@wrongstack/tools 0.1.10 → 0.2.0

package/dist/exec.js

@@ -56,7 +56,7 @@ var execTool = {
   description: "Restricted shell that only runs pre-approved commands with constrained arguments. Safer alternative to `bash`.",
   usageHint: "Set `command` (must be in allowlist). `args` passed through. For arbitrary shell access use the `bash` tool instead.",
   permission: "confirm",
-  mutating: false,
+  mutating: true,
   timeoutMs: TIMEOUT_MS,
   inputSchema: {
     type: "object",

package/dist/exec.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/exec.ts"],"names":["resolve"],"mappings":";;;;;;;AAKA,IAAM,gBAAA,GAA6C;AAAA,EACjD,MAAM,CAAC,WAAA,EAAa,IAAA,EAAM,IAAA,EAAM,MAAM,qBAAqB,CAAA;AAAA,EAC3D,GAAA,EAAK,CAAC,WAAA,EAAa,MAAA,EAAQ,WAAW,MAAA,EAAQ,KAAA,EAAO,MAAA,EAAQ,KAAA,EAAO,QAAQ,CAAA;AAAA,EAC5E,IAAA,EAAM,CAAC,WAAA,EAAa,MAAA,EAAQ,SAAA,EAAW,OAAO,QAAA,EAAU,MAAA,EAAQ,MAAA,EAAQ,KAAA,EAAO,KAAK,CAAA;AAAA,EACpF,GAAA,EAAK,CAAC,WAAW,CAAA;AAAA,EACjB,GAAA,EAAK;AAAA,IACH,WAAA;AAAA,IACA,QAAA;AAAA,IACA,KAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,UAAA;AAAA,IACA,OAAA;AAAA,IACA,KAAA;AAAA,IACA,QAAA;AAAA,IACA,MAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,EAAA,EAAI,CAAC,KAAA,EAAO,IAAA,EAAM,IAAI,CAAA;AAAA,EACtB,KAAK,EAAC;AAAA,EACN,IAAA,EAAM,CAAC,IAAI,CAAA;AAAA,EACX,IAAA,EAAM,CAAC,IAAI,CAAA;AAAA,EACX,EAAA,EAAI,CAAC,IAAA,EAAM,IAAA,EAAM,IAAI,CAAA;AAAA,EACrB,MAAM,EAAC;AAAA,EACP,MAAM,EAAC;AAAA,EACP,MAAM,EAAC;AAAA,EACP,KAAA,EAAO,CAAC,IAAI,CAAA;AAAA,EACZ,EAAA,EAAI,CAAC,IAAI,CAAA;AAAA,EACT,IAAI,EAAC;AAAA,EACL,EAAA,EAAI,CAAC,KAAK,CAAA;AAAA,EACV,OAAO,EAAC;AAAA,EACR,GAAA,EAAK,CAAC,WAAA,EAAa,KAAA,EAAO,OAAO,MAAM,CAAA;AAAA,EACvC,GAAA,EAAK,CAAC,WAAA,EAAa,UAAA,EAAY,WAAW,CAAA;AAAA,EAC1C,MAAA,EAAQ,CAAC,WAAA,EAAa,KAAA,EAAO,YAAY,CAAA;AAAA,EACzC,KAAA,EAAO,CAAC,WAAA,EAAa,MAAA,EAAQ,UAAU,OAAO,CAAA;AAAA,EAC9C,KAAA,EAAO,CAAC,WAAA,EAAa,OAAA,EAAS,QAAQ,OAAO,CAAA;AAAA,EAC7C,KAAA,EAAO,CAAC,WAAW,CAAA;AAAA,EACnB,EAAA,EAAI,CAAC,SAAA,EAAW,KAAA,EAAO,SAAS,MAAM,CAAA;AAAA,EACtC,MAAA,EAAQ,CAAC,WAAA,EAAa,IAAI,CAAA;AAAA,EAC1B,GAAA,EAAK,CAAC,WAAA,EAAa,SAAA,EAAW,MAAM,CAAA;AAAA,EACpC,MAAA,EAAQ,CAAC,WAAA,EAAa,IAAA,EAAM,UAAU,OAAO,CAAA;AAAA,EAC7C,OAAA,EAAS,CAAC,SAAA,EAAW,KAAA,EAAO,YAAY,MAAM;AAChD,CAAA;AAEA,IAAM,QAAA,GAAW,EAAA;AACjB,IAAM,UAAA,GAAa,GAAA;AACnB,IAAM,UAAA,GAAa,GAAA;AAmBZ,IAAM,QAAA,GAAwC;AAAA,EACnD,IAAA,EAAM,MAAA;AAAA,EACN,WAAA,EACE,gHAAA;AAAA,EACF,SAAA,EACE,sHAAA;AAAA,EACF,UAAA,EAAY,SAAA;AAAA,EACZ,QAAA,EAAU,KAAA;AAAA,EACV,SAAA,EAAW,UAAA;AAAA,EACX,WAAA,EAAa;AAAA,IACX,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,OAAA,EAAS,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,uCAAA,EAAwC;AAAA,MAChF,IAAA,EAAM,EAAE,IAAA,EAAM,OAAA,EAAS,KAAA,EAAO,EAAE,IAAA,EAAM,QAAA,EAAS,EAAG,WAAA,EAAa,WAAA,EAAY;AAAA,MAC3E,GAAA,EAAK,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,sDAAA,EAAuD;AAAA,MAC3F,OAAA,EAAS,EAAE,IAAA,EAAM,SAAA,EAAW,aAAa,gCAAA;AAAiC,KAC5E;AAAA,IACA,QAAA,EAAU,CAAC,SAAS;AAAA,GACtB;AAAA,EACA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM;AAC9B,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,OAAA,CAAQ,IAAA,EAAK;AAC/B,IAAA,IAAI,CAAC,GAAA;AACH,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,GAAA;AAAA,QACT,MAAM,EAAC;AAAA,QACP,MAAA,EAAQ,EAAA;AAAA,QACR,MAAA,EAAQ,eAAA;AAAA,QACR,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAEF,IAAA,IAAI,EAAE,OAAO,gBAAA,CAAA,EAAmB;AAC9B,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,GAAA;AAAA,QACT,IAAA,EAAM,KAAA,CAAM,IAAA,IAAQ,EAAC;AAAA,QACrB,MAAA,EAAQ,EAAA;AAAA,QACR,MAAA,EAAQ,YAAY,GAAG,CAAA,6DAAA,CAAA;AAAA,QACvB,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,MAAM,QAAQ,KAAA,CAAM,IAAA,IAAQ,EAAC,EAAG,KAAA,CAAM,GAAG,QAAQ,CAAA;AACjD,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,IAAI,KAAA,CAAM,OAAA,IAAW,UAAA,EAAY,UAAU,CAAC,CAAA;AAI7E,IAAA,MAAM,YAAA,GAAe,MAAM,GAAA,GAAW,IAAA,CAAA,OAAA,CAAQ,IAAI,WAAA,EAAa,KAAA,CAAM,GAAG,CAAA,GAAI,GAAA,CAAI,GAAA;AAChF,IAAA,MAAM,GAAA,GAAW,IAAA,CAAA,QAAA,CAAS,GAAA,CAAI,WAAA,EAAa,YAAY,CAAA;AACvD,IAAA,IAAI,IAAI,UAAA,CAAW,IAAI,CAAA,IAAU,IAAA,CAAA,UAAA,CAAW,GAAG,CAAA,EAAG;AAChD,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,GAAA;AAAA,QACT,IAAA;AAAA,QACA,MAAA,EAAQ,EAAA;AAAA,QACR,MAAA,EAAQ,CAAA,KAAA,EAAQ,KAAA,CAAM,GAAG,CAAA,+BAAA,CAAA;AAAA,QACzB,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GAAM,YAAA;AACZ,IAAA,MAAM,SAAS,IAAA,CAAK,MAAA;AAEpB,IAAA,OAAO,UAAA,CAAW,KAAK,IAAA,EAAM,GAAA,EAAK,SAAS,MAAA,EAAQ,GAAA,CAAI,SAAS,EAAE,CAAA;AAAA,EACpE;AACF;AAEA,SAAS,WACP,GAAA,EACA,IAAA,EACA,GAAA,EACA,OAAA,EACA,QACA,SAAA,EACqB;AACrB,EAAA,OAAO,IAAI,OAAA,CAAQ,CAACA,QAAAA,KAAY;AAC9B,IAAA,IAAI,MAAA,GAAS,EAAA;AACb,IAAA,IAAI,MAAA,GAAS,EAAA;AACb,IAAA,IAAI,MAAA,GAAS,KAAA;AAEb,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,GAAA,EAAK,IAAA,EAAM;AAAA,MAC7B,GAAA;AAAA,MACA,MAAA;AAAA,MACA,GAAA,EAAK,cAAc,SAAS,CAAA;AAAA,MAC5B,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM;AAAA,KACjC,CAAA;AACD,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,MAAA,MAAA,GAAS,IAAA;AACT,MAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,IACtB,GAAG,OAAO,CAAA;AAEV,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAC1C,MAAA,IAAI,MAAA,CAAO,MAAA,GAAS,UAAA,EAAY,MAAA,IAAU,MAAM,QAAA,EAAS;AAAA,IAC3D,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAC1C,MAAA,IAAI,MAAA,CAAO,MAAA,GAAS,UAAA,EAAY,MAAA,IAAU,MAAM,QAAA,EAAS;AAAA,IAC3D,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,IAAA,KAAS;AAC1B,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAAA,QAAAA,CAAQ;AAAA,QACN,OAAA,EAAS,GAAA;AAAA,QACT,IAAA;AAAA,QACA,MAAA,EAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA;AAAA,QAClC,MAAA,EAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA;AAAA,QAClC,QAAA,EAAU,MAAA,GAAS,GAAA,GAAO,IAAA,IAAQ,CAAA;AAAA,QAClC,SAAA,EAAW,MAAA,CAAO,MAAA,IAAU,UAAA,IAAc,OAAO,MAAA,IAAU,UAAA;AAAA,QAC3D,OAAA,EAAS;AAAA,OACV,CAAA;AAAA,IACH,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AACzB,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAAA,QAAAA,CAAQ;AAAA,QACN,OAAA,EAAS,GAAA;AAAA,QACT,IAAA;AAAA,QACA,MAAA,EAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA;AAAA,QAClC,QAAQ,GAAA,CAAI,OAAA;AAAA,QACZ,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACV,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AACH","file":"exec.js","sourcesContent":["import { spawn } from 'node:child_process';\nimport * as path from 'node:path';\nimport type { Tool } from '@wrongstack/core';\nimport { buildChildEnv } from './_env.js';\n\nconst ALLOWED_COMMANDS: Record<string, string[]> = {\n  node: ['--version', '-e', '-p', '-r', '--input-type=module'],\n  npm: ['--version', 'init', 'install', 'test', 'run', 'list', 'pkg', 'doctor'],\n  pnpm: ['--version', 'init', 'install', 'add', 'remove', 'exec', 'list', 'run', 'dlx'],\n  npx: ['--version'],\n  git: [\n    '--version',\n    'status',\n    'log',\n    'diff',\n    'branch',\n    'checkout',\n    'stash',\n    'add',\n    'commit',\n    'push',\n    'pull',\n  ],\n  ls: ['-la', '-l', '-a'],\n  cat: [],\n  head: ['-n'],\n  tail: ['-n'],\n  wc: ['-l', '-w', '-c'],\n  grep: [],\n  find: [],\n  echo: [],\n  mkdir: ['-p'],\n  cp: ['-r'],\n  mv: [],\n  rm: ['-rf'],\n  touch: [],\n  bun: ['--version', 'run', 'add', 'init'],\n  tsc: ['--version', '--noEmit', '--project'],\n  vitest: ['--version', 'run', '--coverage'],\n  biome: ['--version', 'lint', 'format', 'check'],\n  cargo: ['--version', 'build', 'test', 'check'],\n  rustc: ['--version'],\n  go: ['version', 'run', 'build', 'test'],\n  python: ['--version', '-c'],\n  pip: ['--version', 'install', 'list'],\n  docker: ['--version', 'ps', 'images', 'build'],\n  kubectl: ['version', 'get', 'describe', 'logs'],\n};\n\nconst MAX_ARGS = 20;\nconst MAX_OUTPUT = 200_000;\nconst TIMEOUT_MS = 30_000;\n\ninterface ExecInput {\n  command: string;\n  args?: string[];\n  cwd?: string;\n  timeout?: number;\n}\n\ninterface ExecOutput {\n  command: string;\n  args: string[];\n  stdout: string;\n  stderr: string;\n  exitCode: number;\n  truncated: boolean;\n  allowed: boolean;\n}\n\nexport