@wrongstack/tools 0.298.0 → 0.298.2

package/dist/builtin.js

@@ -16042,6 +16042,48 @@ var RULES = [
       return args.some((a) => /^[0-7]{3,4}$/.test(a) && /7/.test(a));
     },
     reason: "chmod with world-writable octal mode (e.g. 777)"
+  },
+  // ----- network recon / offensive scanners (caution) -----
+  // These tools are purpose-built for network reconnaissance and offensive
+  // security. They have legitimate uses in dev (security testing, infra
+  // debugging) but their presence in an agent's command stream is worth a
+  // caution banner so the user can notice an unexpected scan.
+  {
+    id: "network-scanner",
+    level: "caution",
+    test: (cmd) => cmd === "nmap" || cmd === "masscan" || cmd === "zmap" || cmd === "nuclei" || cmd === "hping3" || cmd === "naabu" || cmd === "katana" || cmd === "amass" || cmd === "subfinder" || cmd === "httpx" || cmd === "rustscan" || cmd === "zgrab",
+    reason: "network scanner / offensive reconnaissance tool"
+  },
+  // ----- process termination (caution) -----
+  // kill/killall/pkill terminate processes. The exec kill guard
+  // (exec-kill-guard.ts) hard-blocks attempts on protected WrongStack
+  // processes; this rule adds a caution banner for generic process
+  // termination so the user sees a warning even for non-protected targets.
+  {
+    id: "process-kill",
+    level: "caution",
+    test: (cmd) => cmd === "kill" || cmd === "killall" || cmd === "pkill",
+    reason: "process termination command"
+  },
+  // ----- shell/interpreter launchers (caution) -----
+  // `env bash -c '…'`, `timeout sh`, `nohup perl -e '…'` etc. wrap a child
+  // binary that bypasses the allowlist name-gate entirely (the wrapper
+  // resolves the child from PATH, not from the allowlist). We flag caution
+  // when a known launcher has a shell/interpreter as its target program.
+  {
+    id: "shell-launcher",
+    level: "caution",
+    test: (cmd, args) => {
+      const launchers = ["env", "timeout", "nohup", "nice", "script", "expect", "tmux", "screen", "byobu", "dtach"];
+      if (!launchers.includes(cmd)) return false;
+      const shells = ["sh", "bash", "zsh", "fish", "python", "python3", "perl", "ruby", "node", "pwsh", "powershell", "cmd"];
+      if (cmd === "env") {
+        const prog = args.find((a) => !a.includes("=") && !a.startsWith("-"));
+        return prog !== void 0 && shells.includes(prog);
+      }
+      return args.some((a) => shells.includes(a));
+    },
+    reason: "launcher wrapping a shell/interpreter (bypasses allowlist name-gate)"
   }
 ];
 function detectDanger(cmd, args, bypass) {
@@ -16313,9 +16355,7 @@ async function checkKillTarget(target) {
   return { blocked: false };
 }
 
