@wrongstack/tools 0.274.0 → 0.275.0

package/dist/bash.js

@@ -338,6 +338,7 @@ var CircuitBreaker = class {
     if (this.state === "open") return;
     this.state = "open";
     this.openedAt = Date.now();
+    this.window = [];
     try {
       this.onTrip?.();
     } catch {
@@ -377,7 +378,7 @@ var SENSITIVE_FLAG_PATTERNS = [
   /--(?:token|password|passwd|pwd|secret|api[-_]?key|api[-_]?secret|auth|credential|private[-_]?key|access[-_]?key|github[-_]?token|gh[-_]?token|bearer|jwt|oauth|pin|pincode|passphrase|access[-_]?token)(?:[=\s,][^\s]*)?/gi,
   // -f "value" style short flags
   /(?<!\w)-t(?:\s+|\s*=\s*)[^\s,]+/,
-  /(?<!\w)-p(?:ssword)?(?:\s+|\s*=\s*)[^\s,]+/gi,
+  /(?<!\w)-(?:p|password)(?:\s+|\s*=\s*)[^\s,]+/gi,
   // env var–style secrets: TOKEN=x, API_KEY=y, etc.
   /(?:TOKEN|API_KEY|API_SECRET|AUTH_TOKEN|GITHUB_TOKEN|GH_TOKEN|BEARER|JWT|OAUTH|CREDENTIAL|SECRET|PRIVATE_KEY|PASSWORD|PASSWD)\s*[=:]\s*[^\s,]+/gi,
   // Generic high-entropy look: base64 strings >32 chars or hex strings >32 digits — but only
@@ -438,12 +439,35 @@ var ProcessRegistryImpl = class {
   register(info) {
     this.processes.set(info.pid, { ...info, killed: false, protected: info.protected ?? false });
   }
+  _isSafeSignalPid(pid) {
+    return Number.isInteger(pid) && pid > 1 && pid !== process.pid && pid !== process.ppid;
+  }
+  _canSignalProcessGroup(p) {
+    return os2.platform() !== "win32" && p.processGroupLeader === true && this._isSafeSignalPid(p.pid) && typeof p.child.pid === "number" && p.child.pid === p.pid;
+  }
+  _killChildDirect(p, signal) {
+    try {
+      p.child.kill(signal);
+    } catch {
+    }
+  }
+  _killPosix(p, signal) {
+    if (this._canSignalProcessGroup(p)) {
+      try {
+        process.kill(-p.pid, signal);
+        return;
+      } catch {
+      }
+    }
+    this._killChildDirect(p, signal);
+  }
   /** Unregister a process by PID. Called on 'close' / 'exit' events. */
   unregister(pid) {
     this.processes.delete(pid);
   }
   /** Get a single process by PID. */
   get(pid) {
+    this._pruneStale(pid);
     return this.processes.get(pid);
   }
   /** Get all tracked processes. */
@@ -607,13 +631,14 @@ var ProcessRegistryImpl = class {
    *  Returns true if the process was found and kill was attempted.
    */
   kill(pid, opts = {}) {
+    this._pruneStale(pid);
     const p = this.processes.get(pid);
     if (!p) return false;
     if (p.killed) return true;
     if (p.protected) return false;
     const { force = false, graceMs = DEFAULT_GRACE_MS } = opts;
-    const isWin = os2.platform() === "win32";
-    if (isWin) {
+    const isWin2 = os2.platform() === "win32";
+    if (isWin2) {
       const liveRealChild = p.child.exitCode === null && typeof p.child.pid === "number";
       if (liveRealChild && killWin32Tree(pid)) {
         const fallback = setTimeout(() => {
@@ -636,27 +661,12 @@ var ProcessRegistryImpl = class {
     }
     try {
       if (force) {
-        try {
-          process.kill(-pid, "SIGKILL");
-        } catch {
-          p.child.kill("SIGKILL");
-        }
+        this._killPosix(p, "SIGKILL");
       } else {
-        try {
-          process.kill(-pid, "SIGTERM");
-        } catch {
-          p.child.kill("SIGTERM");
-        }
+        this._killPosix(p, "SIGTERM");
         const timer = setTimeout(() => {
           if (this.processes.has(pid) && !p.child.killed) {
-            try {
-              process.kill(-pid, "SIGKILL");
-            } catch {
-              try {
-                p.child.kill("SIGKILL");
-              } catch {
-              }
-            }
+            this._killPosix(p, "SIGKILL");
           }
         }, graceMs);
         timer.unref?.();
@@ -691,6 +701,34 @@ var ProcessRegistryImpl = class {
     }
     return killed;
   }
+  /**
+   * Check whether a tracked process entry is stale — the child has exited
+   * (exitCode !== null) AND it's been in the registry long enough that the
+   * OS may have reused the PID for a new, unrelated process.
