@wrongstack/tools 0.277.2 → 0.280.1

package/dist/pack.js

@@ -1753,7 +1753,7 @@ function looksLikePowerShell(command) {
   if (/&\s+\$/.test(trimmed)) return true;
   if (/(^|\s)@\s*\(/.test(trimmed)) return true;
   if (/(^|\s)@\{/.test(trimmed)) return true;
-  if (/(?:^|[\s\[\(\{,;])(?:-eq|-ne|-lt|-gt|-le|-ge|-like|-notlike|-match|-notmatch|-contains|-notcontains|-in|-notin|-and|-or|-not|-band|-bor|-bxor|-replace|-isplit|-csplit|-osplit|-join|-is|-as|-f)(?:$|[\s\]\)\},;])/i.test(trimmed)) {
+  if (/(?:^|[\s[({,;])(?:-eq|-ne|-lt|-gt|-le|-ge|-like|-notlike|-match|-notmatch|-contains|-notcontains|-in|-notin|-and|-or|-not|-band|-bor|-bxor|-replace|-isplit|-csplit|-osplit|-join|-is|-as|-f)(?:$|[\s\])},;])/i.test(trimmed)) {
     return true;
   }
   if (PS_VERB_RE.test(trimmed)) return true;
@@ -1780,7 +1780,7 @@ function looksLikePowerShellExtended(command) {
     return true;
   }
   if (/^\s*<#|#>\s*$/m.test(trimmed)) return true;
-  if (/(?:^|\s)[-/\/](?:AsPlainText|PipelineVariable|pv|FilterHashtable|OutVariable|ov)(?:\s|=|$)/i.test(trimmed)) {
+  if (/(?:^|\s)[-//](?:AsPlainText|PipelineVariable|pv|FilterHashtable|OutVariable|ov)(?:\s|=|$)/i.test(trimmed)) {
     return true;
   }
   return false;
@@ -3713,9 +3713,8 @@ func formatType(t ast.Expr) string {
 }
 `;
 async function syncGoParse(filePath, content, lang) {
-  const tmpDir = path3.join(os2.tmpdir(), "ws-go-parse");
+  const tmpDir = await fs2.mkdtemp(path3.join(os2.tmpdir(), "ws-go-parse-"));
   try {
-    await fs2.mkdir(tmpDir, { recursive: true });
     const scriptPath = path3.join(tmpDir, "parse.go");
     await fs2.writeFile(scriptPath, GO_PARSE_SCRIPT, "utf8");
     const proc = spawn("go", ["run", scriptPath], {
@@ -3759,6 +3758,8 @@ async function syncGoParse(filePath, content, lang) {
     return { file: filePath, lang, symbols, mtimeMs: Date.now() };
   } catch {
     return { file: filePath, lang, symbols: [], mtimeMs: Date.now() };
+  } finally {
+    await fs2.rm(tmpDir, { recursive: true, force: true });
   }
 }
 async function parseSymbols3(opts) {
@@ -6091,6 +6092,294 @@ function findSimilarity(haystack, needle) {
   }
   return line;
 }
+
+// src/_danger-detect.ts
+var argHas = (args, value) => args.includes(value);
+var argMatches = (args, re) => args.some((a) => re.test(a));
+var hasShortFlags = (args, letters) => {
+  const seen = /* @__PURE__ */ new Set();
+  for (const a of args) {
+    if (!a.startsWith("-") || a.startsWith("--")) continue;
+    for (const ch of a.replace(/^-+/, "")) seen.add(ch);
+  }
+  return letters.split("").every((l) => seen.has(l));
+};
+var RULES = [
+  // ----- rm / rmdir: recursive force delete (any path) -----
+  // Note: BLOCKED_ARG_PATTERNS already hard-denies root/home/glob paths,
+  // but `rm -rf ./build` is a normal dev workflow that the user might
+  // want to do intentionally. We downgrade it to 'destructive' so the
+  // confirm prompt can approve.
