@xortex/xcode 3.0.0

package/tools/BashTool/shouldUseSandbox.ts

@@ -0,0 +1,153 @@
+import { getFeatureValue_CACHED_MAY_BE_STALE } from 'src/services/analytics/growthbook.js'
+import { splitCommand_DEPRECATED } from '../../utils/bash/commands.js'
+import { SandboxManager } from '../../utils/sandbox/sandbox-adapter.js'
+import { getSettings_DEPRECATED } from '../../utils/settings/settings.js'
+import {
+  BINARY_HIJACK_VARS,
+  bashPermissionRule,
+  matchWildcardPattern,
+  stripAllLeadingEnvVars,
+  stripSafeWrappers,
+} from './bashPermissions.js'
+
+type SandboxInput = {
+  command?: string
+  dangerouslyDisableSandbox?: boolean
+}
+
+// NOTE: excludedCommands is a user-facing convenience feature, not a security boundary.
+// It is not a security bug to be able to bypass excludedCommands — the sandbox permission
+// system (which prompts users) is the actual security control.
+function containsExcludedCommand(command: string): boolean {
+  // Check dynamic config for disabled commands and substrings (only for ants)
+  if (process.env.USER_TYPE === 'ant') {
+    const disabledCommands = getFeatureValue_CACHED_MAY_BE_STALE<{
+      commands: string[]
+      substrings: string[]
+    }>('tengu_sandbox_disabled_commands', { commands: [], substrings: [] })
+
+    // Check if command contains any disabled substrings
+    for (const substring of disabledCommands.substrings) {
+      if (command.includes(substring)) {
+        return true
+      }
+    }
+
+    // Check if command starts with any disabled commands
+    try {
+      const commandParts = splitCommand_DEPRECATED(command)
+      for (const part of commandParts) {
+        const baseCommand = part.trim().split(' ')[0]
+        if (baseCommand && disabledCommands.commands.includes(baseCommand)) {
+          return true
+        }
+      }
+    } catch {
+      // If we can't parse the command (e.g., malformed bash syntax),
+      // treat it as not excluded to allow other validation checks to handle it
+      // This prevents crashes when rendering tool use messages
+    }
+  }
+
+  // Check user-configured excluded commands from settings
+  const settings = getSettings_DEPRECATED()
+  const userExcludedCommands = settings.sandbox?.excludedCommands ?? []
+
+  if (userExcludedCommands.length === 0) {
+    return false
+  }
+
+  // Split compound commands (e.g. "docker ps && curl evil.com") into individual
+  // subcommands and check each one against excluded patterns. This prevents a
+  // compound command from escaping the sandbox just because its first subcommand
+  // matches an excluded pattern.
+  let subcommands: string[]
+  try {
+    subcommands = splitCommand_DEPRECATED(command)
+  } catch {
+    subcommands = [command]
+  }
+
+  for (const subcommand of subcommands) {
+    const trimmed = subcommand.trim()
+    // Also try matching with env var prefixes and wrapper commands stripped, so
+    // that `FOO=bar bazel ...` and `timeout 30 bazel ...` match `bazel:*`. Not a
+    // security boundary (see NOTE at top); the &&-split above already lets
+    // `export FOO=bar && bazel ...` match. BINARY_HIJACK_VARS kept as a heuristic.
+    //
+    // We iteratively apply both stripping operations until no new candidates are
+    // produced (fixed-point), matching the approach in filterRulesByContentsMatchingInput.
+    // This handles interleaved patterns like `timeout 300 FOO=bar bazel run`
+    // where single-pass composition would fail.
+    const candidates = [trimmed]
+    const seen = new Set(candidates)
+    let startIdx = 0
+    while (startIdx < candidates.length) {
+      const endIdx = candidates.length
+      for (let i = startIdx; i < endIdx; i++) {
+        const cmd = candidates[i]!
