@wrongstack/tools 0.277.1 → 0.280.0

package/dist/exec-Ca3fnpUh.d.ts

@@ -0,0 +1,121 @@
+import { Tool } from '@wrongstack/core';
+
+/**
+ * Heuristic danger detection for `exec` tool commands.
+ *
+ * Layered on top of `BLOCKED_ARG_PATTERNS` (which is a hard-deny list for
+ * clear sandbox escapes) and `bash-kill-guard.ts` (which protects WrongStack
+ * itself from kill). This module assigns a danger level to a command/arg
+ * pair so the caller can decide whether to:
+ *
+ *   - 'safe'        → execute normally
+ *   - 'caution'     → execute and emit a warning line to the tool output
+ *   - 'destructive' → route through the existing confirm flow
+ *                     (`execTool.permission === 'confirm'`) instead of
+ *                     hard-deny, so the user can still proceed if intentional
+ *
+ * Design constraints:
+ *   - Deterministic: no randomness, no I/O, no time. Same input → same output.
+ *   - No LLM calls. Patterns are regex / exact-match.
+ *   - Per-rule `id` so config can override specific rules via
+ *     `tools.exec.danger.bypass`.
+ *   - Reasons are human-readable, joined with "; " for the confirm prompt.
+ *
+ * Caution rules are deliberately permissive — they execute and emit a
+ * warning rather than blocking. The rationale: many of these patterns
+ * (python -c, sudo, curl | bash) are part of legitimate dev workflows,
+ * so a hard deny would block too much. A warning gives the user a
+ * chance to notice "wait, I didn't mean to do that" without forcing
+ * them to add a config override for every script.
+ */
+type DangerLevel = 'safe' | 'caution' | 'destructive';
+interface DangerAssessment {
+    level: DangerLevel;
+    reasons: string[];
+    /** Stable id of the matched rule, for tests and config-override. */
+    matchedRule?: string;
+}
+/**
+ * Evaluate the danger level of a (cmd, args) pair.
+ *
+ * Returns 'safe' if no rule fires, otherwise the highest level among all
+ * matching rules. The 'matchedRule' field is the *last* rule that fired
+ * (stable, since rules are evaluated in declaration order).
+ *
+ * Optional `bypass` argument: a set of rule ids that should be SKIPPED
+ * even if they would otherwise match. Wired from
+ * `config.tools.exec.danger.bypass` (see `ExecDangerConfig` in
+ * `@wrongstack/core/src/types/config.ts`). Unknown ids are silently
+ * ignored — forward-compat: a rule added in a future version can be
+ * referenced before the user upgrades their config schema.
+ *
+ * This function is the single source of truth for danger classification;
+ * it is pure (no side effects) and unit-tested in `danger-detect.test.ts`.
+ */
+declare function detectDanger(cmd: string, args: readonly string[], bypass?: ReadonlySet<string>): DangerAssessment;
+
+/**
+ * Apply the configured exec command policy. Recomputes the effective allowlist
+ * as `DEFAULT ∪ allow − deny`. Call once at boot from
+ * `config.tools.exec.{allow,deny}`. Idempotent (always rebuilt from defaults).
+ *
+ * SECURITY: `allow` must originate from TRUSTED config only — the config loader
+ * strips `tools.exec.allow` from the untrusted in-project repo config before it
+ * reaches here. `deny` is safe from any source (it only narrows).
+ */
+declare function configureExecPolicy(opts?: {
+    allow?: readonly string[] | undefined;
+    deny?: readonly string[] | undefined;
+}): void;
+/** Reset the exec allowlist to the built-in defaults (tests / re-init). */
+declare function resetExecPolicy(): void;
+/**
+ * Apply the configured danger-bypass policy. Each id in `bypass` is
+ * added to the effective skip set; duplicates are fine. Idempotent.
+ *
+ * Call once at boot from `config.tools.exec.danger.bypass`.
