comisai 1.0.37 → 1.0.40

package/node_modules/@comis/skills/dist/tools/builtin/sandbox/sandbox-exec-provider.js

@@ -0,0 +1,182 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * SandboxExecProvider -- macOS sandbox provider using sandbox-exec.
+ *
+ * Generates SBPL (Sandbox Profile Language) profiles that restrict
+ * child process filesystem access via Apple's sandbox-exec utility.
+ *
+ * @module
+ */
+import { execFileSync } from "node:child_process";
+import { existsSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { safePath, systemGetEnv } from "@comis/core";
+/** Escape a path for SBPL string literal. */
+function sbplQuote(p) {
+    return `"${p.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+/**
+ * Resolve symlinks in a path for SBPL. On macOS, /var → /private/var,
+ * /tmp → /private/tmp, /etc → /private/etc. The kernel uses resolved
+ * paths for sandbox enforcement, so SBPL rules must use resolved paths.
+ */
+function resolvePath(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return p; // Path doesn't exist yet — use as-is
+    }
+}
+function buildSbplProfile(opts) {
+    // User home subdirectories needed by pip/uv (read-only).
+    // pip scans all sys.path entries via os.scandir(); .pth files in system
+    // site-packages inject ~/Projects/... and ~/Library/Python/... paths.
+    // Without read access, pip crashes with PermissionError.
+    const home = systemGetEnv("HOME") ?? homedir();
+    const homeReadPaths = [
+        safePath(home, "Library"),
+        safePath(home, "Projects"),
+        safePath(home, ".local"),
+        safePath(home, ".nvm"), // nvm Node.js — npm/npx cli.js lives here
+        safePath(home, ".claude"), // claude CLI config, settings, hooks, skills
+    ].filter((p) => existsSync(p)).map(resolvePath);
+    // claude CLI stores auth/config at ~/.claude.json (a file at HOME root,
+    // not inside ~/.claude/ directory). Without read access, `claude -p` hangs
+    // indefinitely producing zero output.
+    const claudeJsonPath = safePath(home, ".claude.json");
+    const claudeJsonLiteral = existsSync(claudeJsonPath) ? resolvePath(claudeJsonPath) : null;
+    const readPaths = [
+        "/usr",
+        "/bin",
+        "/sbin",
+        "/Library",
+        "/System",
+        "/private/etc",
+        "/private/var/db/timezone", // /usr/share/zoneinfo symlinks here; kernel resolves before sandbox check
+        "/var/db/timezone", // intermediate symlink target: /usr/share/zoneinfo → /var/db/timezone/zoneinfo
+        "/opt/homebrew",
+        "/usr/local",
+        "/dev",
+        "/private/tmp", // bash heredoc: creates temp files here, needs to read them back
+        ...homeReadPaths,
+        resolvePath(opts.workspacePath),
+        ...opts.sharedPaths.map(resolvePath),
+        ...opts.readOnlyPaths.map(resolvePath),
+    ];
+    // claude CLI directories that need write access:
+    // ~/.claude/ — history, cache, session state, plans
+    // ~/.local/share/claude/ — version data (already under ~/.local read path,
+    //   but needs write for updates; covered by ~/.local in homeReadPaths for reads)
+    const claudeWritePaths = [
+        safePath(home, ".claude"),
+        safePath(home, ".local", "share", "claude"),
+    ].filter((p) => existsSync(p)).map(resolvePath);
+    const writePaths = [
+        resolvePath(opts.workspacePath),
+        ...opts.sharedPaths.map(resolvePath),
+        ...claudeWritePaths,
+        "/private/tmp",
+        "/private/var/folders",
+    ];
+    const resolvedTempDir = resolvePath(opts.tempDir);
+    if (resolvedTempDir && resolvedTempDir !== "/tmp" && resolvedTempDir !== "/private/tmp") {
+        writePaths.push(resolvedTempDir);
+    }
+    const lines = [
+        "(version 1)",
+        "(deny default)",
+        "",
+        ";; Process execution",
+        "(allow process-exec)",
+        "(allow process-fork)",
+        "",
+        ";; System operations",
+        "(allow sysctl-read)",
+        "(allow mach-lookup)",
+        "(allow signal (target self))",
+        "",
+        ";; Network (allow all -- network isolation is a separate concern)",
