@wrongstack/tools 1.0.0 → 1.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/auto-proceed-loop-guard.d.ts +1 -1
- package/dist/auto-proceed-loop-guard.js +1 -1
- package/dist/bash.js +1 -1
- package/dist/builtin.js +15 -15
- package/dist/{chunk-VVZPQPTY.js → chunk-3AU6CZWL.js} +4 -2
- package/dist/{chunk-N3K2SFEI.js → chunk-52UXXQMP.js} +1408 -200
- package/dist/{chunk-NN2SNP2R.js → chunk-6H4ERJP7.js} +137 -21
- package/dist/{chunk-DK4J2WMH.js → chunk-7XUEPBNT.js} +2 -2
- package/dist/{chunk-IYH4OHBP.js → chunk-DKHMPKDG.js} +2 -2
- package/dist/{chunk-NU2IZ72J.js → chunk-DL2ARI4S.js} +7 -5
- package/dist/{chunk-M6UV67BH.js → chunk-EL2NJXSK.js} +2 -2
- package/dist/{chunk-YEISRT4S.js → chunk-HWXIRVKH.js} +1408 -235
- package/dist/{chunk-GKSG5CPH.js → chunk-KVTEIUND.js} +2 -2
- package/dist/{chunk-GDDXX27P.js → chunk-MBR5VAB5.js} +2 -2
- package/dist/{chunk-KDEXUQY7.js → chunk-MGPR7VG3.js} +261 -258
- package/dist/{chunk-YULVUTK5.js → chunk-NFX2IUQA.js} +3 -3
- package/dist/{chunk-37QKUQ2Z.js → chunk-NL2S2CXD.js} +1 -1
- package/dist/{chunk-ZTCJCYLN.js → chunk-TI5COGLY.js} +49 -6
- package/dist/{chunk-CGXTR34H.js → chunk-TU5MTW2S.js} +2 -2
- package/dist/{chunk-AB2CAUOP.js → chunk-UCXFTCAI.js} +186 -36
- package/dist/{chunk-MK2JK35J.js → chunk-UOYRAS4J.js} +3 -3
- package/dist/{chunk-UCYQTZ7F.js → chunk-ZKC5UNGD.js} +56 -2
- package/dist/codebase-index/atlas-brief.d.ts +90 -0
- package/dist/codebase-index/atlas-export.d.ts +38 -0
- package/dist/codebase-index/atlas-projection.d.ts +114 -0
- package/dist/codebase-index/atlas-types.d.ts +90 -0
- package/dist/codebase-index/background-indexer.d.ts +15 -4
- package/dist/codebase-index/codebase-context-tool.d.ts +54 -0
- package/dist/codebase-index/concept-enrichment.d.ts +154 -0
- package/dist/codebase-index/context-retrieval.d.ts +91 -0
- package/dist/codebase-index/embedding-pass.d.ts +95 -0
- package/dist/codebase-index/graph-adjacency-cache.d.ts +36 -0
- package/dist/codebase-index/graph-rank-pass.d.ts +46 -0
- package/dist/codebase-index/graph-rank.d.ts +198 -0
- package/dist/codebase-index/index-service.d.ts +15 -1
- package/dist/codebase-index/index.d.ts +34 -19
- package/dist/codebase-index/index.js +126 -9
- package/dist/codebase-index/parser-worker-script.js +3 -3
- package/dist/codebase-index/perf-metrics.d.ts +19 -0
- package/dist/codebase-index/project-server-protocol.d.ts +2 -0
- package/dist/codebase-index/project-server-query-cache.d.ts +4 -0
- package/dist/codebase-index/project-server.js +54 -7
- package/dist/codebase-index/repo-map-fallback.d.ts +18 -0
- package/dist/codebase-index/repo-map-render.d.ts +42 -0
- package/dist/codebase-index/repo-map-types.d.ts +21 -0
- package/dist/codebase-index/repo-map.d.ts +28 -16
- package/dist/codebase-index/schema.d.ts +20 -0
- package/dist/codebase-index/worker-protocol.d.ts +47 -1
- package/dist/codebase-index/worker.js +11 -5
- package/dist/codebase-index/writer-concepts.d.ts +84 -0
- package/dist/codebase-index/writer-graph-decorate.d.ts +30 -0
- package/dist/codebase-index/writer-graph-reader.d.ts +22 -0
- package/dist/codebase-index/writer-rank.d.ts +78 -0
- package/dist/codebase-index/writer-schema.d.ts +51 -0
- package/dist/codebase-index/writer-vectors.d.ts +53 -0
- package/dist/codebase-index/writer.d.ts +59 -0
- package/dist/edit.js +7 -7
- package/dist/exec.js +1 -1
- package/dist/{go-parser-D7ELWQ7F.js → go-parser-QIEXU3P2.js} +4 -2
- package/dist/index.d.ts +48 -48
- package/dist/index.js +43 -19
- package/dist/pack.js +16 -16
- package/dist/{parser-dispatch-BDVCJXTV.js → parser-dispatch-37FT3EXQ.js} +4 -4
