cowork-os 0.3.21

package/dist/electron/electron/agent/tools/search-tools.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SearchTools = void 0;
+const search_1 = require("../search");
+/**
+ * SearchTools implements web search operations for the agent
+ */
+class SearchTools {
+    constructor(workspace, daemon, taskId) {
+        this.workspace = workspace;
+        this.daemon = daemon;
+        this.taskId = taskId;
+    }
+    /**
+     * Update the workspace for this tool
+     */
+    setWorkspace(workspace) {
+        this.workspace = workspace;
+    }
+    /**
+     * Perform a web search with automatic fallback support
+     */
+    async webSearch(input) {
+        // Check if any provider is configured
+        if (!search_1.SearchProviderFactory.isAnyProviderConfigured()) {
+            // Return a helpful response instead of throwing an error
+            // This allows the LLM to inform the user gracefully
+            this.daemon.logEvent(this.taskId, 'log', {
+                message: 'Web search is not available - no search provider configured',
+            });
+            return {
+                query: input.query,
+                searchType: input.searchType || 'web',
+                results: [],
+                provider: 'none',
+                metadata: {
+                    error: 'Web search is not configured. To enable web search, please configure a search provider in Settings > Web Search. Supported providers: Tavily, Brave Search, SerpAPI, or Google Custom Search.',
+                    notConfigured: true,
+                },
+            };
+        }
+        const settings = search_1.SearchProviderFactory.loadSettings();
+        if (!settings.primaryProvider && !input.provider) {
+            // This shouldn't happen after the loadSettings auto-detection fix,
+            // but keep as a safety net
+            this.daemon.logEvent(this.taskId, 'log', {
+                message: 'Web search provider not selected - auto-selecting...',
+            });
+            // Clear cache and reload to trigger auto-detection
+            search_1.SearchProviderFactory.clearCache();
+            const reloadedSettings = search_1.SearchProviderFactory.loadSettings();
+            if (!reloadedSettings.primaryProvider) {
+                return {
+                    query: input.query,
+                    searchType: input.searchType || 'web',
+                    results: [],
+                    provider: 'none',
+                    metadata: {
+                        error: 'No search provider is selected. Please configure one in Settings > Web Search.',
+                        notConfigured: true,
+                    },
+                };
+            }
+        }
+        const searchQuery = {
+            query: input.query,
+            searchType: input.searchType || 'web',
+            maxResults: Math.min(input.maxResults || 10, 20), // Cap at 20 results
+            dateRange: input.dateRange,
+            region: input.region,
+            provider: input.provider,
+        };
+        const providerName = input.provider || settings.primaryProvider || 'unknown';
+        this.daemon.logEvent(this.taskId, 'log', {
+            message: `Searching ${searchQuery.searchType}: "${input.query}" via ${providerName}`,
+        });
+        // Use searchWithFallback for automatic fallback support
+        const response = await search_1.SearchProviderFactory.searchWithFallback(searchQuery);
+        this.daemon.logEvent(this.taskId, 'tool_result', {
+            tool: 'web_search',
+            result: {
+                query: input.query,
+                searchType: searchQuery.searchType,
+                resultCount: response.results.length,
+                provider: response.provider,
+            },
+        });
+        return response;
+    }
+}
+exports.SearchTools = SearchTools;

package/dist/electron/electron/agent/tools/shell-tools.js

@@ -0,0 +1,574 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports._testUtils = exports.ShellTools = void 0;
+const child_process_1 = require("child_process");
+const guardrail_manager_1 = require("../../guardrails/guardrail-manager");
+// Limits to prevent runaway commands
+const MAX_TIMEOUT = 5 * 60 * 1000; // 5 minutes max
+const DEFAULT_TIMEOUT = 60 * 1000; // 1 minute default
+const MAX_OUTPUT_SIZE = 100 * 1024; // 100KB max output
+/**
+ * Validate that a PID is a safe positive integer
+ * Prevents command injection if PID is somehow not a number
+ */
+function isValidPid(pid) {
+    return typeof pid === 'number' &&
+        Number.isInteger(pid) &&
+        pid > 0 &&
+        pid <= 4194304; // Max PID on Linux (can be configured higher, but this is safe default)
