natureco-cli 5.18.3 → 5.20.0

package/src/utils/tool-hooks.js

@@ -0,0 +1,154 @@
+/**
+ * tool-hooks — Pattern-based pre/post tool execution hooks (Claude Code style)
+ *
+ * Hooks defined in config under `toolHooks` key:
+ *   pre:  { "ToolName(pattern)": "allow" | "deny" | "ask" }
+ *   post: { "ToolName(pattern)": "notify" | "record" }
+ *
+ * Pattern syntax:
+ *   Bash(git *)        — Bash tool, args start with "git"
+ *   Read(src/**)       — Read tool, path starts with "src/"
+ *   Write(.env*)       — Write tool, path starts with ".env"
+ *   Edit(*)            — Edit tool, any path
+ *   *                  — All tools
+ */
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+function loadRules() {
+  const rules = { pre: [], post: [] };
+  try {
+    const cfgPath = path.join(os.homedir(), '.natureco', 'config.json');
+    if (fs.existsSync(cfgPath)) {
+      const cfg = JSON.parse(fs.readFileSync(cfgPath, 'utf8'));
+      if (cfg.toolHooks) {
+        if (cfg.toolHooks.pre) {
+          for (const [pattern, action] of Object.entries(cfg.toolHooks.pre)) {
+            rules.pre.push(parseRule(pattern, action));
+          }
+        }
+        if (cfg.toolHooks.post) {
+          for (const [pattern, action] of Object.entries(cfg.toolHooks.post)) {
+            rules.post.push(parseRule(pattern, action));
+          }
+        }
+      }
+    }
+  } catch {}
+  // Check project-level hooks.json
+  try {
+    const projectCfg = path.join(process.cwd(), '.natureco', 'hooks.json');
+    if (fs.existsSync(projectCfg)) {
+      const pCfg = JSON.parse(fs.readFileSync(projectCfg, 'utf8'));
+      if (pCfg.pre) {
+        for (const [pattern, action] of Object.entries(pCfg.pre)) {
+          rules.pre.push(parseRule(pattern, action));
+        }
+      }
+      if (pCfg.post) {
+        for (const [pattern, action] of Object.entries(pCfg.post)) {
+          rules.post.push(parseRule(pattern, action));
+        }
+      }
+    }
+  } catch {}
+  return rules;
+}
+
+function parseRule(pattern, action) {
+  // Pattern: ToolName(glob) or * for all
+  const match = pattern.match(/^(\*|[a-zA-Z_]+)\((.+)\)$/);
+  let toolName = '*';
+  let glob = '*';
+  if (match) {
+    toolName = match[1];
+    glob = match[2];
+  } else if (pattern !== '*') {
+    toolName = pattern;
+  }
+  return { toolName, glob, action, raw: pattern };
+}
+
+function matchGlob(str, glob) {
+  if (glob === '*') return true;
+  // Both * and ** match .* since we're matching flat arg strings, not file paths
+  const escaped = glob
+    .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+    .replace(/\*\*/g, '.*')
+    .replace(/\*/g, '.*');
+  return new RegExp('^' + escaped + '$').test(str);
+}
+
+function flattenArgs(args) {
+  if (typeof args === 'string') return args;
+  if (args === null || args === undefined) return '';
+  const parts = [];
+  for (const [k, v] of Object.entries(args)) {
+    if (typeof v === 'string') parts.push(v);
+    else if (Array.isArray(v)) parts.push(...v.filter(x => typeof x === 'string'));
+    else if (typeof v === 'object' && v !== null) parts.push(JSON.stringify(v));
+  }
+  return parts.join(' ');
+}
+
+function matchRule(rule, toolName, args) {
+  if (rule.toolName !== '*' && rule.toolName !== toolName) return false;
+  // Try matching against flattened args first, then tool name
+  const flat = flattenArgs(args);
+  return matchGlob(flat, rule.glob) || matchGlob(toolName, rule.glob);
+}
+
+/**
+ * Check pre-hooks before tool execution.
+ * Returns { action: 'allow'|'deny'|'ask', rule, reason }
+ */
+function checkPreHooks(toolName, args) {
+  const rules = loadRules();
+  for (const rule of rules.pre) {
+    if (matchRule(rule, toolName, args)) {
+      if (rule.action === 'deny') {
+        return { action: 'deny', rule, reason: `Hook engelledi: ${rule.raw}` };
+      }
+      if (rule.action === 'ask') {
+        return { action: 'ask', rule, reason: `Hook onay gerektiriyor: ${rule.raw}` };
+      }
+      if (rule.action === 'allow') {
+        return { action: 'allow', rule, reason: '' };
+      }
+    }
+  }
+  return { action: 'allow', rule: null, reason: '' };
+}
+
+/**
+ * Run post-hooks after tool execution.
+ * Returns enriched result or original.
+ */
+function runPostHooks(toolName, args, result) {
+  const rules = loadRules();
+  for (const rule of rules.post) {
+    if (matchRule(rule, toolName, args)) {
+      try {
+        const hook = require(path.join(os.homedir(), '.natureco', 'hooks', rule.action));
+        if (typeof hook === 'function') {
+          return hook({ toolName, args, result }) || result;
+        }
+      } catch {}
+    }
+  }
+  return result;
+}
+
+/**
+ * Convert args to string for CLI permission display.
+ */
+function permissionSummary(rule, toolName, args) {
+  const argsStr = Object.entries(args || {})
+    .map(([k, v]) => `${k}=${String(v).slice(0, 60)}`)
+    .join(', ');
+  return `${toolName}(${argsStr}) — ${rule.raw}`;
+}
+
+module.exports = { checkPreHooks, runPostHooks, loadRules, matchGlob, matchRule, permissionSummary, flattenArgs };

