@wrongstack/tools 0.313.0 → 0.316.1

package/dist/chunk-IVWV2UM6.js

@@ -0,0 +1,955 @@
+import {
+  buildChildEnv
+} from "./chunk-BTSFTGIL.js";
+import {
+  getPersistentProcessRegistry
+} from "./chunk-NKNOBUBU.js";
+import {
+  createOutputSpool,
+  spoolNote
+} from "./chunk-2VSZC6QM.js";
+import {
+  getProcessRegistry,
+  redactCommand
+} from "./chunk-3PVYQFRQ.js";
+import {
+  resolvePowerShell
+} from "./chunk-V43EQ6VR.js";
+import {
+  normalizeCommandOutput
+} from "./chunk-D33S4RQG.js";
+
+// src/bash.ts
+import { spawn } from "node:child_process";
+import * as os2 from "node:os";
+import { StringDecoder } from "node:string_decoder";
+import {
+  emitProcessCompleted,
+  emitProcessOutput,
+  emitProcessStarted
+} from "@wrongstack/core/observability";
+
+// src/_shell-pick.ts
+var POSIX_DEFAULT = "cmd";
+function pickShell(platform3, command, env) {
+  if (platform3 !== "win32") return POSIX_DEFAULT;
+  const override = env.get("WRONGSTACK_SHELL")?.trim().toLowerCase();
+  if (override === "cmd" || override === "cmd.exe") return "cmd";
+  if (override === "powershell" || override === "powershell.exe") return "powershell";
+  if (override === "pwsh" || override === "pwsh.exe") return "pwsh";
+  if (looksLikePowerShell(command)) return "pwsh";
+  return "cmd";
+}
+function looksLikePowerShell(command) {
+  if (!command) return false;
+  const trimmed = command.trimStart();
+  if (/\.ps1\b/i.test(trimmed)) return true;
+  if (/^\s*#requires\s/i.test(trimmed)) return true;
+  if (/^\s*param\s*\(/i.test(trimmed)) return true;
+  if (/\$[\w:{]/i.test(trimmed)) return true;
+  if (/\$\(/.test(trimmed)) return true;
+  if (/@\s*['"]/.test(trimmed)) return true;
+  if (/&\s+\$/.test(trimmed)) return true;
+  if (/(^|\s)@\s*\(/.test(trimmed)) return true;
+  if (/(^|\s)@\{/.test(trimmed)) return true;
+  if (/(?:^|[\s[({,;])(?:-eq|-ne|-lt|-gt|-le|-ge|-like|-notlike|-match|-notmatch|-contains|-notcontains|-in|-notin|-and|-or|-not|-band|-bor|-bxor|-replace|-isplit|-csplit|-osplit|-join|-is|-as|-f)(?:$|[\s\])},;])/i.test(
+    trimmed
+  )) {
+    return true;
+  }
+  if (PS_VERB_RE.test(trimmed)) return true;
+  if (/(?:^|[\s;&|])(gci|gi|gp|gcm|gps)\b/i.test(trimmed)) {
+    return true;
+  }
+  if (looksLikePowerShellExtended(command)) return true;
+  return false;
+}
+function looksLikePowerShellExtended(command) {
+  if (!command) return false;
+  const trimmed = command.trimStart();
+  if (/(?:^|\s)[-/](?:WhatIf|Confirm|ErrorAction)(?::[^\s]+|\s|=|$)/i.test(trimmed)) {
+    return true;
+  }
+  if (/(?:^|[\s;&|])(Where-Object|ForEach-Object|Select-Object|Sort-Object|Group-Object|Measure-Object|Compare-Object|Tee-Object)(?:\s|$)/i.test(
+    trimmed
+  )) {
+    return true;
+  }
+  if (/\bWrite-(?:Host|Output|Error|Warning|Verbose|Debug|Information)(?:\s|$)/i.test(trimmed)) {
+    return true;
+  }
+  if (/HK(?:LM|CU|CR|U|CC|DD|PD):\\/i.test(trimmed)) return true;
+  if (/\[(?:string|int|bool|xml|double|float|decimal|char|byte|long|System\.)/i.test(trimmed)) {
+    return true;
+  }
+  if (/^\s*<#|#>\s*$/m.test(trimmed)) return true;
+  if (/(?:^|\s)[-//](?:AsPlainText|PipelineVariable|pv|FilterHashtable|OutVariable|ov)(?:\s|=|$)/i.test(
+    trimmed
+  )) {
+    return true;
+  }
+  return false;
+}
+function wrapPowerShellScript(command) {
+  const bootstrap = "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8;$ConfirmPreference='None';$WhatIfPreference=$false";
+  return bootstrap + "\n$ErrorActionPreference='Stop'\n" + command + "\nif ($LASTEXITCODE -is [int]) { exit $LASTEXITCODE }";
+}
+var PS_VERB_RE = new RegExp(
+  // Boundaries: start-of-string, whitespace, `;`, `&`, `|`, `(`, `{`, `,`.
