openfox 2.0.73 → 2.0.75

package/dist/{chunk-2DCJERYX.js → chunk-CJ2AJ7HU.js}

@@ -5,7 +5,7 @@ import {
   getEventStore,
   getRuntimeConfig,
   updateSessionMetadata
-} from "./chunk-6XKM25OT.js";
+} from "./chunk-YFFP4DR4.js";
 import {
   buildMessagesFromStoredEvents,
   foldPendingConfirmations
@@ -13,7 +13,7 @@ import {
 import {
   createContextStateMessage,
   createSessionStateMessage
-} from "./chunk-NOU2QIL5.js";
+} from "./chunk-O3NUNU4H.js";
 import {
   logger
 } from "./chunk-K44MW7JJ.js";
@@ -184,4 +184,4 @@ export {
   buildRunChatTurnParams,
   generateSessionNameForSession
 };
-//# sourceMappingURL=chunk-2DCJERYX.js.map
+//# sourceMappingURL=chunk-CJ2AJ7HU.js.map

package/dist/{chunk-O2BE7KVQ.js → chunk-J3VQBVGO.js}

@@ -1,5 +1,4 @@
 import {
-  PathAccessDeniedError,
   createAssemblyResult,
   findAgentById,
   getAllInstructions,
@@ -10,7 +9,7 @@ import {
   loadAllAgentsDefault,
   processEventsForConversation,
   runTopLevelAgentLoop
-} from "./chunk-GMF36EZ3.js";
+} from "./chunk-6ZMGWDOD.js";
 import {
   TurnMetrics,
   buildAgentReminder,
@@ -19,12 +18,15 @@ import {
   createChatDoneEvent,
   createMessageStartEvent
 } from "./chunk-XWBNYU2L.js";
+import {
+  PathAccessDeniedError
+} from "./chunk-KEVRZWL3.js";
 import {
   getCurrentContextWindowId,
   getCurrentWindowMessageOptions,
   getEventStore,
   getRuntimeConfig
-} from "./chunk-6XKM25OT.js";
+} from "./chunk-YFFP4DR4.js";
 import {
   buildSnapshotFromSessionState
 } from "./chunk-DJASQ2ZB.js";
@@ -64,7 +66,7 @@ function resolveAgentDef(sessionManager, sessionId) {
 }
 async function buildCachedPrompt(sessionManager, sessionId, agentDef) {
   const { instructionContent, skills } = await loadSessionContext(sessionManager, sessionId);
-  const { getToolRegistryForAgent: getToolRegistryForAgent2 } = await import("./tools-X52DFUS6.js");
+  const { getToolRegistryForAgent: getToolRegistryForAgent2 } = await import("./tools-RZ464GUJ.js");
   const tools = getToolRegistryForAgent2(agentDef).definitions;
   const toolFingerprint = getToolFingerprint(tools);
   const allAgents = await loadAllAgentsDefault();
@@ -77,7 +79,7 @@ async function buildCachedPrompt(sessionManager, sessionId, agentDef) {
 async function computeSessionHash(sessionManager, sessionId) {
   const { instructionContent, skills } = await loadSessionContext(sessionManager, sessionId);
   const agentDef = await resolveAgentDef(sessionManager, sessionId);
-  const { getToolRegistryForAgent: getToolRegistryForAgent2 } = await import("./tools-X52DFUS6.js");
+  const { getToolRegistryForAgent: getToolRegistryForAgent2 } = await import("./tools-RZ464GUJ.js");
   const tools = getToolRegistryForAgent2(agentDef).definitions;
   const toolFingerprint = getToolFingerprint(tools);
   return computeDynamicContextHash(instructionContent, skills, toolFingerprint);
@@ -357,4 +359,4 @@ export {
   runChatTurn,
   runAgentTurn
 };
-//# sourceMappingURL=chunk-O2BE7KVQ.js.map
+//# sourceMappingURL=chunk-J3VQBVGO.js.map

package/dist/chunk-KEVRZWL3.js

@@ -0,0 +1,495 @@
+import {
+  getEventStore
+} from "./chunk-YFFP4DR4.js";
+import {
+  createChatPathConfirmationMessage
+} from "./chunk-O3NUNU4H.js";
+
+// src/server/tools/path-security.ts
+import { realpath } from "fs/promises";
+import { resolve, normalize, join, basename, sep, posix, win32 } from "path";
+import { homedir, tmpdir } from "os";
