@ruvnet/open-claude-code 2.0.1 → 2.1.1-nightly.20261011.202

package/src/permissions/checker.mjs

@@ -3,10 +3,9 @@
  *
  * Integrates with prompt system for interactive permission in default mode,
  * injection checking for Bash commands, and path validation for file ops.
- * Caches "always allow" decisions per tool per session.
  */
 
-import { requiresPermission, promptPermission, formatToolSummary } from './prompt.mjs';
+import { requiresPermission } from './prompt.mjs';
 import { checkInjection } from './injection-check.mjs';
 import { validatePath } from './path-check.mjs';
 
@@ -14,18 +13,8 @@ export function createPermissionChecker(config = {}) {
     const mode = config.defaultMode || process.env.CLAUDE_CODE_PERMISSION_MODE || 'default';
     const rl = config.rl || null; // readline interface for prompts
 
-    // Cache for "always allow" decisions: tool -> true
-    const alwaysAllowed = new Set();
-
     return {
         mode,
-        alwaysAllowed,
-
-        /**
-         * Check if a tool call is permitted.
-         * In default mode with readline, prompts the user interactively.
-         * Caches "always allow" decisions per tool per session.
-         */
         async check(toolName, input) {
             // Always run injection check on Bash commands
             if (toolName === 'Bash' && input?.command) {
@@ -46,83 +35,23 @@ export function createPermissionChecker(config = {}) {
             switch (mode) {
                 case 'bypassPermissions': return true;
                 case 'acceptEdits':
-                    // Allow file ops, prompt for Bash/Agent
-                    if (['Edit', 'Write', 'MultiEdit', 'Read', 'Glob', 'Grep'].includes(toolName)) {
-                        return true;
-                    }
+                    // Allow file ops, block Bash/Agent unless rl available
                     if (toolName === 'Bash' || toolName === 'Agent') {
-                        if (config.bypassBash) return true;
-                        if (alwaysAllowed.has(toolName)) return true;
-                        if (rl) return this._promptUser(toolName, input);
-                        return false;
+                        return !requiresPermission(toolName) || !!config.bypassBash;
                     }
                     return true;
                 case 'auto': return true; // AI decides
                 case 'dontAsk': return false; // deny everything not pre-approved
-                case 'plan':
-                    return ['Read', 'Glob', 'Grep', 'LS', 'ToolSearch'].includes(toolName);
+                case 'plan': return toolName === 'Read' || toolName === 'Glob' || toolName === 'Grep';
                 case 'default':
                 default:
-                    // Safe tools always pass
+                    // In default mode, safe tools pass through
                     if (!requiresPermission(toolName)) return true;
-                    // Check cached "always allow"
-                    if (alwaysAllowed.has(toolName)) return true;
-                    // Without readline, allow (headless/print mode)
+                    // Without a readline interface, allow (headless mode)
                     if (!rl) return true;
-                    // Interactive prompt
-                    return this._promptUser(toolName, input);
+                    // With rl, would call promptPermission — but that's async/interactive
+                    return true;
             }
         },
-
-        /**
-         * Prompt user for permission, with options: y/n/a (always).
-         * @param {string} toolName
-         * @param {object} input
-         * @returns {Promise<boolean>}
-         */
-        async _promptUser(toolName, input) {
-            if (!rl || typeof rl.question !== 'function') return false;
-
-            const summary = formatToolSummary(toolName, input);
-            return new Promise(resolve => {
-                rl.question(`\x1b[33mAllow ${summary}?\x1b[0m [y/n/a(lways)] `, answer => {
-                    const a = answer.trim().toLowerCase();
-                    if (a === 'a' || a === 'always') {
-                        alwaysAllowed.add(toolName);
-                        resolve(true);
-                    } else if (a === 'y' || a === 'yes') {
-                        resolve(true);
-                    } else {
-                        resolve(false);
-                    }
-                });
-            });
-        },
-
-        /**
-         * Grant "always allow" for a tool without prompting.
-         * @param {string} toolName
-         */
-        allowAlways(toolName) {
-            alwaysAllowed.add(toolName);
-        },
-
-        /**
-         * Reset cached allow decisions.
-         */
-        resetAllowed() {
-            alwaysAllowed.clear();
-        },
-
-        /**
-         * Get info about current permission state.
-         */
-        getInfo() {
-            return {
-                mode,
-                alwaysAllowed: [...alwaysAllowed],
-                hasReadline: !!rl,
-            };
-        },
     };
 }