+}
+/**
+ * Check if a process with the given PID exists and is owned by the current user
+ * Returns false if the process doesn't exist or is owned by another user
+ */
+function isProcessOwnedByCurrentUser(pid) {
+    if (!isValidPid(pid))
+        return false;
+    try {
+        // Use kill with signal 0 to check if process exists and we have permission to signal it
+        // This will throw EPERM if process exists but is owned by another user
+        // This will throw ESRCH if process doesn't exist
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        // ESRCH = no such process (that's fine, process exited)
+        // EPERM = permission denied (process exists but owned by another user - DON'T KILL)
+        if (error.code === 'EPERM') {
+            console.warn(`[ShellTools] Process ${pid} exists but is owned by another user, skipping`);
+            return false;
+        }
+        // Process doesn't exist, that's fine
+        return false;
+    }
+}
+/**
+ * Validate username for safe use in shell commands
+ * Prevents command injection via USER environment variable
+ */
+function isValidUsername(username) {
+    if (!username)
+        return false;
+    // Username must be alphanumeric, underscore, or dash (standard POSIX username chars)
+    // Max length 32 chars (common limit)
+    return /^[a-zA-Z0-9_-]{1,32}$/.test(username);
+}
+/**
+ * Get all descendant process IDs for a given parent PID
+ * Uses pgrep to find child processes recursively
+ * Only returns processes owned by the current user for security
+ */
+function getDescendantPids(parentPid) {
+    if (!isValidPid(parentPid)) {
+        console.error(`[ShellTools] Invalid parent PID: ${parentPid}`);
+        return [];
+    }
+    const currentUser = process.env.USER;
+    // Validate username to prevent command injection
+    const safeUser = isValidUsername(currentUser) ? currentUser : undefined;
+    if (currentUser && !safeUser) {
+        console.warn(`[ShellTools] Invalid USER env var: ${currentUser}, skipping user filter`);
+    }
+    const descendants = [];
+    const toProcess = [parentPid];
+    const seen = new Set(); // Prevent infinite loops from circular references
+    while (toProcess.length > 0) {
+        const pid = toProcess.pop();
+        if (seen.has(pid))
+            continue;
+        seen.add(pid);
+        try {
+            // pgrep -P finds direct children of the given PID
+            // Add -U $USER to only find processes owned by current user (security)
+            const pgrepCmd = safeUser
+                ? `pgrep -P ${pid} -U ${safeUser}`
+                : `pgrep -P ${pid}`;
+            const output = (0, child_process_1.execSync)(pgrepCmd, {
+                encoding: 'utf-8',
+                timeout: 1000,
+                // Don't inherit env to avoid any injection via environment
+                env: { PATH: '/usr/bin:/bin' },
+            });
+            const childPids = output.trim().split('\n')
+                .filter(line => line.length > 0)
+                .map(line => parseInt(line, 10))
+                .filter(childPid => isValidPid(childPid) && !seen.has(childPid));
+            descendants.push(...childPids);
+            toProcess.push(...childPids);
+        }
+        catch {
+            // pgrep returns non-zero if no children found, which is fine
+        }
+    }
+    return descendants;
+}
+/**
+ * Kill a process and all its descendants
+ * Sends the signal to children first, then to the parent (bottom-up killing)
+ * Only kills processes owned by the current user for security
+ */
+function killProcessTree(pid, signal) {
+    if (!isValidPid(pid)) {
+        console.error(`[ShellTools] Refusing to kill invalid PID: ${pid}`);
+        return;
+    }
+    const descendants = getDescendantPids(pid);
+    // Kill descendants first (in reverse order, deepest children first)
+    for (const descendantPid of descendants.reverse()) {
+        // Double-check ownership before killing each process
+        if (isProcessOwnedByCurrentUser(descendantPid)) {
+            try {
+                process.kill(descendantPid, signal);
+            }
+            catch {
+                // Process may have already exited
+            }
+        }
+    }
+    // Kill the parent process (also verify ownership)
+    if (isProcessOwnedByCurrentUser(pid)) {
+        try {
+            process.kill(pid, signal);
+        }
+        catch {
+            // Process may have already exited
+        }
+    }
+}
+/**
+ * ShellTools implements shell command execution with user approval
+ */
+class ShellTools {
+    constructor(workspace, daemon, taskId) {
+        this.workspace = workspace;
+        this.daemon = daemon;
