@wrongstack/tools 0.273.0 → 0.274.0

package/dist/exec.d.ts

@@ -1,5 +1,24 @@
 import { Tool } from '@wrongstack/core';
 
+/**
+ * Apply the configured exec command policy. Recomputes the effective allowlist
+ * as `DEFAULT ∪ allow − deny`. Call once at boot from
+ * `config.tools.exec.{allow,deny}`. Idempotent (always rebuilt from defaults).
+ *
+ * SECURITY: `allow` must originate from TRUSTED config only — the config loader
+ * strips `tools.exec.allow` from the untrusted in-project repo config before it
+ * reaches here. `deny` is safe from any source (it only narrows).
+ */
+declare function configureExecPolicy(opts?: {
+    allow?: readonly string[] | undefined;
+    deny?: readonly string[] | undefined;
+}): void;
+/** Reset the exec allowlist to the built-in defaults (tests / re-init). */
+declare function resetExecPolicy(): void;
+/** Whether `cmd` is currently in the effective exec allowlist. */
+declare function isExecCommandAllowed(cmd: string): boolean;
+/** Snapshot of the effective allowlist (sorted) — for tests / diagnostics. */
+declare function getExecAllowlist(): string[];
 interface ExecInput {
     command: string;
     args?: string[] | undefined;
@@ -17,4 +36,4 @@ interface ExecOutput {
 }
 declare const execTool: Tool<ExecInput, ExecOutput>;
 
-export { execTool };
+export { configureExecPolicy, execTool, getExecAllowlist, isExecCommandAllowed, resetExecPolicy };

package/dist/exec.js

@@ -1,4 +1,5 @@
 import { spawn } from 'node:child_process';
+import { toErrorMessage } from '@wrongstack/core/utils/error';
 import * as Core from '@wrongstack/core';
 import { buildChildEnv, expectDefined, wstackGlobalRoot } from '@wrongstack/core';
 import * as fs from 'node:fs';
@@ -783,49 +784,86 @@ function assertSafeWin32ShellArgs(args) {
 