-// src/exec.ts
-init_process_registry();
-var isWin4 = process.platform === "win32";
+// src/exec-allowlist.ts
 var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   // JS / TS toolchain
   "node",
@@ -16394,7 +16434,11 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "docker",
   "podman",
   "kubectl",
-  // network (read-only intent; destructive ops still blocked by BLOCKED_ARG_PATTERNS)
+  // network fetch tools. Per-arg safety is NOT enforced by BLOCKED_ARG_PATTERNS
+  // (no curl/wget entries) — the real boundary is the per-call `confirm`
+  // permission gate (exec.ts permission:'confirm', subjectKey:'command'),
+  // the `pipe-to-shell` danger rule, and the kill guard. The allowlist is a
+  // guidance layer, not a security boundary on its own.
   "curl",
   "wget",
   // common POSIX file/text utilities
@@ -16447,9 +16491,15 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "powershell.exe",
   "pwsh",
   "pwsh.exe",
-  // [core] Extended default allowlist (added 4b3d18d1 + this commit). All
-  // non-destructive, broadly-used dev binaries. Per-arg safety is still
-  // enforced by BLOCKED_ARG_PATTERNS + bash-kill-guard.ts.
+  // [core] Extended default allowlist (added 4b3d18d1 + this commit). Broadly
+  // used dev binaries — NOT all non-destructive: this section contains
+  // process/system tools (kill, chown, mount, userdel), network scanners
+  // (nmap, masscan, zmap, nuclei), and launchers (env, perl, timeout, tmux).
+  // The real safety boundary for these is the per-call `confirm` permission
+  // gate (exec.ts permission:'confirm', subjectKey:'command' renders the full
+  // invocation) plus the danger rules in _danger-detect.ts. Per-arg hard-deny
+  // is still enforced by BLOCKED_ARG_PATTERNS + bash-kill-guard.ts, but only
+  // for the commands that have entries there (git, find, rm).
   // --- Archives & compression ---
   "7z",
   "7za",
@@ -16621,10 +16671,7 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "git-lfs",
   "tig",
   "lazygit",
-  // --- POSIX text utilities (extended; duplicates of pwd/ls/cat/head/tail/wc/
-  //     grep/find/echo/awk/mkdir/cp/mv/rm/touch from the base list above are
-  //     omitted — the Set is de-duplicated at runtime but a clean literal is
-  //     easier to maintain) ---
+  // --- POSIX text utilities (extended) ---
   "gawk",
   "tr",
   "cut",
@@ -16657,39 +16704,16 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "locate",
   "which",
   "whereis",
-  "type",
-  "hash",
-  "pushd",
-  "popd",
-  "dirs",
-  "history",
-  "fc",
-  "jobs",
-  "bg",
-  "fg",
-  "wait",
-  "ulimit",
-  "umask",
+  // NOTE: shell builtins with no standalone binary (type, hash, pushd,
+  // popd, dirs, history, fc, jobs, bg, fg, wait, ulimit, umask, trap,
+  // exit, return, source, ., alias, unalias, set, unset, export, readonly,
+  // typeset, declare, local, eval, exec) are intentionally excluded —
+  // spawn() would fail with ENOENT on every platform because they only
+  // exist inside a shell process. Use the `bash` tool for builtins.
   "nice",
   "nohup",
   "timeout",
   "time",
-  "trap",
-  "exit",
-  "return",
-  "source",
-  ".",
-  "alias",
-  "unalias",
-  "set",
-  "unset",
-  "export",
-  "readonly",
-  "typeset",
-  "declare",
-  "local",
-  "eval",
-  "exec",
   // --- Process / system inspection ---
   "htop",
   "top",
@@ -16920,6 +16944,10 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "sublert",
   "chaos"
 ]);
+
+// src/exec.ts
+init_process_registry();
+var isWin4 = process.platform === "win32";
 var allowedCommands = new Set(DEFAULT_ALLOWED_COMMANDS);
 var normalizeCmd = (c) => c.trim();
 var dangerBypass = /* @__PURE__ */ new Set();

package/dist/exec-allowlist.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Default allowlist of command NAMES the `exec` tool may run.
+ *
+ * Extracted from exec.ts for auditability. Only the command name is gated
+ * (per-arg safety is the BLOCKED_ARG_PATTERNS denylist in exec.ts + the
+ * per-call `confirm` permission). A prior version mapped each command to an
+ * allowed-args array, but those arrays were never enforced (dead code) — a
+ * plain Set is the honest shape.
+ *
+ * Extend/trim at runtime via `configureExecPolicy()` (wired from
+ * `config.tools.exec.{allow,deny}` at boot). `allow` is trusted-config-only;
+ * see the security note on ExecToolConfig.
+ */
+export declare const DEFAULT_ALLOWED_COMMANDS: ReadonlySet<string>;
+//# sourceMappingURL=exec-allowlist.d.ts.map