+  "(?:^|[\\s;&|\\(\\{,])(?:Get|Set|New|Remove|Add|Clear|Copy|Move|Rename|Test|Update|Write|Read|Push|Pop|Invoke|Start|Stop|Wait|Out|Format|Group|Measure|Compare|Resolve|ConvertTo|ConvertFrom|Convert|Import|Export|Select|Where|ForEach|Sort|Tee|Split|Join|Limit|Skip|Step|Trace|Debug|Register|Unregister|Enable|Disable|Restart|Suspend|Resume|Save|Open|Close|Lock|Unlock|Mount|Dismount|Enter|Exit|Use|Show|Hide|Find|Search|Watch|Initialize|Optimize|Compress|Expand|Merge|Checkpoint|Undo|Redo|Approve|Deny|Block|Grant|Revoke|Assert|Confirm|Receive|Send|Connect|Disconnect|Reset|Backup|Restore|Publish|Unpublish|Install|Uninstall|Build|Rebuild|Deploy|Submit|Process|Complete|Approve|Revoke|Pay|Refund|Decline|Receive|Send)-[A-Za-z][A-Za-z0-9]+(?:[\\-\\+][A-Za-z][A-Za-z0-9]+)*(?:$|[\\s\\-\\;\\&\\|\\(\\)\\{\\},])",
+  "i"
+);
+function shellArgs(shell) {
+  if (shell === "powershell" || shell === "pwsh") {
+    return ["-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand"];
+  }
+  return ["/c"];
+}
+function diagnoseBashism(command, shell) {
+  if (!command) return void 0;
+  const isCmd = shell === "cmd";
+  const hints = [];
+  const add = (h) => {
+    if (!hints.includes(h)) hints.push(h);
+  };
+  if (/\/dev\/null/.test(command)) {
+    add(
+      isCmd ? "use `nul` instead of `/dev/null` (e.g. `2>nul`)" : "use `$null` instead of `/dev/null` (e.g. `2>$null`)"
+    );
+  }
+  if (/(^|[;&|]\s*)export\s+[A-Za-z_]\w*=/.test(command)) {
+    add(
+      isCmd ? "set env vars with `set NAME=value`, not `export`" : "set env vars with `$env:NAME = 'value'`, not `export`"
+    );
+  }
+  if (/<<-?\s*['"]?[A-Za-z_]\w*/.test(command)) {
+    add(
+      isCmd ? "cmd has no heredocs \u2014 write the content to a file or use multiple `echo` lines" : "PowerShell has no heredocs \u2014 use a single-quoted here-string `@'\u2026'@` (closing `'@` at column 0)"
+    );
+  }
+  if (shell === "powershell" && /(&&|\|\|)/.test(command)) {
+    add(
+      "Windows PowerShell 5.1 has no `&&`/`||` \u2014 separate commands with `;` (check `$LASTEXITCODE`)"
+    );
+  }
+  if (/\brm\s+-[A-Za-z]*[rf]/.test(command)) {
+    add(
+      isCmd ? "`rm` is not a cmd builtin \u2014 use `del` (files) or `rmdir /s /q` (dirs)" : "use `Remove-Item -Recurse -Force` \u2014 the `rm -rf` bash flags don't exist in PowerShell"
+    );
+  }
+  if (/\bwhich\s+\S/.test(command)) {
+    add(
+      isCmd ? "use `where <cmd>` instead of `which`" : "use `Get-Command <cmd>` instead of `which`"
+    );
+  }
+  if (hints.length === 0) return void 0;
+  const label = isCmd ? "cmd.exe" : shell === "pwsh" ? "PowerShell 7" : "Windows PowerShell";
+  return `[wrongstack] This command failed and contains bash/POSIX syntax that ${label} does not accept \u2014 ${hints.join("; ")}. Rewrite it in ${isCmd ? "cmd" : "PowerShell"} syntax and retry.`;
+}
+
+// src/bash-kill-guard.ts
+import * as os from "node:os";
+var isWin = os.platform() === "win32";
+var SCRIPT_KILL_RE = /^(?:\.\\|\.\/)?(?:kill|terminate|stop)\S*\.(?:ps1|bat|cmd|sh)(?:\s|$)/i;
+var SCRIPT_KILL_RE_POSIX = /^(?:\.\/)?(?:kill|terminate|stop)\S*\.sh(?:\s|$)/i;
+var SCRIPT_KILL_FALLBACK_RE = /^\S*(?:kill|terminate|stop)\S*\.(?:ps1|bat|cmd|sh)\b/i;
+function extractKillCommand(command) {
+  const normalized = command.replace(/\s+/g, " ").trim();
+  const shellCMatch = normalized.match(/^.+?\s+-c\s+(['"])([\s\S]+)\1$/);
+  if (shellCMatch?.[2]) {
+    const inner = shellCMatch[2].trim();
+    return isKillRelatedCommand(inner) ? inner : null;
+  }
+  const shellCUnquoted = normalized.match(
+    /^.+?\s+-c\s+(kill(?:\s+-s\s+[a-zA-Z0-9]+|\s+-[a-zA-Z0-9]+)?\s+\d+)$/
+  );
+  if (shellCUnquoted?.[1]) {
+    return shellCUnquoted[1];
+  }
+  return null;
+}
+function isKillRelatedCommand(cmd) {
+  const normalized = cmd.toLowerCase().replace(/\s+/g, " ").trim();
+  if (isWin) {
+    if (/^taskkill\s/i.test(normalized)) return true;
+    if (/^tskill\s/i.test(normalized)) return true;
+    if (/^(stop-process|kill|stop)\s/i.test(normalized)) return true;
+    if (/^wmic\s+process\s/i.test(normalized) && /\bdelete\b/i.test(normalized)) return true;
+    if (SCRIPT_KILL_RE.test(normalized)) return true;
+    return false;
+  }
+  if (/^kill(\s|$)/.test(normalized)) return true;
+  if (/^(pkill|killall|pgrep|skill)\s/.test(normalized)) return true;
+  if (/^\/proc\/\d+\/(?:kill|fd)/.test(normalized)) return true;
+  if (SCRIPT_KILL_RE_POSIX.test(normalized)) return true;
+  return false;
+}
+function parseKillCommand(command) {
