@wrongstack/tools 0.310.1 → 0.313.1

package/dist/chunk-HXSBQ2SE.js

@@ -0,0 +1,1723 @@
+import {
+  buildChildEnv
+} from "./chunk-BTSFTGIL.js";
+import {
+  getPersistentProcessRegistry
+} from "./chunk-ZIGAZFWE.js";
+import {
+  createOutputSpool,
+  spoolNote
+} from "./chunk-2TFQDEPU.js";
+import {
+  getProcessRegistry,
+  redactCommand
+} from "./chunk-3PVYQFRQ.js";
+import {
+  buildWin32CmdShimInvocation,
+  resolveWin32Command
+} from "./chunk-V43EQ6VR.js";
+import {
+  COMMAND_OUTPUT_MAX_BYTES,
+  normalizeCommandOutput,
+  safeResolveReal
+} from "./chunk-D33S4RQG.js";
+
+// src/exec.ts
+import { spawn } from "node:child_process";
+import {
+  emitProcessCompleted,
+  emitProcessOutput,
+  emitProcessStarted
+} from "@wrongstack/core/observability";
+import { toErrorMessage } from "@wrongstack/core/utils/error";
+
+// src/_danger-detect.ts
+var argHas = (args, value) => args.includes(value);
+var argMatches = (args, re) => args.some((a) => re.test(a));
+var hasShortFlags = (args, letters) => {
+  const seen = /* @__PURE__ */ new Set();
+  for (const a of args) {
+    if (!/^-[a-zA-Z]+$/.test(a)) continue;
+    for (const ch of a.slice(1)) seen.add(ch);
+  }
+  return letters.split("").every((l) => seen.has(l));
+};
+var RULES = [
+  // ----- rm / rmdir: recursive force delete (any path) -----
+  // Note: BLOCKED_ARG_PATTERNS already hard-denies root/home/glob paths,
+  // but `rm -rf ./build` is a normal dev workflow that the user might
+  // want to do intentionally. We downgrade it to 'destructive' so the
+  // confirm prompt can approve.
+  {
+    id: "rm-recursive",
+    level: "destructive",
+    test: (cmd, args) => (cmd === "rm" || cmd === "rmdir") && hasShortFlags(args, "rf"),
+    reason: "recursive force-delete"
+  },
+  // ----- Windows PowerShell Remove-Item: -Recurse -Force -----
+  {
+    id: "powershell-remove-item-recursive-force",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "powershell" && cmd !== "pwsh") return false;
+      const hasRecurse = argMatches(args, /^-(?:R|Recurse|Recurse\s)/);
+      const hasForce = argHas(args, "-Force") || argHas(args, "-F");
+      if (argHas(args, "-WhatIf")) return false;
+      return hasRecurse && hasForce;
+    },
+    reason: "Remove-Item with -Recurse -Force"
+  },
+  // ----- Windows PowerShell Disk & Volume destruction -----
+  {
+    id: "powershell-disk-volume-destroy",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "powershell" && cmd !== "pwsh") return false;
+      return args.some(
+        (a) => /^(?:Format-Volume|Clear-Disk|Initialize-Disk|Remove-Partition|Clear-Volume)(?:\s|$)/i.test(a)
+      );
+    },
+    reason: "PowerShell disk/volume partition destruction"
+  },
+  // ----- Windows PowerShell System Restart / Shutdown -----
+  {
+    id: "powershell-stop-restart-computer",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "powershell" && cmd !== "pwsh") return false;
+      return args.some((a) => /^(?:Stop-Computer|Restart-Computer)(?:\s|$)/i.test(a));
+    },
+    reason: "PowerShell system shutdown or restart"
+  },
+  // ----- Windows PowerShell ExecutionPolicy / Payload evasion -----
+  {
+    id: "powershell-execution-policy-bypass",
+    level: "caution",
+    test: (cmd, args) => {
+      if (cmd !== "powershell" && cmd !== "pwsh") return false;
+      return args.some(
+        (a) => /Set-ExecutionPolicy\s+(?:Bypass|Unrestricted)|-(?:EncodedCommand|enc)\b/i.test(a)
+      );
+    },
+    reason: "PowerShell execution policy bypass or encoded command"
+  },
+  // ----- find -exec / -ok / -execdir -----
+  {
+    id: "find-exec",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "find") return false;
+      return args.some(
+        (a) => a === "-exec" || a === "-exec;" || a === "-ok" || a === "-ok;" || a === "-execdir" || a === "-execdir;" || a.startsWith("-exec=") || a.startsWith("-ok=") || a.startsWith("-execdir=")
+      );
+    },
+    reason: "find with -exec/-ok (executes arbitrary command on matches)"
+  },
+  // ----- git --exec= / --upload-pack= / --receive-pack= -----
+  // These run arbitrary commands via the git transport layer.
+  {
+    id: "git-exec",
+    level: "destructive",
+    test: (cmd, args) => cmd === "git" && args.some(
+      (a) => a.startsWith("--exec=") || a.startsWith("--upload-pack=") || a.startsWith("--receive-pack=") || a === "--exec" || a === "--upload-pack" || a === "--receive-pack"
+    ),
+    reason: "git with --exec/--upload-pack/--receive-pack (runs arbitrary code)"
+  },
+  // ----- Windows: format / diskpart / bcdedit -----
+  {
+    id: "win32-format",
+    level: "destructive",
+    test: (cmd) => cmd === "format" || cmd === "format.exe",
+    reason: "format (Windows disk format)"
+  },
+  {
+    id: "win32-diskpart",
+    level: "destructive",
+    test: (cmd) => cmd === "diskpart" || cmd === "diskpart.exe",
+    reason: "diskpart (Windows partition editor)"
+  },
+  {
+    id: "win32-bcdedit",
+    level: "destructive",
+    test: (cmd) => cmd === "bcdedit" || cmd === "bcdedit.exe",
+    reason: "bcdedit (Windows boot config editor)"
+  },
+  // ----- mkfs family -----
+  {
+    id: "mkfs",
+    level: "destructive",
+    test: (cmd) => /^mkfs(\.[a-z0-9]+)?$/.test(cmd) || cmd === "mkswap",
+    reason: "mkfs (filesystem creation \u2014 destroys existing data)"
+  },
+  // ----- dd writing to a block device -----
+  {
+    id: "dd-to-block-device",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "dd") return false;
+      return args.some((a) => /of=\/dev\/(sd|hd|nvme|vd|mmcblk|xvd|loop|disk)/.test(a));
+    },
+    reason: "dd writing to a block device"
+  },
+  // ----- Secure-erase tools -----
+  {
+    id: "shred",
+    level: "destructive",
+    test: (cmd) => cmd === "shred" || cmd === "shred.exe",
+    reason: "shred (secure file delete)"
+  },
+  {
+    id: "wipefs",
+    level: "destructive",
+    test: (cmd) => cmd === "wipefs" || cmd === "wipefs.exe",
+    reason: "wipefs (signature wipe \u2014 destroys filesystem headers)"
+  },
+  {
+    id: "sdelete",
+    level: "destructive",
+    test: (cmd) => cmd === "sdelete" || cmd === "sdelete.exe",
+    reason: "sdelete (Sysinternals secure delete)"
+  },
+  // ----- VCS history rewrite (destructive) -----
+  // `git push --force` / `-f` rewrites remote history. `--force-with-lease`
+  // is the safer variant (checks remote hasn't moved) but still rewrites.
