@ruvnet/open-claude-code 2.1.0 → 2.1.1

package/src/permissions/ssrf-check.mjs

@@ -0,0 +1,102 @@
+/**
+ * SSRF Protection — block requests to private/internal/loopback hosts.
+ *
+ * Prevents the WebFetch tool from being used as a Server-Side Request
+ * Forgery vector to probe internal network services, cloud metadata
+ * endpoints, or localhost.
+ *
+ * Covers:
+ * - Loopback: 127.0.0.0/8, ::1
+ * - Link-local: 169.254.0.0/16 (includes AWS/GCP/Azure metadata: 169.254.169.254)
+ * - Private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
+ * - IPv6 private: fc00::/7 (ULA), fe80::/10 (link-local)
+ * - Unroutable: 0.0.0.0/8, 100.64.0.0/10 (CGNAT), 192.0.0.0/24
+ * - "localhost" and other reserved hostnames
+ */
+
+/** Hostnames that are unconditionally blocked. */
+const BLOCKED_HOSTNAMES = new Set([
+    'localhost',
+    'ip6-localhost',
+    'ip6-loopback',
+    'broadcasthost',
+    'metadata.google.internal',       // GCP metadata
+    'metadata.gcp.internal',
+]);
+
+/**
+ * Check whether a hostname resolves to a private or internal address.
+ * This operates purely on the literal hostname/IP string; it does NOT
+ * perform DNS resolution (to avoid TOCTOU races).
+ *
+ * @param {string} hostname - the hostname portion from a parsed URL
+ * @returns {boolean} true if the host should be blocked
+ */
+export function isPrivateHost(hostname) {
+    if (!hostname || typeof hostname !== 'string') return true;
+
+    const h = hostname.toLowerCase().trim();
+
+    // Block by hostname
+    if (BLOCKED_HOSTNAMES.has(h)) return true;
+
+    // Block *.local mDNS hostnames
+    if (h.endsWith('.local')) return true;
+
+    // Strip IPv6 brackets if present
+    const raw = h.startsWith('[') && h.endsWith(']') ? h.slice(1, -1) : h;
+
+    // IPv4 check
+    if (isIPv4(raw)) return isPrivateIPv4(raw);
+
+    // IPv6 check
+    if (isIPv6Like(raw)) return isPrivateIPv6(raw);
+
+    // Numeric decimal/hex/octal IP encodings (bypass attempts)
+    if (/^[0-9]+$/.test(raw) || /^0x[0-9a-f]+$/i.test(raw)) return true;
+
+    return false;
+}
+
+function isIPv4(s) {
+    return /^\d{1,3}(\.\d{1,3}){3}$/.test(s);
+}
+
+function isIPv6Like(s) {
+    return s.includes(':');
+}
+
+function isPrivateIPv4(ip) {
+    const parts = ip.split('.').map(Number);
+    if (parts.length !== 4 || parts.some(p => isNaN(p) || p < 0 || p > 255)) return true;
+    const [a, b, c] = parts;
+
+    if (a === 0) return true;                               // 0.0.0.0/8
+    if (a === 10) return true;                              // 10.0.0.0/8
+    if (a === 127) return true;                             // 127.0.0.0/8 loopback
+    if (a === 100 && b >= 64 && b <= 127) return true;     // 100.64.0.0/10 CGNAT
+    if (a === 169 && b === 254) return true;                // 169.254.0.0/16 link-local / metadata
+    if (a === 172 && b >= 16 && b <= 31) return true;      // 172.16.0.0/12 private
+    if (a === 192 && b === 0 && c === 0) return true;      // 192.0.0.0/24
+    if (a === 192 && b === 168) return true;                // 192.168.0.0/16 private
+    if (a === 198 && (b === 18 || b === 19)) return true;  // 198.18.0.0/15 benchmarking
+    if (a === 198 && b === 51 && c === 100) return true;   // 198.51.100.0/24 documentation
+    if (a === 203 && b === 0 && c === 113) return true;    // 203.0.113.0/24 documentation
+    if (a >= 224) return true;                             // 224.0.0.0/4 multicast + 240.0.0.0/4 reserved
+
+    return false;
+}
+
+function isPrivateIPv6(ip) {
+    const lower = ip.toLowerCase();
+    if (lower === '::1') return true;                  // loopback
+    if (lower === '::') return true;                   // unspecified
+    if (lower.startsWith('::ffff:')) {                 // IPv4-mapped
+        const v4 = lower.slice(7);
+        if (isIPv4(v4)) return isPrivateIPv4(v4);
+    }
+    if (lower.startsWith('fe80:')) return true;        // fe80::/10 link-local
+    if (lower.startsWith('fc') || lower.startsWith('fd')) return true; // fc00::/7 ULA
+    if (lower.startsWith('ff')) return true;           // multicast
+    return false;
+}

