@yuaone/tools 0.1.0

package/dist/security-scan.js

@@ -0,0 +1,445 @@
+/**
+ * @module security-scan
+ * @description Security scanning tool for YUAN agent.
+ * Checks for common security vulnerabilities in code:
+ * - Hardcoded secrets (API keys, passwords, tokens, AWS keys, private keys)
+ * - Dangerous code patterns (eval, innerHTML, SQL injection, command injection)
+ * - Dependency vulnerabilities (npm/pnpm audit)
+ * - File permission issues
+ *
+ * No external dependencies -- pure TypeScript + node:fs + node:child_process.
+ */
+import { readdir, readFile, access, constants as fsConstants } from 'node:fs/promises';
+import { join, relative, extname } from 'node:path';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { BaseTool } from './base-tool.js';
+const execFileAsync = promisify(execFile);
+// ─── Patterns ───────────────────────────────────────────────────────
+/** Hardcoded secret detection patterns */
+const SECRET_PATTERNS = [
+    {
+        name: 'api_key',
+        pattern: /(api[_-]?key|apikey)\s*[:=]\s*['"][^'"]{10,}['"]/i,
+        severity: 'critical',
+        description: 'Hardcoded API key detected',
+        recommendation: 'Move API keys to environment variables and use .env files (excluded from git).',
+    },
+    {
+        name: 'password',
+        pattern: /(password|passwd|pwd)\s*[:=]\s*['"][^'"]+['"]/i,
+        severity: 'critical',
+        description: 'Hardcoded password detected',
+        recommendation: 'Use environment variables or a secrets manager for passwords.',
+    },
+    {
+        name: 'token_secret',
+        pattern: /(token|secret|auth)\s*[:=]\s*['"][^'"]{10,}['"]/i,
+        severity: 'critical',
+        description: 'Hardcoded token or secret detected',
+        recommendation: 'Store tokens in environment variables or a vault service.',
+    },
+    {
+        name: 'aws_key',
+        pattern: /AKIA[0-9A-Z]{16}/,
+        severity: 'critical',
+        description: 'AWS access key ID detected',
+        recommendation: 'Remove AWS key and rotate credentials immediately. Use IAM roles or env vars.',
+    },
+    {
+        name: 'private_key',
+        pattern: /-----BEGIN (RSA |EC |DSA )?PRIVATE KEY-----/,
+        severity: 'critical',
+        description: 'Private key embedded in source code',
+        recommendation: 'Remove private keys from source. Use file references or secrets managers.',
+    },
+];
+/** Dangerous code pattern detection */
+const DANGEROUS_CODE_PATTERNS = [
+    {
+        name: 'eval',
+        pattern: /\beval\s*\(/,
+        severity: 'high',
+        description: 'Use of eval() detected -- potential code injection',
+        recommendation: 'Replace eval() with safer alternatives like JSON.parse() or Function constructors with validated input.',
+    },
+    {
+        name: 'new_function',
+        pattern: /\bnew\s+Function\s*\(|[^.]\bFunction\s*\(/,
+        severity: 'high',
+        description: 'Dynamic Function constructor detected -- potential code injection',
+        recommendation: 'Avoid Function() constructor. Use static code paths instead.',
+    },
+    {
+        name: 'innerhtml',
+        pattern: /\.innerHTML\s*=/,
+        severity: 'high',
+        description: 'Direct innerHTML assignment -- potential XSS vulnerability',
+        recommendation: 'Use textContent, createElement/appendChild, or a sanitizer like DOMPurify.',
+    },
+    {
+        name: 'document_write',
+        pattern: /document\.write\s*\(/,
+        severity: 'high',
+        description: 'document.write() detected -- potential XSS vulnerability',
+        recommendation: 'Use DOM manipulation methods instead of document.write().',
+    },
+    {
+        name: 'sql_injection',
+        pattern: /query\s*\(.*\+.*req\.|query\s*\(.*\$\{/,
