killeros 2.0.20 → 2.0.22

package/killeros/hooks.ts

@@ -197,16 +197,27 @@ function appendBounded(output: HookOutputBuffer, chunk: Buffer | string): void {
   output.text += output.decoder.write(captured);
 }
 
+/** Terminates a Windows hook tree without depending on the caller's PATH. */
+function terminateWindowsHookTree(child: HookChildProcess): Promise<boolean> {
+  return new Promise((resolve) => {
+    try {
+      const taskkill = process.env.SystemRoot
+        ? path.join(process.env.SystemRoot, "System32", "taskkill.exe")
+        : "taskkill";
+      const killer = spawn(taskkill, ["/pid", String(child.pid), "/T", "/F"], {
+        shell: false,
+        stdio: "ignore",
+        windowsHide: true,
+      });
+      killer.once("error", () => resolve(false));
+      killer.once("close", (code) => resolve(code === 0));
+    } catch {
+      resolve(false);
+    }
+  });
+}
+
 function terminateHookProcess(child: HookChildProcess, force: boolean): void {
-  if (process.platform === "win32" && force && child.pid) {
-    const killer = spawn("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
-      shell: false,
-      stdio: "ignore",
-      windowsHide: true,
-    });
-    killer.unref();
-    return;
-  }
   if (process.platform !== "win32" && child.pid) {
     try {
       process.kill(-child.pid, force ? "SIGKILL" : "SIGTERM");
@@ -282,6 +293,7 @@ export function executeHook(
     let timer: NodeJS.Timeout | undefined;
     let forceTimer: NodeJS.Timeout | undefined;
     let settleTimer: NodeJS.Timeout | undefined;
+    let windowsCleanupPending = false;
     const finish = (code: number, exitUnconfirmed = false): void => {
       if (completed) return;
       completed = true;
@@ -304,6 +316,21 @@ export function executeHook(
     const beginTermination = (reason: "timeout" | "cancelled"): void => {
       if (completed || termination) return;
       termination = reason;
+      if (process.platform === "win32" && child.pid) {
+        windowsCleanupPending = true;
+        void terminateWindowsHookTree(child).then((confirmed) => {
+          if (completed) return;
+          if (!confirmed) terminateHookProcess(child, true);
+          finish(terminationCode(), !confirmed);
+          windowsCleanupPending = false;
+        });
+        settleTimer = setTimeout(() => {
+          terminateHookProcess(child, true);
+          finish(terminationCode(), true);
+          windowsCleanupPending = false;
+        }, 2_000);
+        return;
+      }
       terminateHookProcess(child, false);
       forceTimer = setTimeout(() => {
         if (completed) return;
@@ -318,9 +345,11 @@ export function executeHook(
     child.stderr.on("data", (chunk) => appendBounded(stderr, chunk));
     child.on("error", (error) => {
       appendBounded(stderr, error.message);
-      finish(termination ? terminationCode() : 1);
+      if (!windowsCleanupPending) finish(termination ? terminationCode() : 1);
+    });
+    child.once("close", (code) => {
+      if (!windowsCleanupPending) finish(termination ? terminationCode() : code ?? 1);
     });
-    child.once("close", (code) => finish(termination ? terminationCode() : code ?? 1));
     timer = setTimeout(() => beginTermination("timeout"), Math.max(1, Math.min(timeoutMs, HOOK_TIMEOUT_MAX_MS)));
   });
 }

package/killeros/init-evidence.ts

@@ -2,6 +2,7 @@ import { spawn } from "node:child_process";
 import { promises as fs } from "node:fs";
 import path from "node:path";
 import { StringDecoder } from "node:string_decoder";
+import { containsLikelySecret } from "./secret-detector.ts";
 