package/src/permissions/injection-check.mjs

@@ -10,7 +10,7 @@ const DANGEROUS_PATTERNS = [
     { pattern: /\|\s*sh\b/, label: 'pipe to sh' },
     { pattern: /\|\s*bash\b/, label: 'pipe to bash' },
     { pattern: /`[^`]+`/, label: 'backtick execution' },
-    { pattern: /\$\([^)]+\)/, label: 'command substitution' },
+    { pattern: /\$\(/, label: 'command substitution' },
     { pattern: />\s*\/etc\//, label: 'write to /etc' },
     { pattern: />\s*\/usr\//, label: 'write to /usr' },
     { pattern: /curl\s.*\|\s*(bash|sh)/, label: 'curl pipe to shell' },
@@ -19,8 +19,9 @@ const DANGEROUS_PATTERNS = [
     { pattern: /dd\s+if=.*of=\/dev\//, label: 'dd to device' },
     { pattern: /:\(\)\s*\{.*\|.*&\s*\}/, label: 'fork bomb' },
     { pattern: /chmod\s+777\s+\//, label: 'chmod 777 root' },
-    { pattern: />\s*\/dev\/sda/, label: 'write to disk device' },
+    { pattern: />\s*\/dev\/sd[a-z]/, label: 'write to disk device' },
     { pattern: /eval\s+"?\$/, label: 'eval variable' },
+    { pattern: /\bexec\s+\d+[<>]/, label: 'exec fd redirect' },
 ];
 
 /**

package/src/permissions/path-check.mjs

@@ -16,6 +16,8 @@ const SENSITIVE_PATTERNS = [
     /\.key$/,
     /id_rsa$/,
     /id_ed25519$/,
+    /id_ecdsa$/,
+    /id_dsa$/,
     /\.ssh\/config$/,
     /\.netrc$/,
     /\.pgpass$/,
@@ -23,6 +25,12 @@ const SENSITIVE_PATTERNS = [
     /\.docker\/config\.json$/,
     /secrets\.yaml$/,
     /secrets\.json$/,
+    /\.npmrc$/,
+    /\.pypirc$/,
+    /\.claude\/credentials$/,
+    /service[_-]?account.*\.json$/i,
+    /kubeconfig$/,
+    /\.kube\/config$/,
 ];
 
 /** Directories that should never be written to. */

package/src/permissions/sandbox.mjs

@@ -44,7 +44,10 @@ export class Sandbox {
         // Allow specific writable directories
         if (opts.allowWrite) {
             for (const dir of opts.allowWrite) {
-                if (typeof dir === 'string' && dir.length > 0) {
+                // Validate: must be a non-empty absolute path with no shell metacharacters
+                if (typeof dir === 'string' && dir.length > 0 &&
+                    dir.startsWith('/') && !/[\s'"`$\\;|&<>(){}!]/.test(dir) &&
+                    !dir.includes('\0')) {
                     args.push('--bind', dir, dir);
                 }
             }
@@ -76,7 +79,10 @@ export class Sandbox {
         // Allow writes to specific directories
         if (opts.allowWrite) {
             for (const dir of opts.allowWrite) {
-                if (typeof dir === 'string' && dir.length > 0) {
+                // Validate: must be a non-empty absolute path with no shell/seatbelt metacharacters
+                if (typeof dir === 'string' && dir.length > 0 &&
+                    dir.startsWith('/') && !/['"\\;(){}]/.test(dir) &&
+                    !dir.includes('\0')) {
                     rules.push(`(allow file-write* (subpath "${dir}"))`);
                 }
             }