+        const envStripped = stripAllLeadingEnvVars(cmd, BINARY_HIJACK_VARS)
+        if (!seen.has(envStripped)) {
+          candidates.push(envStripped)
+          seen.add(envStripped)
+        }
+        const wrapperStripped = stripSafeWrappers(cmd)
+        if (!seen.has(wrapperStripped)) {
+          candidates.push(wrapperStripped)
+          seen.add(wrapperStripped)
+        }
+      }
+      startIdx = endIdx
+    }
+
+    for (const pattern of userExcludedCommands) {
+      const rule = bashPermissionRule(pattern)
+      for (const cand of candidates) {
+        switch (rule.type) {
+          case 'prefix':
+            if (cand === rule.prefix || cand.startsWith(rule.prefix + ' ')) {
+              return true
+            }
+            break
+          case 'exact':
+            if (cand === rule.command) {
+              return true
+            }
+            break
+          case 'wildcard':
+            if (matchWildcardPattern(rule.pattern, cand)) {
+              return true
+            }
+            break
+        }
+      }
+    }
+  }
+
+  return false
+}
+
+export function shouldUseSandbox(input: Partial<SandboxInput>): boolean {
+  if (!SandboxManager.isSandboxingEnabled()) {
+    return false
+  }
+
+  // Don't sandbox if explicitly overridden AND unsandboxed commands are allowed by policy
+  if (
+    input.dangerouslyDisableSandbox &&
+    SandboxManager.areUnsandboxedCommandsAllowed()
+  ) {
+    return false
+  }
+
+  if (!input.command) {
+    return false
+  }
+
+  // Don't sandbox if the command contains user-configured excluded commands
+  if (containsExcludedCommand(input.command)) {
+    return false
+  }
+
+  return true
+}

package/tools/BashTool/toolName.ts

@@ -0,0 +1,2 @@
+// Here to break circular dependency from prompt.ts
+export const BASH_TOOL_NAME = 'Bash'

package/tools/BashTool/utils.ts

@@ -0,0 +1,223 @@
+import type {
+  Base64ImageSource,
+  ContentBlockParam,
+  ToolResultBlockParam,
+} from '@anthropic-ai/sdk/resources/index.mjs'
+import { readFile, stat } from 'fs/promises'
+import { getOriginalCwd } from 'src/bootstrap/state.js'
+import { logEvent } from 'src/services/analytics/index.js'
+import type { ToolPermissionContext } from 'src/Tool.js'
+import { getCwd } from 'src/utils/cwd.js'
+import { pathInAllowedWorkingPath } from 'src/utils/permissions/filesystem.js'
+import { setCwd } from 'src/utils/Shell.js'
+import { shouldMaintainProjectWorkingDir } from '../../utils/envUtils.js'
+import { maybeResizeAndDownsampleImageBuffer } from '../../utils/imageResizer.js'
+import { getMaxOutputLength } from '../../utils/shell/outputLimits.js'
+import { countCharInString, plural } from '../../utils/stringUtils.js'
+/**
+ * Strips leading and trailing lines that contain only whitespace/newlines.
+ * Unlike trim(), this preserves whitespace within content lines and only removes
+ * completely empty lines from the beginning and end.
+ */
+export function stripEmptyLines(content: string): string {
+  const lines = content.split('\n')
+
+  // Find the first non-empty line
+  let startIndex = 0
+  while (startIndex < lines.length && lines[startIndex]?.trim() === '') {
+    startIndex++
+  }
+
+  // Find the last non-empty line
+  let endIndex = lines.length - 1
+  while (endIndex >= 0 && lines[endIndex]?.trim() === '') {
+    endIndex--
+  }
+
+  // If all lines are empty, return empty string
+  if (startIndex > endIndex) {
+    return ''
+  }
+
+  // Return the slice with non-empty lines
+  return lines.slice(startIndex, endIndex + 1).join('\n')
+}
+
+/**
+ * Check if content is a base64 encoded image data URL
+ */
+export function isImageOutput(content: string): boolean {
+  return /^data:image\/[a-z0-9.+_-]+;base64,/i.test(content)
+}
+
+const DATA_URI_RE = /^data:([^;]+);base64,(.+)$/
+
+/**
+ * Parse a data-URI string into its media type and base64 payload.
+ * Input is trimmed before matching.
+ */
+export function parseDataUri(
+  s: string,
+): { mediaType: string; data: string } | null {
+  const match = s.trim().match(DATA_URI_RE)
+  if (!match || !match[1] || !match[2]) return null
+  return { mediaType: match[1], data: match[2] }
+}
+
+/**
+ * Build an image tool_result block from shell stdout containing a data URI.
+ * Returns null if parse fails so callers can fall through to text handling.
+ */
+export function buildImageToolResult(
+  stdout: string,
+  toolUseID: string,
+): ToolResultBlockParam | null {
+  const parsed = parseDataUri(stdout)
+  if (!parsed) return null
+  return {
+    tool_use_id: toolUseID,
+    type: 'tool_result',
+    content: [
+      {
+        type: 'image',
+        source: {
+          type: 'base64',
+          media_type: parsed.mediaType as Base64ImageSource['media_type'],
+          data: parsed.data,
+        },
+      },
+    ],
+  }
+}
+
+// Cap file reads to 20 MB — any image data URI larger than this is
+// well beyond what the API accepts (5 MB base64) and would OOM if read
+// into memory.
