patchwork-os 0.2.0-beta.3 → 0.2.0-beta.5

package/scripts/start-all.mjs

@@ -58,6 +58,56 @@ const DASH_DIR = path.join(BRIDGE_DIR, "dashboard");
 const DIST_INDEX = path.join(BRIDGE_DIR, "dist", "index.js");
 const IS_WIN = process.platform === "win32";
 
+// ── Security helpers ──────────────────────────────────────────────────────────
+// On Windows `\` is the path separator (e.g. `C:\Program Files\nodejs\node.exe`),
+// not a shell-injection vector. cmd.exe's actual metacharacters are
+// `^ & < > | ( )` — `\` does not need escaping. Including it in the regex
+// would reject every legitimate Windows path that spawnProc validates
+// (process.execPath, npm.cmd, npx.cmd, etc.) and fail-stop the whole script.
+// Same fix that PR #525 applied to vscode-extension/src/bridgeProcess.ts.
+const SHELL_METACHARACTERS = IS_WIN
+  ? /[;&|`$(){}[\]<>"'\n\r]/
+  : /[;&|`$(){}[\]<>"'\\\n\r]/;
+
+/**
+ * Validate that a command path is safe to execute.
+ * Prevents command injection by checking for shell metacharacters.
+ * @param {string} cmdPath - Path to validate
+ * @param {string} label - Label for error messages
+ * @throws {Error} If path contains shell metacharacters or is empty
+ */
+function validateCommandPath(cmdPath, label) {
+  if (!cmdPath || typeof cmdPath !== "string") {
+    throw new Error(`${label}: command path is empty or invalid`);
+  }
+  if (SHELL_METACHARACTERS.test(cmdPath)) {
+    throw new Error(
+      `${label}: command path contains shell metacharacters: ${cmdPath}`,
+    );
+  }
+  // Additional check: on Windows, .cmd files are allowed but must not have spaces without proper quoting
+  if (IS_WIN && cmdPath.endsWith(".cmd") && cmdPath.includes(" ")) {
+    // This is handled by using cmd.exe explicitly, not shell:true
+    // We validate the path doesn't have injection chars above
+  }
+}
+
+/**
+ * Validate command arguments don't contain injection vectors.
+ * @param {string[]} args - Arguments to validate
+ * @param {string} label - Label for error messages
+ */
+function validateCommandArgs(args, label) {
+  if (!Array.isArray(args)) {
+    throw new Error(`${label}: arguments must be an array`);
+  }
+  for (const arg of args) {
+    if (typeof arg !== "string") {
+      throw new Error(`${label}: all arguments must be strings`);
+    }
+  }
+}
+
 // ── Colour helpers ────────────────────────────────────────────────────────────
 const C = {
   cyan: (s) => `\x1b[36m${s}\x1b[0m`,
@@ -98,6 +148,10 @@ function notify(msg, priority = "default") {
 const procs = new Map(); // name → ChildProcess
 
 function spawnProc(name, cmd, cmdArgs, opts = {}) {
+  // Validate command and arguments to prevent injection attacks
+  validateCommandPath(cmd, `spawnProc[${name}]`);
+  validateCommandArgs(cmdArgs, `spawnProc[${name}]`);
+
   // shell:false everywhere — on Windows we always invoke cmd.exe explicitly
   // for .cmd shim resolution, so shell:true would only widen the attack
   // surface by interpolating env-derived paths into a shell string.
@@ -238,7 +292,12 @@ function readLock(lockPath) {
 function bridgeBin() {
   if (fs.existsSync(DIST_INDEX)) return [process.execPath, [DIST_INDEX]];
   const srcIndex = path.join(BRIDGE_DIR, "src", "index.ts");
-  if (fs.existsSync(srcIndex)) return ["npx", ["tsx", srcIndex]];
+  if (fs.existsSync(srcIndex)) {
+    // On Windows the spawnProc helper uses shell:false, so we must point at
+    // the .cmd shim directly — bare "npx" would ENOENT.