+  {
+    id: "git-push-force",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "git") return false;
+      const pushIdx = args.indexOf("push");
+      if (pushIdx < 0) return false;
+      for (let i = pushIdx + 1; i < args.length; i++) {
+        const a = args[i];
+        if (a === "--force" || a === "-f" || a === "--force-with-lease") return true;
+        if (!a.startsWith("-") && !a.includes("=")) continue;
+        if (a.startsWith("--force")) return true;
+      }
+      return false;
+    },
+    reason: "git push with --force / -f (rewrites remote history)"
+  },
+  // ----- git reset --hard (destructive) -----
+  {
+    id: "git-reset-hard",
+    level: "destructive",
+    test: (cmd, args) => cmd === "git" && args.some((a) => a === "--hard" || a.startsWith("--hard=")),
+    reason: "git reset --hard (discards working tree + index)"
+  },
+  // ----- git clean -f / -fd (destructive) -----
+  {
+    id: "git-clean-force",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "git") return false;
+      const cleanIdx = args.indexOf("clean");
+      if (cleanIdx < 0) return false;
+      return args.slice(cleanIdx + 1).some(
+        (a) => a === "-f" || a === "--force" || a.startsWith("-f") || a.startsWith("--force=")
+      );
+    },
+    reason: "git clean -f (deletes untracked files)"
+  },
+  // ----- package publish (destructive — public, irreversible) -----
+  {
+    id: "npm-publish",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (!["npm", "pnpm", "yarn", "bun", "cargo"].includes(cmd)) return false;
+      return args.includes("publish") || cmd === "cargo" && args.includes("yank");
+    },
+    reason: "publishing to a public package registry (hard to reverse)"
+  },
+  // ----- k8s cluster-wide destructive ops (destructive) -----
+  {
+    id: "kubectl-delete-namespace",
+    level: "destructive",
+    test: (cmd, args) => {
+      if (cmd !== "kubectl") return false;
+      const delIdx = args.indexOf("delete");
+      if (delIdx < 0) return false;
+      const after = args.slice(delIdx + 1);
+      return after[0] === "namespace" || after[0] === "ns";
+    },
+    reason: "kubectl delete namespace (deletes all resources in the namespace)"
+  },
+  {
+    id: "kubectl-drain",
+    level: "destructive",
+    test: (cmd, args) => cmd === "kubectl" && args.includes("drain"),
+    reason: "kubectl drain (evicts pods, marks node unschedulable)"
+  },
+  // ----- inline code evaluation (caution — high false-positive) -----
+  // Common in scripts: `python -c "..."`, `node -e "..."`, `bash -c "..."`.
+  // We tag 'caution' rather than 'destructive' because these are used in
+  // many legitimate one-liners (e.g. `python -c "print(1)"`).
+  {
+    id: "inline-eval",
+    level: "caution",
+    test: (cmd, args) => {
+      if (![
+        "python",
+        "python3",
+        "python2",
+        "node",
+        "bash",
+        "sh",
+        "zsh",
+        "ruby",
+        "perl",
+        "lua"
+      ].includes(cmd)) {
+        return false;
+      }
+      return args.some(
+        (a) => a === "-c" || a === "-e" || a === "--eval" || a === "-eval" || a === "-E"
+      );
+    },
+    reason: "inline script evaluation (-c / -e / --eval)"
+  },
+  // ----- pipe-to-shell (destructive — download-and-run pattern) -----
+  // The classic `curl https://... | sh` download-and-run vector. Detected by
+  // looking for a known fetcher piped into a shell or expression evaluator.
+  // A shell command passed through `bash -c` / `pwsh -Command` arrives as one
+  // argv string, so scan the reconstructed argv text rather than individual
+  // tokens only.
+  {
+    id: "pipe-to-shell",
+    level: "destructive",
+    test: (cmd, args) => /\b(?:curl|wget|fetch|httpie|http|irm|iwr|Invoke-WebRequest|Invoke-RestMethod)\b[\s\S]{0,300}\|\s*(?:sudo\s+)?(?:sh|bash|zsh|fish|pwsh|powershell|iex|Invoke-Expression)\b/i.test(
+      [cmd, ...args].join(" ")
+    ),
+    reason: "network fetch piped to a shell (download-and-run pattern)"
+  },
+  // ----- privilege escalation (caution) -----
+  {
+    id: "sudo",
+    level: "caution",
+    test: (cmd) => cmd === "sudo" || cmd === "doas",
+    reason: "privilege escalation (sudo / doas)"
+  },
+  {
+    id: "runas",
+    level: "caution",
+    test: (cmd) => cmd === "runas" || cmd === "runas.exe",
+    reason: "Windows runas (run as different user)"
+  },
+  // ----- world-writable permissions (caution) -----
+  // `chmod 777` is rarely correct. `chmod -R 777` is almost always wrong.
+  // We only flag octal modes; symbolic modes like `chmod o+w` are
+  // left to the operator's discretion.
+  {
+    id: "chmod-world-writable",
+    level: "caution",
+    test: (cmd, args) => {
+      if (cmd !== "chmod") return false;
+      return args.some((a) => /^[0-7]{3,4}$/.test(a) && /7/.test(a));
+    },
+    reason: "chmod with world-writable octal mode (e.g. 777)"
+  },
+  // ----- network recon / offensive scanners (caution) -----
+  // These tools are purpose-built for network reconnaissance and offensive
+  // security. They have legitimate uses in dev (security testing, infra
+  // debugging) but their presence in an agent's command stream is worth a
+  // caution banner so the user can notice an unexpected scan.
+  {
+    id: "network-scanner",
+    level: "caution",
+    test: (cmd) => cmd === "nmap" || cmd === "masscan" || cmd === "zmap" || cmd === "nuclei" || cmd === "hping3" || cmd === "naabu" || cmd === "katana" || cmd === "amass" || cmd === "subfinder" || cmd === "httpx" || cmd === "rustscan" || cmd === "zgrab",
+    reason: "network scanner / offensive reconnaissance tool"
+  },
+  // ----- process termination (caution) -----
+  // kill/killall/pkill terminate processes. The exec kill guard
+  // (exec-kill-guard.ts) hard-blocks attempts on protected WrongStack
+  // processes; this rule adds a caution banner for generic process
+  // termination so the user sees a warning even for non-protected targets.
+  {
+    id: "process-kill",
+    level: "caution",
+    test: (cmd) => cmd === "kill" || cmd === "killall" || cmd === "pkill",
+    reason: "process termination command"
+  },
+  // ----- shell/interpreter launchers (caution) -----
+  // `env bash -c '…'`, `timeout sh`, `nohup perl -e '…'` etc. wrap a child
+  // binary that bypasses the allowlist name-gate entirely (the wrapper
+  // resolves the child from PATH, not from the allowlist). We flag caution
+  // when a known launcher has a shell/interpreter as its target program.