package/dist/exec.js

@@ -257,6 +257,48 @@ var RULES = [
       return args.some((a) => /^[0-7]{3,4}$/.test(a) && /7/.test(a));
     },
     reason: "chmod with world-writable octal mode (e.g. 777)"
+  },
+  // ----- network recon / offensive scanners (caution) -----
+  // These tools are purpose-built for network reconnaissance and offensive
+  // security. They have legitimate uses in dev (security testing, infra
+  // debugging) but their presence in an agent's command stream is worth a
+  // caution banner so the user can notice an unexpected scan.
+  {
+    id: "network-scanner",
+    level: "caution",
+    test: (cmd) => cmd === "nmap" || cmd === "masscan" || cmd === "zmap" || cmd === "nuclei" || cmd === "hping3" || cmd === "naabu" || cmd === "katana" || cmd === "amass" || cmd === "subfinder" || cmd === "httpx" || cmd === "rustscan" || cmd === "zgrab",
+    reason: "network scanner / offensive reconnaissance tool"
+  },
+  // ----- process termination (caution) -----
+  // kill/killall/pkill terminate processes. The exec kill guard
+  // (exec-kill-guard.ts) hard-blocks attempts on protected WrongStack
+  // processes; this rule adds a caution banner for generic process
+  // termination so the user sees a warning even for non-protected targets.
+  {
+    id: "process-kill",
+    level: "caution",
+    test: (cmd) => cmd === "kill" || cmd === "killall" || cmd === "pkill",
+    reason: "process termination command"
+  },
+  // ----- shell/interpreter launchers (caution) -----
+  // `env bash -c '…'`, `timeout sh`, `nohup perl -e '…'` etc. wrap a child
+  // binary that bypasses the allowlist name-gate entirely (the wrapper
+  // resolves the child from PATH, not from the allowlist). We flag caution
+  // when a known launcher has a shell/interpreter as its target program.
+  {
+    id: "shell-launcher",
+    level: "caution",
+    test: (cmd, args) => {
+      const launchers = ["env", "timeout", "nohup", "nice", "script", "expect", "tmux", "screen", "byobu", "dtach"];
+      if (!launchers.includes(cmd)) return false;
+      const shells = ["sh", "bash", "zsh", "fish", "python", "python3", "perl", "ruby", "node", "pwsh", "powershell", "cmd"];
+      if (cmd === "env") {
+        const prog = args.find((a) => !a.includes("=") && !a.startsWith("-"));
+        return prog !== void 0 && shells.includes(prog);
+      }
+      return args.some((a) => shells.includes(a));
+    },
+    reason: "launcher wrapping a shell/interpreter (bypasses allowlist name-gate)"
   }
 ];
 function detectDanger(cmd, args, bypass) {
@@ -1922,8 +1964,7 @@ async function checkKillTarget(target) {
   return { blocked: false };
 }
 
-// src/exec.ts
-var isWin2 = process.platform === "win32";
+// src/exec-allowlist.ts
 var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   // JS / TS toolchain
   "node",
@@ -2002,7 +2043,11 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "docker",
   "podman",
   "kubectl",
-  // network (read-only intent; destructive ops still blocked by BLOCKED_ARG_PATTERNS)
+  // network fetch tools. Per-arg safety is NOT enforced by BLOCKED_ARG_PATTERNS
+  // (no curl/wget entries) — the real boundary is the per-call `confirm`
+  // permission gate (exec.ts permission:'confirm', subjectKey:'command'),
+  // the `pipe-to-shell` danger rule, and the kill guard. The allowlist is a
+  // guidance layer, not a security boundary on its own.
   "curl",
   "wget",
   // common POSIX file/text utilities
@@ -2055,9 +2100,15 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "powershell.exe",
   "pwsh",
   "pwsh.exe",
-  // [core] Extended default allowlist (added 4b3d18d1 + this commit). All
-  // non-destructive, broadly-used dev binaries. Per-arg safety is still
-  // enforced by BLOCKED_ARG_PATTERNS + bash-kill-guard.ts.
+  // [core] Extended default allowlist (added 4b3d18d1 + this commit). Broadly
+  // used dev binaries — NOT all non-destructive: this section contains
+  // process/system tools (kill, chown, mount, userdel), network scanners
+  // (nmap, masscan, zmap, nuclei), and launchers (env, perl, timeout, tmux).
+  // The real safety boundary for these is the per-call `confirm` permission
+  // gate (exec.ts permission:'confirm', subjectKey:'command' renders the full
+  // invocation) plus the danger rules in _danger-detect.ts. Per-arg hard-deny
+  // is still enforced by BLOCKED_ARG_PATTERNS + bash-kill-guard.ts, but only
+  // for the commands that have entries there (git, find, rm).
   // --- Archives & compression ---
   "7z",
   "7za",
@@ -2229,10 +2280,7 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "git-lfs",
   "tig",
   "lazygit",
-  // --- POSIX text utilities (extended; duplicates of pwd/ls/cat/head/tail/wc/
-  //     grep/find/echo/awk/mkdir/cp/mv/rm/touch from the base list above are
-  //     omitted — the Set is de-duplicated at runtime but a clean literal is
-  //     easier to maintain) ---
+  // --- POSIX text utilities (extended) ---
   "gawk",
   "tr",
   "cut",
@@ -2265,39 +2313,16 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "locate",
   "which",
   "whereis",
-  "type",
-  "hash",
-  "pushd",
-  "popd",
-  "dirs",
-  "history",
-  "fc",
-  "jobs",
-  "bg",
-  "fg",
-  "wait",
-  "ulimit",
-  "umask",
+  // NOTE: shell builtins with no standalone binary (type, hash, pushd,
+  // popd, dirs, history, fc, jobs, bg, fg, wait, ulimit, umask, trap,
+  // exit, return, source, ., alias, unalias, set, unset, export, readonly,
+  // typeset, declare, local, eval, exec) are intentionally excluded —
+  // spawn() would fail with ENOENT on every platform because they only
+  // exist inside a shell process. Use the `bash` tool for builtins.
   "nice",
   "nohup",
   "timeout",
   "time",
-  "trap",
-  "exit",
-  "return",
-  "source",
-  ".",
-  "alias",
-  "unalias",
-  "set",
-  "unset",
-  "export",
-  "readonly",
-  "typeset",
-  "declare",
-  "local",
-  "eval",
-  "exec",
   // --- Process / system inspection ---
   "htop",
   "top",
@@ -2528,6 +2553,9 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "sublert",
   "chaos"
 ]);
+
+// src/exec.ts
+var isWin2 = process.platform === "win32";
 var allowedCommands = new Set(DEFAULT_ALLOWED_COMMANDS);
 var normalizeCmd = (c) => c.trim();
 function configureExecPolicy(opts = {}) {