+var SAFE_PATHS = /* @__PURE__ */ new Set([
+  "/dev/null",
+  "/dev/zero",
+  "/dev/random",
+  "/dev/urandom",
+  "/dev/stdin",
+  "/dev/stdout",
+  "/dev/stderr",
+  "/dev/fd/0",
+  "/dev/fd/1",
+  "/dev/fd/2"
+]);
+var ALLOWED_ROOTS = ["/tmp", "/var/tmp", tmpdir()];
+var SENSITIVE_FILE_PATTERNS = [
+  // Dotenv files (but not .envrc, .env-example, .env.example)
+  /^\.env$/,
+  // .env
+  /^\.env\.(?!example)[a-zA-Z0-9_.-]+$/,
+  // .env.local, .env.production (not .env.example)
+  // Credential files
+  /^credentials\.json$/i,
+  /^secrets?\.(?:json|ya?ml|toml)$/i,
+  // Private keys
+  /\.pem$/i,
+  /\.key$/i,
+  /^id_rsa/,
+  /^id_ed25519/,
+  /^id_ecdsa/,
+  /^id_dsa/,
+  // Auth configs
+  /^\.netrc$/
+];
+function isSensitivePath(path) {
+  const fileName = basename(path);
+  if (!fileName) return false;
+  return SENSITIVE_FILE_PATTERNS.some((pattern) => pattern.test(fileName));
+}
+var sessionAllowedPaths = /* @__PURE__ */ new Map();
+function addAllowedPath(sessionId, path) {
+  if (!sessionAllowedPaths.has(sessionId)) {
+    sessionAllowedPaths.set(sessionId, /* @__PURE__ */ new Set());
+  }
+  sessionAllowedPaths.get(sessionId).add(normalize(path));
+}
+function addAllowedPaths(sessionId, paths) {
+  for (const path of paths) {
+    addAllowedPath(sessionId, path);
+  }
+}
+function isPathAllowed(sessionId, path) {
+  const allowed = sessionAllowedPaths.get(sessionId);
+  if (!allowed) return false;
+  return allowed.has(normalize(path));
+}
+function clearAllowedPaths(sessionId) {
+  sessionAllowedPaths.delete(sessionId);
+}
+async function safeRealpath(path) {
+  const absolutePath = normalize(resolve(path));
+  try {
+    return await realpath(absolutePath);
+  } catch {
+    const missingSegments = [];
+    let current = absolutePath;
+    while (true) {
+      try {
+        const canonicalParent = await realpath(current);
+        return normalize(join(canonicalParent, ...missingSegments.reverse()));
+      } catch {
+        const parent = resolve(current, "..");
+        if (parent === current) return absolutePath;
+        missingSegments.push(basename(current));
+        current = parent;
+      }
+    }
+  }
+}
+async function isPathWithinSandbox(path, workdir, sessionId) {
+  const normalizedWorkdir = normalize((await safeRealpath(workdir)).replace(/\/+$/, ""));
+  let resolvedPath;
+  try {
+    resolvedPath = normalize(await realpath(path));
+  } catch {
+    try {
+      const { readlink } = await import("fs/promises");
+      const linkTarget = await readlink(path);
+      const linkDir = resolve(path, "..");
+      resolvedPath = await safeRealpath(resolve(linkDir, linkTarget));
+    } catch {
+      resolvedPath = await safeRealpath(path);
+    }
+  }
+  resolvedPath = resolvedPath.replace(/\/+$/, "");
+  if (resolvedPath === normalizedWorkdir || resolvedPath.startsWith(normalizedWorkdir + sep)) {
+    return { allowed: true, resolvedPath };
+  }
+  for (const root of ALLOWED_ROOTS) {
+    const normalizedRoot = normalize((await safeRealpath(root)).replace(/\/+$/, ""));
+    if (resolvedPath === normalizedRoot || resolvedPath.startsWith(normalizedRoot + sep)) {
+      return { allowed: true, resolvedPath };
+    }
+  }
+  if (sessionId && (isPathAllowed(sessionId, path) || isPathAllowed(sessionId, resolvedPath))) {
+    return { allowed: true, resolvedPath };
+  }
+  return { allowed: false, resolvedPath };
+}