+  {
+    id: "shell-launcher",
+    level: "caution",
+    test: (cmd, args) => {
+      const launchers = [
+        "env",
+        "timeout",
+        "nohup",
+        "nice",
+        "script",
+        "expect",
+        "tmux",
+        "screen",
+        "byobu",
+        "dtach"
+      ];
+      if (!launchers.includes(cmd)) return false;
+      const shells = [
+        "sh",
+        "bash",
+        "zsh",
+        "fish",
+        "python",
+        "python3",
+        "perl",
+        "ruby",
+        "node",
+        "pwsh",
+        "powershell",
+        "cmd"
+      ];
+      if (cmd === "env") {
+        const prog = args.find((a) => !a.includes("=") && !a.startsWith("-"));
+        return prog !== void 0 && shells.includes(prog);
+      }
+      return args.some((a) => shells.includes(a));
+    },
+    reason: "launcher wrapping a shell/interpreter (bypasses allowlist name-gate)"
+  }
+];
+function detectDanger(cmd, args, bypass) {
+  const reasons = [];
+  let level = "safe";
+  let matchedRule;
+  for (const rule of RULES) {
+    if (bypass?.has(rule.id)) continue;
+    if (!rule.test(cmd, args)) continue;
+    reasons.push(rule.reason);
+    if (matchedRule === void 0 || levelRank(rule.level) >= levelRank(level)) {
+      matchedRule = rule.id;
+    }
+    if (levelRank(rule.level) > levelRank(level)) {
+      level = rule.level;
+    }
+  }
+  if (level === "safe") return { level: "safe", reasons: [] };
+  const result = { level, reasons };
+  if (matchedRule !== void 0) result.matchedRule = matchedRule;
+  return result;
+}
+function levelRank(level) {
+  switch (level) {
+    case "safe":
+      return 0;
+    case "caution":
+      return 1;
+    case "destructive":
+      return 2;
+  }
+}
+
+// src/exec-kill-guard.ts
+import * as os from "node:os";
+import * as path from "node:path";
+var isWin = os.platform() === "win32";
+async function checkExecKillCommand(cmd, args) {
+  if (!cmd) return { blocked: false };
+  const cmdLower = cmd.toLowerCase().trim();
+  const fullCommand = [cmdLower, ...args].join(" ").replace(/\s+/g, " ").trim();
+  if (isWin) {
+    if (cmdLower === "taskkill" || cmdLower === "taskkill.exe") {
+      const hasForce = args.some((a) => a.toUpperCase() === "/F" || a.toUpperCase() === "-F");
+      const signal = hasForce ? "FORCE" : "TERM";
+      for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a.toUpperCase() === "/IM" || a.toUpperCase() === "-IM") {
+          const nameArg = args[i + 1];
+          if (nameArg) {
+            const result = await checkKillTarget({ name: nameArg, signal, cmd: fullCommand });
+            if (result.blocked) return result;
+          }
+        }
+      }
+      for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a.toUpperCase() === "/PID" || a.toUpperCase() === "-PID") {
+          const pidArg = args[i + 1];
+          if (pidArg && /^\d+$/.test(pidArg)) {
+            const result = await checkKillTarget({
+              pid: parseInt(pidArg, 10),
+              signal,
+              cmd: fullCommand
+            });
+            if (result.blocked) return result;
+          }
+        }
+      }
+      for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a.toUpperCase() === "/FI" || a.toUpperCase() === "-FI") {
+          const filterArg = args[i + 1];
+          if (filterArg) {
+            const nameMatch = filterArg.match(/IMAGENAME\s+eq\s+"?([^"\s]+)/i);
+            if (nameMatch?.[1]) {
+              const result = await checkKillTarget({
+                name: nameMatch[1],
+                signal,
+                cmd: fullCommand
+              });
+              if (result.blocked) return result;
+            }
+          }
+        }
+      }
+      return { blocked: false };
+    }
+    if (cmdLower === "powershell" || cmdLower === "powershell.exe" || cmdLower === "pwsh" || cmdLower === "pwsh.exe" || cmdLower === "cmd" || cmdLower === "cmd.exe") {
+      const shellFlagIndex = args.findIndex((arg) => {
+        const lower = arg.toLowerCase();
+        return lower === "-c" || lower === "-command" || lower === "/c";
+      });
+      if (shellFlagIndex >= 0) {
+        const innerTokens = tokenizeShellCommand(args.slice(shellFlagIndex + 1).join(" "));
+        const innerCommand = innerTokens[0];
+        if (innerCommand) {
+          const result = await checkExecKillCommand(innerCommand, innerTokens.slice(1));
+          if (result.blocked) return result;
+        }
+      }
+    }
+    if (cmdLower === "stop-process" || cmdLower === "kill") {
+      for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === "-Name" || a === "-n") {
+          const nameArg = args[i + 1]?.replace(/^['"]|['"]$/g, "");
+          if (nameArg) {
+            const result = await checkKillTarget({
+              name: nameArg,
+              signal: "FORCE",
+              cmd: fullCommand
+            });
+            if (result.blocked) return result;
+          }
+        }
+        if (a === "-Id" || a === "-PID" || a === "-pid") {
+          const pidArg = args[i + 1];
+          if (pidArg && /^\d+$/.test(pidArg)) {
+            const result = await checkKillTarget({
+              pid: parseInt(pidArg, 10),
+              signal: "FORCE",
+              cmd: fullCommand
+            });
+            if (result.blocked) return result;
+          }
+        }
+      }
+      const firstNonFlag = args.find((a) => !a.startsWith("-"));
+      if (firstNonFlag) {
+        const name = firstNonFlag.replace(/^['"]|['"]$/g, "");
+        const result = await checkKillTarget({ name, signal: "TERM", cmd: fullCommand });
+        if (result.blocked) return result;
+      }
+    }
+    if (cmdLower === "wmic" || cmdLower === "wmic.exe") {
+      const joined = args.join(" ").toLowerCase();
+      if (/\bprocess\b/.test(joined) && /\bdelete\b/.test(joined)) {
+        const nameMatch = joined.match(/name\s*=\s*['"]?([^'"]+)/);
+        if (nameMatch?.[1]) {
+          const result = await checkKillTarget({
+            name: nameMatch[1].trim(),
+            signal: "FORCE",
+            cmd: fullCommand
+          });
+          if (result.blocked) return result;
+        }
+        return {
+          blocked: true,
+          reason: "Blocked: wmic process delete targets all matched processes \u2014 would include protected WrongStack processes."
+        };
+      }
+    }
+    if (cmdLower === "node" || cmdLower === "node.exe") {
+      if (args.includes("-e") || args.includes("--eval")) {
+        const evalIdx = args.indexOf("-e") !== -1 ? args.indexOf("-e") : args.indexOf("--eval");
+        const evalCode = args[evalIdx + 1] ?? "";
+        if (/\bprocess\.kill\s*\(/.test(evalCode)) {
+          const pidMatch = evalCode.match(/process\.kill\s*\(\s*(\d+)/);
+          if (pidMatch?.[1]) {
+            const pid = parseInt(pidMatch[1], 10);
+            const result = await checkKillTarget({ pid, signal: "SIGTERM", cmd: fullCommand });
+            if (result.blocked) return result;
+          }
+          return {
+            blocked: true,
+            reason: "Blocked: node -e with process.kill() \u2014 would target protected WrongStack process(es)."