+    const npx = IS_WIN ? "npx.cmd" : "npx";
+    return [npx, ["tsx", srcIndex]];
+  }
   console.error("Error: dist/index.js not found. Run 'npm run build' first.");
   process.exit(1);
 }

package/scripts/start-all.ps1

@@ -1,209 +1,209 @@
-#Requires -Version 5.1
-<#
-.SYNOPSIS
-    Windows orchestrator for bridge + Claude + Patchwork dashboard.
-
-.DESCRIPTION
-    Cross-platform alternative to start-all.sh for native Windows (PowerShell/cmd).
-    Starts the bridge, waits for the lock file, launches Claude --ide, and
-    optionally starts the Patchwork dashboard dev server and opens it in the browser.
-
-    Run via npm:
-        npm run start:bridge          # bridge only (simplest)
-        npm run start-all:win         # full orchestrator (bridge + claude + dashboard)
-
-    Or directly:
-        pwsh -File scripts\start-all.ps1
-        pwsh -File scripts\start-all.ps1 --no-dashboard
-        pwsh -File scripts\start-all.ps1 --workspace C:\my\project --dashboard-port 3200
-
-.PARAMETER Workspace
-    Directory to open in Claude (default: current directory).
-
-.PARAMETER Full
-    Pass --full to the bridge, registering all ~95 tools including git/terminal/file ops.
-    Default is slim mode (27 IDE-exclusive tools).
-
-.PARAMETER NoDashboard
-    Skip starting the Patchwork dashboard.
-
-.PARAMETER DashboardPort
-    Port for the Next.js dashboard dev server (default: 3200).
-
-.PARAMETER BridgePort
-    Port for the bridge (default: auto-assigned via lock file).
-
-.PARAMETER Notify
-    ntfy.sh topic for push notifications (optional).
-#>
-[CmdletBinding()]
-param(
-    [string]$Workspace       = ".",
-    [switch]$Full,
-    [switch]$NoDashboard,
-    [int]   $DashboardPort   = 3200,
-    [int]   $BridgePort      = 0,
-    [string]$Notify          = ""
-)
-
-Set-StrictMode -Version Latest
-$ErrorActionPreference = "Stop"
-
-# ── Resolve paths ─────────────────────────────────────────────────────────────
-$ScriptDir   = Split-Path -Parent $MyInvocation.MyCommand.Path
-$BridgeDir   = Split-Path -Parent $ScriptDir
-$DashboardDir = Join-Path $BridgeDir "dashboard"
-
-try {
-    $Workspace = (Resolve-Path $Workspace).Path
-} catch {
-    Write-Error "Workspace directory not found: $Workspace"
-    exit 1
-}
-
-# ── Helpers ───────────────────────────────────────────────────────────────────
-function Write-Status($msg) { Write-Host "[orchestrator] $msg" -ForegroundColor Cyan }
-function Write-Ok($msg)     { Write-Host "[ok] $msg"           -ForegroundColor Green }
-function Write-Warn($msg)   { Write-Host "[warn] $msg"         -ForegroundColor Yellow }
-
-function Send-Notify($msg) {
-    if (-not $Notify) { return }
-    try {
-        Invoke-RestMethod -Uri "https://ntfy.sh/$Notify" -Method Post -Body $msg -TimeoutSec 5 | Out-Null
-    } catch { Write-Warn "ntfy notification failed: $_" }
-}
-
-# ── Track child processes for cleanup ─────────────────────────────────────────
-$Jobs = [System.Collections.Generic.List[System.Diagnostics.Process]]::new()
-
-function Stop-AllJobs {
-    foreach ($p in $Jobs) {
-        if (-not $p.HasExited) {
-            try { $p.Kill($true) } catch { }
-        }
-    }
-}
-
-# Clean up on Ctrl+C or exit
-$null = Register-EngineEvent -SourceIdentifier PowerShell.Exiting -Action { Stop-AllJobs }
-try { [Console]::TreatControlCAsInput = $false } catch { }
-
-# ── Build bridge args ─────────────────────────────────────────────────────────
-$BridgeArgs = @("--workspace", $Workspace)
-if ($BridgePort -gt 0) { $BridgeArgs += @("--port", $BridgePort) }
-if ($Full)             { $BridgeArgs += "--full" }
-
-# ── Start bridge ──────────────────────────────────────────────────────────────
-Write-Status "Starting bridge (workspace: $Workspace)..."