+        "(allow network*)",
+        "",
+        ";; Path traversal: stat() on any path (type/size/perms only, not content)",
+        "(allow file-read-metadata)",
+        "",
+        ";; Root directory read (required for path resolution on macOS)",
+        '(allow file-read-data (literal "/"))',
+        "",
+        ";; Device writes (null, DTrace helper)",
+        '(allow file-write-data (literal "/dev/null"))',
+        '(allow file-write-data (literal "/dev/dtracehelper"))',
+        "",
+        ";; PTY/TTY device access (required for interactive tools: script, unbuffer, claude CLI)",
+        ";; posix_openpt/grantpt need write on /dev/ptmx; slave needs write on /dev/ttysNNN",
+        '(allow file-write* (literal "/dev/ptmx"))',
+        '(allow file-write* (regex #"^/dev/ttys[0-9]+$"))',
+        ";; ioctl on device files: tcgetattr/tcsetattr for terminal configuration",
+        '(allow file-ioctl (subpath "/dev"))',
+        "",
+        ";; Read access",
+        ...readPaths.map((p) => `(allow file-read* (subpath ${sbplQuote(p)}))`),
+        // claude CLI auth file at HOME root (literal, not subpath)
+        ...(claudeJsonLiteral ? [`(allow file-read* (literal ${sbplQuote(claudeJsonLiteral)}))`, `(allow file-write* (literal ${sbplQuote(claudeJsonLiteral)}))`] : []),
+        "",
+        ";; Write access",
+        ...writePaths.map((p) => `(allow file-write* (subpath ${sbplQuote(p)}))`),
+    ];
+    return lines.join("\n");
+}
+export class SandboxExecProvider {
+    name = "sandbox-exec";
+    available() {
+        try {
+            execFileSync("which", ["sandbox-exec"], { encoding: "utf8" });
+            // Runtime smoke test: verify sandbox-exec actually works with custom SBPL profiles.
+            // On macOS Sequoia 15.3+, sandbox-exec with custom profiles silently fails
+            // (exitCode 1, empty stdout/stderr). The minimal profile (allow default)
+            // permits everything -- we only need to confirm sandbox-exec can execute at all.
+            const out = execFileSync("sandbox-exec", ["-p", "(version 1)(allow default)", "/bin/echo", "ok"], { encoding: "utf8", timeout: 3000 });
+            if (!out.includes("ok")) {
+                return false;
+            }
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    buildArgs(opts) {
+        const profile = buildSbplProfile(opts);
+        return ["sandbox-exec", "-p", profile];
+    }
+    wrapEnv(env, workspacePath) {
+        const cacheDir = safePath(workspacePath, ".cache");
+        return {
+            ...env,
+            // Temp files: heredocs, wheel builds, etc.
+            TMPDIR: safePath(workspacePath, ".comis-tmp"),
+            // Package manager caches
+            NPM_CONFIG_CACHE: safePath(cacheDir, "npm"),
+            PIP_CACHE_DIR: safePath(cacheDir, "pip"),
+            XDG_CACHE_HOME: cacheDir,
+            // Python: redirect user packages into workspace.
+            // PYTHONNOUSERSITE is NOT set — sandbox read paths now include ~/Library
+            // and ~/Projects, so pip's sys.path scanning works. Removing it lets
+            // Python find packages installed to PYTHONUSERBASE.
+            PYTHONUSERBASE: safePath(workspacePath, ".local"),
+            MPLCONFIGDIR: safePath(cacheDir, "matplotlib"),
+            // Force non-interactive backend — prevents plt.show() from opening GUI and blocking
+            MPLBACKEND: "Agg",
+            // uv: redirect managed Python installs into workspace
+            UV_PYTHON_INSTALL_DIR: safePath(cacheDir, "uv", "python"),
+            // Rust
+            CARGO_HOME: safePath(cacheDir, "cargo"),
+            // Go
+            GOPATH: safePath(cacheDir, "go"),
+            GOMODCACHE: safePath(cacheDir, "go", "pkg", "mod"),
+            // Ruby
+            GEM_HOME: safePath(cacheDir, "gems"),
+            BUNDLE_PATH: safePath(cacheDir, "bundle"),
+        };
+    }
+}

package/node_modules/@comis/skills/dist/tools/builtin/tool-provisioner.js

@@ -0,0 +1,227 @@
+// SPDX-License-Identifier: Apache-2.0
+// @allow-throw: builtin tool boundary; throws caught by AgentTool wrapper.