+          };
+        }
+      }
+    }
+  } else {
+    if (cmdLower === "kill") {
+      for (const a of args) {
+        const num = a.replace(/^-/, "");
+        if (/^\d+$/.test(num)) {
+          const pid = parseInt(num, 10);
+          const result = await checkKillTarget({ pid, signal: "SIGTERM", cmd: fullCommand });
+          if (result.blocked) return result;
+        }
+      }
+    }
+    if (cmdLower === "pkill" || cmdLower === "killall") {
+      const firstNonFlag = args.find((a) => !a.startsWith("-"));
+      if (firstNonFlag) {
+        const result = await checkKillTarget({
+          name: firstNonFlag,
+          signal: "SIGTERM",
+          cmd: fullCommand
+        });
+        if (result.blocked) return result;
+      }
+    }
+  }
+  return { blocked: false };
+}
+function tokenizeShellCommand(command) {
+  const tokens = [];
+  let current = "";
+  let quote = null;
+  for (const char of command.trim()) {
+    if (quote) {
+      if (char === quote) quote = null;
+      else current += char;
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      quote = char;
+    } else if (/\s/.test(char)) {
+      if (current) {
+        tokens.push(current);
+        current = "";
+      }
+    } else {
+      current += char;
+    }
+  }
+  if (current) tokens.push(current);
+  return tokens;
+}
+async function checkKillTarget(target) {
+  const registry = getPersistentProcessRegistry();
+  if (target.pid !== void 0) {
+    const blocked = await registry.shouldBlockKill(target.pid);
+    if (blocked) {
+      return {
+        blocked: true,
+        reason: `Blocked: kill ${target.signal} PID ${target.pid} targets a protected WrongStack process (${target.cmd.slice(0, 80)}).`
+      };
+    }
+    if (target.pid === process.pid) {
+      return {
+        blocked: true,
+        reason: "Blocked: cannot kill the current WrongStack process."
+      };
+    }
+    if (target.pid === process.ppid) {
+      return {
+        blocked: true,
+        reason: "Blocked: cannot kill the parent terminal hosting WrongStack."
+      };
+    }
+    return { blocked: false };
+  }
+  if (target.name) {
+    const nameLower = target.name.toLowerCase().replace(/\.exe$/, "");
+    if (nameLower.includes("wrongstack")) {
+      return {
+        blocked: true,
+        reason: `Blocked: kill ${target.signal} '${target.name}' targets a WrongStack process name.`
+      };
+    }
+    const currentImage = path.basename(process.execPath).toLowerCase().replace(/\.exe$/, "");
+    const targetsNodeRuntime = nameLower === "node" || nameLower.startsWith("node");
+    if (targetsNodeRuntime && currentImage === "node") {
+      return {
+        blocked: true,
+        reason: `Blocked: kill ${target.signal} '${target.name}' would kill the active WrongStack node.exe runtime.`
+      };
+    }
+    const protectedPids = await registry.getAllProtectedPids();
+    if (protectedPids.length > 0 && targetsNodeRuntime) {
+      return {
+        blocked: true,
+        reason: `Blocked: kill ${target.signal} '${target.name}' would kill all node.exe processes including active WrongStack instance(s).`
+      };
+    }
+    return { blocked: false };
+  }
+  return { blocked: false };
+}
+
+// src/exec-allowlist.ts
+var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
+  // JS / TS toolchain
+  "node",
+  "npm",
+  "pnpm",
+  "yarn",
+  "npx",
+  "bun",
+  "deno",
+  "corepack",
+  "tsc",
+  "tsx",
+  "ts-node",
+  "vite",
+  "vitest",
+  "jest",
+  "biome",
+  "eslint",
+  "prettier",
+  "turbo",
+  "nx",
+  "webpack",
+  "rollup",
+  "parcel",
+  "next",
+  "astro",
+  "playwright",
+  "cypress",
+  // version control
+  "git",
+  // Rust
+  "cargo",
+  "rustc",
+  // Go
+  "go",
+  // Python
+  "python",
+  "python3",
+  "pip",
+  "pip3",
+  "pytest",
+  "ruff",
+  "mypy",
+  "uv",
+  "uvx",
+  "poetry",
+  "hatch",
+  "tox",
+  // Ruby
+  "ruby",
+  "gem",
+  "bundle",
+  // PHP
+  "php",
+  "composer",
+  "phpunit",
+  // JVM
+  "java",
+  "javac",
+  "mvn",
+  "gradle",
+  "gradlew",
+  // .NET
+  "dotnet",
+  // C / C++ / native build
+  "make",
+  "cmake",
+  "ninja",
+  "clang",
+  "clang-cl",
+  "gcc",
+  "g++",
+  "link",
+  "msbuild",
+  // containers / orchestration
+  "docker",
+  "podman",
+  "kubectl",
+  // network fetch tools. Per-arg safety is NOT enforced by BLOCKED_ARG_PATTERNS
+  // (no curl/wget entries) — the real boundary is the per-call `confirm`
+  // permission gate (exec.ts permission:'confirm', subjectKey:'command'),
+  // the `pipe-to-shell` danger rule, and the kill guard. The allowlist is a
+  // guidance layer, not a security boundary on its own.
+  "curl",
+  "wget",
+  // common POSIX file/text utilities
+  "pwd",
+  "ls",
+  "cat",
+  "head",
+  "tail",
+  "wc",
+  "grep",
+  "rg",
+  "find",
+  "echo",
+  "sort",
+  "uniq",
+  "sed",
+  "awk",
+  "mkdir",
+  "cp",
+  "mv",
+  "rm",
+  "touch",
+  "tar",
+  // Windows-native tooling (win32). All non-destructive binaries; per-arg
+  // safety is still enforced by BLOCKED_ARG_PATTERNS + the destructive-ops
+  // gate in bash-kill-guard.ts. `gh` is included even though it lives at
+  // "C:\Program Files\GitHub CLI\gh.exe" — resolveWin32Command handles the
+  // space in the path.
+  "gh",
+  "where",
+  "tasklist",
+  "systeminfo",
+  "wmic",
+  "sc",
+  "netstat",
+  "ipconfig",
+  "nslookup",
+  "tracert",
+  "pathping",
+  // Windows shell interpreters. Without these, `exec` cannot run cmd builtins
+  // (`dir`, `type`, `copy`, …) or any PowerShell cmdlet on Windows — a major
+  // gap since those are the platform's primary shells. Arbitrary execution
+  // through `cmd /c …` / `powershell -c …` is NOT a new hole: the permission
+  // policy reconstructs the full command line (shellCommandLineFromInput) and
+  // still runs it through the YOLO destructive classifier, so a genuinely
+  // destructive `cmd /c del /s /q C:\…` continues to require confirmation.
+  "cmd",
+  "cmd.exe",
+  "powershell",
+  "powershell.exe",
+  "pwsh",
+  "pwsh.exe",
+  // [core] Extended default allowlist (added 4b3d18d1 + this commit). Broadly
+  // used dev binaries — NOT all non-destructive: this section contains
+  // process/system tools (kill, chown, mount, userdel), network scanners
+  // (nmap, masscan, zmap, nuclei), and launchers (env, perl, timeout, tmux).
+  // The real safety boundary for these is the per-call `confirm` permission
+  // gate (exec.ts permission:'confirm', subjectKey:'command' renders the full
+  // invocation) plus the danger rules in _danger-detect.ts. Per-arg hard-deny
+  // is still enforced by BLOCKED_ARG_PATTERNS + bash-kill-guard.ts, but only
+  // for the commands that have entries there (git, find, rm).
