@wrongstack/tools 0.3.3 → 0.3.7

package/dist/bash.js

@@ -64,12 +64,41 @@ var bashTool = {
       signal: opts.signal
     });
     if (input.background) {
-      const pid = child.pid;
-      if (typeof pid === "number") child.unref();
+      let buf2 = "";
+      let truncated = false;
+      const child2 = spawn(shell, args, {
+        cwd: ctx.projectRoot,
+        env,
+        stdio: ["ignore", "pipe", "pipe"],
+        detached: true,
+        signal: opts.signal
+      });
+      const pid = child2.pid;
+      child2.stdout?.on("data", (chunk) => {
+        if (!truncated) {
+          const remain = MAX_OUTPUT - buf2.length;
+          if (remain > 0) {
+            buf2 += chunk.toString().slice(0, remain);
+          }
+          if (buf2.length >= MAX_OUTPUT) truncated = true;
+        }
+      });
+      child2.stderr?.on("data", (chunk) => {
+        if (!truncated) {
+          const remain = MAX_OUTPUT - buf2.length;
+          if (remain > 0) {
+            buf2 += chunk.toString().slice(0, remain);
+          }
+          if (buf2.length >= MAX_OUTPUT) truncated = true;
+        }
+      });
+      child2.on("close", () => {
+      });
+      if (typeof pid === "number") child2.unref();
       yield {
         type: "final",
         output: {
-          output: `[background] pid=${pid ?? "unknown"}`,
+          output: truncated ? buf2.slice(0, MAX_OUTPUT) + "\u2026[truncated]" : buf2,
           exit_code: null,
           timed_out: false,
           pid
@@ -114,6 +143,7 @@ var bashTool = {
             }
           }, 2e3);
           timers.push(killTimer);
+          killTimer.unref?.();
         } catch {
         }
       }

package/dist/bash.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/_util.ts","../src/bash.ts"],"names":["resolve"],"mappings":";;;;;;AAqBO,SAAS,cAAA,CAAe,GAAW,GAAA,EAAqB;AAC7D,EAAA,IAAI,OAAO,UAAA,CAAW,CAAA,EAAG,MAAM,CAAA,IAAK,KAAK,OAAO,CAAA;AAChD,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,CAAC,CAAA;AAC/B,EAAA,OACE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,GACf;AAAA,iBAAA,EAAiB,MAAA,CAAO,UAAA,CAAW,CAAA,EAAG,MAAM,IAAI,GAAG,CAAA;AAAA,CAAA,GACnD,CAAA,CAAE,KAAA,CAAM,CAAC,IAAI,CAAA;AAEjB;;;ACTA,IAAM,UAAA,GAAa,KAAA;AACnB,IAAM,eAAA,GAAkB,GAAA;AAIxB,IAAM,wBAAA,GAA2B,GAAA;AACjC,IAAM,qBAAqB,CAAA,GAAI,IAAA;AAExB,IAAM,QAAA,GAAwC;AAAA,EACnD,IAAA,EAAM,MAAA;AAAA,EACN,QAAA,EAAU,OAAA;AAAA,EACV,WAAA,EAAa,oDAAA;AAAA,EACb,SAAA,EACE,4KAAA;AAAA,EACF,UAAA,EAAY,SAAA;AAAA,EACZ,QAAA,EAAU,IAAA;AAAA;AAAA;AAAA;AAAA,EAIV,UAAA,EAAY,SAAA;AAAA,EACZ,SAAA,EAAW,GAAA;AAAA,EACX,cAAA,EAAgB,UAAA;AAAA,EAChB,mBAAA,EAAqB,GAAA;AAAA,EACrB,WAAA,EAAa;AAAA,IACX,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,OAAA,EAAS,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,MAC1B,UAAA,EAAY,EAAE,IAAA,EAAM,SAAA,EAAU;AAAA,MAC9B,UAAA,EAAY,EAAE,IAAA,EAAM,SAAA;AAAU,KAChC;AAAA,IACA,QAAA,EAAU,CAAC,SAAS;AAAA,GACtB;AAAA,EACA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM;AAC9B,IAAA,IAAI,KAAA;AACJ,IAAA,WAAA,MAAiB,MAAM,QAAA,CAAS,aAAA,CAAe,KAAA,EAAO,GAAA,EAAK,IAAI,CAAA,EAAG;AAChE,MAAA,IAAI,EAAA,CAAG,IAAA,KAAS,OAAA,EAAS,KAAA,GAAQ,EAAA,CAAG,MAAA;AAAA,IACtC;AACA,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,MAAM,wCAAwC,CAAA;AACpE,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AAAA,EACA,OAAO,aAAA,CAAc,KAAA,EAAO,GAAA,EAAK,IAAA,EAAmD;AAClF,IAAA,IAAI,CAAC,KAAA,EAAO,OAAA,EAAS,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAChE,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,IAAI,KAAA,CAAM,UAAA,IAAc,eAAA,EAAiB,GAAO,CAAC,CAAA;AAEpF,IAAA,MAAM,KAAA,GAAW,aAAS,KAAM,OAAA;AAChC,IAAA,MAAM,KAAA,GAAQ,KAAA,GACT,OAAA,CAAQ,GAAA,CAAI,SAAS,KAAK,SAAA,GAC1B,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,IAAK,WAAA;AAC7B,IAAA,MAAM,IAAA,GAAO,KAAA,GAAQ,CAAC,IAAA,EAAM,KAAA,CAAM,OAAO,CAAA,GAAI,CAAC,IAAA,EAAM,KAAA,CAAM,OAAO,CAAA;AAEjE,IAAA,MAAM,GAAA,GAAM,aAAA,CAAc,GAAA,CAAI,OAAA,EAAS,EAAE,CAAA;AAQzC,IAAA,MAAM,QAAA,GAAW,KAAA,GAAQ,CAAC,CAAC,MAAM,UAAA,GAAa,IAAA;AAC9C,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,EAAO,IAAA,EAAM;AAAA,MAC/B,KAAK,GAAA,CAAI,WAAA;AAAA,MACT,GAAA;AAAA,MACA,OAAO,KAAA,CAAM,UAAA,GAAa,WAAW,CAAC,QAAA,EAAU,QAAQ,MAAM,CAAA;AAAA,MAC9D,QAAA;AAAA,MACA,QAAQ,IAAA,CAAK;AAAA,KACd,CAAA;AAED,IAAA,IAAI,MAAM,UAAA,EAAY;AACpB,MAAA,MAAM,MAAM,KAAA,CAAM,GAAA;AAClB,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,KAAA,CAAM,KAAA,EAAM;AACzC,MAAA,MAAM;AAAA,QACJ,IAAA,EAAM,OAAA;AAAA,QACN,MAAA,EAAQ;AAAA,UACN,MAAA,EAAQ,CAAA,iBAAA,EAAoB,GAAA,IAAO,SAAS,CAAA,CAAA;AAAA,UAC5C,SAAA,EAAW,IAAA;AAAA,UACX,SAAA,EAAW,KAAA;AAAA,UACX;AAAA;AACF,OACF;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,GAAA,GAAM,EAAA;AACV,IAAA,IAAI,OAAA,GAAU,EAAA;AACd,IAAA,IAAI,QAAA,GAAW,KAAA;AACf,IAAA,MAAM,SAA2B,EAAC;AAClC,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,MAAA,QAAA,GAAW,IAAA;AACX,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,IAAI;AACF,UAAA,KAAA,CAAM,IAAA,EAAK;AAAA,QACb,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF,CAAA,MAAO;AACL,QAAA,IAAI;AAIF,UAAA,IAAI,OAAO,KAAA,CAAM,GAAA,KAAQ,QAAA,EAAU;AACjC,YAAA,IAAI;AACF,cAAA,OAAA,CAAQ,IAAA,CAAK,CAAC,KAAA,CAAM,GAAA,EAAK,SAAS,CAAA;AAAA,YACpC,CAAA,CAAA,MAAQ;AACN,cAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,YACtB;AAAA,UACF,CAAA,MAAO;AACL,YAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,UACtB;AACA,UAAA,MAAM,SAAA,GAAY,WAAW,MAAM;AACjC,YAAA,IAAI;AACF,cAAA,IAAI,OAAO,KAAA,CAAM,GAAA,KAAQ,QAAA,EAAU;AACjC,gBAAA,IAAI;AACF,kBAAA,OAAA,CAAQ,IAAA,CAAK,CAAC,KAAA,CAAM,GAAA,EAAK,SAAS,CAAA;AAAA,gBACpC,CAAA,CAAA,MAAQ;AACN,kBAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,gBACtB;AAAA,cACF,CAAA,MAAO;AACL,gBAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,cACtB;AAAA,YACF,CAAA,CAAA,MAAQ;AAAA,YAER;AAAA,UACF,GAAG,GAAI,CAAA;AACP,UAAA,MAAA,CAAO,KAAK,SAAS,CAAA;AAAA,QACvB,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF,GAAG,SAAS,CAAA;AACZ,IAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AACjB,IAAA,KAAA,CAAM,KAAA,IAAQ;AASd,IAAA,MAAM,QAAiB,EAAC;AACxB,IAAA,IAAI,WAAA,GAA2C,IAAA;AAC/C,IAAA,MAAM,IAAA,GAAO,CAAC,CAAA,KAAa;AACzB,MAAA,IAAI,WAAA,EAAa;AACf,QAAA,MAAM,CAAA,GAAI,WAAA;AACV,QAAA,WAAA,GAAc,IAAA;AACd,QAAA,CAAA,CAAE,CAAC,CAAA;AAAA,MACL,CAAA,MAAO;AACL,QAAA,KAAA,CAAM,KAAK,CAAC,CAAA;AAAA,MACd;AAAA,IACF,CAAA;AACA,IAAA,MAAM,IAAA,GAAO,MACX,IAAI,OAAA,CAAQ,CAACA,QAAAA,KAAY;AACvB,MAAA,MAAM,CAAA,GAAI,MAAM,KAAA,EAAM;AACtB,MAAA,IAAI,CAAA,EAAGA,QAAAA,CAAQ,CAAC,CAAA;AAAA,WACX,WAAA,GAAcA,QAAAA;AAAA,IACrB,CAAC,CAAA;AAEH,IAAA,IAAI,SAAA,GAAY,KAAK,GAAA,EAAI;AACzB,IAAA,MAAM,QAAQ,MAAM;AAClB,MAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AACjC,MAAA,MAAM,IAAA,GAAO,OAAA;AACb,MAAA,OAAA,GAAU,EAAA;AACV,MAAA,SAAA,GAAY,KAAK,GAAA,EAAI;AACrB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAEA,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAU;AAClC,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,EAAS;AAC5B,MAAA,GAAA,IAAO,IAAA;AACP,MAAA,OAAA,IAAW,IAAA;AACX,MAAA,IAAA,CAAK,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,CAAA;AAAA,IAC7B,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAU;AAClC,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,EAAS;AAC5B,MAAA,GAAA,IAAO,IAAA;AACP,MAAA,OAAA,IAAW,IAAA;AACX,MAAA,IAAA,CAAK,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,CAAA;AAAA,IAC7B,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AACzB,MAAA,KAAA,MAAW,CAAA,IAAK,MAAA,EAAQ,YAAA,CAAa,CAAC,CAAA;AACtC,MAAA,IAAA,CAAK,EAAE,IAAA,EAAM,OAAA,EAAS,GAAA,EAAK,CAAA;AAAA,IAC7B,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,IAAA,KAAS;AAC1B,MAAA,KAAA,MAAW,CAAA,IAAK,MAAA,EAAQ,YAAA,CAAa,CAAC,CAAA;AACtC,MAAA,IAAA,CAAK,EAAE,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,IAC5B,CAAC,CAAA;AAED,IAAA,IAAI;AACF,MAAA,OAAO,IAAA,EAAM;AACX,QAAA,MAAM,CAAA,GAAI,MAAM,IAAA,EAAK;AACrB,QAAA,IAAI,CAAA,CAAE,IAAA,KAAS,OAAA,EAAS,MAAM,CAAA,CAAE,GAAA;AAChC,QAAA,IAAI,CAAA,CAAE,SAAS,KAAA,EAAO;AACpB,UAAA,MAAM,YAAY,KAAA,EAAM;AACxB,UAAA,IAAI,cAAc,IAAA,EAAM;AACtB,YAAA,MAAM,EAAE,IAAA,EAAM,gBAAA,EAAkB,IAAA,EAAM,SAAA,EAAU;AAAA,UAClD;AACA,UAAA,MAAM,UAAU,SAAA,CAAU,GAAG,CAAA,CAAE,OAAA,CAAQ,UAAU,IAAI,CAAA;AACrD,UAAA,MAAM;AAAA,YACJ,IAAA,EAAM,OAAA;AAAA,YACN,MAAA,EAAQ;AAAA,cACN,MAAA,EAAQ,cAAA,CAAe,OAAA,EAAS,UAAU,CAAA;AAAA,cAC1C,WAAW,CAAA,CAAE,IAAA;AAAA,cACb,SAAA,EAAW;AAAA;AACb,WACF;AACA,UAAA;AAAA,QACF;AAIA,QAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,QAAA,IAAI,OAAA,CAAQ,MAAA,IAAU,kBAAA,IAAsB,GAAA,GAAM,aAAa,wBAAA,EAA0B;AACvF,UAAA,MAAM,OAAO,KAAA,EAAM;AACnB,UAAA,IAAI,IAAA,EAAM,MAAM,EAAE,IAAA,EAAM,kBAAkB,IAAA,EAAK;AAAA,QACjD;AAAA,MACF;AAAA,IACF,CAAA,SAAE;AACA,MAAA,KAAA,MAAW,CAAA,IAAK,MAAA,EAAQ,YAAA,CAAa,CAAC,CAAA;AAAA,IACxC;AAAA,EACF;AACF","file":"bash.js","sourcesContent":["import * as path from 'node:path';\nimport type { Context } from '@wrongstack/core';\n\nexport function resolvePath(input: string, ctx: Context): string {\n  return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.cwd, input);\n}\n\nexport function ensureInsideRoot(absPath: string, ctx: Context): string {\n  const root = path.resolve(ctx.projectRoot);\n  const target = path.resolve(absPath);\n  const rel = path.relative(root, target);\n  if (rel.startsWith('..') || path.isAbsolute(rel)) {\n    throw new Error(`Path \"${absPath}\" is outside project root \"${root}\"`);\n  }\n  return target;\n}\n\nexport function safeResolve(input: string, ctx: Context): string {\n  return ensureInsideRoot(resolvePath(input, ctx), ctx);\n}\n\nexport function truncateMiddle(s: string, max: number): string {\n  if (Buffer.byteLength(s, 'utf8') <= max) return s;\n  const half = Math.floor(max / 2);\n  return (\n    s.slice(0, half) +\n    `\\n…[truncated ${Buffer.byteLength(s, 'utf8') - max} bytes from middle]…\\n` +\n    s.slice(-half)\n  );\n}\n\nexport function isBinaryBuffer(buf: Buffer): boolean {\n  const len = Math.min(buf.length, 8192);\n  for (let i = 0; i < len; i++) {\n    if (buf[i] === 0) return true;\n  }\n  return false;\n}\n","import { spawn } from 'node:child_process';\nimport * as os from 'node:os';\nimport type { Tool, ToolStreamEvent } from '@wrongstack/core';\nimport { stripAnsi } from '@wrongstack/core';\nimport { buildChildEnv } from './_env.js';\nimport { truncateMiddle } from './_util.js';\n\ninterface BashInput {\n  command: string;\n  timeout_ms?: number;\n  background?: boolean;\n}\n\ninterface BashOutput {\n  output: string;\n  exit_code: number | null;\n  timed_out: boolean;\n  pid?: number;\n}\n\nconst MAX_OUTPUT = 32_768;\nconst DEFAULT_TIMEOUT = 30_000;\n// Flush partial_output every 200ms or when 4 KiB accumulates — whichever\n// comes first. Smaller batches make the TUI feel responsive; larger ones\n// keep EventBus traffic reasonable on chatty processes.\nconst STREAM_FLUSH_INTERVAL_MS = 200;\nconst STREAM_FLUSH_BYTES = 4 * 1024;\n\nexport const bashTool: Tool<BashInput, BashOutput> = {\n  name: 'bash',\n  category: 'Shell',\n  description: 'Run a shell command. stdout and stderr are merged.',\n  usageHint:\n    'Runs via `bash -c` (or `cmd /c` on Windows). Cwd is the project root. Default timeout 30s. Output truncated from the middle if oversized. Use for git, npm, builds, tests.',\n  permission: 'confirm',\n  mutating: true,\n  // Trust rules match on the literal `command` string. Without subjectKey\n  // the policy heuristic would have done the same here, but declaring it\n  // explicitly removes the implicit cross-tool aliasing.\n  subjectKey: 'command',\n  timeoutMs: 30_000,\n  maxOutputBytes: MAX_OUTPUT,\n  estimatedDurationMs: 3_000,\n  inputSchema: {\n    type: 'object',\n    properties: {\n      command: { type: 'string' },\n      timeout_ms: { type: 'integer' },\n      background: { type: 'boolean' },\n    },\n    required: ['command'],\n  },\n  async execute(input, ctx, opts) {\n    let final: BashOutput | undefined;\n    for await (const ev of bashTool.executeStream!(input, ctx, opts)) {\n      if (ev.type === 'final') final = ev.output;\n    }\n    if (!final) throw new Error('bash: stream ended without final event');\n    return final;\n  },\n  async *executeStream(input, ctx, opts): AsyncGenerator<ToolStreamEvent<BashOutput>> {\n    if (!input?.command) throw new Error('bash: command is required');\n    const timeoutMs = Math.max(1, Math.min(input.timeout_ms ?? DEFAULT_TIMEOUT, 600_000));\n\n    const isWin = os.platform() === 'win32';\n    const shell = isWin\n      ? (process.env['COMSPEC'] ?? 'cmd.exe')\n      : (process.env['SHELL'] ?? '/bin/bash');\n    const args = isWin ? ['/c', input.command] : ['-c', input.command];\n\n    const env = buildChildEnv(ctx.session?.id);\n\n    // On POSIX we put the shell in its own process group so that timeout /\n    // abort can kill the entire group with `process.kill(-pid)`. Otherwise\n    // `bash -c \"sleep 9999 & disown\"` would leave the grandchild running.\n    // `detached: true` is also reused for the user-facing background mode;\n    // we always want detached on POSIX, only on Windows is it tied to the\n    // explicit background flag.