+        severity: 'critical',
+        description: 'Potential SQL injection -- string concatenation in query',
+        recommendation: 'Use parameterized queries or an ORM. Never concatenate user input into SQL.',
+    },
+    {
+        name: 'command_injection',
+        pattern: /child_process\.exec\s*\(/,
+        severity: 'high',
+        description: 'child_process.exec() detected -- potential command injection',
+        recommendation: 'Use child_process.execFile() with an explicit argument array instead of exec().',
+    },
+    {
+        name: 'chmod_777',
+        pattern: /fs\.chmod\s*\(.*777/,
+        severity: 'medium',
+        description: 'Setting file permissions to 777 (world-readable/writable/executable)',
+        recommendation: 'Use least-privilege permissions. Typically 644 for files, 755 for directories.',
+    },
+    {
+        name: 'insecure_http',
+        pattern: /['"]http:\/\/(?!localhost|127\.0\.0\.1|0\.0\.0\.0)[^'"]+['"]/,
+        severity: 'medium',
+        description: 'Insecure HTTP URL detected (not HTTPS)',
+        recommendation: 'Use HTTPS for all external API calls and resource URLs.',
+    },
+];
+/** Directories to skip during scanning */
+const SKIP_DIRS = new Set([
+    'node_modules', '.git', 'dist', 'build', '.next', '.nuxt',
+    'coverage', '.cache', '__pycache__', '.venv', 'venv',
+    '.turbo', '.output',
+]);
+/** File extensions to scan */
+const SCANNABLE_EXTENSIONS = new Set([
+    '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs',
+    '.py', '.rb', '.go', '.rs', '.java', '.kt',
+    '.c', '.cpp', '.cs', '.swift',
+    '.json', '.yaml', '.yml', '.toml',
+    '.html', '.htm', '.vue', '.svelte',
+    '.sh', '.bash',
+    '.sql',
+    '.env', '.cfg', '.ini', '.conf',
+]);
+/** Files that should be in .gitignore */
+const SHOULD_BE_GITIGNORED = ['.env', '.env.local', '.env.production', 'credentials.json', 'secrets.json'];
+// ─── SecurityScanTool ───────────────────────────────────────────────
+export class SecurityScanTool extends BaseTool {
+    name = 'security_scan';
+    description = 'Scan a project directory for security vulnerabilities: ' +
+        'hardcoded secrets, dangerous code patterns, dependency vulnerabilities, ' +
+        'and file permission issues. Returns a structured security report with score.';
+    riskLevel = 'low';
+    parameters = {
+        workDir: {
+            type: 'string',
+            description: 'Project directory to scan (defaults to current workDir)',
+            required: false,
+        },
+        skipAudit: {
+            type: 'boolean',
+            description: 'Skip dependency audit (faster scan)',
+            required: false,
+            default: false,
+        },
+    };
+    async execute(args, workDir) {
+        const toolCallId = args._toolCallId ?? '';
+        const skipAudit = args.skipAudit ?? false;
+        // Validate scanDir to prevent directory traversal (C3 fix)
+        let scanDir = workDir;
+        if (args.workDir && typeof args.workDir === 'string') {
+            try {
+                scanDir = this.validatePath(args.workDir, workDir);
+            }
+            catch (err) {
+                return this.fail(toolCallId, err.message);
+            }
+        }
+        try {
+            const report = await runSecurityScan(scanDir, skipAudit);
+            const output = formatReport(report);
+            return this.ok(toolCallId, output, { report });
+        }
+        catch (err) {
+            return this.fail(toolCallId, `Security scan failed: ${err.message}`);
+        }
+    }
+}
+// ─── Scan Engine ────────────────────────────────────────────────────
+/**
+ * Run a full security scan on the given directory.