- package/dist/patch.js +7 -7
- package/dist/{py-parser-QC6MR4GB.js → py-parser-6GJTGUXK.js} +3 -3
- package/dist/read.js +7 -7
- package/dist/replace.js +7 -7
- package/dist/tool-tier.js +17 -17
- package/dist/write.js +7 -7
- package/package.json +5 -5
|
@@ -3,7 +3,7 @@ import {
|
|
|
3
3
|
} from "./chunk-MSOAX3GC.js";
|
|
4
4
|
import {
|
|
5
5
|
enqueueReindex
|
|
6
|
-
} from "./chunk-
|
|
6
|
+
} from "./chunk-TI5COGLY.js";
|
|
7
7
|
import {
|
|
8
8
|
safeResolveReal,
|
|
9
9
|
sha256hex,
|
|
@@ -179,4 +179,4 @@ async function finishWrite(input, ctx, prepared, signal) {
|
|
|
179
179
|
export {
|
|
180
180
|
writeTool
|
|
181
181
|
};
|
|
182
|
-
//# sourceMappingURL=chunk-
|
|
182
|
+
//# sourceMappingURL=chunk-KVTEIUND.js.map
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import {
|
|
2
2
|
resolveIndexDir
|
|
3
|
-
} from "./chunk-
|
|
3
|
+
} from "./chunk-52UXXQMP.js";
|
|
4
4
|
|
|
5
5
|
// src/codebase-index/project-server-endpoint.ts
|
|
6
6
|
import { createHash } from "node:crypto";
|
|
@@ -120,4 +120,4 @@ export {
|
|
|
120
120
|
PROJECT_INDEX_SERVER_MAX_FRAME_CHARS,
|
|
121
121
|
encodeProjectServerMessage
|
|
122
122
|
};
|
|
123
|
-
//# sourceMappingURL=chunk-
|
|
123
|
+
//# sourceMappingURL=chunk-MBR5VAB5.js.map
|
|
@@ -471,245 +471,6 @@ function levelRank(level) {
|
|
|
471
471
|
}
|
|
472
472
|
}
|
|
473
473
|
|
|
474
|
-
// src/exec-kill-guard.ts
|
|
475
|
-
import * as os from "node:os";
|
|
476
|
-
import * as path from "node:path";
|
|
477
|
-
var isWin = os.platform() === "win32";
|
|
478
|
-
async function checkExecKillCommand(cmd, args) {
|
|
479
|
-
if (!cmd) return { blocked: false };
|
|
480
|
-
const cmdLower = cmd.toLowerCase().trim();
|
|
481
|
-
const fullCommand = [cmdLower, ...args].join(" ").replace(/\s+/g, " ").trim();
|
|
482
|
-
if (isWin) {
|
|
483
|
-
if (cmdLower === "taskkill" || cmdLower === "taskkill.exe") {
|
|
484
|
-
const hasForce = args.some((a) => a.toUpperCase() === "/F" || a.toUpperCase() === "-F");
|
|
485
|
-
const signal = hasForce ? "FORCE" : "TERM";
|
|
486
|
-
for (let i = 0; i < args.length; i++) {
|
|
487
|
-
const a = args[i];
|
|
488
|
-
if (a.toUpperCase() === "/IM" || a.toUpperCase() === "-IM") {
|
|
489
|
-
const nameArg = args[i + 1];
|
|
490
|
-
if (nameArg) {
|
|
491
|
-
const result = await checkKillTarget({ name: nameArg, signal, cmd: fullCommand });
|
|
492
|
-
if (result.blocked) return result;
|
|
493
|
-
}
|
|
494
|
-
}
|
|
495
|
-
}
|
|
496
|
-
for (let i = 0; i < args.length; i++) {
|
|
497
|
-
const a = args[i];
|
|
498
|
-
if (a.toUpperCase() === "/PID" || a.toUpperCase() === "-PID") {
|
|
499
|
-
const pidArg = args[i + 1];
|
|
500
|
-
if (pidArg && /^\d+$/.test(pidArg)) {
|
|
501
|
-
const result = await checkKillTarget({
|
|
502
|
-
pid: parseInt(pidArg, 10),
|
|
503
|
-
signal,
|
|
504
|
-
cmd: fullCommand
|
|
505
|
-
});
|
|
506
|
-
if (result.blocked) return result;
|
|
507
|
-
}
|
|
508
|
-
}
|
|
509
|
-
}
|
|
510
|
-
for (let i = 0; i < args.length; i++) {
|
|
511
|
-
const a = args[i];
|
|
512
|
-
if (a.toUpperCase() === "/FI" || a.toUpperCase() === "-FI") {
|
|
513
|
-
const filterArg = args[i + 1];
|
|
514
|
-
if (filterArg) {
|
|
515
|
-
const nameMatch = filterArg.match(/IMAGENAME\s+eq\s+"?([^"\s]+)/i);
|
|
516
|
-
if (nameMatch?.[1]) {
|
|
517
|
-
const result = await checkKillTarget({
|
|
518
|
-
name: nameMatch[1],
|
|
519
|
-
signal,
|
|
520
|
-
cmd: fullCommand
|
|
521
|
-
});
|
|
522
|
-
if (result.blocked) return result;
|
|
523
|
-
}
|
|
524
|
-
}
|
|
525
|
-
}
|
|
526
|
-
}
|
|
527
|
-
return { blocked: false };
|
|
528
|
-
}
|
|
529
|
-
