praxis-agent 0.20.4 → 0.20.7

package/dist/compatibility/claude/file-resources.js

@@ -87,8 +87,12 @@ async function downloadOne(resource, config) {
                 ? AbortSignal.any([config.signal, timeoutSignal])
                 : timeoutSignal;
             const response = await fetcher(filesEndpoint(config.baseUrl, resource.fileId), {
-                headers: config.headers ?? {
-                    Authorization: `Bearer ${config.apiKey}`,
+                headers: {
+                    ...(config.headers ?? {
+                        Authorization: `Bearer ${config.apiKey}`,
+                    }),
+                    'anthropic-version': config.headers?.['anthropic-version'] ?? '2023-06-01',
+                    'anthropic-beta': config.headers?.['anthropic-beta'] ?? 'files-api-2025-04-14',
                 },
                 signal: requestSignal,
             });

package/dist/permissions/bash-path-safety.d.ts

@@ -12,6 +12,7 @@ export interface BashPathSafetyOptions {
     sandboxWriteConfig?: FsWriteRestrictionConfig;
     permissionMode: 'acceptEdits' | 'auto' | 'bypassPermissions' | 'manual' | 'dontAsk' | 'plan' | 'default';
     fileRule?: (operation: FileOperation, absolutePath: string) => RuleOutcome;
+    protectedWrite?: (absolutePath: string) => string | undefined;
     platform?: NodeJS.Platform;
 }
 export type BashPathSafetyResult = {

package/dist/permissions/bash-path-safety.js

@@ -421,6 +421,20 @@ function pathFailure(rawPath, operation, options, dangerous = false) {
         : rawPath;
     const absolutePath = expandPath(validationPath, options);
     const pathsToCheck = pathRepresentations(absolutePath);
+    if (operation !== 'read' && options.protectedWrite !== undefined) {
+        for (const path of pathsToCheck) {
+            const protectedReason = options.protectedWrite(path);
+            if (protectedReason !== undefined) {
+                return {
+                    safe: false,
+                    behavior: 'deny',
+                    reason: `Refusing to write protected path: ${protectedReason}`,
+                    path: absolutePath,
+                    operation,
+                };
+            }
+        }
+    }
     const rules = pathsToCheck.map((path) => options.fileRule?.(operation, path) ?? null);
     if (rules.includes('deny')) {
         return {

package/dist/permissions/bypass-immune-paths.d.ts

@@ -0,0 +1,11 @@
+export interface ProtectedWriteOptions {
+    homeDirectory: string;
+    configRoot: string;
+}
+/**
+ * Returns a human-readable rejection reason when a write to `path` targets a
+ * bypass-immune protected credential or configuration file, or undefined when
+ * the write is not protected. Reads are never affected.
+ */
+export declare function protectedWritePathReason(path: string, options: ProtectedWriteOptions): string | undefined;
+//# sourceMappingURL=bypass-immune-paths.d.ts.map

