@wrongstack/tools 0.3.3 → 0.3.7

package/dist/exec.js

@@ -43,7 +43,7 @@ var ALLOWED_COMMANDS = {
   cargo: ["--version", "build", "test", "check"],
   rustc: ["--version"],
   go: ["version", "run", "build", "test"],
-  python: ["--version", "-c"],
+  python: ["--version"],
   pip: ["--version", "install", "list"],
   docker: ["--version", "ps", "images", "build"],
   kubectl: ["version", "get", "describe", "logs"]
@@ -51,6 +51,30 @@ var ALLOWED_COMMANDS = {
 var MAX_ARGS = 20;
 var MAX_OUTPUT = 2e5;
 var TIMEOUT_MS = 3e4;
+var BLOCKED_ARG_PATTERNS = {
+  // python -c/--command executes arbitrary code; python -m runs modules
+  python: [/-c$/, /^--command$/, /^-m$/, /^--module$/],
+  // git --exec=<cmd> runs arbitrary commands via upload-pack/receive-pack
+  git: [/^--exec=/, /^--upload-pack=/, /^--receive-pack=/],
+  // node -r/--require preloads arbitrary modules; --eval executes code
+  node: [/^-r$/, /^--require$/, /^-e$/, /^--eval$/, /^--prof-process$/],
+  // go run could execute arbitrary .go files; -ldflags could inject build-time code
+  go: [/^-ldflags$/],
+  // bun --preload is similar to node --require
+  bun: [/^--preload$/]
+};
+function validateArgs(cmd, args) {
+  const blocked = BLOCKED_ARG_PATTERNS[cmd];
+  if (!blocked) return null;
+  for (const arg of args) {
+    for (const pattern of blocked) {
+      if (pattern.test(arg)) {
+        return `Blocked argument "${arg}" for command "${cmd}" (matches security pattern ${pattern})`;
+      }
+    }
+  }
+  return null;
+}
 var execTool = {
   name: "exec",
   category: "Shell",
@@ -94,6 +118,18 @@ var execTool = {
     }
     const args = (input.args ?? []).slice(0, MAX_ARGS);
     const timeout = Math.max(1, Math.min(input.timeout ?? TIMEOUT_MS, TIMEOUT_MS));
+    const argError = validateArgs(cmd, args);
+    if (argError) {
+      return {
+        command: cmd,
+        args,
+        stdout: "",
+        stderr: argError,
+        exitCode: 1,
+        truncated: false,
+        allowed: false
+      };
+    }
     const requestedCwd = input.cwd ? path.resolve(ctx.projectRoot, input.cwd) : ctx.cwd;
     const rel = path.relative(ctx.projectRoot, requestedCwd);
     if (rel.startsWith("..") || path.isAbsolute(rel)) {

package/dist/exec.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/exec.ts"],"names":["resolve"],"mappings":";;;;;;;AAKA,IAAM,gBAAA,GAA6C;AAAA,EACjD,IAAA,EAAM,CAAC,WAAA,EAAa,IAAA,EAAM,qBAAqB,CAAA;AAAA,EAC/C,GAAA,EAAK,CAAC,WAAA,EAAa,MAAA,EAAQ,WAAW,MAAA,EAAQ,MAAA,EAAQ,OAAO,QAAQ,CAAA;AAAA,EACrE,MAAM,CAAC,WAAA,EAAa,QAAQ,SAAA,EAAW,KAAA,EAAO,UAAU,MAAM,CAAA;AAAA,EAC9D,GAAA,EAAK,CAAC,WAAW,CAAA;AAAA,EACjB,GAAA,EAAK;AAAA,IACH,WAAA;AAAA,IACA,QAAA;AAAA,IACA,KAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,UAAA;AAAA,IACA,OAAA;AAAA,IACA,KAAA;AAAA,IACA,QAAA;AAAA,IACA,MAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,EAAA,EAAI,CAAC,KAAA,EAAO,IAAA,EAAM,IAAI,CAAA;AAAA,EACtB,KAAK,EAAC;AAAA,EACN,IAAA,EAAM,CAAC,IAAI,CAAA;AAAA,EACX,IAAA,EAAM,CAAC,IAAI,CAAA;AAAA,EACX,EAAA,EAAI,CAAC,IAAA,EAAM,IAAA,EAAM,IAAI,CAAA;AAAA,EACrB,MAAM,EAAC;AAAA,EACP,MAAM,EAAC;AAAA,EACP,MAAM,EAAC;AAAA,EACP,KAAA,EAAO,CAAC,IAAI,CAAA;AAAA,EACZ,EAAA,EAAI,CAAC,IAAI,CAAA;AAAA,EACT,IAAI,EAAC;AAAA,EACL,EAAA,EAAI,CAAC,KAAK,CAAA;AAAA,EACV,OAAO,EAAC;AAAA,EACR,GAAA,EAAK,CAAC,WAAA,EAAa,KAAA,EAAO,MAAM,CAAA;AAAA,EAChC,GAAA,EAAK,CAAC,WAAA,EAAa,UAAA,EAAY,WAAW,CAAA;AAAA,EAC1C,MAAA,EAAQ,CAAC,WAAA,EAAa,KAAA,EAAO,YAAY,CAAA;AAAA,EACzC,KAAA,EAAO,CAAC,WAAA,EAAa,MAAA,EAAQ,UAAU,OAAO,CAAA;AAAA,EAC9C,KAAA,EAAO,CAAC,WAAA,EAAa,OAAA,EAAS,QAAQ,OAAO,CAAA;AAAA,EAC7C,KAAA,EAAO,CAAC,WAAW,CAAA;AAAA,EACnB,EAAA,EAAI,CAAC,SAAA,EAAW,KAAA,EAAO,SAAS,MAAM,CAAA;AAAA,EACtC,MAAA,EAAQ,CAAC,WAAA,EAAa,IAAI,CAAA;AAAA,EAC1B,GAAA,EAAK,CAAC,WAAA,EAAa,SAAA,EAAW,MAAM,CAAA;AAAA,EACpC,MAAA,EAAQ,CAAC,WAAA,EAAa,IAAA,EAAM,UAAU,OAAO,CAAA;AAAA,EAC7C,OAAA,EAAS,CAAC,SAAA,EAAW,KAAA,EAAO,YAAY,MAAM;AAChD,CAAA;AAEA,IAAM,QAAA,GAAW,EAAA;AACjB,IAAM,UAAA,GAAa,GAAA;AACnB,IAAM,UAAA,GAAa,GAAA;AAmBZ,IAAM,QAAA,GAAwC;AAAA,EACnD,IAAA,EAAM,MAAA;AAAA,EACN,QAAA,EAAU,OAAA;AAAA,EACV,WAAA,EACE,gHAAA;AAAA,EACF,SAAA,EACE,sHAAA;AAAA,EACF,UAAA,EAAY,SAAA;AAAA,EACZ,QAAA,EAAU,IAAA;AAAA,EACV,SAAA,EAAW,UAAA;AAAA,EACX,WAAA,EAAa;AAAA,IACX,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,OAAA,EAAS,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,uCAAA,EAAwC;AAAA,MAChF,IAAA,EAAM,EAAE,IAAA,EAAM,OAAA,EAAS,KAAA,EAAO,EAAE,IAAA,EAAM,QAAA,EAAS,EAAG,WAAA,EAAa,WAAA,EAAY;AAAA,MAC3E,GAAA,EAAK,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,sDAAA,EAAuD;AAAA,MAC3F,OAAA,EAAS,EAAE,IAAA,EAAM,SAAA,EAAW,aAAa,gCAAA;AAAiC,KAC5E;AAAA,IACA,QAAA,EAAU,CAAC,SAAS;AAAA,GACtB;AAAA,EACA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM;AAC9B,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,OAAA,CAAQ,IAAA,EAAK;AAC/B,IAAA,IAAI,CAAC,GAAA;AACH,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,GAAA;AAAA,QACT,MAAM,EAAC;AAAA,QACP,MAAA,EAAQ,EAAA;AAAA,QACR,MAAA,EAAQ,eAAA;AAAA,QACR,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAEF,IAAA,IAAI,EAAE,OAAO,gBAAA,CAAA,EAAmB;AAC9B,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,GAAA;AAAA,QACT,IAAA,EAAM,KAAA,CAAM,IAAA,IAAQ,EAAC;AAAA,QACrB,MAAA,EAAQ,EAAA;AAAA,QACR,MAAA,EAAQ,YAAY,GAAG,CAAA,6DAAA,CAAA;AAAA,QACvB,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,MAAM,QAAQ,KAAA,CAAM,IAAA,IAAQ,EAAC,EAAG,KAAA,CAAM,GAAG,QAAQ,CAAA;