lonny-agent 0.2.6 → 0.2.7

package/src/tools/execute/bash/execution.ts

@@ -0,0 +1,211 @@
+import type { ChildProcess } from 'node:child_process'
+import { execSync, spawn } from 'node:child_process'
+import * as os from 'node:os'
+
+import { fmtErr } from '../../errors.js'
+import { MAX_ERROR_LENGTH, MAX_OUTPUT_LENGTH } from './constants.js'
+import { ENCODING } from './platform.js'
+
+interface ExecResult {
+  stdout: string
+  stderr: string
+  exitCode: number
+  timedOut: boolean
+}
+
+/**
+ * Kill a child process tree reliably across platforms.
+ * - On Windows: uses `taskkill /F /T` for force-kill of the process tree when possible.
+ * - On Unix: sends SIGTERM first, then SIGKILL after a grace period.
+ * - Handles missing pid and protects against thrown errors.
+ */
+function killProcess(child: ChildProcess): NodeJS.Timeout | undefined {
+  try {
+    if (!child || typeof (child as any).pid !== 'number' || Number.isNaN((child as any).pid)) {
+      // Best-effort kill if pid is not available
+      try {
+        child.kill()
+      } catch {
+        /* ignore */
+      }
+      return undefined
+    }
+
+    if (os.platform() === 'win32') {
+      try {
+        // Use taskkill to terminate the whole process tree. If it fails, fall back to child.kill().
+        execSync(`taskkill /F /T /PID ${child.pid}`, {
+          stdio: 'ignore',
+          timeout: 3000,
+        })
+      } catch {
+        try {
+          child.kill()
+        } catch {
+          /* ignore */
+        }
+      }
+      return undefined
+    } else {
+      try {
+        child.kill('SIGTERM')
+      } catch {
+        /* ignore */
+      }
+      // Track timer so we can force-KILL after a grace period
+      const killTimer = setTimeout(() => {
+        try {
+          child.kill('SIGKILL')
+        } catch {
+          /* already exited or cannot kill */
+        }
+      }, 5000)
+      // Ensure we clean up the timer and the listener when the child exits
+      const onExit = () => {
+        try {
+          clearTimeout(killTimer)
+        } catch {
+          /* ignore */
+        }
+        try {
+          child.removeListener('exit', onExit)
+        } catch {
+          /* ignore */
+        }
+      }
+      child.on('exit', onExit)
+      return killTimer
+    }
+  } catch {
+    return undefined
+  }
+}
+
+function execCommand(command: string, timeout: number, cwd?: string): Promise<ExecResult> {
+  return new Promise(resolve => {
+    const isWindows = os.platform() === 'win32'
+    const shellExe = isWindows ? 'powershell.exe' : process.env.SHELL || '/bin/sh'
+    const shellArgs = isWindows
+      ? ['-NoProfile', '-NonInteractive', '-Command', command]
+      : ['-c', command]
+
+    // Protect against spawn throwing synchronously (e.g. missing shell)
+    let child: ChildProcess | undefined
+    try {
+      child = spawn(shellExe, shellArgs, {
+        cwd: cwd || process.cwd(),
+        env: { ...process.env, FORCE_COLOR: '0', NO_COLOR: '1' },
+        windowsHide: true,
+      })
+    } catch (err) {
+      // Return a normalized error result rather than throwing