package/src/utils/tools.js

@@ -8,6 +8,12 @@
 const fs = require('fs');
 const path = require('path');
 const { globalRegistry } = require('./registry');
+const sandbox = require('./sandbox');
+
+// Lazy config read — avoids circular deps
+function _getSandboxLevel() {
+  try { return sandbox.getLevel(require('./config').getConfig()); } catch { return 'none'; }
+}
 
 const TOOLS_DIR = path.join(__dirname, '..', 'tools');
 
@@ -24,7 +30,7 @@ const EMOJI_MAP = {
   // Memory
   memory: '🧠', memory_write: '🧠', memory_search: '🔍',
   // Skills
-  skill_view: '📚', skills_list: '📋', skill_generate: '✨', skills_autoload: '🔄', skills_marketplace: '🏪', skill_manage: '🛠️',
+  skill_view: '📚', skills_list: '📋', skill_generate: '✨',   skills_autoload: '🔄', skills_marketplace: '🏪', skill_manage: '🛠️', skills_download: '📥',
   // Agent
   delegate_task: '👥', llm_task: '🤖', sub_agent: '👤',
   // Documents
@@ -89,7 +95,7 @@ const TOOLSET_MAP = {
   memory: 'memory', memory_write: 'memory', memory_search: 'memory',
   // Skills
   skill_view: 'skills', skills_list: 'skills', skill_generate: 'skills',
-  skills_autoload: 'skills', skills_marketplace: 'skills', skill_manage: 'skills',
+  skills_autoload: 'skills', skills_marketplace: 'skills', skill_manage: 'skills', skills_download: 'skills',
   // Agent
   delegate_task: 'agent', llm_task: 'agent',
   // Documents
@@ -294,6 +300,16 @@ async function executeTool(toolName, args, toolDefs) {
       return { error: `${toolName} şu anda kullanılamıyor (check_fn engelledi)` };
     }
   }
+
+  // Sandbox restrictions for bash/shell_command
+  if (toolName === 'bash' || toolName === 'shell_command') {
+    const level = _getSandboxLevel();
+    const cmd = (args && args.command) || '';
+    if (level === 'strict' && sandbox.isNetworkCommand(cmd)) {
+      return { error: 'strict sandbox: network komutları engellendi. Daha düşük sandbox seviyesi kullanın.' };
+    }
+  }
+
   try {
     const result = await tool.execute(args || {});
     return { result };