AACjD,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,IAAI,KAAA,CAAM,OAAA,IAAW,UAAA,EAAY,UAAU,CAAC,CAAA;AAI7E,IAAA,MAAM,YAAA,GAAe,MAAM,GAAA,GAAW,IAAA,CAAA,OAAA,CAAQ,IAAI,WAAA,EAAa,KAAA,CAAM,GAAG,CAAA,GAAI,GAAA,CAAI,GAAA;AAChF,IAAA,MAAM,GAAA,GAAW,IAAA,CAAA,QAAA,CAAS,GAAA,CAAI,WAAA,EAAa,YAAY,CAAA;AACvD,IAAA,IAAI,IAAI,UAAA,CAAW,IAAI,CAAA,IAAU,IAAA,CAAA,UAAA,CAAW,GAAG,CAAA,EAAG;AAChD,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,GAAA;AAAA,QACT,IAAA;AAAA,QACA,MAAA,EAAQ,EAAA;AAAA,QACR,MAAA,EAAQ,CAAA,KAAA,EAAQ,KAAA,CAAM,GAAG,CAAA,+BAAA,CAAA;AAAA,QACzB,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GAAM,YAAA;AACZ,IAAA,MAAM,SAAS,IAAA,CAAK,MAAA;AAEpB,IAAA,OAAO,UAAA,CAAW,KAAK,IAAA,EAAM,GAAA,EAAK,SAAS,MAAA,EAAQ,GAAA,CAAI,SAAS,EAAE,CAAA;AAAA,EACpE;AACF;AAEA,SAAS,WACP,GAAA,EACA,IAAA,EACA,GAAA,EACA,OAAA,EACA,QACA,SAAA,EACqB;AACrB,EAAA,OAAO,IAAI,OAAA,CAAQ,CAACA,QAAAA,KAAY;AAC9B,IAAA,IAAI,MAAA,GAAS,EAAA;AACb,IAAA,IAAI,MAAA,GAAS,EAAA;AACb,IAAA,IAAI,MAAA,GAAS,KAAA;AAEb,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,GAAA,EAAK,IAAA,EAAM;AAAA,MAC7B,GAAA;AAAA,MACA,MAAA;AAAA,MACA,GAAA,EAAK,cAAc,SAAS,CAAA;AAAA,MAC5B,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM;AAAA,KACjC,CAAA;AACD,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,MAAA,MAAA,GAAS,IAAA;AACT,MAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,IACtB,GAAG,OAAO,CAAA;AAEV,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAC1C,MAAA,IAAI,MAAA,CAAO,MAAA,GAAS,UAAA,EAAY,MAAA,IAAU,MAAM,QAAA,EAAS;AAAA,IAC3D,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAC1C,MAAA,IAAI,MAAA,CAAO,MAAA,GAAS,UAAA,EAAY,MAAA,IAAU,MAAM,QAAA,EAAS;AAAA,IAC3D,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,IAAA,KAAS;AAC1B,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAAA,QAAAA,CAAQ;AAAA,QACN,OAAA,EAAS,GAAA;AAAA,QACT,IAAA;AAAA,QACA,MAAA,EAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA;AAAA,QAClC,MAAA,EAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA;AAAA,QAClC,QAAA,EAAU,MAAA,GAAS,GAAA,GAAO,IAAA,IAAQ,CAAA;AAAA,QAClC,SAAA,EAAW,MAAA,CAAO,MAAA,IAAU,UAAA,IAAc,OAAO,MAAA,IAAU,UAAA;AAAA,QAC3D,OAAA,EAAS;AAAA,OACV,CAAA;AAAA,IACH,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AACzB,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAAA,QAAAA,CAAQ;AAAA,QACN,OAAA,EAAS,GAAA;AAAA,QACT,IAAA;AAAA,QACA,MAAA,EAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA;AAAA,QAClC,QAAQ,GAAA,CAAI,OAAA;AAAA,QACZ,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACV,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AACH","file":"exec.js","sourcesContent":["import { spawn } from 'node:child_process';\nimport * as path from 'node:path';\nimport type { Tool } from '@wrongstack/core';\nimport { buildChildEnv } from './_env.js';\n\nconst ALLOWED_COMMANDS: Record<string, string[]> = {\n  node: ['--version', '-r', '--input-type=module'],\n  npm: ['--version', 'init', 'install', 'test', 'list', 'pkg', 'doctor'],\n  pnpm: ['--version', 'init', 'install', 'add', 'remove', 'list'],\n  npx: ['--version'],\n  git: [\n    '--version',\n    'status',\n    'log',\n    'diff',\n    'branch',\n    'checkout',\n    'stash',\n    'add',\n    'commit',\n    'push',\n    'pull',\n  ],\n  ls: ['-la', '-l', '-a'],\n  cat: [],\n  head: ['-n'],\n  tail: ['-n'],\n  wc: ['-l', '-w', '-c'],\n  grep: [],\n  find: [],\n  echo: [],\n  mkdir: ['-p'],\n  cp: ['-r'],\n  mv: [],\n  rm: ['-rf'],\n  touch: [],\n  bun: ['--version', 'add', 'init'],\n  tsc: ['--version', '--noEmit', '--project'],\n  vitest: ['--version', 'run', '--coverage'],\n  biome: ['--version', 'lint', 'format', 'check'],\n  cargo: ['--version', 'build', 'test', 'check'],\n  rustc: ['--version'],\n  go: ['version', 'run', 'build', 'test'],\n  python: ['--version', '-c'],\n  pip: ['--version', 'install', 'list'],\n  docker: ['--version', 'ps', 'images', 'build'],\n  kubectl: ['version', 'get', 'describe', 'logs'],\n};\n\nconst MAX_ARGS = 20;\nconst MAX_OUTPUT = 200_000;\nconst TIMEOUT_MS = 30_000;\n\ninterface ExecInput {\n  command: string;\n  args?: string[];\n  cwd?: string;\n  timeout?: number;\n}\n\ninterface ExecOutput {\n  command: string;\n  args: string[];\n  stdout: string;\n  stderr: string;\n  exitCode: number;\n  truncated: boolean;\n  allowed: boolean;\n}\n\nexport const execTool: Tool<ExecInput, ExecOutput> = {\n  name: 'exec',\n  category: 'Shell',\n  description:\n    'Restricted shell that only runs pre-approved commands with constrained arguments. Safer alternative to `bash`.',\n  usageHint:\n    'Set `command` (must be in allowlist). `args` passed through. For arbitrary shell access use the `bash` tool instead.',\n  permission: 'confirm',\n  mutating: true,\n  timeoutMs: TIMEOUT_MS,\n  inputSchema: {\n    type: 'object',\n    properties: {\n      command: { type: 'string', description: 'Command to run (must be in allowlist)' },\n      args: { type: 'array', items: { type: 'string' }, description: 'Arguments' },\n      cwd: { type: 'string', description: 'Working directory (must resolve inside project root)' },\n      timeout: { type: 'integer', description: 'Timeout in ms (default: 30000)' },\n    },\n    required: ['command'],\n  },\n  async execute(input, ctx, opts) {\n    const cmd = input.command.trim();\n    if (!cmd)\n      return {\n        command: cmd,\n        args: [],\n        stdout: '',\n        stderr: 'Empty command',\n        exitCode: 1,\n        truncated: false,\n        allowed: false,\n      };\n\n    if (!