reasonix 0.26.0 → 0.27.0

package/dist/index.d.ts

@@ -446,6 +446,8 @@ declare class ImmutablePrefix {
     toMessages(): ChatMessage[];
     tools(): ToolSpec[];
     addTool(spec: ToolSpec): boolean;
+    /** Mirror of addTool for MCP hot-unbridge. Same cache-miss cost — prefix changes shape. */
+    removeTool(name: string): boolean;
     get fingerprint(): string;
     /** Dev/test only — throws on cache drift, which always means a non-`addTool` mutation slipped in. */
     verifyFingerprint(): string;
@@ -619,6 +621,8 @@ declare class ToolRegistry {
     /** At most one interceptor active; calling twice replaces. */
     setToolInterceptor(fn: ToolInterceptor | null): void;
     register<A, R>(def: ToolDefinition<A, R>): this;
+    /** Drop a registered tool. Returns true if the name was present. Used by MCP hot-unbridge. */
+    unregister(name: string): boolean;
     has(name: string): boolean;
     get(name: string): ToolDefinition | undefined;
     get size(): number;
@@ -1191,7 +1195,7 @@ interface ShellToolsOptions {
 declare function tokenizeCommand(cmd: string): string[];
 /** Up-front detection — without it, `dir | findstr foo` quotes `|` literal and pipe silently fails. */
 declare function detectShellOperator(cmd: string): string | null;
-/** Match on space-normalized leading tokens — `git   status  -s` matches the `git status` prefix. */
+/** Allowlist match on leading argv tokens; demoted by `RISKY_ARGS` when a destructive flag appears in the tail. */
 declare function isAllowed(cmd: string, extra?: readonly string[]): boolean;
 interface RunCommandResult {
     exitCode: number | null;

package/dist/index.js

@@ -981,6 +981,10 @@ var ToolRegistry = class {
     this._tools.set(def.name, internal);
     return this;
   }
+  /** Drop a registered tool. Returns true if the name was present. Used by MCP hot-unbridge. */
+  unregister(name) {
+    return this._tools.delete(name);
+  }
   has(name) {
     return this._tools.has(name);
   }
@@ -1645,6 +1649,14 @@ var ImmutablePrefix = class {
     this._fingerprintCache = null;
     return true;
   }
+  /** Mirror of addTool for MCP hot-unbridge. Same cache-miss cost — prefix changes shape. */
+  removeTool(name) {
+    const idx = this._toolSpecs.findIndex((t) => t.function?.name === name);
+    if (idx < 0) return false;
+    this._toolSpecs.splice(idx, 1);
+    this._fingerprintCache = null;
+    return true;
+  }
   get fingerprint() {
     if (this._fingerprintCache !== null) return this._fingerprintCache;
     this._fingerprintCache = this.computeFingerprint();
@@ -6406,12 +6418,65 @@ function detectShellOperator(cmd) {
   if (quote) return null;
   return check();
 }
+var RISKY_ARGS = {
+  // Branch / remote mutation
+  "git branch": ["-d", "-D", "--delete", "-m", "-M", "--move", "-c", "-C", "--copy", "--force"],
+  "git remote": ["add", "remove", "rm", "rename", "set-url", "set-head", "prune"],
+  // `--output` writes to an arbitrary path; `--ext-diff` invokes user-config'd external programs.
+  "git diff": ["--output", "--ext-diff"],
+  "git log": ["--output"],
+  "git show": ["--output"],
+  // `-exec*` / `-ok*` are RCE; `-delete` and `-fprint*` / `-fls` write to arbitrary paths.
+  find: [
+    "-delete",
+    "-exec",
+    "-execdir",
+    "-ok",
+    "-okdir",
+    "-fprint",
+    "-fprint0",
+    "-fprintf",
+    "-fls"
+  ],
+  // `-o FILE` writes the tree to an arbitrary path.
+  tree: ["-o"],
+  // Auto-fix mutates source files.
+  "npx eslint": ["--fix", "--fix-dry-run"],
+  "npx biome check": ["--write", "--apply", "--apply-unsafe"],
+  ruff: ["--fix", "--unsafe-fixes", "format"]
+};
+function tailHasRisky(tail, risky) {
+  for (const a of tail) {
+    for (const r of risky) {
+      if (a === r) return true;
+      if (a.startsWith(`${r}=`)) return true;
+    }
+  }
+  return false;
+}
 function isAllowed(cmd, extra = []) {
-  const normalized = cmd.trim().replace(/\s+/g, " ");
+  let argv;
+  try {
+    argv = tokenizeCommand(cmd);
+  } catch {
+    return false;
+  }
+  if (argv.length === 0) return false;
   const allowlist = [...BUILTIN_ALLOWLIST, ...extra];
   for (const prefix of allowlist) {
-    if (normalized === prefix) return true;
-    if (normalized.startsWith(`${prefix} `)) return true;
+    const prefixTokens = prefix.split(" ");
+    if (argv.length < prefixTokens.length) continue;
+    let match = true;
+    for (let i = 0; i < prefixTokens.length; i++) {
+      if (argv[i] !== prefixTokens[i]) {
+        match = false;
+        break;
+      }
+    }
+    if (!match) continue;
+    const risky = RISKY_ARGS[prefix];
+    if (risky && tailHasRisky(argv.slice(prefixTokens.length), risky)) return false;
+    return true;
   }
   return false;
 }