+  const normalized = command.replace(/\s+/g, " ").trim();
+  if (isWin) {
+    const hasTaskkillForce = /(?:^|\s)\/F(?=\s|$)/i.test(normalized);
+    const isSimpleTaskkill = /^taskkill\s+/i.test(normalized) && !/[|&<>]/.test(normalized);
+    const taskkillPidMatch = isSimpleTaskkill ? normalized.match(/(?:^|\s)\/PID\s+(\d+)(?=\s|$)/i) : null;
+    if (taskkillPidMatch?.[1]) {
+      return {
+        pid: parseInt(taskkillPidMatch[1], 10),
+        signal: hasTaskkillForce ? "FORCE" : "TERM",
+        isGroupKill: false,
+        isAllKill: false,
+        originalCommand: command
+      };
+    }
+    const taskkillImMatch = isSimpleTaskkill ? normalized.match(/(?:^|\s)\/IM\s+([^\s/]+)(?=\s|$)/i) : null;
+    if (taskkillImMatch?.[1]) {
+      return {
+        name: taskkillImMatch[1],
+        signal: hasTaskkillForce ? "FORCE" : "TERM",
+        isGroupKill: false,
+        isAllKill: false,
+        originalCommand: command
+      };
+    }
+    const taskkillFiMatch = isSimpleTaskkill ? normalized.match(/(?:^|\s)\/FI\s+"IMAGENAME\s+eq\s+([^"]+)"(?=\s|$)/i) : null;
+    if (taskkillFiMatch?.[1]) {
+      return {
+        name: taskkillFiMatch[1],
+        signal: hasTaskkillForce ? "FORCE" : "TERM",
+        isGroupKill: false,
+        isAllKill: false,
+        originalCommand: command
+      };
+    }
+    const tskillMatch = normalized.match(/^tskill\s+(\d+)/i);
+    if (tskillMatch?.[1]) {
+      return {
+        pid: parseInt(tskillMatch[1], 10),
+        signal: "TERM",
+        isGroupKill: false,
+        isAllKill: false,
+        originalCommand: command
+      };
+    }
+    const isStopProcIdCommand = /^(?:stop-process|kill)(?:\s+-(?:id|pid)\s+\d+|\s+-[a-zA-Z]+)+$/i.test(normalized);
+    const stopProcIdMatch = normalized.match(/(?:^|\s)-(?:id|pid)\s+(\d+)(?=\s|$)/i);
+    if (isStopProcIdCommand && stopProcIdMatch?.[1]) {
+      return {
+        pid: parseInt(stopProcIdMatch[1], 10),
+        signal: "FORCE",
+        isGroupKill: false,
+        isAllKill: false,
+        originalCommand: command
+      };
+    }
+    const killSignalOptionMatch = normalized.match(/^kill\s+-s\s+([a-zA-Z0-9]+)\s+(\d+)$/i);
+    if (killSignalOptionMatch?.[1] && killSignalOptionMatch[2]) {
+      return {
+        pid: parseInt(killSignalOptionMatch[2], 10),
+        signal: killSignalOptionMatch[1].toUpperCase(),
+        isGroupKill: false,
+        isAllKill: false,
+        originalCommand: command
+      };
+    }
+    const killPosixMatch = normalized.match(/^kill\s+(?:(-[a-zA-Z0-9]+)\s+)?(\d+)$/);
+    if (killPosixMatch?.[2]) {
+      const sig = killPosixMatch[1] ? killPosixMatch[1].slice(1).toUpperCase() : "TERM";
+      return {
+        pid: parseInt(killPosixMatch[2], 10),
+        signal: sig,
+        isGroupKill: false,
+        isAllKill: false,
+        originalCommand: command
+      };
+    }
+    const stopProcNameMatch = normalized.match(
+      /^(?:stop-process|kill)\s+-(?:name|n)\s+(?:['"]([a-zA-Z0-9_.-]+)['"]|([a-zA-Z0-9_.-]+))(?:\s|$)/i
+    );
+    const stopProcName = stopProcNameMatch?.[1] ?? stopProcNameMatch?.[2];
+    if (stopProcName) {
+      return {
+        name: stopProcName,
+        signal: "FORCE",
+        isGroupKill: false,
+        isAllKill: false,
+        originalCommand: command
+      };
+    }
+    const stopProcStandalone = normalized.match(
+      /^(?:stop-process|kill)\s+['"]?([a-zA-Z][a-zA-Z0-9_.-]+)['"]?$/i
+    );
+    if (stopProcStandalone?.[1]) {
+      return {
+        name: stopProcStandalone[1],
+        signal: "FORCE",
+        isGroupKill: false,
+        isAllKill: false,
+        originalCommand: command
+      };
+    }
+    const wmicMatch = normalized.match(
+      /^wmic\s+process\s+where\s+['"]?(?:name\s*=\s*['"]?)([a-zA-Z0-9_.-]+)/i
+    );
+    if (wmicMatch?.[1]) {
+      return {
+        name: wmicMatch[1],
+        signal: "FORCE",
+        isGroupKill: false,
+        isAllKill: false,
+        originalCommand: command
+      };
+    }
+    const wmicPidMatch = normalized.match(
+      /^wmic\s+process\s+where\s+['"]?processid\s*=\s*['"]?(\d+)/i
+    );
+    if (wmicPidMatch?.[1]) {
+      return {
+        pid: parseInt(wmicPidMatch[1], 10),
+        signal: "FORCE",
+        isGroupKill: false,
+        isAllKill: false,
+        originalCommand: command
+      };
+    }
+    const killScriptMatch = normalized.match(SCRIPT_KILL_RE);
+    if (killScriptMatch) {
+      return {
+        name: "kill-script",
