@xortex/xcode 3.0.0

package/utils/shell/bashProvider.ts

@@ -0,0 +1,255 @@
+import { feature } from 'bun:bundle'
+import { access } from 'fs/promises'
+import { tmpdir as osTmpdir } from 'os'
+import { join as nativeJoin } from 'path'
+import { join as posixJoin } from 'path/posix'
+import { rearrangePipeCommand } from '../bash/bashPipeCommand.js'
+import { createAndSaveSnapshot } from '../bash/ShellSnapshot.js'
+import { formatShellPrefixCommand } from '../bash/shellPrefix.js'
+import { quote } from '../bash/shellQuote.js'
+import {
+  quoteShellCommand,
+  rewriteWindowsNullRedirect,
+  shouldAddStdinRedirect,
+} from '../bash/shellQuoting.js'
+import { logForDebugging } from '../debug.js'
+import { getPlatform } from '../platform.js'
+import { getSessionEnvironmentScript } from '../sessionEnvironment.js'
+import { getSessionEnvVars } from '../sessionEnvVars.js'
+import {
+  ensureSocketInitialized,
+  getClaudeTmuxEnv,
+  hasTmuxToolBeenUsed,
+} from '../tmuxSocket.js'
+import { windowsPathToPosixPath } from '../windowsPaths.js'
+import type { ShellProvider } from './shellProvider.js'
+
+/**
+ * Returns a shell command to disable extended glob patterns for security.
+ * Extended globs (bash extglob, zsh EXTENDED_GLOB) can be exploited via
+ * malicious filenames that expand after our security validation.
+ *
+ * When CLAUDE_CODE_SHELL_PREFIX is set, the actual executing shell may differ
+ * from shellPath (e.g., shellPath is zsh but the wrapper runs bash). In this
+ * case, we include commands for BOTH shells. We redirect both stdout and stderr
+ * to /dev/null because zsh's command_not_found_handler writes to STDOUT.
+ *
+ * When no shell prefix is set, we use the appropriate command for the detected shell.
+ */
+function getDisableExtglobCommand(shellPath: string): string | null {
+  // When CLAUDE_CODE_SHELL_PREFIX is set, the wrapper may use a different shell
+  // than shellPath, so we include both bash and zsh commands
+  if (process.env.CLAUDE_CODE_SHELL_PREFIX) {
+    // Redirect both stdout and stderr because zsh's command_not_found_handler
+    // writes to stdout instead of stderr
+    return '{ shopt -u extglob || setopt NO_EXTENDED_GLOB; } >/dev/null 2>&1 || true'
+  }
+
+  // No shell prefix - use shell-specific command
+  if (shellPath.includes('bash')) {
+    return 'shopt -u extglob 2>/dev/null || true'
+  } else if (shellPath.includes('zsh')) {
+    return 'setopt NO_EXTENDED_GLOB 2>/dev/null || true'
+  }
+  // Unknown shell - do nothing, we don't know the right command
+  return null
+}
+
+export async function createBashShellProvider(
+  shellPath: string,
+  options?: { skipSnapshot?: boolean },
+): Promise<ShellProvider> {
+  let currentSandboxTmpDir: string | undefined
+  const snapshotPromise: Promise<string | undefined> = options?.skipSnapshot
+    ? Promise.resolve(undefined)
+    : createAndSaveSnapshot(shellPath).catch(error => {
+        logForDebugging(`Failed to create shell snapshot: ${error}`)
+        return undefined
+      })
+  // Track the last resolved snapshot path for use in getSpawnArgs
+  let lastSnapshotFilePath: string | undefined
+
+  return {
+    type: 'bash',
+    shellPath,
+    detached: true,
+
+    async buildExecCommand(
+      command: string,
+      opts: {
+        id: number | string
+        sandboxTmpDir?: string
+        useSandbox: boolean
+      },
+    ): Promise<{ commandString: string; cwdFilePath: string }> {
+      let snapshotFilePath = await snapshotPromise
+      // This access() check is NOT pure TOCTOU — it's the fallback decision
+      // point for getSpawnArgs. When the snapshot disappears mid-session
+      // (tmpdir cleanup), we must clear lastSnapshotFilePath so getSpawnArgs
+      // adds -l and the command gets login-shell init. Without this check,
+      // `source ... || true` silently fails and commands run with NO shell
+      // init (neither snapshot env nor login profile). The `|| true` on source
+      // still guards the race between this check and the spawned shell.