+  // --- Archives & compression ---
+  "7z",
+  "7za",
+  "bzip2",
+  "gzip",
+  "xz",
+  "unzip",
+  "zip",
+  "gtar",
+  "bsdtar",
+  "star",
+  "pax",
+  "cpio",
+  // --- Android / mobile dev ---
+  "adb",
+  "fastboot",
+  "sdkmanager",
+  // --- DevOps / config mgmt ---
+  "ansible",
+  "ansible-playbook",
+  "ansible-vault",
+  "ansible-lint",
+  "ansible-galaxy",
+  "molecule",
+  // --- Cloud CLIs ---
+  "aws",
+  "aws-vault",
+  "awslocal",
+  "az",
+  "azcopy",
+  "gcloud",
+  "gsutil",
+  "doctl",
+  "linode-cli",
+  // --- Native / C / C++ / linker tools ---
+  "clang++",
+  "clang-format",
+  "clang-tidy",
+  "clangd",
+  "lld",
+  "lldb",
+  "ctest",
+  "gmake",
+  "meson",
+  "conan",
+  "vcpkg",
+  "cl",
+  "rc",
+  "mt",
+  "dumpbin",
+  "dotnet-format",
+  // --- Image / media / binary tools ---
+  "convert",
+  "ffmpeg",
+  "ffprobe",
+  "magick",
+  "gs",
+  "exiftool",
+  // --- HTTP / fetch ---
+  "wget2",
+  "aria2c",
+  "axel",
+  "httpie",
+  "hey",
+  "ab",
+  "wrk",
+  "http",
+  // --- Diff / patch / merge ---
+  "diff",
+  "diff3",
+  "patch",
+  "meld",
+  "kdiff3",
+  "kompare",
+  // --- Encoding / file inspection ---
+  "dos2unix",
+  "unix2dos",
+  "iconv",
+  "file",
+  "stat",
+  "xxd",
+  "hexdump",
+  "od",
+  "base64",
+  // --- SSH / crypto / signing ---
+  "ssh",
+  "ssh-add",
+  "ssh-keygen",
+  "ssh-keyscan",
+  "scp",
+  "sftp",
+  "rsync",
+  "gpg",
+  "gpg2",
+  "gpg-agent",
+  "openssl",
+  "step",
+  "keytool",
+  // --- Search ---
+  "egrep",
+  "fgrep",
+  "ag",
+  "ack",
+  "sift",
+  "ugrep",
+  "fd",
+  "fdfind",
+  "jq",
+  "yq",
+  "xq",
+  "fx",
+  "gron",
+  // --- K8s / container ecosystem ---
+  "kubectl.exe",
+  "kubeadm",
+  "kubelet",
+  "helm",
+  "k9s",
+  "kustomize",
+  "skaffold",
+  "tilt",
+  "minikube",
+  "kind",
+  "k3d",
+  "k3s",
+  "docker-compose",
+  "buildah",
+  "skopeo",
+  "nerdctl",
+  "ctr",
+  "ctr.exe",
+  // --- Databases ---
+  "sqlite3",
+  "sqlite",
+  "psql",
+  "pg_dump",
+  "pg_restore",
+  "mysql",
+  "mysqladmin",
+  "mysqldump",
+  "mariadb",
+  "mariadb-dump",
+  "redis-cli",
+  "redis-server",
+  "memcached",
+  "etcdctl",
+  "consul",
+  "vault",
+  "nomad",
+  "mongosh",
+  "mongo",
+  "mongoexport",
+  "mongoimport",
+  "mongodump",
+  "mongorestore",
+  // --- Windows extended (read-mostly ops) ---
+  "taskkill",
+  "gpupdate",
+  "gpresult",
+  "hostname",
+  "whoami",
+  "who",
+  "net",
+  "net1",
+  // --- VCS ecosystem ---
+  "glab",
+  "hub",
+  "tea",
+  "git-lfs",
+  "tig",
+  "lazygit",
+  // --- POSIX text utilities (extended) ---
+  "gawk",
+  "tr",
+  "cut",
+  "paste",
+  "join",
+  "comm",
+  "expand",
+  "unexpand",
+  "fold",
+  "fmt",
+  "nl",
+  "pr",
+  "column",
+  "tsort",
+  "tty",
+  "ul",
+  "units",
+  "factor",
+  "seq",
+  "shuf",
+  "look",
+  "yes",
+  "true",
+  "false",
+  "test",
+  "[",
+  "printf",
+  "env",
+  "tree",
+  "locate",
+  "which",
+  "whereis",
+  // NOTE: shell builtins with no standalone binary (type, hash, pushd,
+  // popd, dirs, history, fc, jobs, bg, fg, wait, ulimit, umask, trap,
+  // exit, return, source, ., alias, unalias, set, unset, export, readonly,
+  // typeset, declare, local, eval, exec) are intentionally excluded —
+  // spawn() would fail with ENOENT on every platform because they only
+  // exist inside a shell process. Use the `bash` tool for builtins.
+  "nice",
+  "nohup",
+  "timeout",
+  "time",
+  // --- Process / system inspection ---
+  "htop",
+  "top",
+  "atop",
+  "glances",
+  "iotop",
+  "nethogs",
+  "iftop",
+  "lsof",
+  "strace",
+  "ltrace",
+  "sysstat",
+  "vmstat",
+  "iostat",
+  "mpstat",
+  "sar",
+  "free",
+  "df",
+  "du",
+  "mount",
+  "umount",
+  "lsblk",
+  "blkid",
+  "kill",
+  "killall",
+  "pkill",
+  "pgrep",
+  "pidof",
+  "ps",
+  "ps.exe",
+  // --- Network inspection ---
+  "ip",
+  "ss",
+  "route",
+  "arp",
+  "arping",
+  "ping",
+  "ping6",
+  "hping3",
+  "mtr",
+  "tracepath",
+  "tcpdump",
+  "nmap",
+  "netcat",
+  "nc",
+  "ncat",
+  "socat",
+  // --- Sync / backup ---
+  "rclone",
+  "restic",
+  "borg",
+  "duplicati",
+  "duplicacy",
+  "syncthing",
+  "syncthing-cli",
+  // --- Permissions / users / ACLs (POSIX) ---
+  "useradd",
+  "userdel",
+  "usermod",
+  "groupadd",
+  "groupdel",
+  "groupmod",
+  "chown",
+  "chmod",
+  "chgrp",
+  "getfacl",
+  "setfacl",
+  "setcap",
+  "getcap",
+  // --- Crypto / cert mgmt (extended) ---
+  "certbot",
+  "mkcert",
+  "jarsigner",
+  // --- Editors ---
+  "subl",
+  "code",
+  "code-insiders",
+  "cursor",
+  "atom",
+  "nano",
+  "vim",
+  "nvim",
+  "vi",
+  "emacs",
+  "helix",
+  "hx",
+  "micro",
+  "jed",
+  "ed",
+  "ex",
+  "mg",