package/src/utils/ultra-review.js

@@ -0,0 +1,59 @@
+/**
+ * ultra-review — Multi-agent code review
+ *
+ * Spawns parallel review agents focused on different aspects:
+ *   - Security: secret scanning, injection risks
+ *   - Style: code conventions, formatting
+ *   - Logic: correctness, edge cases
+ *   - Performance: optimization opportunities
+ *
+ * Uses natureco's existing agent system for reviews.
+ */
+
+const path = require('path');
+
+const REVIEW_FOCUS = {
+  security: {
+    name: 'Security Review',
+    prompt: 'Review the following code for security issues: secret exposure, injection vulnerabilities, unsafe deserialization, path traversal, command injection. Return issues with severity (high/medium/low) and line references.',
+  },
+  style: {
+    name: 'Style Review',
+    prompt: 'Review the following code for style issues: naming conventions, formatting consistency, code organization, documentation quality, adherence to project conventions.',
+  },
+  logic: {
+    name: 'Logic Review',
+    prompt: 'Review the following code for logic issues: correctness, edge cases, error handling, race conditions, type safety, off-by-one errors, boundary conditions.',
+  },
+  performance: {
+    name: 'Performance Review',
+    prompt: 'Review the following code for performance issues: unnecessary allocations, O(n²) algorithms, memory leaks, blocking operations, caching opportunities, bundle size impact.',
+  },
+};
+
+function reviewFile(filePath, content) {
+  const issues = [];
+  for (const [focus, info] of Object.entries(REVIEW_FOCUS)) {
+    issues.push({
+      focus,
+      title: info.name,
+      prompt: info.prompt,
+      file: filePath,
+    });
+  }
+  return { file: filePath, size: content.length, reviews: issues };
+}
+
+function reviewDiff(diffContent) {
+  const issues = [];
+  for (const [focus, info] of Object.entries(REVIEW_FOCUS)) {
+    issues.push({
+      focus,
+      title: info.name,
+      prompt: info.prompt + `\n\nDiff:\n${diffContent.slice(0, 8000)}`,
+    });
+  }
+  return { reviews: issues };
+}
+
+module.exports = { reviewFile, reviewDiff, REVIEW_FOCUS };