+      if (snapshotFilePath) {
+        try {
+          await access(snapshotFilePath)
+        } catch {
+          logForDebugging(
+            `Snapshot file missing, falling back to login shell: ${snapshotFilePath}`,
+          )
+          snapshotFilePath = undefined
+        }
+      }
+      lastSnapshotFilePath = snapshotFilePath
+
+      // Stash sandboxTmpDir for use in getEnvironmentOverrides
+      currentSandboxTmpDir = opts.sandboxTmpDir
+
+      const tmpdir = osTmpdir()
+      const isWindows = getPlatform() === 'windows'
+      const shellTmpdir = isWindows ? windowsPathToPosixPath(tmpdir) : tmpdir
+
+      // shellCwdFilePath: POSIX path used inside the bash command (pwd -P >| ...)
+      // cwdFilePath: native OS path used by Node.js for readFileSync/unlinkSync
+      // On non-Windows these are identical; on Windows, Git Bash needs POSIX paths
+      // but Node.js needs native Windows paths for file operations.
+      const shellCwdFilePath = opts.useSandbox
+        ? posixJoin(opts.sandboxTmpDir!, `cwd-${opts.id}`)
+        : posixJoin(shellTmpdir, `claude-${opts.id}-cwd`)
+      const cwdFilePath = opts.useSandbox
+        ? posixJoin(opts.sandboxTmpDir!, `cwd-${opts.id}`)
+        : nativeJoin(tmpdir, `claude-${opts.id}-cwd`)
+
+      // Defensive rewrite: the model sometimes emits Windows CMD-style `2>nul`
+      // redirects. In POSIX bash (including Git Bash on Windows), this creates a
+      // literal file named `nul` — a reserved device name that breaks git.
+      // See anthropics/claude-code#4928.
+      const normalizedCommand = rewriteWindowsNullRedirect(command)
+      const addStdinRedirect = shouldAddStdinRedirect(normalizedCommand)
+      let quotedCommand = quoteShellCommand(normalizedCommand, addStdinRedirect)
+
+      // Debug logging for heredoc/multiline commands to trace trailer handling
+      // Only log when commit attribution is enabled to avoid noise
+      if (
+        feature('COMMIT_ATTRIBUTION') &&
+        (command.includes('<<') || command.includes('\n'))
+      ) {
+        logForDebugging(
+          `Shell: Command before quoting (first 500 chars):\n${command.slice(0, 500)}`,
+        )
+        logForDebugging(
+          `Shell: Quoted command (first 500 chars):\n${quotedCommand.slice(0, 500)}`,
+        )
+      }
+
+      // Special handling for pipes: move stdin redirect after first command
+      // This ensures the redirect applies to the first command, not to eval itself.
+      // Without this, `eval 'rg foo | wc -l' \< /dev/null` becomes
+      // `rg foo | wc -l < /dev/null` — wc reads /dev/null and outputs 0, and
+      // rg (with no path arg) waits on the open spawn stdin pipe forever.
+      // Applies to sandbox mode too: sandbox wraps the assembled commandString,
+      // not the raw command (since PR #9189).
+      if (normalizedCommand.includes('|') && addStdinRedirect) {
+        quotedCommand = rearrangePipeCommand(normalizedCommand)
+      }
+
+      const commandParts: string[] = []
+
+      // Source the snapshot file. The `|| true` guards the race between the
+      // access() check above and the spawned shell's `source` — if the file
+      // vanishes in that window, the `&&` chain still continues.