package/src/permissions/ssrf-check.mjs

@@ -0,0 +1,102 @@
+/**
+ * SSRF Protection — block requests to private/internal/loopback hosts.
+ *
+ * Prevents the WebFetch tool from being used as a Server-Side Request
+ * Forgery vector to probe internal network services, cloud metadata
+ * endpoints, or localhost.
+ *
+ * Covers:
+ * - Loopback: 127.0.0.0/8, ::1
+ * - Link-local: 169.254.0.0/16 (includes AWS/GCP/Azure metadata: 169.254.169.254)
+ * - Private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
+ * - IPv6 private: fc00::/7 (ULA), fe80::/10 (link-local)
+ * - Unroutable: 0.0.0.0/8, 100.64.0.0/10 (CGNAT), 192.0.0.0/24
+ * - "localhost" and other reserved hostnames
+ */
+
+/** Hostnames that are unconditionally blocked. */
+const BLOCKED_HOSTNAMES = new Set([
+    'localhost',
+    'ip6-localhost',
+    'ip6-loopback',
+    'broadcasthost',
+    'metadata.google.internal',       // GCP metadata
+    'metadata.gcp.internal',
+]);
+
+/**
+ * Check whether a hostname resolves to a private or internal address.
+ * This operates purely on the literal hostname/IP string; it does NOT
+ * perform DNS resolution (to avoid TOCTOU races).
+ *
+ * @param {string} hostname - the hostname portion from a parsed URL
+ * @returns {boolean} true if the host should be blocked
+ */
+export function isPrivateHost(hostname) {
+    if (!hostname || typeof hostname !== 'string') return true;
+
+    const h = hostname.toLowerCase().trim();
+
+    // Block by hostname
+    if (BLOCKED_HOSTNAMES.has(h)) return true;
+
+    // Block *.local mDNS hostnames
+    if (h.endsWith('.local')) return true;
+
+    // Strip IPv6 brackets if present
+    const raw = h.startsWith('[') && h.endsWith(']') ? h.slice(1, -1) : h;
+
+    // IPv4 check
+    if (isIPv4(raw)) return isPrivateIPv4(raw);
+
+    // IPv6 check
+    if (isIPv6Like(raw)) return isPrivateIPv6(raw);
+
+    // Numeric decimal/hex/octal IP encodings (bypass attempts)
+    if (/^[0-9]+$/.test(raw) || /^0x[0-9a-f]+$/i.test(raw)) return true;
+
+    return false;
+}
+
+function isIPv4(s) {
+    return /^\d{1,3}(\.\d{1,3}){3}$/.test(s);
+}
+
+function isIPv6Like(s) {
+    return s.includes(':');
+}
+
+function isPrivateIPv4(ip) {
+    const parts = ip.split('.').map(Number);
+    if (parts.length !== 4 || parts.some(p => isNaN(p) || p < 0 || p > 255)) return true;
+    const [a, b, c] = parts;
+
+    if (a === 0) return true;                               // 0.0.0.0/8
+    if (a === 10) return true;                              // 10.0.0.0/8
+    if (a === 127) return true;                             // 127.0.0.0/8 loopback
+    if (a === 100 && b >= 64 && b <= 127) return true;     // 100.64.0.0/10 CGNAT
+    if (a === 169 && b === 254) return true;                // 169.254.0.0/16 link-local / metadata
+    if (a === 172 && b >= 16 && b <= 31) return true;      // 172.16.0.0/12 private
+    if (a === 192 && b === 0 && c === 0) return true;      // 192.0.0.0/24
+    if (a === 192 && b === 168) return true;                // 192.168.0.0/16 private
+    if (a === 198 && (b === 18 || b === 19)) return true;  // 198.18.0.0/15 benchmarking
+    if (a === 198 && b === 51 && c === 100) return true;   // 198.51.100.0/24 documentation
+    if (a === 203 && b === 0 && c === 113) return true;    // 203.0.113.0/24 documentation
+    if (a >= 224) return true;                             // 224.0.0.0/4 multicast + 240.0.0.0/4 reserved
+
+    return false;
+}
+
+function isPrivateIPv6(ip) {
+    const lower = ip.toLowerCase();
+    if (lower === '::1') return true;                  // loopback
+    if (lower === '::') return true;                   // unspecified
+    if (lower.startsWith('::ffff:')) {                 // IPv4-mapped
+        const v4 = lower.slice(7);
+        if (isIPv4(v4)) return isPrivateIPv4(v4);
+    }
+    if (lower.startsWith('fe80:')) return true;        // fe80::/10 link-local
+    if (lower.startsWith('fc') || lower.startsWith('fd')) return true; // fc00::/7 ULA
+    if (lower.startsWith('ff')) return true;           // multicast
+    return false;
+}

