@tencent-ai/agent-sdk 0.3.206 → 0.3.209

package/cli/vendor/shim/safe-bin/safe-delete-bash-env.sh

@@ -1,5 +1,5 @@
 # genie-safe-delete bash environment — sourced via BASH_ENV for every bash subprocess.
-# Defines rm/unlink/rmdir wrappers to intercept shell delete commands and move to OS trash.
+# Defines safe-bin wrappers to intercept shell file commands.
 if [ -n "${CODEBUDDY_SAFE_DELETE_BIN_DIR:-}" ]; then
     rm() { "${CODEBUDDY_SAFE_DELETE_BIN_DIR}/rm" "$@"; }
     unlink() { "${CODEBUDDY_SAFE_DELETE_BIN_DIR}/unlink" "$@"; }

package/cli/vendor/shim/safe-bin/safe-delete-common.sh

@@ -72,11 +72,6 @@ safe_delete_normalize_path() {
     while [ "$p" != "/" ] && [ "${p%/}" != "$p" ]; do
         p="${p%/}"
     done
-    case "$OS" in
-        MINGW*|MSYS*|CYGWIN*)
-            p="$(printf '%s' "$p" | tr '[:upper:]' '[:lower:]')"
-            ;;
-    esac
     printf '%s' "$p"
 }
 
@@ -148,17 +143,50 @@ SAFE_DELETE_OS_TMP_DIRS="$(safe_delete_build_os_tmp_dirs)"
 safe_delete_is_under_os_tmp_dir() {
     local abs
     abs="$(safe_delete_normalize_path "$(safe_delete_abs_path "$1")")"
-    while IFS= read -r tmp_dir; do
+
+    # 用数组分片而不是 heredoc/here-string 遍历 tmp 目录列表：heredoc 在 bash 内部
+    # 会落一个临时文件再 unlink（/tmp/sh-thd-*），在沙箱 broker 场景下这次 unlink
+    # 会被 Seatbelt 的 file-write-unlink 监控误判为一次“受保护文件修改”拦截，
+    # 抢在批量删除确认信号之前触发提权 UI。纯数组分片不产生任何文件系统操作。
+    local tmp_dir
+    local __sdiotd_old_ifs="$IFS"
+    IFS=$'\n'
+    set -f
+    local -a __sdiotd_tmp_dirs=($SAFE_DELETE_OS_TMP_DIRS)
+    set +f
+    IFS="$__sdiotd_old_ifs"
+
+    for tmp_dir in "${__sdiotd_tmp_dirs[@]}"; do
         [ -n "$tmp_dir" ] || continue
+        case "$OS" in
+            MINGW*|MSYS*|CYGWIN*)
+                local abs_lower tmp_lower
+                abs_lower="$(printf '%s' "$abs" | tr '[:upper:]' '[:lower:]')"
+                tmp_lower="$(printf '%s' "$tmp_dir" | tr '[:upper:]' '[:lower:]')"
+                case "$abs_lower" in
+                    "$tmp_lower"/*) return 0 ;;
+                esac
+                continue
+                ;;
+        esac
         case "$abs" in
             "$tmp_dir"/*) return 0 ;;
         esac
-    done <<EOF
-$SAFE_DELETE_OS_TMP_DIRS
-EOF
+    done
     return 1
 }
 
+safe_delete_bulk_guard_non_tmp_check() {
+    local targets=()
+    local p
+    for p in "$@"; do
+        safe_delete_is_under_os_tmp_dir "$p" && continue
+        targets+=("$p")
+    done
+    [ ${#targets[@]} -eq 0 ] && return 0
+    safe_delete_bulk_guard_check "${targets[@]}"
+}
+
 # ---- platform-specific trash helpers -----------------------------------------
 