+const MAX_IMAGE_FILE_SIZE = 20 * 1024 * 1024
+
+/**
+ * Resize image output from a shell tool. stdout is capped at
+ * getMaxOutputLength() when read back from the shell output file — if the
+ * full output spilled to disk, re-read it from there, since truncated base64
+ * would decode to a corrupt image that either throws here or gets rejected by
+ * the API. Caps dimensions too: compressImageBuffer only checks byte size, so
+ * a small-but-high-DPI PNG (e.g. matplotlib at dpi=300) sails through at full
+ * resolution and poisons many-image requests (CC-304).
+ *
+ * Returns the re-encoded data URI on success, or null if the source didn't
+ * parse as a data URI (caller decides whether to flip isImage).
+ */
+export async function resizeShellImageOutput(
+  stdout: string,
+  outputFilePath: string | undefined,
+  outputFileSize: number | undefined,
+): Promise<string | null> {
+  let source = stdout
+  if (outputFilePath) {
+    const size = outputFileSize ?? (await stat(outputFilePath)).size
+    if (size > MAX_IMAGE_FILE_SIZE) return null
+    source = await readFile(outputFilePath, 'utf8')
+  }
+  const parsed = parseDataUri(source)
+  if (!parsed) return null
+  const buf = Buffer.from(parsed.data, 'base64')
+  const ext = parsed.mediaType.split('/')[1] || 'png'
+  const resized = await maybeResizeAndDownsampleImageBuffer(
+    buf,
+    buf.length,
+    ext,
+  )
+  return `data:image/${resized.mediaType};base64,${resized.buffer.toString('base64')}`
+}
+
+export function formatOutput(content: string): {
+  totalLines: number
+  truncatedContent: string
+  isImage?: boolean
+} {
+  const isImage = isImageOutput(content)
+  if (isImage) {
+    return {
+      totalLines: 1,
+      truncatedContent: content,
+      isImage,
+    }
+  }
+
+  const maxOutputLength = getMaxOutputLength()
+  if (content.length <= maxOutputLength) {
+    return {
+      totalLines: countCharInString(content, '\n') + 1,
+      truncatedContent: content,
+      isImage,
+    }
+  }
+
+  const truncatedPart = content.slice(0, maxOutputLength)
+  const remainingLines = countCharInString(content, '\n', maxOutputLength) + 1
+  const truncated = `${truncatedPart}\n\n... [${remainingLines} lines truncated] ...`
+
+  return {
+    totalLines: countCharInString(content, '\n') + 1,
+    truncatedContent: truncated,
+    isImage,
+  }
+}
+
+export const stdErrAppendShellResetMessage = (stderr: string): string =>
+  `${stderr.trim()}\nShell cwd was reset to ${getOriginalCwd()}`
+
+export function resetCwdIfOutsideProject(
+  toolPermissionContext: ToolPermissionContext,
+): boolean {
+  const cwd = getCwd()
+  const originalCwd = getOriginalCwd()
+  const shouldMaintain = shouldMaintainProjectWorkingDir()
+  if (
+    shouldMaintain ||
+    // Fast path: originalCwd is unconditionally in allWorkingDirectories
+    // (filesystem.ts), so when cwd hasn't moved, pathInAllowedWorkingPath is
+    // trivially true — skip its syscalls for the no-cd common case.
+    (cwd !== originalCwd &&
+      !pathInAllowedWorkingPath(cwd, toolPermissionContext))
+  ) {
+    // Reset to original directory if maintaining project dir OR outside allowed working directory
+    setCwd(originalCwd)
+    if (!shouldMaintain) {
+      logEvent('tengu_bash_tool_reset_to_original_dir', {})
+      return true
+    }
+  }
+  return false
+}
+
+/**
+ * Creates a human-readable summary of structured content blocks.
+ * Used to display MCP results with images and text in the UI.