+ *
+ * @param scanDir - Directory to scan recursively
+ * @param skipAudit - If true, skip npm/pnpm audit
+ * @returns SecurityReport
+ */
+export async function runSecurityScan(scanDir, skipAudit = false) {
+    const findings = [];
+    // 1. Scan files for secrets and dangerous patterns
+    const files = await collectFiles(scanDir);
+    for (const filePath of files) {
+        const relPath = relative(scanDir, filePath);
+        const fileFindings = await scanFile(filePath, relPath);
+        findings.push(...fileFindings);
+    }
+    // 2. Dependency audit (optional)
+    if (!skipAudit) {
+        const auditFindings = await runDependencyAudit(scanDir);
+        findings.push(...auditFindings);
+    }
+    // 3. Check for missing .gitignore entries
+    const gitignoreFindings = await checkGitignore(scanDir);
+    findings.push(...gitignoreFindings);
+    // 4. Classify findings by severity
+    const critical = findings.filter((f) => f.severity === 'critical').map(stripSeverity);
+    const high = findings.filter((f) => f.severity === 'high').map(stripSeverity);
+    const medium = findings.filter((f) => f.severity === 'medium').map(stripSeverity);
+    const low = findings.filter((f) => f.severity === 'low').map(stripSeverity);
+    // 5. Calculate score
+    const score = calculateScore(critical.length, high.length, medium.length, low.length);
+    // 6. Build summary
+    const totalFindings = findings.length;
+    const summary = totalFindings === 0
+        ? 'No security issues found. Score: 100/100.'
+        : `Found ${totalFindings} issue(s): ${critical.length} critical, ${high.length} high, ${medium.length} medium, ${low.length} low. Score: ${score}/100.`;
+    return { score, critical, high, medium, low, summary };
+}
+// ─── File Collection ────────────────────────────────────────────────
+async function collectFiles(dir, maxDepth = 10) {
+    if (maxDepth <= 0)
+        return [];
+    const files = [];
+    let entries;
+    try {
+        entries = await readdir(dir, { withFileTypes: true });
+    }
+    catch {
+        return files;
+    }
+    for (const entry of entries) {
+        if (entry.name.startsWith('.') && SKIP_DIRS.has(entry.name))
+            continue;
+        if (SKIP_DIRS.has(entry.name))
+            continue;
+        const fullPath = join(dir, entry.name);
+        if (entry.isDirectory()) {
+            const subFiles = await collectFiles(fullPath, maxDepth - 1);
+            files.push(...subFiles);
+        }
+        else if (entry.isFile()) {
+            const ext = extname(entry.name).toLowerCase();
+            // Scan files with known extensions or dotfiles like .env
+            if (SCANNABLE_EXTENSIONS.has(ext) || entry.name.startsWith('.env')) {
+                files.push(fullPath);
+            }
+        }
+    }
+    return files;
+}
+// ─── File Scanning ──────────────────────────────────────────────────
+async function scanFile(filePath, relPath) {
+    const findings = [];
+    let content;
+    try {
+        content = await readFile(filePath, 'utf-8');
+    }
+    catch {
+        return findings;
+    }
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const lineNum = i + 1;
+        // Check secret patterns
+        for (const sp of SECRET_PATTERNS) {
+            if (sp.pattern.test(line)) {
+                findings.push({
+                    type: `hardcoded_secret:${sp.name}`,
+                    file: relPath,
+                    line: lineNum,
+                    code: redactLine(line),
+                    description: sp.description,
+                    recommendation: sp.recommendation,
+                    severity: sp.severity,
+                });
+            }
+        }
+        // Check dangerous code patterns
+        for (const dp of DANGEROUS_CODE_PATTERNS) {
+            if (dp.pattern.test(line)) {
+                findings.push({
+                    type: dp.name,
+                    file: relPath,
+                    line: lineNum,
+                    code: line.trim().slice(0, 200),
+                    description: dp.description,
+                    recommendation: dp.recommendation,
+                    severity: dp.severity,
+                });
+            }
+        }
+    }
+    return findings;
+}
+/**
+ * Redact secret values in a line for safe display.
+ * Replaces the actual value with asterisks.