+  {
+    id: "rm-recursive",
+    level: "destructive",
+    test: (cmd, args) => (cmd === "rm" || cmd === "rmdir") && hasShortFlags(args, "rf"),
+    reason: "recursive force-delete"
+  },
+  // ----- Windows PowerShell Remove-Item: -Recurse -Force -----
+  {
+    id: "powershell-remove-item-recursive-force",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "powershell" && cmd !== "pwsh") return false;
+      const hasRecurse = argMatches(args, /^-(?:R|Recurse|Recurse\s)/);
+      const hasForce = argHas(args, "-Force") || argHas(args, "-F");
+      if (argHas(args, "-WhatIf")) return false;
+      return hasRecurse && hasForce;
+    },
+    reason: "Remove-Item with -Recurse -Force"
+  },
+  // ----- find -exec / -ok / -execdir -----
+  {
+    id: "find-exec",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "find") return false;
+      return args.some(
+        (a) => a === "-exec" || a === "-exec;" || a === "-ok" || a === "-ok;" || a === "-execdir" || a === "-execdir;" || a.startsWith("-exec=") || a.startsWith("-ok=") || a.startsWith("-execdir=")
+      );
+    },
+    reason: "find with -exec/-ok (executes arbitrary command on matches)"
+  },
+  // ----- git --exec= / --upload-pack= / --receive-pack= -----
+  // These run arbitrary commands via the git transport layer.
+  {
+    id: "git-exec",
+    level: "destructive",
+    test: (cmd, args) => cmd === "git" && args.some(
+      (a) => a.startsWith("--exec=") || a.startsWith("--upload-pack=") || a.startsWith("--receive-pack=") || a === "--exec" || a === "--upload-pack" || a === "--receive-pack"
+    ),
+    reason: "git with --exec/--upload-pack/--receive-pack (runs arbitrary code)"
+  },
+  // ----- Windows: format / diskpart / bcdedit -----
+  {
+    id: "win32-format",
+    level: "destructive",
+    test: (cmd) => cmd === "format" || cmd === "format.exe",
+    reason: "format (Windows disk format)"
+  },
+  {
+    id: "win32-diskpart",
+    level: "destructive",
+    test: (cmd) => cmd === "diskpart" || cmd === "diskpart.exe",
+    reason: "diskpart (Windows partition editor)"
+  },
+  {
+    id: "win32-bcdedit",
+    level: "destructive",
+    test: (cmd) => cmd === "bcdedit" || cmd === "bcdedit.exe",
+    reason: "bcdedit (Windows boot config editor)"
+  },
+  // ----- mkfs family -----
+  {
+    id: "mkfs",
+    level: "destructive",
+    test: (cmd) => /^mkfs(\.[a-z0-9]+)?$/.test(cmd) || cmd === "mkswap",
+    reason: "mkfs (filesystem creation \u2014 destroys existing data)"
+  },
+  // ----- dd writing to a block device -----
+  {
+    id: "dd-to-block-device",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "dd") return false;
+      return args.some((a) => /of=\/dev\/(sd|hd|nvme|vd|mmcblk|xvd|loop|disk)/.test(a));
+    },
+    reason: "dd writing to a block device"
+  },
+  // ----- Secure-erase tools -----
+  {
+    id: "shred",
+    level: "destructive",
+    test: (cmd) => cmd === "shred" || cmd === "shred.exe",
+    reason: "shred (secure file delete)"
+  },
+  {
+    id: "wipefs",
+    level: "destructive",
+    test: (cmd) => cmd === "wipefs" || cmd === "wipefs.exe",
+    reason: "wipefs (signature wipe \u2014 destroys filesystem headers)"
+  },
+  {
+    id: "sdelete",
+    level: "destructive",
+    test: (cmd) => cmd === "sdelete" || cmd === "sdelete.exe",
+    reason: "sdelete (Sysinternals secure delete)"
+  },
+  // ----- VCS history rewrite (destructive) -----
+  // `git push --force` / `-f` rewrites remote history. `--force-with-lease`
+  // is the safer variant (checks remote hasn't moved) but still rewrites.