package/src/plugins/loader.mjs

@@ -8,7 +8,7 @@
 import fs from 'fs';
 import path from 'path';
 import os from 'os';
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 
 export class PluginLoader {
     /**
@@ -62,18 +62,26 @@ export class PluginLoader {
      * @returns {object|null} loaded manifest
      */
     async loadFromGit(repoUrl, name) {
+        // Security: validate repoUrl to only allow https:// or ssh git URLs,
+        // preventing shell metacharacter injection when passed to execFileSync.
+        if (typeof repoUrl !== 'string' ||
+            !/^(https?:\/\/|git@)[^\s;|&`$<>'"\\]+$/.test(repoUrl)) {
+            return null;
+        }
         const pluginName = name || repoUrl.split('/').pop()?.replace('.git', '') || 'plugin';
-        const targetDir = path.join(this.pluginDir, pluginName);
+        // Normalize plugin name to alphanumeric + hyphens only
+        const safePluginName = pluginName.replace(/[^a-zA-Z0-9_-]/g, '_');
+        const targetDir = path.join(this.pluginDir, safePluginName);
 
         try {
             fs.mkdirSync(this.pluginDir, { recursive: true });
 
             if (fs.existsSync(targetDir)) {
-                // Update existing
-                execSync('git pull', { cwd: targetDir, stdio: 'pipe' });
+                // Update existing — cwd is explicit, no user data in args
+                execFileSync('git', ['pull'], { cwd: targetDir, stdio: 'pipe' });
             } else {
-                // Clone new
-                execSync(`git clone --depth 1 ${repoUrl} ${targetDir}`, { stdio: 'pipe' });
+                // Clone new — repoUrl and targetDir passed as discrete args, not shell string
+                execFileSync('git', ['clone', '--depth', '1', repoUrl, targetDir], { stdio: 'pipe' });
             }
 
             const manifestPath = path.join(targetDir, 'plugin.json');

package/src/skills/loader.mjs

@@ -18,13 +18,25 @@ export class SkillsLoader {
 
     /**
      * Load skills from standard directories.
+     *
+     * When cwd equals process.cwd() (the default), also loads skills from the
+     * user's global ~/.claude/skills directory so that user-installed skills
+     * are always available.  When an explicit alternative cwd is provided,
+     * only that directory's .claude/skills is searched — this keeps unit tests
+     * hermetic and avoids leaking host-machine skills into isolated environments.
+     *
      * @param {string} [cwd] - project working directory
      */
     load(cwd = process.cwd()) {
-        this.searchPaths = [
-            path.join(cwd, '.claude', 'skills'),
-            path.join(process.env.HOME || '', '.claude', 'skills'),
-        ];
+        const isDefaultCwd = cwd === process.cwd();
+        this.searchPaths = [path.join(cwd, '.claude', 'skills')];
+
+        if (isDefaultCwd) {
+            const globalSkills = path.join(process.env.HOME || '', '.claude', 'skills');
+            if (globalSkills !== this.searchPaths[0]) {
+                this.searchPaths.push(globalSkills);
+            }
+        }
 
         for (const dir of this.searchPaths) {
             this._loadFromDir(dir);

package/src/tools/enter-worktree.mjs

@@ -4,7 +4,7 @@
  * Creates a temporary worktree branch so edits do not affect the main branch.
  */
 