+ */
+function redactLine(line) {
+    return line
+        .replace(/(['"])[^'"]{8,}(['"])/g, (_, q1, q2) => `${q1}****REDACTED****${q2}`)
+        .trim()
+        .slice(0, 200);
+}
+// ─── Dependency Audit ───────────────────────────────────────────────
+async function runDependencyAudit(dir) {
+    const findings = [];
+    // Detect package manager
+    const hasPnpmLock = await fileExists(join(dir, 'pnpm-lock.yaml'));
+    const hasPackageLock = await fileExists(join(dir, 'package-lock.json'));
+    const hasPackageJson = await fileExists(join(dir, 'package.json'));
+    if (!hasPackageJson)
+        return findings;
+    const cmd = hasPnpmLock ? 'pnpm' : hasPackageLock ? 'npm' : 'npm';
+    const args = ['audit', '--json'];
+    try {
+        const { stdout } = await execFileAsync(cmd, args, {
+            cwd: dir,
+            timeout: 30_000,
+            maxBuffer: 10 * 1024 * 1024,
+        });
+        const auditData = JSON.parse(stdout);
+        const vulnerabilities = (auditData.vulnerabilities ?? auditData.advisories ?? {});
+        for (const [pkg, info] of Object.entries(vulnerabilities)) {
+            const severity = mapAuditSeverity(info.severity ?? 'low');
+            findings.push({
+                type: 'dependency_vulnerability',
+                file: 'package.json',
+                line: 0,
+                code: `${pkg}${info.range ? `@${info.range}` : ''}`,
+                description: info.title ?? `Vulnerability in ${pkg}`,
+                recommendation: info.recommendation ?? `Update ${pkg} to a patched version.`,
+                severity,
+            });
+        }
+    }
+    catch {
+        // Audit command failed or not available -- skip silently
+        // npm audit exits non-zero when vulnerabilities are found
+    }
+    return findings;
+}
+function mapAuditSeverity(severity) {
+    switch (severity.toLowerCase()) {
+        case 'critical':
+            return 'critical';
+        case 'high':
+            return 'high';
+        case 'moderate':
+        case 'medium':
+            return 'medium';
+        default:
+            return 'low';
+    }
+}
+// ─── Gitignore Check ────────────────────────────────────────────────
+async function checkGitignore(dir) {
+    const findings = [];
+    // Read .gitignore
+    let gitignoreContent = '';
+    try {
+        gitignoreContent = await readFile(join(dir, '.gitignore'), 'utf-8');
+    }
+    catch {
+        // No .gitignore
+        if (await fileExists(join(dir, '.git'))) {
+            findings.push({
+                type: 'missing_gitignore',
+                file: '.gitignore',
+                line: 0,
+                code: '',
+                description: 'Git repository has no .gitignore file',
+                recommendation: 'Create a .gitignore to exclude sensitive files, build artifacts, and dependencies.',
+                severity: 'medium',
+            });
+        }
+        return findings;
+    }
+    // Check that sensitive files are gitignored
+    for (const sensitiveFile of SHOULD_BE_GITIGNORED) {
+        const exists = await fileExists(join(dir, sensitiveFile));
+        if (exists && !gitignoreContent.includes(sensitiveFile)) {
+            findings.push({
+                type: 'sensitive_not_gitignored',
+                file: sensitiveFile,
+                line: 0,
+                code: '',
+                description: `Sensitive file "${sensitiveFile}" exists but is not in .gitignore`,
+                recommendation: `Add "${sensitiveFile}" to .gitignore and remove from git tracking.`,
+                severity: 'high',
+            });
+        }
+    }
+    return findings;
+}
+// ─── Score Calculation ──────────────────────────────────────────────
+function calculateScore(critical, high, medium, low) {
+    // Deductions: critical=-25, high=-10, medium=-3, low=-1
+    const deductions = critical * 25 + high * 10 + medium * 3 + low * 1;
+    return Math.max(0, 100 - deductions);
+}
+// ─── Helpers ────────────────────────────────────────────────────────
+function stripSeverity(f) {
+    const { severity: _, ...rest } = f;
+    return rest;
+}