+   *
+   * P3 #24 (before-release.md): on POSIX, PIDs are reused after process
+   * exit. If a tracked process exits but its 'close' event hasn't fired yet
+   * (or was missed), the registry still holds the entry. A new process
+   * gets the same PID, and PID-based lookups (get, kill, shouldBlockKill)
+   * may incorrectly protect or target the wrong process.
+   *
+   * The 60s threshold is conservative — the OS typically waits much longer
+   * before reusing a PID, but we want to clean up before that becomes a risk.
+   */
+  _isStaleEntry(entry) {
+    return entry.child.exitCode !== null && Date.now() - entry.startedAt > 6e4;
+  }
+  /**
+   * Remove a stale entry for a specific PID before any PID-based lookup.
+   * This prevents PID reuse from causing the registry to act on a dead
+   * process that has been replaced by a new one with the same PID.
+   */
+  _pruneStale(pid) {
+    const entry = this.processes.get(pid);
+    if (entry && this._isStaleEntry(entry)) {
+      this.processes.delete(pid);
+    }
+  }
 };
 var _registry;
 function getProcessRegistry() {
@@ -1106,17 +1144,18 @@ function getPersistentProcessRegistry() {
 }
 
 // src/bash-kill-guard.ts
+var isWin = os2.platform() === "win32";
 function extractKillCommand(command) {
   const normalized = command.replace(/\s+/g, " ").trim();
   const shellCMatch = normalized.match(
-    /^(?:\/\w+)?\/?(?:bin|usr)\/(?:ba)?sh\s+-[c]\s+['"](.+?)['"]$/
+    /^(?:\S+(?:\s+\S+)?)?\s+-c\s+['"](.+?)['"]$/
   );
   if (shellCMatch?.[1]) {
     const inner = shellCMatch[1].trim();
     return isKillRelatedCommand(inner) ? inner : null;
   }
   const shellCUnquoted = normalized.match(
-    /^(?:\/\w+)?\/?(?:bin|usr)\/(?:ba)?sh\s+-[c]\s+(kill(?:\s+-[a-zA-Z]+)?(?:\s+\d+)+)$/
+    /^(?:\S+(?:\s+\S+)?)?\s+-c\s+(kill(?:\s+-[a-zA-Z]+)?(?:\s+\d+)+)$/
   );
   if (shellCUnquoted?.[1]) {
     return shellCUnquoted[1];
@@ -1125,15 +1164,43 @@ function extractKillCommand(command) {
 }
 function isKillRelatedCommand(cmd) {
   const normalized = cmd.toLowerCase().replace(/\s+/g, " ").trim();
+  if (isWin) {
+    if (/^taskkill\s/i.test(normalized)) return true;
+    if (/^tskill\s/i.test(normalized)) return true;
+    return false;
+  }
   if (/^kill(\s|$)/.test(normalized)) return true;
   if (/^(pkill|killall|pgrep|skill)\s/.test(normalized)) return true;
-  if (/^taskkill\s/i.test(normalized)) return true;
-  if (/^tskill\s/i.test(normalized)) return true;
   if (/^\/proc\/\d+\/(?:kill|fd)/.test(normalized)) return true;
   return false;
 }
 function parseKillCommand(command) {
   const normalized = command.replace(/\s+/g, " ").trim();
+  if (isWin) {
+    const taskkillMatch = normalized.match(/^taskkill\s+(?:\/[a-zA-Z]+\s+)*\/PID\s+(\d+)/i);
+    if (taskkillMatch?.[1]) {
+      const pidStr = taskkillMatch[1];
+      return {
+        pid: parseInt(pidStr, 10),
+        signal: normalized.includes("/F") ? "FORCE" : "TERM",
+        isGroupKill: false,
+        isAllKill: false,
+        originalCommand: command
+      };
+    }
+    const tskillMatch = normalized.match(/^tskill\s+(\d+)/i);
+    if (tskillMatch?.[1]) {
+      const pidStr = tskillMatch[1];
+      return {
+        pid: parseInt(pidStr, 10),
+        signal: "TERM",
+        isGroupKill: false,
+        isAllKill: false,
+        originalCommand: command
+      };
+    }
+    return null;
+  }
   const simpleMatch = normalized.match(/^kill\s+(?:(-[a-zA-Z]+)\s+)?(\d+|-?\d+)$/);
   if (simpleMatch) {
     const signal = simpleMatch[1] ?? "-TERM";
@@ -1177,28 +1244,6 @@ function parseKillCommand(command) {
   if (pgrepMatch) {
     return null;
   }
-  const taskkillMatch = normalized.match(/^taskkill\s+(?:\/[a-zA-Z]+\s+)*\/PID\s+(\d+)/i);
-  if (taskkillMatch?.[1]) {
-    const pidStr = taskkillMatch[1];
-    return {
-      pid: parseInt(pidStr, 10),
-      signal: normalized.includes("/F") ? "FORCE" : "TERM",
-      isGroupKill: false,
-      isAllKill: false,
-      originalCommand: command
-    };
-  }
-  const tskillMatch = normalized.match(/^tskill\s+(\d+)/i);
-  if (tskillMatch?.[1]) {
-    const pidStr = tskillMatch[1];
-    return {
-      pid: parseInt(pidStr, 10),
-      signal: "TERM",