 trash_darwin() {
@@ -374,10 +402,57 @@ trash_one() {
     esac
 }
 
+try_broker_delete() {
+    local abs="$1"
+    local recursive="${2:-false}"
+    local force="${3:-false}"
+    [ -n "${CODEBUDDY_SANDBOX_BROKER_IPC_ADDRESS:-}" ] || return 2
+    [ -n "${CODEBUDDY_SANDBOX_BROKER_SESSION_ID:-}" ] || return 2
+    [ -n "${CODEBUDDY_SANDBOX_HOST_FILE_OPERATION_COMMAND:-}" ] || return 2
+
+    local helper="${CODEBUDDY_SAFE_DELETE_BROKER_DELETE:-}"
+    local node_bin="${CODEBUDDY_NODE_BIN:-}"
+    [ -n "$helper" ] && [ -f "$helper" ] && [ -n "$node_bin" ] || return 2
+
+    local broker_out broker_rc
+    local broker_args=()
+    [ "$recursive" = "true" ] && broker_args+=("--recursive")
+    [ "$force" = "true" ] && broker_args+=("--force")
+    broker_out="$(
+        NODE_OPTIONS= "$node_bin" "$helper" "${broker_args[@]}" -- "$abs" 2>&1 >/dev/null
+    )"
+    broker_rc=$?
+
+    if [ $broker_rc -eq 0 ]; then
+        return 0
+    fi
+    if [ $broker_rc -eq 2 ]; then
+        _safe_delete_diag "broker unavailable, falling back to local trash: path=$abs"
+        return 2
+    fi
+    _safe_delete_diag "broker denied delete: path=$abs stderr=$(_safe_delete_one_line "$broker_out")"
+    return 1
+}
+
 try_trash() {
     local p="$1"
+    local recursive="${2:-false}"
+    local force="${3:-false}"
     local abs
     abs="$(safe_delete_abs_path "$p")"
+
+    try_broker_delete "$abs" "$recursive" "$force"
+    local broker_rc=$?
+    if [ $broker_rc -eq 0 ]; then
+        return 0
+    fi
+    if [ $broker_rc -eq 1 ]; then
+        local target_json
+        target_json="$(safe_delete_json_string "$p")"
+        echo "[safe-delete][SAFE_DELETE_FAIL_CLOSED] {\"target\":$target_json,\"reason\":\"broker-denied\"}" >&2
+        return 1
+    fi
+
     if trash_one "$p"; then
         safe_delete_record_trash "$abs"
         return 0
@@ -468,7 +543,9 @@ safe_delete_rm() {
             _exit=1
         fi
     done
-    local guarded_targets=()
+    if ! safe_delete_bulk_guard_non_tmp_check "${trash_targets[@]}"; then
+        return 1
+    fi
     for p in "${trash_targets[@]}"; do
         if safe_delete_is_under_os_tmp_dir "$p"; then
             local native_args=()
@@ -478,16 +555,7 @@ safe_delete_rm() {
             if ! "$REAL_RM" "${native_args[@]}" -- "$p"; then
                 _exit=1
             fi
-        else
-            guarded_targets+=("$p")
-        fi
-    done
-
-    if ! safe_delete_bulk_guard_check "${guarded_targets[@]}"; then
-        return 1
-    fi
-    for p in "${guarded_targets[@]}"; do
-        if ! try_trash "$p"; then
+        elif ! try_trash "$p" "$recursive" "$force"; then
             _exit=1
         fi
     done
@@ -525,13 +593,13 @@ safe_delete_unlink() {
         return 1
     fi
 
+    if ! safe_delete_bulk_guard_non_tmp_check "$target"; then
+        return 1
+    fi
     if safe_delete_is_under_os_tmp_dir "$target"; then
         "$REAL_UNLINK" -- "$target"
         return $?
     fi
-    if ! safe_delete_bulk_guard_check "$target"; then
-        return 1
-    fi
 
     try_trash "$target"
     return $?
@@ -590,22 +658,15 @@ safe_delete_rmdir() {
         fi
         trash_targets+=("$p")
     done
-    local guarded_targets=()
+    if ! safe_delete_bulk_guard_non_tmp_check "${trash_targets[@]}"; then
+        return 1
+    fi
     for p in "${trash_targets[@]}"; do
         if safe_delete_is_under_os_tmp_dir "$p"; then
             if ! "$REAL_RMDIR" -- "$p"; then
                 _exit=1
             fi
-        else
-            guarded_targets+=("$p")
-        fi
-    done
-
-    if ! safe_delete_bulk_guard_check "${guarded_targets[@]}"; then
-        return 1
-    fi
-    for p in "${guarded_targets[@]}"; do
-        if ! try_trash "$p"; then
+        elif ! try_trash "$p"; then
             _exit=1
         fi
     done

