@whyvix/remote 0.3.4 → 0.3.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@whyvix/remote",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "private": false,
   "type": "module",
   "files": [

package/packages/agent/src/process-manager.js

@@ -1,13 +1,10 @@
 import { spawn } from "node:child_process";
 import path from "node:path";
 
-const DEFAULT_EXECUTABLES = Object.freeze({
-  node: process.execPath,
-  npm: "npm",
-  npx: "npx",
-  php: "php",
-  composer: "composer"
-});
+const DEFAULT_EXECUTABLES = null;
+const BLOCKED_SHELL_EXECUTABLES = new Set([
+  "cmd", "command", "powershell", "pwsh", "sh", "bash", "dash", "zsh", "fish", "wsl"
+]);
 
 function fail(code, message) { throw Object.assign(new Error(message), { code }); }
 
@@ -20,19 +17,25 @@ function appendBounded(state, key, chunk, maxBytes) {
 }
 
 function normalizeRegistry(value) {
-  if (Array.isArray(value)) return new Map(value.map((x) => [String(x).toLowerCase(), String(x)]));
-  return new Map(Object.entries(value || {}).map(([name, command]) => [String(name).toLowerCase(), String(command)]));
+  if (value == null) return null;
+  if (Array.isArray(value)) return new Map(value.map((x) => [String(x).toLowerCase().replace(/\.exe$/, ""), String(x)]));
+  return new Map(Object.entries(value || {}).map(([name, command]) => [String(name).toLowerCase().replace(/\.exe$/, ""), String(command)]));
 }
 
 function resolveExecutable(registry, requested) {
   const raw = String(requested || "").trim();
   if (!raw) fail("INVALID_ARGUMENT", "command is required");
+  if (raw.includes("/") || raw.includes("\\") || raw.includes(":") || raw === "." || raw === "..") {
+    fail("LOCAL_EXEC_NOT_ALLOWED", "Executable must be a bare command name resolved by the operating system");
+  }
+  if (!/^[A-Za-z0-9][A-Za-z0-9._+-]*$/.test(raw)) fail("LOCAL_EXEC_NOT_ALLOWED", "Executable name is invalid");
   const key = raw.toLowerCase().replace(/\.exe$/, "");
-  if (registry.has(key) && !raw.includes("/") && !raw.includes("\\") && !raw.includes(":")) return { name: key, command: registry.get(key) };
-  for (const [name, command] of registry) {
-    if (raw.toLowerCase() === command.toLowerCase()) return { name, command };
+  if (BLOCKED_SHELL_EXECUTABLES.has(key)) fail("LOCAL_EXEC_NOT_ALLOWED", "Shell executables are not allowed");
+  if (registry) {
+    if (registry.has(key)) return { name: key, command: registry.get(key) };
+    fail("LOCAL_EXEC_NOT_ALLOWED", "Local executable is not allowed by configured policy");
   }
-  fail("LOCAL_EXEC_NOT_ALLOWED", "Local executable is not allowed");
+  return { name: key, command: raw };
 }
 
 export class ProcessManager {