+function looksLikeRegex(str) {
+  return /[*?+[\]\\]/.test(str);
+}
+var isWindows = () => process.platform === "win32";
+function isWindowsAbsolutePath(str) {
+  return /^[A-Za-z]:[\\/]/.test(str);
+}
+function normalizeExtracted(path) {
+  return isWindowsAbsolutePath(path) ? win32.normalize(path) : posix.normalize(path);
+}
+function isPlaceholderToken(str) {
+  return str.includes("__URL__") || str.includes("__FILEURL__") || str.includes("__SED__") || str.includes("__COMMIT_MSG__");
+}
+function extractAbsolutePathsFromCommand(command) {
+  if (!command.trim()) {
+    return [];
+  }
+  const paths = [];
+  const home = homedir();
+  let sanitized = command.replace(/https?:\/\/[^\s'"]+/g, " __URL__ ").replace(/ftp:\/\/[^\s'"]+/g, " __URL__ ");
+  sanitized = sanitized.replace(/(?<!\w)s\/[^/]*\/[^/]*\/[gip]*/g, " __SED__ ");
+  sanitized = sanitized.replace(/(?<!\w)s\|[^|]*\|[^|]*\|[gip]*/g, " __SED__ ");
+  sanitized = sanitized.replace(/(?<!\w)s:[^:]*:[^:]*:[gip]*/g, " __SED__ ");
+  sanitized = sanitized.replace(
+    /git\s+commit\b.*?(?:-(?:[a-zA-Z]*m)(?=\s)|--message)\s+(["'])(?:(?!\1).)*\1/g,
+    (match2) => match2.replace(/\/[^\s"'|&;<>`()]+/g, " __COMMIT_MSG__ ")
+  );
+  const fileUrlMatches = command.matchAll(/file:\/\/([^\s'"]+)/g);
+  for (const match2 of fileUrlMatches) {
+    const filePath = match2[1];
+    if (filePath && !isSafePath(filePath)) {
+      paths.push(normalizeExtracted(filePath));
+    }
+  }
+  sanitized = sanitized.replace(/file:\/\/[^\s'"]+/g, " __FILEURL__ ");
+  const tildePattern = /(?:^|[\s='"(])~(\/[^\s'"()]*)?(?=[\s'"()]|$)/g;
+  let match;
+  while ((match = tildePattern.exec(sanitized)) !== null) {
+    const pathPart = match[1] ?? "";
+    const fullPath = home + pathPart;
+    const resolved = normalize(resolve(fullPath));
+    if (!isSafePath(resolved)) {
+      paths.push(resolved);
+    }
+  }
+  const quotedPattern = /["']([^"']+)["']/g;
+  while ((match = quotedPattern.exec(sanitized)) !== null) {
+    const content = match[1];
+    if (content.startsWith("/") && content.endsWith("/")) {
+      continue;
+    }
+    if (content.startsWith("/") && looksLikeRegex(content)) {
+      continue;
+    }
+    if (isWindowsAbsolutePath(content)) {
+      const resolved = normalizeExtracted(content);
+      if (!isSafePath(resolved)) {
+        paths.push(resolved);
+      }
+    } else if (!isWindows() && content.startsWith("/")) {
+      const resolved = normalizeExtracted(content);
+      if (!isSafePath(resolved)) {
+        paths.push(resolved);
+      }
+    } else if (content.startsWith("~")) {
+      const pathPart = content.slice(1);
+      const fullPath = join(home, pathPart);
+      const resolved = normalize(resolve(fullPath));
+      if (!isSafePath(resolved)) {
+        paths.push(resolved);
+      }
+    }
+  }
+  if (isWindows()) {
+    const winAbsolutePattern = /(?:^|[\s=(])([A-Za-z]:[\\/][^\s"'|&;<>`()]+)/g;
+    while ((match = winAbsolutePattern.exec(sanitized)) !== null) {
+      const candidate = match[1];
+      if (isPlaceholderToken(candidate)) continue;
+      const resolved = normalizeExtracted(candidate);
+      if (!isSafePath(resolved)) {
+        paths.push(resolved);
+      }
+    }
+  } else {
+    const absolutePattern = /(?:^|[\s=(])(\/[^\s"'|&;<>`()]+)/g;
+    while ((match = absolutePattern.exec(sanitized)) !== null) {
+      const candidate = match[1];