+  // --- Terminal multiplexers ---
+  "asciinema",
+  "script",
+  "scriptreplay",
+  "expect",
+  "screen",
+  "tmux",
+  "byobu",
+  "dtach",
+  "abduco",
+  // --- Calculators / REPLs / scientific ---
+  "bc",
+  "dc",
+  "calc",
+  "qalc",
+  "genius",
+  "octave",
+  "R",
+  "Rscript",
+  "julia",
+  "irb",
+  "pry",
+  "ghci",
+  "stack",
+  "cabal",
+  "ghc",
+  // --- PHP / Lua / Perl / Ruby ecosystem (extended) ---
+  "php8",
+  "php7",
+  "phpcs",
+  "phpcbf",
+  "phpmd",
+  "phpstan",
+  "psalm",
+  "lua",
+  "lua5.1",
+  "lua5.2",
+  "lua5.3",
+  "lua5.4",
+  "luarocks",
+  "perl",
+  "cpan",
+  "prove",
+  "plackup",
+  "rake",
+  "rspec",
+  "jekyll",
+  "node-gyp",
+  "node-pre-gyp",
+  // --- JS / TS toolchain (extended) ---
+  "electron",
+  "electron-builder",
+  "electron-forge",
+  "vite-preview",
+  "swc",
+  "swc-cli",
+  "swcpack",
+  "mocha",
+  "chai",
+  "jasmine",
+  "puppeteer",
+  "lighthouse",
+  // --- Linters / formatters (extended) ---
+  "tslint",
+  "stylelint",
+  "htmlhint",
+  "jshint",
+  "jslint",
+  "jscs",
+  // --- Document conversion ---
+  "pandoc",
+  "weasyprint",
+  "wkhtmltopdf",
+  "wkhtmltoimage",
+  "prince",
+  "mdp",
+  "markdown",
+  "multimarkdown",
+  "cmark",
+  "cmark-gfm",
+  // --- Office / spreadsheet ---
+  "soffice",
+  "libreoffice",
+  "unoconv",
+  "abiword",
+  "gnumeric",
+  // --- Spell / grammar ---
+  "aspell",
+  "hunspell",
+  "enchant",
+  "languagetool",
+  // --- Source-highlight / diff tools ---
+  "delta",
+  "bat",
+  "ccat",
+  "hl",
+  "highlight",
+  "source-highlight",
+  "ansifilter",
+  // --- Job schedulers ---
+  "pueue",
+  "task-spooler",
+  "ts",
+  "at",
+  "atd",
+  "anacron",
+  "fcron",
+  "cronie",
+  "systemd-run",
+  "systemd-cat",
+  // --- Plotting / visualization ---
+  "gnuplot",
+  "gnuplot-nox",
+  "veusz",
+  "scidavis",
+  "grace",
+  "xmgrace",
+  "labplot",
+  // --- Security / recon (network + web) ---
+  "masscan",
+  "zmap",
+  "rustscan",
+  "amass",
+  "subfinder",
+  "httpx",
+  "nuclei",
+  "naabu",
+  "katana",
+  "dnsx",
+  "assetfinder",
+  "findomain",
+  "gau",
+  "waybackurls",
+  "httprobe",
+  "meg",
+  "subjack",
+  "sublert",
+  "chaos"
+]);
+
+// src/exec.ts
+var isWin2 = process.platform === "win32";
+var allowedCommands = new Set(DEFAULT_ALLOWED_COMMANDS);
+var normalizeCmd = (c) => c.trim();
+function configureExecPolicy(opts = {}) {
+  const next = new Set(DEFAULT_ALLOWED_COMMANDS);
+  for (const c of opts.allow ?? []) {
+    const n = normalizeCmd(c);
+    if (n) next.add(n);
+  }
+  for (const c of opts.deny ?? []) next.delete(normalizeCmd(c));
+  allowedCommands = next;
+}
+function resetExecPolicy() {
+  allowedCommands = new Set(DEFAULT_ALLOWED_COMMANDS);
+}
+var dangerBypass = /* @__PURE__ */ new Set();
+function configureDangerBypass(opts = {}) {
+  const next = /* @__PURE__ */ new Set();
+  for (const id of opts.bypass ?? []) {
+    const trimmed = id.trim();
+    if (trimmed) next.add(trimmed);
+  }
+  dangerBypass = next;
+}
+function resetDangerBypass() {
+  dangerBypass = /* @__PURE__ */ new Set();
+}
+function getDangerBypass() {
+  return dangerBypass;
+}
+function isExecCommandAllowed(cmd) {
+  return allowedCommands.has(normalizeCmd(cmd));
+}
+function getExecAllowlist() {
+  return [...allowedCommands].sort();
+}
+var MAX_ARGS = 20;
+var MAX_OUTPUT = 2e5;
+var DEFAULT_TIMEOUT_MS = 3e4;
+var MAX_TIMEOUT_MS = 6e5;
+var BLOCKED_ARG_PATTERNS = {
+  python: [],
+  // git --exec=<cmd> runs arbitrary commands via upload-pack/receive-pack;
+  // -C <dir> changes working directory, bypassing cwd sandbox;
+  // -c/--config <k>=<v> injects config that runs commands
+  // (e.g. core.sshCommand, core.pager, http.proxy, alias.x=!cmd).
+  git: [
+    /^--exec=/,
+    /^--upload-pack=/,
+    /^--receive-pack=/,
+    /^-C$/,
+    /^-c$/,
+    /^--config$/,
+    /^-c=/,
+    /^--config=/,
+    /^--config-env=/
+  ],
+  node: [],
+  go: [],
+  bun: [],
+  docker: [],
+  // find -exec/-ok/-execdir execute arbitrary commands
+  find: [
+    /^-exec$/,
+    /^-exec;$/,
+    /^-ok$/,
+    /^-ok;$/,
+    /^-execdir$/,
+    /^-execdir;$/,
+    /^-exec=/,
+    /^-ok=/,
+    /^-execdir=/
+  ],
+  // rm -rf / is catastrophic — block absolute paths, home, dot-dirs,
+  // and glob patterns that could expand to dangerous targets.
+  // `rm -rf ./src/*` expands to project files; `rm -rf ../../` escapes upward;
+  // `rm -rf /*` targets the filesystem root. All are blocked.
+  rm: [/^\//, /^[A-Za-z]:[\\/]/, /^~\//, /^~$/, /^\.$/, /^\.\.$/, /\*$/, /\/$/, /\/\*$/, /\.\//],
+  // npm/pnpm subcommands are checked separately below. Matching every arg here
+  // over-blocked normal dev flows such as `pnpm vitest run ...`.