(cmd in ALLOWED_COMMANDS)) {\n      return {\n        command: cmd,\n        args: input.args ?? [],\n        stdout: '',\n        stderr: `Command \"${cmd}\" not in allowlist. Use the bash tool for arbitrary commands.`,\n        exitCode: 1,\n        truncated: false,\n        allowed: false,\n      };\n    }\n\n    const args = (input.args ?? []).slice(0, MAX_ARGS);\n    const timeout = Math.max(1, Math.min(input.timeout ?? TIMEOUT_MS, TIMEOUT_MS));\n\n    // Resolve cwd inside the project root. Model-supplied paths like '/etc'\n    // would otherwise let allowlisted commands operate anywhere on disk.\n    const requestedCwd = input.cwd ? path.resolve(ctx.projectRoot, input.cwd) : ctx.cwd;\n    const rel = path.relative(ctx.projectRoot, requestedCwd);\n    if (rel.startsWith('..') || path.isAbsolute(rel)) {\n      return {\n        command: cmd,\n        args,\n        stdout: '',\n        stderr: `cwd \"${input.cwd}\" resolves outside project root`,\n        exitCode: 1,\n        truncated: false,\n        allowed: false,\n      };\n    }\n    const cwd = requestedCwd;\n    const signal = opts.signal;\n\n    return runCommand(cmd, args, cwd, timeout, signal, ctx.session?.id);\n  },\n};\n\nfunction runCommand(\n  cmd: string,\n  args: string[],\n  cwd: string,\n  timeout: number,\n  signal: AbortSignal,\n  sessionId: string | undefined,\n): Promise<ExecOutput> {\n  return new Promise((resolve) => {\n    let stdout = '';\n    let stderr = '';\n    let killed = false;\n\n    const child = spawn(cmd, args, {\n      cwd,\n      signal,\n      env: buildChildEnv(sessionId),\n      stdio: ['ignore', 'pipe', 'pipe'],\n    });\n    const timer = setTimeout(() => {\n      killed = true;\n      child.kill('SIGTERM');\n    }, timeout);\n\n    child.stdout?.on('data', (chunk: Buffer) => {\n      if (stdout.length < MAX_OUTPUT) stdout += chunk.toString();\n    });\n\n    child.stderr?.on('data', (chunk: Buffer) => {\n      if (stderr.length < MAX_OUTPUT) stderr += chunk.toString();\n    });\n\n    child.on('close', (code) => {\n      clearTimeout(timer);\n      resolve({\n        command: cmd,\n        args,\n        stdout: stdout.slice(0, MAX_OUTPUT),\n        stderr: stderr.slice(0, MAX_OUTPUT),\n        exitCode: killed ? 124 : (code ?? 1),\n        truncated: stdout.length >= MAX_OUTPUT || stderr.length >= MAX_OUTPUT,\n        allowed: true,\n      });\n    });\n\n    child.on('error', (err) => {\n      clearTimeout(timer);\n      resolve({\n        command: cmd,\n        args,\n        stdout: stdout.slice(0, MAX_OUTPUT),\n        stderr: err.message,\n        exitCode: 1,\n        truncated: false,\n        allowed: true,\n      });\n    });\n  });\n}\n"]}
+{"version":3,"sources":["../src/exec.ts"],"names":["resolve"],"mappings":";;;;;;;AAKA,IAAM,gBAAA,GAA6C;AAAA,EACjD,IAAA,EAAM,CAAC,WAAA,EAAa,IAAA,EAAM,qBAAqB,CAAA;AAAA,EAC/C,GAAA,EAAK,CAAC,WAAA,EAAa,MAAA,EAAQ,WAAW,MAAA,EAAQ,MAAA,EAAQ,OAAO,QAAQ,CAAA;AAAA,EACrE,MAAM,CAAC,WAAA,EAAa,QAAQ,SAAA,EAAW,KAAA,EAAO,UAAU,MAAM,CAAA;AAAA,EAC9D,GAAA,EAAK,CAAC,WAAW,CAAA;AAAA,EACjB,GAAA,EAAK;AAAA,IACH,WAAA;AAAA,IACA,QAAA;AAAA,IACA,KAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAA;AAAA,IACA,UAAA;AAAA,IACA,OAAA;AAAA,IACA,KAAA;AAAA,IACA,QAAA;AAAA,IACA,MAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,EAAA,EAAI,CAAC,KAAA,EAAO,IAAA,EAAM,IAAI,CAAA;AAAA,EACtB,KAAK,EAAC;AAAA,EACN,IAAA,EAAM,CAAC,IAAI,CAAA;AAAA,EACX,IAAA,EAAM,CAAC,IAAI,CAAA;AAAA,EACX,EAAA,EAAI,CAAC,IAAA,EAAM,IAAA,EAAM,IAAI,CAAA;AAAA,EACrB,MAAM,EAAC;AAAA,EACP,MAAM,EAAC;AAAA,EACP,MAAM,EAAC;AAAA,EACP,KAAA,EAAO,CAAC,IAAI,CAAA;AAAA,EACZ,EAAA,EAAI,CAAC,IAAI,CAAA;AAAA,EACT,IAAI,EAAC;AAAA,EACL,EAAA,EAAI,CAAC,KAAK,CAAA;AAAA,EACV,OAAO,EAAC;AAAA,EACR,GAAA,EAAK,CAAC,WAAA,EAAa,KAAA,EAAO,MAAM,CAAA;AAAA,EAChC,GAAA,EAAK,CAAC,WAAA,EAAa,UAAA,EAAY,WAAW,CAAA;AAAA,EAC1C,MAAA,EAAQ,CAAC,WAAA,EAAa,KAAA,EAAO,YAAY,CAAA;AAAA,EACzC,KAAA,EAAO,CAAC,WAAA,EAAa,MAAA,EAAQ,UAAU,OAAO,CAAA;AAAA,EAC9C,KAAA,EAAO,CAAC,WAAA,EAAa,OAAA,EAAS,QAAQ,OAAO,CAAA;AAAA,EAC7C,KAAA,EAAO,CAAC,WAAW,CAAA;AAAA,EACnB,EAAA,EAAI,CAAC,SAAA,EAAW,KAAA,EAAO,SAAS,MAAM,CAAA;AAAA,EACtC,MAAA,EAAQ,CAAC,WAAW,CAAA;AAAA,EACpB,GAAA,EAAK,CAAC,WAAA,EAAa,SAAA,EAAW,MAAM,CAAA;AAAA,EACpC,MAAA,EAAQ,CAAC,WAAA,EAAa,IAAA,EAAM,UAAU,OAAO,CAAA;AAAA,EAC7C,OAAA,EAAS,CAAC,SAAA,EAAW,KAAA,EAAO,YAAY,MAAM;AAChD,CAAA;AAEA,IAAM,QAAA,GAAW,EAAA;AACjB,IAAM,UAAA,GAAa,GAAA;AACnB,IAAM,UAAA,GAAa,GAAA;AAKnB,IAAM,oBAAA,GAAiD;AAAA;AAAA,EAErD,MAAA,EAAQ,CAAC,KAAA,EAAO,aAAA,EAAe,QAAQ,YAAY,CAAA;AAAA;AAAA,EAEnD,GAAA,EAAK,CAAC,UAAA,EAAY,iBAAA,EAAmB,kBAAkB,CAAA;AAAA;AAAA,EAEvD,MAAM,CAAC,MAAA,EAAQ,aAAA,EAAe,MAAA,EAAQ,YAAY,kBAAkB,CAAA;AAAA;AAAA,EAEpE,EAAA,EAAI,CAAC,YAAY,CAAA;AAAA;AAAA,EAEjB,GAAA,EAAK,CAAC,aAAa;AACrB,CAAA;AAEA,SAAS,YAAA,CAAa,KAAa,IAAA,EAA+B;AAChE,EAAA,MAAM,OAAA,GAAU,qBAAqB,GAAG,CAAA;AACxC,EAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AAErB,EAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,IAAA,KAAA,MAAW,WAAW,OAAA,EAAS;AAC7B,MAAA,IAAI,OAAA,CAAQ,IAAA,CAAK,GAAG,CAAA,EAAG;AACrB,QAAA,OAAO,CAAA,kBAAA,EAAqB,GAAG,CAAA,eAAA,EAAkB,GAAG,+BAA+B,OAAO,CAAA,CAAA,CAAA;AAAA,MAC5F;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAmBO,IAAM,QAAA,GAAwC;AAAA,EACnD,IAAA,EAAM,MAAA;AAAA,EACN,QAAA,EAAU,OAAA;AAAA,EACV,WAAA,EACE,gHAAA;AAAA,EACF,SAAA,EACE,sHAAA;AAAA,EACF,UAAA,EAAY,SAAA;AAAA,EACZ,QAAA,EAAU,IAAA;AAAA,EACV,SAAA,EAAW,UAAA;AAAA,EACX,WAAA,EAAa;AAAA,IACX,IAAA,EAAM,QAAA;AAAA,IACN,UAAA,EAAY;AAAA,MACV,OAAA,EAAS,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,uCAAA,EAAwC;AAAA,MAChF,IAAA,EAAM,EAAE,IAAA,EAAM,OAAA,EAAS,KAAA,EAAO,EAAE,IAAA,EAAM,QAAA,EAAS,EAAG,WAAA,EAAa,WAAA,EAAY;AAAA,MAC3E,GAAA,EAAK,EAAE,IAAA,EAAM,QAAA,EAAU,aAAa,sDAAA,EAAuD;AAAA,MAC3F,OAAA,EAAS,EAAE,IAAA,EAAM,SAAA,EAAW,aAAa,gCAAA;AAAiC,KAC5E;AAAA,IACA,QAAA,EAAU,CAAC,SAAS;AAAA,GACtB;AAAA,EACA,MAAM,OAAA,CAAQ,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM;AAC9B,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,OAAA,CAAQ,IAAA,EAAK;AAC/B,IAAA,IAAI,CAAC,GAAA;AACH,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,GAAA;AAAA,QACT,MAAM,EAAC;AAAA,QACP,MAAA,EAAQ,EAAA;AAAA,QACR,MAAA,EAAQ,eAAA;AAAA,QACR,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAEF,IAAA,IAAI,EAAE,OAAO,gBAAA,CAAA,EAAmB;AAC9B,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,GAAA;AAAA,QACT,IAAA,EAAM,KAAA,CAAM,IAAA,IAAQ,EAAC;AAAA,QACrB,MAAA,EAAQ,EAAA;AAAA,QACR,MAAA,EAAQ,YAAY,GAAG,CAAA,6DAAA,CAAA;AAAA,QACvB,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,MAAM,QAAQ,KAAA,CAAM,IAAA,IAAQ,EAAC,EAAG,KAAA,CAAM,GAAG,QAAQ,CAAA;AACjD,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,IAAI,KAAA,CAAM,OAAA,IAAW,UAAA,EAAY,UAAU,CAAC,CAAA;AAG7E,IAAA,MAAM,QAAA,GAAW,YAAA,CAAa,GAAA,EAAK,IAAI,CAAA;AACvC,IAAA,IAAI,QAAA,EAAU;AACZ,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,GAAA;AAAA,QACT,IAAA;AAAA,QACA,MAAA,EAAQ,EAAA;AAAA,QACR,MAAA,EAAQ,QAAA;AAAA,QACR,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAIA,IAAA,MAAM,YAAA,GAAe,MAAM,GAAA,GAAW,IAAA,CAAA,OAAA,CAAQ,IAAI,WAAA,EAAa,KAAA,CAAM,GAAG,CAAA,GAAI,GAAA,CAAI,GAAA;AAChF,IAAA,MAAM,GAAA,GAAW,IAAA,CAAA,QAAA,CAAS,GAAA,CAAI,WAAA,EAAa,YAAY,CAAA;AACvD,IAAA,IAAI,IAAI,UAAA,CAAW,IAAI,CAAA,IAAU,IAAA,CAAA,UAAA,CAAW,GAAG,CAAA,EAAG;AAChD,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,GAAA;AAAA,QACT,IAAA;AAAA,QACA,MAAA,EAAQ,EAAA;AAAA,QACR,MAAA,EAAQ,CAAA,KAAA,EAAQ,KAAA,CAAM,GAAG,CAAA,+BAAA,CAAA;AAAA,QACzB,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GAAM,YAAA;AACZ,IAAA,MAAM,SAAS,IAAA,CAAK,MAAA;AAEpB,IAAA,OAAO,UAAA,CAAW,KAAK,IAAA,EAAM,GAAA,EAAK,SAAS,MAAA,EAAQ,GAAA,CAAI,SAAS,EAAE,CAAA;AAAA,EACpE;AACF;AAEA,SAAS,WACP,GAAA,EACA,IAAA,EACA,GAAA,EACA,OAAA,EACA,QACA,SAAA,EACqB;AACrB,EAAA,OAAO,IAAI,OAAA,CAAQ,CAACA,QAAAA,KAAY;AAC9B,IAAA,IAAI,MAAA,GAAS,EAAA;AACb,IAAA,IAAI,MAAA,GAAS,EAAA;AACb,IAAA,IAAI,MAAA,GAAS,KAAA;AAEb,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,GAAA,EAAK,IAAA,EAAM;AAAA,MAC7B,GAAA;AAAA,MACA,MAAA;AAAA,MACA,GAAA,EAAK,cAAc,SAAS,CAAA;AAAA,MAC5B,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM;AAAA,KACjC,CAAA;AACD,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,MAAA,MAAA,GAAS,IAAA;AACT,MAAA,KAAA,CAAM,KAAK,SAAS,CAAA;AAAA,IACtB,GAAG,OAAO,CAAA;AAEV,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAC1C,MAAA,IAAI,MAAA,CAAO,MAAA,GAAS,UAAA,EAAY,MAAA,IAAU,MAAM,QAAA,EAAS;AAAA,IAC3D,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,KAAA,KAAkB;AAC1C,MAAA,IAAI,MAAA,CAAO,MAAA,GAAS,UAAA,EAAY,MAAA,IAAU,MAAM,QAAA,EAAS;AAAA,IAC3D,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,IAAA,KAAS;AAC1B,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAAA,QAAAA,CAAQ;AAAA,QACN,OAAA,EAAS,GAAA;AAAA,QACT,IAAA;AAAA,QACA,MAAA,EAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA;AAAA,QAClC,MAAA,EAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA;AAAA,QAClC,QAAA,EAAU,MAAA,GAAS,GAAA,GAAO,IAAA,IAAQ,CAAA;AAAA,QAClC,SAAA,EAAW,MAAA,CAAO,MAAA,IAAU,UAAA,IAAc,OAAO,MAAA,IAAU,UAAA;AAAA,QAC3D,OAAA,EAAS;AAAA,OACV,CAAA;AAAA,IACH,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AACzB,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAAA,QAAAA,CAAQ;AAAA,QACN,OAAA,EAAS,GAAA;AAAA,QACT,IAAA;AAAA,QACA,MAAA,EAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA;AAAA,QAClC,QAAQ,GAAA,CAAI,OAAA;AAAA,QACZ,QAAA,EAAU,CAAA;AAAA,QACV,SAAA,EAAW,KAAA;AAAA,QACX,OAAA,EAAS;AAAA,OACV,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AACH","file":"exec.js","sourcesContent":["import { spawn } from 'node:child_process';\r\nimport * as path from 'node:path';\r\nimport type { Tool } from '@wrongstack/core';\r\nimport { buildChildEnv } from './_env.js';\r\n\r\nconst ALLOWED_COMMANDS: Record<string, string[]> = {\r\n  node: ['--version', '-r', '--input-type=module'],\r\n  npm: ['--version', 'init', 'install', 'test', 'list', 'pkg', 'doctor'],\r\n  pnpm: ['--version', 'init', 'install', 'add', 'remove', 'list'],\r\n  npx: ['--version'],\r\n  git: [\r\n    '--version',\r\n    'status',\r\n    'log',\r\n    'diff',\r\n    'branch',\r\n    'checkout',\r\n    'stash',\r\n    'add',\r\n    'commit',\r\n    'push',\r\n    'pull',\r\n  ],\r\n  ls: ['-la', '-l', '-a'],\r\n  cat: [],\r\n  head: ['-n'],\r\n  tail: ['-n'],\r\n  wc: ['-l', '-w', '-c'],\r\n  grep: [],\r\n  find: [],\r\n  echo: [],\r\n  mkdir: ['-p'],\r\n  cp: ['-r'],\r\n  mv: [],\r\n  rm: ['-rf'],\r\n  touch: [],\r\n  bun: ['--version', 'add', 'init'],\r\n  tsc: ['--version', '--noEmit', '--project'],\r\n  vitest: ['--version', 'run', '--coverage'],\r\n  biome: ['--version', 'lint', 'format', 'check'],\r\n  cargo: ['--version', 'build', 'test', 'check'],\r\n  rustc: ['--version'],\r\n  go: ['version', 'run', 'build', 'test'],\r\n  python: ['--version'],\r\n  pip: ['--version', 'install', 'list'],\r\n  docker: ['--version', 'ps', 'images', 'build'],\r\n  kubectl: ['version', 'get', 'describe', 'logs'],\r\n};\r\n\r\nconst MAX_ARGS = 20;\r\nconst MAX_OUTPUT = 200_000;\r\nconst TIMEOUT_MS = 30_000;\r\n\r\n// Per-command argument validation. Each entry is a list of regex patterns\r\n// that, if matched against any argument, will reject the invocation.