+      resolve({ stdout: '', stderr: fmtErr(err), exitCode: 1, timedOut: false })
+      return
+    }
+
+    let stdout = ''
+    let stderr = ''
+    let timedOut = false
+
+    // Keep memory bounded by limiting how much we accumulate for each stream
+    const MAX_STDOUT_BUFFER = Math.max(MAX_OUTPUT_LENGTH * 2, 20000)
+    const MAX_STDERR_BUFFER = Math.max(MAX_ERROR_LENGTH * 2, 4000)
+    let stdoutTruncated = false
+    let stderrTruncated = false
+
+    // Track which encodings work for each stream (per-chunk fallback).
+    let stdoutEncoding: string | undefined
+    let stderrEncoding: string | undefined
+
+    let treeKillTimer: NodeJS.Timeout | undefined
+    const timer = setTimeout(() => {
+      timedOut = true
+      // Attempt to kill the process tree; capture any returned timer so we can clear it on close
+      treeKillTimer = killProcess(child!)
+    }, timeout)
+
+    child!.stdout?.on('data', (data: Buffer) => {
+      if (stdout.length >= MAX_STDOUT_BUFFER) {
+        stdoutTruncated = true
+        return
+      }
+      try {
+        const enc = stdoutEncoding || ENCODING
+        stdout += data.toString(enc as BufferEncoding)
+        stdoutEncoding = enc
+      } catch {
+        // Detected encoding failed; fall back to utf-8
+        try {
+          stdout += data.toString('utf-8')
+          stdoutEncoding = 'utf-8'
+        } catch {
+          // Give up on this chunk
+        }
+      }
+    })
+
+    child!.stderr?.on('data', (data: Buffer) => {
+      if (stderr.length >= MAX_STDERR_BUFFER) {
+        stderrTruncated = true
+        return
+      }
+      try {
+        const enc = stderrEncoding || ENCODING
+        stderr += data.toString(enc as BufferEncoding)
+        stderrEncoding = enc
+      } catch {
+        try {
+          stderr += data.toString('utf-8')
+          stderrEncoding = 'utf-8'
+        } catch {
+          // ignore
+        }
+      }
+    })
+
+    const finish = (code: number | null) => {
+      try {
+        clearTimeout(timer)
+      } catch {
+        /* ignore */
+      }
+      if (treeKillTimer) {
+        try {
+          clearTimeout(treeKillTimer)
+        } catch {
+          /* ignore */
+        }
+      }
+
+      // If we truncated during streaming, append a short notice so final output can indicate truncation
+      if (stdoutTruncated) stdout += '\n... [stdout truncated due to size limit]'
+      if (stderrTruncated) stderr += '\n... [stderr truncated due to size limit]'
+
+      resolve({ stdout, stderr, exitCode: code ?? 0, timedOut })
+    }
+
+    child!.on('close', code => finish(code))
+
+    child!.on('error', err => {
+      try {
+        clearTimeout(timer)
+      } catch {
+        /* ignore */
+      }
+      if (treeKillTimer) {
+        try {
+          clearTimeout(treeKillTimer)
+        } catch {
+          /* ignore */
+        }
+      }
+      // Include the spawn error message in stderr so callers can surface it
+      const errMsg = fmtErr(err)
+      if (errMsg) stderr += (stderr ? '\n' : '') + errMsg
+      resolve({ stdout, stderr, exitCode: 1, timedOut })
+    })
+  })
+}
+
+export type { ExecResult }
+export { execCommand, killProcess }

