context-mode 1.0.162 → 1.0.163

package/build/security.js

@@ -120,11 +120,18 @@ export function matchesAnyPattern(command, patterns, caseInsensitive = false) {
     return null;
 }
 // ==============================================================================
-// Chained Command Splitting
+// Chained Command Splitting & Subshell Extraction
 // ==============================================================================
+function isEscaped(command, index) {
+    let backslashes = 0;
+    for (let i = index - 1; i >= 0 && command[i] === "\\"; i--) {
+        backslashes++;
+    }
+    return backslashes % 2 === 1;
+}
 /**
- * Split a shell command on chain operators (&&, ||, ;, |) while
- * respecting single/double quotes and backticks.
+ * Split a shell command on chain operators (&&, ||, ;, |, \n, \r, &) while
+ * respecting single/double quotes, backticks, subshells, and escape backslashes.
  *
  * "echo hello && sudo rm -rf /" → ["echo hello", "sudo rm -rf /"]
  *
@@ -136,37 +143,57 @@ export function splitChainedCommands(command) {
     let inSingle = false;
     let inDouble = false;
     let inBacktick = false;
+    let dollarParenDepth = 0;
     for (let i = 0; i < command.length; i++) {
         const ch = command[i];
-        const prev = i > 0 ? command[i - 1] : "";
-        if (ch === "'" && !inDouble && !inBacktick && prev !== "\\") {
+        const escaped = isEscaped(command, i);
+        if (ch === "'" && !inDouble && !inBacktick && !escaped) {
             inSingle = !inSingle;
             current += ch;
         }
-        else if (ch === '"' && !inSingle && !inBacktick && prev !== "\\") {
+        else if (ch === '"' && !inSingle && !inBacktick && !escaped) {
             inDouble = !inDouble;
             current += ch;
         }
-        else if (ch === "`" && !inSingle && !inDouble && prev !== "\\") {
+        else if (ch === "`" && !inSingle && !inDouble && !escaped) {
             inBacktick = !inBacktick;
             current += ch;
         }
         else if (!inSingle && !inDouble && !inBacktick) {
-            if (ch === ";") {
+            if (ch === "$" && command[i + 1] === "(" && !escaped) {
+                dollarParenDepth++;
+                current += ch + command[i + 1];
+                i++;
+            }
+            else if (dollarParenDepth > 0 && ch === "(" && !escaped) {
+                dollarParenDepth++;
+                current += ch;
+            }
+            else if (ch === ")" && dollarParenDepth > 0 && !escaped) {
+                dollarParenDepth--;
+                current += ch;
+            }
+            else if (dollarParenDepth === 0 &&
+                (ch === ";" || ch === "\n" || ch === "\r") &&
+                !escaped) {
                 parts.push(current.trim());
                 current = "";
             }
-            else if (ch === "|" && command[i + 1] === "|") {
+            else if (dollarParenDepth === 0 && ch === "|" && command[i + 1] === "|") {
                 parts.push(current.trim());
                 current = "";
                 i++; // skip second |
             }
-            else if (ch === "&" && command[i + 1] === "&") {
+            else if (dollarParenDepth === 0 && ch === "&" && command[i + 1] === "&") {
                 parts.push(current.trim());
                 current = "";
                 i++; // skip second &
             }
-            else if (ch === "|") {
+            else if (dollarParenDepth === 0 && ch === "&" && !escaped) {
+                parts.push(current.trim());
+                current = "";
+            }
+            else if (dollarParenDepth === 0 && ch === "|") {
                 // Single pipe — left side is a command too
                 parts.push(current.trim());
                 current = "";
@@ -183,6 +210,83 @@ export function splitChainedCommands(command) {
         parts.push(current.trim());
     return parts.filter((p) => p.length > 0);
 }
+/**
+ * Recursively extract all nested subshell commands from `$()` and `` `...` ``.
+ * Handles escaping and quote contexts to ensure correct command boundary detection.