\n    const detached = isWin ? !!input.background : true;\n    const child = spawn(shell, args, {\n      cwd: ctx.projectRoot,\n      env,\n      stdio: input.background ? 'ignore' : ['ignore', 'pipe', 'pipe'],\n      detached,\n      signal: opts.signal,\n    });\n\n    if (input.background) {\n      const pid = child.pid;\n      if (typeof pid === 'number') child.unref();\n      yield {\n        type: 'final',\n        output: {\n          output: `[background] pid=${pid ?? 'unknown'}`,\n          exit_code: null,\n          timed_out: false,\n          pid,\n        },\n      };\n      return;\n    }\n\n    let buf = '';\n    let pending = '';\n    let timedOut = false;\n    const timers: NodeJS.Timeout[] = [];\n    const timer = setTimeout(() => {\n      timedOut = true;\n      if (isWin) {\n        try {\n          child.kill();\n        } catch {\n          /* ignore */\n        }\n      } else {\n        try {\n          // Kill the process group, not just the shell — pid is positive,\n          // group id is the negated pid. Without this a runaway grandchild\n          // ('sleep 9999 & disown') survives bash termination.\n          if (typeof child.pid === 'number') {\n            try {\n              process.kill(-child.pid, 'SIGTERM');\n            } catch {\n              child.kill('SIGTERM');\n            }\n          } else {\n            child.kill('SIGTERM');\n          }\n          const killTimer = setTimeout(() => {\n            try {\n              if (typeof child.pid === 'number') {\n                try {\n                  process.kill(-child.pid, 'SIGKILL');\n                } catch {\n                  child.kill('SIGKILL');\n                }\n              } else {\n                child.kill('SIGKILL');\n              }\n            } catch {\n              /* ignore */\n            }\n          }, 2000);\n          timers.push(killTimer);\n        } catch {\n          /* ignore */\n        }\n      }\n    }, timeoutMs);\n    timers.push(timer);\n    timer.unref?.();\n\n    // Bridge the EventEmitter-style child to an async iterator. We push\n    // chunks into a queue and let the generator pull them; this lets us\n    // yield 'partial_output' events to the executor at flush boundaries.\n    type Chunk =\n      | { kind: 'data'; text: string }\n      | { kind: 'end'; code: number | null }\n      | { kind: 'error'; err: Error };\n    const queue: Chunk[] = [];\n    let resolveNext: ((c: Chunk) => void) | null = null;\n    const push = (c: Chunk) => {\n      if (resolveNext) {\n        const r = resolveNext;\n        resolveNext = null;\n        r(c);\n      } else {\n        queue.push(c);\n      }\n    };\n    const next = (): Promise<Chunk> =>\n      new Promise((resolve) => {\n        const c = queue.shift();\n        if (c) resolve(c);\n        else resolveNext = resolve;\n      });\n\n    let lastFlush = Date.now();\n    const flush = () => {\n      if (pending.length === 0) return null;\n      const text = pending;\n      pending = '';\n      lastFlush = Date.now();\n      return text;\n    };\n\n    child.stdout?.on('data', (chunk) => {\n      const text = chunk.toString();\n      buf += text;\n      pending += text;\n      push({ kind: 'data', text });\n    });\n    child.stderr?.on('data', (chunk) => {\n      const text = chunk.toString();\n      buf += text;\n      pending += text;\n      push({ kind: 'data', text });\n    });\n    child.on('error', (err) => {\n      for (const t of timers) clearTimeout(t);\n      push({ kind: 'error', err });\n    });\n    child.on('close', (code) => {\n      for (const t of timers) clearTimeout(t);\n      push({ kind: 'end', code });\n    });\n\n    try {\n      while (true) {\n        const c = await next();\n        if (c.kind === 'error') throw c.err;\n        if (c.kind === 'end') {\n          const remainder = flush();\n          if (remainder !== null) {\n            yield { type: 'partial_output', text: remainder };\n          }\n          const cleaned = stripAnsi(buf).replace(/\\r\\n?/g, '\\n');\n          yield {\n            type: 'final',\n            output: {\n              output: truncateMiddle(cleaned, MAX_OUTPUT),\n              exit_code: c.code,\n              timed_out: timedOut,\n            },\n          };\n          return;\n        }\n        // Decide whether to flush. Time-based OR size-based to keep latency\n        // low for slow-emitting commands without overwhelming the TUI for\n        // chatty ones.\n        const now = Date.now();\n        if (pending.length >= STREAM_FLUSH_BYTES || now - lastFlush >= STREAM_FLUSH_INTERVAL_MS) {\n          const text = flush();\n          if (text) yield { type: 'partial_output', text };\n        }\n      }\n    } finally {\n      for (const t of timers) clearTimeout(t);\n    }\n  },\n};\n\n// Re-export types so consumers can narrow on stream events.\nexport type { BashInput, BashOutput };\n"]}
+{"version":3,"sources":["../src/_util.ts","../src/bash.ts"],"names":["buf","child","resolve"],"mappings":";;;;;;AAqBO,SAAS,cAAA,CAAe,GAAW,GAAA,EAAqB;AAC7D,EAAA,IAAI,OAAO,UAAA,CAAW,CAAA,EAAG,MAAM,CAAA,IAAK,KAAK,OAAO,CAAA;AAChD,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,CAAC,CAAA;AAC/B,EAAA,OACE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,GACf;AAAA,iBAAA,EAAiB,MAAA,CAAO,UAAA,CAAW,CAAA,EAAG,MAAM,IAAI,GAAG,CAAA;AAAA,CAAA,GACnD,CAAA,CAAE,KAAA,CAAM,CAAC,IAAI,CAAA;AAEjB;;;ACTA,IAAM,UAAA,GAAa,KAAA;AACnB,IAAM,eAAA,GAAkB,GAAA;AAIxB,IAAM,wBAAA,GAA2B,GAAA;AACjC,IAAM,qBAAqB,CAAA,GAAI,IAAA;AAExB,IAAM,QAAA,GAAwC;AAAA,EACnD,IAAA,EAAM,MAAA;AAAA,EACN,QAAA,EAAU,OAAA;AAAA,EACV,WAAA,EAAa,oDAAA;AAAA,EACb,SAAA,EACE,4KAAA;AAAA,EACF,UAAA,EAAY,SAAA;AAAA,EACZ,QAAA,EAAU,IAAA;AAAA;AAAA;AAAA;AAAA,EAIV,UAAA,EAAY,SAAA;AAAA,EACZ,SAAA,EAAW,GAAA;AAAA,EACX,cAAA,EAAgB,UAAA;AAAA,EAChB,mBAAA,EAAqB,GAAA;AAAA,EACrB,WAAA,EAAa;AAAA,IACX,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,OAAA,EAAS,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,MAC1B,UAAA,EAAY,EAAE,IAAA,EAAM,SAAA,EAAU;AAAA,MAC9B,UAAA,EAAY,EAAE,IAAA,EAAM,SAAA;AAAU,KAChC;AAAA,IACA,QAAA,EAAU,CAAC,SAAS;AAAA,GACtB;AAAA,EACA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM;AAC9B,IAAA,IAAI,KAAA;AACJ,IAAA,WAAA,MAAiB,MAAM,QAAA,CAAS,aAAA,CAAe,KAAA,EAAO,GAAA,EAAK,IAAI,CAAA,EAAG;AAChE,MAAA,IAAI,EAAA,CAAG,IAAA,KAAS,OAAA,EAAS,KAAA,GAAQ,EAAA,CAAG,MAAA;AAAA,IACtC;AACA,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