package/dist/index.js

@@ -7148,6 +7148,48 @@ var RULES = [
       return args.some((a) => /^[0-7]{3,4}$/.test(a) && /7/.test(a));
     },
     reason: "chmod with world-writable octal mode (e.g. 777)"
+  },
+  // ----- network recon / offensive scanners (caution) -----
+  // These tools are purpose-built for network reconnaissance and offensive
+  // security. They have legitimate uses in dev (security testing, infra
+  // debugging) but their presence in an agent's command stream is worth a
+  // caution banner so the user can notice an unexpected scan.
+  {
+    id: "network-scanner",
+    level: "caution",
+    test: (cmd) => cmd === "nmap" || cmd === "masscan" || cmd === "zmap" || cmd === "nuclei" || cmd === "hping3" || cmd === "naabu" || cmd === "katana" || cmd === "amass" || cmd === "subfinder" || cmd === "httpx" || cmd === "rustscan" || cmd === "zgrab",
+    reason: "network scanner / offensive reconnaissance tool"
+  },
+  // ----- process termination (caution) -----
+  // kill/killall/pkill terminate processes. The exec kill guard
+  // (exec-kill-guard.ts) hard-blocks attempts on protected WrongStack
+  // processes; this rule adds a caution banner for generic process
+  // termination so the user sees a warning even for non-protected targets.
+  {
+    id: "process-kill",
+    level: "caution",
+    test: (cmd) => cmd === "kill" || cmd === "killall" || cmd === "pkill",
+    reason: "process termination command"
+  },
+  // ----- shell/interpreter launchers (caution) -----
+  // `env bash -c '…'`, `timeout sh`, `nohup perl -e '…'` etc. wrap a child
+  // binary that bypasses the allowlist name-gate entirely (the wrapper
+  // resolves the child from PATH, not from the allowlist). We flag caution
+  // when a known launcher has a shell/interpreter as its target program.
+  {
+    id: "shell-launcher",
+    level: "caution",
+    test: (cmd, args) => {
+      const launchers = ["env", "timeout", "nohup", "nice", "script", "expect", "tmux", "screen", "byobu", "dtach"];
+      if (!launchers.includes(cmd)) return false;
+      const shells = ["sh", "bash", "zsh", "fish", "python", "python3", "perl", "ruby", "node", "pwsh", "powershell", "cmd"];
+      if (cmd === "env") {
+        const prog = args.find((a) => !a.includes("=") && !a.startsWith("-"));
+        return prog !== void 0 && shells.includes(prog);
+      }
+      return args.some((a) => shells.includes(a));
+    },
+    reason: "launcher wrapping a shell/interpreter (bypasses allowlist name-gate)"
   }
 ];
 function detectDanger(cmd, args, bypass) {
@@ -16535,9 +16577,7 @@ async function checkKillTarget(target) {
   return { blocked: false };
 }
 
