pptb-standard-sample-tool 1.1.2 → 1.1.5

package/dist/features/filesystem.js

@@ -0,0 +1,291 @@
+import { readTextWithPolicyGuard } from "../security/policy.js";
+export function createFileSystemFeature(deps) {
+    async function saveDataToFile() {
+        try {
+            const conn = deps.getCurrentConnection();
+            const data = {
+                timestamp: new Date().toISOString(),
+                connection: conn
+                    ? {
+                        name: conn.name,
+                        url: conn.url,
+                        environment: conn.environment,
+                    }
+                    : null,
+                message: "Export from HTML Sample Tool",
+            };
+            const filePath = await deps.toolbox.fileSystem.saveFile("sample-export.json", JSON.stringify(data, null, 2));
+            if (filePath) {
+                await deps.showNotification("File Saved", `File saved to: ${filePath}`, "success");
+                deps.log(`File saved to: ${filePath}`, "success");
+            }
+            else {
+                deps.log("File save cancelled", "info");
+            }
+        }
+        catch (error) {
+            deps.log(`Error saving file: ${error.message}`, "error");
+        }
+    }
+    async function readText() {
+        try {
+            const output = document.getElementById("filesystem-output");
+            if (output)
+                output.textContent = "Selecting text file...\n";
+            const filePath = await deps.toolbox.fileSystem.selectPath({
+                type: "file",
+                title: "Select a Text File",
+                filters: [
+                    { name: "Text Files", extensions: ["txt", "json", "xml", "csv", "md"] },
+                    { name: "All Files", extensions: ["*"] },
+                ],
+            });
+            if (!filePath) {
+                if (output)
+                    output.textContent = "File selection cancelled.";
+                deps.log("File selection cancelled", "info");
+                return;
+            }
+            if (output)
+                output.textContent = `Reading file: ${filePath}\n\n`;
+            const content = await readTextWithPolicyGuard(deps.toolbox, filePath);
+            if (output) {
+                output.textContent += `File Size: ${content.length} characters\n\n`;
+                output.textContent += "Content:\n";
+                output.textContent += "─".repeat(50) + "\n";
+                output.textContent += content;
+            }
+            await deps.showNotification("Success", `File read successfully (${content.length} characters)`, "success");
+            deps.log(`Read text file: ${filePath} (${content.length} chars)`, "success");
+        }
+        catch (error) {
+            const output = document.getElementById("filesystem-output");
+            if (output)
+                output.textContent = `Error: ${error.message}`;
+            deps.log(`Error reading text file: ${error.message}`, "error");
+        }
+    }
+    async function readDirectory() {
+        try {
+            const output = document.getElementById("filesystem-output");
+            if (output)
+                output.textContent = "Selecting directory...\n";
+            const dirPath = await deps.toolbox.fileSystem.selectPath({
+                type: "folder",
+                title: "Select a Directory",
+            });
+            if (!dirPath) {
+                if (output)
+                    output.textContent = "Directory selection cancelled.";
+                deps.log("Directory selection cancelled", "info");
+                return;
+            }
+            if (output)
+                output.textContent = `Reading directory: ${dirPath}\n\n`;
+            const entries = await deps.toolbox.fileSystem.readDirectory(dirPath);
+            const directories = entries.filter((e) => e.type === "directory");
+            const files = entries.filter((e) => e.type === "file");
+            if (output) {
+                output.textContent += `Found ${entries.length} entries:\n`;
+                output.textContent += "─".repeat(50) + "\n";
+                if (directories.length > 0) {
+                    output.textContent += `\nDirectories (${directories.length}):\n`;
+                    directories.forEach((entry) => {
+                        output.textContent += `  📁 ${entry.name}\n`;