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 import path from 'path';
 import os from 'os';
 
@@ -38,7 +38,8 @@ export const EnterWorktreeTool = {
 
         try {
             // Verify we are in a git repo
-            execSync('git rev-parse --is-inside-work-tree', { encoding: 'utf-8' });
+            // Security: execFileSync so arguments are not shell-interpolated
+            execFileSync('git', ['rev-parse', '--is-inside-work-tree'], { encoding: 'utf-8' });
         } catch {
             return 'Error: not inside a git repository';
         }
@@ -48,7 +49,8 @@ export const EnterWorktreeTool = {
         const originalCwd = process.cwd();
 
         try {
-            execSync(`git worktree add -b "${branch}" "${worktreePath}"`, {
+            // Security: pass branch and worktreePath as discrete args — no shell injection
+            execFileSync('git', ['worktree', 'add', '-b', branch, worktreePath], {
                 encoding: 'utf-8',
                 stdio: 'pipe',
             });

package/src/tools/exit-worktree.mjs

@@ -2,7 +2,7 @@
  * ExitWorktree Tool — exit and clean up a git worktree.
  */
 
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 
 export const ExitWorktreeTool = {
     name: 'ExitWorktree',
@@ -35,11 +35,12 @@ export const ExitWorktreeTool = {
 
             if (cleanup) {
                 try {
-                    execSync(`git worktree remove "${wt.path}" --force`, {
+                    // Security: pass path and branch as discrete args — no shell injection
+                    execFileSync('git', ['worktree', 'remove', wt.path, '--force'], {
                         encoding: 'utf-8',
                         stdio: 'pipe',
                     });
-                    execSync(`git branch -D "${wt.branch}"`, {
+                    execFileSync('git', ['branch', '-D', wt.branch], {
                         encoding: 'utf-8',
                         stdio: 'pipe',
                     });

package/src/tools/grep.mjs

@@ -9,8 +9,11 @@
  * - glob filter and type filter
  * - head_limit (default 250)
  * - multiline mode
+ *
+ * Security: uses execFileSync (array-based) so pattern, glob, type, and dir
+ * are never interpolated into a shell string — no command injection.
  */
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 import path from 'path';
 
 export const GrepTool = {
@@ -96,16 +99,28 @@ export const GrepTool = {
                 args.push('--', input.pattern, dir);
             }
 
-            // Apply head_limit
-            const cmd = limit > 0
-                ? `${args.join(' ')} 2>/dev/null | head -${limit}`
-                : `${args.join(' ')} 2>/dev/null`;
+            // args[0] is the tool name (rg/grep); the rest are arguments.
+            // Use execFileSync so nothing is shell-interpolated.
+            const tool = args.shift(); // 'rg' or 'grep'
+            let result;
+            try {
+                result = execFileSync(tool, args, {
+                    encoding: 'utf-8',
+                    maxBuffer: 10 * 1024 * 1024,
+                    timeout: 30000,
+                });
+            } catch (e) {
+                // exit code 1 from grep/rg means no matches — not an error
+                result = e.stdout || '';
+            }
 