\r\n// This blocks common injection vectors through allowlisted commands.\r\nconst BLOCKED_ARG_PATTERNS: Record<string, RegExp[]> = {\r\n  // python -c/--command executes arbitrary code; python -m runs modules\r\n  python: [/-c$/, /^--command$/, /^-m$/, /^--module$/],\r\n  // git --exec=<cmd> runs arbitrary commands via upload-pack/receive-pack\r\n  git: [/^--exec=/, /^--upload-pack=/, /^--receive-pack=/],\r\n  // node -r/--require preloads arbitrary modules; --eval executes code\r\n  node: [/^-r$/, /^--require$/, /^-e$/, /^--eval$/, /^--prof-process$/],\r\n  // go run could execute arbitrary .go files; -ldflags could inject build-time code\r\n  go: [/^-ldflags$/],\r\n  // bun --preload is similar to node --require\r\n  bun: [/^--preload$/],\r\n};\r\n\r\nfunction validateArgs(cmd: string, args: string[]): string | null {\r\n  const blocked = BLOCKED_ARG_PATTERNS[cmd];\r\n  if (!blocked) return null;\r\n\r\n  for (const arg of args) {\r\n    for (const pattern of blocked) {\r\n      if (pattern.test(arg)) {\r\n        return `Blocked argument \"${arg}\" for command \"${cmd}\" (matches security pattern ${pattern})`;\r\n      }\r\n    }\r\n  }\r\n  return null;\r\n}\r\n\r\ninterface ExecInput {\r\n  command: string;\r\n  args?: string[];\r\n  cwd?: string;\r\n  timeout?: number;\r\n}\r\n\r\ninterface ExecOutput {\r\n  command: string;\r\n  args: string[];\r\n  stdout: string;\r\n  stderr: string;\r\n  exitCode: number;\r\n  truncated: boolean;\r\n  allowed: boolean;\r\n}\r\n\r\nexport const execTool: Tool<ExecInput, ExecOutput> = {\r\n  name: 'exec',\r\n  category: 'Shell',\r\n  description:\r\n    'Restricted shell that only runs pre-approved commands with constrained arguments. Safer alternative to `bash`.',\r\n  usageHint:\r\n    'Set `command` (must be in allowlist). `args` passed through. For arbitrary shell access use the `bash` tool instead.',\r\n  permission: 'confirm',\r\n  mutating: true,\r\n  timeoutMs: TIMEOUT_MS,\r\n  inputSchema: {\r\n    type: 'object',\r\n    properties: {\r\n      command: { type: 'string', description: 'Command to run (must be in allowlist)' },\r\n      args: { type: 'array', items: { type: 'string' }, description: 'Arguments' },\r\n      cwd: { type: 'string', description: 'Working directory (must resolve inside project root)' },\r\n      timeout: { type: 'integer', description: 'Timeout in ms (default: 30000)' },\r\n    },\r\n    required: ['command'],\r\n  },\r\n  async execute(input, ctx, opts) {\r\n    const cmd = input.command.trim();\r\n    if (!cmd)\r\n      return {\r\n        command: cmd,\r\n        args: [],\r\n        stdout: '',\r\n        stderr: 'Empty command',\r\n        exitCode: 1,\r\n        truncated: false,\r\n        allowed: false,\r\n      };\r\n\r\n    if (!(cmd in ALLOWED_COMMANDS)) {\r\n      return {\r\n        command: cmd,\r\n        args: input.args ?? [],\r\n        stdout: '',\r\n        stderr: `Command \"${cmd}\" not in allowlist. Use the bash tool for arbitrary commands.`,\r\n        exitCode: 1,\r\n        truncated: false,\r\n        allowed: false,\r\n      };\r\n    }\r\n\r\n    const args = (input.args ?? []).slice(0, MAX_ARGS);\r\n    const timeout = Math.max(1, Math.min(input.timeout ?? TIMEOUT_MS, TIMEOUT_MS));\r\n\r\n    // Validate args against per-command security patterns\r\n    const argError = validateArgs(cmd, args);\r\n    if (argError) {\r\n      return {\r\n        command: cmd,\r\n        args,\r\n        stdout: '',\r\n        stderr: argError,\r\n        exitCode: 1,\r\n        truncated: false,\r\n        allowed: false,\r\n      };\r\n    }\r\n\r\n    // Resolve cwd inside the project root. Model-supplied paths like '/etc'\r\n    // would otherwise let allowlisted commands operate anywhere on disk.\r\n    const requestedCwd = input.cwd ? path.resolve(ctx.projectRoot, input.cwd) : ctx.cwd;\r\n    const rel = path.relative(ctx.projectRoot, requestedCwd);\r\n    if (rel.startsWith('..') || path.isAbsolute(rel)) {\r\n      return {\r\n        command: cmd,\r\n        args,\r\n        stdout: '',\r\n        stderr: `cwd \"${input.cwd}\" resolves outside project root`,\r\n        exitCode: 1,\r\n        truncated: false,\r\n        allowed: false,\r\n      };\r\n    }\r\n    const cwd = requestedCwd;\r\n    const signal = opts.signal;\r\n\r\n    return runCommand(cmd, args, cwd, timeout, signal, ctx.session?.id);\r\n  },\r\n};\r\n\r\nfunction runCommand(\r\n  cmd: string,\r\n  args: string[],\r\n  cwd: string,\r\n  timeout: number,\r\n  signal: AbortSignal,\r\n  sessionId: string | undefined,\r\n): Promise<ExecOutput> {\r\n  return new Promise((resolve) => {\r\n    let stdout = '';\r\n    let stderr = '';\r\n    let killed = false;\r\n\r\n    const child = spawn(cmd, args, {\r\n      cwd,\r\n      signal,\r\n      env: buildChildEnv(sessionId),\r\n      stdio: ['ignore', 'pipe', 'pipe'],\r\n    });\r\n    const timer = setTimeout(() => {\r\n      killed = true;\r\n      child.kill('SIGTERM');\r\n    }, timeout);\r\n\r\n    child.stdout?.on('data', (chunk: Buffer) => {\r\n      if (stdout.length < MAX_OUTPUT) stdout += chunk.toString();\r\n    });\r\n\r\n    child.stderr?.on('data', (chunk: Buffer) => {\r\n      if (stderr.length < MAX_OUTPUT) stderr += chunk.toString();\r\n    });\r\n\r\n    child.on('close', (code) => {\r\n      clearTimeout(timer);\r\n      resolve({\r\n        command: cmd,\r\n        args,\r\n        stdout: stdout.slice(0, MAX_OUTPUT),\r\n        stderr: stderr.slice(0, MAX_OUTPUT),\r\n        exitCode: killed ? 