+        this.taskId = taskId;
+        this.recentApprovals = new Map();
+        this.approvalWindowMs = 2 * 60 * 1000;
+        // Track the currently running child process for stdin support
+        this.activeProcess = null;
+        // Track escalation timeouts so we can cancel them when process exits
+        this.escalationTimeouts = [];
+        // Prevent multiple concurrent kill attempts
+        this.killInProgress = false;
+        // Unique identifier for the current process session (prevents PID reuse issues)
+        this.processSessionId = 0;
+        // Track user-initiated kills to signal termination reason to agent
+        this.userKillRequested = false;
+    }
+    /**
+     * Update the workspace for this tool
+     */
+    setWorkspace(workspace) {
+        this.workspace = workspace;
+    }
+    /**
+     * Clear all pending escalation timeouts
+     * Called when process exits to prevent killing reused PIDs
+     */
+    clearEscalationTimeouts() {
+        for (const timeout of this.escalationTimeouts) {
+            clearTimeout(timeout);
+        }
+        this.escalationTimeouts = [];
+        this.killInProgress = false;
+    }
+    /**
+     * Send input to the currently running command's stdin
+     */
+    sendStdin(input) {
+        if (!this.activeProcess || !this.activeProcess.stdin || this.activeProcess.killed) {
+            return false;
+        }
+        try {
+            this.activeProcess.stdin.write(input);
+            // Echo the input to show it was sent
+            this.daemon.logEvent(this.taskId, 'command_output', {
+                type: 'stdin',
+                output: input,
+            });
+            return true;
+        }
+        catch (error) {
+            console.error('Failed to write to stdin:', error);
+            return false;
+        }
+    }
+    /**
+     * Check if a command is currently running
+     */
+    hasActiveProcess() {
+        return this.activeProcess !== null && !this.activeProcess.killed;
+    }
+    /**
+     * Kill the currently running command and all its child processes
+     * @param force - If true, send SIGKILL immediately. Otherwise, try SIGINT first, then SIGTERM, then SIGKILL.
+     */
+    killProcess(force = false) {
+        if (!this.activeProcess || this.activeProcess.killed) {
+            return false;
+        }
+        const pid = this.activeProcess.pid;
+        if (!isValidPid(pid)) {
+            console.error(`[ShellTools] Invalid PID for kill: ${pid}`);
+            return false;
+        }
+        // Prevent multiple concurrent kill chains (security: avoid race conditions)
+        if (this.killInProgress && !force) {
+            console.log(`[ShellTools] Kill already in progress, ignoring duplicate request`);
+            return true; // Return true since a kill is already underway
+        }
+        // Capture session ID to verify we're killing the right process in escalation timeouts
+        const currentSessionId = this.processSessionId;
+        // Mark this as a user-initiated kill so the close handler can signal the agent
+        this.userKillRequested = true;
+        if (force) {
+            // Force kill - immediate SIGKILL to entire process tree
+            // Clear any pending escalation timeouts first
+            this.clearEscalationTimeouts();
+            try {
+                killProcessTree(pid, 'SIGKILL');
+                this.daemon.logEvent(this.taskId, 'command_output', {
+                    type: 'error',
+                    output: '\n[Process tree force killed by user]\n',
+                });
+                return true;
+            }
+            catch (error) {
+                console.error('Failed to force kill process tree:', error);
+                return false;
+            }
+        }
+        // Mark kill as in progress to prevent duplicate escalation chains
+        this.killInProgress = true;
+        try {
+            // Send SIGINT (Ctrl+C) to gracefully interrupt the process tree
+            killProcessTree(pid, 'SIGINT');
+            this.daemon.logEvent(this.taskId, 'command_output', {
+                type: 'error',
+                output: '\n^C [Process tree interrupted by user]\n',
+            });
+            // Set up escalation: if still running after 2s, send SIGTERM to tree
+            // If still running after 4s, send SIGKILL to tree
+            // These timeouts are tracked so they can be cancelled if process exits
+            const childProcess = this.activeProcess;
+            const sigtermTimeout = setTimeout(() => {
+                // Verify this is still the same process session (prevents PID reuse attacks)
+                if (currentSessionId !== this.processSessionId) {