const execTool: Tool<ExecInput, ExecOutput> = {\n  name: 'exec',\n  description:\n    'Restricted shell that only runs pre-approved commands with constrained arguments. Safer alternative to `bash`.',\n  usageHint:\n    'Set `command` (must be in allowlist). `args` passed through. For arbitrary shell access use the `bash` tool instead.',\n  permission: 'confirm',\n  mutating: false,\n  timeoutMs: TIMEOUT_MS,\n  inputSchema: {\n    type: 'object',\n    properties: {\n      command: { type: 'string', description: 'Command to run (must be in allowlist)' },\n      args: { type: 'array', items: { type: 'string' }, description: 'Arguments' },\n      cwd: { type: 'string', description: 'Working directory (must resolve inside project root)' },\n      timeout: { type: 'integer', description: 'Timeout in ms (default: 30000)' },\n    },\n    required: ['command'],\n  },\n  async execute(input, ctx, opts) {\n    const cmd = input.command.trim();\n    if (!cmd)\n      return {\n        command: cmd,\n        args: [],\n        stdout: '',\n        stderr: 'Empty command',\n        exitCode: 1,\n        truncated: false,\n        allowed: false,\n      };\n\n    if (!(cmd in ALLOWED_COMMANDS)) {\n      return {\n        command: cmd,\n        args: input.args ?? [],\n        stdout: '',\n        stderr: `Command \"${cmd}\" not in allowlist. Use the bash tool for arbitrary commands.`,\n        exitCode: 1,\n        truncated: false,\n        allowed: false,\n      };\n    }\n\n    const args = (input.args ?? []).slice(0, MAX_ARGS);\n    const timeout = Math.max(1, Math.min(input.timeout ?? TIMEOUT_MS, TIMEOUT_MS));\n\n    // Resolve cwd inside the project root. Model-supplied paths like '/etc'\n    // would otherwise let allowlisted commands operate anywhere on disk.\n    const requestedCwd = input.cwd ? path.resolve(ctx.projectRoot, input.cwd) : ctx.cwd;\n    const rel = path.relative(ctx.projectRoot, requestedCwd);\n    if (rel.startsWith('..') || path.isAbsolute(rel)) {\n      return {\n        command: cmd,\n        args,\n        stdout: '',\n        stderr: `cwd \"${input.cwd}\" resolves outside project root`,\n        exitCode: 1,\n        truncated: false,\n        allowed: false,\n      };\n    }\n    const cwd = requestedCwd;\n    const signal = opts.signal;\n\n    return runCommand(cmd, args, cwd, timeout, signal, ctx.session?.id);\n  },\n};\n\nfunction runCommand(\n  cmd: string,\n  args: string[],\n  cwd: string,\n  timeout: number,\n  signal: AbortSignal,\n  sessionId: string | undefined,\n): Promise<ExecOutput> {\n  return new Promise((resolve) => {\n    let stdout = '';\n    let stderr = '';\n    let killed = false;\n\n    const child = spawn(cmd, args, {\n      cwd,\n      signal,\n      env: buildChildEnv(sessionId),\n      stdio: ['ignore', 'pipe', 'pipe'],\n    });\n    const timer = setTimeout(() => {\n      killed = true;\n      child.kill('SIGTERM');\n    }, timeout);\n\n    child.stdout?.on('data', (chunk: Buffer) => {\n      if (stdout.length < MAX_OUTPUT) stdout += chunk.toString();\n    });\n\n    child.stderr?.on('data', (chunk: Buffer) => {\n      if (stderr.length < MAX_OUTPUT) stderr += chunk.toString();\n    });\n\n    child.on('close', (code) => {\n      clearTimeout(timer);\n      resolve({\n        command: cmd,\n        args,\n        stdout: stdout.slice(0, MAX_OUTPUT),\n        stderr: stderr.slice(0, MAX_OUTPUT),\n        exitCode: killed ? 124 : (code ?? 1),\n        truncated: stdout.length >= MAX_OUTPUT || stderr.length >= MAX_OUTPUT,\n        allowed: true,\n      });\n    });\n\n    child.on('error', (err) => {\n      clearTimeout(timer);\n      resolve({\n        command: cmd,\n        args,\n        stdout: stdout.slice(0, MAX_OUTPUT),\n        stderr: err.message,\n        exitCode: 1,\n        truncated: false,\n        allowed: true,\n      });\n    });\n  });\n}\n"]}
