gentle-pi 3.7.0 → 4.1.0

package/lib/destructive-command-guard.ts

@@ -0,0 +1,144 @@
+// Recognizable executable forms only. This is deliberately not a shell/SQL
+// interpreter or a sandbox: no expansion, script loading or remote inspection.
+const DESTRUCTION_KIND = { DATABASE: "database", FILESYSTEM: "filesystem", GIT: "git" } as const;
+type DestructionKind = (typeof DESTRUCTION_KIND)[keyof typeof DESTRUCTION_KIND];
+export interface DestructiveCommandMatch {
+	kind: DestructionKind;
+	triggerIndex: number;
+	hardDeny: boolean;
+}
+interface Token {
+	value: string;
+	raw: string;
+	operator: boolean;
+	index: number;
+}
+const separators = new Set([";", "&&", "||", "|", "&", "\n", "(", ")"]);
+
+/** Keep quoted arguments intact so harmless prose is never treated as a command. */
+function tokenize(command: string): Token[] {
+	const tokens: Token[] = [];
+	// Literal, named heredocs are data, not executable shell segments.
+	command = command.replace(/<<-?\s*(['"]?)([A-Za-z_]\w*)\1[^\n]*\n[\s\S]*?\n\2(?=\n|$)/g, (raw) => {
+		const headerLength = raw.indexOf("\n") + 1;
+		return raw.slice(0, headerLength) + " ".repeat(raw.length - headerLength);
+	});
+	const pattern = /(?:"(?:\\.|[^"\\])*"|'[^']*'|\\.|[^\s;&|()'"\\])+|&&|\|\||[;&|()\n]/g;
+	for (const match of command.matchAll(pattern)) {
+		const raw = match[0];
+		const value = raw.replace(/"((?:\\.|[^"\\])*)"|'([^']*)'|\\(.)/g,
+			(_raw, double: string | undefined, single: string | undefined, escaped: string | undefined) => {
+				if (double !== undefined) return double.replace(/\\(["\\$`\n])/g, (_escape, char: string) => char === "\n" ? "" : char);
+				return single ?? escaped ?? "";
+			});
+		// Only raw operators are boundaries; quoted/escaped operators are words.
+		tokens.push({ value, raw, operator: separators.has(raw), index: match.index });
+	}
+	return tokens;
+}
+const executable = (value: string) => value.split("/").at(-1) ?? value;
+
+function sqlDestroys(sql: string): boolean {
+	// Mask quoted identifiers as non-keyword atoms, and remove comments and
+	// strings. A table named "where" is not a predicate or a statement boundary.
+	const code = sql.replace(/--[^\n]*|\/\*[\s\S]*?\*\/|'(?:''|[^'])*'|"(?:""|[^"])*"|`(?:``|[^`])*`|\[(?:\]\]|[^\]])*\]/g,
+		(raw) => /^["`\[]/.test(raw) ? "identifier" : " ");
+	return code.split(";").some((statement) => {
+		if (/^\s*(?:DROP\s+(?:TABLE|DATABASE|SCHEMA|INDEX|VIEW)\b|TRUNCATE\s+(?:TABLE\s+)?\S)/i.test(statement)) return true;
+		if (!/^\s*DELETE\s+FROM\s+\S/i.test(statement)) return false;
+		return !/\bWHERE\b/i.test(statement) || /\bWHERE\s+(?:1\s*=\s*1|TRUE)\s*$/i.test(statement.trim());
+	});
+}
+
+export function recognizeDestructiveCommands(command: string, depth = 0): DestructiveCommandMatch[] {
+	if (depth > 4) return [];
+	const tokens = tokenize(command);
+	const matches: DestructiveCommandMatch[] = [];
+	let previous: Token[] = [];
+	let previousSeparator = "";
+	let start = 0;
+	for (let end = 0; end <= tokens.length; end++) {
+		if (end < tokens.length && !tokens[end].operator) continue;
+		const segment = tokens.slice(start, end);
+		let cursor = 0;
+		// Assignments and familiar executable wrappers preserve command position.
+		while (cursor < segment.length) {
+			const value = segment[cursor].value;
+			if (/^[A-Za-z_][A-Za-z_0-9]*=/.test(value)) {
+				cursor++;
+				continue;
+			}
+			const name = executable(value);
+			if (!["env", "sudo", "command", "exec", "nohup", "timeout", "xargs"].includes(name)) break;
+			const valueOptions: Record<string, readonly string[]> = {
+				env: ["-u", "--unset", "-C", "--chdir"],
+				sudo: ["-u", "-g", "-h", "-p", "-C", "--user", "--group", "--host", "--prompt", "--chdir"],
+				timeout: ["-s", "--signal", "-k", "--kill-after"],