+                    console.log(`[ShellTools] Session ID mismatch, skipping SIGTERM escalation`);
+                    return;
+                }
+                if (childProcess && !childProcess.killed && childProcess.pid === pid) {
+                    // Additional safety: verify we own this process before killing
+                    if (!isProcessOwnedByCurrentUser(pid)) {
+                        console.warn(`[ShellTools] Process ${pid} no longer owned by current user, skipping SIGTERM`);
+                        return;
+                    }
+                    try {
+                        killProcessTree(pid, 'SIGTERM');
+                        this.daemon.logEvent(this.taskId, 'command_output', {
+                            type: 'error',
+                            output: '[Escalating to SIGTERM for process tree...]\n',
+                        });
+                    }
+                    catch { /* Process may have exited */ }
+                }
+            }, 2000);
+            this.escalationTimeouts.push(sigtermTimeout);
+            const sigkillTimeout = setTimeout(() => {
+                // Verify this is still the same process session (prevents PID reuse attacks)
+                if (currentSessionId !== this.processSessionId) {
+                    console.log(`[ShellTools] Session ID mismatch, skipping SIGKILL escalation`);
+                    return;
+                }
+                if (childProcess && !childProcess.killed && childProcess.pid === pid) {
+                    // Additional safety: verify we own this process before killing
+                    if (!isProcessOwnedByCurrentUser(pid)) {
+                        console.warn(`[ShellTools] Process ${pid} no longer owned by current user, skipping SIGKILL`);
+                        return;
+                    }
+                    try {
+                        killProcessTree(pid, 'SIGKILL');
+                        this.daemon.logEvent(this.taskId, 'command_output', {
+                            type: 'error',
+                            output: '[Escalating to SIGKILL for process tree...]\n',
+                        });
+                    }
+                    catch { /* Process may have exited */ }
+                }
+            }, 4000);
+            this.escalationTimeouts.push(sigkillTimeout);
+            return true;
+        }
+        catch (error) {
+            console.error('Failed to kill process tree:', error);
+            this.killInProgress = false;
+            // Try SIGTERM as fallback
+            try {
+                killProcessTree(pid, 'SIGTERM');
+                return true;
+            }
+            catch {
+                // Last resort: SIGKILL
+                try {
+                    killProcessTree(pid, 'SIGKILL');
+                    return true;
+                }
+                catch {
+                    return false;
+                }
+            }
+        }
+    }
+    /**
+     * Execute a shell command (requires user approval)
+     * Note: We don't check workspace.permissions.shell here because
+     * shell commands always require explicit user approval via requestApproval()
+     */
+    async runCommand(command, options) {
+        // Check if command is blocked by guardrails BEFORE anything else
+        const blockCheck = guardrail_manager_1.GuardrailManager.isCommandBlocked(command);
+        if (blockCheck.blocked) {
+            throw new Error(`Command blocked by guardrails: "${command}"\n` +
+                `Matched pattern: ${blockCheck.pattern}\n` +
+                `This command has been blocked for safety. You can modify blocked patterns in Settings > Guardrails.`);
+        }
+        // Check if command is trusted (auto-approve without user confirmation)
+        const trustCheck = guardrail_manager_1.GuardrailManager.isCommandTrusted(command);
+        let approved = false;
+        if (trustCheck.trusted) {
+            // Auto-approve trusted commands
+            approved = true;
+            this.daemon.logEvent(this.taskId, 'log', {
+                message: `Auto-approved trusted command (matched: ${trustCheck.pattern})`,
+                command,
+            });
+        }
+        else {
+            const signature = this.getCommandSignature(command);
+            const previousApproval = signature ? this.recentApprovals.get(signature) : undefined;
+            const now = Date.now();
+            if (signature &&
+                previousApproval &&
+                now - previousApproval.approvedAt <= this.approvalWindowMs &&
+                this.isAutoApprovalSafe(command)) {
+                approved = true;
+                previousApproval.count += 1;
