autoclaw 1.3.3 → 1.3.5

package/dist/tools/core.js

@@ -3,6 +3,8 @@ import * as path from 'path';
 import inquirer from 'inquirer';
 import chalk from 'chalk';
 import { execShellCommand } from '../shell.js';
+import { resolveSandboxMode, sandboxBackend, sandboxedInvocation } from '../sandbox.js';
+import * as os from 'os';
 const DEFAULT_SHELL_TIMEOUT_MS = 120000;
 const SHELL_MAX_BUFFER = 10 * 1024 * 1024;
 // Bounded reads keep a huge file from exhausting memory or the model context;
@@ -27,6 +29,24 @@ export function matchDangerousPattern(command) {
     const hit = DANGEROUS_PATTERNS.find(p => p.re.test(command));
     return hit ? hit.label : null;
 }
+// An unattended agent reads web pages and repos; a prompt injection must not
+// end up reading AutoClaw's own credential stores (or classic .env files)
+// and exfiltrating them. Blocked for read_file/write_file unless
+// --allow-dangerous. execute_shell_command is not pattern-restricted here.
+export function isSensitivePath(p) {
+    const norm = path.normalize(String(p)).toLowerCase();
+    const protectedFiles = [
+        path.join(os.homedir(), '.autoclaw', 'setting.json').toLowerCase(),
+        path.join(os.homedir(), '.autoclaw', '.env').toLowerCase(),
+        path.join(process.cwd(), '.autoclaw', 'setting.json').toLowerCase()
+    ];
+    if (protectedFiles.includes(norm))
+        return true;
+    return path.basename(norm).startsWith('.env');
+}
+function sensitivePathBlock(p, verb) {
+    return `Error: ${p} is blocked by AutoClaw safety policy (credential/secret store). It was NOT ${verb === 'read' ? 'read' : 'written'}. If this task genuinely requires it, restart AutoClaw with --allow-dangerous.`;
+}
 export const ShellTool = {
     name: "Shell Execution",
     definition: {
@@ -56,6 +76,21 @@ export const ShellTool = {
             }
         }
         const timeoutMs = Number(config?.shellTimeout || process.env.AUTOCLOW_SHELL_TIMEOUT || DEFAULT_SHELL_TIMEOUT_MS);
+        // Sandbox policy: non-default modes wrap the invocation in a platform
+        // backend, or refuse (fail-closed) when no backend exists.
+        const sandboxMode = resolveSandboxMode(config);
+        let sandboxed;
+        if (sandboxMode !== 'danger-full-access') {
+            const backend = sandboxBackend();
+            if (!backend.available) {
+                return `Error: sandbox mode "${sandboxMode}" is configured but no sandbox backend is available: ${backend.detail}`;
+            }
+            const inv = sandboxedInvocation(args.command, sandboxMode, process.cwd());
+            if ('blocked' in inv) {
+                return `Error: sandbox mode "${sandboxMode}" cannot wrap this command: ${inv.detail}`;
+            }
+            sandboxed = inv;
+        }
         // Check for auto-confirm flag
         if (!config?.autoConfirm) {
             if (!process.stdin.isTTY) {
@@ -78,7 +113,7 @@ export const ShellTool = {
             console.log(chalk.gray("(Auto-confirming command execution due to --yes flag)"));
         }
         try {
-            const r = await execShellCommand(args.command, { timeoutMs, maxBuffer: SHELL_MAX_BUFFER });
+            const r = await execShellCommand(args.command, { timeoutMs, maxBuffer: SHELL_MAX_BUFFER, sandboxed });
             if (r.timedOut) {
                 return `Command timed out after ${timeoutMs}ms and was terminated.\nStdout: ${r.stdout}\nStderr: ${r.stderr}`;
             }
@@ -107,7 +142,10 @@ export const ReadFileTool = {
             }
         }
     },
-    handler: async (args) => {
+    handler: async (args, config) => {
+        if (!config?.allowDangerous && isSensitivePath(args.path)) {
+            return sensitivePathBlock(args.path, 'read');
+        }
         let fh;
         try {
             fh = await fs.open(args.path, 'r');
@@ -151,7 +189,10 @@ export const WriteFileTool = {
             }
         }
     },
-    handler: async (args) => {
+    handler: async (args, config) => {
+        if (!config?.allowDangerous && isSensitivePath(args.path)) {
+            return sensitivePathBlock(args.path, 'write');
+        }
         try {
             await fs.mkdir(path.dirname(args.path), { recursive: true });
             await fs.writeFile(args.path, args.content, 'utf-8');

package/dist/tools/index.js

@@ -6,6 +6,7 @@ import { BrowserTool } from './browser.js';
 import { ScreenshotTool } from './screenshot.js';
 import { ImageTool } from './image.js';
 import { PromptOptimizerTool } from './prompt-optimizer.js';
+import { CheckBackgroundProcessTool, StartBackgroundProcessTool, StopBackgroundProcessTool } from './background.js';
 // Central Registry of all available tools
 export const toolRegistry = [
     ShellTool,
@@ -18,7 +19,10 @@ export const toolRegistry = [
     NotifyTool,
     BrowserTool,
     ScreenshotTool,
-    ImageTool
+    ImageTool,
+    StartBackgroundProcessTool,
+    CheckBackgroundProcessTool,
+    StopBackgroundProcessTool
 ];
 export function getToolDefinitions(config) {
     return toolRegistry

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "autoclaw",
-  "version": "1.3.3",
+  "version": "1.3.5",
   "type": "module",
   "main": "dist/index.js",
   "bin": {