+ */
+export function extractSubshellCommands(command) {
+    const subshells = [];
+    let inSingle = false;
+    let inDouble = false;
+    let backtickStart = -1;
+    const dollarParenStarts = [];
+    const dollarParenDepths = [];
+    let parenDepth = 0;
+    for (let i = 0; i < command.length; i++) {
+        const ch = command[i];
+        const escaped = isEscaped(command, i);
+        if (ch === "'" && !inDouble && backtickStart === -1 && !escaped) {
+            inSingle = !inSingle;
+        }
+        else if (ch === '"' && !inSingle && backtickStart === -1 && !escaped) {
+            inDouble = !inDouble;
+        }
+        else if (ch === "`" && !inSingle && !inDouble && !escaped) {
+            if (backtickStart === -1) {
+                backtickStart = i + 1;
+            }
+            else {
+                const sub = command.slice(backtickStart, i);
+                subshells.push(sub);
+                subshells.push(...extractSubshellCommands(sub));
+                backtickStart = -1;
+            }
+        }
+        else if (!inSingle && backtickStart === -1) {
+            if (ch === "$" && command[i + 1] === "(" && !escaped) {
+                if (command[i + 2] === "(") {
+                    // Arithmetic expansion is not command execution, but nested command
+                    // substitutions inside it still get discovered by the scanner.
+                    parenDepth += 2;
+                    i += 2; // skip '(('
+                }
+                else {
+                    dollarParenStarts.push(i + 2);
+                    dollarParenDepths.push(parenDepth);
+                    parenDepth++;
+                    i++; // skip '('
+                }
+            }
+            else if (ch === "(" && !escaped) {
+                parenDepth++;
+            }
+            else if (ch === ")" && !escaped) {
+                if (parenDepth > 0) {
+                    parenDepth--;
+                }
+                if (dollarParenDepths.length > 0 &&
+                    parenDepth === dollarParenDepths[dollarParenDepths.length - 1]) {
+                    dollarParenDepths.pop();
+                    const start = dollarParenStarts.pop();
+                    const sub = command.slice(start, i);
+                    subshells.push(sub);
+                }
+            }
+        }
+    }
+    return subshells;
+}
+function collectCommandElements(command) {
+    const elements = [];
+    const segments = splitChainedCommands(command);
+    for (const segment of segments) {
+        elements.push(segment);
+        for (const subshell of extractSubshellCommands(segment)) {
+            elements.push(...collectCommandElements(subshell));
+        }
+    }
+    return elements;
+}
 // ==============================================================================
 // Settings Reader
 // ==============================================================================
@@ -326,24 +430,46 @@ export function readToolDenyPatterns(toolName, projectDir, globalSettingsPath) {
  * First definitive match across policies wins.
  * Default (no match in any policy): "ask".
  */
-export function evaluateCommand(command, policies, caseInsensitive = process.platform === "win32") {
-    // Check each segment of chained commands against deny patterns
-    const segments = splitChainedCommands(command);
-    for (const segment of segments) {
+export function evaluateCommand(command, policies, caseInsensitive = process.platform === "win32" || process.platform === "darwin") {
+    // Extract all main segments and nested subshell commands
+    const allCommands = collectCommandElements(command);
+    // 1. Deny check: If ANY segment or subshell command is denied, block the entire command
+    for (const cmdElement of allCommands) {
         for (const policy of policies) {
-            const denyMatch = matchesAnyPattern(segment, policy.deny, caseInsensitive);
+            const denyMatch = matchesAnyPattern(cmdElement, policy.deny, caseInsensitive);
             if (denyMatch)
                 return { decision: "deny", matchedPattern: denyMatch };
         }
     }
-    // Check ask/allow against the full command (original behavior)
+    // 2. Allow/Ask check: Evaluate segment-by-segment in precedence order.
+    // The command is allowed if and only if EVERY segment and subshell is explicitly allowed.
+    // If any element matches an ask pattern or matches no allow pattern, it defaults to ask.
     for (const policy of policies) {
-        const askMatch = matchesAnyPattern(command, policy.ask, caseInsensitive);
-        if (askMatch)
-            return { decision: "ask", matchedPattern: askMatch };
-        const allowMatch = matchesAnyPattern(command, policy.allow, caseInsensitive);
-        if (allowMatch)
-            return { decision: "allow", matchedPattern: allowMatch };
+        let allAllowed = true;
+        let anyAsk = false;
+        let matchedAskPattern;
+        let matchedAllowPattern;
+        for (const cmdElement of allCommands) {
+            const askMatch = matchesAnyPattern(cmdElement, policy.ask, caseInsensitive);
+            if (askMatch) {
+                anyAsk = true;
+                matchedAskPattern = askMatch;
+                break; // Ask wins immediately within this policy
+            }
+            const allowMatch = matchesAnyPattern(cmdElement, policy.allow, caseInsensitive);
+            if (!allowMatch) {
+                allAllowed = false;
+            }
+            else {
+                matchedAllowPattern = allowMatch;
+            }
+        }
+        if (anyAsk) {
+            return { decision: "ask", matchedPattern: matchedAskPattern };
+        }
+        if (allAllowed && allCommands.length > 0) {
+            return { decision: "allow", matchedPattern: matchedAllowPattern };
+        }
     }
     return { decision: "ask" };
 }
@@ -353,13 +479,13 @@ export function evaluateCommand(command, policies, caseInsensitive = process.pla
  * The server has no UI for "ask" prompts, so allow/ask patterns are
  * irrelevant. Returns "deny" if any deny pattern matches, otherwise "allow".