+/**
+ * Auto-provisioning for external tool binaries (ripgrep, fd).
+ *
+ * Checks system PATH first, then a local tools directory (~/.comis/bin/).
+ * Downloads from GitHub releases if not found. Supports macOS/Linux
+ * (x86_64 + aarch64). Respects COMIS_OFFLINE env var.
+ *
+ * @module
+ */
+import { safePath, systemGetEnv } from "@comis/core";
+import { existsSync, mkdirSync, createWriteStream, chmodSync, renameSync, rmSync } from "node:fs";
+import { arch, platform, homedir } from "node:os";
+import { spawnSync, execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { pipeline } from "node:stream/promises";
+import { Readable } from "node:stream";
+const execFileAsync = promisify(execFile);
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+const TOOLS_DIR = safePath(homedir(), ".comis", "bin");
+const NETWORK_TIMEOUT_MS = 10_000;
+const DOWNLOAD_TIMEOUT_MS = 120_000;
+const TOOLS = {
+    rg: {
+        name: "ripgrep",
+        repo: "BurntSushi/ripgrep",
+        binaryName: "rg",
+        tagPrefix: "",
+        getAssetName: (version, plat, architecture) => {
+            if (plat === "darwin") {
+                const archStr = architecture === "arm64" ? "aarch64" : "x86_64";
+                return `ripgrep-${version}-${archStr}-apple-darwin.tar.gz`;
+            }
+            if (plat === "linux") {
+                if (architecture === "arm64")
+                    return `ripgrep-${version}-aarch64-unknown-linux-gnu.tar.gz`;
+                return `ripgrep-${version}-x86_64-unknown-linux-musl.tar.gz`;
+            }
+            return null;
+        },
+    },
+    fd: {
+        name: "fd",
+        repo: "sharkdp/fd",
+        binaryName: "fd",
+        tagPrefix: "v",
+        getAssetName: (version, plat, architecture) => {
+            if (plat === "darwin") {
+                const archStr = architecture === "arm64" ? "aarch64" : "x86_64";
+                return `fd-v${version}-${archStr}-apple-darwin.tar.gz`;
+            }
+            if (plat === "linux") {
+                const archStr = architecture === "arm64" ? "aarch64" : "x86_64";
+                return `fd-v${version}-${archStr}-unknown-linux-gnu.tar.gz`;
+            }
+            return null;
+        },
+    },
+};
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Check if a command exists on the system PATH.
+ *
+ * @param cmd - Binary name to check
+ * @returns true if the command is callable
+ */
+function commandExists(cmd) {
+    const result = spawnSync(cmd, ["--version"], { stdio: "pipe" });
+    return result.error === undefined || result.error === null;
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Get the path to a tool binary, checking local tools dir first then PATH.
+ *
+ * @param tool - Tool key ("rg" or "fd")
+ * @returns Absolute path to local binary, bare binary name if on PATH, or null
+ */
+export function getToolPath(tool) {
+    const config = TOOLS[tool];
+    if (!config)
+        return null;
+    // Check local tools directory first
+    const localPath = safePath(TOOLS_DIR, config.binaryName);
+    if (existsSync(localPath))
+        return localPath;
+    // Check system PATH
+    if (commandExists(config.binaryName))
+        return config.binaryName;
+    return null;
+}
+/**
+ * Ensure a tool binary is available, downloading if necessary.
+ *
+ * Resolution order: local ~/.comis/bin/ -> system PATH -> download.
+ * Returns undefined (never throws) on download failure or offline mode.