+				xargs: ["-n", "-I", "-P", "--max-args", "--replace", "--max-procs"],
+			};
+			cursor++;
+			while (cursor < segment.length && segment[cursor].value.startsWith("-")) {
+				const flag = segment[cursor++].value;
+				if (flag === "--") break;
+				if (valueOptions[name]?.includes(flag)) cursor++;
+			}
+			if (name === "timeout") cursor++;
+		}
+		const head = segment[cursor];
+		const name = executable(head?.value ?? "");
+		const args = segment.slice(cursor + 1).map((token) => token.value);
+		const add = (kind: DestructionKind, hardDeny = false) => matches.push({ kind, hardDeny, triggerIndex: head.index });
+		if (["sh", "bash", "zsh", "dash"].includes(name)) {
+			const flag = args.findIndex((arg) => /^-[a-z]*c[a-z]*$/.test(arg));
+			if (flag >= 0 && args[flag + 1]) {
+				// Nested offsets use the enclosing executable, which is stable even
+				// when quote removal changes the payload's byte positions.
+				matches.push(...recognizeDestructiveCommands(args[flag + 1], depth + 1).map((match) => ({ ...match, triggerIndex: head.index })));
+			}
+		}
+		if (["psql", "mysql", "mariadb", "sqlite3"].includes(name)) {
+			const payloads = args.map((arg) => arg.replace(/^(?:--command|--execute)=/, ""));
+			const heredoc = command.slice(head.index).match(/^[^\n]*<<-?\s*(['"]?)([A-Za-z_]\w*)\1[^\n]*\n([\s\S]*?)\n\2(?=\n|$)/);
+			if (heredoc) payloads.push(heredoc[3]);
+			if (previousSeparator === "|" && ["echo", "printf"].includes(executable(previous[0]?.value ?? ""))) {
+				payloads.push(previous.slice(1).map((token) => token.value).join(" ").replace(/^%s\s*/, ""));
+			}
+			if (payloads.some(sqlDestroys)) add(DESTRUCTION_KIND.DATABASE);
+		}
+		if (name === "rm" && args.some((arg) => /^-[^-]*[rR]/.test(arg) || arg === "--recursive")) {
+			const rootTarget = args.some((arg) => /^(?:\/(?:\*+)?$|\.{1,2}\/?$|~(?:\/|$)|\$\{?HOME\}?(?:\/|$))/.test(arg));
+			add(DESTRUCTION_KIND.FILESYSTEM, rootTarget);
+		}
+		if (name === "find") {
+			if (args.includes("-delete")) add(DESTRUCTION_KIND.FILESYSTEM);
+			for (let execIndex = 0; execIndex < args.length; execIndex++) {
+				if (!["-exec", "-execdir"].includes(args[execIndex])) continue;
+				const invocation = segment.slice(cursor + execIndex + 2);
+				const terminator = invocation.findIndex((arg) => arg.value === ";" || arg.value === "+");
+				const nested = (terminator < 0 ? invocation : invocation.slice(0, terminator)).map((arg) => arg.raw).join(" ");
+				matches.push(...recognizeDestructiveCommands(nested, depth + 1).map((match) => ({ ...match, triggerIndex: head.index })));
+				if (terminator < 0) break;
+				execIndex += terminator + 1;
+			}
+		}
+		if (name === "git") {
+			let index = 0;
+			while (args[index]?.startsWith("-")) {
+				const flag = args[index++];
+				if (["-C", "-c", "--git-dir", "--work-tree", "--namespace"].includes(flag)) index++;
+			}
+			const action = args[index];
+			const flags = args.slice(index + 1);
+			const force = flags.some((arg) => /^--force(?:-with-lease|=|$)/.test(arg) || /^-[^-]*f/.test(arg));
+			const hard = (action === "reset" && flags.includes("--hard")) || (action === "clean" && force) || (action === "push" && force);
+			const branchDelete = action === "branch" && (flags.some((arg) => /^-[^-]*D/.test(arg)) || (force && flags.some((arg) => arg === "--delete" || /^-[^-]*d/.test(arg))));
+			if (hard || branchDelete || ["reset", "clean", "restore", "rebase"].includes(action) ||
+				(action === "checkout" && (force || flags.includes("--"))) ||
+				(action === "stash" && ["drop", "clear"].includes(flags[0]))) add(DESTRUCTION_KIND.GIT, hard);
+		}
+		previous = segment;
+		previousSeparator = tokens[end]?.value ?? "";
+		start = end + 1;
+	}
+	return matches;
+}