+{"version":3,"sources":["../src/exec.ts"],"names":["resolve"],"mappings":";;;;;;;AAKA,IAAM,gBAAA,GAA6C;AAAA,EACjD,MAAM,CAAC,WAAA,EAAa,IAAA,EAAM,IAAA,EAAM,MAAM,qBAAqB,CAAA;AAAA,EAC3D,GAAA,EAAK,CAAC,WAAA,EAAa,MAAA,EAAQ,WAAW,MAAA,EAAQ,KAAA,EAAO,MAAA,EAAQ,KAAA,EAAO,QAAQ,CAAA;AAAA,EAC5E,IAAA,EAAM,CAAC,WAAA,EAAa,MAAA,EAAQ,SAAA,EAAW,OAAO,QAAA,EAAU,MAAA,EAAQ,MAAA,EAAQ,KAAA,EAAO,KAAK,CAAA;AAAA,EACpF,GAAA,EAAK,CAAC,WAAW,CAAA;AAAA,EACjB,GAAA,EAAK;AAAA,IACH,WAAA;AAAA,IACA,QAAA;AAAA,IACA,KAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,UAAA;AAAA,IACA,OAAA;AAAA,IACA,KAAA;AAAA,IACA,QAAA;AAAA,IACA,MAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,EAAA,EAAI,CAAC,KAAA,EAAO,IAAA,EAAM,IAAI,CAAA;AAAA,EACtB,KAAK,EAAC;AAAA,EACN,IAAA,EAAM,CAAC,IAAI,CAAA;AAAA,EACX,IAAA,EAAM,CAAC,IAAI,CAAA;AAAA,EACX,EAAA,EAAI,CAAC,IAAA,EAAM,IAAA,EAAM,IAAI,CAAA;AAAA,EACrB,MAAM,EAAC;AAAA,EACP,MAAM,EAAC;AAAA,EACP,MAAM,EAAC;AAAA,EACP,KAAA,EAAO,CAAC,IAAI,CAAA;AAAA,EACZ,EAAA,EAAI,CAAC,IAAI,CAAA;AAAA,EACT,IAAI,EAAC;AAAA,EACL,EAAA,EAAI,CAAC,KAAK,CAAA;AAAA,EACV,OAAO,EAAC;AAAA,EACR,GAAA,EAAK,CAAC,WAAA,EAAa,KAAA,EAAO,OAAO,MAAM,CAAA;AAAA,EACvC,GAAA,EAAK,CAAC,WAAA,EAAa,UAAA,EAAY,WAAW,CAAA;AAAA,EAC1C,MAAA,EAAQ,CAAC,WAAA,EAAa,KAAA,EAAO,YAAY,CAAA;AAAA,EACzC,KAAA,EAAO,CAAC,WAAA,EAAa,MAAA,EAAQ,UAAU,OAAO,CAAA;AAAA,EAC9C,KAAA,EAAO,CAAC,WAAA,EAAa,OAAA,EAAS,QAAQ,OAAO,CAAA;AAAA,EAC7C,KAAA,EAAO,CAAC,WAAW,CAAA;AAAA,EACnB,EAAA,EAAI,CAAC,SAAA,EAAW,KAAA,EAAO,SAAS,MAAM,CAAA;AAAA,EACtC,MAAA,EAAQ,CAAC,WAAA,EAAa,IAAI,CAAA;AAAA,EAC1B,GAAA,EAAK,CAAC,WAAA,EAAa,SAAA,EAAW,MAAM,CAAA;AAAA,EACpC,MAAA,EAAQ,CAAC,WAAA,EAAa,IAAA,EAAM,UAAU,OAAO,CAAA;AAAA,EAC7C,OAAA,EAAS,CAAC,SAAA,EAAW,KAAA,EAAO,YAAY,MAAM;AAChD,CAAA;AAEA,IAAM,QAAA,GAAW,EAAA;AACjB,IAAM,UAAA,GAAa,GAAA;AACnB,IAAM,UAAA,GAAa,GAAA;AAmBZ,IAAM,QAAA,GAAwC;AAAA,EACnD,IAAA,EAAM,MAAA;AAAA,EACN,WAAA,EACE,gHAAA;AAAA,EACF,SAAA,EACE,sHAAA;AAAA,EACF,UAAA,EAAY,SAAA;AAAA,EACZ,QAAA,EAAU,IAAA;AAAA,EACV,SAAA,EAAW,UAAA;AAAA,EACX,WAAA,EAAa;AAAA,IACX,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,OAAA,EAAS,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,uCAAA,EAAwC;AAAA,MAChF,IAAA,EAAM,EAAE,IAAA,EAAM,OAAA,EAAS,KAAA,EAAO,EAAE,IAAA,EAAM,QAAA,EAAS,EAAG,WAAA,EAAa,WAAA,EAAY;AAAA,MAC3E,GAAA,EAAK,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,sDAAA,EAAuD;AAAA,MAC3F,OAAA,EAAS,EAAE,IAAA,EAAM,SAAA,EAAW,aAAa,gCAAA;AAAiC,KAC5E;AAAA,IACA,QAAA,EAAU,CAAC,SAAS;AAAA,GACtB;AAAA,EACA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM;AAC9B,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,OAAA,CAAQ,IAAA,EAAK;AAC/B,IAAA,IAAI,CAAC,GAAA;AACH,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,GAAA;AAAA,QACT,MAAM,EAAC;AAAA,QACP,MAAA,EAAQ,EAAA;AAAA,QACR,MAAA,EAAQ,eAAA;AAAA,QACR,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAEF,IAAA,IAAI,EAAE,OAAO,gBAAA,CAAA,EAAmB;AAC9B,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,GAAA;AAAA,QACT,IAAA,EAAM,KAAA,CAAM,IAAA,IAAQ,EAAC;AAAA,QACrB,MAAA,EAAQ,EAAA;AAAA,QACR,MAAA,EAAQ,YAAY,GAAG,CAAA,6DAAA,CAAA;AAAA,QACvB,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,MAAM,QAAQ,KAAA,CAAM,IAAA,IAAQ,EAAC,EAAG,KAAA,CAAM,GAAG,QAAQ,CAAA;AACjD,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,IAAI,KAAA,CAAM,OAAA,IAAW,UAAA,EAAY,UAAU,CAAC,CAAA;AAI7E,IAAA,MAAM,YAAA,GAAe,MAAM,GAAA,GAAW,IAAA,CAAA,OAAA,CAAQ,IAAI,WAAA,EAAa,KAAA,CAAM,GAAG,CAAA,GAAI,GAAA,CAAI,GAAA;AAChF,IAAA,MAAM,GAAA,GAAW,IAAA,CAAA,QAAA,CAAS,GAAA,CAAI,WAAA,EAAa,YAAY,CAAA;AACvD,IAAA,IAAI,IAAI,UAAA,CAAW,IAAI,CAAA,IAAU,IAAA,CAAA,UAAA,CAAW,GAAG,CAAA,EAAG;AAChD,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,GAAA;AAAA,QACT,IAAA;AAAA,QACA,MAAA,EAAQ,EAAA;AAAA,QACR,MAAA,EAAQ,CAAA,KAAA,EAAQ,KAAA,CAAM,GAAG,CAAA,+BAAA,CAAA;AAAA,QACzB,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GAAM,YAAA;AACZ,IAAA,MAAM,SAAS,IAAA,CAAK,MAAA;AAEpB,IAAA,OAAO,UAAA,CAAW,KAAK,IAAA,EAAM,GAAA,EAAK,SAAS,MAAA,EAAQ,GAAA,CAAI,SAAS,EAAE,CAAA;AAAA,EACpE;AACF;AAEA,SAAS,WACP,GAAA,EACA,IAAA,EACA,GAAA,EACA,OAAA,EACA,QACA,SAAA,EACqB;AACrB,EAAA,OAAO,IAAI,OAAA,CAAQ,CAACA,QAAAA,KAAY;AAC9B,IAAA,IAAI,MAAA,GAAS,EAAA;AACb,IAAA,IAAI,MAAA,GAAS,EAAA;AACb,IAAA,IAAI,MAAA,GAAS,KAAA;AAEb,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,GAAA,EAAK,IAAA,EAAM;AAAA,MAC7B,GAAA;AAAA,MACA,MAAA;AAAA,MACA,GAAA,EAAK,cAAc,SAAS,CAAA;AAAA,MAC5B,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM;AAAA,KACjC,CAAA;AACD,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,MAAA,MAAA,GAAS,IAAA;AACT,MAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,IACtB,GAAG,OAAO,CAAA;AAEV,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAC1C,MAAA,IAAI,MAAA,CAAO,MAAA,GAAS,UAAA,EAAY,MAAA,IAAU,MAAM,QAAA,EAAS;AAAA,IAC3D,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAC1C,MAAA,IAAI,MAAA,CAAO,MAAA,GAAS,UAAA,EAAY,MAAA,IAAU,MAAM,QAAA,EAAS;AAAA,IAC3D,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,IAAA,KAAS;AAC1B,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAAA,QAAAA,CAAQ;AAAA,QACN,OAAA,EAAS,GAAA;AAAA,QACT,IAAA;AAAA,QACA,MAAA,EAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA;AAAA,QAClC,MAAA,EAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA;AAAA,QAClC,QAAA,EAAU,MAAA,GAAS,GAAA,GAAO,IAAA,IAAQ,CAAA;AAAA,QAClC,SAAA,EAAW,MAAA,CAAO,MAAA,IAAU,UAAA,IAAc,OAAO,MAAA,IAAU,UAAA;AAAA,QAC3D,OAAA,EAAS;AAAA,OACV,CAAA;AAAA,IACH,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AACzB,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAAA,QAAAA,CAAQ;AAAA,QACN,OAAA,EAAS,GAAA;AAAA,QACT,IAAA;AAAA,QACA,MAAA,EAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA;AAAA,QAClC,QAAQ,GAAA,CAAI,OAAA;AAAA,QACZ,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACV,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AACH","file":"exec.js","sourcesContent":["import { spawn } from 'node:child_process';\nimport * as path from 'node:path';\nimport type { Tool } from '@wrongstack/core';\nimport { buildChildEnv } from './_env.js';\n\nconst ALLOWED_COMMANDS: Record<string, string[]> = {\n  node: ['--version', '-e', '-p', '-r', '--input-type=module'],\n  npm: ['--version', 'init', 'install', 'test', 'run', 'list', 'pkg', 'doctor'],\n  pnpm: ['--version', 'init', 'install', 'add', 'remove', 'exec', 'list', 'run', 'dlx'],\n  npx: ['--version'],\n  git: [\n    '--version',\n    'status',\n    'log',\n    'diff',\n    'branch',\n    'checkout',\n    'stash',\n    'add',\n    'commit',\n    'push',\n    'pull',\n  ],\n  ls: ['-la', '-l', '-a'],\n  cat: [],\n  head: ['-n'],\n  tail: ['-n'],\n  wc: ['-l', '-w', '-c'],\n  grep: [],\n  find: [],\n  echo: [],\n  mkdir: ['-p'],\n  cp: ['-r'],\n  mv: [],\n  rm: ['-rf'],\n  touch: [],\n  bun: ['--version', 'run', 'add', 'init'],\n  tsc: ['--version', '--noEmit', '--project'],\n  vitest: ['--version', 'run', '--coverage'],\n  biome: ['--version', 'lint', 'format', 'check'],\n  cargo: ['--version', 'build', 'test', 'check'],\n  rustc: ['--version'],\n  go: ['version', 'run', 'build', 'test'],\n  python: ['--version', '-c'],\n  pip: ['--version', 'install', 'list'],\n  docker: ['--version', 'ps', 'images', 'build'],\n  kubectl: ['version', 'get', 'describe', 'logs'],\n};\n\nconst MAX_ARGS = 20;\nconst MAX_OUTPUT = 200_000;\nconst TIMEOUT_MS = 30_000;\n\ninterface ExecInput {\n  command: string;\n  args?: string[];\n  cwd?: string;\n  timeout?: number;\n}\n\ninterface ExecOutput {\n  command: string;\n  args: string[];\n  stdout: string;\n  stderr: string;\n  exitCode: number;\n  truncated: boolean;\n  allowed: boolean;\n}\n\nexport const execTool: Tool<ExecInput, ExecOutput> = {\n  name: 'exec',\n  description:\n    'Restricted shell that only runs pre-approved commands with constrained arguments. Safer alternative to `bash`.',\n  usageHint:\n    'Set `command` (must be in allowlist). `args` passed through. For arbitrary shell access use the `bash` tool instead.',\n  permission: 'confirm',\n  mutating: true,\n  timeoutMs: TIMEOUT_MS,\n  inputSchema: {\n    type: 'object',\n    properties: {\n      command: { type: 'string', description: 'Command to run (must be in allowlist)' },\n      args: { type: 'array', items: { type: 'string' }, description: 'Arguments' },\n      cwd: { type: 'string', description: 'Working directory (must resolve inside project root)' },\n      timeout: { type: 'integer', description: 'Timeout in ms (default: 30000)' },\n    },\n    required: ['command'],\n  },\n  async execute(input, ctx, opts) {\n    const cmd = input.command.trim();\n    if (!cmd)\n      return {\n        command: cmd,\n        args: [],\n        stdout: '',\n        stderr: 'Empty command',\n        exitCode: 1,\n        truncated: false,\n        allowed: false,\n      };\n\n    if (!