 export const INIT_READ_TOOL = "killeros_init_read";
 export const INIT_LIST_TOOL = "killeros_init_list";
@@ -19,7 +20,7 @@ const EXCLUDED_GUIDANCE = new Set([
   ".cursorrules", "agents.md", "agents.local.md", "claude.md", "claude.local.md", "copilot-instructions.md", "gemini.md", "memory.md", "skill.md",
 ]);
 const ROOT_EVIDENCE = [
-  "README.md", "README.rst", "README.txt", "CONTRIBUTING.md", "package.json", "pyproject.toml", "requirements.txt", "Cargo.toml", "go.mod", "Makefile", "Dockerfile", "compose.yaml", "compose.yml", "config.yaml", "config.yml", "tsconfig.json", "vite.config.ts", "vite.config.js", "eslint.config.js", "eslint.config.mjs",
+  "README.md", "README.rst", "README.txt", "CONTRIBUTING.md", "package.json", "pyproject.toml", "requirements.txt", "Cargo.toml", "go.mod", "Makefile", "Dockerfile", "compose.yaml", "compose.yml", "tsconfig.json", "vite.config.ts", "vite.config.js", "eslint.config.js", "eslint.config.mjs",
 ] as const;
 const NESTED_EVIDENCE = new Set(["package.json", "pyproject.toml", "requirements.txt", "Cargo.toml", "go.mod"]);
 
@@ -43,6 +44,10 @@ function sensitiveEvidencePath(relativePath: string): boolean {
   const name = path.posix.basename(normalized);
   return /^\.env(?:\.|$)/u.test(name)
     || [".npmrc", ".pypirc", ".netrc", "id_rsa", "id_ed25519", "credentials.json"].includes(name)
+    || /(?:^|\/)\.aws\/credentials$/u.test(normalized)
+    || /(?:^|\/)\.docker\/config\.json$/u.test(normalized)
+    || /(?:^|\/)\.kube\/config$/u.test(normalized)
+    || /(?:credential|secret|token)/u.test(name)
     || /^service-account.*\.json$/u.test(name)
     || /\.(?:pem|key|p12|pfx|jks|keystore)$/u.test(name);
 }
@@ -200,6 +205,13 @@ async function validateAndRead(projectRoot: string, absolutePath: string, limit:
   }
 }
 
+/** Reads evidence only when its bounded content does not resemble a credential. */
+async function readEvidenceFile(projectRoot: string, absolutePath: string, limit: number): Promise<{ content: string; truncated: boolean }> {
+  const result = await validateAndRead(projectRoot, absolutePath, limit);
+  if (containsLikelySecret(result.content)) throw new Error("file is not available to /init");
+  return result;
+}
+
 function normalizeRequestedPath(requestedPath: string): string {
   if (!requestedPath || requestedPath.trim() !== requestedPath || requestedPath.startsWith("~")
     || /^file:/iu.test(requestedPath) || path.isAbsolute(requestedPath)) {
@@ -237,7 +249,7 @@ export async function buildInitEvidence(projectRoot: string): Promise<InitEviden
     const relativePath = canonicalPaths.get(evidenceKey(requested));
     if (!relativePath || Buffer.byteLength(snapshot, "utf8") >= SNAPSHOT_LIMIT) continue;
     try {
-      const result = await validateAndRead(projectRoot, path.join(projectRoot, relativePath), AUTOMATIC_FILE_LIMIT);
+      const result = await readEvidenceFile(projectRoot, path.join(projectRoot, relativePath), AUTOMATIC_FILE_LIMIT);
       const suffix = result.truncated ? "\n[truncated by /init]" : "";
       snapshot = appendWithinLimit(snapshot, `\n\n## ${relativePath}\n${result.content}${suffix}`, SNAPSHOT_LIMIT);
     } catch {
@@ -251,7 +263,7 @@ export async function readInitEvidence(index: InitEvidenceIndex, requestedPath:
   const normalized = normalizeRequestedPath(requestedPath);
   const relativePath = index.canonicalPaths.get(evidenceKey(normalized));
   if (!relativePath) throw new Error(`${requestedPath} is not available to /init`);
-  const result = await validateAndRead(index.projectRoot, path.join(index.projectRoot, relativePath), READ_LIMIT);
+  const result = await readEvidenceFile(index.projectRoot, path.join(index.projectRoot, relativePath), READ_LIMIT);
   return result.truncated ? `${result.content}\n[truncated by /init at ${READ_LIMIT} bytes]` : result.content;
 }
 

package/killeros/personal-instructions.ts

@@ -1,8 +1,8 @@
-import { closeSync, openSync, readSync } from "node:fs";
+import { closeSync, fstatSync, lstatSync, openSync, readSync, realpathSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { StringDecoder } from "node:string_decoder";
-import { type ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { getAgentDir, type ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import type { InitRuntime } from "./runtime.ts";
 