124 : (code ?? 1),\r\n        truncated: stdout.length >= MAX_OUTPUT || stderr.length >= MAX_OUTPUT,\r\n        allowed: true,\r\n      });\r\n    });\r\n\r\n    child.on('error', (err) => {\r\n      clearTimeout(timer);\r\n      resolve({\r\n        command: cmd,\r\n        args,\r\n        stdout: stdout.slice(0, MAX_OUTPUT),\r\n        stderr: err.message,\r\n        exitCode: 1,\r\n        truncated: false,\r\n        allowed: true,\r\n      });\r\n    });\r\n  });\r\n}\r\n"]}

package/dist/index.js

@@ -67,7 +67,14 @@ var readTool = {
   async execute(input, ctx) {
     if (!input?.path) throw new Error("read: path is required");
     const absPath = safeResolve(input.path, ctx);
-    const stat9 = await fs4.stat(absPath);
+    let stat9;
+    try {
+      stat9 = await fs4.stat(absPath);
+    } catch (err) {
+      const code = err.code;
+      if (code === "ENOENT") throw new Error(`read: file not found "${input.path}"`);
+      throw new Error(`read: failed to stat "${input.path}": ${err instanceof Error ? err.message : String(err)}`);
+    }
     if (!stat9.isFile()) throw new Error(`read: "${input.path}" is not a regular file`);
     if (stat9.size > MAX_BYTES) {
       throw new Error(`read: file too large (${stat9.size} bytes, limit ${MAX_BYTES})`);
@@ -125,11 +132,11 @@ var writeTool = {
       existed = stat10.isFile();
       if (existed) {
         if (!ctx.hasRead(absPath)) {
-          throw new Error(
-            `write: file "${input.path}" exists but was not read in this session. Read it first.`
-          );
+          prev = await fs4.readFile(absPath, "utf8");
+          ctx.recordRead(absPath, stat10.mtimeMs);
+        } else {
+          prev = await fs4.readFile(absPath, "utf8");
         }
-        prev = await fs4.readFile(absPath, "utf8");
       }
     } catch (err) {
       if (err.code !== "ENOENT") {
@@ -436,13 +443,13 @@ async function globFiles(pattern, base, extraGlob) {
   return await globNative(pattern, base, extraGlob);
 }
 function checkRg() {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     try {
       const p = spawn("rg", ["--version"], { stdio: "ignore" });
-      p.on("error", () => resolve4(false));
-      p.on("close", (code) => resolve4(code === 0));
+      p.on("error", () => resolve5(false));
+      p.on("close", (code) => resolve5(code === 0));
     } catch {
-      resolve4(false);
+      resolve5(false);
     }
   });
 }
@@ -454,10 +461,10 @@ function spawnRgFind(pattern, base) {
     buf += chunk.toString();
   });
   return {
-    promise: new Promise((resolve4, reject) => {
+    promise: new Promise((resolve5, reject) => {
       child.on("error", reject);
       child.on("close", () => {
-        resolve4(buf.split("\n").filter(Boolean));
+        resolve5(buf.split("\n").filter(Boolean));
       });
     })
   };
@@ -621,13 +628,13 @@ var grepTool = {
   }
 };
 async function detectRg(signal) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     try {
       const p = spawn("rg", ["--version"], { stdio: "ignore", signal });
-      p.on("error", () => resolve4(false));
-      p.on("close", (code) => resolve4(code === 0));
+      p.on("error", () => resolve5(false));
+      p.on("close", (code) => resolve5(code === 0));
     } catch {
-      resolve4(false);
+      resolve5(false);
     }
   });
 }
@@ -882,12 +889,41 @@ var bashTool = {
       signal: opts.signal
     });
     if (input.background) {
-      const pid = child.pid;
-      if (typeof pid === "number") child.unref();
+      let buf2 = "";
+      let truncated = false;
+      const child2 = spawn(shell, args, {
+        cwd: ctx.projectRoot,
+        env,
+        stdio: ["ignore", "pipe", "pipe"],
+        detached: true,
+        signal: opts.signal
+      });
+      const pid = child2.pid;
+      child2.stdout?.on("data", (chunk) => {
+        if (!truncated) {
+          const remain = MAX_OUTPUT - buf2.length;
+          if (remain > 0) {
+            buf2 += chunk.toString().slice(0, remain);
+          }
+          if (buf2.length >= MAX_OUTPUT) truncated = true;
+        }
+      });
+      child2.stderr?.on("data", (chunk) => {
+        if (!truncated) {
+          const remain = MAX_OUTPUT - buf2.length;
+          if (remain > 0) {
+            buf2 += chunk.toString().slice(0, remain);
+          }
+          if (buf2.length >= MAX_OUTPUT) truncated = true;
+        }
+      });
+      child2.on("close", () => {
+      });
+      if (typeof pid === "number") child2.unref();
       yield {
         type: "final",
         output: {
-          output: `[background] pid=${pid ?? "unknown"}`,
+          output: truncated ? buf2.slice(0, MAX_OUTPUT) + "\u2026[truncated]" : buf2,