package/src/tools/execute/bash/index.ts

@@ -0,0 +1,131 @@
+import * as os from 'node:os'
+
+import { fmtErr } from '../../errors.js'
+import type { Tool, ToolResult } from '../../types.js'
+import { MAX_OUTPUT_LENGTH } from './constants.js'
+import { buildErrorMsg, extractPowerShellNativeOutput, truncateOutput } from './errors.js'
+import { execCommand } from './execution.js'
+import { ENCODING, env } from './platform.js'
+import { checkDestructive, redactSensitive } from './security.js'
+import { validateInput } from './validation.js'
+
+export const bashTool: Tool = {
+  definition: {
+    name: 'bash',
+    category: 'Execute',
+    group: 'Shell',
+    description: `Execute a shell command. Returns stdout and stderr.
+
+Environment: ${env.osInfo}
+Shell: ${env.shell}
+Console encoding: ${ENCODING}
+
+⚠️  Use this tool for READ-ONLY operations (run tests, check builds, list files).
+For creating/modifying files, use the 'edit' tool instead.
+For git operations (status, diff, log), use the 'git' tool instead.`,
+    parameters: {
+      command: {
+        type: 'string',
+        description: 'Shell command to execute (required, non-empty string)',
+        required: true,
+      },
+      description: {
+        type: 'string',
+        description:
+          'Brief description (e.g. "Run unit tests"). Included in the output for traceability.',
+      },
+      timeout: {
+        type: 'number',
+        description:
+          'Timeout in ms (100-600000, default: 120000). Increase for slow operations like npm install.',
+      },
+      cwd: {
+        type: 'string',
+        description:
+          'Working directory path. Use when you need to run a command inside a subdirectory. Must exist.',
+      },
+    },
+  },
+  async execute(input): Promise<ToolResult> {
+    // ── Step 1: Validate input ──────────────────────────────────────────
+    const validated = validateInput(input)
+    if (!validated.ok) {
+      return { success: false, output: '', error: validated.error }
+    }
+
+    const { command, timeout, description, cwd } = validated
+
+    // ── Step 2: Security check ──────────────────────────────────────────
+    const destructiveHint = checkDestructive(command)
+    if (destructiveHint) {
+      return {
+        success: false,
+        output: '',
+        error: `Destructive command blocked: ${destructiveHint}.\nUse the 'edit' tool for file modifications instead.`,
+      }
+    }
+
+    try {
+      const { stdout, stderr, exitCode, timedOut } = await execCommand(command, timeout, cwd)
+
+      // ── Step 3: Build output ──────────────────────────────────────────
+      let output = ''
+      if (description) {
+        output += `[bash] ${description}\n`
+      }
+
+      // Redact sensitive data from output (API keys, tokens, passwords, etc.)
+      const stdoutTrimmed = redactSensitive(stdout.trim())
+      if (stdoutTrimmed) {
+        output += stdoutTrimmed
+      }
+
+      let stderrTrimmed = redactSensitive(stderr.trim())
+
+      // On Windows, PowerShell wraps native command stderr in ErrorRecord format
+      // even when the command succeeds (exit code 0). Detect this and extract the
+      // actual message content so it doesn't pollute output with "Command exited..." noise.
+      if (exitCode === 0 && stderrTrimmed && os.platform() === 'win32') {
+        const cleaned = extractPowerShellNativeOutput(stderrTrimmed)
+        if (cleaned) {
+          // Prepend a newline if there's already output
+          output += (output ? '\n' : '') + cleaned
+          stderrTrimmed = ''
+        }
+      }
+
+      if (stderrTrimmed) {
+        if (output) output += '\n'
+        output += `(stderr):\n${stderrTrimmed}`
+      }
+
+      // Apply global truncation
+      output = truncateOutput(output, MAX_OUTPUT_LENGTH, 'output')
+
+      if (!output || output === (description ? `[bash] ${description}\n` : '')) {
+        output = description ? `[bash] ${description}\n(no output)` : '(no output)'
+      }
+
+      if (timedOut) {
+        return {
+          success: false,
+          output,
+          error: buildErrorMsg(0, stderr, command, true, cwd),
+        }
+      }
+
+      if (exitCode !== 0) {
+        return {
+          success: false,
+          output,
+          error: buildErrorMsg(exitCode, stderr, command, false, cwd),
+        }
+      }
+
+      return { success: true, output }
+    } catch (err) {
+      const msg = fmtErr(err)
+      return { success: false, output: '', error: `Command failed unexpectedly: ${msg}` }
+    }
+  },
+}

package/src/tools/execute/bash/platform.ts

@@ -0,0 +1,65 @@
+import { execSync } from 'node:child_process'
+import * as os from 'node:os'
+
+function detectEnv(): { osInfo: string; shell: string } {
+  const platform = os.platform()
+  const release = os.release()
+  const arch = os.arch()
+
+  if (platform === 'win32') {
+    return {
+      osInfo: `Windows ${release} (${arch})`,
+      shell: 'powershell.exe',
+    }
+  }
+
+  const osName = platform === 'darwin' ? 'macOS' : platform === 'linux' ? 'Linux' : platform
+  return {
+    osInfo: `${osName} ${release} (${arch})`,
+    shell: process.env.SHELL || '/bin/sh',
+  }
+}
+
+export const env = detectEnv()
+
+/**
+ * Detect Windows console code page to handle non-UTF-8 output correctly.
+ * Falls back to 'utf-8' if detection fails.
+ * On non-Windows platforms, always returns 'utf-8'.
+ */
+function detectEncoding(): string {
+  if (os.platform() !== 'win32') return 'utf-8'
+  try {
+    const result = execSync('[Console]::OutputEncoding.CodePage', {
+      stdio: ['ignore', 'pipe', 'pipe'],
+      timeout: 2000,
+      windowsHide: true,
+      encoding: 'utf-8',
+      shell: 'powershell.exe',
+    })
+    const cp = Number.parseInt(result.toString().trim(), 10)
+    // Common Windows code pages that need special handling
+    if (cp === 936) return 'gbk' // Chinese (Simplified)
+    if (cp === 950) return 'big5' // Chinese (Traditional)
+    if (cp === 932) return 'shift-jis' // Japanese
+    if (cp === 949) return 'euc-kr' // Korean
+    if (
+      cp === 1250 ||
+      cp === 1251 ||
+      cp === 1252 ||
+      cp === 1253 ||
+      cp === 1254 ||
+      cp === 1255 ||
+      cp === 1256 ||
+      cp === 1257
+    ) {
+      return `cp${cp}` // Windows code page
+    }
+    return 'utf-8'
+  } catch {
+    return 'utf-8'
+  }
+}
+
+// Cache encoding detection once at startup
+export const ENCODING = detectEncoding()