,MAAM,wCAAwC,CAAA;AACpE,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AAAA,EACA,OAAO,aAAA,CAAc,KAAA,EAAO,GAAA,EAAK,IAAA,EAAmD;AAClF,IAAA,IAAI,CAAC,KAAA,EAAO,OAAA,EAAS,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAChE,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,IAAI,KAAA,CAAM,UAAA,IAAc,eAAA,EAAiB,GAAO,CAAC,CAAA;AAEpF,IAAA,MAAM,KAAA,GAAW,aAAS,KAAM,OAAA;AAChC,IAAA,MAAM,KAAA,GAAQ,KAAA,GACT,OAAA,CAAQ,GAAA,CAAI,SAAS,KAAK,SAAA,GAC1B,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,IAAK,WAAA;AAC7B,IAAA,MAAM,IAAA,GAAO,KAAA,GAAQ,CAAC,IAAA,EAAM,KAAA,CAAM,OAAO,CAAA,GAAI,CAAC,IAAA,EAAM,KAAA,CAAM,OAAO,CAAA;AAEjE,IAAA,MAAM,GAAA,GAAM,aAAA,CAAc,GAAA,CAAI,OAAA,EAAS,EAAE,CAAA;AAQzC,IAAA,MAAM,QAAA,GAAW,KAAA,GAAQ,CAAC,CAAC,MAAM,UAAA,GAAa,IAAA;AAC9C,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,EAAO,IAAA,EAAM;AAAA,MAC/B,KAAK,GAAA,CAAI,WAAA;AAAA,MACT,GAAA;AAAA,MACA,OAAO,KAAA,CAAM,UAAA,GAAa,WAAW,CAAC,QAAA,EAAU,QAAQ,MAAM,CAAA;AAAA,MAC9D,QAAA;AAAA,MACA,QAAQ,IAAA,CAAK;AAAA,KACd,CAAA;AAED,IAAA,IAAI,MAAM,UAAA,EAAY;AAGpB,MAAA,IAAIA,IAAAA,GAAM,EAAA;AACV,MAAA,IAAI,SAAA,GAAY,KAAA;AAChB,MAAA,MAAMC,MAAAA,GAAQ,KAAA,CAAM,KAAA,EAAO,IAAA,EAAM;AAAA,QAC/B,KAAK,GAAA,CAAI,WAAA;AAAA,QACT,GAAA;AAAA,QACA,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM,CAAA;AAAA,QAChC,QAAA,EAAU,IAAA;AAAA,QACV,QAAQ,IAAA,CAAK;AAAA,OACd,CAAA;AACD,MAAA,MAAM,MAAMA,MAAAA,CAAM,GAAA;AAClB,MAAAA,MAAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAC1C,QAAA,IAAI,CAAC,SAAA,EAAW;AACd,UAAA,MAAM,MAAA,GAAS,aAAaD,IAAAA,CAAI,MAAA;AAChC,UAAA,IAAI,SAAS,CAAA,EAAG;AACd,YAAAA,QAAO,KAAA,CAAM,QAAA,EAAS,CAAE,KAAA,CAAM,GAAG,MAAM,CAAA;AAAA,UACzC;AACA,UAAA,IAAIA,IAAAA,CAAI,MAAA,IAAU,UAAA,EAAY,SAAA,GAAY,IAAA;AAAA,QAC5C;AAAA,MACF,CAAC,CAAA;AACD,MAAAC,MAAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAC1C,QAAA,IAAI,CAAC,SAAA,EAAW;AACd,UAAA,MAAM,MAAA,GAAS,aAAaD,IAAAA,CAAI,MAAA;AAChC,UAAA,IAAI,SAAS,CAAA,EAAG;AACd,YAAAA,QAAO,KAAA,CAAM,QAAA,EAAS,CAAE,KAAA,CAAM,GAAG,MAAM,CAAA;AAAA,UACzC;AACA,UAAA,IAAIA,IAAAA,CAAI,MAAA,IAAU,UAAA,EAAY,SAAA,GAAY,IAAA;AAAA,QAC5C;AAAA,MACF,CAAC,CAAA;AACD,MAAAC,MAAAA,CAAM,EAAA,CAAG,OAAA,EAAS,MAAM;AAAA,MAExB,CAAC,CAAA;AACD,MAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAUA,OAAM,KAAA,EAAM;AACzC,MAAA,MAAM;AAAA,QACJ,IAAA,EAAM,OAAA;AAAA,QACN,MAAA,EAAQ;AAAA,UACN,QAAQ,SAAA,GAAYD,IAAAA,CAAI,MAAM,CAAA,EAAG,UAAU,IAAI,mBAAA,GAAiBA,IAAAA;AAAA,UAChE,SAAA,EAAW,IAAA;AAAA,UACX,SAAA,EAAW,KAAA;AAAA,UACX;AAAA;AACF,OACF;AACA,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,GAAA,GAAM,EAAA;AACV,IAAA,IAAI,OAAA,GAAU,EAAA;AACd,IAAA,IAAI,QAAA,GAAW,KAAA;AACf,IAAA,MAAM,SAA2B,EAAC;AAClC,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,MAAA,QAAA,GAAW,IAAA;AACX,MAAA,IAAI,KAAA,EAAO;AACT,QAAA,IAAI;AACF,UAAA,KAAA,CAAM,IAAA,EAAK;AAAA,QACb,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF,CAAA,MAAO;AACL,QAAA,IAAI;AAIF,UAAA,IAAI,OAAO,KAAA,CAAM,GAAA,KAAQ,QAAA,EAAU;AACjC,YAAA,IAAI;AACF,cAAA,OAAA,CAAQ,IAAA,CAAK,CAAC,KAAA,CAAM,GAAA,EAAK,SAAS,CAAA;AAAA,YACpC,CAAA,CAAA,MAAQ;AACN,cAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,YACtB;AAAA,UACF,CAAA,MAAO;AACL,YAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,UACtB;AACA,UAAA,MAAM,SAAA,GAAY,WAAW,MAAM;AACjC,YAAA,IAAI;AACF,cAAA,IAAI,OAAO,KAAA,CAAM,GAAA,KAAQ,QAAA,EAAU;AACjC,gBAAA,IAAI;AACF,kBAAA,OAAA,CAAQ,IAAA,CAAK,CAAC,KAAA,CAAM,GAAA,EAAK,SAAS,CAAA;AAAA,gBACpC,CAAA,CAAA,MAAQ;AACN,kBAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,gBACtB;AAAA,cACF,CAAA,MAAO;AACL,gBAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,cACtB;AAAA,YACF,CAAA,CAAA,MAAQ;AAAA,YAER;AAAA,UACF,GAAG,GAAI,CAAA;AACP,UAAA,MAAA,CAAO,KAAK,SAAS,CAAA;AACrB,UAAA,SAAA,CAAU,KAAA,IAAQ;AAAA,QACpB,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF,GAAG,SAAS,CAAA;AACZ,IAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AACjB,IAAA,KAAA,CAAM,KAAA,IAAQ;AASd,IAAA,MAAM,QAAiB,EAAC;AACxB,IAAA,IAAI,WAAA,GAA2C,IAAA;AAC/C,IAAA,MAAM,IAAA,GAAO,CAAC,CAAA,KAAa;AAKzB,MAAA,IAAI,WAAA,EAAa;AACf,QAAA,MAAM,CAAA,GAAI,WAAA;AACV,QAAA,WAAA,GAAc,IAAA;AACd,QAAA,CAAA,CAAE,CAAC,CAAA;AAAA,MACL,CAAA,MAAO;AACL,QAAA,KAAA,CAAM,KAAK,CAAC,CAAA;AAAA,MACd;AAAA,IACF,CAAA;AACA,IAAA,MAAM,IAAA,GAAO,MACX,IAAI,OAAA,CAAQ,CAACE,QAAAA,KAAY;AACvB,MAAA,MAAM,CAAA,GAAI,MAAM,KAAA,EAAM;AACtB,MAAA,IAAI,CAAA,EAAGA,QAAAA,CAAQ,CAAC,CAAA;AAAA,WACX,WAAA,GAAcA,QAAAA;AAAA,IACrB,CAAC,CAAA;AAEH,IAAA,IAAI,SAAA,GAAY,KAAK,GAAA,EAAI;AACzB,IAAA,MAAM,QAAQ,MAAM;AAClB,MAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AACjC,MAAA,MAAM,IAAA,GAAO,OAAA;AACb,MAAA,OAAA,GAAU,EAAA;AACV,MAAA,SAAA,GAAY,KAAK,GAAA,EAAI;AACrB,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAEA,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAU;AAClC,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,EAAS;AAC5B,MAAA,GAAA,IAAO,IAAA;AACP,MAAA,OAAA,IAAW,IAAA;AACX,MAAA,IAAA,CAAK,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,CAAA;AAAA,IAC7B,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAU;AAClC,MAAA,MAAM,IAAA,GAAO,MAAM,QAAA,EAAS;AAC5B,MAAA,GAAA,IAAO,IAAA;AACP,MAAA,OAAA,IAAW,IAAA;AACX,MAAA,IAAA,CAAK,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,CAAA;AAAA,IAC7B,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AACzB,MAAA,KAAA,MAAW,CAAA,IAAK,MAAA,EAAQ,YAAA,CAAa,CAAC,CAAA;AACtC,MAAA,IAAA,CAAK,EAAE,IAAA,EAAM,OAAA,EAAS,GAAA,EAAK,CAAA;AAAA,IAC7B,CAAC,CAAA;AACD,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,IAAA,KAAS;AAC1B,MAAA,KAAA,MAAW,CAAA,IAAK,MAAA,EAAQ,YAAA,CAAa,CAAC,CAAA;AACtC,MAAA,IAAA,CAAK,EAAE,IAAA,EAAM,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,IAC5B,CAAC,CAAA;AAED,IAAA,IAAI;AACF,MAAA,OAAO,IAAA,EAAM;AACX,QAAA,MAAM,CAAA,GAAI,MAAM,IAAA,EAAK;AACrB,QAAA,IAAI,CAAA,CAAE,IAAA,KAAS,OAAA,EAAS,MAAM,CAAA,CAAE,GAAA;AAChC,QAAA,IAAI,CAAA,CAAE,SAAS,KAAA,EAAO;AACpB,UAAA,MAAM,YAAY,KAAA,EAAM;AACxB,UAAA,IAAI,cAAc,IAAA,EAAM;AACtB,YAAA,MAAM,EAAE,IAAA,EAAM,gBAAA,EAAkB,IAAA,EAAM,SAAA,EAAU;AAAA,UAClD;AACA,UAAA,MAAM,UAAU,SAAA,CAAU,GAAG,CAAA,CAAE,OAAA,CAAQ,UAAU,IAAI,CAAA;AACrD,UAAA,MAAM;AAAA,YACJ,IAAA,EAAM,OAAA;AAAA,YACN,MAAA,EAAQ;AAAA,cACN,MAAA,EAAQ,cAAA,CAAe,OAAA,EAAS,UAAU,CAAA;AAAA,cAC1C,WAAW,CAAA,CAAE,IAAA;AAAA,cACb,SAAA,EAAW;AAAA;AACb,WACF;AACA,UAAA;AAAA,QACF;AAIA,QAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,QAAA,IAAI,OAAA,CAAQ,MAAA,IAAU,kBAAA,IAAsB,GAAA,GAAM,aAAa,wBAAA,EAA0B;AACvF,UAAA,MAAM,OAAO,KAAA,EAAM;AACnB,UAAA,IAAI,IAAA,EAAM,MAAM,EAAE,IAAA,EAAM,kBAAkB,IAAA,EAAK;AAAA,QACjD;AAAA,MACF;AAAA,IACF,CAAA,SAAE;AACA,MAAA,KAAA,MAAW,CAAA,IAAK,MAAA,EAAQ,YAAA,CAAa,CAAC,CAAA;AAAA,IACxC;AAAA,EACF;AACF","file":"bash.js","sourcesContent":["import * as path from 'node:path';\nimport type { Context } from '@wrongstack/core';\n\nexport function resolvePath(input: string, ctx: Context): string {\n  return path.isAbsolute(input) ? path.normalize(input) : path.resolve(ctx.cwd, input);\n}\n\nexport function ensureInsideRoot(absPath: string, ctx: Context): string {\n  const root = path.resolve(ctx.projectRoot);\n  const target = path.resolve(absPath);\n  const rel = path.relative(root, target);\n  if (rel.startsWith('..') || path.isAbsolute(rel)) {\n    throw new Error(`Path \"${absPath}\" is outside project root \"${root}\"`);\n  }\n  return target;\n}\n\nexport function safeResolve(input: string, ctx: Context): string {\n  return ensureInsideRoot(resolvePath(input, ctx), ctx);\n}\n\nexport function truncateMiddle(s: string, max: number): string {\n  if (Buffer.byteLength(s, 'utf8') <= max) return s;\n  const half = Math.floor(max / 2);\n  return (\n    s.slice(0, half) +\n    `\\n…[truncated ${Buffer.byteLength(s, 'utf8') - max} bytes from middle]…\\n` +\n    s.slice(-half)\n  );\n}\n\nexport function isBinaryBuffer(buf: Buffer): boolean {\n  const len = Math.min(buf.length, 8192);\n  for (let i = 0; i < len; i++) {\n    if (buf[i] === 0) return true;\n  }\n  return false;\n}\n","import { spawn } from 'node:child_process';\nimport * as os from 'node:os';\nimport type { Tool, ToolStreamEvent } from '@wrongstack/core';\nimport { stripAnsi } from '@wrongstack/core';\nimport { buildChildEnv } from './_env.js';\nimport { truncateMiddle } from './_util.js';\n\ninterface BashInput {\n  command: string;\n  timeout_ms?: number;\n  background?: boolean;\n}\n\ninterface BashOutput {\n  output: string;\n  exit_code: number | null;\n  timed_out: boolean;\n  pid?: number;\n}\n\nconst MAX_OUTPUT = 32_768;\nconst DEFAULT_TIMEOUT = 30_000;\n// Flush partial_output every 200ms or when 4 KiB accumulates — whichever\n// comes first. Smaller batches make the TUI feel responsive; larger ones\n// keep EventBus traffic reasonable on chatty processes.\nconst STREAM_FLUSH_INTERVAL_MS = 200;\nconst STREAM_FLUSH_BYTES = 4 * 1024;\n\nexport const bashTool: Tool<BashInput, BashOutput> = {\n  name: 'bash',\n  category: 'Shell',\n  description: 'Run a shell command. stdout and stderr are merged.',\n  usageHint:\n    'Runs via `bash -c` (or `cmd /c` on Windows). Cwd is the project root. Default timeout 30s. Output truncated from the middle if oversized. Use for git, npm, builds, tests.',\n  permission: 'confirm',\n  mutating: true,\n  // Trust rules match on the literal `command` string. Without subjectKey\n  // the policy heuristic would have done the same here, but declaring it\n  // explicitly removes the implicit cross-tool aliasing.\n  subjectKey: 'command',\n  timeoutMs: 30_000,\n  maxOutputBytes: MAX_OUTPUT,\n  estimatedDurationMs: 3_000,\n  inputSchema: {\n    type: 'object',\n    properties: {\n      command: { type: 'string' },\n      timeout_ms: { type: 'integer' },\n      background: { type: 'boolean' },\n    },\n    required: ['command'],\n  },\n  async execute(input, ctx, opts) {\n    let final: BashOutput | undefined;\n    for await (const ev of bashTool.executeStream!(input, ctx, opts)) {\n      if (ev.type === 'final') final = ev.output;\n    }\n    if (!final) throw new Error('bash: stream ended without final event');\n    return final;\n  },\n  async *executeStream(input, ctx, opts): AsyncGenerator<ToolStreamEvent<BashOutput>> {\n    if (!input?.command) throw new Error('bash: command is required');\n    const timeoutMs = Math.max(1, Math.min(input.timeout_ms ?? DEFAULT_TIMEOUT, 600_000));\n\n    const isWin = os.platform() === 'win32';\n    const shell = isWin\n      ? (process.env['COMSPEC'] ?? 'cmd.exe')\n      : (process.env['SHELL'] ?? '/bin/bash');\n    const args = isWin ? ['/c', input.command] : ['-c', input.command];\n\n    const env = buildChildEnv(ctx.session?.id);\n\n    // On POSIX we put the shell in its own process group so that timeout /\n    // abort can kill the entire group with `process.kill(-pid)`. Otherwise\n    // `bash -c \"sleep 9999 & disown\"` would leave the grandchild running.\n    // `detached: true` is also reused for the user-facing background mode;\n    // we always want detached on POSIX, only on Windows is it tied to the\n    // explicit background flag.\n    const detached = isWin ? !!input.background : true;\n    const child = spawn(shell, args, {\n      cwd: ctx.projectRoot,\n      env,\n      stdio: input.background ? 'ignore' : ['ignore', 'pipe', 'pipe'],\n      detached,\n      signal: opts.signal,\n    });\n\n    if (input.background) {\n      // Background mode: capture stdout/stderr with bounded buffers so a\n      // malicious command can't write unbounded output. Apply MAX_OUTPUT cap.\n      let buf = '';\n      let truncated = false;\n      const child = spawn(shell, args, {\n        cwd: ctx.projectRoot,\n        env,\n        stdio: ['ignore', 'pipe', 'pipe'],\n        detached: true,\n        signal: opts.signal,\n      });\n      const pid = child.pid;\n      child.stdout?.on('data', (chunk: Buffer) => {\n        if (!truncated) {\n          const remain = MAX_OUTPUT - buf.length;\n          if (remain > 0) {\n            buf += chunk.toString().slice(0, remain);\n          }\n          if (buf.length >= MAX_OUTPUT) truncated = true;\n        }\n      });\n      child.stderr?.on('data', (chunk: Buffer) => {\n        if (!truncated) {\n          const remain = MAX_OUTPUT - buf.length;\n          if (remain > 0) {\n            buf += chunk.toString().slice(0, remain);\n          }\n          if (buf.length >= MAX_OUTPUT) truncated = true;\n        }\n      });\n      child.on('close', () => {\n        /* async generator — nothing to yield after close in background mode */\n      });\n      if (typeof pid === 'number') child.unref();\n      yield {\n        type: 'final',\n        output: {\n          output: truncated ? buf.slice(0, MAX_OUTPUT) + '…[truncated]' : buf,\n          exit_code: null,\n          timed_out: false,\n          pid,\n        },\n      };\n      return;\n    }\n\n    let buf = '';\n    let pending = '';\n    let timedOut = false;\n    const timers: NodeJS.Timeout[] = [];\n    const timer = setTimeout(() => {\n      timedOut = true;\n      if (isWin) {\n        try {\n          child.kill();\n        } catch {\n          /* ignore */\n        }\n      } else {\n        try {\n          // Kill the process group, not just the shell — pid is positive,\n          // group id is the negated pid. Without this a runaway grandchild\n          // ('sleep 9999 & disown') survives bash termination.