           exit_code: null,
           timed_out: false,
           pid
@@ -932,6 +968,7 @@ var bashTool = {
             }
           }, 2e3);
           timers.push(killTimer);
+          killTimer.unref?.();
         } catch {
         }
       }
@@ -949,10 +986,10 @@ var bashTool = {
         queue.push(c);
       }
     };
-    const next = () => new Promise((resolve4) => {
+    const next = () => new Promise((resolve5) => {
       const c = queue.shift();
-      if (c) resolve4(c);
-      else resolveNext = resolve4;
+      if (c) resolve5(c);
+      else resolveNext = resolve5;
     });
     let lastFlush = Date.now();
     const flush = () => {
@@ -1051,7 +1088,7 @@ var ALLOWED_COMMANDS = {
   cargo: ["--version", "build", "test", "check"],
   rustc: ["--version"],
   go: ["version", "run", "build", "test"],
-  python: ["--version", "-c"],
+  python: ["--version"],
   pip: ["--version", "install", "list"],
   docker: ["--version", "ps", "images", "build"],
   kubectl: ["version", "get", "describe", "logs"]
@@ -1059,6 +1096,30 @@ var ALLOWED_COMMANDS = {
 var MAX_ARGS = 20;
 var MAX_OUTPUT2 = 2e5;
 var TIMEOUT_MS = 3e4;
+var BLOCKED_ARG_PATTERNS = {
+  // python -c/--command executes arbitrary code; python -m runs modules
+  python: [/-c$/, /^--command$/, /^-m$/, /^--module$/],
+  // git --exec=<cmd> runs arbitrary commands via upload-pack/receive-pack
+  git: [/^--exec=/, /^--upload-pack=/, /^--receive-pack=/],
+  // node -r/--require preloads arbitrary modules; --eval executes code
+  node: [/^-r$/, /^--require$/, /^-e$/, /^--eval$/, /^--prof-process$/],
+  // go run could execute arbitrary .go files; -ldflags could inject build-time code
+  go: [/^-ldflags$/],
+  // bun --preload is similar to node --require
+  bun: [/^--preload$/]
+};
+function validateArgs(cmd, args) {
+  const blocked = BLOCKED_ARG_PATTERNS[cmd];
+  if (!blocked) return null;
+  for (const arg of args) {
+    for (const pattern of blocked) {
+      if (pattern.test(arg)) {
+        return `Blocked argument "${arg}" for command "${cmd}" (matches security pattern ${pattern})`;
+      }
+    }
+  }
+  return null;
+}
 var execTool = {
   name: "exec",
   category: "Shell",
@@ -1102,6 +1163,18 @@ var execTool = {
     }
     const args = (input.args ?? []).slice(0, MAX_ARGS);
     const timeout = Math.max(1, Math.min(input.timeout ?? TIMEOUT_MS, TIMEOUT_MS));
+    const argError = validateArgs(cmd, args);
+    if (argError) {
+      return {
+        command: cmd,
+        args,
+        stdout: "",
+        stderr: argError,
+        exitCode: 1,
+        truncated: false,
+        allowed: false
+      };
+    }
     const requestedCwd = input.cwd ? path.resolve(ctx.projectRoot, input.cwd) : ctx.cwd;
     const rel = path.relative(ctx.projectRoot, requestedCwd);
     if (rel.startsWith("..") || path.isAbsolute(rel)) {
@@ -1121,7 +1194,7 @@ var execTool = {
   }
 };
 function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     let stdout = "";
     let stderr = "";
     let killed = false;
@@ -1143,7 +1216,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
     });
     child.on("close", (code) => {
       clearTimeout(timer);
-      resolve4({
+      resolve5({
         command: cmd,
         args,
         stdout: stdout.slice(0, MAX_OUTPUT2),
@@ -1155,7 +1228,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId) {
     });
     child.on("error", (err) => {
       clearTimeout(timer);
-      resolve4({
+      resolve5({
         command: cmd,
         args,
         stdout: stdout.slice(0, MAX_OUTPUT2),
@@ -1946,7 +2019,7 @@ function buildArgs(input) {
   }
 }
 function runGit(args, cwd, signal) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     let stdout = "";
     let stderr = "";
     const child = spawn("git", args, {
@@ -1965,7 +2038,7 @@ function runGit(args, cwd, signal) {
       }
     });
     child.on("error", (err) => {
-      resolve4({
+      resolve5({
         command: args[0],
         stdout,
         stderr: err.message,
@@ -1974,7 +2047,7 @@ function runGit(args, cwd, signal) {
       });
     });
     child.on("close", (code) => {
-      resolve4({
+      resolve5({
         command: args[0],
         stdout: stdout.slice(0, MAX_OUTPUT3),
         stderr: stderr.slice(0, MAX_OUTPUT3),
@@ -2023,7 +2096,7 @@ var patchTool = {
         };
       }
     }
-    const tmpDir = await fs4.mkdtemp(path.join(dir, ".wstack_patch_"));
+    const tmpDir = await fs4.mkdtemp(path.join(os.tmpdir(), ".wstack_patch_"));
     try {
       await fs4.chmod(tmpDir, 448).catch(() => {
       });
@@ -2070,7 +2143,7 @@ function stripPathComponents(p, strip) {
   return parts.slice(strip).join("/");
 }
 function runPatch(args, cwd, signal) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     let stdout = "";
     let stderr = "";
     const env = { ...buildChildEnv(), LANG: "C", LC_ALL: "C" };
@@ -2081,8 +2154,8 @@ function runPatch(args, cwd, signal) {
     child.stderr?.on("data", (c) => {
       stderr += c.toString();
     });
-    child.on("close", (code) => resolve4({ exitCode: code ?? 1, stdout, stderr }));
-    child.on("error", (e) => resolve4({ exitCode: 1, stdout: "", stderr: e.message }));
+    child.on("close", (code) => resolve5({ exitCode: code ?? 1, stdout, stderr }));