+      if (isPlaceholderToken(candidate)) continue;
+      if (looksLikeRegex(candidate)) continue;
+      const resolved = normalizeExtracted(candidate);
+      if (resolved === "/" || resolved === "") continue;
+      if (!isSafePath(resolved)) {
+        paths.push(resolved);
+      }
+    }
+  }
+  return [...new Set(paths)];
+}
+function extractSensitivePathsFromCommand(command) {
+  if (!command.trim()) {
+    return [];
+  }
+  const paths = [];
+  const quotedPattern = /["']([^"']+)["']/g;
+  let match;
+  while ((match = quotedPattern.exec(command)) !== null) {
+    const content = match[1];
+    if (isSensitivePath(content)) {
+      paths.push(content);
+    }
+  }
+  const unquoted = command.replace(/["'][^"']*["']/g, " ").replace(/[|&;><]/g, " ");
+  const tokens = unquoted.split(/\s+/).filter(Boolean);
+  for (const token of tokens) {
+    if (token.startsWith("-")) continue;
+    if (token.includes("://")) continue;
+    if (isSensitivePath(token)) {
+      paths.push(token);
+    }
+  }
+  return [...new Set(paths)];
+}
+function isSafePath(path) {
+  const normalized = posix.normalize(path);
+  return SAFE_PATHS.has(normalized);
+}
+async function checkPathsAccess(paths, workdir, sessionId) {
+  if (paths.length === 0) {
+    return { needsConfirmation: false, deniedPaths: [], sensitivePaths: [] };
+  }
+  const deniedPaths = [];
+  const sensitivePaths = [];
+  for (const path of paths) {
+    const result = await isPathWithinSandbox(path, workdir, sessionId);
+    if (!result.allowed) {
+      deniedPaths.push(result.resolvedPath);
+    }
+    if (isSensitivePath(path) && !isPathAllowed(sessionId ?? "", path)) {
+      sensitivePaths.push(result.resolvedPath);
+    }
+  }
+  const uniqueDenied = [...new Set(deniedPaths)];
+  const uniqueSensitive = [...new Set(sensitivePaths)];
+  return {
+    needsConfirmation: uniqueDenied.length > 0 || uniqueSensitive.length > 0,
+    deniedPaths: uniqueDenied,
+    sensitivePaths: uniqueSensitive
+  };
+}
+var DANGEROUS_PATTERNS = [
+  /sudo\s/,
+  /rm\s+(-rf?|--recursive)\s+[~]/,
+  /chmod\s+777/,
+  />\s*\/dev\/sd/,
+  /mkfs\s/,
+  /dd\s+if=/,
+  /:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;/
+];
+function extractDangerousPatterns(command) {
+  const dangerous = [];
+  for (const pattern of DANGEROUS_PATTERNS) {
+    if (pattern.test(command)) {
+      dangerous.push(pattern.source);
+    }
+  }
+  return dangerous;
+}
+function extractGitNoVerify(command) {
+  const subCommands = command.split(/\s*(?:&&|\|\||\||;)\s*/);
+  for (const sub of subCommands) {
+    const parts = sub.trim().split(/\s+/);
+    const gitIndex = parts.indexOf("git");
+    const subCmd = parts[gitIndex + 1];
+    if (gitIndex >= 0 && subCmd && !subCmd.startsWith("-")) {
+      const gitArgs = parts.slice(gitIndex + 2);
+      if (gitArgs.some((a) => a === "--no-verify" || a === "-n")) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+async function requestPathAccess(paths, workdir, sessionId, callId, tool, onEvent, dangerLevel, command, isSubAgent) {
+  if (isSubAgent) {
+    const result2 = await checkPathsAccess(paths, workdir, sessionId);
+    if (!result2.needsConfirmation) return;
+    if (dangerLevel === "dangerous") {
+      const allPaths2 = [.../* @__PURE__ */ new Set([...result2.deniedPaths, ...result2.sensitivePaths])];
+      addAllowedPaths(sessionId, allPaths2);
+      return;
+    }