+                previousApproval.approvedAt = now;
+                this.recentApprovals.set(signature, previousApproval);
+                this.daemon.logEvent(this.taskId, 'log', {
+                    message: `Auto-approved similar command (approved ${previousApproval.count}x in last ${Math.round(this.approvalWindowMs / 1000)}s)`,
+                    command,
+                });
+            }
+            else {
+                // Request user approval before executing
+                approved = await this.daemon.requestApproval(this.taskId, 'run_command', `Run command: ${command}`, {
+                    command,
+                    cwd: options?.cwd || this.workspace.path,
+                    timeout: options?.timeout || DEFAULT_TIMEOUT,
+                });
+                if (approved && signature) {
+                    this.recentApprovals.set(signature, { approvedAt: now, count: 1 });
+                }
+            }
+        }
+        if (!approved) {
+            throw new Error('User denied command execution');
+        }
+        // Log the command execution attempt
+        this.daemon.logEvent(this.taskId, 'tool_call', {
+            tool: 'run_command',
+            command,
+            cwd: options?.cwd || this.workspace.path,
+        });
+        const timeout = Math.min(options?.timeout || DEFAULT_TIMEOUT, MAX_TIMEOUT);
+        // Create a minimal, safe environment (don't leak sensitive process.env vars like API keys)
+        const safeEnv = {
+            // Essential system variables only
+            PATH: process.env.PATH || '/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin',
+            HOME: process.env.HOME || '',
+            USER: process.env.USER || '',
+            SHELL: process.env.SHELL || '/bin/bash',
+            LANG: process.env.LANG || 'en_US.UTF-8',
+            TERM: process.env.TERM || 'xterm-256color',
+            TMPDIR: process.env.TMPDIR || '/tmp',
+            // Add any user-provided env vars (explicitly passed by caller)
+            ...options?.env,
+        };
+        const cwd = options?.cwd || this.workspace.path;
+        // Emit the command being executed
+        this.daemon.logEvent(this.taskId, 'command_output', {
+            command,
+            cwd,
+            type: 'start',
+            output: `$ ${command}\n`,
+        });
+        return new Promise((resolve) => {
+            let stdout = '';
+            let stderr = '';
+            let killed = false;
+            // Increment session ID to invalidate any pending escalation timeouts from previous commands
+            this.processSessionId++;
+            // Clear any leftover escalation timeouts from previous commands
+            this.clearEscalationTimeouts();
+            // Use shell to handle complex commands with pipes, redirects, etc.
+            const shell = process.env.SHELL || '/bin/bash';
+            const child = (0, child_process_1.spawn)(shell, ['-c', command], {
+                cwd,
+                env: safeEnv,
+                stdio: ['pipe', 'pipe', 'pipe'], // Enable stdin for interactive commands
+            });
+            // Store reference to active process for stdin support
+            this.activeProcess = child;
+            // Set timeout
+            const timeoutId = setTimeout(() => {
+                killed = true;
+                child.kill('SIGTERM');
+                this.daemon.logEvent(this.taskId, 'command_output', {
+                    command,
+                    type: 'error',
+                    output: `\n[Command timed out after ${timeout / 1000}s]\n`,
+                });
+            }, timeout);
+            // Stream stdout
+            child.stdout.on('data', (data) => {
+                const chunk = data.toString('utf-8');
+                stdout += chunk;
+                // Emit live output
+                this.daemon.logEvent(this.taskId, 'command_output', {
+                    command,
+                    type: 'stdout',
+                    output: chunk,
+                });
+            });
+            // Stream stderr
+            child.stderr.on('data', (data) => {
+                const chunk = data.toString('utf-8');
+                stderr += chunk;
+                // Emit live output
+                this.daemon.logEvent(this.taskId, 'command_output', {
+                    command,
+                    type: 'stderr',
+                    output: chunk,
+                });
+            });
+            child.on('close', (code) => {
+                clearTimeout(timeoutId);
+                this.activeProcess = null; // Clear active process reference
+                // Clear any pending escalation timeouts to prevent killing reused PIDs