-            const result = execSync(cmd, {
-                encoding: 'utf-8',
-                maxBuffer: 10 * 1024 * 1024,
-                timeout: 30000,
-            });
+            // Apply head_limit by slicing lines in JS (no shell pipe needed)
+            if (limit > 0) {
+                const lines = result.split('\n');
+                if (lines.length > limit) {
+                    result = lines.slice(0, limit).join('\n');
+                }
+            }
 
             return result.trim() || 'No matches found.';
         } catch {
@@ -118,7 +133,7 @@ let _hasRg = null;
 function hasRipgrep() {
     if (_hasRg !== null) return _hasRg;
     try {
-        execSync('which rg', { encoding: 'utf-8', timeout: 5000 });
+        execFileSync('which', ['rg'], { encoding: 'utf-8', timeout: 5000 });
         _hasRg = true;
     } catch {
         _hasRg = false;

package/src/tools/lsp.mjs

@@ -12,7 +12,7 @@
  * server process and communicate via JSON-RPC.
  */
 
-import { execSync } from 'child_process';
+import { execFileSync } from 'child_process';
 import path from 'path';
 
 export const LspTool = {
@@ -78,21 +78,35 @@ function getDiagnostics(filePath, language) {
     const ext = path.extname(filePath);
     const lang = language || extToLanguage(ext);
 
+    // Security: use execFileSync with explicit args arrays so filePath is
+    // never shell-interpolated — no command injection via crafted file names.
     try {
         switch (lang) {
             case 'typescript':
             case 'javascript': {
-                const result = execSync(
-                    `npx tsc --noEmit --pretty false "${filePath}" 2>&1 || true`,
-                    { encoding: 'utf-8', timeout: 15000 }
-                );
+                let result = '';
+                try {
+                    result = execFileSync(
+                        'npx',
+                        ['tsc', '--noEmit', '--pretty', 'false', filePath],
+                        { encoding: 'utf-8', timeout: 15000 }
+                    );
+                } catch (e) {
+                    result = e.stdout || e.stderr || '';
+                }
                 return result.trim() || 'No diagnostics.';
             }
             case 'python': {
-                const result = execSync(
-                    `python3 -m py_compile "${filePath}" 2>&1 || true`,
-                    { encoding: 'utf-8', timeout: 10000 }
-                );
+                let result = '';
+                try {
+                    result = execFileSync(
+                        'python3',
+                        ['-m', 'py_compile', filePath],
+                        { encoding: 'utf-8', timeout: 10000 }
+                    );
+                } catch (e) {
+                    result = e.stderr || e.stdout || '';
+                }
                 return result.trim() || 'No diagnostics.';
             }
             default:

package/src/tools/read.mjs

@@ -11,6 +11,7 @@
  */
 import fs from 'fs';
 import path from 'path';
+import { execFileSync } from 'child_process';
 
 const DEFAULT_LIMIT = 2000;
 
@@ -117,11 +118,26 @@ export const ReadTool = {
 
 function readPdf(filePath, pages) {
     // PDF reading requires external tools; provide a best-effort
-    // text extraction using a simple approach
+    // text extraction using a simple approach.
+    // Security: use execFileSync with an explicit args array so filePath and
+    // page numbers are never shell-interpolated (no injection possible).
     try {
-        const { execSync } = await_import_child_process();
-        const pageArg = pages ? `-f ${pages.split('-')[0]} -l ${pages.split('-').pop()}` : '-f 1 -l 20';
-        const text = execSync(`pdftotext ${pageArg} "${filePath}" - 2>/dev/null`, {
+        const args = [];
+        if (pages) {
+            const parts = pages.split('-');
+            const first = parseInt(parts[0], 10);
+            const last = parseInt(parts[parts.length - 1], 10);
+            if (!isNaN(first) && !isNaN(last) && first > 0 && last >= first) {
+                args.push('-f', String(first), '-l', String(last));
+            } else {
+                args.push('-f', '1', '-l', '20');
+            }
+        } else {
+            args.push('-f', '1', '-l', '20');
+        }
+        args.push(filePath, '-');
+
+        const text = execFileSync('pdftotext', args, {
             encoding: 'utf-8',
             timeout: 30000,
             maxBuffer: 1024 * 1024,
@@ -131,8 +147,3 @@ function readPdf(filePath, pages) {
         return `[PDF file at ${filePath} — pdftotext not available. Install poppler-utils for PDF support.]`;
     }
 }
-
-// Lazy import helper
-function await_import_child_process() {
-    return require('child_process');
-}