+    const allPaths = [.../* @__PURE__ */ new Set([...result2.deniedPaths, ...result2.sensitivePaths])];
+    const hasDenied2 = result2.deniedPaths.length > 0;
+    const hasSensitive2 = result2.sensitivePaths.length > 0;
+    const reason2 = hasDenied2 && hasSensitive2 ? "both" : hasDenied2 ? "outside_workdir" : "sensitive_file";
+    throw new PathAccessDeniedError(allPaths, tool, reason2);
+  }
+  const emitPendingEvent = (confirmationPaths, confirmationReason) => {
+    try {
+      const eventStore = getEventStore();
+      eventStore.append(sessionId, {
+        type: "path.confirmation_pending",
+        data: { callId, tool, paths: confirmationPaths, workdir, reason: confirmationReason }
+      });
+    } catch {
+    }
+  };
+  if (command && extractGitNoVerify(command)) {
+    emitPendingEvent([workdir], "git_no_verify");
+    const confirmationPromise2 = registerPathConfirmation(callId, [workdir], sessionId, tool, workdir, "git_no_verify");
+    onEvent(createChatPathConfirmationMessage(callId, tool, ["git --no-verify detected"], workdir, "git_no_verify"));
+    const approved2 = await confirmationPromise2;
+    if (!approved2) {
+      throw new PathAccessDeniedError(
+        ["git --no-verify"],
+        tool,
+        "git_no_verify",
+        "User denied git command with --no-verify. The agent must not use --no-verify and must resolve the issue (e.g., fix lint errors, resolve conflicts) that prevents the commit."
+      );
+    }
+  }
+  if (dangerLevel !== "dangerous" && command) {
+    const dangerousPatterns = extractDangerousPatterns(command);
+    if (dangerousPatterns.length > 0) {
+      emitPendingEvent([workdir], "dangerous_command");
+      const confirmationPromise2 = registerPathConfirmation(
+        callId,
+        [workdir],
+        sessionId,
+        tool,
+        workdir,
+        "dangerous_command"
+      );
+      onEvent(
+        createChatPathConfirmationMessage(callId, tool, [dangerousPatterns.join(", ")], workdir, "dangerous_command")
+      );
+      const approved2 = await confirmationPromise2;
+      if (!approved2) {
+        throw new PathAccessDeniedError(dangerousPatterns, tool, "dangerous_command");
+      }
+    }
+  }
+  const result = await checkPathsAccess(paths, workdir, sessionId);
+  if (!result.needsConfirmation) {
+    return;
+  }
+  if (dangerLevel === "dangerous") {
+    const allPaths = [.../* @__PURE__ */ new Set([...result.deniedPaths, ...result.sensitivePaths])];
+    addAllowedPaths(sessionId, allPaths);
+    return;
+  }
+  const allPathsNeedingConfirmation = [.../* @__PURE__ */ new Set([...result.deniedPaths, ...result.sensitivePaths])];
+  const hasDenied = result.deniedPaths.length > 0;
+  const hasSensitive = result.sensitivePaths.length > 0;
+  const reason = hasDenied && hasSensitive ? "both" : hasDenied ? "outside_workdir" : "sensitive_file";
+  emitPendingEvent(allPathsNeedingConfirmation, reason);
+  const confirmationPromise = registerPathConfirmation(
+    callId,
+    allPathsNeedingConfirmation,
+    sessionId,
+    tool,
+    workdir,
+    reason
+  );
+  onEvent(createChatPathConfirmationMessage(callId, tool, allPathsNeedingConfirmation, workdir, reason));
+  const approved = await confirmationPromise;
+  if (!approved) {
+    throw new PathAccessDeniedError(allPathsNeedingConfirmation, tool, reason);
+  }
+}
+var PathAccessDeniedError = class extends Error {