+      if (snapshotFilePath) {
+        const finalPath =
+          getPlatform() === 'windows'
+            ? windowsPathToPosixPath(snapshotFilePath)
+            : snapshotFilePath
+        commandParts.push(`source ${quote([finalPath])} 2>/dev/null || true`)
+      }
+
+      // Source session environment variables captured from session start hooks
+      const sessionEnvScript = await getSessionEnvironmentScript()
+      if (sessionEnvScript) {
+        commandParts.push(sessionEnvScript)
+      }
+
+      // Disable extended glob patterns for security (after sourcing user config to override)
+      const disableExtglobCmd = getDisableExtglobCommand(shellPath)
+      if (disableExtglobCmd) {
+        commandParts.push(disableExtglobCmd)
+      }
+
+      // When sourcing a file with aliases, they won't be expanded in the same command line
+      // because the shell parses the entire line before execution. Using eval after
+      // sourcing causes a second parsing pass where aliases are now available for expansion.
+      commandParts.push(`eval ${quotedCommand}`)
+      // Use `pwd -P` to get the physical path of the current working directory for consistency with `process.cwd()`
+      commandParts.push(`pwd -P >| ${quote([shellCwdFilePath])}`)
+      let commandString = commandParts.join(' && ')
+
+      // Apply CLAUDE_CODE_SHELL_PREFIX if set
+      if (process.env.CLAUDE_CODE_SHELL_PREFIX) {
+        commandString = formatShellPrefixCommand(
+          process.env.CLAUDE_CODE_SHELL_PREFIX,
+          commandString,
+        )
+      }
+
+      return { commandString, cwdFilePath }
+    },
+
+    getSpawnArgs(commandString: string): string[] {
+      const skipLoginShell = lastSnapshotFilePath !== undefined
+      if (skipLoginShell) {
+        logForDebugging('Spawning shell without login (-l flag skipped)')
+      }
+      return ['-c', ...(skipLoginShell ? [] : ['-l']), commandString]
+    },
+
+    async getEnvironmentOverrides(
+      command: string,
+    ): Promise<Record<string, string>> {
+      // TMUX SOCKET ISOLATION (DEFERRED):
+      // We initialize Claude's tmux socket ONLY AFTER the Tmux tool has been used
+      // at least once, OR if the current command appears to use tmux.
+      // This defers the startup cost until tmux is actually needed.
+      //
+      // Once the Tmux tool is used (or a tmux command runs), all subsequent Bash
+      // commands will use Claude's isolated socket via the TMUX env var override.
+      //
+      // See tmuxSocket.ts for the full isolation architecture documentation.
+      const commandUsesTmux = command.includes('tmux')
+      if (
+        process.env.USER_TYPE === 'ant' &&
+        (hasTmuxToolBeenUsed() || commandUsesTmux)
+      ) {
+        await ensureSocketInitialized()
+      }
+      const claudeTmuxEnv = getClaudeTmuxEnv()
+      const env: Record<string, string> = {}
+      // CRITICAL: Override TMUX to isolate ALL tmux commands to Claude's socket.
+      // This is NOT the user's TMUX value - it points to Claude's isolated socket.
+      // When null (before socket initializes), user's TMUX is preserved.
+      if (claudeTmuxEnv) {
+        env.TMUX = claudeTmuxEnv
+      }
+      if (currentSandboxTmpDir) {
+        let posixTmpDir = currentSandboxTmpDir
+        if (getPlatform() === 'windows') {
+          posixTmpDir = windowsPathToPosixPath(posixTmpDir)
+        }
+        env.TMPDIR = posixTmpDir
+        env.CLAUDE_CODE_TMPDIR = posixTmpDir
+        // Zsh uses TMPPREFIX (default /tmp/zsh) for heredoc temp files,
+        // not TMPDIR. Set it to a path inside the sandbox tmp dir so
+        // heredocs work in sandboxed zsh commands.
+        // Safe to set unconditionally — non-zsh shells ignore TMPPREFIX.