+ */
+declare function configureDangerBypass(opts?: {
+    bypass?: readonly string[] | undefined;
+}): void;
+/** Reset the danger-bypass set to empty (tests / re-init). */
+declare function resetDangerBypass(): void;
+/**
+ * Read-only view of the active bypass set. `detectDanger()` takes a
+ * `bypass` argument directly, so consumers should prefer passing this
+ * rather than reading the set and matching themselves.
+ */
+declare function getDangerBypass(): ReadonlySet<string>;
+/** Whether `cmd` is currently in the effective exec allowlist. */
+declare function isExecCommandAllowed(cmd: string): boolean;
+/** Snapshot of the effective allowlist (sorted) — for tests / diagnostics. */
+declare function getExecAllowlist(): string[];
+interface ExecInput {
+    command: string;
+    args?: string[] | undefined;
+    cwd?: string | undefined;
+    timeout?: number | undefined;
+}
+interface ExecOutput {
+    command: string;
+    args: string[];
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+    truncated: boolean;
+    allowed: boolean;
+    /**
+     * Heuristic danger assessment of the (cmd, args) pair. Populated for every
+     * call (not just blocked ones) so the UI/TUI can render a banner when the
+     * level is 'caution' or 'destructive'. See `_danger-detect.ts` for the
+     * rule set.
+     *
+     * Pre-execution error returns (allowlist miss, circuit breaker, etc.)
+     * report `level: 'safe'` because the command never actually ran; the UI
+     * should surface the error separately and not also a danger warning.
+     */
+    danger: DangerAssessment;
+}
+declare const execTool: Tool<ExecInput, ExecOutput>;
+
+export { type DangerAssessment as D, type DangerLevel as a, configureExecPolicy as b, configureDangerBypass as c, detectDanger as d, execTool as e, getExecAllowlist as f, getDangerBypass as g, resetExecPolicy as h, isExecCommandAllowed as i, resetDangerBypass as r };

package/dist/exec.d.ts

@@ -1,39 +1,2 @@
-import { Tool } from '@wrongstack/core';
-
-/**
- * Apply the configured exec command policy. Recomputes the effective allowlist
- * as `DEFAULT ∪ allow − deny`. Call once at boot from
- * `config.tools.exec.{allow,deny}`. Idempotent (always rebuilt from defaults).
- *
- * SECURITY: `allow` must originate from TRUSTED config only — the config loader
- * strips `tools.exec.allow` from the untrusted in-project repo config before it
- * reaches here. `deny` is safe from any source (it only narrows).
- */
-declare function configureExecPolicy(opts?: {
-    allow?: readonly string[] | undefined;
-    deny?: readonly string[] | undefined;
-}): void;
-/** Reset the exec allowlist to the built-in defaults (tests / re-init). */
-declare function resetExecPolicy(): void;
-/** Whether `cmd` is currently in the effective exec allowlist. */
-declare function isExecCommandAllowed(cmd: string): boolean;
-/** Snapshot of the effective allowlist (sorted) — for tests / diagnostics. */
-declare function getExecAllowlist(): string[];
-interface ExecInput {
-    command: string;
-    args?: string[] | undefined;
-    cwd?: string | undefined;
-    timeout?: number | undefined;
-}
-interface ExecOutput {
-    command: string;
-    args: string[];
-    stdout: string;
-    stderr: string;
-    exitCode: number;
-    truncated: boolean;
-    allowed: boolean;
-}
-declare const execTool: Tool<ExecInput, ExecOutput>;
-
-export { configureExecPolicy, execTool, getExecAllowlist, isExecCommandAllowed, resetExecPolicy };
+import '@wrongstack/core';
+export { c as configureDangerBypass, b as configureExecPolicy, e as execTool, g as getDangerBypass, f as getExecAllowlist, i as isExecCommandAllowed, r as resetDangerBypass, h as resetExecPolicy } from './exec-Ca3fnpUh.js';

package/dist/exec.js

@@ -832,6 +832,292 @@ function quoteWin32CmdArg(arg) {
   return `"${arg}"`;
 }
 
+// src/_danger-detect.ts
+var argHas = (args, value) => args.includes(value);
+var argMatches = (args, re) => args.some((a) => re.test(a));
+var hasShortFlags = (args, letters) => {
+  const seen = /* @__PURE__ */ new Set();
+  for (const a of args) {
+    if (!a.startsWith("-") || a.startsWith("--")) continue;
+    for (const ch of a.replace(/^-+/, "")) seen.add(ch);
+  }
+  return letters.split("").every((l) => seen.has(l));
+};
+var RULES = [
+  // ----- rm / rmdir: recursive force delete (any path) -----
+  // Note: BLOCKED_ARG_PATTERNS already hard-denies root/home/glob paths,
+  // but `rm -rf ./build` is a normal dev workflow that the user might
+  // want to do intentionally. We downgrade it to 'destructive' so the
+  // confirm prompt can approve.
