gentle-pi 4.0.0 → 4.2.0

package/lib/destructive-command-guard.ts

@@ -15,14 +15,18 @@ interface Token {
 }
 const separators = new Set([";", "&&", "||", "|", "&", "\n", "(", ")"]);
 
-/** Keep quoted arguments intact so harmless prose is never treated as a command. */
-function tokenize(command: string): Token[] {
-	const tokens: Token[] = [];
-	// Literal, named heredocs are data, not executable shell segments.
-	command = command.replace(/<<-?\s*(['"]?)([A-Za-z_]\w*)\1[^\n]*\n[\s\S]*?\n\2(?=\n|$)/g, (raw) => {
+/** Literal, named heredocs are data, not executable shell segments; offsets are preserved. */
+function blankHeredocs(command: string): string {
+	return command.replace(/<<-?\s*(['"]?)([A-Za-z_]\w*)\1[^\n]*\n[\s\S]*?\n\2(?=\n|$)/g, (raw) => {
 		const headerLength = raw.indexOf("\n") + 1;
 		return raw.slice(0, headerLength) + " ".repeat(raw.length - headerLength);
 	});
+}
+
+/** Keep quoted arguments intact so harmless prose is never treated as a command. */
+function tokenize(command: string, blank = true): Token[] {
+	const tokens: Token[] = [];
+	if (blank) command = blankHeredocs(command);
 	const pattern = /(?:"(?:\\.|[^"\\])*"|'[^']*'|\\.|[^\s;&|()'"\\])+|&&|\|\||[;&|()\n]/g;
 	for (const match of command.matchAll(pattern)) {
 		const raw = match[0];
@@ -38,6 +42,100 @@ function tokenize(command: string): Token[] {
 }
 const executable = (value: string) => value.split("/").at(-1) ?? value;
 