package/lib/gentle-ai-binary.ts

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { existsSync, lstatSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { dirname, isAbsolute, join, posix, relative, resolve, win32 } from "node:path";
 import {
 	GENTLE_AI_INSTALL_METHOD,
 	GENTLE_AI_WINDOWS_SOURCE_MODULE,
@@ -13,6 +13,8 @@ import {
 	isWindowsGoSumdbSourceTarget,
 	resolveGentleAiReleaseAsset,
 } from "../scripts/gentle-ai-installer.mjs";
+import { engramPinVersion } from "../scripts/installer-downloads.mjs";
+import { bundledGentlePiConfigHome, bundledPiConfigDir, bundledPiConfigParent, runningBundledPrefix } from "./gentle-shell-bundled.ts";
 import { fileURLToPath } from "node:url";
 
 export const GENTLE_AI_BINARY_MISSING_CODE = "package-local-binary-missing";
@@ -45,6 +47,84 @@ export function gentleAiBinaryPath(
 	);
 }
 
+// ---------------------------------------------------------------------------
+// Bundled isolation (S9). The bundled launcher (bin/gentle-shell.mjs) gives Pi
+// and setup GENTLE_SHELL_PREFIX, its prefix. Every gentle-ai run a bundled
+// gentle-pi starts gets Gentle AI's own variables (gentle-ai #5462): its state,
+// backups and telemetry under <prefix>/gentle-ai, the gentle-pi config folder
+// <prefix>/config/gentle-ai for its persona and background subagent files
+// (and, for Gentle AI 4.0.0, GENTLE_PI_CONFIG_HOME=<prefix>/config), the pinned
+// Engram in runtime/ with no Engram acquisition or dependency probe, and no
+// self-update. They are never put in Pi's own environment: the agent's shell
+// inherits it, and a gentle-ai the user runs there stays the user's. A
+// gentle-ai release without #5462 ignores them.
+// ---------------------------------------------------------------------------
+
+export interface BundledGentleAiPaths {
+	/** GENTLE_AI_HOME. */
+	home: string;
+	/** GENTLE_PI_CONFIG_HOME for Gentle AI only: the parent Gentle AI 4.0.0 appends gentle-ai to. */
+	piConfigParent: string;
+	/** GENTLE_AI_PI_CONFIG_DIR: gentle-pi's own bundled config home, <piConfigParent>/gentle-ai. */
+	piConfig: string;
+	/** The Engram scripts/bundled-install.mjs publishes (prefixLayout's `engram`). */
+	engram: string;
+}
+
+export function bundledGentleAiPaths(prefix: string, platform: string = process.platform): BundledGentleAiPaths {
+	const path = platform === "win32" ? win32 : posix;
+	return {
+		home: path.join(prefix, "gentle-ai"),
+		piConfigParent: bundledPiConfigParent(prefix, platform),
+		piConfig: bundledPiConfigDir(prefix, platform),
+		engram: path.join(prefix, "runtime", `engram-${engramPinVersion}`, platform === "win32" ? "engram.exe" : "engram"),
+	};
+}
+
+/**
+ * `env` plus GENTLE_AI_HOME, GENTLE_AI_PI_CONFIG_DIR, GENTLE_AI_ENGRAM_BIN
+ * (only when the pinned Engram is published), GENTLE_AI_NO_SELF_UPDATE=1 and
+ * GENTLE_PI_CONFIG_HOME (the parent of GENTLE_AI_PI_CONFIG_DIR)
+ * when this gentle-pi runs from the valid bundled install GENTLE_SHELL_PREFIX
+ * names (runningBundledPrefix). Otherwise `env` itself, unchanged: a gentle-pi
+ * installed elsewhere (the user's own, started from the agent's shell, which
+ * inherits the variable) keeps its own Gentle AI.
+ */
+export function gentleAiIsolationEnv(
+	env: NodeJS.ProcessEnv,
+	options: { packageRoot?: string; platform?: string } = {},
+): NodeJS.ProcessEnv {
+	const platform = options.platform ?? process.platform;
+	const prefix = runningBundledPrefix(env, { packageRoot: options.packageRoot, platform });
+	if (prefix === undefined) return env;
+	const paths = bundledGentleAiPaths(prefix, platform);
+	let engram = false;
+	try {
+		engram = lstatSync(paths.engram).isFile();
+	} catch {
+		// Not published (a prefix from before Engram shipped): Gentle AI gets none.
+	}
+	// Gentle AI 4.0.0 ignores GENTLE_AI_ENGRAM_BIN and looks `engram` up on PATH
+	// first, then falls back to Homebrew (`brew tap`, #2105): the pinned one goes first.
+	const pathKey = Object.keys(env).find((name) => name.toUpperCase() === "PATH") ?? (platform === "win32" ? "Path" : "PATH");
+	const pathModule = platform === "win32" ? win32 : posix;
+	const path = engram
+		? { [pathKey]: [pathModule.dirname(paths.engram), ...(env[pathKey] ?? "").split(pathModule.delimiter).filter((entry) => entry.length > 0)].join(pathModule.delimiter) }
+		: {};
+	return {
+		...env,
+		...path,
+		GENTLE_AI_HOME: paths.home,
+		GENTLE_AI_PI_CONFIG_DIR: paths.piConfig,
+		...(engram ? { GENTLE_AI_ENGRAM_BIN: paths.engram } : {}),
+		GENTLE_AI_NO_SELF_UPDATE: "1",
+		// Gentle AI 4.0.0 knows no GENTLE_AI_PI_CONFIG_DIR: it writes gentle-pi's
+		// background-subagents policy to <GENTLE_PI_CONFIG_HOME>/gentle-ai, the same
+		// folder. Only these Gentle AI processes get it, never Pi or its shell.
+		GENTLE_PI_CONFIG_HOME: paths.piConfigParent,
+	};
+}
+
 function sha256(value: Buffer): string {
 	return createHash("sha256").update(value).digest("hex");
 }
@@ -55,7 +135,8 @@ function sha256(value: Buffer): string {
 // Two explicit activation paths, in precedence order:
 //   1. GENTLE_PI_GENTLE_AI_DEV_BINARY (session override, absolute path), then
 //   2. the persistent registration file at
-//      <GENTLE_PI_CONFIG_HOME|~/.pi/gentle-ai>/dev-binary.json with the strict
+//      <config home>/dev-binary.json (a bundled prefix's gentle-pi, else
+//      GENTLE_PI_CONFIG_HOME, else ~/.pi/gentle-ai) with the strict
 //      shape {"schema":"gentle-pi.dev-binary/v1","path":"<absolute path>"}.
 //
 // The registration deliberately pins no digest: it is the unpinned field-test
@@ -113,7 +194,7 @@ function ambientDevBinaryEnvironment(): GentleAiDevBinaryEnvironment {
 }
 