\n          if (typeof child.pid === 'number') {\n            try {\n              process.kill(-child.pid, 'SIGTERM');\n            } catch {\n              child.kill('SIGTERM');\n            }\n          } else {\n            child.kill('SIGTERM');\n          }\n          const killTimer = setTimeout(() => {\n            try {\n              if (typeof child.pid === 'number') {\n                try {\n                  process.kill(-child.pid, 'SIGKILL');\n                } catch {\n                  child.kill('SIGKILL');\n                }\n              } else {\n                child.kill('SIGKILL');\n              }\n            } catch {\n              /* ignore */\n            }\n          }, 2000);\n          timers.push(killTimer);\n          killTimer.unref?.(); // Don't keep event loop alive on clean exit\n        } catch {\n          /* ignore */\n        }\n      }\n    }, timeoutMs);\n    timers.push(timer);\n    timer.unref?.();\n\n    // Bridge the EventEmitter-style child to an async iterator. We push\n    // chunks into a queue and let the generator pull them; this lets us\n    // yield 'partial_output' events to the executor at flush boundaries.\n    type Chunk =\n      | { kind: 'data'; text: string }\n      | { kind: 'end'; code: number | null }\n      | { kind: 'error'; err: Error };\n    const queue: Chunk[] = [];\n    let resolveNext: ((c: Chunk) => void) | null = null;\n    const push = (c: Chunk) => {\n      // Node.js EventEmitter guarantees no 'data' events fire after 'close',\n      // so resolveNext can only be set when the consumer loop is alive.\n      // Theoretically a custom stream could violate this, but the bash tool\n      // only uses node:child_process streams which follow the contract.\n      if (resolveNext) {\n        const r = resolveNext;\n        resolveNext = null;\n        r(c);\n      } else {\n        queue.push(c);\n      }\n    };\n    const next = (): Promise<Chunk> =>\n      new Promise((resolve) => {\n        const c = queue.shift();\n        if (c) resolve(c);\n        else resolveNext = resolve;\n      });\n\n    let lastFlush = Date.now();\n    const flush = () => {\n      if (pending.length === 0) return null;\n      const text = pending;\n      pending = '';\n      lastFlush = Date.now();\n      return text;\n    };\n\n    child.stdout?.on('data', (chunk) => {\n      const text = chunk.toString();\n      buf += text;\n      pending += text;\n      push({ kind: 'data', text });\n    });\n    child.stderr?.on('data', (chunk) => {\n      const text = chunk.toString();\n      buf += text;\n      pending += text;\n      push({ kind: 'data', text });\n    });\n    child.on('error', (err) => {\n      for (const t of timers) clearTimeout(t);\n      push({ kind: 'error', err });\n    });\n    child.on('close', (code) => {\n      for (const t of timers) clearTimeout(t);\n      push({ kind: 'end', code });\n    });\n\n    try {\n      while (true) {\n        const c = await next();\n        if (c.kind === 'error') throw c.err;\n        if (c.kind === 'end') {\n          const remainder = flush();\n          if (remainder !== null) {\n            yield { type: 'partial_output', text: remainder };\n          }\n          const cleaned = stripAnsi(buf).replace(/\\r\\n?/g, '\\n');\n          yield {\n            type: 'final',\n            output: {\n              output: truncateMiddle(cleaned, MAX_OUTPUT),\n              exit_code: c.code,\n              timed_out: timedOut,\n            },\n          };\n          return;\n        }\n        // Decide whether to flush. Time-based OR size-based to keep latency\n        // low for slow-emitting commands without overwhelming the TUI for\n        // chatty ones.\n        const now = Date.now();\n        if (pending.length >= STREAM_FLUSH_BYTES || now - lastFlush >= STREAM_FLUSH_INTERVAL_MS) {\n          const text = flush();\n          if (text) yield { type: 'partial_output', text };\n        }\n      }\n    } finally {\n      for (const t of timers) clearTimeout(t);\n    }\n  },\n};\n\n// Re-export types so consumers can narrow on stream events.\nexport type { BashInput, BashOutput };\n"]}

package/dist/builtin.js

@@ -61,8 +61,8 @@ async function* spawnStream(opts) {
   let spawnFailed = false;
   for (; ; ) {
     while (queue.length === 0) {
-      await new Promise((resolve4) => {
-        waiter = resolve4;
+      await new Promise((resolve5) => {
+        waiter = resolve5;
       });
     }
     const chunk = queue.shift();
@@ -284,12 +284,41 @@ var bashTool = {
       signal: opts.signal
     });
     if (input.background) {
-      const pid = child.pid;
-      if (typeof pid === "number") child.unref();
+      let buf2 = "";
+      let truncated = false;
+      const child2 = spawn(shell, args, {
+        cwd: ctx.projectRoot,
+        env,
+        stdio: ["ignore", "pipe", "pipe"],
+        detached: true,
+        signal: opts.signal
+      });
+      const pid = child2.pid;
+      child2.stdout?.on("data", (chunk) => {
+        if (!truncated) {
+          const remain = MAX_OUTPUT - buf2.length;
+          if (remain > 0) {
+            buf2 += chunk.toString().slice(0, remain);
+          }
+          if (buf2.length >= MAX_OUTPUT) truncated = true;
+        }
+      });
+      child2.stderr?.on("data", (chunk) => {
+        if (!truncated) {
+          const remain = MAX_OUTPUT - buf2.length;
+          if (remain > 0) {
+            buf2 += chunk.toString().slice(0, remain);
+          }
+          if (buf2.length >= MAX_OUTPUT) truncated = true;
+        }
+      });
+      child2.on("close", () => {
+      });
+      if (typeof pid === "number") child2.unref();
       yield {
         type: "final",
         output: {
-          output: `[background] pid=${pid ?? "unknown"}`,
+          output: truncated ? buf2.slice(0, MAX_OUTPUT) + "\u2026[truncated]" : buf2,
           exit_code: null,
           timed_out: false,
           pid
@@ -334,6 +363,7 @@ var bashTool = {
             }
           }, 2e3);
           timers.push(killTimer);
+          killTimer.unref?.();
         } catch {
         }
       }
@@ -351,10 +381,10 @@ var bashTool = {