+  {
+    id: "rm-recursive",
+    level: "destructive",
+    test: (cmd, args) => (cmd === "rm" || cmd === "rmdir") && hasShortFlags(args, "rf"),
+    reason: "recursive force-delete"
+  },
+  // ----- Windows PowerShell Remove-Item: -Recurse -Force -----
+  {
+    id: "powershell-remove-item-recursive-force",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "powershell" && cmd !== "pwsh") return false;
+      const hasRecurse = argMatches(args, /^-(?:R|Recurse|Recurse\s)/);
+      const hasForce = argHas(args, "-Force") || argHas(args, "-F");
+      if (argHas(args, "-WhatIf")) return false;
+      return hasRecurse && hasForce;
+    },
+    reason: "Remove-Item with -Recurse -Force"
+  },
+  // ----- find -exec / -ok / -execdir -----
+  {
+    id: "find-exec",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "find") return false;
+      return args.some(
+        (a) => a === "-exec" || a === "-exec;" || a === "-ok" || a === "-ok;" || a === "-execdir" || a === "-execdir;" || a.startsWith("-exec=") || a.startsWith("-ok=") || a.startsWith("-execdir=")
+      );
+    },
+    reason: "find with -exec/-ok (executes arbitrary command on matches)"
+  },
+  // ----- git --exec= / --upload-pack= / --receive-pack= -----
+  // These run arbitrary commands via the git transport layer.
+  {
+    id: "git-exec",
+    level: "destructive",
+    test: (cmd, args) => cmd === "git" && args.some(
+      (a) => a.startsWith("--exec=") || a.startsWith("--upload-pack=") || a.startsWith("--receive-pack=") || a === "--exec" || a === "--upload-pack" || a === "--receive-pack"
+    ),
+    reason: "git with --exec/--upload-pack/--receive-pack (runs arbitrary code)"
+  },
+  // ----- Windows: format / diskpart / bcdedit -----
+  {
+    id: "win32-format",
+    level: "destructive",
+    test: (cmd) => cmd === "format" || cmd === "format.exe",
+    reason: "format (Windows disk format)"
+  },
+  {
+    id: "win32-diskpart",
+    level: "destructive",
+    test: (cmd) => cmd === "diskpart" || cmd === "diskpart.exe",
+    reason: "diskpart (Windows partition editor)"
+  },
+  {
+    id: "win32-bcdedit",
+    level: "destructive",
+    test: (cmd) => cmd === "bcdedit" || cmd === "bcdedit.exe",
+    reason: "bcdedit (Windows boot config editor)"
+  },
+  // ----- mkfs family -----
+  {
+    id: "mkfs",
+    level: "destructive",
+    test: (cmd) => /^mkfs(\.[a-z0-9]+)?$/.test(cmd) || cmd === "mkswap",
+    reason: "mkfs (filesystem creation \u2014 destroys existing data)"
+  },
+  // ----- dd writing to a block device -----
+  {
+    id: "dd-to-block-device",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "dd") return false;
+      return args.some((a) => /of=\/dev\/(sd|hd|nvme|vd|mmcblk|xvd|loop|disk)/.test(a));
+    },
+    reason: "dd writing to a block device"
+  },
+  // ----- Secure-erase tools -----
+  {
+    id: "shred",
+    level: "destructive",
+    test: (cmd) => cmd === "shred" || cmd === "shred.exe",
+    reason: "shred (secure file delete)"
+  },
+  {
+    id: "wipefs",
+    level: "destructive",
+    test: (cmd) => cmd === "wipefs" || cmd === "wipefs.exe",
+    reason: "wipefs (signature wipe \u2014 destroys filesystem headers)"
+  },
+  {
+    id: "sdelete",
+    level: "destructive",
+    test: (cmd) => cmd === "sdelete" || cmd === "sdelete.exe",
+    reason: "sdelete (Sysinternals secure delete)"
+  },
+  // ----- VCS history rewrite (destructive) -----
+  // `git push --force` / `-f` rewrites remote history. `--force-with-lease`
+  // is the safer variant (checks remote hasn't moved) but still rewrites.