-// src/exec.ts
-init_process_registry();
-var isWin4 = process.platform === "win32";
+// src/exec-allowlist.ts
 var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   // JS / TS toolchain
   "node",
@@ -16616,7 +16656,11 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "docker",
   "podman",
   "kubectl",
-  // network (read-only intent; destructive ops still blocked by BLOCKED_ARG_PATTERNS)
+  // network fetch tools. Per-arg safety is NOT enforced by BLOCKED_ARG_PATTERNS
+  // (no curl/wget entries) — the real boundary is the per-call `confirm`
+  // permission gate (exec.ts permission:'confirm', subjectKey:'command'),
+  // the `pipe-to-shell` danger rule, and the kill guard. The allowlist is a
+  // guidance layer, not a security boundary on its own.
   "curl",
   "wget",
   // common POSIX file/text utilities
@@ -16669,9 +16713,15 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "powershell.exe",
   "pwsh",
   "pwsh.exe",
-  // [core] Extended default allowlist (added 4b3d18d1 + this commit). All
-  // non-destructive, broadly-used dev binaries. Per-arg safety is still
-  // enforced by BLOCKED_ARG_PATTERNS + bash-kill-guard.ts.
+  // [core] Extended default allowlist (added 4b3d18d1 + this commit). Broadly
+  // used dev binaries — NOT all non-destructive: this section contains
+  // process/system tools (kill, chown, mount, userdel), network scanners
+  // (nmap, masscan, zmap, nuclei), and launchers (env, perl, timeout, tmux).
+  // The real safety boundary for these is the per-call `confirm` permission
+  // gate (exec.ts permission:'confirm', subjectKey:'command' renders the full
+  // invocation) plus the danger rules in _danger-detect.ts. Per-arg hard-deny
+  // is still enforced by BLOCKED_ARG_PATTERNS + bash-kill-guard.ts, but only
+  // for the commands that have entries there (git, find, rm).
   // --- Archives & compression ---
   "7z",
   "7za",
@@ -16843,10 +16893,7 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "git-lfs",
   "tig",
   "lazygit",
-  // --- POSIX text utilities (extended; duplicates of pwd/ls/cat/head/tail/wc/
-  //     grep/find/echo/awk/mkdir/cp/mv/rm/touch from the base list above are
-  //     omitted — the Set is de-duplicated at runtime but a clean literal is
-  //     easier to maintain) ---
+  // --- POSIX text utilities (extended) ---
   "gawk",
   "tr",
   "cut",
@@ -16879,39 +16926,16 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "locate",
   "which",
   "whereis",
-  "type",
-  "hash",
-  "pushd",
-  "popd",
-  "dirs",
-  "history",
-  "fc",
-  "jobs",
-  "bg",
-  "fg",
-  "wait",
-  "ulimit",
-  "umask",
+  // NOTE: shell builtins with no standalone binary (type, hash, pushd,
+  // popd, dirs, history, fc, jobs, bg, fg, wait, ulimit, umask, trap,
+  // exit, return, source, ., alias, unalias, set, unset, export, readonly,
+  // typeset, declare, local, eval, exec) are intentionally excluded —
+  // spawn() would fail with ENOENT on every platform because they only
+  // exist inside a shell process. Use the `bash` tool for builtins.
   "nice",
   "nohup",
   "timeout",
   "time",
-  "trap",
-  "exit",
-  "return",
-  "source",
-  ".",
-  "alias",
-  "unalias",
-  "set",
-  "unset",
-  "export",
-  "readonly",
-  "typeset",
-  "declare",
-  "local",
-  "eval",
-  "exec",
   // --- Process / system inspection ---
   "htop",
   "top",
@@ -17142,6 +17166,10 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "sublert",
   "chaos"
 ]);
+
+// src/exec.ts
+init_process_registry();
+var isWin4 = process.platform === "win32";
 var allowedCommands = new Set(DEFAULT_ALLOWED_COMMANDS);
 var normalizeCmd = (c) => c.trim();
 function configureExecPolicy(opts = {}) {