         queue.push(c);
       }
     };
-    const next = () => new Promise((resolve4) => {
+    const next = () => new Promise((resolve5) => {
       const c = queue.shift();
-      if (c) resolve4(c);
-      else resolveNext = resolve4;
+      if (c) resolve5(c);
+      else resolveNext = resolve5;
     });
     let lastFlush = Date.now();
     const flush = () => {
@@ -589,7 +619,7 @@ function findGitDir(cwd) {
   return null;
 }
 function runGit(args, cwd, signal) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     let stdout = "";
     let stderr = "";
     const child = spawn("git", args, { cwd, signal, stdio: ["ignore", "pipe", "pipe"] });
@@ -599,8 +629,8 @@ function runGit(args, cwd, signal) {
     child.stderr?.on("data", (c) => {
       stderr += c.toString();
     });
-    child.on("close", (code) => resolve4({ stdout, stderr, exitCode: code ?? 0 }));
-    child.on("error", (e) => resolve4({ stdout: "", stderr: e.message, exitCode: 1 }));
+    child.on("close", (code) => resolve5({ stdout, stderr, exitCode: code ?? 0 }));
+    child.on("error", (e) => resolve5({ stdout: "", stderr: e.message, exitCode: 1 }));
   });
 }
 async function fileDiff(input, ctx, signal) {
@@ -934,7 +964,7 @@ var ALLOWED_COMMANDS = {
   cargo: ["--version", "build", "test", "check"],
   rustc: ["--version"],
   go: ["version", "run", "build", "test"],
-  python: ["--version", "-c"],
+  python: ["--version"],
   pip: ["--version", "install", "list"],
   docker: ["--version", "ps", "images", "build"],
   kubectl: ["version", "get", "describe", "logs"]
@@ -942,6 +972,30 @@ var ALLOWED_COMMANDS = {
 var MAX_ARGS = 20;
 var MAX_OUTPUT2 = 2e5;
 var TIMEOUT_MS = 3e4;
+var BLOCKED_ARG_PATTERNS = {
+  // python -c/--command executes arbitrary code; python -m runs modules
+  python: [/-c$/, /^--command$/, /^-m$/, /^--module$/],
+  // git --exec=<cmd> runs arbitrary commands via upload-pack/receive-pack
+  git: [/^--exec=/, /^--upload-pack=/, /^--receive-pack=/],
+  // node -r/--require preloads arbitrary modules; --eval executes code
+  node: [/^-r$/, /^--require$/, /^-e$/, /^--eval$/, /^--prof-process$/],
+  // go run could execute arbitrary .go files; -ldflags could inject build-time code
+  go: [/^-ldflags$/],
+  // bun --preload is similar to node --require
+  bun: [/^--preload$/]
+};
+function validateArgs(cmd, args) {
+  const blocked = BLOCKED_ARG_PATTERNS[cmd];
+  if (!blocked) return null;
+  for (const arg of args) {
+    for (const pattern of blocked) {
+      if (pattern.test(arg)) {
+        return `Blocked argument "${arg}" for command "${cmd}" (matches security pattern ${pattern})`;
+      }
+    }
+  }
+  return null;
+}
 var execTool = {
   name: "exec",
   category: "Shell",
@@ -985,6 +1039,18 @@ var execTool = {
     }
     const args = (input.args ?? []).slice(0, MAX_ARGS);
     const timeout = Math.max(1, Math.min(input.timeout ?? TIMEOUT_MS, TIMEOUT_MS));
+    const argError = validateArgs(cmd, args);
+    if (argError) {
+      return {
+        command: cmd,
+        args,
+        stdout: "",
+        stderr: argError,
+        exitCode: 1,
+        truncated: false,
+        allowed: false
+      };
+    }
     const requestedCwd = input.cwd ? path.resolve(ctx.projectRoot, input.cwd) : ctx.cwd;
     const rel = path.relative(ctx.projectRoot, requestedCwd);
     if (rel.startsWith("..") || path.isAbsolute(rel)) {
@@ -1004,7 +1070,7 @@ var execTool = {
   }
 };
 function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     let stdout = "";
     let stderr = "";
     let killed = false;
@@ -1026,7 +1092,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
     });
     child.on("close", (code) => {
       clearTimeout(timer);
-      resolve4({
+      resolve5({
         command: cmd,
         args,
         stdout: stdout.slice(0, MAX_OUTPUT2),
@@ -1038,7 +1104,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
     });
     child.on("error", (err) => {
       clearTimeout(timer);
-      resolve4({
+      resolve5({
         command: cmd,
         args,
         stdout: stdout.slice(0, MAX_OUTPUT2),
@@ -1565,7 +1631,7 @@ function buildArgs(input) {
   }
 }
 function runGit2(args, cwd, signal) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     let stdout = "";
     let stderr = "";
     const child = spawn("git", args, {
@@ -1584,7 +1650,7 @@ function runGit2(args, cwd, signal) {
       }
     });
     child.on("error", (err) => {
-      resolve4({
+      resolve5({
         command: args[0],
         stdout,
         stderr: err.message,
@@ -1593,7 +1659,7 @@ function runGit2(args, cwd, signal) {
       });
     });
     child.on("close", (code) => {
-      resolve4({
+      resolve5({
         command: args[0],
         stdout: stdout.slice(0, MAX_OUTPUT3),
         stderr: stderr.slice(0, MAX_OUTPUT3),
@@ -1774,13 +1840,13 @@ var grepTool = {
   }
 };
 async function detectRg(signal) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     try {
       const p = spawn("rg", ["--version"], { stdio: "ignore", signal });
-      p.on("error", () => resolve4(false));
-      p.on("close", (code) => resolve4(code === 0));
+      p.on("error", () => resolve5(false));
+      p.on("close", (code) => resolve5(code === 0));
     } catch {
-      resolve4(false);
+      resolve5(false);
     }
   });
 }
@@ -2039,6 +2105,22 @@ var installTool = {
     const pkgList = input.packages ? (Array.isArray(input.packages) ? input.packages : input.packages.split(",")).map(
       (p) => p.trim()
     ) : [];
+    const PKG_NAME_RE = /^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/i;
+    for (const pkg of pkgList) {
+      if (!PKG_NAME_RE.test(pkg) || pkg.startsWith("-")) {
+        yield {
+          type: "final",
+          output: {
+            packages: pkgList,
+            exit_code: 1,
+            output: `Invalid package name "${pkg}". Names must match ${PKG_NAME_RE} and not start with "-".`,
+            dry_run: Boolean(input.dry_run),
+            truncated: false
+          }
+        };
+        return;
+      }
+    }
     if (pkgList.length > 0) args.push(...pkgList);
     yield {
       type: "log",
@@ -2361,8 +2443,17 @@ var logsTool = {
 async function dockerLogs(service, lines, filterRe, cwd, signal, since) {
   const args = ["logs"];
   if (lines > 0) args.push("--tail", String(lines));
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9._:-]+$/.test(service)) {
