@startanaicompany/cli 1.9.1 → 1.9.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/src/commands/exec.js +24 -15
package/package.json
CHANGED
package/src/commands/exec.js
CHANGED
|
@@ -111,27 +111,36 @@ async function exec(command, options = {}) {
|
|
|
111
111
|
|
|
112
112
|
spin.succeed('Command executed');
|
|
113
113
|
} catch (error) {
|
|
114
|
-
spin.fail('Command
|
|
114
|
+
spin.fail('Command not allowed');
|
|
115
115
|
|
|
116
116
|
if (error.response?.status === 400) {
|
|
117
|
-
const data = error.response.data;
|
|
117
|
+
const data = error.response.data || {};
|
|
118
118
|
logger.newline();
|
|
119
119
|
|
|
120
|
-
|
|
121
|
-
|
|
120
|
+
// Show clear "command not allowed" message for all 400 errors
|
|
121
|
+
logger.error('This command is blocked for security reasons');
|
|
122
|
+
|
|
123
|
+
// Show backend error message if available (note: field is 'error', not 'message')
|
|
124
|
+
if (data.error) {
|
|
122
125
|
logger.newline();
|
|
123
|
-
logger.warn(data.
|
|
124
|
-
|
|
125
|
-
if (data.message.includes('not in allowlist')) {
|
|
126
|
-
logger.newline();
|
|
127
|
-
logger.info('Allowed commands include:');
|
|
128
|
-
logger.log(' Node.js: npm, node, npx, yarn, pnpm');
|
|
129
|
-
logger.log(' Python: python, python3, pip, poetry');
|
|
130
|
-
logger.log(' Ruby: bundle, rake, rails');
|
|
131
|
-
logger.log(' Shell: sh, bash, echo, cat, ls, pwd');
|
|
132
|
-
logger.log(' Database: psql, mysql, mongosh');
|
|
133
|
-
}
|
|
126
|
+
logger.warn(data.error);
|
|
134
127
|
}
|
|
128
|
+
|
|
129
|
+
logger.newline();
|
|
130
|
+
logger.info('Allowed commands include:');
|
|
131
|
+
logger.log(' Node.js: npm, node, npx, yarn, pnpm');
|
|
132
|
+
logger.log(' Python: python, python3, pip, poetry');
|
|
133
|
+
logger.log(' Ruby: bundle, rake, rails, ruby');
|
|
134
|
+
logger.log(' Shell: sh, bash, echo, cat, ls, pwd, env');
|
|
135
|
+
logger.log(' Database: psql, mysql, mongosh');
|
|
136
|
+
logger.log(' Build: go, cargo, make, cmake');
|
|
137
|
+
logger.newline();
|
|
138
|
+
logger.info('Blocked for security:');
|
|
139
|
+
logger.log(' System commands: whoami, ps, top, kill');
|
|
140
|
+
logger.log(' Destructive operations: rm, chmod, chown');
|
|
141
|
+
logger.log(' Advanced shell features: pipes (|), redirects (>), command substitution');
|
|
142
|
+
|
|
143
|
+
process.exit(1);
|
|
135
144
|
} else if (error.response?.status === 408) {
|
|
136
145
|
logger.newline();
|
|
137
146
|
logger.error('Command execution timed out');
|