word* of each shell segment, so a read-only
 // command that merely mentions a dangerous word (`grep -n format README.md`,
 // `cat notes/shutdown.md`) is not refused.
-const WRAPPERS = new Set(['sudo', 'doas', 'env', 'nohup', 'command', 'builtin', 'time', 'nice', 'ionice', 'stdbuf', 'timeout', 'setsid', 'exec']);
+const WRAPPERS = new Set(['sudo', 'doas', 'env', 'nohup', 'command', 'builtin', 'time', 'nice', 'ionice', 'stdbuf', 'timeout', 'setsid', 'exec', 'busybox']);
+const SHELL_WRAPPERS = /^(?:sh|bash|zsh|dash|ksh|fish|cmd(?:\.exe)?|powershell(?:\.exe)?|pwsh(?:\.exe)?)$/i;
+const INTERPRETER_EXECUTION = /\b(?:os\.system|subprocess\.(?:run|call|check_call|check_output|Popen)|child_process|\bexec\s*\(|\beval\s*\(|\bspawn\s*\()/i;
+const CATASTROPHIC_TEXT = /(?:mkfs(?:\.[a-z0-9]+)?\b|\b(?:fdisk|sfdisk|cfdisk|parted|diskpart|gdisk)\b|\bdd\b[^\n]*(?:\bof=\s*\/dev\/|\bof=\s*\\\\\.\\)|\b(?:shutdown|reboot|halt|poweroff|restart-computer|stop-computer)\b|\brm\b[^\n]*(?:--recursive|--force|-[a-z]*r[a-z]*f[a-z]*|-[a-z]*f[a-z]*r[a-z]*)[^\n]*(?:\s|\s*\/\s*|\s*~\s*|\s*\$HOME\b|\s*\$\{HOME\})|\bpython[0-9.]*\b[^\n]*(?:os\.system|subprocess|rm\s+-[^\n]*r[^\n]*f))/i;
 
 const DANGEROUS_RULES = [
   { id: 'filesystem-format', description: 'formats a filesystem', commands: /^mkfs(\.[a-z0-9]+)?$/i, args: () => true },
@@ -18,15 +22,19 @@ const DANGEROUS_RULES = [
   { id: 'disk-partition', description: 'repartitions a disk', commands: /^(fdisk|sfdisk|cfdisk|parted|diskpart|gdisk)$/i, args: () => true },
   { id: 'redirect-to-device', description: 'redirects output into a block device', commands: null, anySegment: />>?\s*\/dev\/(sd|hd|vd|nvme|mmcblk|disk)/i },
   { id: 'host-power', description: 'powers off or reboots the machine', commands: /^(shutdown|reboot|halt|poweroff|restart-computer|stop-computer)$/i, args: () => true },
+  { id: 'service-power', description: 'changes system power through a service manager', commands: /^systemctl$/i, args: segment => /\b(?:poweroff|reboot|halt|shutdown)\b/i.test(segment) },
   { id: 'init-runlevel', description: 'changes the init runlevel', commands: /^init$/i, args: segment => /\binit\s+[06]\b/i.test(segment) },
   { id: 'fork-bomb', description: 'starts a fork bomb', commands: null, anySegment: /:\s*\(\s*\)\s*\{[^}]*\}\s*;\s*:/ },
   {
     id: 'recursive-root-delete',
     description: 'recursively deletes a root or home path',
     commands: /^rm$/i,
-    args: segment => /(^|\s)-[a-z]*r[a-z]*(\s|$)/i.test(segment)
-      && /(^|\s)-[a-z]*f[a-z]*(\s|$)/i.test(segment)
-      && /(\s)(\/|\/\*|~|~\/\*|\$HOME|\$\{HOME\})(\s|$)/i.test(segment),
+    args: segment => {
+      const recursive = /(^|\s)(?:--recursive|-[a-z]*r[a-z]*)(?=\s|$)/i.test(segment);
+      const force = /(^|\s)(?:--force|-[a-z]*f[a-z]*)(?=\s|$)/i.test(segment);
+      const rootTarget = /(\s)(\/|\/\*|~|~\/\*|\$HOME|\$\{HOME\})(\s|$)/i.test(segment);
+      return recursive && force && rootTarget;
+    },
   },
   { id: 'chmod-root', description: 'recursively rewrites permissions on a root path', commands: /^chmod$/i, args: segment => /(\s)(\/|\/\*)(\s|$)/.test(segment) },
   { id: 'chown-root', description: 'recursively rewrites ownership on a root path', commands: /^chown$/i, args: segment => /(\s)(\/|\/\*)(\s|$)/.test(segment) },
@@ -39,6 +47,10 @@ function normalize(command) {
   return String(command).replace(/\s+/g, ' ').trim();
 }
 