+                    });
+                }
+                if (files.length > 0) {
+                    output.textContent += `\nFiles (${files.length}):\n`;
+                    files.forEach((entry) => {
+                        output.textContent += `  📄 ${entry.name}\n`;
+                    });
+                }
+            }
+            await deps.showNotification("Success", `Directory read successfully (${entries.length} entries)`, "success");
+            deps.log(`Read directory: ${dirPath} (${entries.length} entries: ${directories.length} dirs, ${files.length} files)`, "success");
+        }
+        catch (error) {
+            const output = document.getElementById("filesystem-output");
+            if (output)
+                output.textContent = `Error: ${error.message}`;
+            deps.log(`Error reading directory: ${error.message}`, "error");
+        }
+    }
+    async function createDirectory() {
+        try {
+            const output = document.getElementById("filesystem-output");
+            if (output)
+                output.textContent = "Selecting parent directory...\n";
+            const parentPath = await deps.toolbox.fileSystem.selectPath({
+                type: "folder",
+                title: "Select Parent Directory",
+            });
+            if (!parentPath) {
+                if (output)
+                    output.textContent = "Directory selection cancelled.";
+                deps.log("Directory selection cancelled", "info");
+                return;
+            }
+            const dirName = prompt("Enter new directory name:", "new-folder");
+            if (!dirName || dirName.trim() === "") {
+                if (output)
+                    output.textContent = "Directory creation cancelled.";
+                deps.log("Directory creation cancelled", "info");
+                return;
+            }
+            const newDirPath = `${parentPath}/${dirName.trim()}`;
+            if (output)
+                output.textContent = `Creating directory: ${newDirPath}\n`;
+            await deps.toolbox.fileSystem.createDirectory(newDirPath);
+            if (output) {
+                output.textContent += "✓ Directory created successfully!\n";
+                output.textContent += `Path: ${newDirPath}`;
+            }
+            await deps.showNotification("Success", `Directory created: ${newDirPath}`, "success");
+            deps.log(`Created directory: ${newDirPath}`, "success");
+        }
+        catch (error) {
+            const output = document.getElementById("filesystem-output");
+            if (output)
+                output.textContent = `Error: ${error.message}`;
+            deps.log(`Error creating directory: ${error.message}`, "error");
+        }
+    }
+    async function readSystemFile() {
+        try {
+            const output = document.getElementById("filesystem-output");
+            const systemFilePath = "/var/log/system.log";
+            if (output)
+                output.textContent = `Attempting to read system file: ${systemFilePath}\n\n`;
+            deps.log(`Attempting to read system file: ${systemFilePath}`, "info");
+            const content = await readTextWithPolicyGuard(deps.toolbox, systemFilePath);
+            if (output) {
+                output.textContent += `File Size: ${content.length} characters\n\n`;
+                output.textContent += "Content (first 1000 chars):\n";
+                output.textContent += "─".repeat(50) + "\n";
+                output.textContent += content.substring(0, 1000);
+                if (content.length > 1000) {
+                    output.textContent += "\n\n... (truncated)";
+                }
+            }
+            await deps.showNotification("Success", `System file read (${content.length} characters)`, "success");
+            deps.log(`Successfully read system file: ${systemFilePath}`, "success");
+        }
+        catch (error) {
+            const output = document.getElementById("filesystem-output");
+            const errorMsg = error.message;
+            if (output) {
+                output.textContent = `❌ Error Reading System File\n`;
+                output.textContent += `Path: /var/log/system.log\n\n`;
+                output.textContent += `Error: ${errorMsg}\n\n`;
+                output.textContent += "This is expected - system files are typically restricted due to:\n";