package/dist/pack.js

@@ -16042,6 +16042,48 @@ var RULES = [
       return args.some((a) => /^[0-7]{3,4}$/.test(a) && /7/.test(a));
     },
     reason: "chmod with world-writable octal mode (e.g. 777)"
+  },
+  // ----- network recon / offensive scanners (caution) -----
+  // These tools are purpose-built for network reconnaissance and offensive
+  // security. They have legitimate uses in dev (security testing, infra
+  // debugging) but their presence in an agent's command stream is worth a
+  // caution banner so the user can notice an unexpected scan.
+  {
+    id: "network-scanner",
+    level: "caution",
+    test: (cmd) => cmd === "nmap" || cmd === "masscan" || cmd === "zmap" || cmd === "nuclei" || cmd === "hping3" || cmd === "naabu" || cmd === "katana" || cmd === "amass" || cmd === "subfinder" || cmd === "httpx" || cmd === "rustscan" || cmd === "zgrab",
+    reason: "network scanner / offensive reconnaissance tool"
+  },
+  // ----- process termination (caution) -----
+  // kill/killall/pkill terminate processes. The exec kill guard
+  // (exec-kill-guard.ts) hard-blocks attempts on protected WrongStack
+  // processes; this rule adds a caution banner for generic process
+  // termination so the user sees a warning even for non-protected targets.
+  {
+    id: "process-kill",
+    level: "caution",
+    test: (cmd) => cmd === "kill" || cmd === "killall" || cmd === "pkill",
+    reason: "process termination command"
+  },
+  // ----- shell/interpreter launchers (caution) -----
+  // `env bash -c '…'`, `timeout sh`, `nohup perl -e '…'` etc. wrap a child
+  // binary that bypasses the allowlist name-gate entirely (the wrapper
+  // resolves the child from PATH, not from the allowlist). We flag caution
+  // when a known launcher has a shell/interpreter as its target program.
+  {
+    id: "shell-launcher",
+    level: "caution",
+    test: (cmd, args) => {
+      const launchers = ["env", "timeout", "nohup", "nice", "script", "expect", "tmux", "screen", "byobu", "dtach"];
+      if (!launchers.includes(cmd)) return false;
+      const shells = ["sh", "bash", "zsh", "fish", "python", "python3", "perl", "ruby", "node", "pwsh", "powershell", "cmd"];
+      if (cmd === "env") {
+        const prog = args.find((a) => !a.includes("=") && !a.startsWith("-"));
+        return prog !== void 0 && shells.includes(prog);
+      }
+      return args.some((a) => shells.includes(a));
+    },
+    reason: "launcher wrapping a shell/interpreter (bypasses allowlist name-gate)"
   }
 ];
 function detectDanger(cmd, args, bypass) {
@@ -16313,9 +16355,7 @@ async function checkKillTarget(target) {
   return { blocked: false };
 }
 
-// src/exec.ts
-init_process_registry();
-var isWin4 = process.platform === "win32";
+// src/exec-allowlist.ts
 var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   // JS / TS toolchain
   "node",
@@ -16394,7 +16434,11 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "docker",
   "podman",
   "kubectl",
-  // network (read-only intent; destructive ops still blocked by BLOCKED_ARG_PATTERNS)
+  // network fetch tools. Per-arg safety is NOT enforced by BLOCKED_ARG_PATTERNS
+  // (no curl/wget entries) — the real boundary is the per-call `confirm`
+  // permission gate (exec.ts permission:'confirm', subjectKey:'command'),
+  // the `pipe-to-shell` danger rule, and the kill guard. The allowlist is a
+  // guidance layer, not a security boundary on its own.
   "curl",
   "wget",
   // common POSIX file/text utilities
@@ -16447,9 +16491,15 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "powershell.exe",
   "pwsh",
   "pwsh.exe",
-  // [core] Extended default allowlist (added 4b3d18d1 + this commit). All
-  // non-destructive, broadly-used dev binaries. Per-arg safety is still
-  // enforced by BLOCKED_ARG_PATTERNS + bash-kill-guard.ts.
+  // [core] Extended default allowlist (added 4b3d18d1 + this commit). Broadly
+  // used dev binaries — NOT all non-destructive: this section contains
+  // process/system tools (kill, chown, mount, userdel), network scanners
+  // (nmap, masscan, zmap, nuclei), and launchers (env, perl, timeout, tmux).
+  // The real safety boundary for these is the per-call `confirm` permission
+  // gate (exec.ts permission:'confirm', subjectKey:'command' renders the full
+  // invocation) plus the danger rules in _danger-detect.ts. Per-arg hard-deny
+  // is still enforced by BLOCKED_ARG_PATTERNS + bash-kill-guard.ts, but only
+  // for the commands that have entries there (git, find, rm).
   // --- Archives & compression ---
   "7z",
   "7za",
@@ -16621,10 +16671,7 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "git-lfs",
   "tig",
   "lazygit",
-  // --- POSIX text utilities (extended; duplicates of pwd/ls/cat/head/tail/wc/
-  //     grep/find/echo/awk/mkdir/cp/mv/rm/touch from the base list above are
-  //     omitted — the Set is de-duplicated at runtime but a clean literal is
-  //     easier to maintain) ---
+  // --- POSIX text utilities (extended) ---
   "gawk",
   "tr",
   "cut",
@@ -16657,39 +16704,16 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "locate",
   "which",
   "whereis",
-  "type",
-  "hash",
-  "pushd",
-  "popd",
-  "dirs",
-  "history",
-  "fc",
-  "jobs",
-  "bg",
-  "fg",
-  "wait",
-  "ulimit",
-  "umask",
+  // NOTE: shell builtins with no standalone binary (type, hash, pushd,
+  // popd, dirs, history, fc, jobs, bg, fg, wait, ulimit, umask, trap,
+  // exit, return, source, ., alias, unalias, set, unset, export, readonly,
+  // typeset, declare, local, eval, exec) are intentionally excluded —
+  // spawn() would fail with ENOENT on every platform because they only
+  // exist inside a shell process. Use the `bash` tool for builtins.
   "nice",
   "nohup",
   "timeout",
   "time",
-  "trap",
-  "exit",
-  "return",
-  "source",
-  ".",
-  "alias",
-  "unalias",
-  "set",
-  "unset",
-  "export",
-  "readonly",
-  "typeset",
-  "declare",
-  "local",
-  "eval",
-  "exec",
   // --- Process / system inspection ---
   "htop",
   "top",
@@ -16920,6 +16944,10 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "sublert",
   "chaos"
 ]);
+
+// src/exec.ts
+init_process_registry();
+var isWin4 = process.platform === "win32";
 var allowedCommands = new Set(DEFAULT_ALLOWED_COMMANDS);
 var normalizeCmd = (c) => c.trim();
 var dangerBypass = /* @__PURE__ */ new Set();