package/dist/permissions/bypass-immune-paths.js

@@ -0,0 +1,86 @@
+import { realpathSync } from 'node:fs';
+import { dirname, isAbsolute, relative, resolve } from 'node:path';
+const SSH_CREDENTIAL_BASENAMES = new Set([
+    'authorized_keys',
+    'id_rsa',
+    'id_ed25519',
+    'id_ecdsa',
+    'id_dsa',
+]);
+const AWS_CREDENTIAL_BASENAMES = new Set(['credentials']);
+function isWithin(candidate, root) {
+    const child = relative(resolve(root), resolve(candidate));
+    return child === '' || (!child.startsWith('..') && !isAbsolute(child));
+}
+function pathRepresentations(path) {
+    const absolute = resolve(path);
+    const representations = new Set([absolute]);
+    let existing = absolute;
+    for (;;) {
+        try {
+            realpathSync(existing);
+            break;
+        }
+        catch {
+            const parent = dirname(existing);
+            if (parent === existing)
+                return [...representations];
+            existing = parent;
+        }
+    }
+    try {
+        representations.add(resolve(realpathSync.native(existing), relative(existing, absolute)));
+    }
+    catch {
+        // A disappearing or inaccessible path retains its lexical representation.
+    }
+    try {
+        representations.add(realpathSync.native(absolute));
+    }
+    catch {
+        // Non-existent targets are covered by their deepest existing ancestor.
+    }
+    return [...representations];
+}
+function lowerBasename(path) {
+    const segments = path.split(/[\\/]+/u).filter(Boolean);
+    return (segments.at(-1) ?? '').toLowerCase();
+}
+/**
+ * Returns a human-readable rejection reason when a write to `path` targets a
+ * bypass-immune protected credential or configuration file, or undefined when
+ * the write is not protected. Reads are never affected.
+ */
+export function protectedWritePathReason(path, options) {
+    const homeDirectory = resolve(options.homeDirectory);
+    const configRoot = resolve(options.configRoot);
+    const sshDirectory = resolve(homeDirectory, '.ssh');
+    const awsDirectory = resolve(homeDirectory, '.aws');
+    const sshDirectories = pathRepresentations(sshDirectory);
+    const awsDirectories = pathRepresentations(awsDirectory);
+    const configRoots = pathRepresentations(configRoot);
+    for (const representation of pathRepresentations(path)) {
+        const basename = lowerBasename(representation);
+        if (sshDirectories.some((root) => isWithin(representation, root))) {
+            return `${sshDirectory} is a protected SSH directory`;
+        }
+        if (awsDirectories.some((root) => isWithin(representation, root))) {
+            return `${awsDirectory} is a protected AWS credentials directory`;
+        }
+        if (SSH_CREDENTIAL_BASENAMES.has(basename)) {
+            return `${basename} is a protected SSH credential file`;
+        }
+        if (AWS_CREDENTIAL_BASENAMES.has(basename)) {
+            return `${basename} is a protected AWS credential file`;
+        }
+        if (basename === '.env' || basename.startsWith('.env.')) {
+            return '.env and .env.* files are protected';
+        }
+        if (configRoots.some((root) => isWithin(representation, root)) &&
+            (basename === 'settings.json' || basename.endsWith('.jsonl'))) {
+            return 'settings.json and .jsonl files in the Claude config root are protected';
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=bypass-immune-paths.js.map

package/dist/tools/local-tools.d.ts

@@ -11,6 +11,8 @@ export interface LocalToolRegistryOptions {
     enableReportFindings?: boolean;
     environment?: Readonly<Record<string, string>>;
     sandbox?: BashSandboxRuntime;
+    homeDirectory?: string;
+    configRoot?: string;
 }
 export interface BashSandboxRuntime {
     shouldUseSandbox(input: {
@@ -41,7 +43,12 @@ export declare class LocalToolRegistry implements ToolRegistry {
     private readonly enableReportFindings;
     private readonly environment;
     private readonly sandbox;
+    private readonly homeDirectory;
+    private readonly configRoot;
+    private readonly protectedWriteReason;
     constructor(options: LocalToolRegistryOptions);
+    private assertProtectedWritePath;
+    private assertProtectedBashCommand;
     private currentCwd;
     definitions(): readonly ModelToolDefinition[];
     prepare(call: ModelToolCall, context: ToolExecutionContext): Promise<ModelToolCall>;