 export function gentleAiDevBinaryRegistrationPath(environment: GentleAiDevBinaryEnvironment = ambientDevBinaryEnvironment()): string {
-	const configHome = environment.env.GENTLE_PI_CONFIG_HOME ?? join(environment.home, ".pi", "gentle-ai");
+	const configHome = bundledGentlePiConfigHome(environment.env) ?? environment.env.GENTLE_PI_CONFIG_HOME ?? join(environment.home, ".pi", "gentle-ai");
 	return join(configHome, "dev-binary.json");
 }
 
@@ -268,6 +349,30 @@ function sameFile(before: ReturnType<typeof lstatSync>, after: ReturnType<typeof
 	return before.dev === after.dev && before.ino === after.ino && before.size === after.size && before.mtimeMs === after.mtimeMs;
 }
 
+// Reading and hashing the whole binary on every native call is expensive, and
+// on Windows antivirus scans each read. The digest is reused only while the
+// file keeps its full identity; any rewrite changes ctime, which callers cannot
+// set, so a replaced binary is always hashed again. Keyed per reader so an
+// injected reader never sees another reader's digest.
+const binaryDigestCache = new WeakMap<(path: string) => Buffer, Map<string, { readonly identity: string; readonly sha256: string }>>();
+
+function binaryIdentity(path: string): string {
+	const details = lstatSync(path, { bigint: true });
+	return [details.dev, details.ino, details.size, details.mtimeNs, details.ctimeNs].join(":");
+}
+
+function binaryDigest(path: string, readBinary: (path: string) => Buffer): string {
+	let entries = binaryDigestCache.get(readBinary);
+	if (entries === undefined) binaryDigestCache.set(readBinary, entries = new Map());
+	const identity = binaryIdentity(path);
+	const cached = entries.get(path);
+	if (cached?.identity === identity) return cached.sha256;
+	const digest = sha256(readBinary(path));
+	if (binaryIdentity(path) === identity) entries.set(path, { identity, sha256: digest });
+	else entries.delete(path);
+	return digest;
+}
+
 export function resolveGentleAiBinary(
 	packageRoot = dirname(dirname(fileURLToPath(import.meta.url))),
 	platform = process.platform,
@@ -296,7 +401,7 @@ export function resolveGentleAiBinary(
 		const beforeManifest = lstatSync(manifestPath);
 		const manifestContents = readFileSync(manifestPath, "utf8");
 		const manifest = JSON.parse(manifestContents) as Record<string, unknown>;
-		const binarySha256 = sha256(readBinary(binaryPath));
+		const binarySha256 = binaryDigest(binaryPath, readBinary);
 		const expected = expectedRuntimeManifest(platform, binarySha256, manifest);
 		if (!isCanonicalManifest(manifestContents, manifest, expected)) throw new Error("invalid runtime integrity manifest");
 		const afterBinary = lstatSync(binaryPath);