-      isGroupKill: false,
-      isAllKill: false,
-      originalCommand: command
-    };
-  }
   return null;
 }
 async function getProtectedEntries() {
@@ -1275,7 +1320,7 @@ async function checkAndBlockKillCommand(command) {
   }
   return { blocked: false };
 }
-function pickShell(platform3, command, env) {
+function pickShell(platform4, command, env) {
   const override = env.get("WRONGSTACK_SHELL")?.trim().toLowerCase();
   if (override === "cmd" || override === "cmd.exe") return "cmd";
   if (override === "powershell" || override === "powershell.exe") return "powershell";
@@ -1329,7 +1374,7 @@ function looksLikePowerShellExtended(command) {
 }
 function wrapPowerShellScript(command) {
   const bootstrap = "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8;$ConfirmPreference='None';$WhatIfPreference=$false";
-  return "\uFEFF" + bootstrap + "\ntry {\n" + command + "\n} finally { exit $LASTEXITCODE }";
+  return bootstrap + "\n$ErrorActionPreference='Stop'\n" + command + "\nif ($LASTEXITCODE -is [int]) { exit $LASTEXITCODE }";
 }
 var PS_VERB_RE = new RegExp(
   // Boundaries: start-of-string, whitespace, `;`, `&`, `|`, `(`, `{`, `,`.
@@ -1509,10 +1554,10 @@ var bashTool = {
       }));
     }
     const timeoutMs = Math.max(1, Math.min(input.timeout_ms ?? DEFAULT_TIMEOUT_MS, 6e5));
-    const isWin = os2.platform() === "win32";
+    const isWin2 = os2.platform() === "win32";
     let plan;
     let winShellKind;
-    if (isWin) {
+    if (isWin2) {
       const shell2 = pickShell("win32", input.command, {
         get: (k) => process.env[k]
       });
@@ -1541,7 +1586,7 @@ var bashTool = {
     const shell = plan.bin;
     const args = plan.useStdin ? [...plan.argv] : [...plan.argv, input.command];
     const env = buildChildEnv(ctx.session?.id);
-    const detached = !isWin;
+    const detached = !isWin2;
     const startedAt = Date.now();
     if (input.background) {
       let buf2 = "";
@@ -1559,7 +1604,7 @@ var bashTool = {
         // apply: the child gets a hidden console that grandchildren inherit.
         // Windows children survive parent exit either way. POSIX keeps
         // detached for the process-group kill semantics.
-        detached: !isWin,
+        detached: !isWin2,
         windowsHide: true
       });
       if (plan.useStdin) {
@@ -1577,7 +1622,8 @@ var bashTool = {
           command: redactCommand(input.command),
           startedAt: Date.now(),
           sessionId: ctx.session?.id,
-          child: child2
+          child: child2,
+          processGroupLeader: detached && child2.pid === pid2
         });
         child2.on("close", () => registry.unregister(pid2));
       }
@@ -1618,6 +1664,14 @@ var bashTool = {
           pid: pid2
         }
       };
+      ctx.recordSideEffect?.({
+        toolUseId: `bash-bg-${Date.now()}`,
+        toolName: "bash",
+        ts: (/* @__PURE__ */ new Date()).toISOString(),
+        input: { command: redactCommand(input.command), background: true },
+        outcome: `launched (pid ${pid2 ?? "unknown"})`,
+        risk: "shell"
+      });
       return;
     }
     const child = spawn(shell, args, {
@@ -1628,7 +1682,7 @@ var bashTool = {
       stdio: [plan.useStdin ? "pipe" : "ignore", "pipe", "pipe"],
       detached,
       windowsHide: true,
-      ...isWin ? {} : { signal: opts.signal }
+      ...isWin2 ? {} : { signal: opts.signal }
     });
     if (plan.useStdin) {
       try {
@@ -1645,7 +1699,8 @@ var bashTool = {
         command: redactCommand(input.command),
         startedAt: Date.now(),
         sessionId: ctx.session?.id,
-        child
+        child,
+        processGroupLeader: detached && child.pid === pid
       });
     }
     let buf = "";
@@ -1654,7 +1709,7 @@ var bashTool = {
     const timers = [];
     const spool = createOutputSpool({ tool: "bash", thresholdBytes: MAX_OUTPUT });
     function killWithTimeout(child2, timeoutMs2) {
-      if (isWin) {
+      if (isWin2) {
         if (typeof child2.pid === "number" && child2.exitCode === null && killWin32Tree(child2.pid)) {
           const fallback = setTimeout(() => {
             if (child2.exitCode === null) {