+                this.clearEscalationTimeouts();
+                // Determine termination reason to signal the agent
+                let terminationReason = 'normal';
+                if (this.userKillRequested) {
+                    terminationReason = 'user_stopped';
+                }
+                else if (killed) {
+                    terminationReason = 'timeout';
+                }
+                // Reset for next command
+                this.userKillRequested = false;
+                const success = terminationReason === 'normal' && code === 0;
+                const truncatedStdout = this.truncateOutput(stdout);
+                const truncatedStderr = this.truncateOutput(stderr);
+                const exitCodeLabel = code === null ? 'unknown' : String(code);
+                const errorMessage = terminationReason === 'timeout'
+                    ? 'Command timed out'
+                    : terminationReason === 'user_stopped'
+                        ? 'Command stopped by user'
+                        : !success
+                            ? `Command exited with code ${exitCodeLabel}`
+                            : undefined;
+                // Emit command completion with termination reason
+                this.daemon.logEvent(this.taskId, 'command_output', {
+                    command,
+                    type: 'end',
+                    exitCode: code,
+                    success,
+                    terminationReason,
+                });
+                this.daemon.logEvent(this.taskId, 'tool_result', {
+                    tool: 'run_command',
+                    success,
+                    exitCode: code,
+                    terminationReason,
+                    error: errorMessage,
+                });
+                resolve({
+                    success,
+                    stdout: truncatedStdout,
+                    stderr: truncatedStderr,
+                    exitCode: code,
+                    truncated: stdout.length > MAX_OUTPUT_SIZE || stderr.length > MAX_OUTPUT_SIZE,
+                    terminationReason,
+                });
+            });
+            child.on('error', (error) => {
+                clearTimeout(timeoutId);
+                this.activeProcess = null; // Clear active process reference
+                // Clear any pending escalation timeouts to prevent killing reused PIDs
+                this.clearEscalationTimeouts();
+                // Reset user kill flag
+                this.userKillRequested = false;
+                const terminationReason = 'error';
+                this.daemon.logEvent(this.taskId, 'command_output', {
+                    command,
+                    type: 'error',
+                    output: `\n[Error: ${error.message}]\n`,
+                    terminationReason,
+                });
+                this.daemon.logEvent(this.taskId, 'tool_result', {
+                    tool: 'run_command',
+                    success: false,
+                    error: error.message,
+                    terminationReason,
+                });
+                resolve({
+                    success: false,
+                    stdout: this.truncateOutput(stdout),
+                    stderr: error.message,
+                    exitCode: null,
+                    terminationReason,
+                });
+            });
+        });
+    }
+    /**
+     * Generate a normalized signature for a command to detect similar repeats
+     */
+    getCommandSignature(command) {
+        if (!command)
+            return '';
+        let signature = command.trim();
+        signature = signature.replace(/\s+/g, ' ');
+        signature = signature.replace(/"(?:[^"\\]|\\.)*"/g, '"<arg>"');
+        signature = signature.replace(/'(?:[^'\\]|\\.)*'/g, "'<arg>'");
+        signature = signature.replace(/(?:\/Users\/[^\s]+|~\/[^\s]+|\/[^\s]+)/g, '<path>');
+        return signature;
+    }
+    /**
+     * Safety check for auto-approving similar commands
+     */
+    isAutoApprovalSafe(command) {
+        return !/(^|\s)(sudo|rm|dd|mkfs|diskutil|shutdown|reboot|killall)\b/i.test(command);
+    }
+    /**
+     * Truncate output to prevent context overflow
+     */
+    truncateOutput(output) {
+        if (output.length <= MAX_OUTPUT_SIZE) {
+            return output;
+        }
+        return (output.slice(0, MAX_OUTPUT_SIZE) +
+            `\n\n[... Output truncated. Showing first ${Math.round(MAX_OUTPUT_SIZE / 1024)}KB ...]`);
+    }
+}
+exports.ShellTools = ShellTools;
+// Export validation functions for testing
+exports._testUtils = {
+    isValidPid,
+    isValidUsername,
+    isProcessOwnedByCurrentUser,
+    getDescendantPids,
+    killProcessTree,
+};