+  constructor(paths, tool, reason = "outside_workdir", customMessage) {
+    const reasonText = reason === "sensitive_file" ? "sensitive files (may contain secrets)" : reason === "both" ? "paths outside workdir and sensitive files" : reason === "git_no_verify" ? "git commands with --no-verify" : "paths outside workdir";
+    super(customMessage ?? `User denied access to ${reasonText}: ${paths.join(", ")}`);
+    this.paths = paths;
+    this.tool = tool;
+    this.reason = reason;
+    this.customMessage = customMessage;
+    this.name = "PathAccessDeniedError";
+  }
+};
+var pendingConfirmations = /* @__PURE__ */ new Map();
+function registerPathConfirmation(callId, paths, sessionId, tool, workdir, reason) {
+  return new Promise((resolve2, reject) => {
+    pendingConfirmations.set(callId, { resolve: resolve2, reject, paths, sessionId, tool, workdir, reason });
+  });
+}
+function providePathConfirmation(callId, approved, alwaysAllow) {
+  const pending = pendingConfirmations.get(callId);
+  if (!pending) {
+    return { found: false };
+  }
+  try {
+    const eventStore = getEventStore();
+    eventStore.append(pending.sessionId, {
+      type: "path.confirmation_responded",
+      data: { callId, approved, alwaysAllow: alwaysAllow ?? false }
+    });
+  } catch {
+  }
+  if (approved) {
+    if (alwaysAllow) {
+      addAllowedPaths(pending.sessionId, pending.paths);
+    } else {
+      addAllowedPaths(pending.sessionId, pending.paths);
+    }
+  }
+  pending.resolve(approved);
+  pendingConfirmations.delete(callId);
+  return { found: true, sessionId: pending.sessionId, approved };
+}
+function cancelPathConfirmation(callId, reason) {
+  const pending = pendingConfirmations.get(callId);
+  if (!pending) {
+    return false;
+  }
+  pending.reject(new Error(reason));
+  pendingConfirmations.delete(callId);
+  return true;
+}
+function cancelPathConfirmationsForSession(sessionId, reason) {
+  let cancelledCount = 0;
+  for (const [callId, pending] of pendingConfirmations.entries()) {
+    if (pending.sessionId !== sessionId) {
+      continue;
+    }
+    pending.reject(new Error(reason));
+    pendingConfirmations.delete(callId);
+    cancelledCount += 1;
+  }
+  return cancelledCount;
+}
+function hasPendingPathConfirmation(callId) {
+  return pendingConfirmations.has(callId);
+}
+function getPendingConfirmationsBySession() {
+  const bySession = {};
+  for (const [_callId, pending] of pendingConfirmations.entries()) {
+    const entry = {
+      callId: _callId,
+      tool: pending.tool,
+      paths: pending.paths,
+      workdir: pending.workdir,
+      reason: pending.reason
+    };
+    const existing = bySession[pending.sessionId];
+    if (existing) {
+      existing.push(entry);
+    } else {
+      bySession[pending.sessionId] = [entry];
+    }
+  }
+  return bySession;
+}
+
+export {
+  isSensitivePath,
+  addAllowedPath,
+  addAllowedPaths,
+  isPathAllowed,
+  clearAllowedPaths,
+  isPathWithinSandbox,
+  extractAbsolutePathsFromCommand,
+  extractSensitivePathsFromCommand,
+  checkPathsAccess,
+  extractDangerousPatterns,
+  extractGitNoVerify,
+  requestPathAccess,
+  PathAccessDeniedError,
+  registerPathConfirmation,
+  providePathConfirmation,
+  cancelPathConfirmation,
+  cancelPathConfirmationsForSession,
+  hasPendingPathConfirmation,
+  getPendingConfirmationsBySession
+};
+//# sourceMappingURL=chunk-KEVRZWL3.js.map