@@ -1674,34 +1729,22 @@ var bashTool = {
         }
         return;
       }
-      try {
-        if (typeof child2.pid === "number") {
-          try {
-            process.kill(-child2.pid, "SIGTERM");
-          } catch {
-            child2.kill("SIGTERM");
-          }
-        } else {
+      if (typeof child2.pid === "number") {
+        registry.kill(child2.pid, { graceMs: timeoutMs2 });
+      } else {
+        try {
           child2.kill("SIGTERM");
+        } catch {
         }
-      } catch {
-      }
-      const killTimer = setTimeout(() => {
-        try {
-          if (typeof child2.pid === "number") {
-            try {
-              process.kill(-child2.pid, "SIGKILL");
-            } catch {
-              child2.kill("SIGKILL");
-            }
-          } else {
+        const killTimer = setTimeout(() => {
+          try {
             child2.kill("SIGKILL");
+          } catch {
           }
-        } catch {
-        }
-      }, timeoutMs2);
-      timers.push(killTimer);
-      killTimer.unref?.();
+        }, timeoutMs2);
+        timers.push(killTimer);
+        killTimer.unref?.();
+      }
     }
     const timer = setTimeout(() => {
       timedOut = true;
@@ -1710,7 +1753,7 @@ var bashTool = {
     timers.push(timer);
     timer.unref?.();
     const onAbort = () => killWithTimeout(child, 2e3);
-    if (isWin) {
+    if (isWin2) {
       if (opts.signal.aborted) onAbort();
       else opts.signal.addEventListener("abort", onAbort, { once: true });
     }
@@ -1798,6 +1841,14 @@ ${hint}` : ""),
               timed_out: timedOut
             }
           };
+          ctx.recordSideEffect?.({
+            toolUseId: `bash-${Date.now()}`,
+            toolName: "bash",
+            ts: (/* @__PURE__ */ new Date()).toISOString(),
+            input: { command: redactCommand(input.command) },
+            outcome: timedOut ? `timed out (exit ${c.code})` : `exit ${c.code}`,
+            risk: "shell"
+          });
           return;
         }
         const now = Date.now();
@@ -1809,7 +1860,7 @@ ${hint}` : ""),
     } finally {
       for (const t of timers) clearTimeout(t);
       spool.finalize();
-      if (isWin) opts.signal.removeEventListener("abort", onAbort);
+      if (isWin2) opts.signal.removeEventListener("abort", onAbort);
       child.stdout?.off("data", onData);
       child.stderr?.off("data", onData);
       child.stdout?.destroy();
@@ -1819,6 +1870,38 @@ ${hint}` : ""),
         else killWithTimeout(child, 2e3);
       }
     }
+  },
+  /**
+   * Tool-level teardown fired by `ToolExecutor.runToolCleanup()` when the
+   * tool's run is aborted/timeout'd. The generator's `finally` block above
+   * already force-kills the direct child, but that only runs if the
+   * executor closes the async iterator (via `iter.return()`). When the
+   * executor tears down without iterating — or a re-entrant abort races
+   * with the generator — a bash-spawned process tree can survive in the
+   * ProcessRegistry with `killed === false`, continuing to write files,
+   * consume CPU, or hold inherited stdio pipes open for the rest of the
+   * session.
+   *
+   * This is the defensive layer the executor calls via `tool.cleanup()`
+   * (see `types/tool.ts`): kill every bash-owned process still tracked
+   * for this session that hasn't exited yet. `registry.kill()` already
+   * handles process-group / taskkill tree-kill and the SIGTERM→SIGKILL
+   * grace window, so this just scopes the registry's existing kill path
+   * to "this session's runaway bash children". Idempotent — a process
+   * that already exited is skipped by `kill()` (it returns false), and a
+   * `protected` infrastructure process (dev server the user intentionally
+   * backgrounded) is left alone by design.
+   */
+  async cleanup(_input, ctx) {
+    const registry = getProcessRegistry();
+    const sessionId = ctx.session?.id;
+    if (!sessionId) return;
+    for (const entry of registry.bySession(sessionId)) {
+      if (entry.name !== "bash") continue;
+      if (entry.child.exitCode !== null) continue;
+      if (entry.protected) continue;
+      registry.kill(entry.pid, { force: true });
+    }
   }
 };