package/src/tools/send-message.mjs

@@ -5,6 +5,8 @@
  * Messages are stored in a shared message queue.
  */
 
+import { randomBytes } from 'crypto';
+
 const messageQueue = new Map(); // agentId -> messages[]
 
 export const SendMessageTool = {
@@ -38,8 +40,10 @@ export const SendMessageTool = {
     },
 
     async call(input) {
+        // Use cryptographically secure random bytes for message IDs to
+        // prevent guessing/enumeration of message identifiers.
         const msg = {
-            id: `msg_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
+            id: `msg_${Date.now()}_${randomBytes(6).toString('hex')}`,
             from: process.env.AGENT_ID || 'main',
             to: input.to,
             type: input.type || 'notification',

package/src/tools/web-fetch.mjs

@@ -1,7 +1,13 @@
 /**
  * Web Fetch Tool — fetch URL content using built-in Node.js fetch.
+ *
+ * Security: validates the URL before fetching to prevent SSRF attacks.
+ * Private/link-local/loopback addresses and cloud metadata endpoints are
+ * blocked so the tool cannot be used to probe internal network services.
  */
 
+import { isPrivateHost } from '../permissions/ssrf-check.mjs';
+
 export const WebFetchTool = {
     name: 'WebFetch',
     description: 'Fetch content from a URL. Returns the response body as text.',
@@ -25,7 +31,15 @@ export const WebFetchTool = {
         const errors = [];
         if (!input.url) errors.push('url is required');
         try {
-            new URL(input.url);
+            const parsed = new URL(input.url);
+            // Only allow http and https protocols
+            if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+                errors.push('url must use http or https protocol');
+            }
+            // Block SSRF: reject private/internal/loopback hosts
+            if (isPrivateHost(parsed.hostname)) {
+                errors.push('url must not target private or internal network addresses');
+            }
         } catch {
             errors.push('url must be a valid URL');
         }

package/src/tools/web-search.mjs

@@ -5,7 +5,11 @@
  * - Brave Search API (BRAVE_API_KEY)
  * - SearXNG (self-hosted, SEARXNG_URL)
  * - Fallback: returns instructions to use web-fetch instead
+ *
+ * Security: validates that SEARXNG_URL does not target private/internal
+ * addresses (SSRF guard) before making requests.
  */
+import { isPrivateHost } from '../permissions/ssrf-check.mjs';
 
 export const WebSearchTool = {
     name: 'WebSearch',
@@ -32,9 +36,17 @@ export const WebSearchTool = {
             return searchBrave(input.query, limit, braveKey);
         }
 
-        // Try SearXNG
+        // Try SearXNG — validate the configured URL is not an internal host
         const searxUrl = process.env.SEARXNG_URL;
         if (searxUrl) {
+            try {
+                const parsed = new URL(searxUrl);
+                if (isPrivateHost(parsed.hostname)) {
+                    return 'SEARXNG_URL points to a private/internal address. Configure a public SearXNG instance.';
+                }
+            } catch {
+                return 'SEARXNG_URL is not a valid URL.';
+            }
             return searchSearxng(input.query, limit, searxUrl);
         }
 

package/src/ui/commands.mjs

@@ -9,7 +9,9 @@ import { SessionManager } from '../core/session.mjs';
 import { CheckpointManager } from '../core/checkpoints.mjs';
 import { PromptCache } from '../core/cache.mjs';
 import { readEnv, listEnvVars } from '../config/env.mjs';
+import { readApiKey } from '../core/providers.mjs';
 import * as telemetry from '../telemetry/index.mjs';
+import { OutcomeStore } from '../optimize/store.mjs';
 