+ *
+ * @param tool - Tool key ("rg" or "fd")
+ * @param logger - Optional logger for debug messages
+ * @returns Path to binary, or undefined if unavailable
+ */
+export async function ensureTool(tool, logger) {
+    const existing = getToolPath(tool);
+    if (existing)
+        return existing;
+    const config = TOOLS[tool];
+    if (!config)
+        return undefined;
+    // Respect offline mode
+    if (systemGetEnv("COMIS_OFFLINE") === "1" || systemGetEnv("COMIS_OFFLINE") === "true") {
+        logger?.debug?.(`${config.name} not found, offline mode enabled`);
+        return undefined;
+    }
+    logger?.debug?.(`${config.name} not found, downloading...`);
+    try {
+        const path = await downloadTool(tool);
+        logger?.debug?.(`${config.name} installed to ${path}`);
+        return path;
+    }
+    catch (e) {
+        logger?.debug?.(`Failed to download ${config.name}: ${e instanceof Error ? e.message : e}`);
+        return undefined;
+    }
+}
+// ---------------------------------------------------------------------------
+// Download implementation
+// ---------------------------------------------------------------------------
+/**
+ * Download a tool binary from GitHub releases.
+ *
+ * Fetches latest version from GitHub API, downloads the platform-specific
+ * tar.gz asset, extracts the binary, and installs to ~/.comis/bin/.
+ *
+ * @param tool - Tool key ("rg" or "fd")
+ * @returns Path to installed binary
+ * @throws Error on download or extraction failure
+ */
+async function downloadTool(tool) {
+    const config = TOOLS[tool];
+    if (!config)
+        throw new Error(`Unknown tool: ${tool}`);
+    // 1. Resolve platform + architecture
+    const plat = platform();
+    const architecture = arch();
+    const assetName = config.getAssetName("VERSION_PLACEHOLDER", plat, architecture);
+    if (!assetName) {
+        throw new Error(`Unsupported platform: ${plat}/${architecture}`);
+    }
+    // 2. Fetch latest version from GitHub API
+    const apiUrl = `https://api.github.com/repos/${config.repo}/releases/latest`;
+    const apiResponse = await fetch(apiUrl, {
+        signal: AbortSignal.timeout(NETWORK_TIMEOUT_MS),
+        headers: { Accept: "application/vnd.github.v3+json" },
+    });
+    if (!apiResponse.ok) {
+        throw new Error(`GitHub API returned ${apiResponse.status}: ${await apiResponse.text()}`);
+    }
+    const release = (await apiResponse.json());
+    const tagName = release.tag_name;
+    const version = tagName.startsWith(config.tagPrefix)
+        ? tagName.slice(config.tagPrefix.length)
+        : tagName;
+    // 3. Build real asset name with version
+    const realAssetName = config.getAssetName(version, plat, architecture);
+    const downloadUrl = `https://github.com/${config.repo}/releases/download/${tagName}/${realAssetName}`;
+    // 4. Ensure tools directory exists
+    mkdirSync(TOOLS_DIR, { recursive: true });
+    // 5. Download tar.gz
+    const tempTarPath = safePath(TOOLS_DIR, `.${config.binaryName}-download.tar.gz`);
+    const tempExtractDir = safePath(TOOLS_DIR, `.${config.binaryName}-extract`);
+    try {
+        const downloadResponse = await fetch(downloadUrl, {
+            signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS),
+        });
+        if (!downloadResponse.ok) {
+            throw new Error(`Download failed with ${downloadResponse.status}: ${downloadUrl}`);
+        }
+        // Stream to file
+        const body = downloadResponse.body;
+        if (!body)
+            throw new Error("Empty response body");
+        await pipeline(Readable.fromWeb(body), createWriteStream(tempTarPath));
+        // 6. Extract
+        mkdirSync(tempExtractDir, { recursive: true });
+        await execFileAsync("tar", ["-xzf", tempTarPath, "-C", tempExtractDir]);
+        // 7. Find the binary in extracted directory (may be in a subdirectory)
+        const assetBaseName = realAssetName.replace(/\.tar\.gz$/, "");
+        const possiblePaths = [
+            safePath(tempExtractDir, assetBaseName, config.binaryName),
+            safePath(tempExtractDir, config.binaryName),
+        ];
+        let sourceBinary;
+        for (const p of possiblePaths) {
+            if (existsSync(p)) {
+                sourceBinary = p;
+                break;
+            }
+        }
+        if (!sourceBinary) {
+            throw new Error(`Binary ${config.binaryName} not found in extracted archive`);
+        }
+        // 8. Atomic install: write to .tmp, chmod +x, rename to final
+        const finalPath = safePath(TOOLS_DIR, config.binaryName);
+        const tmpPath = finalPath + ".tmp";
+        renameSync(sourceBinary, tmpPath);
+        chmodSync(tmpPath, 0o755);
+        renameSync(tmpPath, finalPath);
+        return finalPath;
+    }
+    finally {
+        // Cleanup temp files
+        try {
+            rmSync(tempTarPath, { force: true });
+        }
+        catch { /* best effort */ }
+        try {
+            rmSync(tempExtractDir, { recursive: true, force: true });
+        }
+        catch { /* best effort */ }
+    }
+}

package/node_modules/@comis/skills/dist/tools/builtin/web-fetch-tool.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Web Fetch Tool: Fetch and extract readable content from a URL.