package/dist/tools/local-tools.js

@@ -1,7 +1,7 @@
 import { constants } from 'node:fs';
 import { mkdir, mkdtemp, open, realpath, stat, writeFile, } from 'node:fs/promises';
 import { basename, dirname, extname, isAbsolute, join, relative, resolve, } from 'node:path';
-import { tmpdir } from 'node:os';
+import { homedir, tmpdir } from 'node:os';
 import sharp from 'sharp';
 import { commandShell, commandShellArguments, } from '../platform/command-shell.js';
 import { BoundedProcessRunner, joinedProcessOutput, } from '../platform/bounded-process-runner.js';
@@ -9,6 +9,8 @@ import { globFiles } from './glob.js';
 import { countLineChanges } from './line-changes.js';
 import { editNotebook, formatNotebookForRead } from './notebook.js';
 import { openPdf } from './pdf.js';
+import { validateBashPathSafety } from '../permissions/bash-path-safety.js';
+import { protectedWritePathReason } from '../permissions/bypass-immune-paths.js';
 import { effectiveAdditionalDirectories } from '../permissions/permission-updates.js';
 const REPORT_FINDINGS_DEFINITION = {
     name: 'ReportFindings',
@@ -436,6 +438,9 @@ export class LocalToolRegistry {
     enableReportFindings;
     environment;
     sandbox;
+    homeDirectory;
+    configRoot;
+    protectedWriteReason;
     constructor(options) {
         this.cwd = resolve(options.cwd);
         this.cwdProvider = options.cwdProvider;
@@ -450,11 +455,43 @@ export class LocalToolRegistry {
         this.enableReportFindings = options.enableReportFindings ?? false;
         this.environment = options.environment;
         this.sandbox = options.sandbox;
+        this.homeDirectory = options.homeDirectory
+            ? resolve(options.homeDirectory)
+            : homedir();
+        this.configRoot = options.configRoot
+            ? resolve(options.configRoot)
+            : process.env.CLAUDE_CONFIG_DIR
+                ? resolve(process.env.CLAUDE_CONFIG_DIR)
+                : resolve(this.homeDirectory, '.claude');
+        this.protectedWriteReason = (absolutePath) => protectedWritePathReason(absolutePath, {
+            homeDirectory: this.homeDirectory,
+            configRoot: this.configRoot,
+        });
         this.processRunner = new BoundedProcessRunner({
             cwd: this.cwd,
             maxOutputBytes: this.maxOutputBytes,
         });
     }
+    assertProtectedWritePath(filePath) {
+        const reason = this.protectedWriteReason(filePath);
+        if (reason !== undefined) {
+            throw new Error(`Refusing to write protected path: ${reason}`);
+        }
+    }
+    assertProtectedBashCommand(command, context) {
+        const cwd = this.currentCwd(context);
+        const result = validateBashPathSafety(command, {
+            cwd,
+            homeDirectory: this.homeDirectory,
+            readRoots: [cwd],
+            writeRoots: [cwd],
+            permissionMode: 'bypassPermissions',
+            protectedWrite: this.protectedWriteReason,
+        });
+        if (!result.safe && result.behavior === 'deny') {
+            throw new Error(result.reason);
+        }
+    }
     currentCwd(context) {
         return resolve(context?.cwd || this.cwdProvider?.() || this.cwd);
     }
@@ -910,6 +947,7 @@ export class LocalToolRegistry {
     }
     async write(call) {
         const filePath = stringInput(call.input, 'file_path');
+        this.assertProtectedWritePath(filePath);
         const content = stringInput(call.input, 'content', true);
         if (Buffer.byteLength(content) > this.maxFileBytes) {
             throw new Error(`Content exceeds ${this.maxFileBytes} byte write limit`);
@@ -960,6 +998,7 @@ export class LocalToolRegistry {
     }
     async edit(call) {
         const filePath = stringInput(call.input, 'file_path');
+        this.assertProtectedWritePath(filePath);
         const oldString = stringInput(call.input, 'old_string');
         const newString = stringInput(call.input, 'new_string', true);
         const handle = await open(filePath, constants.O_RDWR | constants.O_NOFOLLOW);
@@ -1006,6 +1045,7 @@ export class LocalToolRegistry {
     }
     async notebookEdit(call) {
         const filePath = stringInput(call.input, 'notebook_path');
+        this.assertProtectedWritePath(filePath);
         const handle = await open(filePath, constants.O_RDWR | constants.O_NOFOLLOW);
         try {
             await this.assertStablePath(filePath);
@@ -1117,6 +1157,7 @@ export class LocalToolRegistry {
         if (timeout === undefined)
             throw new Error('Prepared Bash call has no timeout');
         const rawCommand = stringInput(call.input, 'command');
+        this.assertProtectedBashCommand(rawCommand, context);
         const sandboxInput = {
             command: rawCommand,
             ...(call.input.dangerouslyDisableSandbox === true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "praxis-agent",
-  "version": "0.20.4",
+  "version": "0.20.7",
   "description": "Local-first, single-user general agent for the command line.",
   "license": "MIT",
   "author": "wuqisen",