+  {
+    id: "git-push-force",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "git") return false;
+      const pushIdx = args.indexOf("push");
+      if (pushIdx < 0) return false;
+      for (let i = pushIdx + 1; i < args.length; i++) {
+        const a = args[i];
+        if (a === "--force" || a === "-f" || a === "--force-with-lease") return true;
+        if (!a.startsWith("-") && !a.includes("=")) continue;
+        if (a.startsWith("--force")) return true;
+      }
+      return false;
+    },
+    reason: "git push with --force / -f (rewrites remote history)"
+  },
+  // ----- git reset --hard (destructive) -----
+  {
+    id: "git-reset-hard",
+    level: "destructive",
+    test: (cmd, args) => cmd === "git" && args.some((a) => a === "--hard" || a.startsWith("--hard=")),
+    reason: "git reset --hard (discards working tree + index)"
+  },
+  // ----- git clean -f / -fd (destructive) -----
+  {
+    id: "git-clean-force",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "git") return false;
+      const cleanIdx = args.indexOf("clean");
+      if (cleanIdx < 0) return false;
+      return args.slice(cleanIdx + 1).some(
+        (a) => a === "-f" || a === "--force" || a.startsWith("-f") || a.startsWith("--force=")
+      );
+    },
+    reason: "git clean -f (deletes untracked files)"
+  },
+  // ----- package publish (destructive — public, irreversible) -----
+  {
+    id: "npm-publish",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (!["npm", "pnpm", "yarn", "bun", "cargo"].includes(cmd)) return false;
+      return args.includes("publish") || cmd === "cargo" && args.includes("yank");
+    },
+    reason: "publishing to a public package registry (hard to reverse)"
+  },
+  // ----- k8s cluster-wide destructive ops (destructive) -----
+  {
+    id: "kubectl-delete-namespace",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "kubectl") return false;
+      const delIdx = args.indexOf("delete");
+      if (delIdx < 0) return false;
+      const after = args.slice(delIdx + 1);
+      return after[0] === "namespace" || after[0] === "ns";
+    },
+    reason: "kubectl delete namespace (deletes all resources in the namespace)"
+  },
+  {
+    id: "kubectl-drain",
+    level: "destructive",
+    test: (cmd, args) => cmd === "kubectl" && args.includes("drain"),
+    reason: "kubectl drain (evicts pods, marks node unschedulable)"
+  },
+  // ----- inline code evaluation (caution — high false-positive) -----
+  // Common in scripts: `python -c "..."`, `node -e "..."`, `bash -c "..."`.
+  // We tag 'caution' rather than 'destructive' because these are used in
+  // many legitimate one-liners (e.g. `python -c "print(1)"`).
+  {
+    id: "inline-eval",
+    level: "caution",
+    test: (cmd, args) => {
+      if (![
+        "python",
+        "python3",
+        "python2",
+        "node",
+        "bash",
+        "sh",
+        "zsh",
+        "ruby",
+        "perl",
+        "lua"
+      ].includes(cmd)) {
+        return false;
+      }
+      return args.some(
+        (a) => a === "-c" || a === "-e" || a === "--eval" || a === "-eval" || a === "-E"
+      );
+    },
+    reason: "inline script evaluation (-c / -e / --eval)"
+  },
+  // ----- pipe-to-shell (caution — well-known exfil pattern) -----
+  // The classic `curl https://... | sh` download-and-run vector. Detected by
+  // looking for a known fetcher followed by a shell sink. We use a simple
+  // substring scan; false positives are limited because both tokens must
+  // appear in the same argv.
+  {
+    id: "pipe-to-shell",
+    level: "caution",
+    test: (_cmd, args) => {
+      const hasFetcher = args.some(
+        (a) => /^(curl|wget|fetch|httpie|http)$/i.test(a) || a.startsWith("curl") || a.startsWith("wget")
+      );
+      const hasShellSink = args.some(
+        (a) => a === "sh" || a === "bash" || a === "zsh" || a === "fish" || a === "pwsh" || a === "powershell" || a.endsWith("/sh") || a.endsWith("/bash") || a.endsWith("/zsh") || a.endsWith("/pwsh")
+      );
+      return hasFetcher && hasShellSink;
+    },
+    reason: "network fetch piped to a shell (download-and-run pattern)"
+  },
+  // ----- privilege escalation (caution) -----
+  {
+    id: "sudo",
+    level: "caution",
+    test: (cmd) => cmd === "sudo" || cmd === "doas",
+    reason: "privilege escalation (sudo / doas)"
+  },
+  {
+    id: "runas",
+    level: "caution",
+    test: (cmd) => cmd === "runas" || cmd === "runas.exe",
+    reason: "Windows runas (run as different user)"
+  },
+  // ----- world-writable permissions (caution) -----
+  // `chmod 777` is rarely correct. `chmod -R 777` is almost always wrong.
+  // We only flag octal modes; symbolic modes like `chmod o+w` are
+  // left to the operator's discretion.