+        // sentinel — isKillProtected always blocks "kill-script"
+        signal: "FORCE",
+        isGroupKill: false,
+        isAllKill: false,
+        originalCommand: command
+      };
+    }
+    return null;
+  }
+  const signalOptionMatch = normalized.match(/^kill\s+-s\s+([a-zA-Z0-9]+)\s+(\d+|-?\d+)$/i);
+  if (signalOptionMatch?.[1] && signalOptionMatch[2]) {
+    const pidOrGroup = signalOptionMatch[2];
+    const isGroupKill = pidOrGroup.startsWith("-");
+    return {
+      pid: parseInt(isGroupKill ? pidOrGroup.slice(1) : pidOrGroup, 10),
+      signal: signalOptionMatch[1].toUpperCase(),
+      isGroupKill,
+      isAllKill: false,
+      originalCommand: command
+    };
+  }
+  const simpleMatch = normalized.match(/^kill\s+(?:(-[a-zA-Z0-9]+)\s+)?(\d+|-?\d+)$/);
+  if (simpleMatch) {
+    const signal = simpleMatch[1] ?? "-TERM";
+    const pidOrGroup = simpleMatch[2];
+    if (!pidOrGroup) return null;
+    const isGroupKill = pidOrGroup.startsWith("-");
+    const pid = isGroupKill ? parseInt(pidOrGroup.slice(1), 10) : parseInt(pidOrGroup, 10);
+    return {
+      pid,
+      signal: signal.slice(1),
+      isGroupKill,
+      isAllKill: false,
+      originalCommand: command
+    };
+  }
+  const pkillMatch = normalized.match(/^pkill\s+(?:(-[a-zA-Z]+)\s+)?(.+)$/);
+  if (pkillMatch?.[2]) {
+    const name = pkillMatch[2];
+    const signalMatch = pkillMatch[1];
+    return {
+      name,
+      signal: signalMatch ? signalMatch.slice(1) : "TERM",
+      isGroupKill: false,
+      isAllKill: false,
+      originalCommand: command
+    };
+  }
+  const killallMatch = normalized.match(/^killall\s+(?:(-[a-zA-Z]+)\s+)?(.+)$/);
+  if (killallMatch?.[2]) {
+    const name = killallMatch[2];
+    const signalMatch = killallMatch[1];
+    return {
+      name,
+      signal: signalMatch ? signalMatch.slice(1) : "TERM",
+      isGroupKill: false,
+      isAllKill: false,
+      originalCommand: command
+    };
+  }
+  const pgrepMatch = normalized.match(/^pgrep\s+(.+)$/);
+  if (pgrepMatch) {
+    return null;
+  }
+  const posixScriptMatch = normalized.match(SCRIPT_KILL_RE_POSIX);
+  if (posixScriptMatch) {
+    return {
+      name: "kill-script",
+      signal: "FORCE",
+      isGroupKill: false,
+      isAllKill: false,
+      originalCommand: command
+    };
+  }
+  return null;
+}
+async function getProtectedEntries() {
+  const registry = getPersistentProcessRegistry();
+  const status = await registry.getGlobalStatus();
+  const entries = [];
+  for (const instanceEntries of status.instances.values()) {
+    for (const entry of instanceEntries) {
+      if (entry.protected && Date.now() - entry.lastHeartbeat < 3e4) {
+        entries.push(entry);
+      }
+    }
+  }
+  return entries;
+}
+async function isKillProtected(kill) {
+  const registry = getPersistentProcessRegistry();
+  if (kill.name === "kill-script") {
+    return true;
+  }
+  if (kill.name) {
+    const entries = await getProtectedEntries();
+    const killNameLower = kill.name.toLowerCase();
+    for (const entry of entries) {
+      if (entry.name?.toLowerCase().includes(killNameLower)) {
+        return true;
+      }
+    }
+    if (killNameLower.includes("wrongstack")) {
+      return true;
+    }
+    if (killNameLower.includes("node") && entries.length > 0) {
+      return true;
+    }
+    return false;
+  }
+  if (kill.isGroupKill) {
+    const protectedPids = await registry.getAllProtectedPids();
+    return protectedPids.length > 0;
+  }
+  if (kill.pid !== void 0) {
+    if (await registry.shouldBlockKill(kill.pid)) return true;
+    if (kill.pid === process.pid || kill.pid === process.ppid) return true;
+    return false;
+  }
+  return false;
+}
+async function checkAndBlockKillCommand(command) {
+  const normalized = command.replace(/\s+/g, " ").trim();
+  const killCmd = extractKillCommand(normalized) || (isKillRelatedCommand(normalized) ? normalized : null);
+  if (!killCmd) {
+    return { blocked: false };
+  }
+  const parsed = parseKillCommand(killCmd);
+  if (!parsed) {
+    if (killCmd.includes("kill") && /kill\s+.*\|/.test(killCmd)) {
+      return {
+        blocked: true,
+        reason: `Blocked: complex kill pipeline detected \u2014 "${killCmd.slice(0, 50)}..."`
+      };
+    }
+    if (SCRIPT_KILL_FALLBACK_RE.test(killCmd)) {
+      return {
+        blocked: true,
+        reason: `Blocked: script-based kill detected \u2014 "${killCmd.slice(0, 80)}" may target protected WrongStack processes (cannot inspect script body).`