+        env.TMPPREFIX = posixJoin(posixTmpDir, 'zsh')
+      }
+      // Apply session env vars set via /env (child processes only, not the REPL)
+      for (const [key, value] of getSessionEnvVars()) {
+        env[key] = value
+      }
+      return env
+    },
+  }
+}

package/utils/shell/outputLimits.ts

@@ -0,0 +1,14 @@
+import { validateBoundedIntEnvVar } from '../envValidation.js'
+
+export const BASH_MAX_OUTPUT_UPPER_LIMIT = 150_000
+export const BASH_MAX_OUTPUT_DEFAULT = 30_000
+
+export function getMaxOutputLength(): number {
+  const result = validateBoundedIntEnvVar(
+    'BASH_MAX_OUTPUT_LENGTH',
+    process.env.BASH_MAX_OUTPUT_LENGTH,
+    BASH_MAX_OUTPUT_DEFAULT,
+    BASH_MAX_OUTPUT_UPPER_LIMIT,
+  )
+  return result.effective
+}

package/utils/shell/powershellDetection.ts

@@ -0,0 +1,107 @@
+import { realpath, stat } from 'fs/promises'
+import { getPlatform } from '../platform.js'
+import { which } from '../which.js'
+
+async function probePath(p: string): Promise<string | null> {
+  try {
+    return (await stat(p)).isFile() ? p : null
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Attempts to find PowerShell on the system via PATH.
+ * Prefers pwsh (PowerShell Core 7+), falls back to powershell (5.1).
+ *
+ * On Linux, if PATH resolves to a snap launcher (/snap/…) — directly or
+ * via a symlink chain like /usr/bin/pwsh → /snap/bin/pwsh — probe known
+ * apt/rpm install locations instead: the snap launcher can hang in
+ * subprocesses while snapd initializes confinement, but the underlying
+ * binary at /opt/microsoft/powershell/7/pwsh is reliable. On
+ * Windows/macOS, PATH is sufficient.
+ */
+export async function findPowerShell(): Promise<string | null> {
+  const pwshPath = await which('pwsh')
+  if (pwshPath) {
+    // Snap launcher hangs in subprocesses. Prefer the direct binary.
+    // Check both the resolved PATH entry and its symlink target: on
+    // some distros /usr/bin/pwsh is a symlink to /snap/bin/pwsh, which
+    // would bypass a naive startsWith('/snap/') on the which() result.
+    if (getPlatform() === 'linux') {
+      const resolved = await realpath(pwshPath).catch(() => pwshPath)
+      if (pwshPath.startsWith('/snap/') || resolved.startsWith('/snap/')) {
+        const direct =
+          (await probePath('/opt/microsoft/powershell/7/pwsh')) ??
+          (await probePath('/usr/bin/pwsh'))
+        if (direct) {
+          const directResolved = await realpath(direct).catch(() => direct)
+          if (
+            !direct.startsWith('/snap/') &&
+            !directResolved.startsWith('/snap/')
+          ) {
+            return direct
+          }
+        }
+      }
+    }
+    return pwshPath
+  }
+
+  const powershellPath = await which('powershell')
+  if (powershellPath) {
+    return powershellPath
+  }
+
+  return null
+}
+
+let cachedPowerShellPath: Promise<string | null> | null = null
+
+/**
+ * Gets the cached PowerShell path. Returns a memoized promise that
+ * resolves to the PowerShell executable path or null.
+ */
+export function getCachedPowerShellPath(): Promise<string | null> {
+  if (!cachedPowerShellPath) {
+    cachedPowerShellPath = findPowerShell()
+  }
+  return cachedPowerShellPath
+}
+
+export type PowerShellEdition = 'core' | 'desktop'
+
+/**
+ * Infers the PowerShell edition from the binary name without spawning.