(cmd in ALLOWED_COMMANDS)) {\n      return {\n        command: cmd,\n        args: input.args ?? [],\n        stdout: '',\n        stderr: `Command \"${cmd}\" not in allowlist. Use the bash tool for arbitrary commands.`,\n        exitCode: 1,\n        truncated: false,\n        allowed: false,\n      };\n    }\n\n    const args = (input.args ?? []).slice(0, MAX_ARGS);\n    const timeout = Math.max(1, Math.min(input.timeout ?? TIMEOUT_MS, TIMEOUT_MS));\n\n    // Resolve cwd inside the project root. Model-supplied paths like '/etc'\n    // would otherwise let allowlisted commands operate anywhere on disk.\n    const requestedCwd = input.cwd ? path.resolve(ctx.projectRoot, input.cwd) : ctx.cwd;\n    const rel = path.relative(ctx.projectRoot, requestedCwd);\n    if (rel.startsWith('..') || path.isAbsolute(rel)) {\n      return {\n        command: cmd,\n        args,\n        stdout: '',\n        stderr: `cwd \"${input.cwd}\" resolves outside project root`,\n        exitCode: 1,\n        truncated: false,\n        allowed: false,\n      };\n    }\n    const cwd = requestedCwd;\n    const signal = opts.signal;\n\n    return runCommand(cmd, args, cwd, timeout, signal, ctx.session?.id);\n  },\n};\n\nfunction runCommand(\n  cmd: string,\n  args: string[],\n  cwd: string,\n  timeout: number,\n  signal: AbortSignal,\n  sessionId: string | undefined,\n): Promise<ExecOutput> {\n  return new Promise((resolve) => {\n    let stdout = '';\n    let stderr = '';\n    let killed = false;\n\n    const child = spawn(cmd, args, {\n      cwd,\n      signal,\n      env: buildChildEnv(sessionId),\n      stdio: ['ignore', 'pipe', 'pipe'],\n    });\n    const timer = setTimeout(() => {\n      killed = true;\n      child.kill('SIGTERM');\n    }, timeout);\n\n    child.stdout?.on('data', (chunk: Buffer) => {\n      if (stdout.length < MAX_OUTPUT) stdout += chunk.toString();\n    });\n\n    child.stderr?.on('data', (chunk: Buffer) => {\n      if (stderr.length < MAX_OUTPUT) stderr += chunk.toString();\n    });\n\n    child.on('close', (code) => {\n      clearTimeout(timer);\n      resolve({\n        command: cmd,\n        args,\n        stdout: stdout.slice(0, MAX_OUTPUT),\n        stderr: stderr.slice(0, MAX_OUTPUT),\n        exitCode: killed ? 124 : (code ?? 1),\n        truncated: stdout.length >= MAX_OUTPUT || stderr.length >= MAX_OUTPUT,\n        allowed: true,\n      });\n    });\n\n    child.on('error', (err) => {\n      clearTimeout(timer);\n      resolve({\n        command: cmd,\n        args,\n        stdout: stdout.slice(0, MAX_OUTPUT),\n        stderr: err.message,\n        exitCode: 1,\n        truncated: false,\n        allowed: true,\n      });\n    });\n  });\n}\n"]}

package/dist/index.d.ts

@@ -9,6 +9,7 @@ export { execTool } from './exec.js';
 export { fetchTool } from './fetch.js';
 export { searchTool } from './search.js';
 export { todoTool } from './todo.js';
+import { Tool } from '@wrongstack/core';
 export { gitTool } from './git.js';
 export { patchTool } from './patch.js';
 export { jsonTool } from './json.js';
@@ -31,4 +32,39 @@ export { toolHelpTool } from './tool-help.js';
 export { forgetTool, rememberTool } from './memory.js';
 export { createModeTool } from './mode.js';
 export { builtinTools } from './builtin.js';
-import '@wrongstack/core';
+
+/**
+ * `planTool` — the LLM-callable counterpart to the `/plan` slash command.