+const WRAPPER_VALUE_OPTIONS: Record<string, readonly string[]> = {
+	env: ["-u", "--unset", "-C", "--chdir"],
+	sudo: ["-u", "-g", "-h", "-p", "-C", "--user", "--group", "--host", "--prompt", "--chdir"],
+	timeout: ["-s", "--signal", "-k", "--kill-after"],
+	xargs: ["-n", "-I", "-P", "--max-args", "--replace", "--max-procs"],
+};
+const WRAPPERS = ["env", "sudo", "command", "exec", "nohup", "timeout", "xargs"];
+
+/** Index of the executable token after assignments and familiar wrappers. */
+function headCursor(segment: readonly Token[]): number {
+	let cursor = 0;
+	while (cursor < segment.length) {
+		const value = segment[cursor].value;
+		if (/^[A-Za-z_][A-Za-z_0-9]*=/.test(value)) {
+			cursor++;
+			continue;
+		}
+		const name = executable(value);
+		if (!WRAPPERS.includes(name)) break;
+		cursor++;
+		while (cursor < segment.length && segment[cursor].value.startsWith("-")) {
+			const flag = segment[cursor++].value;
+			if (flag === "--") break;
+			if (WRAPPER_VALUE_OPTIONS[name]?.includes(flag)) cursor++;
+		}
+		if (name === "timeout") cursor++;
+	}
+	return cursor;
+}
+
+// gentle-shell#2174: commands whose arguments are searched, printed or viewed
+// text, never executed and never fed to an executor. `sed` is absent on
+// purpose: GNU sed executes scripts through `e` with any delimiter or address.
+// The exemption applies only when EVERY segment head is in DATA_COMMANDS or
+// INERT_COMMANDS, so an unknown consumer (`| at now`, `&& ./x.sh`) keeps the
+// lexical guard: a missing entry costs a dialog, never a bypass.
+const DATA_COMMANDS = new Set([
+	"grep", "egrep", "fgrep", "rg", "ag", "ack", "echo", "printf", "cat", "head", "tail", "less", "more",
+	"wc", "sort", "uniq", "cut", "tr", "jq", "diff", "ls", "file", "stat",
+]);
+const INERT_COMMANDS = new Set(["cd", "pwd", "true", "false", "test", "[", "mkdir", "touch"]);
+const HEREDOC_RE = /<<-?\s*(['"]?)([A-Za-z_]\w*)\1[^\n]*\n[\s\S]*?\n\2(?=\n|$)/g;
+
+/**
+ * Byte ranges of the command that are plain arguments of a known data command
+ * (gentle-shell#2174). A guarded or denied pattern matching only inside these
+ * ranges is prose, not an operation. Returns no ranges, keeping every lexical
+ * match, when the command is opaque: command or process substitution, an
+ * interpreter or remote shell anywhere, or quoting the tokenizer cannot
+ * account for.
+ */
+export function dataArgumentRanges(command: string): Array<readonly [number, number]> {
+	if (/\$\(|`|[<>]\(/.test(command)) return [];
+	// A heredoc counts only when its `<<` starts an unquoted token of the raw
+	// command; quoted text such as `echo '<<x'` must not blank following lines.
+	const rawStarts = new Set(tokenize(command, false).filter((token) => token.raw.startsWith("<<")).map((token) => token.index));
+	const heredocs = [...command.matchAll(HEREDOC_RE)];
+	if (heredocs.some((heredoc) => !rawStarts.has(heredoc.index))) return [];
+	const blanked = blankHeredocs(command);
+	const tokens = tokenize(command);
+	const covered = new Uint8Array(blanked.length);
+	for (const token of tokens) covered.fill(1, token.index, token.index + token.raw.length);
+	for (let index = 0; index < blanked.length; index++) {
+		if (!covered[index] && !/\s/.test(blanked[index])) return [];
+	}
+	const ranges: Array<readonly [number, number]> = [];
+	let start = 0;
+	for (let end = 0; end <= tokens.length; end++) {
+		if (end < tokens.length && !tokens[end].operator) continue;
+		const segment = tokens.slice(start, end);
+		start = end + 1;
+		if (segment.length === 0) continue;
+		// Only plain assignments, optionally after a flagless `env`, may precede
+		// the head; every other wrapper or wrapper flag can change what runs.
+		let cursor = 0;
+		if (segment[0].value === "env") cursor++;
+		while (cursor < segment.length && /^[A-Za-z_][A-Za-z_0-9]*=/.test(segment[cursor].value)) cursor++;
+		const head = segment[cursor];
+		if (head === undefined || head.value !== head.raw) return [];
+		const name = head.value;
+		if (INERT_COMMANDS.has(name)) continue;
+		if (!DATA_COMMANDS.has(name)) return [];
+		ranges.push([head.index + head.raw.length, tokens[end]?.index ?? command.length]);
+	}
+	// A heredoc body belongs to the segment of its `<<` header, which the
+	// header's trailing newline would otherwise split off. Only the body is
+	// covered: the rest of the header line can hold further commands.
+	for (const heredoc of heredocs) {
+		const bodyStart = heredoc.index + heredoc[0].indexOf("\n") + 1;
+		if (ranges.some(([from, to]) => heredoc.index >= from && heredoc.index < to)) ranges.push([bodyStart, heredoc.index + heredoc[0].length]);
+	}
+	return ranges;
+}
+
 function sqlDestroys(sql: string): boolean {
 	// Mask quoted identifiers as non-keyword atoms, and remove comments and
 	// strings. A table named "where" is not a predicate or a statement boundary.
@@ -60,30 +158,8 @@ export function recognizeDestructiveCommands(command: string, depth = 0): Destru
 	for (let end = 0; end <= tokens.length; end++) {
 		if (end < tokens.length && !tokens[end].operator) continue;
 		const segment = tokens.slice(start, end);
-		let cursor = 0;
 		// Assignments and familiar executable wrappers preserve command position.
-		while (cursor < segment.length) {
-			const value = segment[cursor].value;
-			if (/^[A-Za-z_][A-Za-z_0-9]*=/.test(value)) {
-				cursor++;
-				continue;
-			}
-			const name = executable(value);
-			if (!["env", "sudo", "command", "exec", "nohup", "timeout", "xargs"].includes(name)) break;
-			const valueOptions: Record<string, readonly string[]> = {
-				env: ["-u", "--unset", "-C", "--chdir"],
-				sudo: ["-u", "-g", "-h", "-p", "-C", "--user", "--group", "--host", "--prompt", "--chdir"],
-				timeout: ["-s", "--signal", "-k", "--kill-after"],
-				xargs: ["-n", "-I", "-P", "--max-args", "--replace", "--max-procs"],
-			};
-			cursor++;
-			while (cursor < segment.length && segment[cursor].value.startsWith("-")) {
-				const flag = segment[cursor++].value;
-				if (flag === "--") break;
-				if (valueOptions[name]?.includes(flag)) cursor++;
-			}
-			if (name === "timeout") cursor++;
-		}
+		const cursor = headCursor(segment);
 		const head = segment[cursor];
 		const name = executable(head?.value ?? "");
 		const args = segment.slice(cursor + 1).map((token) => token.value);

package/lib/gentle-ai-binary.ts

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { existsSync, lstatSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { dirname, isAbsolute, join, posix, relative, resolve, win32 } from "node:path";
 import {
 	GENTLE_AI_INSTALL_METHOD,
 	GENTLE_AI_WINDOWS_SOURCE_MODULE,
@@ -13,6 +13,8 @@ import {
 	isWindowsGoSumdbSourceTarget,
 	resolveGentleAiReleaseAsset,
 } from "../scripts/gentle-ai-installer.mjs";
+import { engramPinVersion } from "../scripts/installer-downloads.mjs";
+import { bundledGentlePiConfigHome, bundledPiConfigDir, bundledPiConfigParent, runningBundledPrefix } from "./gentle-shell-bundled.ts";
 import { fileURLToPath } from "node:url";
 
 export const GENTLE_AI_BINARY_MISSING_CODE = "package-local-binary-missing";
@@ -45,6 +47,84 @@ export function gentleAiBinaryPath(
 	);
 }
 