+                output.textContent += "- File permissions (insufficient access)\n";
+                output.textContent += "- Security restrictions\n";
+                output.textContent += "- Sandbox limitations";
+            }
+            deps.log(`Error reading system file: ${errorMsg}`, "error");
+            await deps.showNotification("Error Reading System File", errorMsg, "error");
+        }
+    }
+    async function readHardcodedFile() {
+        try {
+            const output = document.getElementById("filesystem-output");
+            if (output)
+                output.textContent = "Opening file selection dialog...\n";
+            deps.log("Opening file selection dialog", "info");
+            const selectedPath = await deps.toolbox.fileSystem.selectPath({
+                type: "file",
+                title: "Select a File (will be ignored)",
+                filters: [{ name: "All Files", extensions: ["*"] }],
+            });
+            if (!selectedPath) {
+                if (output)
+                    output.textContent = "File selection cancelled.";
+                deps.log("File selection cancelled", "info");
+                return;
+            }
+            if (output) {
+                output.textContent = `User selected: ${selectedPath}\n\n`;
+                output.textContent += "But we're ignoring that and attempting to read a hardcoded system path instead...\n\n";
+                output.textContent += "─".repeat(50) + "\n\n";
+            }
+            deps.log(`User selected: ${selectedPath} (will be ignored)`, "info");
+            const hardcodedPath = "/etc/passwd";
+            if (output)
+                output.textContent += `Attempting to read hardcoded path: ${hardcodedPath}\n\n`;
+            deps.log(`Attempting to read hardcoded path: ${hardcodedPath}`, "info");
+            const content = await readTextWithPolicyGuard(deps.toolbox, hardcodedPath);
+            if (output) {
+                output.textContent += `✓ Success! File Size: ${content.length} characters\n\n`;
+                output.textContent += "Content:\n";
+                output.textContent += "─".repeat(50) + "\n";
+                output.textContent += content.substring(0, 1500);
+                if (content.length > 1500) {
+                    output.textContent += "\n\n... (truncated)";
+                }
+            }
+            await deps.showNotification("File Read Successfully", `Hardcoded file read: ${hardcodedPath} (${content.length} characters)`, "success");
+            deps.log(`Successfully read hardcoded file: ${hardcodedPath}`, "success");
+        }
+        catch (error) {
+            const output = document.getElementById("filesystem-output");
+            const errorMsg = error.message;
+            if (output) {
+                output.textContent += `❌ Error Reading Hardcoded File\n`;
+                output.textContent += `Path: /etc/passwd\n\n`;
+                output.textContent += `Error: ${errorMsg}\n\n`;
+                output.textContent += "This demonstrates that hardcoded system paths are typically restricted:\n";
+                output.textContent += "- Permission denied (macOS sandbox restrictions)\n";
+                output.textContent += "- The file picker selected a different path, but we tried to read this one instead\n";
+                output.textContent += "- Real-world use case: don't hardcode paths, always use user selection";
+            }
+            deps.log(`Error reading hardcoded file: ${errorMsg}`, "error");
+            await deps.showNotification("Error Reading Hardcoded File", errorMsg, "error");
+        }
+    }
+    async function readDirectFile() {
+        try {
+            const output = document.getElementById("filesystem-output");
+            const hardcodedPath = "/etc/hosts";
+            if (output)
+                output.textContent = `Reading hardcoded path directly (no dialog)...\n`;
+            if (output)
+                output.textContent += `Path: ${hardcodedPath}\n\n`;
+            deps.log(`Attempting direct read of hardcoded path: ${hardcodedPath}`, "info");
+            const content = await readTextWithPolicyGuard(deps.toolbox, hardcodedPath);
+            if (output) {
+                output.textContent += `✓ Success! File Size: ${content.length} characters\n\n`;
+                output.textContent += "Content:\n";
+                output.textContent += "─".repeat(50) + "\n";
