@tea-agent/loop-agent 0.23.1 → 0.24.0

package/dist/worker/console/chat/repo-browser.js

@@ -0,0 +1,140 @@
+import { createHash } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, open, readdir } from "node:fs/promises";
+import path from "node:path";
+import { guardReadPath, isSensitivePath, scrubSecrets, } from "./explore-tools.js";
+const TREE_LIMIT = 500;
+const READ_LIMIT = 256 * 1024;
+const RESPONSE_LIMIT = 128 * 1024;
+const SKIP_DIRS = new Set([
+    ".git",
+    ".harness",
+    ".agents",
+    "node_modules",
+    ".next",
+    "dist",
+    "build",
+    "out",
+    ".cache",
+    ".turbo",
+    ".vite",
+    "coverage",
+]);
+export class RepoBrowserError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+    }
+}
+function guardedCode(code) {
+    return code === "PATH_OUTSIDE_REPO" ? "OUT_OF_REPO" : code;
+}
+export async function listRepoDirectory(repoRoot, rawPath) {
+    const root = rawPath === "";
+    const guard = await guardReadPath(repoRoot, root ? "." : rawPath);
+    if (!guard.ok)
+        throw new RepoBrowserError(403, guardedCode(guard.code), guard.message);
+    try {
+        const info = await lstat(guard.abs);
+        if (info.isSymbolicLink())
+            throw new RepoBrowserError(403, "OUT_OF_REPO", "symbolic links are not browsable");
+        if (!info.isDirectory())
+            throw new RepoBrowserError(400, "NOT_A_DIRECTORY", "path is not a directory");
+        const base = root ? "" : guard.repoRelative;
+        const entries = (await readdir(guard.abs, { withFileTypes: true }))
+            .filter((entry) => !entry.isSymbolicLink() && (entry.isDirectory() || entry.isFile()))
+            .filter((entry) => {
+            const relative = base ? `${base}/${entry.name}` : entry.name;
+            return (!isSensitivePath(relative) &&
+                !(entry.isDirectory() && SKIP_DIRS.has(entry.name)));
+        })
+            .sort((a, b) => Number(b.isDirectory()) - Number(a.isDirectory()) ||
+            a.name.localeCompare(b.name));
+        const rechecked = await guardReadPath(repoRoot, root ? "." : rawPath);
+        if (!rechecked.ok || rechecked.abs !== guard.abs)
+            throw new RepoBrowserError(403, "OUT_OF_REPO", "directory changed while it was being listed");
+        return {
+            path: base,
+            entries: await Promise.all(entries.slice(0, TREE_LIMIT).map(async (entry) => {
+                const relative = base ? `${base}/${entry.name}` : entry.name;
+                return entry.isDirectory()
+                    ? { name: entry.name, path: relative, kind: "directory" }
+                    : {
+                        name: entry.name,
+                        path: relative,
+                        kind: "file",
+                        size: (await lstat(path.join(guard.abs, entry.name))).size,
+                    };
+            })),
+            truncated: entries.length > TREE_LIMIT,
+        };
+    }
+    catch (error) {
+        if (error instanceof RepoBrowserError)
+            throw error;
+        if (error.code === "ENOENT")
+            throw new RepoBrowserError(404, "NOT_FOUND", "directory does not exist");
+        throw error;
+    }
+}
+export async function readRepoPreview(repoRoot, rawPath) {
+    const guard = await guardReadPath(repoRoot, rawPath);
+    if (!guard.ok)
+        throw new RepoBrowserError(403, guardedCode(guard.code), guard.message);
+    try {
+        const handle = await open(guard.abs, constants.O_RDONLY | constants.O_NOFOLLOW);
+        let bytes;
+        let size;
+        try {
+            const info = await handle.stat();
+            if (!info.isFile())
+                throw new RepoBrowserError(400, "NOT_A_FILE", "path is not a regular file");
+            if (info.size > READ_LIMIT)
+                throw new RepoBrowserError(413, "TOO_LARGE", `file exceeds ${READ_LIMIT} byte preview limit`);
+            const rechecked = await guardReadPath(repoRoot, rawPath);
+            if (!rechecked.ok)
+                throw new RepoBrowserError(403, guardedCode(rechecked.code), "file path changed while it was being opened");
+            const current = await lstat(rechecked.abs);
+            if (current.isSymbolicLink() ||
+                current.dev !== info.dev ||
+                current.ino !== info.ino)
+                throw new RepoBrowserError(403, "OUT_OF_REPO", "file identity changed while it was being opened");
+            size = info.size;
+            bytes = Buffer.alloc(size);
+            const bytesRead = size
+                ? (await handle.read(bytes, 0, size, 0)).bytesRead
+                : 0;
+            bytes = bytes.subarray(0, bytesRead);
+        }
+        finally {
+            await handle.close();
+        }
+        if (bytes.includes(0))
+            throw new RepoBrowserError(415, "BINARY_UNSUPPORTED", "binary files cannot be previewed");
+        let end = Math.min(bytes.length, RESPONSE_LIMIT);
+        while (end > 0 && end < bytes.length && (bytes[end] & 0xc0) === 0x80)
+            end -= 1;
+        const content = scrubSecrets(bytes.subarray(0, end).toString("utf8")).scrubbed;
+        return {
+            path: guard.repoRelative,
+            kind: "text",
+            content,
+            language: path.extname(guard.repoRelative).slice(1).toLowerCase() || "text",
+            bytes: size,
+            truncated: bytes.length > RESPONSE_LIMIT,
+            sha256: createHash("sha256").update(bytes).digest("hex"),
+        };
+    }
+    catch (error) {
+        if (error instanceof RepoBrowserError)
+            throw error;
+        if (error.code === "ENOENT")
+            throw new RepoBrowserError(404, "NOT_FOUND", "file does not exist");
+        if (error.code === "ELOOP")
+            throw new RepoBrowserError(403, "OUT_OF_REPO", "symbolic links are not previewable");
+        throw error;
+    }
+}