-
-$BridgeInfo = New-Object System.Diagnostics.ProcessStartInfo
-$BridgeInfo.UseShellExecute = $false
-# On Windows, npm global bins are .cmd wrappers — must invoke via cmd.exe.
-# Quote each argument so workspace paths with spaces (e.g. "C:\Users\Jane Doe\...") survive.
-$BridgeInfo.FileName  = "cmd.exe"
-$quotedArgs = $BridgeArgs | ForEach-Object { if ($_ -match '\s') { "`"$_`"" } else { $_ } }
-$BridgeInfo.Arguments = "/c claude-ide-bridge " + ($quotedArgs -join " ")
-
-$BridgeProc = [System.Diagnostics.Process]::Start($BridgeInfo)
-$Jobs.Add($BridgeProc)
-
-# ── Wait for lock file ────────────────────────────────────────────────────────
-Write-Status "Waiting for bridge lock file..."
-$ClaudeBase = if ($env:CLAUDE_CONFIG_DIR) { $env:CLAUDE_CONFIG_DIR } else { Join-Path $env:USERPROFILE ".claude" }
-$IdeDir  = Join-Path $ClaudeBase "ide"
-$Deadline = (Get-Date).AddSeconds(30)
-$LockFile = $null
-
-while ((Get-Date) -lt $Deadline) {
-    $locks = Get-ChildItem -Path $IdeDir -Filter "*.lock" -ErrorAction SilentlyContinue |
-             Where-Object { $_.LastWriteTime -gt (Get-Date).AddSeconds(-60) }
-    if ($locks) {
-        # Find the lock that matches our workspace
-        foreach ($lf in $locks) {
-            try {
-                $content = Get-Content $lf.FullName -Raw | ConvertFrom-Json
-                if ($content.isBridge -and
-                    ($content.workspace -replace '\\','/' ) -eq ($Workspace -replace '\\','/')) {
-                    $LockFile = $lf
-                    $DetectedPort = [int][System.IO.Path]::GetFileNameWithoutExtension($lf.Name)
-                    break
-                }
-            } catch { }
-        }
-        if ($LockFile) { break }
-    }
-    Start-Sleep -Milliseconds 200
-}
-
-if (-not $LockFile) {
-    Write-Error "Bridge lock file not written after 30s. Bridge may have failed to start."
-    Stop-AllJobs
-    exit 1
-}
-
-Write-Ok "Bridge ready on port $DetectedPort"
-Send-Notify "Bridge started on port $DetectedPort"
-
-# ── Start Claude --ide ────────────────────────────────────────────────────────
-Write-Status "Starting claude --ide..."
-$ClaudeInfo = New-Object System.Diagnostics.ProcessStartInfo
-$ClaudeInfo.FileName  = "cmd.exe"
-$ClaudeInfo.Arguments = "/c claude --ide"
-$ClaudeInfo.UseShellExecute = $false
-$ClaudeProc = [System.Diagnostics.Process]::Start($ClaudeInfo)
-$Jobs.Add($ClaudeProc)
-
-# ── Start dashboard ───────────────────────────────────────────────────────────
-$DashProc = $null
-if (-not $NoDashboard) {
-    if (-not (Test-Path (Join-Path $DashboardDir "node_modules"))) {
-        Write-Warn "dashboard/node_modules not found. Run 'npm ci' in the dashboard directory first, or pass -NoDashboard."