+ * - `pwsh` / `pwsh.exe` → 'core' (PowerShell 7+: supports `&&`, `||`, `?:`, `??`)
+ * - `powershell` / `powershell.exe` → 'desktop' (Windows PowerShell 5.1:
+ *   no pipeline chain operators, stderr-sets-$? bug, UTF-16 default encoding)
+ *
+ * PowerShell 6 (also `pwsh`, no `&&`) has been EOL since 2020 and is not
+ * a realistic install target, so 'core' safely implies 7+ semantics.
+ *
+ * Used by the tool prompt to give version-appropriate syntax guidance so
+ * the model doesn't emit `cmd1 && cmd2` on 5.1 (parser error) or avoid
+ * `&&` on 7+ where it's the correct short-circuiting operator.
+ */
+export async function getPowerShellEdition(): Promise<PowerShellEdition | null> {
+  const p = await getCachedPowerShellPath()
+  if (!p) return null
+  // basename without extension, case-insensitive. Covers:
+  //   C:\Program Files\PowerShell\7\pwsh.exe
+  //   /opt/microsoft/powershell/7/pwsh
+  //   C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
+  const base = p
+    .split(/[/\\]/)
+    .pop()!
+    .toLowerCase()
+    .replace(/\.exe$/, '')
+  return base === 'pwsh' ? 'core' : 'desktop'
+}
+
+/**
+ * Resets the cached PowerShell path. Only for testing.
+ */
+export function resetPowerShellCache(): void {
+  cachedPowerShellPath = null
+}

package/utils/shell/powershellProvider.ts

@@ -0,0 +1,123 @@
+import { tmpdir } from 'os'
+import { join } from 'path'
+import { join as posixJoin } from 'path/posix'
+import { getSessionEnvVars } from '../sessionEnvVars.js'
+import type { ShellProvider } from './shellProvider.js'
+
+/**
+ * PowerShell invocation flags + command. Shared by the provider's getSpawnArgs
+ * and the hook spawn path in hooks.ts so the flag set stays in one place.
+ */
+export function buildPowerShellArgs(cmd: string): string[] {
+  return ['-NoProfile', '-NonInteractive', '-Command', cmd]
+}
+
+/**
+ * Base64-encode a string as UTF-16LE for PowerShell's -EncodedCommand.
+ * Same encoding the parser uses (parser.ts toUtf16LeBase64). The output
+ * is [A-Za-z0-9+/=] only — survives ANY shell-quoting layer, including
+ * @anthropic-ai/sandbox-runtime's shellquote.quote() which would otherwise
+ * corrupt !$? to \!$? when re-wrapping a single-quoted string in double
+ * quotes. Review 2964609818.
+ */
+function encodePowerShellCommand(psCommand: string): string {
+  return Buffer.from(psCommand, 'utf16le').toString('base64')
+}
+
+export function createPowerShellProvider(shellPath: string): ShellProvider {
+  let currentSandboxTmpDir: string | undefined
+
+  return {
+    type: 'powershell' as ShellProvider['type'],
+    shellPath,
+    detached: false,
+
+    async buildExecCommand(
+      command: string,
+      opts: {
+        id: number | string
+        sandboxTmpDir?: string
+        useSandbox: boolean
+      },
+    ): Promise<{ commandString: string; cwdFilePath: string }> {
+      // Stash sandboxTmpDir for getEnvironmentOverrides (mirrors bashProvider)
+      currentSandboxTmpDir = opts.useSandbox ? opts.sandboxTmpDir : undefined
+
+      // When sandboxed, tmpdir() is not writable — the sandbox only allows
+      // writes to sandboxTmpDir. Put the cwd tracking file there so the
+      // inner pwsh can actually write it. Only applies on Linux/macOS/WSL2;
+      // on Windows native, sandbox is never enabled so this branch is dead.
+      const cwdFilePath =
+        opts.useSandbox && opts.sandboxTmpDir
+          ? posixJoin(opts.sandboxTmpDir, `claude-pwd-ps-${opts.id}`)
+          : join(tmpdir(), `claude-pwd-ps-${opts.id}`)
+      const escapedCwdFilePath = cwdFilePath.replace(/'/g, "''")
+      // Exit-code capture: prefer $LASTEXITCODE when a native exe ran.