+  {
+    id: "git-push-force",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "git") return false;
+      const pushIdx = args.indexOf("push");
+      if (pushIdx < 0) return false;
+      for (let i = pushIdx + 1; i < args.length; i++) {
+        const a = args[i];
+        if (a === "--force" || a === "-f" || a === "--force-with-lease") return true;
+        if (!a.startsWith("-") && !a.includes("=")) continue;
+        if (a.startsWith("--force")) return true;
+      }
+      return false;
+    },
+    reason: "git push with --force / -f (rewrites remote history)"
+  },
+  // ----- git reset --hard (destructive) -----
+  {
+    id: "git-reset-hard",
+    level: "destructive",
+    test: (cmd, args) => cmd === "git" && args.some((a) => a === "--hard" || a.startsWith("--hard=")),
+    reason: "git reset --hard (discards working tree + index)"
+  },
+  // ----- git clean -f / -fd (destructive) -----
+  {
+    id: "git-clean-force",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "git") return false;
+      const cleanIdx = args.indexOf("clean");
+      if (cleanIdx < 0) return false;
+      return args.slice(cleanIdx + 1).some(
+        (a) => a === "-f" || a === "--force" || a.startsWith("-f") || a.startsWith("--force=")
+      );
+    },
+    reason: "git clean -f (deletes untracked files)"
+  },
+  // ----- package publish (destructive — public, irreversible) -----
+  {
+    id: "npm-publish",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (!["npm", "pnpm", "yarn", "bun", "cargo"].includes(cmd)) return false;
+      return args.includes("publish") || cmd === "cargo" && args.includes("yank");
+    },
+    reason: "publishing to a public package registry (hard to reverse)"
+  },
+  // ----- k8s cluster-wide destructive ops (destructive) -----
+  {
+    id: "kubectl-delete-namespace",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "kubectl") return false;
+      const delIdx = args.indexOf("delete");
+      if (delIdx < 0) return false;
+      const after = args.slice(delIdx + 1);
+      return after[0] === "namespace" || after[0] === "ns";
+    },
+    reason: "kubectl delete namespace (deletes all resources in the namespace)"
+  },
+  {
+    id: "kubectl-drain",
+    level: "destructive",
+    test: (cmd, args) => cmd === "kubectl" && args.includes("drain"),
+    reason: "kubectl drain (evicts pods, marks node unschedulable)"
+  },
+  // ----- inline code evaluation (caution — high false-positive) -----
+  // Common in scripts: `python -c "..."`, `node -e "..."`, `bash -c "..."`.
+  // We tag 'caution' rather than 'destructive' because these are used in
+  // many legitimate one-liners (e.g. `python -c "print(1)"`).