package/src/tools/execute/bash/security.ts

@@ -0,0 +1,28 @@
+import { DESTRUCTIVE_PATTERNS, SENSITIVE_PATTERNS } from './constants.js'
+
+/**
+ * Check if a command matches destructive patterns.
+ * Returns a warning string if detected, null otherwise.
+ */
+function checkDestructive(command: string): string | null {
+  for (const { regex, hint } of DESTRUCTIVE_PATTERNS) {
+    if (regex.test(command)) {
+      return hint
+    }
+  }
+  return null
+}
+
+/**
+ * Redact sensitive data from a string by replacing matches with "[REDACTED]".
+ * Returns the redacted string.
+ */
+function redactSensitive(s: string): string {
+  let result = s
+  for (const pattern of SENSITIVE_PATTERNS) {
+    result = result.replace(pattern, '[REDACTED]')
+  }
+  return result
+}
+
+export { checkDestructive, redactSensitive }

package/src/tools/execute/bash/validation.ts

@@ -0,0 +1,78 @@
+import * as fs from 'node:fs'
+import * as path from 'node:path'
+
+import { DEFAULT_TIMEOUT, MAX_TIMEOUT, MIN_TIMEOUT } from './constants.js'
+
+interface ValidatedInput {
+  ok: true
+  command: string
+  timeout: number
+  description: string
+  cwd: string | undefined
+}
+interface InputError {
+  ok: false
+  error: string
+}
+type ValidateResult = ValidatedInput | InputError
+
+function validateInput(input: Record<string, unknown>): ValidateResult {
+  // command: must be a non-empty string
+  const command = input.command
+  if (command === undefined || command === null) {
+    return { ok: false, error: 'command is required' }
+  }
+  if (typeof command !== 'string') {
+    return { ok: false, error: `command must be a string, got ${typeof command}` }
+  }
+  if (command.trim() === '') {
+    return { ok: false, error: 'command must not be empty or whitespace-only' }
+  }
+
+  // timeout: must be a number (or default), within bounds
+  let timeout = DEFAULT_TIMEOUT
+  if (input.timeout !== undefined) {
+    if (
+      typeof input.timeout === 'number' &&
+      !Number.isNaN(input.timeout) &&
+      Number.isFinite(input.timeout)
+    ) {
+      timeout = Math.round(input.timeout)
+      if (timeout < MIN_TIMEOUT) {
+        timeout = MIN_TIMEOUT
+      } else if (timeout > MAX_TIMEOUT) {
+        timeout = MAX_TIMEOUT
+      }
+    }
+    // If timeout is not a valid number, silently use default
+  }
+
+  // description: optional string
+  const description = typeof input.description === 'string' ? input.description : ''
+
+  // cwd: optional string, must be a valid directory, no path traversal
+  let cwd: string | undefined
+  if (typeof input.cwd === 'string' && input.cwd.trim()) {
+    const rawCwd = input.cwd.trim()
+    // Path traversal protection
+    if (/(?:^|[\\/])\.\.(?:[\\/]|$)/.test(rawCwd)) {
+      return {
+        ok: false,
+        error: `cwd contains path traversal (..) which is not allowed: "${rawCwd}"`,
+      }
+    }
+    const resolvedCwd = path.resolve(rawCwd)
+    if (!fs.existsSync(resolvedCwd)) {
+      return { ok: false, error: `cwd directory does not exist: "${resolvedCwd}"` }
+    }
+    if (!fs.statSync(resolvedCwd).isDirectory()) {
+      return { ok: false, error: `cwd is not a directory: "${resolvedCwd}"` }
+    }
+    cwd = resolvedCwd
+  }
+
+  return { ok: true, command: command.trim(), timeout, description, cwd }
+}
+
+export type { InputError, ValidatedInput, ValidateResult }
+export { validateInput }