+  {
+    id: "chmod-world-writable",
+    level: "caution",
+    test: (cmd, args) => {
+      if (cmd !== "chmod") return false;
+      return args.some((a) => /^[0-7]{3,4}$/.test(a) && /7/.test(a));
+    },
+    reason: "chmod with world-writable octal mode (e.g. 777)"
+  }
+];
+function detectDanger(cmd, args, bypass) {
+  const reasons = [];
+  let level = "safe";
+  let matchedRule;
+  for (const rule of RULES) {
+    if (bypass?.has(rule.id)) continue;
+    if (!rule.test(cmd, args)) continue;
+    reasons.push(rule.reason);
+    matchedRule = rule.id;
+    if (levelRank(rule.level) > levelRank(level)) {
+      level = rule.level;
+    }
+  }
+  if (level === "safe") return { level: "safe", reasons: [] };
+  const result = { level, reasons };
+  if (matchedRule !== void 0) result.matchedRule = matchedRule;
+  return result;
+}
+function levelRank(level) {
+  switch (level) {
+    case "safe":
+      return 0;
+    case "caution":
+      return 1;
+    case "destructive":
+      return 2;
+  }
+}
+
+// src/exec.ts
 var isWin3 = process.platform === "win32";
 var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   // JS / TS toolchain
@@ -6698,6 +6987,7 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
 ]);
 var allowedCommands = new Set(DEFAULT_ALLOWED_COMMANDS);
 var normalizeCmd = (c) => c.trim();
+var dangerBypass = /* @__PURE__ */ new Set();
 function isExecCommandAllowed(cmd) {
   return allowedCommands.has(normalizeCmd(cmd));
 }
@@ -6786,6 +7076,7 @@ function validateArgs(cmd, args) {
   }
   return null;
 }
+var SAFE_DANGER = { level: "safe", reasons: [] };
 var execTool = {
   name: "exec",
   category: "Shell",
@@ -6830,7 +7121,8 @@ var execTool = {
         stderr: "Circuit breaker is open \u2014 too many consecutive failures. Use /kill reset to recover.",
         exitCode: 1,
         truncated: false,
-        allowed: false
+        allowed: false,
+        danger: SAFE_DANGER
       };
     }
     const cmd = input.command.trim();
@@ -6842,7 +7134,8 @@ var execTool = {
         stderr: "Empty command",
         exitCode: 1,
         truncated: false,
-        allowed: false
+        allowed: false,
+        danger: SAFE_DANGER
       };
     if (!isExecCommandAllowed(cmd)) {
       return {
@@ -6852,11 +7145,13 @@ var execTool = {
         stderr: `Command "${cmd}" not in allowlist. Add it to your ~/.wrongstack/config.json under "tools": { "exec": { "allow": ["${cmd}"] } }, or use the bash tool for one-off arbitrary commands.`,
         exitCode: 1,
         truncated: false,
-        allowed: false
+        allowed: false,
+        danger: SAFE_DANGER
       };
     }
     const args = (input.args ?? []).slice(0, MAX_ARGS);
     const timeout = Math.max(1, Math.min(input.timeout ?? DEFAULT_TIMEOUT_MS2, DEFAULT_TIMEOUT_MS2));
+    const danger = detectDanger(cmd, args, dangerBypass);
     const argError = validateArgs(cmd, args);
     if (argError) {
       return {
@@ -6866,7 +7161,8 @@ var execTool = {
         stderr: argError,
         exitCode: 1,
         truncated: false,
-        allowed: false
+        allowed: false,
+        danger
       };
     }
     let cwd;
@@ -6880,14 +7176,15 @@ var execTool = {
         stderr: `cwd "${input.cwd ?? ctx.cwd}" resolves outside project root`,
         exitCode: 1,
         truncated: false,
-        allowed: false
+        allowed: false,
+        danger
       };
     }
     const signal = opts.signal;
-    return runCommand(cmd, args, cwd, timeout, signal, ctx.session?.id);
+    return runCommand(cmd, args, cwd, timeout, signal, ctx.session?.id, danger);
   }
 };
-function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
+function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
   return new Promise((resolve7) => {
     let stdout = "";
     let stderr = "";
@@ -6924,7 +7221,8 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
         stderr: `spawn failed: ${toErrorMessage$1(err)}`,
         exitCode: 1,
         truncated: false,
-        allowed: true
+        allowed: true,
+        danger
       });
       return;
     }
@@ -6943,7 +7241,8 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
         stderr: stderrText,
         exitCode: isAbort ? 124 : 1,
         truncated: Buffer.byteLength(stdout, "utf8") > COMMAND_OUTPUT_MAX_BYTES,
-        allowed: true
+        allowed: true,
+        danger
       });
     });
     const registry = getProcessRegistry();
@@ -6991,7 +7290,8 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
         stderr: normalizeCommandOutput(stderr),
         exitCode,
         truncated: Buffer.byteLength(stdout, "utf8") > COMMAND_OUTPUT_MAX_BYTES || Buffer.byteLength(stderr, "utf8") > COMMAND_OUTPUT_MAX_BYTES,
-        allowed: true
+        allowed: true,
+        danger
       });
     });
   });
@@ -8494,7 +8794,6 @@ var jsonTool = {
         return executeTransform(input, ctx);
       case "merge":
         return executeMerge(input);
-      case "parse":
       default:
         return executeParse(input, ctx);
     }