+ */
+export function createContentSummary(content: ContentBlockParam[]): string {
+  const parts: string[] = []
+  let textCount = 0
+  let imageCount = 0
+
+  for (const block of content) {
+    if (block.type === 'image') {
+      imageCount++
+    } else if (block.type === 'text' && 'text' in block) {
+      textCount++
+      // Include first 200 chars of text blocks for context
+      const preview = block.text.slice(0, 200)
+      parts.push(preview + (block.text.length > 200 ? '...' : ''))
+    }
+  }
+
+  const summary: string[] = []
+  if (imageCount > 0) {
+    summary.push(`[${imageCount} ${plural(imageCount, 'image')}]`)
+  }
+  if (textCount > 0) {
+    summary.push(`[${textCount} text ${plural(textCount, 'block')}]`)
+  }
+
+  return `MCP Result: ${summary.join(', ')}${parts.length > 0 ? '\n\n' + parts.join('\n\n') : ''}`
+}

package/tools/BriefTool/BriefTool.ts

@@ -0,0 +1,204 @@
+import { feature } from 'bun:bundle'
+import { z } from 'zod/v4'
+import { getKairosActive, getUserMsgOptIn } from '../../bootstrap/state.js'
+import { getFeatureValue_CACHED_WITH_REFRESH } from '../../services/analytics/growthbook.js'
+import { logEvent } from '../../services/analytics/index.js'
+import type { ValidationResult } from '../../Tool.js'
+import { buildTool, type ToolDef } from '../../Tool.js'
+import { isEnvTruthy } from '../../utils/envUtils.js'
+import { lazySchema } from '../../utils/lazySchema.js'
+import { plural } from '../../utils/stringUtils.js'
+import { resolveAttachments, validateAttachmentPaths } from './attachments.js'
+import {
+  BRIEF_TOOL_NAME,
+  BRIEF_TOOL_PROMPT,
+  DESCRIPTION,
+  LEGACY_BRIEF_TOOL_NAME,
+} from './prompt.js'
+import { renderToolResultMessage, renderToolUseMessage } from './UI.js'
+
+const inputSchema = lazySchema(() =>
+  z.strictObject({
+    message: z
+      .string()
+      .describe('The message for the user. Supports markdown formatting.'),
+    attachments: z
+      .array(z.string())
+      .optional()
+      .describe(
+        'Optional file paths (absolute or relative to cwd) to attach. Use for photos, screenshots, diffs, logs, or any file the user should see alongside your message.',
+      ),
+    status: z
+      .enum(['normal', 'proactive'])
+      .describe(
+        "Use 'proactive' when you're surfacing something the user hasn't asked for and needs to see now — task completion while they're away, a blocker you hit, an unsolicited status update. Use 'normal' when replying to something the user just said.",
+      ),
+  }),
+)
+type InputSchema = ReturnType<typeof inputSchema>
+
+// attachments MUST remain optional — resumed sessions replay pre-attachment
+// outputs verbatim and a required field would crash the UI renderer on resume.
+const outputSchema = lazySchema(() =>
+  z.object({
+    message: z.string().describe('The message'),
+    attachments: z
+      .array(
+        z.object({
+          path: z.string(),
+          size: z.number(),
+          isImage: z.boolean(),
+          file_uuid: z.string().optional(),
+        }),
+      )
+      .optional()
+      .describe('Resolved attachment metadata'),
+    sentAt: z
+      .string()
+      .optional()
+      .describe(
+        'ISO timestamp captured at tool execution on the emitting process. Optional — resumed sessions replay pre-sentAt outputs verbatim.',
+      ),
+  }),
+)
+type OutputSchema = ReturnType<typeof outputSchema>
+export type Output = z.infer<OutputSchema>
+
+const KAIROS_BRIEF_REFRESH_MS = 5 * 60 * 1000
+
+/**
+ * Entitlement check — is the user ALLOWED to use Brief? Combines build-time
+ * flags with runtime GB gate + assistant-mode passthrough. No opt-in check
+ * here — this decides whether opt-in should be HONORED, not whether the user
+ * has opted in.
+ *
+ * Build-time OR-gated on KAIROS || KAIROS_BRIEF (same pattern as
+ * PROACTIVE || KAIROS): assistant mode depends on Brief, so KAIROS alone
+ * must bundle it. KAIROS_BRIEF lets Brief ship independently.
+ *
+ * Use this to decide whether `--brief` / `defaultView: 'chat'` / `--tools`
+ * listing should be honored. Use `isBriefEnabled()` to decide whether the
+ * tool is actually active in the current session.
+ *
+ * CLAUDE_CODE_BRIEF env var force-grants entitlement for dev/testing —
+ * bypasses the GB gate so you can test without being enrolled. Still
+ * requires an opt-in action to activate (--brief, defaultView, etc.), but
+ * the env var alone also sets userMsgOptIn via maybeActivateBrief().
+ */
+export function isBriefEntitled(): boolean {
+  // Positive ternary — see docs/feature-gating.md. Negative early-return
+  // would not eliminate the GB gate string from external builds.