+  {
+    id: "inline-eval",
+    level: "caution",
+    test: (cmd, args) => {
+      if (![
+        "python",
+        "python3",
+        "python2",
+        "node",
+        "bash",
+        "sh",
+        "zsh",
+        "ruby",
+        "perl",
+        "lua"
+      ].includes(cmd)) {
+        return false;
+      }
+      return args.some(
+        (a) => a === "-c" || a === "-e" || a === "--eval" || a === "-eval" || a === "-E"
+      );
+    },
+    reason: "inline script evaluation (-c / -e / --eval)"
+  },
+  // ----- pipe-to-shell (caution — well-known exfil pattern) -----
+  // The classic `curl https://... | sh` download-and-run vector. Detected by
+  // looking for a known fetcher followed by a shell sink. We use a simple
+  // substring scan; false positives are limited because both tokens must
+  // appear in the same argv.
+  {
+    id: "pipe-to-shell",
+    level: "caution",
+    test: (_cmd, args) => {
+      const hasFetcher = args.some(
+        (a) => /^(curl|wget|fetch|httpie|http)$/i.test(a) || a.startsWith("curl") || a.startsWith("wget")
+      );
+      const hasShellSink = args.some(
+        (a) => a === "sh" || a === "bash" || a === "zsh" || a === "fish" || a === "pwsh" || a === "powershell" || a.endsWith("/sh") || a.endsWith("/bash") || a.endsWith("/zsh") || a.endsWith("/pwsh")
+      );
+      return hasFetcher && hasShellSink;
+    },
+    reason: "network fetch piped to a shell (download-and-run pattern)"
+  },
+  // ----- privilege escalation (caution) -----
+  {
+    id: "sudo",
+    level: "caution",
+    test: (cmd) => cmd === "sudo" || cmd === "doas",
+    reason: "privilege escalation (sudo / doas)"
+  },
+  {
+    id: "runas",
+    level: "caution",
+    test: (cmd) => cmd === "runas" || cmd === "runas.exe",
+    reason: "Windows runas (run as different user)"
+  },
+  // ----- world-writable permissions (caution) -----
+  // `chmod 777` is rarely correct. `chmod -R 777` is almost always wrong.
+  // We only flag octal modes; symbolic modes like `chmod o+w` are
+  // left to the operator's discretion.
+  {
+    id: "chmod-world-writable",
+    level: "caution",
+    test: (cmd, args) => {
+      if (cmd !== "chmod") return false;
+      return args.some((a) => /^[0-7]{3,4}$/.test(a) && /7/.test(a));
+    },
+    reason: "chmod with world-writable octal mode (e.g. 777)"
+  }
+];
+function detectDanger(cmd, args, bypass) {
+  const reasons = [];
+  let level = "safe";
+  let matchedRule;
+  for (const rule of RULES) {
+    if (bypass?.has(rule.id)) continue;
+    if (!rule.test(cmd, args)) continue;
+    reasons.push(rule.reason);
+    matchedRule = rule.id;
+    if (levelRank(rule.level) > levelRank(level)) {
+      level = rule.level;
+    }
+  }
+  if (level === "safe") return { level: "safe", reasons: [] };
+  const result = { level, reasons };
+  if (matchedRule !== void 0) result.matchedRule = matchedRule;
+  return result;
+}
+function levelRank(level) {
+  switch (level) {
+    case "safe":
+      return 0;
+    case "caution":
+      return 1;
+    case "destructive":
+      return 2;
+  }
+}
+
 // src/exec.ts
 var isWin = process.platform === "win32";
 var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
@@ -1452,6 +1738,21 @@ function configureExecPolicy(opts = {}) {
 function resetExecPolicy() {
   allowedCommands = new Set(DEFAULT_ALLOWED_COMMANDS);
 }
+var dangerBypass = /* @__PURE__ */ new Set();
+function configureDangerBypass(opts = {}) {
+  const next = /* @__PURE__ */ new Set();
+  for (const id of opts.bypass ?? []) {
+    const trimmed = id.trim();
+    if (trimmed) next.add(trimmed);
+  }
+  dangerBypass = next;
+}
+function resetDangerBypass() {
+  dangerBypass = /* @__PURE__ */ new Set();
+}
+function getDangerBypass() {
+  return dangerBypass;