if (cmdLower === "powershell" || cmdLower === "powershell.exe" || cmdLower === "pwsh" || cmdLower === "pwsh.exe" || cmdLower === "cmd" || cmdLower === "cmd.exe") {
|
|
530
|
-
const shellFlagIndex = args.findIndex((arg) => {
|
|
531
|
-
const lower = arg.toLowerCase();
|
|
532
|
-
return lower === "-c" || lower === "-command" || lower === "/c";
|
|
533
|
-
});
|
|
534
|
-
if (shellFlagIndex >= 0) {
|
|
535
|
-
const innerTokens = tokenizeShellCommand(args.slice(shellFlagIndex + 1).join(" "));
|
|
536
|
-
const innerCommand = innerTokens[0];
|
|
537
|
-
if (innerCommand) {
|
|
538
|
-
const result = await checkExecKillCommand(innerCommand, innerTokens.slice(1));
|
|
539
|
-
if (result.blocked) return result;
|
|
540
|
-
}
|
|
541
|
-
}
|
|
542
|
-
}
|
|
543
|
-
if (cmdLower === "stop-process" || cmdLower === "kill") {
|
|
544
|
-
for (let i = 0; i < args.length; i++) {
|
|
545
|
-
const a = args[i];
|
|
546
|
-
if (a === "-Name" || a === "-n") {
|
|
547
|
-
const nameArg = args[i + 1]?.replace(/^['"]|['"]$/g, "");
|
|
548
|
-
if (nameArg) {
|
|
549
|
-
const result = await checkKillTarget({
|
|
550
|
-
name: nameArg,
|
|
551
|
-
signal: "FORCE",
|
|
552
|
-
cmd: fullCommand
|
|
553
|
-
});
|
|
554
|
-
if (result.blocked) return result;
|
|
555
|
-
}
|
|
556
|
-
}
|
|
557
|
-
if (a === "-Id" || a === "-PID" || a === "-pid") {
|
|
558
|
-
const pidArg = args[i + 1];
|
|
559
|
-
if (pidArg && /^\d+$/.test(pidArg)) {
|
|
560
|
-
const result = await checkKillTarget({
|
|
561
|
-
pid: parseInt(pidArg, 10),
|
|
562
|
-
signal: "FORCE",
|
|
563
|
-
cmd: fullCommand
|
|
564
|
-
});
|
|
565
|
-
if (result.blocked) return result;
|
|
566
|
-
}
|
|
567
|
-
}
|
|
568
|
-
}
|
|
569
|
-
const firstNonFlag = args.find((a) => !a.startsWith("-"));
|
|
570
|
-
if (firstNonFlag) {
|
|
571
|
-
const name = firstNonFlag.replace(/^['"]|['"]$/g, "");
|
|
572
|
-
const result = await checkKillTarget({ name, signal: "TERM", cmd: fullCommand });
|
|
573
|
-
if (result.blocked) return result;
|
|
574
|
-
}
|
|
575
|
-
}
|
|
576
|
-
if (cmdLower === "wmic" || cmdLower === "wmic.exe") {
|
|
577
|
-
const joined = args.join(" ").toLowerCase();
|
|
578
|
-
if (/\bprocess\b/.test(joined) && /\bdelete\b/.test(joined)) {
|
|
579
|
-
const nameMatch = joined.match(/name\s*=\s*['"]?([^'"]+)/);
|
|
580
|
-
if (nameMatch?.[1]) {
|
|
581
|
-
const result = await checkKillTarget({
|
|
582
|
-
name: nameMatch[1].trim(),
|
|
583
|
-
signal: "FORCE",
|
|
584
|
-
cmd: fullCommand
|
|
585
|
-
});
|
|
586
|
-
if (result.blocked) return result;
|
|
587
|
-
}
|
|
588
|
-
return {
|
|
589
|
-
blocked: true,
|
|
590
|
-
reason: "Blocked: wmic process delete targets all matched processes \u2014 would include protected WrongStack processes."
|
|
591
|
-
};
|
|
592
|
-
}
|
|
593
|
-
}
|
|
594
|
-
if (cmdLower === "node" || cmdLower === "node.exe") {
|
|
595
|
-
if (args.includes("-e") || args.includes("--eval")) {
|
|
596
|
-
const evalIdx = args.indexOf("-e") !== -1 ? args.indexOf("-e") : args.indexOf("--eval");
|
|
597
|
-
const evalCode = args[evalIdx + 1] ?? "";
|
|
598
|
-
if (/\bprocess\.kill\s*\(/.test(evalCode)) {
|
|
599
|
-
const pidMatch = evalCode.match(/process\.kill\s*\(\s*(\d+)/);
|
|
600
|
-
if (pidMatch?.[1]) {
|
|
601
|
-
const pid = parseInt(pidMatch[1], 10);
|
|
602
|
-
const result = await checkKillTarget({ pid, signal: "SIGTERM", cmd: fullCommand });
|
|
603
|
-
if (result.blocked) return result;
|
|
604
|
-
}
|
|
605
|
-
return {
|
|
606
|
-
blocked: true,
|
|
607
|
-
reason: "Blocked: node -e with process.kill() \u2014 would target protected WrongStack process(es)."