+  return feature('KAIROS') || feature('KAIROS_BRIEF')
+    ? getKairosActive() ||
+        isEnvTruthy(process.env.CLAUDE_CODE_BRIEF) ||
+        getFeatureValue_CACHED_WITH_REFRESH(
+          'tengu_kairos_brief',
+          false,
+          KAIROS_BRIEF_REFRESH_MS,
+        )
+    : false
+}
+
+/**
+ * Unified activation gate for the Brief tool. Governs model-facing behavior
+ * as a unit: tool availability, system prompt section (getBriefSection),
+ * tool-deferral bypass (isDeferredTool), and todo-nag suppression.
+ *
+ * Activation requires explicit opt-in (userMsgOptIn) set by one of:
+ *   - `--brief` CLI flag (maybeActivateBrief in main.tsx)
+ *   - `defaultView: 'chat'` in settings (main.tsx init)
+ *   - `/brief` slash command (brief.ts)
+ *   - `/config` defaultView picker (Config.tsx)
+ *   - SendUserMessage in `--tools` / SDK `tools` option (main.tsx)
+ *   - CLAUDE_CODE_BRIEF env var (maybeActivateBrief — dev/testing bypass)
+ * Assistant mode (kairosActive) bypasses opt-in since its system prompt
+ * hard-codes "you MUST use SendUserMessage" (systemPrompt.md:14).
+ *
+ * The GB gate is re-checked here as a kill-switch AND — flipping
+ * tengu_kairos_brief off mid-session disables the tool on the next 5-min
+ * refresh even for opted-in sessions. No opt-in → always false regardless
+ * of GB (this is the fix for "brief defaults on for enrolled ants").
+ *
+ * Called from Tool.isEnabled() (lazy, post-init), never at module scope.
+ * getKairosActive() and getUserMsgOptIn() are set in main.tsx before any
+ * caller reaches here.
+ */
+export function isBriefEnabled(): boolean {
+  // Top-level feature() guard is load-bearing for DCE: Bun can constant-fold
+  // the ternary to `false` in external builds and then dead-code the BriefTool
+  // object. Composing isBriefEntitled() alone (which has its own guard) is
+  // semantically equivalent but defeats constant-folding across the boundary.
+  return feature('KAIROS') || feature('KAIROS_BRIEF')
+    ? (getKairosActive() || getUserMsgOptIn()) && isBriefEntitled()
+    : false
+}
+
+export const BriefTool = buildTool({
+  name: BRIEF_TOOL_NAME,
+  aliases: [LEGACY_BRIEF_TOOL_NAME],
+  searchHint:
+    'send a message to the user — your primary visible output channel',
+  maxResultSizeChars: 100_000,
+  userFacingName() {
+    return ''
+  },
+  get inputSchema(): InputSchema {
+    return inputSchema()
+  },
+  get outputSchema(): OutputSchema {
+    return outputSchema()
+  },
+  isEnabled() {
+    return isBriefEnabled()
+  },
+  isConcurrencySafe() {
+    return true
+  },
+  isReadOnly() {
+    return true
+  },
+  toAutoClassifierInput(input) {
+    return input.message
+  },
+  async validateInput({ attachments }, _context): Promise<ValidationResult> {
+    if (!attachments || attachments.length === 0) {
+      return { result: true }
+    }
+    return validateAttachmentPaths(attachments)
+  },
+  async description() {
+    return DESCRIPTION
+  },
+  async prompt() {
+    return BRIEF_TOOL_PROMPT
+  },
+  mapToolResultToToolResultBlockParam(output, toolUseID) {
+    const n = output.attachments?.length ?? 0
+    const suffix = n === 0 ? '' : ` (${n} ${plural(n, 'attachment')} included)`
+    return {
+      tool_use_id: toolUseID,
+      type: 'tool_result',
+      content: `Message delivered to user.${suffix}`,
+    }
+  },
+  renderToolUseMessage,
+  renderToolResultMessage,
+  async call({ message, attachments, status }, context) {
+    const sentAt = new Date().toISOString()
+    logEvent('tengu_brief_send', {
+      proactive: status === 'proactive',
+      attachment_count: attachments?.length ?? 0,
+    })
+    if (!attachments || attachments.length === 0) {
+      return { data: { message, sentAt } }
+    }
+    const appState = context.getAppState()
+    const resolved = await resolveAttachments(attachments, {
+      replBridgeEnabled: appState.replBridgeEnabled,
+      signal: context.abortController.signal,
+    })
+    return {
+      data: { message, attachments: resolved, sentAt },
+    }
+  },
+} satisfies ToolDef<InputSchema, Output>)