+      // On PS 5.1, a native command that writes to stderr while the stream
+      // is PS-redirected (e.g. `git push 2>&1`) sets $? = $false even when
+      // the exe returned exit 0 — so `if (!$?)` reports a false positive.
+      // $LASTEXITCODE is $null only when no native exe has run in the
+      // session; in that case fall back to $? for cmdlet-only pipelines.
+      // Tradeoff: `native-ok; cmdlet-fail` now returns 0 (was 1). Reverse
+      // is also true: `native-fail; cmdlet-ok` now returns the native
+      // exit code (was 0 — old logic only looked at $? which the trailing
+      // cmdlet set true). Both rarer than the git/npm/curl stderr case.
+      const cwdTracking = `\n; $_ec = if ($null -ne $LASTEXITCODE) { $LASTEXITCODE } elseif ($?) { 0 } else { 1 }\n; (Get-Location).Path | Out-File -FilePath '${escapedCwdFilePath}' -Encoding utf8 -NoNewline\n; exit $_ec`
+      const psCommand = command + cwdTracking
+
+      // Sandbox wraps the returned commandString as `<binShell> -c '<cmd>'` —
+      // hardcoded `-c`, no way to inject -NoProfile -NonInteractive. So for
+      // the sandbox path, build a command that itself invokes pwsh with the
+      // full flag set. Shell.ts passes /bin/sh as the sandbox binShell,
+      // producing: bwrap ... sh -c 'pwsh -NoProfile ... -EncodedCommand ...'.
+      // The non-sandbox path returns the bare PS command; getSpawnArgs() adds
+      // the flags via buildPowerShellArgs().
+      //
+      // -EncodedCommand (base64 UTF-16LE), not -Command: the sandbox runtime
+      // applies its OWN shellquote.quote() on top of whatever we build. Any
+      // string containing ' triggers double-quote mode which escapes ! as \! —
+      // POSIX sh preserves that literally, pwsh parse error. Base64 is
+      // [A-Za-z0-9+/=] — no chars that any quoting layer can corrupt.
+      // Review 2964609818.
+      //
+      // shellPath is POSIX-single-quoted so a space-containing install path
+      // (e.g. /opt/my tools/pwsh) survives the inner `/bin/sh -c` word-split.
+      // Flags and base64 are [A-Za-z0-9+/=-] only — no quoting needed.
+      const commandString = opts.useSandbox
+        ? [
+            `'${shellPath.replace(/'/g, `'\\''`)}'`,
+            '-NoProfile',
+            '-NonInteractive',
+            '-EncodedCommand',
+            encodePowerShellCommand(psCommand),
+          ].join(' ')
+        : psCommand
+
+      return { commandString, cwdFilePath }
+    },
+
+    getSpawnArgs(commandString: string): string[] {
+      return buildPowerShellArgs(commandString)
+    },
+
+    async getEnvironmentOverrides(): Promise<Record<string, string>> {
+      const env: Record<string, string> = {}
+      // Apply session env vars set via /env (child processes only, not
+      // the REPL). Without this, `/env PATH=...` affects Bash tool
+      // commands but not PowerShell — so PyCharm users with a stripped
+      // PATH can't self-rescue.
+      // Ordering: session vars FIRST so the sandbox TMPDIR below can't be
+      // overridden by `/env TMPDIR=...`. bashProvider.ts has these in the
+      // opposite order (pre-existing), but sandbox isolation should win.
+      for (const [key, value] of getSessionEnvVars()) {
+        env[key] = value
+      }
+      if (currentSandboxTmpDir) {
+        // PowerShell on Linux/macOS honors TMPDIR for [System.IO.Path]::GetTempPath()
+        env.TMPDIR = currentSandboxTmpDir
+        env.CLAUDE_CODE_TMPDIR = currentSandboxTmpDir
+      }
+      return env
+    },
+  }
+}