|
|
608
|
-
};
|
|
609
|
-
}
|
|
610
|
-
}
|
|
611
|
-
}
|
|
612
|
-
} else {
|
|
613
|
-
if (cmdLower === "kill") {
|
|
614
|
-
for (const a of args) {
|
|
615
|
-
const num = a.replace(/^-/, "");
|
|
616
|
-
if (/^\d+$/.test(num)) {
|
|
617
|
-
const pid = parseInt(num, 10);
|
|
618
|
-
const result = await checkKillTarget({ pid, signal: "SIGTERM", cmd: fullCommand });
|
|
619
|
-
if (result.blocked) return result;
|
|
620
|
-
}
|
|
621
|
-
}
|
|
622
|
-
}
|
|
623
|
-
if (cmdLower === "pkill" || cmdLower === "killall") {
|
|
624
|
-
const firstNonFlag = args.find((a) => !a.startsWith("-"));
|
|
625
|
-
if (firstNonFlag) {
|
|
626
|
-
const result = await checkKillTarget({
|
|
627
|
-
name: firstNonFlag,
|
|
628
|
-
signal: "SIGTERM",
|
|
629
|
-
cmd: fullCommand
|
|
630
|
-
});
|
|
631
|
-
if (result.blocked) return result;
|
|
632
|
-
}
|
|
633
|
-
}
|
|
634
|
-
}
|
|
635
|
-
return { blocked: false };
|
|
636
|
-
}
|
|
637
|
-
function tokenizeShellCommand(command) {
|
|
638
|
-
const tokens = [];
|
|
639
|
-
let current = "";
|
|
640
|
-
let quote = null;
|
|
641
|
-
for (const char of command.trim()) {
|
|
642
|
-
if (quote) {
|
|
643
|
-
if (char === quote) quote = null;
|
|
644
|
-
else current += char;
|
|
645
|
-
continue;
|
|
646
|
-
}
|
|
647
|
-
if (char === '"' || char === "'") {
|
|
648
|
-
quote = char;
|
|
649
|
-
} else if (/\s/.test(char)) {
|
|
650
|
-
if (current) {
|
|
651
|
-
tokens.push(current);
|
|
652
|
-
current = "";
|
|
653
|
-
}
|
|
654
|
-
} else {
|
|
655
|
-
current += char;
|
|
656
|
-
}
|
|
657
|
-
}
|
|
658
|
-
if (current) tokens.push(current);
|
|
659
|
-
return tokens;
|
|
660
|
-
}
|
|
661
|
-
async function checkKillTarget(target) {
|
|
662
|
-
const registry = getPersistentProcessRegistry();
|
|
663
|
-
if (target.pid !== void 0) {
|
|
664
|
-
const blocked = await registry.shouldBlockKill(target.pid);
|
|
665
|
-
if (blocked) {
|
|
666
|
-
return {
|
|
667
|
-
blocked: true,
|
|
668
|
-
reason: `Blocked: kill ${target.signal} PID ${target.pid} targets a protected WrongStack process (${target.cmd.slice(0, 80)}).`
|
|
669
|
-
};
|
|
670
|
-
}
|
|
671
|
-
if (target.pid === process.pid) {
|
|
672
|
-
return {
|
|
673
|
-
blocked: true,
|
|
674
|
-
reason: "Blocked: cannot kill the current WrongStack process."
|
|
675
|
-
};
|
|
676
|
-
}
|
|
677
|
-
if (target.pid === process.ppid) {
|
|
678
|
-
return {
|
|
679
|
-
blocked: true,
|
|
680
|
-
reason: "Blocked: cannot kill the parent terminal hosting WrongStack."
|
|
681
|
-
};
|
|
682
|
-
}
|
|
683
|
-
return { blocked: false };
|
|
684
|
-
}
|
|
685
|
-
if (target.name) {
|
|
686
|
-
const nameLower = target.name.toLowerCase().replace(/\.exe$/, "");
|
|
687
|
-
if (nameLower.includes("wrongstack")) {
|
|
688
|
-
return {
|
|
689
|
-
blocked: true,
|
|
690
|
-
reason: `Blocked: kill ${target.signal} '${target.name}' targets a WrongStack process name.`
|
|
691
|
-
};
|
|
692
|
-
}
|
|
693
|
-
const currentImage = path.basename(process.execPath).toLowerCase().replace(/\.exe$/, "");
|
|
694
|
-
const targetsNodeRuntime = nameLower === "node" || nameLower.startsWith("node");
|
|
695
|
-
if (targetsNodeRuntime && currentImage === "node") {
|
|
696
|
-
return {
|
|
697
|
-
blocked: true,
|
|
698
|
-
reason: `Blocked: kill ${target.signal} '${target.name}' would kill the active WrongStack node.exe runtime.`
|
|
699
|
-
};
|
|
700
|
-
}
|
|
701
|
-
const protectedPids = await registry.getAllProtectedPids();
|
|
702
|
-
if (protectedPids.length > 0 && targetsNodeRuntime) {
|
|
703
|
-
return {
|
|
704
|
-
blocked: true,
|
|
705
|
-
reason: `Blocked: kill ${target.signal} '${target.name}' would kill all node.exe processes including active WrongStack instance(s).`
|
|
706
|
-
};
|
|
707
|
-
}
|
|
708
|
-
return { blocked: false };
|
|
709
|
-
}
|
|
710
|
-
return { blocked: false };
|
|
711
|
-
}
|
|
712
|
-
|
|
713
474
|
// src/exec-allowlist.ts
|
|
714
475
|
var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
|
|
715
476
|
// JS / TS toolchain
|
|
@@ -1300,6 +1061,245 @@ var DEFAULT_ALLOWED_COMMANDS = /* @__PURE__ */ new Set([
|
|
|
1300
1061
|
"chaos"
|
|
1301
1062
|
]);
|
|
1302
1063
|
|
|
1064
|
+
// src/exec-kill-guard.ts
|
|
1065
|
+
import * as os from "node:os";
|
|
1066
|
+
import * as path from "node:path";
|
|
1067
|
+
var isWin = os.platform() === "win32";
|
|
1068
|
+
async function checkExecKillCommand(cmd, args) {
|
|
1069
|
+
if (!cmd) return { blocked: false };
|
|
1070
|
+
const cmdLower = cmd.toLowerCase().trim();
|
|
1071
|
+
const fullCommand = [cmdLower, ...args].join(" ").replace(/\s+/g, " ").trim();
|
|
1072
|
+
if (isWin) {
|
|
1073