+function matchingText(value) {
+  return String(value).replace(/(["'])(.*?)\1/g, '$2').replace(/\\(["'\\$`])/g, '$1');
+}
+
 // Split on shell control operators so each simple command is judged on its own command
 // word instead of on every word in the line.
 function segments(command) {
@@ -49,14 +61,15 @@ function segments(command) {
 }
 
 function commandWord(segment) {
-  const tokens = segment.split(' ').filter(Boolean);
+  const tokens = matchingText(segment).split(' ').filter(Boolean);
   while (tokens.length) {
     const token = tokens[0];
     if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(token)) { tokens.shift(); continue; }
-    if (WRAPPERS.has(token.toLowerCase())) {
+    const tokenName = path.basename(token).replace(/\.(exe|cmd|bat)$/i, '').toLowerCase();
+    if (WRAPPERS.has(tokenName)) {
       tokens.shift();
       while (tokens.length && tokens[0].startsWith('-')) tokens.shift();
-      if (token.toLowerCase() === 'timeout' && tokens.length && /^\d+[smhd]?$/.test(tokens[0])) tokens.shift();
+      if (tokenName === 'timeout' && tokens.length && /^\d+[smhd]?$/.test(tokens[0])) tokens.shift();
       continue;
     }
     break;
@@ -65,22 +78,42 @@ function commandWord(segment) {
   return word.replace(/^.*[\\/]/, '').replace(/\.(exe|cmd|bat)$/i, '');
 }
 
+function nestedCommandValues(command) {
+  const values = [];
+  const normalized = String(command || '');
+  const substitution = /\$\(([\s\S]*?)\)|`([^`]*)`/g;
+  for (const match of normalized.matchAll(substitution)) values.push(match[1] || match[2] || '');
+  const shellCommand = /(^|\s)(?:-c|--command|-e|--eval)\s+(?:"([\s\S]*?)"|'([\s\S]*?)'|([^\s;]+))/g;
+  for (const match of normalized.matchAll(shellCommand)) values.push(match[2] || match[3] || match[4] || '');
+  return values;
+}
+
+function nestedExecutionIsDangerous(command) {
+  const normalized = String(command || '');
+  const shell = normalized.split(/\s+/).some(token => SHELL_WRAPPERS.test(path.basename(token).replace(/\.(exe|cmd|bat)$/i, '')));
+  return (shell || INTERPRETER_EXECUTION.test(normalized)) && CATASTROPHIC_TEXT.test(normalized);
+}
+
 export function checkCommand(command) {
   if (runtimeConfig.unrestricted) return { warned: false, mode: 'allow', unrestricted: true, findings: [] };
   const normalized = normalize(command);
-  const parts = segments(normalized);
+  const nested = nestedCommandValues(normalized);
+  const commands = [normalized, ...nested];
+  const parts = commands.flatMap(segments);
   const findings = [];
   for (const blocked of runtimeConfig.blockedCommands) {
     if (normalized.toLowerCase().includes(blocked.toLowerCase())) findings.push({ id: 'policy', description: blocked, source: 'device-policy' });
   }
   if (runtimeConfig.dangerousCommands !== 'allow') {
     for (const part of parts) {
+      const matchText = matchingText(part);
       const word = commandWord(part);
       for (const rule of DANGEROUS_RULES) {
-        const matches = rule.anySegment ? rule.anySegment.test(part) : Boolean(word && rule.commands?.test(word) && rule.args(part));
+        const matches = rule.anySegment ? rule.anySegment.test(matchText) : Boolean(word && rule.commands?.test(word) && rule.args(matchText));
         if (matches) findings.push({ id: rule.id, description: rule.description, source: 'builtin' });
       }
     }
+    if (nestedExecutionIsDangerous(matchingText(normalized))) findings.push({ id: 'nested-catastrophic-command', description: 'executes a catastrophic command through a shell or interpreter', source: 'builtin' });
   }
   if (!findings.length) return { warned: false, mode: runtimeConfig.dangerousCommands };
   const unique = [...new Map(findings.map(item => [item.id + item.description, item])).values()];