package/dist/tool-tier.js

@@ -16042,6 +16042,48 @@ var RULES = [
       return args.some((a) => /^[0-7]{3,4}$/.test(a) && /7/.test(a));
     },
     reason: "chmod with world-writable octal mode (e.g. 777)"
+  },
+  // ----- network recon / offensive scanners (caution) -----
+  // These tools are purpose-built for network reconnaissance and offensive
+  // security. They have legitimate uses in dev (security testing, infra
+  // debugging) but their presence in an agent's command stream is worth a
+  // caution banner so the user can notice an unexpected scan.
+  {
+    id: "network-scanner",
+    level: "caution",
+    test: (cmd) => cmd === "nmap" || cmd === "masscan" || cmd === "zmap" || cmd === "nuclei" || cmd === "hping3" || cmd === "naabu" || cmd === "katana" || cmd === "amass" || cmd === "subfinder" || cmd === "httpx" || cmd === "rustscan" || cmd === "zgrab",
+    reason: "network scanner / offensive reconnaissance tool"
+  },
+  // ----- process termination (caution) -----
+  // kill/killall/pkill terminate processes. The exec kill guard
+  // (exec-kill-guard.ts) hard-blocks attempts on protected WrongStack
+  // processes; this rule adds a caution banner for generic process
+  // termination so the user sees a warning even for non-protected targets.
+  {
+    id: "process-kill",
+    level: "caution",
+    test: (cmd) => cmd === "kill" || cmd === "killall" || cmd === "pkill",
+    reason: "process termination command"
+  },
+  // ----- shell/interpreter launchers (caution) -----
+  // `env bash -c '…'`, `timeout sh`, `nohup perl -e '…'` etc. wrap a child
+  // binary that bypasses the allowlist name-gate entirely (the wrapper
+  // resolves the child from PATH, not from the allowlist). We flag caution
+  // when a known launcher has a shell/interpreter as its target program.
+  {
+    id: "shell-launcher",
+    level: "caution",
+    test: (cmd, args) => {
+      const launchers = ["env", "timeout", "nohup", "nice", "script", "expect", "tmux", "screen", "byobu", "dtach"];
+      if (!launchers.includes(cmd)) return false;
+      const shells = ["sh", "bash", "zsh", "fish", "python", "python3", "perl", "ruby", "node", "pwsh", "powershell", "cmd"];
+      if (cmd === "env") {
+        const prog = args.find((a) => !a.includes("=") && !a.startsWith("-"));
+        return prog !== void 0 && shells.includes(prog);
+      }
+      return args.some((a) => shells.includes(a));
+    },
+    reason: "launcher wrapping a shell/interpreter (bypasses allowlist name-gate)"
   }
 ];
 function detectDanger(cmd, args, bypass) {
@@ -16313,9 +16355,7 @@ async function checkKillTarget(target) {
   return { blocked: false };
 }
 
