@tensor.chat/companion 0.3.1 → 0.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tensor.chat/companion",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Lets your tensor.chat AI use this machine: files, shell and internet through your own connection.",
   "license": "MIT",
   "homepage": "https://tensor.chat",

package/src/daemon.js

@@ -13,6 +13,7 @@ const bash = require('./tools/bash');
 const files = require('./tools/files');
 const { fetchUrl } = require('./tools/fetch');
 const { extractTouched } = require('./tools/touched');
+const { outsideFolders } = require('./tools/outside');
 const { Jobs } = require('./tools/jobs');
 
 const VERSION = require('../package.json').version;
@@ -158,6 +159,12 @@ function createDaemon({ serverUrl, token, shell, log, approvedRoots, approvedShe
       case 'write': return files.write(callRoots, a.path, a.content, { overwrite: a.overwrite === true });
       case 'edit': return files.edit(callRoots, a.path, a.edits);
       case 'glob': return files.glob(callRoots, a.pattern);
+      // The server asks before it judges a shell command: what of it lies outside
+      // the shared folders, read with this machine's own variables. Nothing runs.
+      case 'outside': {
+        const at = a.cwd ? callRoots.resolve(a.cwd) : null;
+        return outsideFolders(callRoots, a.command, { cwd: at && !at.error ? at.abs : callRoots.primary() || os.homedir() });
+      }
       case 'grep': return files.grep(callRoots, a.command);
       case 'ls': return files.ls(callRoots, a.path, { max: a.max });
       case 'fetchfile': return files.fetchfile(callRoots, a.path, { maxBytes: a.maxBytes });

package/src/tools/outside.js

@@ -0,0 +1,101 @@
+'use strict';
+// Which folders outside the shared ones does a shell command name? The safety check on
+// the server can only guess what "$env:USERPROFILE\.voicetype" means - this computer
+// knows (03.10.2026: four commands like that left it "not sure"). Every path-looking
+// word of the command, with this machine's variables put in, that names an existing
+// file or folder - or a new file in an existing folder - and lies outside every shared
+// folder counts, as the folder that holds it. A command can reach further than its
+// words (a script reads what it likes): this helps the question, it is no fence.
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { isInside, realExisting } = require('../paths');
+
+const MAX_FOLDERS = 10;
+const MAX_WORDS = 2000;
+// What ends a path written without quotes
+const STOP = '\\s"\'<>|*?;,`()';
+const WIN_ABS = new RegExp(`(?<![\\w\\\\/])[A-Za-z]:[\\\\/][^${STOP}]*`, 'g');
+const UNC = new RegExp(`(?<![\\w\\\\])\\\\\\\\[^${STOP}\\\\]+\\\\[^${STOP}]+`, 'g');
+const DOTDOT = new RegExp(`(?<![\\w.\\\\/])\\.\\.(?:[\\\\/][^${STOP}]*)?(?![\\w.])`, 'g');
+const POSIX_ABS = new RegExp(`(?<![\\w.~\\\\/:])/[^${STOP}]+`, 'g');
+const WHOLE_PATH = /^(?:[A-Za-z]:[\\/]|\\\\|\.\.(?:[\\/]|$)|\/)/;
+
+// The command as this machine reads it: PowerShell's $env:NAME, cmd's %NAME%, the
+// POSIX $NAME and ${NAME}, and ~ for the home folder. A name it does not know stays.
+function expand(command, { env, home, platform }) {
+  const keys = Object.keys(env);
+  const get = (name) => {
+    const key = platform === 'win32' ? keys.find((k) => k.toLowerCase() === name.toLowerCase()) : (name in env ? name : null);
+    if (key != null && env[key] != null) return String(env[key]);
+    return /^(home|userprofile)$/i.test(name) ? home : null;
+  };
+  return String(command == null ? '' : command)
+    .replace(/\$\{env:([A-Za-z_][\w()]*)\}|\$env:([A-Za-z_]\w*)/gi, (m, a, b) => get(a || b) ?? m)
+    .replace(/%([A-Za-z_][\w()]*)%/g, (m, n) => get(n) ?? m)
+    .replace(/\$\{([A-Za-z_]\w*)\}|\$([A-Za-z_]\w*)/g, (m, a, b) => get(a || b) ?? m)
+    .replace(/(^|[\s"'=(])~(?=[\\/]|$|[\s"')])/g, (m, pre) => pre + home);
+}
+
+// The words that may be paths: a quoted one that starts like a path is one path,
+// spaces and all - cut at a space, "R:\Projekte\Open Chat Pal\x" named a stray file
+// "R:\Projekte\Open". Other quoted text (a -Command "...") and the rest are searched.
+function words(text, platform) {
+  const out = [];
+  const scan = (s) => {
+    for (const re of platform === 'win32' ? [WIN_ABS, UNC, DOTDOT] : [WIN_ABS, UNC, DOTDOT, POSIX_ABS]) {
+      re.lastIndex = 0;
+      let m;
+      while ((m = re.exec(s)) && out.length < MAX_WORDS) out.push(m[0]);
+    }
+  };
+  const rest = text.replace(/"([^"]*)"|'([^']*)'/g, (m, a, b) => {
+    const inner = a != null ? a : b;
+    if (WHOLE_PATH.test(inner)) out.push(inner); else scan(inner);
+    return ' ';
+  });
+  scan(rest);
+  // A full stop or comma after a path belongs to the sentence; ".." stays itself
+  return out.map((w) => w.replace(/[,;:\]}]+$/, '').replace(/([^.])\.$/, '$1')).filter(Boolean);
+}
+
+function statOf(p) {
+  try { return fs.statSync(p); } catch (_) { return null; }
+}
+
+// The folder a word stands for: the folder itself, the folder of a file, or the folder
+// a new file would go into. Anything else is not a path on this machine.
+function folderOf(word, cwd) {
+  const abs = path.resolve(cwd, word);
+  const st = statOf(abs);
+  if (st) return st.isDirectory() ? abs : path.dirname(abs);
+  if (!/\.[A-Za-z0-9]{1,8}$/.test(path.basename(abs))) return null;
+  const parent = path.dirname(abs);
+  const ps = statOf(parent);
+  return ps && ps.isDirectory() && path.parse(parent).root !== parent ? parent : null;
+}
+
+function outsideFolders(roots, command, { cwd, env = process.env, home = os.homedir(), platform = process.platform } = {}) {
+  const shared = roots.okRoots().map((r) => r.real);
+  const found = [];
+  for (const word of words(expand(command, { env, home, platform }), platform)) {
+    const folder = folderOf(word, cwd || home);
+    if (!folder) continue;
+    const real = realExisting(folder) || folder;
+    if (shared.some((r) => isInside(real, r))) continue;
+    if (!found.some((f) => isInside(folder, f) && isInside(f, folder))) found.push(folder);
+  }
+  // A folder inside another one found is covered by it
+  const folders = found
+    .filter((f) => !found.some((g) => g !== f && isInside(f, g) && !isInside(g, f)))
+    .slice(0, MAX_FOLDERS)
+    // A whole drive, the home folder or what holds it is too much to share in one click
+    .map((f) => ({ path: f, broad: path.parse(f).root === f || isInside(home, f) }));
+  const text = folders.length
+    ? `(outside the shared folders: ${folders.map((f) => f.path).join(', ')})`
+    : '(nothing outside the shared folders)';
+  return { ok: true, text, folders };
+}
+
+module.exports = { outsideFolders, expand, words };