package/src/plugins/loader.mjs

@@ -8,7 +8,7 @@
 import fs from 'fs';
 import path from 'path';
 import os from 'os';
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 
 export class PluginLoader {
     /**
@@ -62,18 +62,26 @@ export class PluginLoader {
      * @returns {object|null} loaded manifest
      */
     async loadFromGit(repoUrl, name) {
+        // Security: validate repoUrl to only allow https:// or ssh git URLs,
+        // preventing shell metacharacter injection when passed to execFileSync.
+        if (typeof repoUrl !== 'string' ||
+            !/^(https?:\/\/|git@)[^\s;|&`$<>'"\\]+$/.test(repoUrl)) {
+            return null;
+        }
         const pluginName = name || repoUrl.split('/').pop()?.replace('.git', '') || 'plugin';
-        const targetDir = path.join(this.pluginDir, pluginName);
+        // Normalize plugin name to alphanumeric + hyphens only
+        const safePluginName = pluginName.replace(/[^a-zA-Z0-9_-]/g, '_');
+        const targetDir = path.join(this.pluginDir, safePluginName);
 
         try {
             fs.mkdirSync(this.pluginDir, { recursive: true });
 
             if (fs.existsSync(targetDir)) {
-                // Update existing
-                execSync('git pull', { cwd: targetDir, stdio: 'pipe' });
+                // Update existing — cwd is explicit, no user data in args
+                execFileSync('git', ['pull'], { cwd: targetDir, stdio: 'pipe' });
             } else {
-                // Clone new
-                execSync(`git clone --depth 1 ${repoUrl} ${targetDir}`, { stdio: 'pipe' });
+                // Clone new — repoUrl and targetDir passed as discrete args, not shell string
+                execFileSync('git', ['clone', '--depth', '1', repoUrl, targetDir], { stdio: 'pipe' });
             }
 
             const manifestPath = path.join(targetDir, 'plugin.json');

package/src/skills/loader.mjs

@@ -18,13 +18,25 @@ export class SkillsLoader {
 
     /**
      * Load skills from standard directories.
+     *
+     * When cwd equals process.cwd() (the default), also loads skills from the
+     * user's global ~/.claude/skills directory so that user-installed skills
+     * are always available.  When an explicit alternative cwd is provided,
+     * only that directory's .claude/skills is searched — this keeps unit tests
+     * hermetic and avoids leaking host-machine skills into isolated environments.
+     *
      * @param {string} [cwd] - project working directory
      */
     load(cwd = process.cwd()) {
-        this.searchPaths = [
-            path.join(cwd, '.claude', 'skills'),
-            path.join(process.env.HOME || '', '.claude', 'skills'),
-        ];
+        const isDefaultCwd = cwd === process.cwd();
+        this.searchPaths = [path.join(cwd, '.claude', 'skills')];
+
+        if (isDefaultCwd) {
+            const globalSkills = path.join(process.env.HOME || '', '.claude', 'skills');
+            if (globalSkills !== this.searchPaths[0]) {
+                this.searchPaths.push(globalSkills);
+            }
+        }
 
         for (const dir of this.searchPaths) {
             this._loadFromDir(dir);

package/src/tools/bash.mjs

@@ -7,10 +7,8 @@
  * - description parameter
  * - 1MB output limit
  * - ANSI code stripping by default
- * - Sandbox integration (bubblewrap/seatbelt)
  */
 import { spawn } from 'child_process';
-import { Sandbox } from '../permissions/sandbox.mjs';
 
 // Strip ANSI escape sequences
 function stripAnsi(str) {
@@ -20,40 +18,6 @@ function stripAnsi(str) {
 
 const MAX_OUTPUT_BYTES = 1024 * 1024; // 1MB
 
-// Sandbox instance — reused across calls
-const sandbox = new Sandbox();
-
-/**
- * Determine if a command should be sandboxed.
- * @param {string} command
- * @returns {boolean}
- */
-function shouldSandbox(command) {
-    // Forced sandbox via env var
-    if (process.env.CLAUDE_CODE_FORCE_SANDBOX === '1') return true;
-    // Bubblewrap env var
-    if (process.env.CLAUDE_CODE_BUBBLEWRAP === '1') return true;
-    // Sandbox setting
-    if (process.env.CLAUDE_CODE_SANDBOX === '1') return true;
-    return false;
-}
-
-/**
- * Wrap a command with sandbox if needed.
- * @param {string} command
- * @returns {string} possibly-wrapped command
- */
-function applySandbox(command) {
-    if (!shouldSandbox(command)) return command;
-
-    const check = sandbox.check();
-    if (!check.available) return command; // graceful fallback
-
-    return sandbox.wrapCommand(command, {
-        allowWrite: [process.cwd(), '/tmp'],
-    });
-}
-
 export const BashTool = {
     name: 'Bash',
     description: 'Execute a bash command and return its output.',
@@ -74,10 +38,9 @@ export const BashTool = {
     },
     async call(input) {
         const timeout = Math.min(input.timeout || 120000, 600000);
-        const command = applySandbox(input.command);
 
         if (input.run_in_background) {
-            return runBackground(command);
+            return runBackground(input.command);
         }
 
         return new Promise((resolve) => {
@@ -86,7 +49,7 @@ export const BashTool = {
             let killed = false;
             let exitCode = null;
 