|
+
if (cmdLower === "taskkill" || cmdLower === "taskkill.exe") {
|
|
1074
|
+
const hasForce = args.some((a) => a.toUpperCase() === "/F" || a.toUpperCase() === "-F");
|
|
1075
|
+
const signal = hasForce ? "FORCE" : "TERM";
|
|
1076
|
+
for (let i = 0; i < args.length; i++) {
|
|
1077
|
+
const a = args[i];
|
|
1078
|
+
if (a.toUpperCase() === "/IM" || a.toUpperCase() === "-IM") {
|
|
1079
|
+
const nameArg = args[i + 1];
|
|
1080
|
+
if (nameArg) {
|
|
1081
|
+
const result = await checkKillTarget({ name: nameArg, signal, cmd: fullCommand });
|
|
1082
|
+
if (result.blocked) return result;
|
|
1083
|
+
}
|
|
1084
|
+
}
|
|
1085
|
+
}
|
|
1086
|
+
for (let i = 0; i < args.length; i++) {
|
|
1087
|
+
const a = args[i];
|
|
1088
|
+
if (a.toUpperCase() === "/PID" || a.toUpperCase() === "-PID") {
|
|
1089
|
+
const pidArg = args[i + 1];
|
|
1090
|
+
if (pidArg && /^\d+$/.test(pidArg)) {
|
|
1091
|
+
const result = await checkKillTarget({
|
|
1092
|
+
pid: parseInt(pidArg, 10),
|
|
1093
|
+
signal,
|
|
1094
|
+
cmd: fullCommand
|
|
1095
|
+
});
|
|
1096
|
+
if (result.blocked) return result;
|
|
1097
|
+
}
|
|
1098
|
+
}
|
|
1099
|
+
}
|
|
1100
|
+
for (let i = 0; i < args.length; i++) {
|
|
1101
|
+
const a = args[i];
|
|
1102
|
+
if (a.toUpperCase() === "/FI" || a.toUpperCase() === "-FI") {
|
|
1103
|
+
const filterArg = args[i + 1];
|
|
1104
|
+
if (filterArg) {
|
|
1105
|
+
const nameMatch = filterArg.match(/IMAGENAME\s+eq\s+"?([^"\s]+)/i);
|
|
1106
|
+
if (nameMatch?.[1]) {
|
|
1107
|
+
const result = await checkKillTarget({
|
|
1108
|
+
name: nameMatch[1],
|
|
1109
|
+
signal,
|
|
1110
|
+
cmd: fullCommand
|
|
1111
|
+
});
|
|
1112
|
+
if (result.blocked) return result;
|
|
1113
|
+
}
|
|
1114
|
+
}
|
|
1115
|
+
}
|
|
1116
|
+
}
|
|
1117
|
+
return { blocked: false };
|
|
1118
|
+
}
|
|
1119
|
+
if (cmdLower === "powershell" || cmdLower === "powershell.exe" || cmdLower === "pwsh" || cmdLower === "pwsh.exe" || cmdLower === "cmd" || cmdLower === "cmd.exe") {
|
|
1120
|
+
const shellFlagIndex = args.findIndex((arg) => {
|
|
1121
|
+
const lower = arg.toLowerCase();
|
|
1122
|
+
return lower === "-c" || lower === "-command" || lower === "/c";
|
|
1123
|
+
});
|
|
1124
|
+
if (shellFlagIndex >= 0) {
|
|
1125
|
+
const innerTokens = tokenizeShellCommand(args.slice(shellFlagIndex + 1).join(" "));
|
|
1126
|
+
const innerCommand = innerTokens[0];
|
|
1127
|
+
if (innerCommand) {
|
|
1128
|
+
const result = await checkExecKillCommand(innerCommand, innerTokens.slice(1));
|
|
1129
|
+
if (result.blocked) return result;
|
|
1130
|
+
}
|
|
1131
|
+
}
|
|
1132
|
+
}
|
|
1133
|
+
if (cmdLower === "stop-process" || cmdLower === "kill") {
|
|
1134
|
+
for (let i = 0; i < args.length; i++) {
|
|
1135
|
+
const a = args[i];
|
|
1136
|
+
if (a === "-Name" || a === "-n") {
|
|
1137
|
+
const nameArg = args[i + 1]?.replace(/^['"]|['"]$/g, "");
|
|
1138
|
+
if (nameArg) {
|
|
1139
|
+
const result = await checkKillTarget({
|
|
1140
|
+
name: nameArg,
|
|
1141
|
+
signal: "FORCE",
|
|
1142
|
+
cmd: fullCommand
|
|
1143
|
+
});
|
|
1144
|
+
if (result.blocked) return result;
|
|
1145
|
+
}
|
|
1146
|
+
}
|
|
1147
|
+
if (a === "-Id" || a === "-PID" || a === "-pid") {
|
|
1148
|
+
const pidArg = args[i + 1];
|
|
1149
|
+
if (pidArg && /^\d+$/.test(pidArg)) {
|
|
1150
|
+
const result = await checkKillTarget({
|
|
1151
|
+
pid: parseInt(pidArg, 10),
|
|
1152
|
+
signal: "FORCE",
|
|
1153
|
+
cmd: fullCommand
|
|
1154
|
+
});
|
|
1155
|
+
if (result.blocked) return result;
|
|
1156
|
+
}
|
|
1157
|
+
}
|
|
1158
|
+
}
|
|
1159
|
+
const firstNonFlag = args.find((a) => !a.startsWith("-"));
|
|
1160
|
+
if (firstNonFlag) {
|
|
1161
|
+
const name = firstNonFlag.replace(/^['"]|['"]$/g, "");
|
|
1162
|
+
const result = await checkKillTarget({ name, signal: "TERM", cmd: fullCommand });
|
|
1163
|
+
if (result.blocked) return result;
|
|
1164
|
+
}
|
|
1165
|
+
}
|
|
1166
|
+
if (cmdLower === "wmic" || cmdLower === "wmic.exe") {
|
|
1167
|
+
const joined = args.join(" ").toLowerCase();
|
|
1168
|
+
if (/\bprocess\b/.test(joined) && /\bdelete\b/.test(joined)) {
|
|
1169
|
+
const nameMatch = joined.match(/name\s*=\s*['"]?([^'"]+)/);
|
|
1170
|
+
if (nameMatch?.[1]) {
|
|
1171
|
+
const result = await checkKillTarget({
|
|
1172
|
+
name: nameMatch[1].trim(),
|
|
1173
|
+
signal: "FORCE",
|
|
1174
|
+
cmd: fullCommand
|
|
1175
|
+
});
|
|
1176
|
+
if (result.blocked) return result;
|
|
1177
|
+
}
|
|
1178
|
+
return {
|
|
1179
|
+
blocked: true,
|
|
1180
|
+
reason: "Blocked: wmic process delete targets all matched processes \u2014 would include protected WrongStack processes."