package/dist/worker/console/chat/repo-walk.js

@@ -0,0 +1,116 @@
+/**
+ * Repo file walker for the safe explore tools (roadmap M0-A).
+ *
+ * Walks the repo working tree, skipping gitignored paths (best-effort, no
+ * extra dep), the sensitive denylist, and common binary/build dirs. Returns
+ * repo-relative + absolute path pairs for bounded read/grep.
+ */
+import { readdir } from "node:fs/promises";
+import path from "node:path";
+import { isSensitivePath } from "./explore-tools.js";
+/** Directories never descended into (build output, VCS, deps, lock state). */
+const SKIP_DIRS = new Set([
+    ".git",
+    "node_modules",
+    ".next",
+    "dist",
+    "build",
+    "out",
+    ".cache",
+    ".turbo",
+    ".vite",
+    "coverage",
+    ".harness",
+    ".agents",
+]);
+/** File extensions treated as binary (skipped by grep). */
+const BINARY_EXTS = new Set([
+    ".png",
+    ".jpg",
+    ".jpeg",
+    ".gif",
+    ".webp",
+    ".bmp",
+    ".ico",
+    ".pdf",
+    ".zip",
+    ".gz",
+    ".tar",
+    ".tgz",
+    ".7z",
+    ".rar",
+    ".woff",
+    ".woff2",
+    ".ttf",
+    ".otf",
+    ".eot",
+    ".mp3",
+    ".mp4",
+    ".webm",
+    ".mov",
+    ".exe",
+    ".dll",
+    ".so",
+    ".dylib",
+    ".class",
+    ".jar",
+    ".wasm",
+]);
+function globToRe(glob) {
+    // Minimal glob → regex: * → [^/]*, ** → .*, ? → ., escape others.
+    const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    const re = escaped
+        .replace(/\*\*/g, "\u0000")
+        .replace(/\*/g, "[^/]*")
+        .replace(/\u0000/g, ".*")
+        .replace(/\?/g, ".");
+    return new RegExp(`^${re}$`, "i");
+}
+function isBinaryExt(p) {
+    return BINARY_EXTS.has(path.extname(p).toLowerCase());
+}
+/**
+ * Walk the repo working tree under repoRoot. Returns at most maxFiles files.
+ * Skips SKIP_DIRS, binary files (by extension), and (optionally) sensitive
+ * paths. Does NOT follow symlinks (defense against escape).
+ */
+export async function walkRepoFiles(repoRoot, options) {
+    const skipSensitive = options?.skipSensitive ?? true;
+    const maxFiles = options?.maxFiles ?? 5000;
+    const filter = options?.glob ? globToRe(options.glob) : undefined;
+    const out = [];
+    async function walk(dir, prefix) {
+        if (out.length >= maxFiles)
+            return;
+        let entries;
+        try {
+            entries = await readdir(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (out.length >= maxFiles)
+                return;
+            const name = entry.name;
+            if (entry.isDirectory()) {
+                if (SKIP_DIRS.has(name))
+                    continue;
+                await walk(path.join(dir, name), `${prefix}${name}/`);
+                continue;
+            }
+            if (!entry.isFile())
+                continue; // skip symlinks, sockets, etc.
+            if (isBinaryExt(name))
+                continue;
+            const repoRelative = `${prefix}${name}`;
+            if (skipSensitive && isSensitivePath(repoRelative))
+                continue;
+            if (filter && !filter.test(repoRelative))
+                continue;
+            out.push({ abs: path.join(dir, name), repoRelative });
+        }
+    }
+    await walk(repoRoot, "");
+    return out;
+}