package/lib/gentle-ai-elapsed-store.ts

@@ -0,0 +1,87 @@
+export const GENTLE_AI_TIMING_ENTRY = "gentle-ai-elapsed-timing/v1";
+
+export interface GentleAiTimingRecord {
+	toolCallId: string;
+	startedAt: number;
+	endedAt?: number;
+}
+
+/** What the renderer consumes: a read-only lookup keyed by pi's stable toolCallId. */
+export interface GentleAiTimingLookup {
+	lookup(toolCallId: string): GentleAiTimingRecord | undefined;
+}
+
+export interface GentleAiTimingEntry {
+	type: string;
+	customType?: string;
+	data?: unknown;
+}
+
+export interface GentleAiTimingSessionReader {
+	getEntries(): readonly GentleAiTimingEntry[];
+}
+
+export interface GentleAiTimingAppendHost {
+	appendEntry(type: string, data?: unknown): void;
+}
+
+export function parseGentleAiTimingData(data: unknown): GentleAiTimingRecord | undefined {
+	if (!data || typeof data !== "object" || Array.isArray(data)) return undefined;
+	const record = data as { toolCallId?: unknown; startedAt?: unknown; endedAt?: unknown };
+	if (typeof record.toolCallId !== "string" || record.toolCallId.length === 0) return undefined;
+	if (typeof record.startedAt !== "number" || !Number.isFinite(record.startedAt)) return undefined;
+	// Local capture + a plain typeof guard: under non-strict null checks a
+	// `x === undefined` condition leaves `unknown` unnarrowed, so the finite-
+	// number branch must be decided by typeof before the value is used.
+	const endedAt = record.endedAt;
+	if (endedAt !== undefined) {
+		if (typeof endedAt !== "number" || !Number.isFinite(endedAt)) return undefined;
+		return { toolCallId: record.toolCallId, startedAt: record.startedAt, endedAt };
+	}
+	return { toolCallId: record.toolCallId, startedAt: record.startedAt };
+}
+
+/** Replay: entries are append-only, so the last timing entry per toolCallId wins. */
+export function readGentleAiTimings(entries: readonly GentleAiTimingEntry[]): Map<string, GentleAiTimingRecord> {
+	const timings = new Map<string, GentleAiTimingRecord>();
+	for (const entry of entries) {
+		if (entry.type !== "custom" || entry.customType !== GENTLE_AI_TIMING_ENTRY) continue;
+		const record = parseGentleAiTimingData(entry.data);
+		if (record) timings.set(record.toolCallId, record);
+	}
+	return timings;
+}
+
+// No global store: the owning extension binds its own Pi API, and reading all
+// entries also catches a launch that happened while the shell was absent.
+export class GentleAiElapsedTimingLedger implements GentleAiTimingLookup {
+	private readonly recorded = new Set<string>();
+	private readonly session: GentleAiTimingSessionReader;
+	private readonly host?: GentleAiTimingAppendHost;
+
+	constructor(session: GentleAiTimingSessionReader, host?: GentleAiTimingAppendHost) {
+		this.session = session;
+		this.host = host;
+	}
+
+	lookup(toolCallId: string): GentleAiTimingRecord | undefined {
+		return readGentleAiTimings(this.session.getEntries()).get(toolCallId);
+	}
+
+	recordStart(toolCallId: string, startedAt: number): void {
+		this.append(`${toolCallId}:start`, { toolCallId, startedAt });
+	}
+
+	recordEnd(toolCallId: string, endedAt: number): void {
+		const startedAt = this.lookup(toolCallId)?.startedAt;
+		// A terminal without a durable start has no honest duration to freeze.
+		if (startedAt === undefined) return;
+		this.append(`${toolCallId}:end`, { toolCallId, startedAt, endedAt });
+	}
+
+	private append(stage: string, data: GentleAiTimingRecord): void {
+		if (this.recorded.has(stage)) return;
+		this.host?.appendEntry(GENTLE_AI_TIMING_ENTRY, data);
+		this.recorded.add(stage);
+	}
+}