+  npm: [],
+  pnpm: [],
+  npx: []
+};
+var BLOCKED_OPTION_NAMES = {
+  git: /* @__PURE__ */ new Set([
+    "--exec",
+    "--upload-pack",
+    "--receive-pack",
+    "--exec-path",
+    "--git-dir",
+    "--work-tree",
+    "--namespace",
+    "-c",
+    "--config",
+    "--config-env",
+    "-C"
+  ]),
+  find: /* @__PURE__ */ new Set(["-exec", "-ok", "-execdir"])
+};
+function optionName(arg) {
+  const eq = arg.indexOf("=");
+  return eq > 0 ? arg.slice(0, eq) : arg;
+}
+var BLOCKED_SUBCOMMANDS = {
+  docker: /* @__PURE__ */ new Set(["push"]),
+  podman: /* @__PURE__ */ new Set(["push"]),
+  npm: /* @__PURE__ */ new Set(["publish", "deploy"]),
+  pnpm: /* @__PURE__ */ new Set(["publish", "deploy"]),
+  yarn: /* @__PURE__ */ new Set(["publish"])
+};
+var BLOCKED_SUBCOMMAND_SEQUENCES = {
+  yarn: [["npm", "publish"]]
+};
+function firstSubcommand(args) {
+  for (const arg of args) {
+    if (arg === "--") return null;
+    if (!arg.startsWith("-")) return arg;
+  }
+  return null;
+}
+function subcommandArgs(args) {
+  const out = [];
+  for (const arg of args) {
+    if (arg === "--") break;
+    if (!arg.startsWith("-")) out.push(arg);
+  }
+  return out;
+}
+function validateArgs(cmd, args) {
+  const blockedSubcommands = BLOCKED_SUBCOMMANDS[cmd];
+  const subcommand = firstSubcommand(args);
+  if (blockedSubcommands && subcommand && blockedSubcommands.has(subcommand)) {
+    return `Blocked subcommand "${subcommand}" for command "${cmd}"`;
+  }
+  const blockedSequences = BLOCKED_SUBCOMMAND_SEQUENCES[cmd];
+  if (blockedSequences) {
+    const actual = subcommandArgs(args);
+    const blocked2 = blockedSequences.find((seq) => seq.every((part, idx) => actual[idx] === part));
+    if (blocked2) return `Blocked subcommand "${blocked2.join(" ")}" for command "${cmd}"`;
+  }
+  const blockedOptions = BLOCKED_OPTION_NAMES[cmd];
+  if (blockedOptions) {
+    for (const arg of args) {
+      if (arg === "--") break;
+      if (blockedOptions.has(optionName(arg))) {
+        return `Blocked option "${optionName(arg)}" for command "${cmd}"`;
+      }
+    }
+  }
+  const blocked = BLOCKED_ARG_PATTERNS[cmd];
+  if (!blocked) return null;
+  for (const arg of args) {
+    for (const pattern of blocked) {
+      if (pattern.test(arg)) {
+        return `Blocked argument "${arg}" for command "${cmd}" (matches security pattern ${pattern})`;
+      }
+    }
+  }
+  return null;
+}
+var SAFE_DANGER = { level: "safe", reasons: [] };
+var execTool = {
+  name: "exec",
+  category: "Shell",
+  description: "Execute a command from a **curated command roster** with argument validation and confirm gating. This is the **preferred** alternative to the `bash` tool for running development tools (node, npm, pnpm, tsc, git, tests, linters, etc.). It is NOT a sandbox \u2014 several rostered commands (node, python, powershell, \u2026) can run arbitrary code \u2014 so prefer least-privilege commands.",
+  usageHint: "PREFERRED SHELL TOOL for most cases.\n\nUse this instead of `bash` whenever possible.\n- `command` must be in the allowlist. Defaults cover JS (node/npm/pnpm/yarn/bun/deno/tsc/vitest/eslint/biome), Go (`go build`/`go test`), Rust (cargo), Python (python/pip), Ruby (gem/bundle), JVM (java/mvn/gradle), .NET (dotnet), native (make/cmake), and git. Users can extend it via `tools.exec.allow` in config.\n- Arguments are passed as a clean array (no shell interpretation).\n- `cwd` is validated to stay inside the project.\n- If a command is not allowlisted, the error explains how to add it; for one-off arbitrary commands, fall back to `bash` (with strong justification).\nThe curated roster + confirm gating narrows the surface compared to full shell access, but this is not a sandbox \u2014 prefer least-privilege commands.",
+  selection: {
+    doNotUseWhen: "the operation requires pipes, redirection, shell expansion, or a non-allowlisted command.",
+    useInstead: ["bash"]
+  },
+  permission: "confirm",
+  // WS-046: without this, every exec call collapsed onto the bare tool name.
+  // Three consequences followed: "always allow" stored a rule that could never
+  // match, pressing "no" once blocked ALL exec for the session, and the
+  // permission cache keyed one decision for every command. `subjectKey:
+  // 'command'` renders the FULL invocation (`command` + `args`) — using the
+  // program alone would make `exec git status` and `exec git push --force` the
+  // same subject, so trusting one would silently authorize the other.
+  subjectKey: "command",
+  mutating: true,
+  riskTier: "standard",
+  // Executor-level abort ceiling. Must sit ABOVE the per-call timeout ceiling
+  // (MAX_TIMEOUT_MS): the tool's own timer resolves with exit 124 + registry
+  // tree-kill; the executor's AbortSignal.timeout is a blunt abort that would
+  // otherwise fire first and discard the structured timeout result. The 10s
+  // margin covers the kill/teardown window. (The executor additionally clamps
+  // to config `tools.maxToolTimeoutMs`.)
+  timeoutMs: MAX_TIMEOUT_MS + 1e4,
+  capabilities: ["shell.restricted"],
+  icon: "terminal",
+  inputSchema: {
+    type: "object",
+    properties: {
+      command: {
+        type: "string",
+        description: 'The base command to run. Must be in the internal allowlist (e.g. "node", "pnpm", "git", "tsc").'
+      },
+      args: {
+        type: "array",
+        items: { type: "string" },
+        description: "Arguments passed to the command. Passed as an array (no shell parsing)."
+      },
+      cwd: {
+        type: "string",
+        description: "Optional working directory. Must resolve inside the project root."
+      },
+      timeout: {
+        type: "integer",
+        description: "Per-command timeout in milliseconds (default 30000, max 600000)."