 // src/exec.ts
 var isWin = process.platform === "win32";
-var ALLOWED_COMMANDS = {
-  node: ["--version", "-r", "--input-type=module"],
-  npm: ["--version", "list", "pkg", "doctor", "view", "outdated", "audit"],
-  pnpm: ["--version", "remove", "list", "view", "outdated", "audit"],
-  npx: ["--version"],
-  git: [
-    "--version",
-    "status",
-    "log",
-    "diff",
-    "branch",
-    "checkout",
-    "stash",
-    "add",
-    "commit",
-    "push",
-    "pull"
-  ],
-  ls: ["-la", "-l", "-a"],
-  cat: [],
-  head: ["-n"],
-  tail: ["-n"],
-  wc: ["-l", "-w", "-c"],
-  grep: [],
-  find: [],
-  echo: [],
-  mkdir: ["-p"],
-  cp: ["-r"],
-  mv: [],
-  rm: ["-rf"],
-  touch: [],
-  bun: ["--version"],
-  tsc: ["--version", "--noEmit", "--project"],
-  vitest: ["--version", "run", "--coverage"],
-  biome: ["--version", "lint", "format", "check"],
-  cargo: ["--version", "build", "test", "check"],
-  rustc: ["--version"],
-  go: ["version", "run", "build", "test"],
-  python: ["--version"],
-  pip: ["--version", "list"],
-  docker: ["--version", "ps", "images"],
-  kubectl: ["version", "get", "describe", "logs"]
-};
+var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
+  // JS / TS toolchain
+  "node",
+  "npm",
+  "pnpm",
+  "yarn",
+  "npx",
+  "bun",
+  "deno",
+  "tsc",
+  "vitest",
+  "jest",
+  "biome",
+  "eslint",
+  "prettier",
+  // version control
+  "git",
+  // Rust
+  "cargo",
+  "rustc",
+  // Go
+  "go",
+  // Python
+  "python",
+  "python3",
+  "pip",
+  "pip3",
+  // Ruby
+  "ruby",
+  "gem",
+  "bundle",
+  // JVM
+  "java",
+  "javac",
+  "mvn",
+  "gradle",
+  "gradlew",
+  // .NET
+  "dotnet",
+  // C / C++ / native build
+  "make",
+  "cmake",
+  // containers / orchestration (read-only subcommands; see BLOCKED_ARG_PATTERNS)
+  "docker",
+  "kubectl",
+  // common POSIX file/text utilities
+  "ls",
+  "cat",
+  "head",
+  "tail",
+  "wc",
+  "grep",
+  "find",
+  "echo",
+  "mkdir",
+  "cp",
+  "mv",
+  "rm",
+  "touch"
+]);
+var allowedCommands = new Set(DEFAULT_ALLOWED_COMMANDS);
+var normalizeCmd = (c) => c.trim();
+function configureExecPolicy(opts = {}) {
+  const next = new Set(DEFAULT_ALLOWED_COMMANDS);
+  for (const c of opts.allow ?? []) {
+    const n = normalizeCmd(c);
+    if (n) next.add(n);
+  }
+  for (const c of opts.deny ?? []) next.delete(normalizeCmd(c));
+  allowedCommands = next;
+}
+function resetExecPolicy() {
+  allowedCommands = new Set(DEFAULT_ALLOWED_COMMANDS);
+}
+function isExecCommandAllowed(cmd) {
+  return allowedCommands.has(normalizeCmd(cmd));
+}
+function getExecAllowlist() {
+  return [...allowedCommands].sort();
+}
 var MAX_ARGS = 20;
 var MAX_OUTPUT = 2e5;
 var DEFAULT_TIMEOUT_MS = 3e4;
@@ -887,7 +925,7 @@ var execTool = {
   name: "exec",
   category: "Shell",
   description: "Execute a **whitelisted, restricted set of commands** with strict argument validation. This is the **preferred and safer** alternative to the `bash` tool for running development tools (node, npm, pnpm, tsc, git, tests, linters, etc.). It prevents arbitrary command injection and limits what the model can do.",
-  usageHint: "PREFERRED SHELL TOOL for most cases.\n\nUse this instead of `bash` whenever possible.\n- `command` must be one of the allowed commands (node, npm, pnpm, git, tsc, eslint, vitest, etc.).\n- Arguments are passed as a clean array (no shell interpretation).\n- `cwd` is validated to stay inside the project.\n- For anything that requires real shell features (pipes, complex redirection, arbitrary commands), fall back to `bash` (with strong justification).\nThis tool significantly reduces the risk compared to full shell access.",
+  usageHint: "PREFERRED SHELL TOOL for most cases.\n\nUse this instead of `bash` whenever possible.\n- `command` must be in the allowlist. Defaults cover JS (node/npm/pnpm/yarn/bun/deno/tsc/vitest/eslint/biome), Go (`go build`/`go test`), Rust (cargo), Python (python/pip), Ruby (gem/bundle), JVM (java/mvn/gradle), .NET (dotnet), native (make/cmake), and git. Users can extend it via `tools.exec.allow` in config.\n- Arguments are passed as a clean array (no shell interpretation).\n- `cwd` is validated to stay inside the project.\n- If a command is not allowlisted, the error explains how to add it; for one-off arbitrary commands, fall back to `bash` (with strong justification).\nThis tool significantly reduces the risk compared to full shell access.",