+ *
+ * Uses @mozilla/readability for HTML extraction, shared caching with TTL,
+ * and external content security wrapping. All returned content is wrapped
+ * in EXTERNAL_UNTRUSTED_CONTENT markers.
+ *
+ * Uses impit for Chrome TLS fingerprinting to bypass bot detection.
+ *
+ * Ported from Comis's web-fetch.ts with adaptations:
+ * - SSRF via validateUrl() from @comis/core
+ * - Content wrapping via wrapWebContent() from @comis/core
+ * - Cache/timeout via web-shared.ts
+ * - Readability extraction via web-fetch-utils.ts
+ * - No Firecrawl (htmlToMarkdown fallback instead)
+ * - No process.env access (config-driven)
+ *
+ * @module
+ */
+import type { AgentTool } from "@earendil-works/pi-agent-core";
+import { Type } from "typebox";
+import { type WrapExternalContentOptions } from "@comis/core";
+import { type ExtractMode } from "./web-fetch-utils.js";
+declare const WebFetchParams: Type.TObject<{
+    url: Type.TString;
+    extractMode: Type.TOptional<Type.TString>;
+    maxChars: Type.TOptional<Type.TNumber>;
+}>;
+export interface WebFetchConfig {
+    enabled?: boolean;
+    readabilityEnabled?: boolean;
+    maxCharsCap?: number;
+    /** Maximum response bytes to read via streaming (default 2MB, clamped to 32KB-5MB). */
+    maxResponseBytes?: number;
+    timeoutSeconds?: number;
+    cacheTtlMinutes?: number;
+    userAgent?: string;
+    /** Optional callback for suspicious content detection in external content. */
+    onSuspiciousContent?: WrapExternalContentOptions["onSuspiciousContent"];
+}
+/**
+ * Fetch and extract readable content from a URL.
+ * Reusable core for both web_fetch tool and web_search deep fetch.
+ *
+ * Returns an object with `text`, `title`, `error`, `tookMs`, and metadata.
+ * On any failure (SSRF, HTTP error, timeout), returns `{ error: string }` instead of throwing.
+ */
+export declare function fetchUrlContent(params: {
+    url: string;
+    extractMode?: ExtractMode;
+    maxChars?: number;
+    maxResponseBytes?: number;
+    timeoutSeconds?: number;
+    readabilityEnabled?: boolean;
+    onSuspiciousContent?: WrapExternalContentOptions["onSuspiciousContent"];
+}): Promise<{
+    url: string;
+    text?: string;
+    title?: string;
+    error?: string;
+    tookMs: number;
+    status?: number;
+    extractor?: string;
+    truncated?: boolean;
+}>;
+/**
+ * Create a web fetch tool with readability extraction and content wrapping.
+ * Uses impit Chrome TLS fingerprinting to avoid bot detection.
+ *
+ * @param config - Optional configuration for the fetch tool
+ * @returns AgentTool implementing the web fetch interface
+ */
+export declare function createWebFetchTool(config?: WebFetchConfig): AgentTool<typeof WebFetchParams>;
+/**
+ * Exported for testing: clears the internal fetch cache.
+ */
+export declare function __clearFetchCache(): void;
+export {};