-    } else {
-        Write-Status "Starting dashboard on http://localhost:$DashboardPort ..."
-
-        $env:PATCHWORK_BRIDGE_PORT = $DetectedPort
-        $DashInfo = New-Object System.Diagnostics.ProcessStartInfo
-        $DashInfo.FileName         = "cmd.exe"
-        $DashInfo.Arguments        = "/c npx next dev -p $DashboardPort"
-        $DashInfo.WorkingDirectory = $DashboardDir
-        $DashInfo.UseShellExecute  = $false
-        $DashProc = [System.Diagnostics.Process]::Start($DashInfo)
-        $Jobs.Add($DashProc)
-
-        # Poll until Next.js answers, then open the browser
-        $DashUrl     = "http://localhost:$DashboardPort"
-        $DashDeadline = (Get-Date).AddSeconds(60)
-        $Opened = $false
-        while ((Get-Date) -lt $DashDeadline) {
-            try {
-                $r = Invoke-WebRequest -Uri $DashUrl -UseBasicParsing -TimeoutSec 1 -ErrorAction Stop
-                if ($r.StatusCode -lt 500) {
-                    Write-Ok "Dashboard ready — opening $DashUrl"
-                    Start-Process $DashUrl   # opens default browser on Windows
-                    $Opened = $true
-                    break
-                }
-            } catch { }
-            Start-Sleep -Milliseconds 1000
-        }
-        if (-not $Opened) {
-            Write-Warn "Dashboard did not respond within 60s — open $DashUrl manually."
-        }
-    }
-}
-
-# ── Wait ──────────────────────────────────────────────────────────────────────
-Write-Host ""
-Write-Ok "All processes started. Press Ctrl+C to stop."
-Write-Host "  Bridge PID : $($BridgeProc.Id)"
-Write-Host "  Claude PID : $($ClaudeProc.Id)"
-if ($DashProc) { Write-Host "  Dashboard  : http://localhost:$DashboardPort (PID $($DashProc.Id))" }
-Write-Host ""
-
-try {
-    # Block until the bridge exits (primary process)
-    $BridgeProc.WaitForExit()
-} finally {
-    Write-Status "Bridge exited — stopping all processes..."
-    Stop-AllJobs
-}
+#Requires -Version 5.1
+<#
+.SYNOPSIS
+    Windows orchestrator for bridge + Claude + Patchwork dashboard.
+
+.DESCRIPTION
+    Cross-platform alternative to start-all.sh for native Windows (PowerShell/cmd).
+    Starts the bridge, waits for the lock file, launches Claude --ide, and
+    optionally starts the Patchwork dashboard dev server and opens it in the browser.
+
+    Run via npm:
+        npm run start:bridge          # bridge only (simplest)
+        npm run start-all:win         # full orchestrator (bridge + claude + dashboard)
+
+    Or directly:
+        pwsh -File scripts\start-all.ps1
+        pwsh -File scripts\start-all.ps1 --no-dashboard
+        pwsh -File scripts\start-all.ps1 --workspace C:\my\project --dashboard-port 3200
+
+.PARAMETER Workspace
+    Directory to open in Claude (default: current directory).
+
+.PARAMETER Full
+    Pass --full to the bridge, registering all ~95 tools including git/terminal/file ops.
+    Default is slim mode (27 IDE-exclusive tools).
+
+.PARAMETER NoDashboard
+    Skip starting the Patchwork dashboard.
+
+.PARAMETER DashboardPort
+    Port for the Next.js dashboard dev server (default: 3200).
+
+.PARAMETER BridgePort
+    Port for the bridge (default: auto-assigned via lock file).
+
+.PARAMETER Notify
+    ntfy.sh topic for push notifications (optional).