+      };
+    }
+    return { blocked: false };
+  }
+  if (await isKillProtected(parsed)) {
+    let target;
+    if (parsed.name) {
+      target = `process name "${parsed.name}"`;
+    } else if (parsed.pid !== void 0) {
+      target = `PID ${parsed.pid}`;
+    } else {
+      target = "(unknown target)";
+    }
+    const signal = parsed.signal ? ` (${parsed.signal})` : "";
+    const groupNote = parsed.isGroupKill ? " (process group)" : "";
+    return {
+      blocked: true,
+      reason: `Blocked: kill${signal} ${target}${groupNote} targets a protected WrongStack process.`
+    };
+  }
+  return { blocked: false };
+}
+
+// src/bash.ts
+var MAX_OUTPUT = 32768;
+var DEFAULT_TIMEOUT_MS = 3e5;
+var STREAM_FLUSH_INTERVAL_MS = 200;
+var STREAM_FLUSH_BYTES = 4 * 1024;
+var MAX_QUEUE_CHUNKS = 500;
+var bashTool = {
+  name: "bash",
+  category: "Shell",
+  description: "Execute an arbitrary command in the user's default shell (bash/zsh/pwsh/cmd). stdout and stderr are merged into one stream. This is the most powerful and dangerous tool \u2014 it gives the model full access to the developer's machine. Prefer specialized tools whenever possible.",
+  usageHint: "SECURITY WARNING: This tool runs with the full privileges of the current user.\n\nBest practices for the model:\n- Strongly prefer `exec` for known safe commands (node, npm, pnpm, tsc, git, etc.).\n- Use bash only when you genuinely need shell features (pipes, redirection, complex one-liners).\n- Prefer single focused commands over huge `&&` chains.\n- Use `background: true` only for long-running processes (dev servers, watchers).\n- The working directory is the session working dir (changed via `set_working_dir`), defaulting to the project root.\n- Output may be truncated in the middle for very large results.",
+  selection: {
+    doNotUseWhen: "the command is allowlisted and does not require pipes, redirection, or shell expansion.",
+    useInstead: ["exec"]
+  },
+  permission: "confirm",
+  mutating: true,
+  riskTier: "destructive",
+  icon: "terminal",
+  // Trust rules match on the literal `command` string. Without subjectKey
+  // the policy heuristic would have done the same here, but declaring it
+  // explicitly removes the implicit cross-tool aliasing.
+  subjectKey: "command",
+  capabilities: ["shell.arbitrary"],
+  // Executor-level abort ceiling. Must sit ABOVE the per-call `timeout_ms`
+  // ceiling (600_000): the tool's own timer tree-kills and returns a
+  // structured `timed_out: true` result, while the executor's
+  // AbortSignal.timeout is a blunt abort. The old value (300_000) meant any
+  // timeout_ms > 5min was silently cut short by the executor. The 10s margin
+  // covers the kill/teardown window. (The executor additionally clamps to
+  // config `tools.maxToolTimeoutMs`.)
+  timeoutMs: 61e4,
+  maxOutputBytes: MAX_OUTPUT,
+  estimatedDurationMs: 3e4,
+  inputSchema: {
+    type: "object",
+    properties: {
+      command: {
+        type: "string",
+        description: "The exact shell command to run. Prefer simple, focused commands."
+      },
+      timeout_ms: {
+        type: "integer",
+        description: "Optional timeout for this specific command in milliseconds (default 300000, max 600000)."
+      },
+      background: {
+        type: "boolean",
+        description: "If true, launch the process in the background and return the PID immediately."
+      }
+    },
+    required: ["command"]
+  },
+  async execute(input, ctx, opts) {
+    let final;
+    const executeStream = bashTool.executeStream;
+    if (!executeStream) throw new Error("bashTool: stream execution unavailable");
+    for await (const ev of executeStream(input, ctx, opts)) {
+      if (ev.type === "final") final = ev.output;
+    }
+    if (!final) throw new Error("bash: stream ended without final event");
+    return final;
+  },
+  async *executeStream(input, ctx, opts) {
+    if (!input?.command) throw new Error("bash: command is required");
+    const registry = getProcessRegistry();
+    const bypassBreaker = !!input.background;
+    if (!registry.beforeCall(bypassBreaker)) {
+      yield {
+        type: "final",
+        output: {
+          output: "",
+          exit_code: 1,
+          timed_out: false,
+          pid: null,
+          error: "bash: circuit breaker open \u2014 too many consecutive failures or slow calls. Use /kill to inspect or /kill reset to recover."