package/dist/worker/console/chat/resource-loader.js

@@ -1,18 +1,14 @@
 /**
  * Operator Chat — closed ResourceLoader contract (design §7.5 / V12 / plan W3).
  *
- * The Chat session does NOT discover user-level / project-level extensions or
- * skills (its tool surface is fixed: the operator-action registry + the
- * built-in explore tools). This module is the typed contract describing the
- * DECLARED Chat tool surface — it mirrors what pi-runtime.ts actually wires
- * into the SDK session, so that capabilities/doctor/red-team can report a
- * single source of truth. It is deliberately framework-agnostic (does not
- * import the Pi SDK at module top-level so it stays unit-testable).
- *
- * Current contract (2026-07-25 widening): bash/read/grep/find/ls are ALLOWED
- * explore tools; the full operator action set is allowed; the ONLY denied
- * tools are file-WRITING coding tools (edit/write/apply_patch/full-tools/
- * shell/coding-chat). hasBash therefore reflects reality: true.
+ * M0-A (roadmap §14 工作块 A): the bare bash/read/grep built-ins are GONE.
+ * The Chat session now exposes safe explore custom tools (safe-read /
+ * safe-grep / git-status / git-diff) which enforce a repo-relative boundary,
+ * a sensitive-file denylist, and secret scrubbing — plus find/ls. The full
+ * model-callable operator action set is still allowed; the only denied tools
+ * are file-WRITING coding tools (edit/write/apply_patch/full-tools/shell/
+ * coding-chat) AND bash/read/grep (replaced by the safe versions). hasBash is
+ * therefore false: there is no shell escape.
  *
  * Note: this adapter is NOT the SDK's own ResourceLoader (that is
  * DefaultResourceLoader, created inside createAgentSessionServices with
@@ -22,14 +18,18 @@
  * enforcement; this adapter describes what that gate admits.
  */
 import { OPERATOR_CHAT_ALLOWED_TOOLS, OPERATOR_CHAT_DENIED_TOOLS, OPERATOR_CHAT_DENIED_OPERATOR_ACTIONS, authorizeOperatorChatTool, filterOperatorChatTools, assertNoWriteToolInList, } from "./tools.js";
-/** Built-in explore tool names that are ALLOWED in every Chat session. */
+/** Built-in explore tool names that are ALLOWED in every Chat session (M0-A). */
 export const OPERATOR_CHAT_BUILTIN_EXPLORE_TOOL_IDS = Object.freeze([
-    "bash",
-    "read",
-    "grep",
     "find",
     "ls",
 ]);
+/** Safe explore custom tool names (M0-A). */
+export const OPERATOR_CHAT_SAFE_EXPLORE_TOOL_IDS = Object.freeze([
+    "safe-read",
+    "safe-grep",
+    "git-status",
+    "git-diff",
+]);
 export function createOperatorChatResourceLoader() {
     let active = new Set();
     return {
@@ -38,6 +38,7 @@ export function createOperatorChatResourceLoader() {
         deniedToolIds: OPERATOR_CHAT_DENIED_TOOLS,
         deniedOperatorActions: OPERATOR_CHAT_DENIED_OPERATOR_ACTIONS,
         builtinExploreToolIds: OPERATOR_CHAT_BUILTIN_EXPLORE_TOOL_IDS,
+        safeExploreToolIds: OPERATOR_CHAT_SAFE_EXPLORE_TOOL_IDS,
         listTools: () => OPERATOR_CHAT_ALLOWED_TOOLS,
         tryActivateTool: (toolId) => {
             // Explore tools (bash/read/grep/find/ls) are run by the SDK's built-in
@@ -61,6 +62,6 @@ export function createOperatorChatResourceLoader() {
             return { active: [...active], denied };
         },
         allowsEnvToolRestore: false,
-        hasBash: true,
+        hasBash: false,
     };
 }