 const checkpoints = new CheckpointManager();
 const promptCache = new PromptCache();
@@ -96,8 +98,9 @@ export const COMMANDS = {
         description: 'Check system health and configuration',
         handler(args, state) {
             const checks = [];
+            const anthropicKey = readApiKey('ANTHROPIC_API_KEY');
             checks.push(`Node.js: ${process.version}`);
-            checks.push(`ANTHROPIC_API_KEY: ${process.env.ANTHROPIC_API_KEY ? 'set' : 'NOT SET'}`);
+            checks.push(`ANTHROPIC_API_KEY: ${anthropicKey ? 'set' : 'NOT SET'}`);
             checks.push(`Model: ${state.model || 'default'}`);
             checks.push(`Tools: ${state.tools?.list?.()?.length || 0}`);
             checks.push(`Messages: ${state.messages.length}`);
@@ -106,7 +109,7 @@ export const COMMANDS = {
 
             // Check API connectivity
             let apiStatus = 'unchecked';
-            if (process.env.ANTHROPIC_API_KEY) {
+            if (anthropicKey) {
                 apiStatus = 'key present';
             }
             checks.push(`API: ${apiStatus}`);
@@ -214,8 +217,9 @@ export const COMMANDS = {
     '/login': {
         description: 'Set API key',
         handler(args) {
-            if (args) {
-                process.env.ANTHROPIC_API_KEY = args;
+            const key = (args || '').trim();
+            if (key) {
+                process.env.ANTHROPIC_API_KEY = key;
                 return 'API key set.';
             }
             return 'Usage: /login <api-key>';
@@ -443,10 +447,13 @@ export const COMMANDS = {
         description: 'Create a git commit with AI message',
         handler(args) {
             try {
-                const { execSync } = require('child_process');
+                // Security: use execFileSync with discrete args so the commit
+                // message is never shell-interpolated (prevents injection via
+                // crafted message strings containing shell metacharacters).
+                const { execFileSync } = require('child_process');
                 const msg = args || 'Update from open-claude-code';
-                execSync('git add -A', { encoding: 'utf-8' });
-                execSync(`git commit -m "${msg}"`, { encoding: 'utf-8' });
+                execFileSync('git', ['add', '-A'], { encoding: 'utf-8' });
+                execFileSync('git', ['commit', '-m', msg], { encoding: 'utf-8' });
                 return `Committed: ${msg}`;
             } catch (err) {
                 return `Commit failed: ${err.message}`;
@@ -467,6 +474,36 @@ export const COMMANDS = {
             return 'Release creation requires gh CLI. Run: gh release create <tag>';
         },
     },
+
+    '/optimize': {
+        description: 'Self-optimization router status / report (metaharness)',
+        handler(args, state) {
+            const sub = (args || '').trim().split(/\s+/)[0] || 'status';
+            const store = new OutcomeStore();
+            if (sub === 'report') {
+                const summary = store.summary();
+                if (summary.total === 0) return 'No recorded outcomes yet. Start occ with --self-optimize to collect real data.';
+                const lines = [`Optimization report — ${summary.total} outcomes`];
+                for (const [m, b] of Object.entries(summary.byModel)) {
+                    lines.push(`  ${m}: ${b.attempts} runs, ${(b.successRate * 100).toFixed(0)}% ok, ~$${b.costUsd.toFixed(4)}`);
+                }
+                lines.push(`  total est cost: $${summary.totalCostUsd.toFixed(4)}`);
+                return lines.join('\n');
+            }
+            if (sub === 'reset') {
+                return store.reset() ? 'Outcome store cleared.' : 'Nothing to reset.';
+            }
+            // status (default)
+            const enabled = !!(state && state._cascade);
+            const summary = store.summary();
+            return [
+                'MetaHarness self-optimization',
+                `  live router this session: ${enabled ? 'ON' : 'OFF (start with --self-optimize)'}`,
+                `  recorded outcomes:        ${summary.total}`,
+                `  store:                    ${store.filePath}`,
+            ].join('\n');
+        },
+    },
 };
 
 /**