+// ---------------------------------------------------------------------------
+// Bundled isolation (S9). The bundled launcher (bin/gentle-shell.mjs) gives Pi
+// and setup GENTLE_SHELL_PREFIX, its prefix. Every gentle-ai run a bundled
+// gentle-pi starts gets Gentle AI's own variables (gentle-ai #5462): its state,
+// backups and telemetry under <prefix>/gentle-ai, the gentle-pi config folder
+// <prefix>/config/gentle-ai for its persona and background subagent files
+// (and, for Gentle AI 4.0.0, GENTLE_PI_CONFIG_HOME=<prefix>/config), the pinned
+// Engram in runtime/ with no Engram acquisition or dependency probe, and no
+// self-update. They are never put in Pi's own environment: the agent's shell
+// inherits it, and a gentle-ai the user runs there stays the user's. A
+// gentle-ai release without #5462 ignores them.
+// ---------------------------------------------------------------------------
+
+export interface BundledGentleAiPaths {
+	/** GENTLE_AI_HOME. */
+	home: string;
+	/** GENTLE_PI_CONFIG_HOME for Gentle AI only: the parent Gentle AI 4.0.0 appends gentle-ai to. */
+	piConfigParent: string;
+	/** GENTLE_AI_PI_CONFIG_DIR: gentle-pi's own bundled config home, <piConfigParent>/gentle-ai. */
+	piConfig: string;
+	/** The Engram scripts/bundled-install.mjs publishes (prefixLayout's `engram`). */
+	engram: string;
+}
+
+export function bundledGentleAiPaths(prefix: string, platform: string = process.platform): BundledGentleAiPaths {
+	const path = platform === "win32" ? win32 : posix;
+	return {
+		home: path.join(prefix, "gentle-ai"),
+		piConfigParent: bundledPiConfigParent(prefix, platform),
+		piConfig: bundledPiConfigDir(prefix, platform),
+		engram: path.join(prefix, "runtime", `engram-${engramPinVersion}`, platform === "win32" ? "engram.exe" : "engram"),
+	};
+}
+
+/**
+ * `env` plus GENTLE_AI_HOME, GENTLE_AI_PI_CONFIG_DIR, GENTLE_AI_ENGRAM_BIN
+ * (only when the pinned Engram is published), GENTLE_AI_NO_SELF_UPDATE=1 and
+ * GENTLE_PI_CONFIG_HOME (the parent of GENTLE_AI_PI_CONFIG_DIR)
+ * when this gentle-pi runs from the valid bundled install GENTLE_SHELL_PREFIX
+ * names (runningBundledPrefix). Otherwise `env` itself, unchanged: a gentle-pi
+ * installed elsewhere (the user's own, started from the agent's shell, which
+ * inherits the variable) keeps its own Gentle AI.
+ */
+export function gentleAiIsolationEnv(
+	env: NodeJS.ProcessEnv,
+	options: { packageRoot?: string; platform?: string } = {},
+): NodeJS.ProcessEnv {
+	const platform = options.platform ?? process.platform;
+	const prefix = runningBundledPrefix(env, { packageRoot: options.packageRoot, platform });
+	if (prefix === undefined) return env;
+	const paths = bundledGentleAiPaths(prefix, platform);
+	let engram = false;
+	try {
+		engram = lstatSync(paths.engram).isFile();
+	} catch {
+		// Not published (a prefix from before Engram shipped): Gentle AI gets none.
+	}
+	// Gentle AI 4.0.0 ignores GENTLE_AI_ENGRAM_BIN and looks `engram` up on PATH
+	// first, then falls back to Homebrew (`brew tap`, #2105): the pinned one goes first.
+	const pathKey = Object.keys(env).find((name) => name.toUpperCase() === "PATH") ?? (platform === "win32" ? "Path" : "PATH");
+	const pathModule = platform === "win32" ? win32 : posix;
+	const path = engram
+		? { [pathKey]: [pathModule.dirname(paths.engram), ...(env[pathKey] ?? "").split(pathModule.delimiter).filter((entry) => entry.length > 0)].join(pathModule.delimiter) }
+		: {};
+	return {
+		...env,
+		...path,
+		GENTLE_AI_HOME: paths.home,
+		GENTLE_AI_PI_CONFIG_DIR: paths.piConfig,
+		...(engram ? { GENTLE_AI_ENGRAM_BIN: paths.engram } : {}),
+		GENTLE_AI_NO_SELF_UPDATE: "1",
+		// Gentle AI 4.0.0 knows no GENTLE_AI_PI_CONFIG_DIR: it writes gentle-pi's
+		// background-subagents policy to <GENTLE_PI_CONFIG_HOME>/gentle-ai, the same
+		// folder. Only these Gentle AI processes get it, never Pi or its shell.
+		GENTLE_PI_CONFIG_HOME: paths.piConfigParent,
+	};
+}
+
 function sha256(value: Buffer): string {
 	return createHash("sha256").update(value).digest("hex");
 }
@@ -55,7 +135,8 @@ function sha256(value: Buffer): string {
 // Two explicit activation paths, in precedence order:
 //   1. GENTLE_PI_GENTLE_AI_DEV_BINARY (session override, absolute path), then
 //   2. the persistent registration file at
-//      <GENTLE_PI_CONFIG_HOME|~/.pi/gentle-ai>/dev-binary.json with the strict
+//      <config home>/dev-binary.json (a bundled prefix's gentle-pi, else
+//      GENTLE_PI_CONFIG_HOME, else ~/.pi/gentle-ai) with the strict
 //      shape {"schema":"gentle-pi.dev-binary/v1","path":"<absolute path>"}.
 //
 // The registration deliberately pins no digest: it is the unpinned field-test
@@ -113,7 +194,7 @@ function ambientDevBinaryEnvironment(): GentleAiDevBinaryEnvironment {
 }
 