+      }
+    },
+    required: ["command"]
+  },
+  async execute(input, ctx, opts) {
+    const registry = getProcessRegistry();
+    if (!registry.canProceed) {
+      return {
+        command: input.command,
+        args: input.args ?? [],
+        stdout: "",
+        stderr: "Circuit breaker is open \u2014 too many consecutive failures. Use /kill reset to recover.",
+        exitCode: 1,
+        truncated: false,
+        allowed: false,
+        danger: SAFE_DANGER
+      };
+    }
+    const cmd = input.command.trim();
+    if (!cmd)
+      return {
+        command: cmd,
+        args: [],
+        stdout: "",
+        stderr: "Empty command",
+        exitCode: 1,
+        truncated: false,
+        allowed: false,
+        danger: SAFE_DANGER
+      };
+    if (!isExecCommandAllowed(cmd)) {
+      return {
+        command: cmd,
+        args: input.args ?? [],
+        stdout: "",
+        stderr: `Command "${cmd}" not in allowlist. Add it to your active profile config (~/.wrongstack/profiles/<name>/config.json) under "tools": { "exec": { "allow": ["${cmd}"] } }, or use the bash tool for one-off arbitrary commands.`,
+        exitCode: 1,
+        truncated: false,
+        allowed: false,
+        danger: SAFE_DANGER
+      };
+    }
+    const args = (input.args ?? []).slice(0, MAX_ARGS);
+    const timeout = Math.max(1, Math.min(input.timeout ?? DEFAULT_TIMEOUT_MS, MAX_TIMEOUT_MS));
+    const danger = detectDanger(cmd, args, dangerBypass);
+    const killCheck = await checkExecKillCommand(cmd, args);
+    if (killCheck.blocked) {
+      return {
+        command: cmd,
+        args,
+        stdout: "",
+        stderr: killCheck.reason ?? "Kill command blocked: targets a protected WrongStack process.",
+        exitCode: 1,
+        truncated: false,
+        allowed: false,
+        danger
+      };
+    }
+    const argError = validateArgs(cmd, args);
+    if (argError) {
+      return {
+        command: cmd,
+        args,
+        stdout: "",
+        stderr: argError,
+        exitCode: 1,
+        truncated: false,
+        allowed: false,
+        danger
+      };
+    }
+    const defaultCwd = ctx.workingDir ?? ctx.cwd;
+    let cwd;
+    try {
+      cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : await safeResolveReal(defaultCwd, ctx);
+    } catch {
+      return {
+        command: cmd,
+        args,
+        stdout: "",
+        stderr: `cwd "${input.cwd ?? defaultCwd}" resolves outside project root`,
+        exitCode: 1,
+        truncated: false,
+        allowed: false,
+        danger
+      };
+    }
+    const signal = opts.signal;
+    return runCommand(cmd, args, cwd, timeout, signal, ctx.session?.id, danger);
+  }
+};
+function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
+  return new Promise((resolve) => {
+    let stdout = "";
+    let stderr = "";
+    let killed = false;
+    const resolvedOnce = { value: false };
+    const finish = (result) => {
+      if (resolvedOnce.value) return;
+      resolvedOnce.value = true;
+      resolve(result);
+    };
+    const startedAt = Date.now();
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    let telemetryCompleted = false;
+    let timedOut = false;
+    const spool = createOutputSpool({ tool: `exec-${cmd}`, thresholdBytes: MAX_OUTPUT });
+    const resolved = resolveWin32Command(cmd);
+    const needsShell = isWin2 && (resolved.endsWith(".cmd") || resolved.endsWith(".bat"));
+    const shim = needsShell ? buildWin32CmdShimInvocation(resolved, args) : null;
+    const spawnCmd = shim?.command ?? resolved;
+    const spawnArgs = shim?.args ?? args;
+    const emitCompletedOnce = (exitCode, pid2, signal2) => {
+      if (telemetryCompleted) return;
+      telemetryCompleted = true;
+      emitProcessCompleted({
+        ...pid2 !== void 0 ? { pid: pid2 } : {},
+        exitCode,
+        ...signal2 ? { signal: signal2 } : {},
+        durationMs: Date.now() - startedAt,
+        stdoutBytes,
+        stderrBytes,
+        timedOut,
+        endedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    };
+    let child;
+    try {
+      child = spawn(spawnCmd, spawnArgs, {
+        cwd,
+        env: buildChildEnv(sessionId),
+        stdio: ["ignore", "pipe", "pipe"],
+        windowsHide: true,
+        ...isWin2 ? {} : { signal },
+        ...shim ? { windowsVerbatimArguments: shim.windowsVerbatimArguments } : {}
+      });
+    } catch (err) {
+      spool.finalize();
+      emitProcessStarted({
+        parentPid: process.pid,
+        command: redactCommand(`${cmd} ${args.join(" ")}`),
+        args: redactCommand(args.join(" ")).split(" ").filter(Boolean),
+        cwd,
+        background: false,
+        startedAt: new Date(startedAt).toISOString()
+      });
+      emitCompletedOnce(1, void 0);
+      finish({
+        command: cmd,
+        args,
+        stdout: "",
+        stderr: `spawn failed: ${toErrorMessage(err)}`,
+        exitCode: 1,
+        truncated: false,
+        allowed: true,
+        danger
+      });
+      return;
+    }
+    emitProcessStarted({
+      ...child.pid !== void 0 ? { pid: child.pid } : {},
+      parentPid: process.pid,
+      command: redactCommand(`${cmd} ${args.join(" ")}`),
+      args: redactCommand(args.join(" ")).split(" ").filter(Boolean),
+      cwd,
+      background: false,
+      startedAt: new Date(startedAt).toISOString()
+    });
+    child.on("error", (err) => {
+      const isAbort = err && err.code === "ABORT_ERR";
+      const stderrText = isAbort ? `Aborted: ${err.message}` : err.message;
+      clearTimeout(timer);
+      if (isWin2) signal.removeEventListener("abort", onAbort);
+      if (typeof pid === "number") registry.unregister(pid);
+      registry.afterCall(Date.now() - startedAt, true);
+      spool.finalize();
+      emitCompletedOnce(isAbort ? 124 : 1, child.pid, isAbort ? "ABORT" : void 0);
+      finish({
+        command: cmd,
+        args,
+        stdout: normalizeCommandOutput(stdout),
+        stderr: stderrText,
+        exitCode: isAbort ? 124 : 1,
+        truncated: Buffer.byteLength(stdout, "utf8") > COMMAND_OUTPUT_MAX_BYTES,
+        allowed: true,
+        danger
+      });
+    });
+    const registry = getProcessRegistry();
+    const pid = child.pid;
+    if (typeof pid === "number") {
+      const fullCommand = `${cmd} ${args.join(" ")}`;
+      registry.register({
+        pid,
+        name: "exec",
+        command: redactCommand(fullCommand),
+        startedAt: Date.now(),
+        sessionId,
+        child
+      });
+    }
+    const timer = setTimeout(() => {
+      killed = true;
+      timedOut = true;
+      if (typeof pid === "number") registry.kill(pid);
+      else child.kill("SIGTERM");
+    }, timeout);
+    const onAbort = () => {
+      killed = true;
+      if (typeof pid === "number") registry.kill(pid, { force: true });
+      else child.kill("SIGTERM");
+    };
+    if (isWin2) {
+      if (signal.aborted) onAbort();
+      else signal.addEventListener("abort", onAbort, { once: true });
+    }
+    child.stdout?.on("data", (chunk) => {
+      const text = chunk.toString();
+      stdoutBytes += chunk.byteLength;
+      emitProcessOutput({ pid, stream: "stdout", chunk });
+      if (stdout.length < MAX_OUTPUT) stdout += text;
+      spool.write(text);
+    });
+    child.stderr?.on("data", (chunk) => {
+      const text = chunk.toString();
+      stderrBytes += chunk.byteLength;
+      emitProcessOutput({ pid, stream: "stderr", chunk });
+      if (stderr.length < MAX_OUTPUT) stderr += text;
+      spool.write(text);
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      if (isWin2) signal.removeEventListener("abort", onAbort);
+      if (typeof pid === "number") registry.unregister(pid);
+      const durationMs = Date.now() - startedAt;
+      const exitCode = killed ? 124 : code ?? 1;
+      emitCompletedOnce(exitCode, pid);
+      registry.afterCall(durationMs, exitCode !== 0);
+      const spooled = spool.finalize();
+      finish({
+        command: cmd,
+        args,
+        stdout: normalizeCommandOutput(stdout) + (spooled ? spoolNote(spooled) : ""),
+        stderr: normalizeCommandOutput(stderr),
+        exitCode,
+        truncated: Buffer.byteLength(stdout, "utf8") > COMMAND_OUTPUT_MAX_BYTES || Buffer.byteLength(stderr, "utf8") > COMMAND_OUTPUT_MAX_BYTES,
+        allowed: true,
+        danger
+      });
+    });
+  });
+}
+
+export {
+  detectDanger,
+  checkExecKillCommand,
+  configureExecPolicy,
+  resetExecPolicy,
+  configureDangerBypass,
+  resetDangerBypass,
+  getDangerBypass,
+  isExecCommandAllowed,
+  getExecAllowlist,
+  execTool
+};
+//# sourceMappingURL=chunk-HXSBQ2SE.js.map