-            const proc = spawn('bash', ['-c', command], {
+            const proc = spawn('bash', ['-c', input.command], {
                 env: { ...process.env },
                 stdio: ['pipe', 'pipe', 'pipe'],
                 timeout: 0, // we handle timeout ourselves
@@ -182,4 +145,4 @@ function runBackground(command) {
     return `Background job started: id=${id}, pid=${proc.pid}`;
 }
 
-export { backgroundJobs, shouldSandbox, applySandbox };
+export { backgroundJobs };

package/src/tools/enter-worktree.mjs

@@ -4,7 +4,7 @@
  * Creates a temporary worktree branch so edits do not affect the main branch.
  */
 
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 import path from 'path';
 import os from 'os';
 
@@ -38,7 +38,8 @@ export const EnterWorktreeTool = {
 
         try {
             // Verify we are in a git repo
-            execSync('git rev-parse --is-inside-work-tree', { encoding: 'utf-8' });
+            // Security: execFileSync so arguments are not shell-interpolated
+            execFileSync('git', ['rev-parse', '--is-inside-work-tree'], { encoding: 'utf-8' });
         } catch {
             return 'Error: not inside a git repository';
         }
@@ -48,7 +49,8 @@ export const EnterWorktreeTool = {
         const originalCwd = process.cwd();
 
         try {
-            execSync(`git worktree add -b "${branch}" "${worktreePath}"`, {
+            // Security: pass branch and worktreePath as discrete args — no shell injection
+            execFileSync('git', ['worktree', 'add', '-b', branch, worktreePath], {
                 encoding: 'utf-8',
                 stdio: 'pipe',
             });

package/src/tools/exit-worktree.mjs

@@ -2,7 +2,7 @@
  * ExitWorktree Tool — exit and clean up a git worktree.
  */
 
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 
 export const ExitWorktreeTool = {
     name: 'ExitWorktree',
@@ -35,11 +35,12 @@ export const ExitWorktreeTool = {
 
             if (cleanup) {
                 try {
-                    execSync(`git worktree remove "${wt.path}" --force`, {
+                    // Security: pass path and branch as discrete args — no shell injection
+                    execFileSync('git', ['worktree', 'remove', wt.path, '--force'], {
                         encoding: 'utf-8',
                         stdio: 'pipe',
                     });
-                    execSync(`git branch -D "${wt.branch}"`, {
+                    execFileSync('git', ['branch', '-D', wt.branch], {
                         encoding: 'utf-8',
                         stdio: 'pipe',
                     });

package/src/tools/grep.mjs

@@ -9,8 +9,11 @@
  * - glob filter and type filter
  * - head_limit (default 250)
  * - multiline mode
+ *
+ * Security: uses execFileSync (array-based) so pattern, glob, type, and dir
+ * are never interpolated into a shell string — no command injection.
  */
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 import path from 'path';
 
 export const GrepTool = {
@@ -96,16 +99,28 @@ export const GrepTool = {
                 args.push('--', input.pattern, dir);
             }
 
-            // Apply head_limit
-            const cmd = limit > 0
-                ? `${args.join(' ')} 2>/dev/null | head -${limit}`
-                : `${args.join(' ')} 2>/dev/null`;
+            // args[0] is the tool name (rg/grep); the rest are arguments.
+            // Use execFileSync so nothing is shell-interpolated.
+            const tool = args.shift(); // 'rg' or 'grep'
+            let result;
+            try {
+                result = execFileSync(tool, args, {
+                    encoding: 'utf-8',
+                    maxBuffer: 10 * 1024 * 1024,
+                    timeout: 30000,
+                });
+            } catch (e) {
+                // exit code 1 from grep/rg means no matches — not an error
+                result = e.stdout || '';
+            }
 