 export function gentleAiDevBinaryRegistrationPath(environment: GentleAiDevBinaryEnvironment = ambientDevBinaryEnvironment()): string {
-	const configHome = environment.env.GENTLE_PI_CONFIG_HOME ?? join(environment.home, ".pi", "gentle-ai");
+	const configHome = bundledGentlePiConfigHome(environment.env) ?? environment.env.GENTLE_PI_CONFIG_HOME ?? join(environment.home, ".pi", "gentle-ai");
 	return join(configHome, "dev-binary.json");
 }
 
@@ -268,6 +349,30 @@ function sameFile(before: ReturnType<typeof lstatSync>, after: ReturnType<typeof
 	return before.dev === after.dev && before.ino === after.ino && before.size === after.size && before.mtimeMs === after.mtimeMs;
 }
 
+// Reading and hashing the whole binary on every native call is expensive, and
+// on Windows antivirus scans each read. The digest is reused only while the
+// file keeps its full identity; any rewrite changes ctime, which callers cannot
+// set, so a replaced binary is always hashed again. Keyed per reader so an
+// injected reader never sees another reader's digest.
+const binaryDigestCache = new WeakMap<(path: string) => Buffer, Map<string, { readonly identity: string; readonly sha256: string }>>();
+
+function binaryIdentity(path: string): string {
+	const details = lstatSync(path, { bigint: true });
+	return [details.dev, details.ino, details.size, details.mtimeNs, details.ctimeNs].join(":");
+}
+
+function binaryDigest(path: string, readBinary: (path: string) => Buffer): string {
+	let entries = binaryDigestCache.get(readBinary);
+	if (entries === undefined) binaryDigestCache.set(readBinary, entries = new Map());
+	const identity = binaryIdentity(path);
+	const cached = entries.get(path);
+	if (cached?.identity === identity) return cached.sha256;
+	const digest = sha256(readBinary(path));
+	if (binaryIdentity(path) === identity) entries.set(path, { identity, sha256: digest });
+	else entries.delete(path);
+	return digest;
+}
+
 export function resolveGentleAiBinary(
 	packageRoot = dirname(dirname(fileURLToPath(import.meta.url))),
 	platform = process.platform,
@@ -296,7 +401,7 @@ export function resolveGentleAiBinary(
 		const beforeManifest = lstatSync(manifestPath);
 		const manifestContents = readFileSync(manifestPath, "utf8");
 		const manifest = JSON.parse(manifestContents) as Record<string, unknown>;
-		const binarySha256 = sha256(readBinary(binaryPath));
+		const binarySha256 = binaryDigest(binaryPath, readBinary);
 		const expected = expectedRuntimeManifest(platform, binarySha256, manifest);
 		if (!isCanonicalManifest(manifestContents, manifest, expected)) throw new Error("invalid runtime integrity manifest");
 		const afterBinary = lstatSync(binaryPath);