profclaw 2.0.0 → 2.4.0

package/dist/agents/worktree-tools.js

@@ -0,0 +1,246 @@
+/**
+ * Worktree-confined tools for the verified-run agent.
+ *
+ * A small coding toolset (read, write, list, shell, complete) whose every file
+ * operation is resolved against a single root directory, the run's git
+ * worktree. Paths that escape the root (via `..`, absolute paths or symlinks)
+ * are rejected, writes into `.git` are refused, and shell commands that push
+ * or open pull requests are denied. Cautious and dangerous tools also go
+ * through the existing PermissionManager (src/agents/permissions.ts).
+ *
+ * The shell tool runs with the worktree as cwd and a scrubbed environment,
+ * confined by an OS sandbox when available (src/agents/command-sandbox.ts).
+ * Without one it falls back to pattern screening, a guard rail, not a jail.
+ */
+import { execFile, spawn } from 'node:child_process';
+import { mkdir, mkdtemp, readdir, readFile, realpath, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { jsonSchema, tool } from 'ai';
+import { PermissionManager } from './permissions.js';
+import { planSandboxedCommand, resolveAllowNetwork, resolveExtraWritable } from './command-sandbox.js';
+/** Tools the agent must never be given, denied even if requested by name. */
+const DENIED_TOOLS = new Set(['git_push', 'git_force_push']);
+/** Shell commands that would publish work. Screened before execution. */
+const BLOCKED_COMMAND_PATTERNS = [
+    /\bgit\b[^;&|\n]*\bpush\b/,
+    /\bgh\s+(pr|repo|release|api|workflow)\b/,
+    /\bgit\b[^;&|\n]*\bremote\s+(add|set-url)\b/,
+    /\bgit\b[^;&|\n]*--receive-pack\b/,
+];
+/** Environment variables that carry credentials for remotes. */
+const SCRUBBED_ENV_KEYS = ['GITHUB_TOKEN', 'GH_TOKEN', 'GITLAB_TOKEN', 'GIT_ASKPASS', 'SSH_AUTH_SOCK'];
+export function isBlockedCommand(command) {
+    return BLOCKED_COMMAND_PATTERNS.some((p) => p.test(command));
+}
+/** Non-interactive policy: allow everything except publishing actions. */
+export function createRunPermissionManager() {
+    const manager = new PermissionManager();
+    manager.setPromptCallback(async (toolName, args) => {
+        if (DENIED_TOOLS.has(toolName))
+            return 'deny';
+        if (toolName === 'bash') {
+            const command = getString(args, 'command');
+            if (command !== undefined && isBlockedCommand(command))
+                return 'deny';
+        }
+        return 'allow';
+    });
+    return manager;
+}
+function getString(args, key) {
+    if (typeof args !== 'object' || args === null)
+        return undefined;
+    const value = args[key];
+    return typeof value === 'string' ? value : undefined;
+}
+function isInside(root, target) {
+    const rel = relative(root, target);
+    if (rel === '')
+        return true;
+    return rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+/**
+ * Resolve `requested` against `root` and guarantee the result stays inside it,
+ * including through symlinks (checked on the deepest existing ancestor).
+ */
+export async function confinePath(root, requested) {
+    const absolute = resolve(root, requested);
+    if (!isInside(root, absolute))
+        throw new Error(`Path escapes the worktree: ${requested}`);
+    const rootReal = await realpath(root);
+    let probe = absolute;
+    for (;;) {
+        try {
+            const real = await realpath(probe);
+            if (!isInside(rootReal, real))
+                throw new Error(`Path escapes the worktree via symlink: ${requested}`);
+            return absolute;
+        }
+        catch (error) {
+            if (error instanceof Error && error.message.startsWith('Path escapes'))
+                throw error;
+            const parent = dirname(probe);
+            if (parent === probe)
+                throw new Error(`Cannot resolve path: ${requested}`);
+            probe = parent;
+        }
+    }
+}
+function truncateTail(text, max) {
+    return text.length <= max ? text : `...[truncated]\n${text.slice(-max)}`;
+}
+/** Git dirs a linked worktree must write to (index, refs, objects), minus hooks and config. */
+async function resolveGitSandboxPaths(workdir) {
+    const run = (arg) => new Promise((res) => {
+        execFile('git', ['-C', workdir, 'rev-parse', arg], (err, stdout) => res(err ? '' : stdout.trim()));
+    });
+    const writable = new Set();
+    const readOnly = [];
+    for (const dir of [await run('--git-dir'), await run('--git-common-dir')]) {
+        if (dir === '')
+            continue;
+        const abs = resolve(workdir, dir);
+        writable.add(abs);
+        readOnly.push(join(abs, 'hooks'), join(abs, 'config'));
+    }
+    return { writable: [...writable], readOnly };
+}
+function runShell(spec, cwd, timeoutMs, maxChars) {
+    return new Promise((resolvePromise) => {
+        const env = { ...process.env, GIT_TERMINAL_PROMPT: '0', ...spec.env };
+        for (const key of SCRUBBED_ENV_KEYS)
+            delete env[key];
+        const child = spawn(spec.file, spec.args, { cwd, env, stdio: ['ignore', 'pipe', 'pipe'] });
+        let output = '';
+        let timedOut = false;
+        const append = (d) => {
+            output = (output + d.toString('utf-8')).slice(-maxChars * 2);
+        };
+        child.stdout.on('data', append);
+        child.stderr.on('data', append);
+        const timer = setTimeout(() => {
+            timedOut = true;
+            child.kill('SIGKILL');
+        }, timeoutMs);
+        child.on('error', (err) => {
+            clearTimeout(timer);
+            resolvePromise({ exitCode: null, output: err.message, timedOut });
+        });
+        child.on('close', (code) => {
+            clearTimeout(timer);
+            resolvePromise({ exitCode: code, output: truncateTail(output, maxChars), timedOut });
+        });
+    });
+}
+function schemaTool(description, properties, required) {
+    return tool({
+        description,
+        inputSchema: jsonSchema({