+#>
+[CmdletBinding()]
+param(
+    [string]$Workspace       = ".",
+    [switch]$Full,
+    [switch]$NoDashboard,
+    [int]   $DashboardPort   = 3200,
+    [int]   $BridgePort      = 0,
+    [string]$Notify          = ""
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = "Stop"
+
+# ── Resolve paths ─────────────────────────────────────────────────────────────
+$ScriptDir   = Split-Path -Parent $MyInvocation.MyCommand.Path
+$BridgeDir   = Split-Path -Parent $ScriptDir
+$DashboardDir = Join-Path $BridgeDir "dashboard"
+
+try {
+    $Workspace = (Resolve-Path $Workspace).Path
+} catch {
+    Write-Error "Workspace directory not found: $Workspace"
+    exit 1
+}
+
+# ── Helpers ───────────────────────────────────────────────────────────────────
+function Write-Status($msg) { Write-Host "[orchestrator] $msg" -ForegroundColor Cyan }
+function Write-Ok($msg)     { Write-Host "[ok] $msg"           -ForegroundColor Green }
+function Write-Warn($msg)   { Write-Host "[warn] $msg"         -ForegroundColor Yellow }
+
+function Send-Notify($msg) {
+    if (-not $Notify) { return }
+    try {
+        Invoke-RestMethod -Uri "https://ntfy.sh/$Notify" -Method Post -Body $msg -TimeoutSec 5 | Out-Null
+    } catch { Write-Warn "ntfy notification failed: $_" }
+}
+
+# ── Track child processes for cleanup ─────────────────────────────────────────
+$Jobs = [System.Collections.Generic.List[System.Diagnostics.Process]]::new()
+
+function Stop-AllJobs {
+    foreach ($p in $Jobs) {
+        if (-not $p.HasExited) {
+            try { $p.Kill($true) } catch { }
+        }
+    }
+}
+
+# Clean up on Ctrl+C or exit
+$null = Register-EngineEvent -SourceIdentifier PowerShell.Exiting -Action { Stop-AllJobs }
+try { [Console]::TreatControlCAsInput = $false } catch { }
+
+# ── Build bridge args ─────────────────────────────────────────────────────────
+$BridgeArgs = @("--workspace", $Workspace)
+if ($BridgePort -gt 0) { $BridgeArgs += @("--port", $BridgePort) }
+if ($Full)             { $BridgeArgs += "--full" }
+
+# ── Start bridge ──────────────────────────────────────────────────────────────
+Write-Status "Starting bridge (workspace: $Workspace)..."
+
+$BridgeInfo = New-Object System.Diagnostics.ProcessStartInfo
+$BridgeInfo.UseShellExecute = $false
+# On Windows, npm global bins are .cmd wrappers — must invoke via cmd.exe.
+# Quote each argument so workspace paths with spaces (e.g. "C:\Users\Jane Doe\...") survive.
+$BridgeInfo.FileName  = "cmd.exe"
+$quotedArgs = $BridgeArgs | ForEach-Object { if ($_ -match '\s') { "`"$_`"" } else { $_ } }
+$BridgeInfo.Arguments = "/c claude-ide-bridge " + ($quotedArgs -join " ")
+
+$BridgeProc = [System.Diagnostics.Process]::Start($BridgeInfo)
+$Jobs.Add($BridgeProc)
+
+# ── Wait for lock file ────────────────────────────────────────────────────────
+Write-Status "Waiting for bridge lock file..."
+$ClaudeBase = if ($env:CLAUDE_CONFIG_DIR) { $env:CLAUDE_CONFIG_DIR } else { Join-Path $env:USERPROFILE ".claude" }
+$IdeDir  = Join-Path $ClaudeBase "ide"
+$Deadline = (Get-Date).AddSeconds(30)
+$LockFile = $null
+
+while ((Get-Date) -lt $Deadline) {
+    $locks = Get-ChildItem -Path $IdeDir -Filter "*.lock" -ErrorAction SilentlyContinue |
+             Where-Object { $_.LastWriteTime -gt (Get-Date).AddSeconds(-60) }
+    if ($locks) {
+        # Find the lock that matches our workspace
+        foreach ($lf in $locks) {
+            try {
+                $content = Get-Content $lf.FullName -Raw | ConvertFrom-Json
+                if ($content.isBridge -and
+                    ($content.workspace -replace '\\','/' ) -eq ($Workspace -replace '\\','/')) {
+                    $LockFile = $lf
+                    $DetectedPort = [int][System.IO.Path]::GetFileNameWithoutExtension($lf.Name)
+                    break
+                }
+            } catch { }
+        }
+        if ($LockFile) { break }
+    }
+    Start-Sleep -Milliseconds 200
+}
+
+if (-not $LockFile) {
+    Write-Error "Bridge lock file not written after 30s. Bridge may have failed to start."