   permission: "confirm",
   mutating: true,
   riskTier: "standard",
@@ -941,12 +979,12 @@ var execTool = {
         truncated: false,
         allowed: false
       };
-    if (!(cmd in ALLOWED_COMMANDS)) {
+    if (!isExecCommandAllowed(cmd)) {
       return {
         command: cmd,
         args: input.args ?? [],
         stdout: "",
-        stderr: `Command "${cmd}" not in allowlist. Use the bash tool for arbitrary commands.`,
+        stderr: `Command "${cmd}" not in allowlist. Add it to your ~/.wrongstack/config.json under "tools": { "exec": { "allow": ["${cmd}"] } }, or use the bash tool for one-off arbitrary commands.`,
         exitCode: 1,
         truncated: false,
         allowed: false
@@ -989,19 +1027,58 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
     let stdout = "";
     let stderr = "";
     let killed = false;
+    const resolvedOnce = { value: false };
+    const finish = (result) => {
+      if (resolvedOnce.value) return;
+      resolvedOnce.value = true;
+      resolve2(result);
+    };
     const startedAt = Date.now();
     const spool = createOutputSpool({ tool: `exec-${cmd}`, thresholdBytes: MAX_OUTPUT });
     const resolved = resolveWin32Command(cmd);
     const needsShell = isWin && (resolved.endsWith(".cmd") || resolved.endsWith(".bat"));
     const spawnCmd = needsShell ? cmd : resolved;
     if (needsShell) assertSafeWin32ShellArgs(args);
-    const child = spawn(spawnCmd, args, {
-      cwd,
-      env: buildChildEnv(sessionId),
-      stdio: ["ignore", "pipe", "pipe"],
-      windowsHide: true,
-      ...isWin ? {} : { signal },
-      ...needsShell ? { shell: true, windowsVerbatimArguments: true } : {}
+    let child;
+    try {
+      child = spawn(spawnCmd, args, {
+        cwd,
+        env: buildChildEnv(sessionId),
+        stdio: ["ignore", "pipe", "pipe"],
+        windowsHide: true,
+        ...isWin ? {} : { signal },
+        ...needsShell ? { shell: true, windowsVerbatimArguments: true } : {}
+      });
+    } catch (err) {
+      spool.finalize();
+      finish({
+        command: cmd,
+        args,
+        stdout: "",
+        stderr: `spawn failed: ${toErrorMessage(err)}`,
+        exitCode: 1,
+        truncated: false,
+        allowed: true
+      });
+      return;
+    }
+    child.on("error", (err) => {
+      const isAbort = err && err.code === "ABORT_ERR";
+      const stderrText = isAbort ? `Aborted: ${err.message}` : err.message;
+      clearTimeout(timer);
+      if (isWin) signal.removeEventListener("abort", onAbort);
+      if (typeof pid === "number") registry.unregister(pid);
+      registry.afterCall(Date.now() - startedAt, true);
+      spool.finalize();
+      finish({
+        command: cmd,
+        args,
+        stdout: normalizeCommandOutput(stdout),
+        stderr: stderrText,
+        exitCode: isAbort ? 124 : 1,
+        truncated: Buffer.byteLength(stdout, "utf8") > COMMAND_OUTPUT_MAX_BYTES,
+        allowed: true
+      });
     });
     const registry = getProcessRegistry();
     const pid = child.pid;
@@ -1041,7 +1118,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
       const exitCode = killed ? 124 : code ?? 1;
       registry.afterCall(durationMs, exitCode !== 0);
       const spooled = spool.finalize();
-      resolve2({
+      finish({
         command: cmd,
         args,
         stdout: normalizeCommandOutput(stdout) + (spooled ? spoolNote(spooled) : ""),
@@ -1051,25 +1128,9 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
         allowed: true
       });
     });
-    child.on("error", (err) => {
-      clearTimeout(timer);
-      if (isWin) signal.removeEventListener("abort", onAbort);
-      if (typeof pid === "number") registry.unregister(pid);
-      registry.afterCall(Date.now() - startedAt, true);
-      spool.finalize();
-      resolve2({
-        command: cmd,
-        args,
-        stdout: normalizeCommandOutput(stdout),
-        stderr: err.message,
-        exitCode: 1,
-        truncated: Buffer.byteLength(stdout, "utf8") > COMMAND_OUTPUT_MAX_BYTES,
-        allowed: true
-      });
-    });
   });
 }
 
-export { execTool };
+export { configureExecPolicy, execTool, getExecAllowlist, isExecCommandAllowed, resetExecPolicy };
 //# sourceMappingURL=exec.js.map
 //# sourceMappingURL=exec.js.map