+ *
+ * Plans capture strategic, multi-step approaches that survive across
+ * session resumes (unlike todos, which are tactical and per-turn).
+ * Storage path comes from `ctx.meta['plan.path']` — the CLI seeds this
+ * during startup so the tool always knows where to read/write.
+ *
+ * One tool, multiple actions, JSON in/out. The action discriminates the
+ * operation so the LLM can do show / add / start / done / remove / clear
+ * via a single tool registration instead of bloating the surface with
+ * six near-identical tools.
+ */
+interface PlanInput {
+    action: 'show' | 'add' | 'start' | 'done' | 'remove' | 'clear';
+    /** Required for add. */
+    title?: string;
+    /** Optional detail line for add. */
+    details?: string;
+    /** Required for start/done/remove — accepts plan item id OR 1-based index OR title substring. */
+    target?: string;
+}
+interface PlanOutput {
+    ok: boolean;
+    message: string;
+    /** Formatted plan after the operation. Same string the user sees from `/plan show`. */
+    plan: string;
+    /** Total item count after the operation. */
+    count: number;
+    /** Number of items not in 'done' status. */
+    open: number;
+}
+declare const planTool: Tool<PlanInput, PlanOutput>;
+
+export { planTool };

package/dist/index.js

@@ -1,7 +1,7 @@
 import * as fs4 from 'fs/promises';
 import * as path from 'path';
 import { dirname } from 'path';
-import { atomicWrite, unifiedDiff, detectNewlineStyle, normalizeToLf, toStyle, compileGlob, buildChildEnv, stripAnsi } from '@wrongstack/core';
+import { atomicWrite, unifiedDiff, detectNewlineStyle, normalizeToLf, toStyle, compileGlob, buildChildEnv, stripAnsi, loadPlan, emptyPlan, clearPlan, savePlan, removePlanItem, setPlanItemStatus, addPlanItem, formatPlan } from '@wrongstack/core';
 import { spawn } from 'child_process';
 import * as os from 'os';
 import * as dns from 'dns/promises';
@@ -330,7 +330,7 @@ var replaceTool = {
     if (input.replacement === void 0) throw new Error("replace: replacement is required");
     if (!input?.files) throw new Error("replace: files is required");
     const replaceAll = input.replace_all ?? true;
-    const compiled = compileUserRegex(input.pattern, replaceAll ? "g" : "");
+    const compiled = compileUserRegex(input.pattern, "g");
     if (!compiled.ok) {
       throw new Error(`replace: ${compiled.reason}`);
     }
@@ -369,11 +369,17 @@ var replaceTool = {
       const style = detectNewlineStyle(content);
       const contentLf = normalizeToLf(content);
       re.lastIndex = 0;
-      const matches = [...contentLf.matchAll(re)];
-      if (matches.length === 0) continue;
-      const newContentLf = contentLf.replace(re, input.replacement);
+      const allMatches = [...contentLf.matchAll(re)];
+      if (allMatches.length === 0) continue;
+      const matches = replaceAll ? allMatches : allMatches.slice(0, 1);
+      const count = matches.length;
+      let newContentLf = contentLf;
+      for (let i = matches.length - 1; i >= 0; i--) {
+        const m = matches[i];
+        newContentLf = newContentLf.slice(0, m.index) + input.replacement + newContentLf.slice(m.index + m[0].length);
+      }
       re.lastIndex = 0;
-      totalReplacements += matches.length;
+      totalReplacements += count;
       if (!dryRun) {
         const newContent = toStyle(newContentLf, style);
         await atomicWrite(realPath, newContent, { mode: stat9.mode & 511 });
@@ -1035,7 +1041,7 @@ var execTool = {
   description: "Restricted shell that only runs pre-approved commands with constrained arguments. Safer alternative to `bash`.",
   usageHint: "Set `command` (must be in allowlist). `args` passed through. For arbitrary shell access use the `bash` tool instead.",
   permission: "confirm",
-  mutating: false,
+  mutating: true,
   timeoutMs: TIMEOUT_MS,
   inputSchema: {
     type: "object",
@@ -1684,6 +1690,103 @@ var todoTool = {
     };
   }
 };
+var planTool = {
+  name: "plan",
+  description: "Inspect or edit the strategic plan board for this session. Plans persist across resume (unlike todos). Use this to lay out the multi-step approach before diving in, then mark steps in_progress/done as the work proceeds.",
+  usageHint: "Set action to one of: show | add | start | done | remove | clear. Pass `title` for add. Pass `target` (item id, 1-based index, or title substring) for start/done/remove. Always returns the formatted plan plus open/total counts.",
+  permission: "auto",
+  mutating: false,
+  timeoutMs: 2e3,
+  inputSchema: {
+    type: "object",
+    properties: {
+      action: {
+        type: "string",
+        enum: ["show", "add", "start", "done", "remove", "clear"]
+      },
+      title: { type: "string", description: "Required when action = add." },
+      details: { type: "string", description: "Optional extra context for add." },
+      target: {
+        type: "string",
+        description: "Plan item id, 1-based index, or title substring. Required for start/done/remove."