package/cli/vendor/shim/safe-delete-broker-delete.cjs

@@ -0,0 +1,166 @@
+/**
+ * safe-delete broker delete helper.
+ *
+ * Shared by bash safe-delete wrappers and the Node safe-delete shim.
+ * Delete-specific response classification stays here; broker-ipc-client.cjs
+ * only owns neutral JSON-line transport.
+ *
+ * CLI contract: `node safe-delete-broker-delete.cjs [--recursive] [--force] -- <path>`
+ * accepts exactly one target. Callers that need to delete multiple paths must
+ * loop and invoke once per path. Exit codes: 0 = ok, 1 = broker denied
+ * (fail-closed), 2 = unavailable.
+ */
+
+'use strict';
+
+const path = require('path');
+const brokerIpc = require('./broker-ipc-client.cjs');
+
+let requestSeq = 0;
+
+function buildDeleteRequest(targetPath, options = {}) {
+    const command = options.command || process.env.CODEBUDDY_SANDBOX_HOST_FILE_OPERATION_COMMAND;
+    const sessionId = options.sessionId || process.env.CODEBUDDY_SANDBOX_BROKER_SESSION_ID;
+    const toolCallId = options.toolCallId || process.env.CODEBUDDY_SANDBOX_BROKER_TOOL_CALL_ID;
+    const traceId = options.brokerTraceId || process.env.CODEBUDDY_SANDBOX_BROKER_TRACE_ID;
+
+    const request = {
+        id: `sd-${process.pid}-${++requestSeq}`,
+        runtime: options.runtime || 'bash',
+        command,
+        operation: 'delete',
+        path: path.resolve(targetPath),
+        deleteMode: 'trash',
+        sessionId,
+    };
+    if (options.recursive === true) { request.recursive = true; }
+    if (options.force === true) { request.force = true; }
+    if (toolCallId) { request.toolCallId = toolCallId; }
+    if (traceId) { request.brokerTraceId = traceId; }
+    return request;
+}
+
+function hasBrokerDeleteEnv(options = {}) {
+    return !!(
+        (options.socketPath || process.env.CODEBUDDY_SANDBOX_BROKER_IPC_ADDRESS)
+        && (options.sessionId || process.env.CODEBUDDY_SANDBOX_BROKER_SESSION_ID)
+        && (options.command || process.env.CODEBUDDY_SANDBOX_HOST_FILE_OPERATION_COMMAND)
+    );
+}
+
+function classifyDeleteResult(response) {
+    if (response && response.ok === true) {
+        return 'ok';
+    }
+    if (response && response.decision === 'sandbox') {
+        return 'unavailable';
+    }
+    return 'denied';
+}
+
+function tryBrokerDeleteSync(absPath, options = {}) {
+    if (!hasBrokerDeleteEnv(options)) {
+        return 'unavailable';
+    }
+    try {
+        return classifyDeleteResult(
+            brokerIpc.sendBrokerRequestSync(buildDeleteRequest(absPath, options), options),
+        );
+    } catch (_) {
+        return 'unavailable';
+    }
+}
+
+async function tryBrokerDeleteAsync(absPath, options = {}) {
+    if (!hasBrokerDeleteEnv(options)) {
+        return 'unavailable';
+    }
+    try {
+        return classifyDeleteResult(
+            await brokerIpc.sendBrokerRequest(buildDeleteRequest(absPath, options), options),
+        );
+    } catch (_) {
+        return 'unavailable';
+    }
+}
+
+function tryBrokerDelete(absPath, options = {}) {
+    if (options.sync === false) {
+        return tryBrokerDeleteAsync(absPath, options);
+    }
+    return tryBrokerDeleteSync(absPath, options);
+}
+
+function parseDeleteCliArgs(argv) {
+    const options = {
+        recursive: false,
+        force: false,
+    };
+    const targets = [];
+    let afterDashDash = false;
+    for (const arg of argv) {
+        if (!afterDashDash && arg === '--') {
+            afterDashDash = true;
+            continue;
+        }
+        if (!afterDashDash && arg === '--recursive') {
+            options.recursive = true;
+            continue;
+        }
+        if (!afterDashDash && arg === '--force') {
+            options.force = true;
+            continue;
+        }
+        if (!afterDashDash && arg.startsWith('-')) {
+            return undefined;
+        }
+        targets.push(arg);
+    }
+    if (targets.length !== 1) {
+        return undefined;
+    }
+    return {
+        target: targets[0],
+        options,
+    };
+}
+
+async function runDeleteCli(argv = process.argv.slice(2)) {
+    const parsed = parseDeleteCliArgs(argv);
+    if (!parsed) {
+        process.stderr.write('[safe-delete-broker] expected exactly one target path\n');
+        return 2;
+    }
+
+    const result = await tryBrokerDelete(parsed.target, {
+        runtime: 'bash',
+        recursive: parsed.options.recursive,
+        force: parsed.options.force,
+        sync: false,
+    });
+    if (result === 'ok') {
+        return 0;
+    }
+    if (result === 'denied') {
+        process.stderr.write(`[safe-delete-broker] denied: path=${parsed.target}\n`);
+        return 1;
+    }
+    return 2;
+}
+
+module.exports = {
+    buildDeleteRequest,
+    classifyDeleteResult,
+    tryBrokerDelete,
+    runDeleteCli,
+};
+
+if (require.main === module) {
+    runDeleteCli().then(
+        code => process.exit(code),
+        error => {
+            process.stderr.write(`[safe-delete-broker] unavailable: ${error && error.message ? error.message : error}\n`);
+            process.exit(2);
+        },
+    );
+}

package/cli/vendor/shim/shell-runtime-bash-env.sh

@@ -0,0 +1,8 @@
+# CodeBuddy bash runtime environment — sourced via BASH_ENV for bash subprocesses.
+# Keep feature-specific bootstrap scripts separate and compose them here.
+__codebuddy_shell_runtime_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+[ ! -f "${__codebuddy_shell_runtime_dir}/safe-bin/safe-delete-bash-env.sh" ] || . "${__codebuddy_shell_runtime_dir}/safe-bin/safe-delete-bash-env.sh"
+[ ! -f "${__codebuddy_shell_runtime_dir}/brokered-sandbox-bash-env.sh" ] || . "${__codebuddy_shell_runtime_dir}/brokered-sandbox-bash-env.sh"
+
+unset __codebuddy_shell_runtime_dir