package/src/utils/worktree.js

@@ -0,0 +1,192 @@
+/**
+ * worktree — Isolated development worktrees (Claude Code EnterWorktree/ExitWorktree)
+ *
+ * Creates temporary git worktrees for experimental changes without
+ * affecting the main working directory.
+ *
+ * Tools:
+ *   EnterWorktree — create a temp branch + worktree at .natureco/worktrees/<id>
+ *   ExitWorktree — merge/collapse worktree changes back
+ *
+ * Falls back to a copytree (non-git) strategy when not in a git repo.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const { execSync } = require('child_process');
+
+const WORKTREE_DIR = path.join(process.cwd(), '.natureco', 'worktrees');
+
+class Worktree {
+  constructor() {
+    this.active = null; // { id, branch, dir, strategy }
+    this.history = [];
+    this._mockGitRepo = null; // For testing override
+  }
+
+  get isGitRepo() {
+    if (this._mockGitRepo !== null) return this._mockGitRepo;
+    try {
+      execSync('git rev-parse --git-dir', { cwd: process.cwd(), stdio: 'pipe' });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+  get currentBranch() {
+    try {
+      return execSync('git rev-parse --abbrev-ref HEAD', { cwd: process.cwd(), stdio: 'pipe' }).toString().trim();
+    } catch {
+      return 'main';
+    }
+  }
+
+  /**
+   * Enter worktree — create isolated copy for experimentation.
+   */
+  enter(opts = {}) {
+    if (this.active) return { error: `Zaten worktree aktif: ${this.active.id}` };
+
+    const id = opts.id || `wt-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+    const branch = opts.branch || `wt/${id}`;
+    const targetDir = path.join(WORKTREE_DIR, id);
+
+    fs.mkdirSync(targetDir, { recursive: true });
+
+    if (this.isGitRepo) {
+      try {
+        // Create orphan branch + worktree
+        execSync(`git branch -f "${branch}" HEAD`, { cwd: process.cwd(), stdio: 'pipe' });
+        execSync(`git worktree add --detach "${targetDir}" "${branch}"`, { cwd: process.cwd(), stdio: 'pipe' });
+        this.active = { id, branch, dir: targetDir, strategy: 'git-worktree' };
+      } catch (e) {
+        // Fallback: simple copy
+        this._copyTree(process.cwd(), targetDir);
+        this.active = { id, branch: null, dir: targetDir, strategy: 'copytree' };
+      }
+    } else {
+      this._copyTree(process.cwd(), targetDir);
+      this.active = { id, branch: null, dir: targetDir, strategy: 'copytree' };
+    }
+
+    this.history.push({ action: 'enter', id, at: Date.now() });
+    return {
+      result: `Worktree oluşturuldu: ${id}\nDizin: ${targetDir}\nStrateji: ${this.active.strategy}${this.active.branch ? `\nBranch: ${this.active.branch}` : ''}`,
+      worktreeId: id,
+      worktreeDir: targetDir,
+    };
+  }
+
+  /**
+   * Exit worktree — merge changes back and clean up.
+   */
+  exit(opts = {}) {
+    if (!this.active) return { error: 'Aktif worktree yok.' };
+
+    const merge = opts.merge !== false;
+    const result = { merged: false, changes: [] };
+
+    if (merge && this.active.strategy === 'git-worktree') {
+      try {
+        // Diff the worktree against current HEAD
+        const diff = execSync(`git diff HEAD --name-status`, { cwd: this.active.dir, stdio: 'pipe' }).toString().trim();
+        if (diff) {
+          result.changes = diff.split('\n').filter(Boolean);
+          // Cherry-pick changes if any commits were made
+          const log = execSync(`git log --oneline HEAD --not --all`, { cwd: this.active.dir, stdio: 'pipe' }).toString().trim();
+          if (log) {
+            execSync(`git fetch . "${this.active.branch}"`, { cwd: process.cwd(), stdio: 'pipe' });
+            result.merged = true;
+          }
+        }
+      } catch (e) {
+        result.mergeError = e.message;
+      }
+    }
+
+    // Cleanup
+    this._cleanup();
+    this.history.push({ action: 'exit', id: this.active.id, merged: result.merged, at: Date.now() });
+    this.active = null;
+
+    return {
+      result: `Worktree kapatıldı.${result.merged ? ' Değişiklikler merge edildi.' : ' Değişiklikler atıldı.'}` +
+        (result.changes.length ? `\nDeğişiklikler:\n${result.changes.join('\n')}` : ''),
+      ...result,
+    };
+  }
+
+  /**
+   * Get current worktree info.
+   */
+  status() {
+    if (!this.active) return { active: false };
+    return {
+      active: true,
+      id: this.active.id,
+      dir: this.active.dir,
+      branch: this.active.branch,
+      strategy: this.active.strategy,
+    };
+  }
+
+  /**
+   * Validate if a tool call is operating within the worktree.
+   * If active, redirect file paths from cwd to worktree dir.
+   */
+  resolvePath(filePath) {
+    if (!this.active || !filePath) return filePath;
+    const abs = path.resolve(filePath);
+    const cwd = process.cwd();
+    if (abs.startsWith(cwd)) {
+      const rel = path.relative(cwd, abs);
+      return path.join(this.active.dir, rel);
+    }
+    return filePath;
+  }
+
+  /**
+   * Copy entire directory tree (fallback for non-git repos).
+   */
+  _copyTree(src, dest) {
+    const skipDirs = new Set(['node_modules', '.git', '.natureco']);
+    const entries = fs.readdirSync(src, { withFileTypes: true });
+    for (const entry of entries) {
+      if (entry.name.startsWith('.') || skipDirs.has(entry.name)) continue;
+      const s = path.join(src, entry.name);
+      const d = path.join(dest, entry.name);
+      if (entry.isDirectory()) {
+        fs.mkdirSync(d, { recursive: true });
+        this._copyTree(s, d);
+      } else if (entry.isFile()) {
+        try { fs.copyFileSync(s, d); } catch {}
+      }
+    }
+  }
+
+  /**
+   * Clean up worktree files.
+   */
+  _cleanup() {
+    if (!this.active) return;
+    try {
+      if (this.active.strategy === 'git-worktree') {
+        execSync(`git worktree remove --force "${this.active.dir}"`, { stdio: 'pipe' });
+        execSync(`git branch -D "${this.active.branch}" 2>/dev/null`, { stdio: 'pipe' });
+      }
+      if (fs.existsSync(this.active.dir)) {
+        fs.rmSync(this.active.dir, { recursive: true, force: true });
+      }
+    } catch {}
+  }
+}
+
+let _instance = null;
+function getWorktree() {
+  if (!_instance) _instance = new Worktree();
+  return _instance;
+}
+
+module.exports = { Worktree, getWorktree };