+    Stop-AllJobs
+    exit 1
+}
+
+Write-Ok "Bridge ready on port $DetectedPort"
+Send-Notify "Bridge started on port $DetectedPort"
+
+# ── Start Claude --ide ────────────────────────────────────────────────────────
+Write-Status "Starting claude --ide..."
+$ClaudeInfo = New-Object System.Diagnostics.ProcessStartInfo
+$ClaudeInfo.FileName  = "cmd.exe"
+$ClaudeInfo.Arguments = "/c claude --ide"
+$ClaudeInfo.UseShellExecute = $false
+$ClaudeProc = [System.Diagnostics.Process]::Start($ClaudeInfo)
+$Jobs.Add($ClaudeProc)
+
+# ── Start dashboard ───────────────────────────────────────────────────────────
+$DashProc = $null
+if (-not $NoDashboard) {
+    if (-not (Test-Path (Join-Path $DashboardDir "node_modules"))) {
+        Write-Warn "dashboard/node_modules not found. Run 'npm ci' in the dashboard directory first, or pass -NoDashboard."
+    } else {
+        Write-Status "Starting dashboard on http://localhost:$DashboardPort ..."
+
+        $env:PATCHWORK_BRIDGE_PORT = $DetectedPort
+        $DashInfo = New-Object System.Diagnostics.ProcessStartInfo
+        $DashInfo.FileName         = "cmd.exe"
+        $DashInfo.Arguments        = "/c npx next dev -p $DashboardPort"
+        $DashInfo.WorkingDirectory = $DashboardDir
+        $DashInfo.UseShellExecute  = $false
+        $DashProc = [System.Diagnostics.Process]::Start($DashInfo)
+        $Jobs.Add($DashProc)
+
+        # Poll until Next.js answers, then open the browser
+        $DashUrl     = "http://localhost:$DashboardPort"
+        $DashDeadline = (Get-Date).AddSeconds(60)
+        $Opened = $false
+        while ((Get-Date) -lt $DashDeadline) {
+            try {
+                $r = Invoke-WebRequest -Uri $DashUrl -UseBasicParsing -TimeoutSec 1 -ErrorAction Stop
+                if ($r.StatusCode -lt 500) {
+                    Write-Ok "Dashboard ready — opening $DashUrl"
+                    Start-Process $DashUrl   # opens default browser on Windows
+                    $Opened = $true
+                    break
+                }
+            } catch { }
+            Start-Sleep -Milliseconds 1000
+        }
+        if (-not $Opened) {
+            Write-Warn "Dashboard did not respond within 60s — open $DashUrl manually."
+        }
+    }
+}
+
+# ── Wait ──────────────────────────────────────────────────────────────────────
+Write-Host ""
+Write-Ok "All processes started. Press Ctrl+C to stop."
+Write-Host "  Bridge PID : $($BridgeProc.Id)"
+Write-Host "  Claude PID : $($ClaudeProc.Id)"
+if ($DashProc) { Write-Host "  Dashboard  : http://localhost:$DashboardPort (PID $($DashProc.Id))" }
+Write-Host ""
+
+try {
+    # Block until the bridge exits (primary process)
+    $BridgeProc.WaitForExit()
+} finally {
+    Write-Status "Bridge exited — stopping all processes..."
+    Stop-AllJobs
+}