+    child.on("error", (e) => resolve5({ exitCode: 1, stdout: "", stderr: e.message }));
   });
 }
 function extractPatchedFiles(output) {
@@ -2284,7 +2357,7 @@ function findGitDir2(cwd) {
   return null;
 }
 function runGit2(args, cwd, signal) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     let stdout = "";
     let stderr = "";
     const child = spawn("git", args, { cwd, signal, stdio: ["ignore", "pipe", "pipe"] });
@@ -2294,8 +2367,8 @@ function runGit2(args, cwd, signal) {
     child.stderr?.on("data", (c) => {
       stderr += c.toString();
     });
-    child.on("close", (code) => resolve4({ stdout, stderr, exitCode: code ?? 0 }));
-    child.on("error", (e) => resolve4({ stdout: "", stderr: e.message, exitCode: 1 }));
+    child.on("close", (code) => resolve5({ stdout, stderr, exitCode: code ?? 0 }));
+    child.on("error", (e) => resolve5({ stdout: "", stderr: e.message, exitCode: 1 }));
   });
 }
 async function fileDiff(input, ctx, signal) {
@@ -2542,8 +2615,8 @@ async function* spawnStream(opts) {
   let spawnFailed = false;
   for (; ; ) {
     while (queue.length === 0) {
-      await new Promise((resolve4) => {
-        waiter = resolve4;
+      await new Promise((resolve5) => {
+        waiter = resolve5;
       });
     }
     const chunk = queue.shift();
@@ -3047,6 +3120,22 @@ var installTool = {
     const pkgList = input.packages ? (Array.isArray(input.packages) ? input.packages : input.packages.split(",")).map(
       (p) => p.trim()
     ) : [];
+    const PKG_NAME_RE = /^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/i;
+    for (const pkg of pkgList) {
+      if (!PKG_NAME_RE.test(pkg) || pkg.startsWith("-")) {
+        yield {
+          type: "final",
+          output: {
+            packages: pkgList,
+            exit_code: 1,
+            output: `Invalid package name "${pkg}". Names must match ${PKG_NAME_RE} and not start with "-".`,
+            dry_run: Boolean(input.dry_run),
+            truncated: false
+          }
+        };
+        return;
+      }
+    }
     if (pkgList.length > 0) args.push(...pkgList);
     yield {
       type: "log",
@@ -3247,7 +3336,7 @@ async function detectManager2(cwd) {
   return "npm";
 }
 function runOutdated(manager, args, cwd, signal) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     let stdout = "";
     let stderr = "";
     const MAX = 1e5;
@@ -3260,11 +3349,11 @@ function runOutdated(manager, args, cwd, signal) {
     });
     child.on("close", (code) => {
       const result = parseOutdatedOutput(stdout, code ?? 0);
-      resolve4(result);
+      resolve5(result);
     });
     child.on(
       "error",
-      (e) => resolve4({
+      (e) => resolve5({
         exit_code: 1,
         packages: [],
         total: 0,
@@ -3378,8 +3467,17 @@ var logsTool = {
 async function dockerLogs(service, lines, filterRe, cwd, signal, since) {
   const args = ["logs"];
   if (lines > 0) args.push("--tail", String(lines));
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9._:-]+$/.test(service)) {
+    return {
+      source: `docker:${service}`,
+      entries: [],
+      total: 0,
+      truncated: false,
+      stream_mode: false
+    };
+  }
   args.push("--timestamps", service);
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     let stdout = "";
     let stderr = "";
     const MAX = 2e5;
@@ -3393,7 +3491,7 @@ async function dockerLogs(service, lines, filterRe, cwd, signal, since) {
     child.on("close", (code) => {
       const output = stdout + stderr;
       const entries = parseLogLines(output, filterRe);
-      resolve4({
+      resolve5({
         source: `docker:${service}`,
         entries,
         total: entries.length,
@@ -3403,7 +3501,7 @@ async function dockerLogs(service, lines, filterRe, cwd, signal, since) {
     });
     child.on(
       "error",
-      (e) => resolve4({
+      (e) => resolve5({
         source: `docker:${service}`,
         entries: [],
         total: 0,
@@ -3764,7 +3862,7 @@ var scaffoldTool = {
     const vars = { name, ...input.vars };
     const builtIn = BUILT_IN_TEMPLATES[input.template];
     if (builtIn) {
-      return await handleBuiltIn(name, builtIn.files, cwd, input.dry_run ?? false, vars);
+      return await handleBuiltIn(name, builtIn.files, cwd, ctx, input.dry_run ?? false, vars);
     }
     return {
       template: input.template,
@@ -3776,12 +3874,19 @@ var scaffoldTool = {
     };
   }
 };
-async function handleBuiltIn(name, templateFiles, cwd, dryRun, vars) {
+async function handleBuiltIn(name, templateFiles, cwd, ctx, dryRun, vars) {
   const files = [];
   let filesCreated = 0;
   for (const [filePath, content] of Object.entries(templateFiles)) {
     const resolvedPath = substituteVars(filePath, name, vars);
-    const fullPath = path.join(cwd, resolvedPath);
+    const joinedPath = path.join(cwd, resolvedPath);
+    const root = path.resolve(ctx.projectRoot);
+    const target = path.resolve(joinedPath);
+    const rel = path.relative(root, target);
+    if (rel.startsWith("..") || path.isAbsolute(rel)) {
+      throw new Error(`scaffold: generated path "${resolvedPath}" would escape project root`);
+    }
+    const fullPath = target;
     if (!dryRun) {
       await fs4.mkdir(path.dirname(fullPath), { recursive: true });
       await fs4.writeFile(fullPath, substituteVars(content, name, vars), "utf8");