+                output.textContent += content;
+            }
+            await deps.showNotification("File Read Successfully", `Direct file read: ${hardcodedPath} (${content.length} characters)`, "success");
+            deps.log(`Successfully read direct file: ${hardcodedPath}`, "success");
+        }
+        catch (error) {
+            const output = document.getElementById("filesystem-output");
+            const errorMsg = error.message;
+            if (output) {
+                output.textContent = `❌ Error Reading Hardcoded Path\n`;
+                output.textContent += `Path: /etc/hosts\n`;
+                output.textContent += `Method: Direct read (no selectPath dialog)\n\n`;
+                output.textContent += `Error: ${errorMsg}\n\n`;
+                output.textContent += "This demonstrates:\n";
+                output.textContent += "- System files are protected even with hardcoded paths\n";
+                output.textContent += "- No file picker dialog was used\n";
+                output.textContent += "- Security restrictions apply to all file access attempts";
+            }
+            deps.log(`Error reading direct file: ${errorMsg}`, "error");
+            await deps.showNotification("Error Reading Direct File", errorMsg, "error");
+        }
+    }
+    return {
+        saveDataToFile,
+        readText,
+        readDirectory,
+        createDirectory,
+        readSystemFile,
+        readHardcodedFile,
+        readDirectFile,
+    };
+}

package/dist/features/terminal.js

@@ -0,0 +1,141 @@
+import { executeCommandWithPolicyGuard } from "../security/policy.js";
+import { delay } from "../utils/time.js";
+export function createTerminalFeature(deps) {
+    async function createTerminal() {
+        try {
+            const terminal = await deps.toolbox.terminal.create({
+                name: "HTML Sample Terminal",
+            });
+            deps.setCurrentTerminal(terminal);
+            deps.log(`Terminal created: ${terminal.name} (${terminal.id})`, "success");
+            const executeBtn = document.getElementById("execute-command-btn");
+            const probeBtn = document.getElementById("run-security-probe-btn");
+            const closeBtn = document.getElementById("close-terminal-btn");
+            if (executeBtn)
+                executeBtn.disabled = false;
+            if (probeBtn)
+                probeBtn.disabled = false;
+            if (closeBtn)
+                closeBtn.disabled = false;
+            await deps.showNotification("Terminal Created", `Terminal ${terminal.name} is ready`, "success");
+        }
+        catch (error) {
+            deps.log(`Error creating terminal: ${error.message}`, "error");
+        }
+    }
+    async function executeTerminalCommand() {
+        const terminal = deps.getCurrentTerminal();
+        if (!terminal) {
+            await deps.showNotification("No Terminal", "Please create a terminal first", "warning");
+            return;
+        }
+        try {
+            const isWindows = navigator.platform.toLowerCase().includes("win");
+            const command = isWindows ? "dir" : "ls -la";
+            const output = document.getElementById("terminal-output");
+            if (output)
+                output.textContent = `> ${command}\n`;
+            deps.log(`Executing command: ${command}`, "info");
+            await executeCommandWithPolicyGuard(deps.toolbox, terminal.id, command);
+        }
+        catch (error) {
+            deps.log(`Error executing command: ${error.message}`, "error");
+        }
+    }
+    async function runTerminalSecurityProbe() {
+        try {
+            if (!deps.getCurrentTerminal()) {
+                await createTerminal();
+            }
+            const terminal = deps.getCurrentTerminal();
+            if (!terminal) {
+                await deps.showNotification("Terminal Unavailable", "Unable to create terminal for probe", "error");
+                return;
+            }
+            const output = document.getElementById("terminal-output");
+            const isWindows = navigator.platform.toLowerCase().includes("win");
+            const probeCommands = isWindows
+                ? ["echo PPTB_SECURITY_PROBE", "Get-Location", "$PSVersionTable.PSVersion.ToString()", 'Write-Output "CHAIN_TEST"; Write-Output "SECOND_COMMAND"']
+                : ["echo PPTB_SECURITY_PROBE", "pwd", "uname -a", "echo CHAIN_TEST && echo SECOND_COMMAND"];
+            if (output) {