-// src/exec.ts
-init_process_registry();
-var isWin4 = process.platform === "win32";
+// src/exec-allowlist.ts
 var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   // JS / TS toolchain
   "node",
@@ -16394,7 +16434,11 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "docker",
   "podman",
   "kubectl",
-  // network (read-only intent; destructive ops still blocked by BLOCKED_ARG_PATTERNS)
+  // network fetch tools. Per-arg safety is NOT enforced by BLOCKED_ARG_PATTERNS
+  // (no curl/wget entries) — the real boundary is the per-call `confirm`
+  // permission gate (exec.ts permission:'confirm', subjectKey:'command'),
+  // the `pipe-to-shell` danger rule, and the kill guard. The allowlist is a
+  // guidance layer, not a security boundary on its own.
   "curl",
   "wget",
   // common POSIX file/text utilities
@@ -16447,9 +16491,15 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "powershell.exe",
   "pwsh",
   "pwsh.exe",
-  // [core] Extended default allowlist (added 4b3d18d1 + this commit). All
-  // non-destructive, broadly-used dev binaries. Per-arg safety is still
-  // enforced by BLOCKED_ARG_PATTERNS + bash-kill-guard.ts.
+  // [core] Extended default allowlist (added 4b3d18d1 + this commit). Broadly
+  // used dev binaries — NOT all non-destructive: this section contains
+  // process/system tools (kill, chown, mount, userdel), network scanners
+  // (nmap, masscan, zmap, nuclei), and launchers (env, perl, timeout, tmux).
+  // The real safety boundary for these is the per-call `confirm` permission
+  // gate (exec.ts permission:'confirm', subjectKey:'command' renders the full
+  // invocation) plus the danger rules in _danger-detect.ts. Per-arg hard-deny
+  // is still enforced by BLOCKED_ARG_PATTERNS + bash-kill-guard.ts, but only
+  // for the commands that have entries there (git, find, rm).
   // --- Archives & compression ---
   "7z",
   "7za",
@@ -16621,10 +16671,7 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "git-lfs",
   "tig",
   "lazygit",
-  // --- POSIX text utilities (extended; duplicates of pwd/ls/cat/head/tail/wc/
-  //     grep/find/echo/awk/mkdir/cp/mv/rm/touch from the base list above are
-  //     omitted — the Set is de-duplicated at runtime but a clean literal is
-  //     easier to maintain) ---
+  // --- POSIX text utilities (extended) ---
   "gawk",
   "tr",
   "cut",
@@ -16657,39 +16704,16 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "locate",
   "which",
   "whereis",
-  "type",
-  "hash",
-  "pushd",
-  "popd",
-  "dirs",
-  "history",
-  "fc",
-  "jobs",
-  "bg",
-  "fg",
-  "wait",
-  "ulimit",
-  "umask",
+  // NOTE: shell builtins with no standalone binary (type, hash, pushd,
+  // popd, dirs, history, fc, jobs, bg, fg, wait, ulimit, umask, trap,
+  // exit, return, source, ., alias, unalias, set, unset, export, readonly,
+  // typeset, declare, local, eval, exec) are intentionally excluded —
+  // spawn() would fail with ENOENT on every platform because they only
+  // exist inside a shell process. Use the `bash` tool for builtins.
   "nice",
   "nohup",
   "timeout",
   "time",
-  "trap",
-  "exit",
-  "return",
-  "source",
-  ".",
-  "alias",
-  "unalias",
-  "set",
-  "unset",
-  "export",
-  "readonly",
-  "typeset",
-  "declare",
-  "local",
-  "eval",
-  "exec",
   // --- Process / system inspection ---
   "htop",
   "top",
@@ -16920,6 +16944,10 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
   "sublert",
   "chaos"
 ]);
+
+// src/exec.ts
+init_process_registry();
+var isWin4 = process.platform === "win32";
 var allowedCommands = new Set(DEFAULT_ALLOWED_COMMANDS);
 var normalizeCmd = (c) => c.trim();
 var dangerBypass = /* @__PURE__ */ new Set();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/tools",
-  "version": "0.298.0",
+  "version": "0.298.2",
   "license": "MIT",
   "description": "WrongStack built-in tools: read/write/edit, bash/exec, grep/glob, git, fetch, test, lint, and more.",
   "repository": {
@@ -246,15 +246,15 @@
     "!dist/**/*.map"
   ],
   "dependencies": {
-    "@playwright/test": "^1.62.0",
+    "@playwright/test": "^1.62.1",
     "@typescript/typescript6": "^6.0.2",
     "turndown": "^7.2.4",
     "undici": "^8.9.0",
-    "@wrongstack/core": "0.298.0",
-    "@wrongstack/kanban": "0.298.0"
+    "@wrongstack/core": "0.298.2",
+    "@wrongstack/kanban": "0.298.2"
   },
   "devDependencies": {
-    "@types/node": "^26.1.1",
+    "@types/node": "^26.1.2",
     "typescript": "^7.0.2"
   },
   "publishConfig": {