 const PERSONAL_INSTRUCTIONS_FILE = "AGENTS.local.md";
@@ -11,7 +11,12 @@ const PERSONAL_INSTRUCTIONS_LIMIT = 32 * 1024;
 function readBoundedText(filePath: string, limit = PERSONAL_INSTRUCTIONS_LIMIT): string | undefined {
   let descriptor: number | undefined;
   try {
+    const pathStat = lstatSync(filePath);
+    if (!pathStat.isFile() || pathStat.isSymbolicLink() || pathStat.nlink !== 1) return undefined;
     descriptor = openSync(filePath, "r");
+    const openedStat = fstatSync(descriptor);
+    if (!openedStat.isFile() || openedStat.nlink !== 1
+      || openedStat.dev !== pathStat.dev || openedStat.ino !== pathStat.ino) return undefined;
     const buffer = Buffer.alloc(limit + 1);
     const bytesRead = readSync(descriptor, buffer, 0, buffer.length, 0);
     const decoder = new StringDecoder("utf8");
@@ -33,9 +38,59 @@ function readBoundedText(filePath: string, limit = PERSONAL_INSTRUCTIONS_LIMIT):
   }
 }
 
+/** Checks path containment using host filesystem casing rules. */
+function pathInside(root: string, candidate: string): boolean {
+  const normalizedRoot = process.platform === "win32" ? root.toLowerCase() : root;
+  const normalizedCandidate = process.platform === "win32" ? candidate.toLowerCase() : candidate;
+  const relative = path.relative(normalizedRoot, normalizedCandidate);
+  return Boolean(relative) && relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+
+/** Reads one stable, unlinked import from inside Pi's agent directory. */
+function readImportedText(filePath: string): string | undefined {
+  let descriptor: number | undefined;
+  try {
+    const allowedPath = path.resolve(getAgentDir());
+    const requestedPath = path.resolve(filePath);
+    if (!pathInside(allowedPath, requestedPath)) return undefined;
+
+    const allowedRealPath = realpathSync(allowedPath);
+    const requestedRealPath = realpathSync(requestedPath);
+    if (!pathInside(allowedRealPath, requestedRealPath)) return undefined;
+
+    let current = allowedPath;
+    for (const segment of path.relative(allowedPath, requestedPath).split(path.sep)) {
+      current = path.join(current, segment);
+      if (lstatSync(current).isSymbolicLink()) return undefined;
+    }
+
+    const pathStat = lstatSync(requestedPath);
+    if (!pathStat.isFile() || pathStat.isSymbolicLink() || pathStat.nlink !== 1) return undefined;
+    descriptor = openSync(requestedPath, "r");
+    const openedStat = fstatSync(descriptor);
+    if (!openedStat.isFile() || openedStat.nlink !== 1
+      || openedStat.dev !== pathStat.dev || openedStat.ino !== pathStat.ino) return undefined;
+
+    const buffer = Buffer.alloc(PERSONAL_INSTRUCTIONS_LIMIT + 1);
+    const bytesRead = readSync(descriptor, buffer, 0, buffer.length, 0);
+    if (bytesRead > PERSONAL_INSTRUCTIONS_LIMIT) return undefined;
+    const content = new StringDecoder("utf8").write(buffer.subarray(0, bytesRead));
+    return content.trim() ? content : undefined;
+  } catch {
+    return undefined;
+  } finally {
+    if (descriptor !== undefined) {
+      try {
+        closeSync(descriptor);
+      } catch {
+        // Ignore cleanup failures after rejecting or reading an import.
+      }
+    }
+  }
+}
+
 export function resolvePersonalInstructions(cwd: string): string | undefined {
-  const localPath = path.join(cwd, PERSONAL_INSTRUCTIONS_FILE);
-  const local = readBoundedText(localPath);
+  const local = readBoundedText(path.join(cwd, PERSONAL_INSTRUCTIONS_FILE));
   if (!local) return undefined;
 
   const importMatch = local.trim().match(/^@(.+)$/u);
@@ -45,7 +100,9 @@ export function resolvePersonalInstructions(cwd: string): string | undefined {
     const importedPath = requestedPath.startsWith("~/") || requestedPath.startsWith("~\\")
       ? path.join(os.homedir(), requestedPath.slice(2))
       : path.resolve(cwd, requestedPath);
-    content = readBoundedText(importedPath) ?? local;
+    const imported = readImportedText(importedPath);
+    if (!imported) return undefined;
+    content = imported;
   }
   return `<personal_instructions>\n${content}\n</personal_instructions>`;
 }