+            type: 'object',
+            properties,
+            required,
+            additionalProperties: false,
+        }),
+    });
+}
+export function createWorktreeToolset(options) {
+    const { workdir, commandTimeoutMs, maxOutputChars } = options;
+    const permissions = options.permissions ?? createRunPermissionManager();
+    let sandboxBase;
+    const getSandboxBase = () => {
+        sandboxBase ??= (async () => {
+            const tempDir = await mkdtemp(join(tmpdir(), 'profclaw-run-'));
+            const git = await resolveGitSandboxPaths(workdir);
+            return {
+                workdir,
+                tempDir,
+                allowNetwork: options.allowNetwork ?? resolveAllowNetwork(),
+                extraWritable: [...git.writable, ...resolveExtraWritable()],
+                extraReadOnly: git.readOnly,
+            };
+        })();
+        return sandboxBase;
+    };
+    const dispose = async () => {
+        if (!sandboxBase)
+            return;
+        const base = await sandboxBase;
+        sandboxBase = undefined;
+        await rm(base.tempDir, { recursive: true, force: true });
+    };
+    const tools = {
+        read_file: schemaTool('Read a UTF-8 text file inside the working directory.', { path: { type: 'string' } }, ['path']),
+        write_file: schemaTool('Create or overwrite a file inside the working directory. Parent directories are created.', { path: { type: 'string' }, content: { type: 'string' } }, ['path', 'content']),
+        list_files: schemaTool('List entries of a directory inside the working directory (default: the root).', { path: { type: 'string' } }, []),
+        bash: schemaTool('Run a shell command with the working directory as cwd. Use it to run tests and the verify command. Pushing and opening pull requests is forbidden.', { command: { type: 'string' } }, ['command']),
+        complete_task: schemaTool('Call when the goal is done. Provide a short summary of what changed.', { summary: { type: 'string' } }, ['summary']),
+    };
+    const execute = async (name, args) => {
+        if (DENIED_TOOLS.has(name))
+            return { success: false, error: `Tool "${name}" is not allowed in a verified run` };
+        if (!(name in tools))
+            return { success: false, error: `Unknown tool "${name}"` };
+        const verdict = await permissions.check(name, args);
+        if (!verdict.allowed)
+            return { success: false, error: verdict.reason ?? `Permission denied for "${name}"` };
+        try {
+            switch (name) {
+                case 'read_file': {
+                    const path = getString(args, 'path');
+                    if (path === undefined)
+                        return { success: false, error: 'path is required' };
+                    const target = await confinePath(workdir, path);
+                    const text = await readFile(target, 'utf-8');
+                    return { success: true, data: { content: truncateTail(text, maxOutputChars) } };
+                }
+                case 'write_file': {
+                    const path = getString(args, 'path');
+                    const content = getString(args, 'content');
+                    if (path === undefined || content === undefined)
+                        return { success: false, error: 'path and content are required' };
+                    const target = await confinePath(workdir, path);
+                    const rel = relative(workdir, target);
+                    if (rel === '.git' || rel.startsWith(`.git${sep}`))
+                        return { success: false, error: 'Writing into .git is not allowed' };
+                    await mkdir(dirname(target), { recursive: true });
+                    await writeFile(target, content, 'utf-8');
+                    return { success: true, data: { path: rel, bytes: Buffer.byteLength(content) } };
+                }
+                case 'list_files': {
+                    const target = await confinePath(workdir, getString(args, 'path') ?? '.');
+                    const entries = await readdir(target, { withFileTypes: true });
+                    const names = entries
+                        .filter((e) => e.name !== '.git')
+                        .map((e) => (e.isDirectory() ? `${e.name}/` : e.name))
+                        .sort();
+                    return { success: true, data: { entries: names } };
+                }
+                case 'bash': {
+                    const command = getString(args, 'command');
+                    if (command === undefined)
+                        return { success: false, error: 'command is required' };
+                    if (isBlockedCommand(command)) {
+                        return { success: false, error: 'Command denied: pushing and opening pull requests are not allowed' };
+                    }
+                    const spec = planSandboxedCommand(command, await getSandboxBase(), options.sandbox);
+                    const result = await runShell(spec, workdir, commandTimeoutMs, maxOutputChars);
+                    return {
+                        success: result.exitCode === 0,
+                        data: { exitCode: result.exitCode, timedOut: result.timedOut, output: result.output },
+                        ...(result.exitCode === 0 ? {} : { error: `exit ${result.exitCode ?? 'null'}${result.timedOut ? ' (timed out)' : ''}` }),
+                    };
+                }
+                case 'complete_task':
+                    return { success: true, data: { summary: getString(args, 'summary') ?? 'Done' } };
+                default:
+                    return { success: false, error: `Unknown tool "${name}"` };
+            }
+        }
+        catch (error) {
+            return { success: false, error: error instanceof Error ? error.message : 'Tool failed' };
+        }
+    };
+    return { tools, execute, dispose };
+}
+//# sourceMappingURL=worktree-tools.js.map