+        }
+      };
+      return;
+    }
+    const killCheck = await checkAndBlockKillCommand(input.command);
+    if (killCheck.blocked) {
+      yield {
+        type: "final",
+        output: {
+          output: "",
+          exit_code: 1,
+          timed_out: false,
+          pid: null,
+          error: killCheck.reason || "Kill command blocked: targets a protected WrongStack process."
+        }
+      };
+      return;
+    }
+    const PIPE_TO_SHELL_PATTERN = /\|\s*(sh|bash|ksh|zsh|fish|cmd|powershell|pwsh)/i;
+    const pipeToShellNote = PIPE_TO_SHELL_PATTERN.test(input.command) ? "\n\n[wrongstack] Caution: this command pipes output into a shell interpreter (pipe-to-shell). Piped content executes as arbitrary code \u2014 review the source before trusting the result, and prefer downloading to a file and inspecting it first." : "";
+    const timeoutMs = Math.max(1, Math.min(input.timeout_ms ?? DEFAULT_TIMEOUT_MS, 6e5));
+    const isWin2 = os2.platform() === "win32";
+    let plan;
+    let winShellKind;
+    if (isWin2) {
+      const shell2 = pickShell("win32", input.command, {
+        get: (k) => process.env[k]
+      });
+      winShellKind = shell2;
+      const bin = shell2 === "powershell" ? resolvePowerShell("powershell.exe") : shell2 === "pwsh" ? resolvePowerShell("pwsh.exe") : process.env["COMSPEC"] ?? "cmd.exe";
+      plan = {
+        bin,
+        argv: shellArgs(shell2),
+        commandArg: shell2 === "powershell" || shell2 === "pwsh" ? Buffer.from(wrapPowerShellScript(input.command), "utf16le").toString("base64") : input.command
+      };
+    } else {
+      const explicit = process.env["WRONGSTACK_SHELL"];
+      let bin;
+      if (explicit) bin = explicit;
+      else {
+        const fromEnv = process.env["SHELL"];
+        if (fromEnv) {
+          const name = fromEnv.split("/").pop() ?? "";
+          if (["bash", "zsh", "sh", "dash", "fish"].includes(name)) bin = fromEnv;
+          else bin = "/bin/bash";
+        } else bin = "/bin/bash";
+      }
+      plan = { bin, argv: ["-c"], commandArg: input.command };
+    }
+    const shell = plan.bin;
+    const args = [...plan.argv, plan.commandArg];
+    const env = buildChildEnv(ctx.session?.id);
+    const spawnCwd = ctx.workingDir ?? ctx.projectRoot;
+    const detached = !isWin2;
+    const startedAt = Date.now();
+    if (input.background) {
+      const child2 = spawn(shell, args, {
+        cwd: spawnCwd,
+        env,
+        stdio: ["ignore", "ignore", "ignore"],
+        detached: !isWin2,
+        windowsHide: true
+      });
+      const pid2 = child2.pid;
+      const stdoutBytes2 = 0;
+      const stderrBytes2 = 0;
+      let telemetryCompleted2 = false;
+      emitProcessStarted({
+        ...pid2 !== void 0 ? { pid: pid2 } : {},
+        parentPid: process.pid,
+        command: redactCommand(`${shell} ${args.join(" ")}`),
+        args: redactCommand(args.join(" ")).split(" ").filter(Boolean),
+        cwd: spawnCwd,
+        background: true,
+        startedAt: new Date(startedAt).toISOString()
+      });
+      const completeBackground = (exitCode, signal) => {
+        if (telemetryCompleted2) return;
+        telemetryCompleted2 = true;
+        emitProcessCompleted({
+          ...pid2 !== void 0 ? { pid: pid2 } : {},
+          exitCode,
+          ...signal ? { signal } : {},
+          durationMs: Date.now() - startedAt,
+          stdoutBytes: stdoutBytes2,
+          stderrBytes: stderrBytes2,
+          timedOut: false,
+          endedAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+      };
+      if (typeof pid2 === "number") {
+        registry.register({
+          pid: pid2,
+          name: "bash",
+          command: redactCommand(input.command),
+          startedAt: Date.now(),
+          sessionId: ctx.session?.id,
+          child: child2,
+          processGroupLeader: detached && child2.pid === pid2,
+          background: true
+        });
+        child2.on("close", () => registry.unregister(pid2));
+      }
+      child2.on("error", () => {
+        if (typeof pid2 === "number") registry.unregister(pid2);
+        registry.afterCall(Date.now() - startedAt, true, bypassBreaker);
+        completeBackground(1);
+      });
+      child2.on("close", (code, signal) => {
+        registry.afterCall(Date.now() - startedAt, false, bypassBreaker);
+        completeBackground(code ?? (signal ? 1 : 0), signal ?? void 0);
+      });
+      if (typeof pid2 === "number") child2.unref();
+      yield {
+        type: "final",
+        output: {
+          // Background runs have no captured output; the pipe-to-shell caution
+          // (when present) is the only thing worth surfacing.