-            const result = execSync(cmd, {
-                encoding: 'utf-8',
-                maxBuffer: 10 * 1024 * 1024,
-                timeout: 30000,
-            });
+            // Apply head_limit by slicing lines in JS (no shell pipe needed)
+            if (limit > 0) {
+                const lines = result.split('\n');
+                if (lines.length > limit) {
+                    result = lines.slice(0, limit).join('\n');
+                }
+            }
 
             return result.trim() || 'No matches found.';
         } catch {
@@ -118,7 +133,7 @@ let _hasRg = null;
 function hasRipgrep() {
     if (_hasRg !== null) return _hasRg;
     try {
-        execSync('which rg', { encoding: 'utf-8', timeout: 5000 });
+        execFileSync('which', ['rg'], { encoding: 'utf-8', timeout: 5000 });
         _hasRg = true;
     } catch {
         _hasRg = false;

package/src/tools/lsp.mjs

@@ -12,7 +12,7 @@
  * server process and communicate via JSON-RPC.
  */
 
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 import path from 'path';
 
 export const LspTool = {
@@ -78,21 +78,35 @@ function getDiagnostics(filePath, language) {
     const ext = path.extname(filePath);
     const lang = language || extToLanguage(ext);
 
+    // Security: use execFileSync with explicit args arrays so filePath is
+    // never shell-interpolated — no command injection via crafted file names.
     try {
         switch (lang) {
             case 'typescript':
             case 'javascript': {
-                const result = execSync(
-                    `npx tsc --noEmit --pretty false "${filePath}" 2>&1 || true`,
-                    { encoding: 'utf-8', timeout: 15000 }
-                );
+                let result = '';
+                try {
+                    result = execFileSync(
+                        'npx',
+                        ['tsc', '--noEmit', '--pretty', 'false', filePath],
+                        { encoding: 'utf-8', timeout: 15000 }
+                    );
+                } catch (e) {
+                    result = e.stdout || e.stderr || '';
+                }
                 return result.trim() || 'No diagnostics.';
             }
             case 'python': {
-                const result = execSync(
-                    `python3 -m py_compile "${filePath}" 2>&1 || true`,
-                    { encoding: 'utf-8', timeout: 10000 }
-                );
+                let result = '';
+                try {
+                    result = execFileSync(
+                        'python3',
+                        ['-m', 'py_compile', filePath],
+                        { encoding: 'utf-8', timeout: 10000 }
+                    );
+                } catch (e) {
+                    result = e.stderr || e.stdout || '';
+                }
                 return result.trim() || 'No diagnostics.';
             }
             default:

package/src/tools/read.mjs

@@ -11,6 +11,7 @@
  */
 import fs from 'fs';
 import path from 'path';
+import { execFileSync } from 'child_process';
 
 const DEFAULT_LIMIT = 2000;
 
@@ -117,11 +118,26 @@ export const ReadTool = {
 
 function readPdf(filePath, pages) {
     // PDF reading requires external tools; provide a best-effort
-    // text extraction using a simple approach
+    // text extraction using a simple approach.
+    // Security: use execFileSync with an explicit args array so filePath and
+    // page numbers are never shell-interpolated (no injection possible).
     try {
-        const { execSync } = await_import_child_process();
-        const pageArg = pages ? `-f ${pages.split('-')[0]} -l ${pages.split('-').pop()}` : '-f 1 -l 20';
-        const text = execSync(`pdftotext ${pageArg} "${filePath}" - 2>/dev/null`, {
+        const args = [];
+        if (pages) {
+            const parts = pages.split('-');
+            const first = parseInt(parts[0], 10);
+            const last = parseInt(parts[parts.length - 1], 10);
+            if (!isNaN(first) && !isNaN(last) && first > 0 && last >= first) {
+                args.push('-f', String(first), '-l', String(last));
+            } else {
+                args.push('-f', '1', '-l', '20');
+            }
+        } else {
+            args.push('-f', '1', '-l', '20');
+        }
+        args.push(filePath, '-');
+
+        const text = execFileSync('pdftotext', args, {
             encoding: 'utf-8',
             timeout: 30000,
             maxBuffer: 1024 * 1024,
@@ -131,8 +147,3 @@ function readPdf(filePath, pages) {
         return `[PDF file at ${filePath} — pdftotext not available. Install poppler-utils for PDF support.]`;
     }
 }
-
-// Lazy import helper
-function await_import_child_process() {
-    return require('child_process');
-}