+}
 function isExecCommandAllowed(cmd) {
   return allowedCommands.has(normalizeCmd(cmd));
 }
@@ -1543,6 +1844,7 @@ function validateArgs(cmd, args) {
   }
   return null;
 }
+var SAFE_DANGER = { level: "safe", reasons: [] };
 var execTool = {
   name: "exec",
   category: "Shell",
@@ -1587,7 +1889,8 @@ var execTool = {
         stderr: "Circuit breaker is open \u2014 too many consecutive failures. Use /kill reset to recover.",
         exitCode: 1,
         truncated: false,
-        allowed: false
+        allowed: false,
+        danger: SAFE_DANGER
       };
     }
     const cmd = input.command.trim();
@@ -1599,7 +1902,8 @@ var execTool = {
         stderr: "Empty command",
         exitCode: 1,
         truncated: false,
-        allowed: false
+        allowed: false,
+        danger: SAFE_DANGER
       };
     if (!isExecCommandAllowed(cmd)) {
       return {
@@ -1609,11 +1913,13 @@ var execTool = {
         stderr: `Command "${cmd}" not in allowlist. Add it to your ~/.wrongstack/config.json under "tools": { "exec": { "allow": ["${cmd}"] } }, or use the bash tool for one-off arbitrary commands.`,
         exitCode: 1,
         truncated: false,
-        allowed: false
+        allowed: false,
+        danger: SAFE_DANGER
       };
     }
     const args = (input.args ?? []).slice(0, MAX_ARGS);
     const timeout = Math.max(1, Math.min(input.timeout ?? DEFAULT_TIMEOUT_MS, DEFAULT_TIMEOUT_MS));
+    const danger = detectDanger(cmd, args, dangerBypass);
     const argError = validateArgs(cmd, args);
     if (argError) {
       return {
@@ -1623,7 +1929,8 @@ var execTool = {
         stderr: argError,
         exitCode: 1,
         truncated: false,
-        allowed: false
+        allowed: false,
+        danger
       };
     }
     let cwd;
@@ -1637,14 +1944,15 @@ var execTool = {
         stderr: `cwd "${input.cwd ?? ctx.cwd}" resolves outside project root`,
         exitCode: 1,
         truncated: false,
-        allowed: false
+        allowed: false,
+        danger
       };
     }
     const signal = opts.signal;
-    return runCommand(cmd, args, cwd, timeout, signal, ctx.session?.id);
+    return runCommand(cmd, args, cwd, timeout, signal, ctx.session?.id, danger);
   }
 };
-function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
+function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
   return new Promise((resolve2) => {
     let stdout = "";
     let stderr = "";
@@ -1681,7 +1989,8 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
         stderr: `spawn failed: ${toErrorMessage(err)}`,
         exitCode: 1,
         truncated: false,
-        allowed: true
+        allowed: true,
+        danger
       });
       return;
     }
@@ -1700,7 +2009,8 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
         stderr: stderrText,
         exitCode: isAbort ? 124 : 1,
         truncated: Buffer.byteLength(stdout, "utf8") > COMMAND_OUTPUT_MAX_BYTES,
-        allowed: true
+        allowed: true,
+        danger
       });
     });
     const registry = getProcessRegistry();
@@ -1748,12 +2058,13 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
         stderr: normalizeCommandOutput(stderr),
         exitCode,
         truncated: Buffer.byteLength(stdout, "utf8") > COMMAND_OUTPUT_MAX_BYTES || Buffer.byteLength(stderr, "utf8") > COMMAND_OUTPUT_MAX_BYTES,
-        allowed: true
+        allowed: true,
+        danger
       });
     });
   });
 }
 
-export { configureExecPolicy, execTool, getExecAllowlist, isExecCommandAllowed, resetExecPolicy };
+export { configureDangerBypass, configureExecPolicy, execTool, getDangerBypass, getExecAllowlist, isExecCommandAllowed, resetDangerBypass, resetExecPolicy };
 //# sourceMappingURL=exec.js.map
 //# sourceMappingURL=exec.js.map