+      }
+    },
+    required: ["action"]
+  },
+  async execute(input, ctx) {
+    const planPath = ctx.meta["plan.path"];
+    if (typeof planPath !== "string" || !planPath) {
+      return {
+        ok: false,
+        message: "Plan storage path is not configured for this session.",
+        plan: "",
+        count: 0,
+        open: 0
+      };
+    }
+    const sessionId = ctx.session?.id ?? "unknown";
+    let plan = await loadPlan(planPath) ?? emptyPlan(sessionId);
+    switch (input.action) {
+      case "show":
+        break;
+      case "add": {
+        const title = input.title?.trim();
+        if (!title) {
+          return mkResult(plan, false, "add requires `title`.");
+        }
+        ({ plan } = addPlanItem(plan, title, input.details?.trim() || void 0));
+        await savePlan(planPath, plan);
+        break;
+      }
+      case "start":
+      case "done": {
+        if (!input.target) {
+          return mkResult(plan, false, `${input.action} requires \`target\` (id|index|substring).`);
+        }
+        const next = setPlanItemStatus(
+          plan,
+          input.target,
+          input.action === "start" ? "in_progress" : "done"
+        );
+        if (next === plan) {
+          return mkResult(plan, false, `No plan item matched "${input.target}".`);
+        }
+        plan = next;
+        await savePlan(planPath, plan);
+        break;
+      }
+      case "remove": {
+        if (!input.target) {
+          return mkResult(plan, false, "remove requires `target` (id|index|substring).");
+        }
+        const next = removePlanItem(plan, input.target);
+        if (next === plan) {
+          return mkResult(plan, false, `No plan item matched "${input.target}".`);
+        }
+        plan = next;
+        await savePlan(planPath, plan);
+        break;
+      }
+      case "clear":
+        plan = clearPlan(plan);
+        await savePlan(planPath, plan);
+        break;
+      default:
+        return mkResult(plan, false, `Unknown action "${input.action}".`);
+    }
+    return mkResult(plan, true, `Plan ${input.action} ok.`);
+  }
+};
+function mkResult(plan, ok, message) {
+  const open = plan.items.filter((i) => i.status !== "done").length;
+  return {
+    ok,
+    message,
+    plan: formatPlan(plan),
+    count: plan.items.length,
+    open
+  };
+}
 var TIMEOUT_MS4 = 3e4;
 var MAX_OUTPUT3 = 1e5;
 var gitTool = {
@@ -3735,7 +3838,7 @@ var toolUseTool = {
   description: "Execute a specific tool by name with given input. Useful when the agent knows exactly which tool to call.",
   usageHint: "Set `tool` with exact tool name and `input` with the tool parameters. Returns result or error.",
   permission: "confirm",
-  mutating: false,
+  mutating: true,
   timeoutMs: 6e4,
   inputSchema: {
     type: "object",
@@ -3803,7 +3906,7 @@ var batchToolUseTool = {
   description: "Execute multiple tool calls in sequence or parallel. Returns all results.",
   usageHint: "Set `calls` array with tool names and inputs. `stop_on_error` halts on first failure. `parallel` runs concurrently (default: true).",
   permission: "confirm",
-  mutating: false,
+  mutating: true,
   timeoutMs: 12e4,
   inputSchema: {
     type: "object",
@@ -4166,6 +4269,7 @@ var builtinTools = [
   fetchTool,
   searchTool,
   todoTool,
+  planTool,
   gitTool,
   patchTool,
   jsonTool,
@@ -4187,6 +4291,6 @@ var builtinTools = [
   toolHelpTool
 ];
 
-export { auditTool, bashTool, batchToolUseTool, builtinTools, createModeTool, diffTool, documentTool, editTool, execTool, fetchTool, forgetTool, formatTool, gitTool, globTool, grepTool, installTool, jsonTool, lintTool, logsTool, outdatedTool, patchTool, readTool, rememberTool, replaceTool, scaffoldTool, searchTool, testTool, todoTool, toolHelpTool, toolSearchTool, toolUseTool, treeTool, typecheckTool, writeTool };
+export { auditTool, bashTool, batchToolUseTool, builtinTools, createModeTool, diffTool, documentTool, editTool, execTool, fetchTool, forgetTool, formatTool, gitTool, globTool, grepTool, installTool, jsonTool, lintTool, logsTool, outdatedTool, patchTool, planTool, readTool, rememberTool, replaceTool, scaffoldTool, searchTool, testTool, todoTool, toolHelpTool, toolSearchTool, toolUseTool, treeTool, typecheckTool, writeTool };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map