|
|
1181
|
+
};
|
|
1182
|
+
}
|
|
1183
|
+
}
|
|
1184
|
+
if (cmdLower === "node" || cmdLower === "node.exe") {
|
|
1185
|
+
if (args.includes("-e") || args.includes("--eval")) {
|
|
1186
|
+
const evalIdx = args.indexOf("-e") !== -1 ? args.indexOf("-e") : args.indexOf("--eval");
|
|
1187
|
+
const evalCode = args[evalIdx + 1] ?? "";
|
|
1188
|
+
if (/\bprocess\.kill\s*\(/.test(evalCode)) {
|
|
1189
|
+
const pidMatch = evalCode.match(/process\.kill\s*\(\s*(\d+)/);
|
|
1190
|
+
if (pidMatch?.[1]) {
|
|
1191
|
+
const pid = parseInt(pidMatch[1], 10);
|
|
1192
|
+
const result = await checkKillTarget({ pid, signal: "SIGTERM", cmd: fullCommand });
|
|
1193
|
+
if (result.blocked) return result;
|
|
1194
|
+
}
|
|
1195
|
+
return {
|
|
1196
|
+
blocked: true,
|
|
1197
|
+
reason: "Blocked: node -e with process.kill() \u2014 would target protected WrongStack process(es)."
|
|
1198
|
+
};
|
|
1199
|
+
}
|
|
1200
|
+
}
|
|
1201
|
+
}
|
|
1202
|
+
} else {
|
|
1203
|
+
if (cmdLower === "kill") {
|
|
1204
|
+
for (const a of args) {
|
|
1205
|
+
const num = a.replace(/^-/, "");
|
|
1206
|
+
if (/^\d+$/.test(num)) {
|
|
1207
|
+
const pid = parseInt(num, 10);
|
|
1208
|
+
const result = await checkKillTarget({ pid, signal: "SIGTERM", cmd: fullCommand });
|
|
1209
|
+
if (result.blocked) return result;
|
|
1210
|
+
}
|
|
1211
|
+
}
|
|
1212
|
+
}
|
|
1213
|
+
if (cmdLower === "pkill" || cmdLower === "killall") {
|
|
1214
|
+
const firstNonFlag = args.find((a) => !a.startsWith("-"));
|
|
1215
|
+
if (firstNonFlag) {
|
|
1216
|
+
const result = await checkKillTarget({
|
|
1217
|
+
name: firstNonFlag,
|
|
1218
|
+
signal: "SIGTERM",
|
|
1219
|
+
cmd: fullCommand
|
|
1220
|
+
});
|
|
1221
|
+
if (result.blocked) return result;
|
|
1222
|
+
}
|
|
1223
|
+
}
|
|
1224
|
+
}
|
|
1225
|
+
return { blocked: false };
|
|
1226
|
+
}
|
|
1227
|
+
function tokenizeShellCommand(command) {
|
|
1228
|
+
const tokens = [];
|
|
1229
|
+
let current = "";
|
|
1230
|
+
let quote = null;
|
|
1231
|
+
for (const char of command.trim()) {
|
|
1232
|
+
if (quote) {
|
|
1233
|
+
if (char === quote) quote = null;
|
|
1234
|
+
else current += char;
|
|
1235
|
+
continue;
|
|
1236
|
+
}
|
|
1237
|
+
if (char === '"' || char === "'") {
|
|
1238
|
+
quote = char;
|
|
1239
|
+
} else if (/\s/.test(char)) {
|
|
1240
|
+
if (current) {
|
|
1241
|
+
tokens.push(current);
|
|
1242
|
+
current = "";
|
|
1243
|
+
}
|
|
1244
|
+
} else {
|
|
1245
|
+
current += char;
|
|
1246
|
+
}
|
|
1247
|
+
}
|
|
1248
|
+
if (current) tokens.push(current);
|
|
1249
|
+
return tokens;
|
|
1250
|
+
}
|
|
1251
|
+
async function checkKillTarget(target) {
|
|
1252
|
+
const registry = getPersistentProcessRegistry();
|
|
1253
|
+
if (target.pid !== void 0) {
|
|
1254
|
+
const blocked = await registry.shouldBlockKill(target.pid);
|
|
1255
|
+
if (blocked) {
|
|
1256
|
+
return {
|
|
1257
|
+
blocked: true,
|
|
1258
|
+
reason: `Blocked: kill ${target.signal} PID ${target.pid} targets a protected WrongStack process (${target.cmd.slice(0, 80)}).`
|
|
1259
|
+
};
|
|
1260
|
+
}
|
|
1261
|
+
if (target.pid === process.pid) {
|
|
1262
|
+
return {
|
|
1263
|
+
blocked: true,
|
|
1264
|
+
reason: "Blocked: cannot kill the current WrongStack process."