package/dist/auth/middleware.js

@@ -14,6 +14,7 @@ import { getSettingsRaw } from '../settings/index.js';
 import { getDb } from '../storage/index.js';
 import { users } from '../storage/schema.js';
 import { eq } from 'drizzle-orm';
+import { getMode } from '../core/deployment.js';
 // Cached admin user for local-mode bypass (avoids DB query per request)
 let cachedLocalAdmin = null;
 let cachedLocalAdminExpiry = 0;
@@ -81,6 +82,19 @@ export function authMiddleware() {
         if (!path.startsWith('/api/') && !path.startsWith('/api')) {
             return next();
         }
+        // Pico mode: no UI dashboard, single-user local device — bypass auth entirely
+        if (getMode() === 'pico') {
+            c.set('user', {
+                id: 'local',
+                name: 'Local User',
+                email: 'local@profclaw',
+                role: 'admin',
+                status: 'active',
+                createdAt: new Date(0),
+                onboardingCompleted: true,
+            });
+            return next();
+        }
         // Local-mode bypass: auto-inject admin user when authMode is 'local'
         // Skip auto-inject if an access key is set (require session cookie instead)
         try {

package/dist/chat/agentic-executor.d.ts

@@ -12,6 +12,7 @@
  * - Provider cooldown tracking
  */
 import { type AgentState } from '../agents/index.js';
+import { type Suggestion } from './proactive/index.js';
 import type { ChatMessage } from '../providers/core/types.js';
 import type { ChatToolHandler } from './tool-handler.js';
 import { type FallbackAttempt } from './failover/index.js';
@@ -24,6 +25,10 @@ export interface AgenticChatRequest {
     temperature?: number;
     /** Thinking effort level for Anthropic models: low (cheap), medium, high, max (deep reasoning) */
     effort?: 'low' | 'medium' | 'high' | 'max';
+    /** User ID for budget tracking and preference recall */
+    userId?: string;
+    /** Team ID for shared budget enforcement */
+    teamId?: string;
     toolHandler: ChatToolHandler;
     tools: Array<{
         name: string;
@@ -68,6 +73,8 @@ export interface AgenticChatResponse {
         requestedModel: string;
         attempts: FallbackAttempt[];
     };
+    /** Proactive follow-up suggestions based on completed task */
+    suggestions?: Suggestion[];
 }
 /**
  * Execute an agentic chat conversation.