  *
- * Also splits chained commands to prevent bypass.
+ * Also splits chained commands and nested subshells to prevent bypass.
  */
-export function evaluateCommandDenyOnly(command, policies, caseInsensitive = process.platform === "win32") {
-    const segments = splitChainedCommands(command);
-    for (const segment of segments) {
+export function evaluateCommandDenyOnly(command, policies, caseInsensitive = process.platform === "win32" || process.platform === "darwin") {
+    const allCommands = collectCommandElements(command);
+    for (const cmdElement of allCommands) {
         for (const policy of policies) {
-            const denyMatch = matchesAnyPattern(segment, policy.deny, caseInsensitive);
+            const denyMatch = matchesAnyPattern(cmdElement, policy.deny, caseInsensitive);
             if (denyMatch)
                 return { decision: "deny", matchedPattern: denyMatch };
         }
@@ -391,7 +517,7 @@ export function evaluateCommandDenyOnly(command, policies, caseInsensitive = pro
  * still checked. This keeps the function usable for paths that will
  * be created during execution.
  */
-export function evaluateFilePath(filePath, denyGlobs, caseInsensitive = process.platform === "win32", projectRoot) {
+export function evaluateFilePath(filePath, denyGlobs, caseInsensitive = process.platform === "win32" || process.platform === "darwin", projectRoot) {
     const toForward = (path) => path.replace(/\\/g, "/");
     // Match against the raw input, the lexically-resolved absolute path,
     // and the canonical (symlink-resolved) path when the file exists.

package/build/server.d.ts

@@ -61,6 +61,8 @@ type ToolContextOverride = {
     sessionId?: string;
 };
 export declare function withProjectDirOverride<T>(projectDir: string | ToolContextOverride, fn: () => Promise<T>): Promise<T>;
+export declare function sanitizeSchemaForStrictClients(node: unknown): unknown;
+export declare function installStrictClientSchemaCompat(target?: McpServer): void;
 /**
  * Build the FK-attribution object passed to every ContentStore.index*() call
  * in this process. CLAUDE_SESSION_ID is the only MCP-side handle we have on
@@ -116,6 +118,7 @@ export interface BatchRunOptions {
     timeout: number | undefined;
     concurrency: number;
     nodeOptsPrefix: string;
+    cwd?: string;
     onFsBytes?: (bytes: number) => void;
 }
 interface BatchExecutor {
@@ -123,12 +126,23 @@ interface BatchExecutor {
         language: "shell";
         code: string;
         timeout: number | undefined;
+        cwd?: string;
     }): Promise<{
         stdout: string;
         timedOut?: boolean;
     }>;
 }
 export declare function buildBatchNodeOptionsPrefix(shellPath: string, preloadPath: string): string;
+/**
+ * Default execution timeout (ms) applied ONLY under Antigravity CLI (`agy`).
+ * agy does not enforce an MCP RPC timeout, so a ctx_execute with a runaway or
+ * blocking script hangs forever — the host never kills it and the user must
+ * interrupt. Every other host enforces its own RPC timeout, so we keep the
+ * no-server-timer behavior there (Issue #406 — long builds need an unbounded
+ * run). A caller can still pass an explicit `timeout` to override on any host.
+ */
+export declare const AGY_DEFAULT_EXEC_TIMEOUT_MS = 120000;
+export declare function resolveExecTimeout(timeout: number | undefined): number | undefined;
 /**
  * Execute batch commands. concurrency=1 preserves the legacy serial path
  * (shared timeout budget + cascading skip-on-timeout). concurrency>1 runs