|
|
1265
|
+
};
|
|
1266
|
+
}
|
|
1267
|
+
if (target.pid === process.ppid) {
|
|
1268
|
+
return {
|
|
1269
|
+
blocked: true,
|
|
1270
|
+
reason: "Blocked: cannot kill the parent terminal hosting WrongStack."
|
|
1271
|
+
};
|
|
1272
|
+
}
|
|
1273
|
+
return { blocked: false };
|
|
1274
|
+
}
|
|
1275
|
+
if (target.name) {
|
|
1276
|
+
const nameLower = target.name.toLowerCase().replace(/\.exe$/, "");
|
|
1277
|
+
if (nameLower.includes("wrongstack")) {
|
|
1278
|
+
return {
|
|
1279
|
+
blocked: true,
|
|
1280
|
+
reason: `Blocked: kill ${target.signal} '${target.name}' targets a WrongStack process name.`
|
|
1281
|
+
};
|
|
1282
|
+
}
|
|
1283
|
+
const currentImage = path.basename(process.execPath).toLowerCase().replace(/\.exe$/, "");
|
|
1284
|
+
const targetsNodeRuntime = nameLower === "node" || nameLower.startsWith("node");
|
|
1285
|
+
if (targetsNodeRuntime && currentImage === "node") {
|
|
1286
|
+
return {
|
|
1287
|
+
blocked: true,
|
|
1288
|
+
reason: `Blocked: kill ${target.signal} '${target.name}' would kill the active WrongStack node.exe runtime.`
|
|
1289
|
+
};
|
|
1290
|
+
}
|
|
1291
|
+
const protectedPids = await registry.getAllProtectedPids();
|
|
1292
|
+
if (protectedPids.length > 0 && targetsNodeRuntime) {
|
|
1293
|
+
return {
|
|
1294
|
+
blocked: true,
|
|
1295
|
+
reason: `Blocked: kill ${target.signal} '${target.name}' would kill all node.exe processes including active WrongStack instance(s).`
|
|
1296
|
+
};
|
|
1297
|
+
}
|
|
1298
|
+
return { blocked: false };
|
|
1299
|
+
}
|
|
1300
|
+
return { blocked: false };
|
|
1301
|
+
}
|
|
1302
|
+
|
|
1303
1303
|
// src/exec.ts
|
|
1304
1304
|
var isWin2 = process.platform === "win32";
|
|
1305
1305
|
var allowedCommands = new Set(DEFAULT_ALLOWED_COMMANDS);
|
|
@@ -1351,10 +1351,9 @@ var BLOCKED_ARG_PATTERNS = {
|
|
|
1351
1351
|
/^--exec=/,
|
|
1352
1352
|
/^--upload-pack=/,
|
|
1353
1353
|
/^--receive-pack=/,
|
|
1354
|
-
/^-C
|
|
1355
|
-
/^-c
|
|
1354
|
+
/^-C/,
|
|
1355
|
+
/^-c/,
|
|
1356
1356
|
/^--config$/,
|
|
1357
|
-
/^-c=/,
|
|
1358
1357
|
/^--config=/,
|
|
1359
1358
|
/^--config-env=/
|
|
1360
1359
|
],
|
|
@@ -1454,6 +1453,7 @@ function validateArgs(cmd, args) {
|
|
|
1454
1453
|
const blocked = BLOCKED_ARG_PATTERNS[cmd];
|
|
1455
1454
|
if (!blocked) return null;
|
|
1456
1455
|
for (const arg of args) {
|
|
1456
|
+
if (arg === "--") break;
|
|
1457
1457
|
for (const pattern of blocked) {
|
|
1458
1458
|
if (pattern.test(arg)) {
|
|
1459
1459
|
return `Blocked argument "${arg}" for command "${cmd}" (matches security pattern ${pattern})`;
|
|
@@ -1657,11 +1657,6 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
|
|
|
1657
1657
|
});
|
|
1658
1658
|
return;
|
|
1659
1659
|
}
|
|
1660
|
-
const resolved = resolveWin32Command(cmd);
|
|
1661
|
-
const needsShell = isWin2 && (resolved.endsWith(".cmd") || resolved.endsWith(".bat"));
|
|
1662
|
-
const shim = needsShell ? buildWin32CmdShimInvocation(resolved, args) : null;
|
|
1663
|
-
const spawnCmd = shim?.command ?? resolved;
|
|
1664
|
-
const spawnArgs = shim?.args ?? args;
|
|
1665
1660
|
const emitCompletedOnce = (exitCode, pid2, signal2) => {
|
|
1666
1661
|
if (telemetryCompleted) return;
|
|
1667
1662
|
telemetryCompleted = true;
|
|
@@ -1678,6 +1673,11 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
|
|
|
1678
1673
|
};
|
|
1679
1674
|
let child;
|
|
1680
1675
|
try {
|
|
1676
|
+
const resolved = resolveWin32Command(cmd);
|
|
1677
|
+
const needsShell = isWin2 && (resolved.endsWith(".cmd") || resolved.endsWith(".bat"));
|
|
1678
|
+
const shim = needsShell ? buildWin32CmdShimInvocation(resolved, args) : null;
|
|
1679
|
+
const spawnCmd = shim?.command ?? resolved;
|
|
1680
|
+
const spawnArgs = shim?.args ?? args;
|
|
1681
1681
|
child = spawn(spawnCmd, spawnArgs, {
|
|
1682
1682
|
cwd,
|
|
1683
1683
|
env: buildChildEnv(sessionId),
|
|
@@ -1687,6 +1687,7 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