+          output: pipeToShellNote.trim(),
+          exit_code: null,
+          timed_out: false,
+          pid: pid2
+        }
+      };
+      ctx.recordSideEffect?.({
+        toolUseId: `bash-bg-${Date.now()}`,
+        toolName: "bash",
+        ts: (/* @__PURE__ */ new Date()).toISOString(),
+        input: { command: redactCommand(input.command), background: true },
+        outcome: `launched (pid ${pid2 ?? "unknown"})`,
+        risk: "shell"
+      });
+      return;
+    }
+    const child = spawn(shell, args, {
+      cwd: spawnCwd,
+      env,
+      stdio: ["ignore", "pipe", "pipe"],
+      detached,
+      windowsHide: true,
+      ...isWin2 ? {} : { signal: opts.signal }
+    });
+    const pid = child.pid;
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    let telemetryCompleted = false;
+    emitProcessStarted({
+      ...pid !== void 0 ? { pid } : {},
+      parentPid: process.pid,
+      command: redactCommand(`${shell} ${args.join(" ")}`),
+      args: redactCommand(args.join(" ")).split(" ").filter(Boolean),
+      cwd: spawnCwd,
+      background: false,
+      startedAt: new Date(startedAt).toISOString()
+    });
+    const completeForeground = (exitCode, signal) => {
+      if (telemetryCompleted) return;
+      telemetryCompleted = true;
+      emitProcessCompleted({
+        ...pid !== void 0 ? { pid } : {},
+        exitCode,
+        ...signal ? { signal } : {},
+        durationMs: Date.now() - startedAt,
+        stdoutBytes,
+        stderrBytes,
+        timedOut,
+        endedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    };
+    if (typeof pid === "number") {
+      registry.register({
+        pid,
+        name: "bash",
+        command: redactCommand(input.command),
+        startedAt: Date.now(),
+        sessionId: ctx.session?.id,
+        child,
+        processGroupLeader: detached && child.pid === pid
+      });
+    }
+    let buf = "";
+    let pending = "";
+    let timedOut = false;
+    const timers = [];
+    const spool = createOutputSpool({ tool: "bash", thresholdBytes: MAX_OUTPUT });
+    function killWithTimeout(child2, timeoutMs2) {
+      if (isWin2) {
+        if (typeof child2.pid === "number" && child2.exitCode === null) {
+          const attempted = registry.kill(child2.pid, { force: true, graceMs: timeoutMs2 });
+          if (!attempted) {
+            try {
+              child2.kill();
+            } catch {
+            }
+          }
+        } else {
+          try {
+            child2.kill();
+          } catch {
+          }
+        }
+        return;
+      }
+      if (typeof child2.pid === "number") {
+        registry.kill(child2.pid, { graceMs: timeoutMs2 });
+      } else {
+        try {
+          child2.kill("SIGTERM");
+        } catch {
+        }
+        const killTimer = setTimeout(() => {
+          try {
+            child2.kill("SIGKILL");
+          } catch {
+          }
+        }, timeoutMs2);
+        timers.push(killTimer);
+        killTimer.unref?.();
+      }
+    }
+    const timer = setTimeout(() => {
+      timedOut = true;
+      killWithTimeout(child, 2e3);
+    }, timeoutMs);
+    timers.push(timer);
+    timer.unref?.();
+    const onAbort = () => killWithTimeout(child, 2e3);
+    if (isWin2) {
+      if (opts.signal.aborted) onAbort();
+      else opts.signal.addEventListener("abort", onAbort, { once: true });
+    }
+    const queue = [];
+    let resolveNext = null;
+    const push = (c) => {
+      if (resolveNext) {
+        const r = resolveNext;
+        resolveNext = null;
+        r(c);
+      } else {
+        queue.push(c);
+      }
+    };
+    const next = () => new Promise((resolve) => {
+      const c = queue.shift();
+      if (c) resolve(c);
+      else resolveNext = resolve;
+    });
+    let lastFlush = Date.now();
+    const flush = () => {
+      if (pending.length === 0) return null;
+      const text = pending;
+      pending = "";
+      lastFlush = Date.now();
+      return text;
+    };
+    let paused = false;
+    const pauseIfFlooded = () => {
+      if (!paused && queue.length >= MAX_QUEUE_CHUNKS) {
+        paused = true;
+        child.stdout?.pause();
+        child.stderr?.pause();
+      }
+    };
+    const resumeIfDrained = () => {
+      if (paused && queue.length < MAX_QUEUE_CHUNKS) {
+        paused = false;
+        child.stdout?.resume();
+        child.stderr?.resume();
+      }
+    };
+    const stdoutDecoder = new StringDecoder("utf8");
+    const stderrDecoder = new StringDecoder("utf8");
+    const onData = (chunk, stream) => {
+      const text = (stream === "stdout" ? stdoutDecoder : stderrDecoder).write(chunk);
+      if (stream === "stdout") stdoutBytes += chunk.byteLength;
+      else stderrBytes += chunk.byteLength;
+      emitProcessOutput({ pid, stream, chunk });
+      if (buf.length < MAX_OUTPUT) {
+        buf += text.slice(0, MAX_OUTPUT - buf.length);
+      }
+      spool.write(text);