+async function fileExists(path) {
+    try {
+        await access(path, fsConstants.F_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// ─── Report Formatting ─────────────────────────────────────────────
+function formatReport(report) {
+    const lines = [];
+    lines.push(`## Security Scan Report`);
+    lines.push(`Score: ${report.score}/100`);
+    lines.push('');
+    lines.push(report.summary);
+    lines.push('');
+    const sections = [
+        ['CRITICAL', report.critical],
+        ['HIGH', report.high],
+        ['MEDIUM', report.medium],
+        ['LOW', report.low],
+    ];
+    for (const [label, findings] of sections) {
+        if (findings.length === 0)
+            continue;
+        lines.push(`### ${label} (${findings.length})`);
+        for (const f of findings) {
+            const loc = f.line > 0 ? `${f.file}:${f.line}` : f.file;
+            lines.push(`- [${f.type}] ${loc}`);
+            lines.push(`  ${f.description}`);
+            if (f.code)
+                lines.push(`  Code: ${f.code}`);
+            lines.push(`  Fix: ${f.recommendation}`);
+        }
+        lines.push('');
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=security-scan.js.map

package/dist/security-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-scan.js","sourceRoot":"","sources":["../src/security-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAQ,MAAM,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC7F,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAuC1C,uEAAuE;AAEvE,0CAA0C;AAC1C,MAAM,eAAe,GAMhB;IACH;QACE,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,mDAAmD;QAC5D,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,4BAA4B;QACzC,cAAc,EAAE,gFAAgF;KACjG;IACD;QACE,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,gDAAgD;QACzD,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,6BAA6B;QAC1C,cAAc,EAAE,+DAA+D;KAChF;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,kDAAkD;QAC3D,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,oCAAoC;QACjD,cAAc,EAAE,2DAA2D;KAC5E;IACD;QACE,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,kBAAkB;QAC3B,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,4BAA4B;QACzC,cAAc,EAAE,+EAA+E;KAChG;IACD;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,6CAA6C;QACtD,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,qCAAqC;QAClD,cAAc,EAAE,2EAA2E;KAC5F;CACF,CAAC;AAEF,uCAAuC;AACvC,MAAM,uBAAuB,GAMxB;IACH;QACE,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,oDAAoD;QACjE,cAAc,EAAE,yGAAyG;KAC1H;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,2CAA2C;QACpD,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,mEAAmE;QAChF,cAAc,EAAE,8DAA8D;KAC/E;IACD;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,iBAAiB;QAC1B,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,4DAA4D;QACzE,cAAc,EAAE,4EAA4E;KAC7F;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,sBAAsB;QAC/B,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,0DAA0D;QACvE,cAAc,EAAE,2DAA2D;KAC5E;IACD;QACE,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,wCAAwC;QACjD,QAAQ,EAAE,UAAU;QACpB,WAAW,EAAE,0DAA0D;QACvE,cAAc,EAAE,6EAA6E;KAC9F;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,0BAA0B;QACnC,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,8DAA8D;QAC3E,cAAc,EAAE,iFAAiF;KAClG;IACD;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,qBAAqB;QAC9B,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,sEAAsE;QACnF,cAAc,EAAE,gFAAgF;KACjG;IACD;QACE,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,8DAA8D;QACvE,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,wCAAwC;QACrD,cAAc,EAAE,yDAAyD;KAC1E;CACF,CAAC;AAEF,0CAA0C;AAC1C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO;IACzD,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM;IACpD,QAAQ,EAAE,SAAS;CACpB,CAAC,CAAC;AAEH,8BAA8B;AAC9B,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC5C,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;IAC1C,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ;IAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO;IACjC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS;IAClC,KAAK,EAAE,OAAO;IACd,MAAM;IACN,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO;CAChC,CAAC,CAAC;AAEH,yCAAyC;AACzC,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC;AAE3G,uEAAuE;AAEvE,MAAM,OAAO,gBAAiB,SAAQ,QAAQ;IACnC,IAAI,GAAG,eAAe,CAAC;IACvB,WAAW,GAClB,yDAAyD;QACzD,0EAA0E;QAC1E,8EAA8E,CAAC;IACxE,SAAS,GAAc,KAAK,CAAC;IAE7B,UAAU,GAAiC;QAClD,OAAO,EAAE;YACP,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,yDAAyD;YACtE,QAAQ,EAAE,KAAK;SAChB;QACD,SAAS,EAAE;YACT,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,qCAAqC;YAClD,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,KAAK;SACf;KACF,CAAC;IAEF,KAAK,CAAC,OAAO,CAAC,IAA6B,EAAE,OAAe;QAC1D,MAAM,UAAU,GAAI,IAAI,CAAC,WAAsB,IAAI,EAAE,CAAC;QACtD,MAAM,SAAS,GAAI,IAAI,CAAC,SAAqB,IAAI,KAAK,CAAC;QAEvD,2DAA2D;QAC3D,IAAI,OAAO,GAAG,OAAO,CAAC;QACtB,IAAI,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACrD,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAiB,EAAE,OAAO,CAAC,CAAC;YAC/D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,yBAA0B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;CACF;AAED,uEAAuE;AAEvE;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAe,EAAE,SAAS,GAAG,KAAK;IACtE,MAAM,QAAQ,GAA2D,EAAE,CAAC;IAE5E,mDAAmD;IACnD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;IAC1C,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACvD,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;IACjC,CAAC;IAED,iCAAiC;IACjC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;IAClC,CAAC;IAED,0CAA0C;IAC1C,MAAM,iBAAiB,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IACxD,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,CAAC;IAEpC,mCAAmC;IACnC,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACtF,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAClF,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAE5E,qBAAqB;IACrB,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAEtF,mBAAmB;IACnB,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC;IACtC,MAAM,OAAO,GACX,aAAa,KAAK,CAAC;QACjB,CAAC,CAAC,2CAA2C;QAC7C,CAAC,CAAC,SAAS,aAAa,cAAc,QAAQ,CAAC,MAAM,cAAc,IAAI,CAAC,MAAM,UAAU,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAM,gBAAgB,KAAK,OAAO,CAAC;IAE5J,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AACzD,CAAC;AAED,uEAAuE;AAEvE,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,QAAQ,GAAG,EAAE;IACpD,IAAI,QAAQ,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACtE,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QAExC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAEvC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;YAC5D,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAC1B,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAC9C,yDAAyD;YACzD,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uEAAuE;AAEvE,KAAK,UAAU,QAAQ,CACrB,QAAgB,EAChB,OAAe;IAEf,MAAM,QAAQ,GAA2D,EAAE,CAAC;IAE5E,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QAEtB,wBAAwB;QACxB,KAAK,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC;YACjC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,oBAAoB,EAAE,CAAC,IAAI,EAAE;oBACnC,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;oBACtB,WAAW,EAAE,EAAE,CAAC,WAAW;oBAC3B,cAAc,EAAE,EAAE,CAAC,cAAc;oBACjC,QAAQ,EAAE,EAAE,CAAC,QAAQ;iBACtB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,KAAK,MAAM,EAAE,IAAI,uBAAuB,EAAE,CAAC;YACzC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,EAAE,CAAC,IAAI;oBACb,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBAC/B,WAAW,EAAE,EAAE,CAAC,WAAW;oBAC3B,cAAc,EAAE,EAAE,CAAC,cAAc;oBACjC,QAAQ,EAAE,EAAE,CAAC,QAAQ;iBACtB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI;SACR,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,EAAU,EAAE,EAAU,EAAE,EAAE,CAAC,GAAG,EAAE,mBAAmB,EAAE,EAAE,CAAC;SAC9F,IAAI,EAAE;SACN,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,uEAAuE;AAEvE,KAAK,UAAU,kBAAkB,CAC/B,GAAW;IAEX,MAAM,QAAQ,GAA2D,EAAE,CAAC;IAE5E,yBAAyB;IACzB,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAClE,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACxE,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC;IAEnE,IAAI,CAAC,cAAc;QAAE,OAAO,QAAQ,CAAC;IAErC,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAClE,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEjC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE;YAChD,GAAG,EAAE,GAAG;YACR,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SAC5B,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAA4B,CAAC;QAChE,MAAM,eAAe,GAAG,CAAC,SAAS,CAAC,eAAe,IAAI,SAAS,CAAC,UAAU,IAAI,EAAE,CAG/E,CAAC;QAEF,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,CAAC;YAC1D,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,0BAA0B;gBAChC,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;gBACnD,WAAW,EAAE,IAAI,CAAC,KAAK,IAAI,oBAAoB,GAAG,EAAE;gBACpD,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,UAAU,GAAG,wBAAwB;gBAC5E,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yDAAyD;QACzD,0DAA0D;IAC5D,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,QAAQ,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/B,KAAK,UAAU;YACb,OAAO,UAAU,CAAC;QACpB,KAAK,MAAM;YACT,OAAO,MAAM,CAAC;QAChB,KAAK,UAAU,CAAC;QAChB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,uEAAuE;AAEvE,KAAK,UAAU,cAAc,CAC3B,GAAW;IAEX,MAAM,QAAQ,GAA2D,EAAE,CAAC;IAE5E,kBAAkB;IAClB,IAAI,gBAAgB,GAAG,EAAE,CAAC;IAC1B,IAAI,CAAC;QACH,gBAAgB,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;QAChB,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,mBAAmB;gBACzB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,EAAE;gBACR,WAAW,EAAE,uCAAuC;gBACpD,cAAc,EAAE,oFAAoF;gBACpG,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,4CAA4C;IAC5C,KAAK,MAAM,aAAa,IAAI,oBAAoB,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC;QAC1D,IAAI,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACxD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,0BAA0B;gBAChC,IAAI,EAAE,aAAa;gBACnB,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,EAAE;gBACR,WAAW,EAAE,mBAAmB,aAAa,mCAAmC;gBAChF,cAAc,EAAE,QAAQ,aAAa,+CAA+C;gBACpF,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,uEAAuE;AAEvE,SAAS,cAAc,CAAC,QAAgB,EAAE,IAAY,EAAE,MAAc,EAAE,GAAW;IACjF,wDAAwD;IACxD,MAAM,UAAU,GAAG,QAAQ,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,MAAM,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,UAAU,CAAC,CAAC;AACvC,CAAC;AAED,uEAAuE;AAEvE,SAAS,aAAa,CAAC,CAAkD;IACvE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,sEAAsE;AAEtE,SAAS,YAAY,CAAC,MAAsB;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACtC,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,MAAM,CAAC,CAAC;IACzC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,MAAM,QAAQ,GAAuC;QACnD,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC;QAC7B,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QACzB,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;KACpB,CAAC;IAEF,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACpC,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAChD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACxD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5C,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/shell-exec.d.ts

@@ -0,0 +1,20 @@
+/**
+ * @yuaone/tools — shell_exec tool
+ *
+ * Executes a command using execFile (no shell interpretation).
+ * - executable + args[] pattern (not a string command)
+ * - Shell metacharacter validation
+ * - Blocked commands (rm -rf /, sudo, chmod 777, etc.)
+ * - 30-second default timeout
+ * - stdout/stderr separate return
+ */
+import type { ParameterDef, RiskLevel, ToolResult } from './types.js';
+import { BaseTool } from './base-tool.js';
+export declare class ShellExecTool extends BaseTool {
+    readonly name = "shell_exec";
+    readonly description: string;
+    readonly riskLevel: RiskLevel;
+    readonly parameters: Record<string, ParameterDef>;
+    execute(args: Record<string, unknown>, workDir: string, abortSignal?: AbortSignal): Promise<ToolResult>;
+}
+//# sourceMappingURL=shell-exec.d.ts.map

package/dist/shell-exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-exec.d.ts","sourceRoot":"","sources":["../src/shell-exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAO1C,qBAAa,aAAc,SAAQ,QAAQ;IACzC,QAAQ,CAAC,IAAI,gBAAgB;IAC7B,QAAQ,CAAC,WAAW,SAEiC;IACrD,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAc;IAE3C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CA4B/C;IAEI,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;CAwJ9G"}