|
|
|
1687
1687
|
...shim ? { windowsVerbatimArguments: shim.windowsVerbatimArguments } : {}
|
|
1688
1688
|
});
|
|
1689
1689
|
} catch (err) {
|
|
1690
|
+
getProcessRegistry().afterCall(Date.now() - startedAt, true);
|
|
1690
1691
|
spool.finalize();
|
|
1691
1692
|
emitProcessStarted({
|
|
1692
1693
|
parentPid: process.pid,
|
|
@@ -1718,10 +1719,18 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
|
|
|
1718
1719
|
background: false,
|
|
1719
1720
|
startedAt: new Date(startedAt).toISOString()
|
|
1720
1721
|
});
|
|
1722
|
+
const registry = getProcessRegistry();
|
|
1723
|
+
const pid = child.pid;
|
|
1724
|
+
let timer;
|
|
1725
|
+
const onAbort = () => {
|
|
1726
|
+
killed = true;
|
|
1727
|
+
if (typeof pid === "number") registry.kill(pid, { force: true });
|
|
1728
|
+
else child.kill("SIGTERM");
|
|
1729
|
+
};
|
|
1721
1730
|
child.on("error", (err) => {
|
|
1722
1731
|
const isAbort = err && err.code === "ABORT_ERR";
|
|
1723
1732
|
const stderrText = isAbort ? `Aborted: ${err.message}` : err.message;
|
|
1724
|
-
clearTimeout(timer);
|
|
1733
|
+
if (timer !== void 0) clearTimeout(timer);
|
|
1725
1734
|
if (isWin2) signal.removeEventListener("abort", onAbort);
|
|
1726
1735
|
if (typeof pid === "number") registry.unregister(pid);
|
|
1727
1736
|
registry.afterCall(Date.now() - startedAt, true);
|
|
@@ -1738,8 +1747,6 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
|
|
|
1738
1747
|
danger
|
|
1739
1748
|
});
|
|
1740
1749
|
});
|
|
1741
|
-
const registry = getProcessRegistry();
|
|
1742
|
-
const pid = child.pid;
|
|
1743
1750
|
if (typeof pid === "number") {
|
|
1744
1751
|
const fullCommand = `${cmd} ${args.join(" ")}`;
|
|
1745
1752
|
registry.register({
|
|
@@ -1751,17 +1758,12 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
|
|
|
1751
1758
|
child
|
|
1752
1759
|
});
|
|
1753
1760
|
}
|
|
1754
|
-
|
|
1761
|
+
timer = setTimeout(() => {
|
|
1755
1762
|
killed = true;
|
|
1756
1763
|
timedOut = true;
|
|
1757
1764
|
if (typeof pid === "number") registry.kill(pid);
|
|
1758
1765
|
else child.kill("SIGTERM");
|
|
1759
1766
|
}, timeout);
|
|
1760
|
-
const onAbort = () => {
|
|
1761
|
-
killed = true;
|
|
1762
|
-
if (typeof pid === "number") registry.kill(pid, { force: true });
|
|
1763
|
-
else child.kill("SIGTERM");
|
|
1764
|
-
};
|
|
1765
1767
|
if (isWin2) {
|
|
1766
1768
|
if (signal.aborted) onAbort();
|
|
1767
1769
|
else signal.addEventListener("abort", onAbort, { once: true });
|
|
@@ -1787,9 +1789,10 @@ function runCommand(cmd, args, cwd, timeout, signal, sessionId, danger) {
|
|
|
1787
1789
|
}
|
|
1788
1790
|
});
|
|
1789
1791
|
child.on("close", (code) => {
|
|
1790
|
-
clearTimeout(timer);
|
|
1792
|
+
if (timer !== void 0) clearTimeout(timer);
|
|
1791
1793
|
if (isWin2) signal.removeEventListener("abort", onAbort);
|
|
1792
1794
|
if (typeof pid === "number") registry.unregister(pid);
|
|
1795
|
+
if (resolvedOnce.value) return;
|
|
1793
1796
|
const durationMs = Date.now() - startedAt;
|
|
1794
1797
|
const exitCode = killed ? 124 : code ?? 1;
|
|
1795
1798
|
emitCompletedOnce(exitCode, pid);
|
|
@@ -1832,4 +1835,4 @@ export {
|
|
|
1832
1835
|
getExecAllowlist,
|
|
1833
1836
|
execTool
|
|
1834
1837
|
};
|
|
1835
|
-
//# sourceMappingURL=chunk-
|
|
1838
|
+
//# sourceMappingURL=chunk-MGPR7VG3.js.map
|
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
import {
|
|
2
2
|
builtinToolsPack
|
|
3
|
-
} from "./chunk-
|
|
3
|
+
} from "./chunk-EL2NJXSK.js";
|
|
4
4
|
import {
|
|
5
5
|
TIER1_TOOLS,
|
|
6
6
|
TIER2_TOOLS
|
|
7
|
-
} from "./chunk-
|
|
7
|
+
} from "./chunk-UCXFTCAI.js";
|
|
8
8
|
|
|
9
9
|
// src/tool-tier.ts
|
|
10
10
|
function toolNameSet(tools) {
|
|
@@ -54,4 +54,4 @@ export {
|
|
|
54
54
|
selectBuiltinToolsForTier,
|
|
55
55
|
registerBuiltinToolTier
|
|
56
56
|
};
|
|
57
|
-
//# sourceMappingURL=chunk-
|
|
57
|
+
//# sourceMappingURL=chunk-NFX2IUQA.js.map
|