+    return {
+      source: `docker:${service}`,
+      entries: [],
+      total: 0,
+      truncated: false,
+      stream_mode: false
+    };
+  }
   args.push("--timestamps", service);
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     let stdout = "";
     let stderr = "";
     const MAX = 2e5;
@@ -2376,7 +2467,7 @@ async function dockerLogs(service, lines, filterRe, cwd, signal, since) {
     child.on("close", (code) => {
       const output = stdout + stderr;
       const entries = parseLogLines(output, filterRe);
-      resolve4({
+      resolve5({
         source: `docker:${service}`,
         entries,
         total: entries.length,
@@ -2386,7 +2477,7 @@ async function dockerLogs(service, lines, filterRe, cwd, signal, since) {
     });
     child.on(
       "error",
-      (e) => resolve4({
+      (e) => resolve5({
         source: `docker:${service}`,
         entries: [],
         total: 0,
@@ -2520,7 +2611,7 @@ async function detectManager2(cwd) {
   return "npm";
 }
 function runOutdated(manager, args, cwd, signal) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     let stdout = "";
     let stderr = "";
     const MAX = 1e5;
@@ -2533,11 +2624,11 @@ function runOutdated(manager, args, cwd, signal) {
     });
     child.on("close", (code) => {
       const result = parseOutdatedOutput(stdout, code ?? 0);
-      resolve4(result);
+      resolve5(result);
     });
     child.on(
       "error",
-      (e) => resolve4({
+      (e) => resolve5({
         exit_code: 1,
         packages: [],
         total: 0,
@@ -2620,7 +2711,7 @@ var patchTool = {
         };
       }
     }
-    const tmpDir = await fs9.mkdtemp(path.join(dir, ".wstack_patch_"));
+    const tmpDir = await fs9.mkdtemp(path.join(os.tmpdir(), ".wstack_patch_"));
     try {
       await fs9.chmod(tmpDir, 448).catch(() => {
       });
@@ -2667,7 +2758,7 @@ function stripPathComponents(p, strip) {
   return parts.slice(strip).join("/");
 }
 function runPatch(args, cwd, signal) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     let stdout = "";
     let stderr = "";
     const env = { ...buildChildEnv(), LANG: "C", LC_ALL: "C" };
@@ -2678,8 +2769,8 @@ function runPatch(args, cwd, signal) {
     child.stderr?.on("data", (c) => {
       stderr += c.toString();
     });
-    child.on("close", (code) => resolve4({ exitCode: code ?? 1, stdout, stderr }));
-    child.on("error", (e) => resolve4({ exitCode: 1, stdout: "", stderr: e.message }));
+    child.on("close", (code) => resolve5({ exitCode: code ?? 1, stdout, stderr }));
+    child.on("error", (e) => resolve5({ exitCode: 1, stdout: "", stderr: e.message }));
   });
 }
 function extractPatchedFiles(output) {
@@ -2810,7 +2901,14 @@ var readTool = {
   async execute(input, ctx) {
     if (!input?.path) throw new Error("read: path is required");
     const absPath = safeResolve(input.path, ctx);
-    const stat9 = await fs9.stat(absPath);
+    let stat9;
+    try {
+      stat9 = await fs9.stat(absPath);
+    } catch (err) {
+      const code = err.code;
+      if (code === "ENOENT") throw new Error(`read: file not found "${input.path}"`);
+      throw new Error(`read: failed to stat "${input.path}": ${err instanceof Error ? err.message : String(err)}`);
+    }
     if (!stat9.isFile()) throw new Error(`read: "${input.path}" is not a regular file`);
     if (stat9.size > MAX_BYTES2) {
       throw new Error(`read: file too large (${stat9.size} bytes, limit ${MAX_BYTES2})`);
@@ -2975,13 +3073,13 @@ async function globFiles(pattern, base, extraGlob) {
   return await globNative(pattern, base, extraGlob);
 }
 function checkRg() {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     try {
       const p = spawn("rg", ["--version"], { stdio: "ignore" });
-      p.on("error", () => resolve4(false));
-      p.on("close", (code) => resolve4(code === 0));
+      p.on("error", () => resolve5(false));
+      p.on("close", (code) => resolve5(code === 0));
     } catch {
-      resolve4(false);
+      resolve5(false);
     }
   });
 }
@@ -2993,10 +3091,10 @@ function spawnRgFind(pattern, base) {
     buf += chunk.toString();
   });
   return {
-    promise: new Promise((resolve4, reject) => {
+    promise: new Promise((resolve5, reject) => {
       child.on("error", reject);
       child.on("close", () => {
-        resolve4(buf.split("\n").filter(Boolean));
+        resolve5(buf.split("\n").filter(Boolean));
       });
     })
   };
@@ -3160,7 +3258,7 @@ var scaffoldTool = {
     const vars = { name, ...input.vars };
     const builtIn = BUILT_IN_TEMPLATES[input.template];
     if (builtIn) {
-      return await handleBuiltIn(name, builtIn.files, cwd, input.dry_run ?? false, vars);
+      return await handleBuiltIn(name, builtIn.files, cwd, ctx, input.dry_run ?? false, vars);
     }
     return {
       template: input.template,
@@ -3172,12 +3270,19 @@ var scaffoldTool = {
     };
   }
 };
-async function handleBuiltIn(name, templateFiles, cwd, dryRun, vars) {
+async function handleBuiltIn(name, templateFiles, cwd, ctx, dryRun, vars) {
   const files = [];
   let filesCreated = 0;
   for (const [filePath, content] of Object.entries(templateFiles)) {
     const resolvedPath = substituteVars(filePath, name, vars);
-    const fullPath = path.join(cwd, resolvedPath);
+    const joinedPath = path.join(cwd, resolvedPath);
+    const root = path.resolve(ctx.projectRoot);
+    const target = path.resolve(joinedPath);
+    const rel = path.relative(root, target);
+    if (rel.startsWith("..") || path.isAbsolute(rel)) {
+      throw new Error(`scaffold: generated path "${resolvedPath}" would escape project root`);
+    }
+    const fullPath = target;
     if (!dryRun) {
       await fs9.mkdir(path.dirname(fullPath), { recursive: true });
       await fs9.writeFile(fullPath, substituteVars(content, name, vars), "utf8");
@@ -4147,11 +4252,11 @@ var writeTool = {
       existed = stat10.isFile();
       if (existed) {
         if (!ctx.hasRead(absPath)) {
-          throw new Error(
-            `write: file "${input.path}" exists but was not read in this session. Read it first.`
-          );
+          prev = await fs9.readFile(absPath, "utf8");
+          ctx.recordRead(absPath, stat10.mtimeMs);
+        } else {
+          prev = await fs9.readFile(absPath, "utf8");
         }
-        prev = await fs9.readFile(absPath, "utf8");
       }
     } catch (err) {
       if (err.code !== "ENOENT") {