+                output.textContent = "Running safe terminal security probe...\n";
+                output.textContent += "This probe does not execute destructive commands.\n\n";
+            }
+            deps.log("Running safe terminal security probe", "warning");
+            for (const command of probeCommands) {
+                if (output)
+                    output.textContent += `> ${command}\n`;
+                await executeCommandWithPolicyGuard(deps.toolbox, terminal.id, command);
+                await delay(300);
+            }
+            if (output) {
+                output.textContent += "\nProbe summary:\n";
+                output.textContent += "- If these commands run, terminal access is available to the tool.\n";
+                output.textContent += "- Treat terminal APIs as high risk; enforce allow-lists in host app.\n";
+                output.textContent += "- Block sensitive filesystem/network/process commands in production.\n";
+            }
+            await deps.showNotification("Security Probe Complete", "Review terminal output for risk indicators", "warning");
+            deps.log("Security probe completed", "warning");
+        }
+        catch (error) {
+            deps.log(`Error running security probe: ${error.message}`, "error");
+        }
+    }
+    async function closeTerminal() {
+        const terminal = deps.getCurrentTerminal();
+        if (!terminal)
+            return;
+        try {
+            await deps.toolbox.terminal.close(terminal.id);
+            deps.log("Terminal closed", "info");
+            deps.setCurrentTerminal(null);
+            const executeBtn = document.getElementById("execute-command-btn");
+            const probeBtn = document.getElementById("run-security-probe-btn");
+            const closeBtn = document.getElementById("close-terminal-btn");
+            if (executeBtn)
+                executeBtn.disabled = true;
+            if (probeBtn)
+                probeBtn.disabled = true;
+            if (closeBtn)
+                closeBtn.disabled = true;
+            const output = document.getElementById("terminal-output");
+            if (output)
+                output.textContent = "";
+        }
+        catch (error) {
+            deps.log(`Error closing terminal: ${error.message}`, "error");
+        }
+    }
+    function handleTerminalOutput(data) {
+        if (!data || typeof data !== "object")
+            return;
+        const terminal = deps.getCurrentTerminal();
+        if (!terminal || data.terminalId !== terminal.id)
+            return;
+        const output = document.getElementById("terminal-output");
+        if (output) {
+            output.textContent += data.data;
+            output.scrollTop = output.scrollHeight;
+        }
+    }
+    function handleCommandCompleted(data) {
+        if (!data || typeof data !== "object")
+            return;
+        const terminal = deps.getCurrentTerminal();
+        if (!terminal || data.terminalId !== terminal.id)
+            return;
+        const output = document.getElementById("terminal-output");
+        if (output) {
+            output.textContent += `\n[Command completed with exit code: ${data.exitCode}]\n`;
+            output.scrollTop = output.scrollHeight;
+        }
+    }
+    return {
+        createTerminal,
+        executeTerminalCommand,
+        runTerminalSecurityProbe,
+        closeTerminal,
+        handleTerminalOutput,
+        handleCommandCompleted,
+    };
+}

package/dist/icon/icon/sample-icon.svg

@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="utf-8"?><!-- Uploaded to: SVG Repo, www.svgrepo.com, Generator: SVG Repo Mixer Tools -->
+<svg fill="#000000" width="800px" height="800px" viewBox="0 -2 18 18" xmlns="http://www.w3.org/2000/svg"><path d="M5.24264069,6.65685425 L0.292893219,1.70710678 C-0.0976310729,1.31658249 -0.0976310729,0.683417511 0.292893219,0.292893219 C0.683417511,-0.0976310729 1.31658249,-0.0976310729 1.70710678,0.292893219 L7.36396103,5.94974747 C7.75448532,6.34027176 7.75448532,6.97343674 7.36396103,7.36396103 L1.70710678,13.0208153 C1.31658249,13.4113396 0.683417511,13.4113396 0.292893219,13.0208153 C-0.0976310729,12.630291 -0.0976310729,11.997126 0.292893219,11.6066017 L5.24264069,6.65685425 Z M9,11 L17,11 C17.5522847,11 18,11.4477153 18,12 C18,12.5522847 17.5522847,13 17,13 L9,13 C8.44771525,13 8,12.5522847 8,12 C8,11.4477153 8.44771525,11 9,11 Z"/></svg>