+      pending += text;
+      push({ kind: "data", text });
+      pauseIfFlooded();
+    };
+    const onStdoutData = (chunk) => onData(chunk, "stdout");
+    const onStderrData = (chunk) => onData(chunk, "stderr");
+    child.stdout?.on("data", onStdoutData);
+    child.stderr?.on("data", onStderrData);
+    child.on("error", (err) => {
+      for (const t of timers) clearTimeout(t);
+      registry.afterCall(Date.now() - startedAt, true);
+      completeForeground(1);
+      push({ kind: "error", err });
+    });
+    child.on("close", (code, signal) => {
+      for (const t of timers) clearTimeout(t);
+      if (typeof pid === "number") registry.unregister(pid);
+      registry.afterCall(Date.now() - startedAt, code !== 0 && code !== null);
+      completeForeground(timedOut ? 124 : code ?? (signal ? 1 : 0), signal ?? void 0);
+      const tail = stdoutDecoder.end() + stderrDecoder.end();
+      if (tail) {
+        if (buf.length < MAX_OUTPUT) buf += tail.slice(0, MAX_OUTPUT - buf.length);
+        spool.write(tail);
+        pending += tail;
+      }
+      push({ kind: "end", code });
+    });
+    try {
+      while (true) {
+        const c = await next();
+        resumeIfDrained();
+        if (c.kind === "error") throw c.err;
+        if (c.kind === "end") {
+          const remainder = flush();
+          if (remainder !== null) {
+            yield { type: "partial_output", text: remainder };
+          }
+          const spooled = spool.finalize();
+          const hint = !timedOut && typeof c.code === "number" && c.code !== 0 && winShellKind ? diagnoseBashism(input.command, winShellKind) : void 0;
+          yield {
+            type: "final",
+            output: {
+              output: normalizeCommandOutput(buf) + (spooled ? spoolNote(spooled) : "") + (hint ? `
+
+${hint}` : "") + pipeToShellNote,
+              exit_code: c.code,
+              timed_out: timedOut
+            }
+          };
+          ctx.recordSideEffect?.({
+            toolUseId: `bash-${Date.now()}`,
+            toolName: "bash",
+            ts: (/* @__PURE__ */ new Date()).toISOString(),
+            input: { command: redactCommand(input.command) },
+            outcome: timedOut ? `timed out (exit ${c.code})` : `exit ${c.code}`,
+            risk: "shell"
+          });
+          return;
+        }
+        const now = Date.now();
+        if (pending.length >= STREAM_FLUSH_BYTES || now - lastFlush >= STREAM_FLUSH_INTERVAL_MS) {
+          const text = flush();
+          if (text) yield { type: "partial_output", text };
+        }
+      }
+    } finally {
+      for (const t of timers) clearTimeout(t);
+      spool.finalize();
+      if (isWin2) opts.signal.removeEventListener("abort", onAbort);
+      child.stdout?.off("data", onStdoutData);
+      child.stderr?.off("data", onStderrData);
+      child.stdout?.destroy();
+      child.stderr?.destroy();
+      if (child.exitCode === null && !child.killed) {
+        if (typeof pid === "number") registry.kill(pid, { force: true });
+        else killWithTimeout(child, 2e3);
+      }
+    }
+  },
+  /**
+   * Tool-level teardown fired by `ToolExecutor.runToolCleanup()` when the
+   * tool's run is aborted/timeout'd. The generator's `finally` block above
+   * already force-kills the direct child, but that only runs if the
+   * executor closes the async iterator (via `iter.return()`). When the
+   * executor tears down without iterating — or a re-entrant abort races
+   * with the generator — a bash-spawned process tree can survive in the
+   * ProcessRegistry with `killed === false`, continuing to write files,
+   * consume CPU, or hold inherited stdio pipes open for the rest of the
+   * session.
+   *
+   * This is the defensive layer the executor calls via `tool.cleanup()`
+   * (see `types/tool.ts`): kill every bash-owned process still tracked
+   * for this session that hasn't exited yet. `registry.kill()` already
+   * handles process-group / taskkill tree-kill and the SIGTERM→SIGKILL
+   * grace window, so this just scopes the registry's existing kill path
+   * to "this session's runaway bash children". Idempotent — a process
+   * that already exited is skipped by `kill()` (it returns false), and a
+   * `protected` infrastructure process (dev server the user intentionally
+   * backgrounded) is left alone by design.
+   */
+  async cleanup(_input, ctx) {
+    const registry = getProcessRegistry();
+    const sessionId = ctx.session?.id;
+    if (!sessionId) return;
+    for (const entry of registry.bySession(sessionId)) {
+      if (entry.name !== "bash") continue;
+      if (entry.child && entry.child.exitCode !== null) continue;
+      if (entry.background) continue;
+      if (entry.protected) continue;
+      registry.kill(entry.pid, { force: true });
+    }
+  }
+};
+
+export {
+  shellArgs,
+  diagnoseBashism,
+  checkAndBlockKillCommand,
+  bashTool
+};
+//# sourceMappingURL=chunk-IVWV2UM6.js.map