reasonix 0.43.0 → 0.44.0

package/dist/cli/{chunk-HFEAY5DT.js → chunk-R3CTO2HM.js}

@@ -4,7 +4,7 @@ import {
   cacheSavingsUsd,
   claudeEquivalentCost,
   costUsd
-} from "./chunk-YQ6NTIIE.js";
+} from "./chunk-ZZYBBX5N.js";
 
 // src/telemetry/usage.ts
 import {
@@ -229,4 +229,4 @@ export {
   aggregateUsage,
   formatLogSize
 };
-//# sourceMappingURL=chunk-HFEAY5DT.js.map
+//# sourceMappingURL=chunk-R3CTO2HM.js.map

package/dist/cli/{chunk-O52OLQL3.js → chunk-RDRC3XDT.js}

@@ -2,7 +2,7 @@
 import { createRequire as __cr } from 'node:module'; if (typeof globalThis.require === 'undefined') { globalThis.require = __cr(import.meta.url); }
 import {
   addProjectShellAllowed
-} from "./chunk-XPDVG52A.js";
+} from "./chunk-AVFXO2EZ.js";
 
 // src/core/pause-gate.ts
 var PauseGate = class {
@@ -19,10 +19,10 @@ var PauseGate = class {
         `${kind}: no confirmation listener registered \u2014 cannot prompt the user. This tool can only be used inside an interactive Reasonix session.`
       );
     }
-    return new Promise((resolve4) => {
+    return new Promise((resolve5) => {
       const id = this._nextId++;
       const request = { id, kind, payload };
-      this._pending.set(id, { resolve: resolve4, request });
+      this._pending.set(id, { resolve: resolve5, request });
       for (const fn of this._listeners) {
         try {
           fn(request);
@@ -130,15 +130,15 @@ var pauseGate = new PauseGate();
 
 // src/tools/jobs.ts
 import { spawn as spawn3 } from "child_process";
-import * as pathMod4 from "path";
+import * as pathMod5 from "path";
 
 // src/tools/shell.ts
-import * as pathMod3 from "path";
+import * as pathMod4 from "path";
 
 // src/tools/shell/exec.ts
 import { spawn as spawn2, spawnSync } from "child_process";
 import { existsSync, statSync } from "fs";
-import * as pathMod2 from "path";
+import * as pathMod3 from "path";
 
 // src/tools/shell-chain.ts
 import { spawn } from "child_process";
@@ -471,6 +471,10 @@ async function runPipeGroup(segments, opts) {
         cwd: opts.cwd,
         shell: false,
         windowsHide: true,
+        // POSIX: detach so the child becomes its own process-group leader,
+        // allowing killProcessTree's neg-pid kill to terminate the whole
+        // pipe chain subtree instead of just the direct child.
+        detached: process.platform !== "win32",
         env,
         stdio: [stdinSpec, stdoutSpec, stderrSpec],
         ...spawnOverrides
@@ -521,9 +525,9 @@ async function runPipeGroup(segments, opts) {
     }
     const exits = await Promise.all(
       children.map(
-        (c) => new Promise((resolve4) => {
-          c.once("error", () => resolve4(null));
-          c.once("close", (code) => resolve4(code));
+        (c) => new Promise((resolve5) => {
+          c.once("error", () => resolve5(null));
+          c.once("close", (code) => resolve5(code));
         })
       )
     );
@@ -567,6 +571,8 @@ var OutputBuffer = class {
 };
 
 // src/tools/shell/parse.ts
+import { homedir } from "os";
+import * as pathMod2 from "path";
 var BUILTIN_ALLOWLIST = [
   // Repo inspection
   "git status",
@@ -743,7 +749,65 @@ function tailHasRisky(tail, risky) {
   }
   return false;
 }
-function isAllowed(cmd, extra = []) {
+var DEFAULT_SENSITIVE_PREFIXES = [
+  "~/.ssh",
+  "~/.aws",
+  "~/.gnupg",
+  "~/.kube",
+  "/etc/shadow",
+  "/etc/sudoers"
+];
+var DEFAULT_SENSITIVE_PATTERNS = [
+  "*.env",
+  "*.env.*",
+  "*.key",
+  "*.pem",
+  "id_rsa*",
+  "id_ed25519*",
+  "*credentials*",
+  "*secret*"
+];
+function resolveSensitivePath(token, projectRoot) {
+  if (!token || token.startsWith("-") || token.includes("://") || token.startsWith("$"))
+    return null;
+  let expanded = token;
+  if (expanded.startsWith("~")) {
+    expanded = pathMod2.join(homedir(), expanded.slice(1));
+  }
+  return pathMod2.resolve(projectRoot, expanded);
+}
+function expandPrefix(prefix) {
+  if (prefix.startsWith("~")) return pathMod2.join(homedir(), prefix.slice(1));
+  return pathMod2.resolve(prefix);
+}
+function pathStartsWithPrefix(normalized, prefix) {
+  return normalized === prefix || normalized.startsWith(`${prefix}${pathMod2.sep}`);
+}
+function matchesGlob(name, pattern) {
+  const regex = new RegExp(
+    `^${pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".")}$`,
+    "i"
+  );
+  return regex.test(name);
+}
+function hasSensitivePathArgs(argv, projectRoot, extraPrefixes = [], extraPatterns = []) {
+  const prefixes = [...DEFAULT_SENSITIVE_PREFIXES, ...extraPrefixes].map(expandPrefix);
+  const patterns = [...DEFAULT_SENSITIVE_PATTERNS, ...extraPatterns];
+  for (const token of argv) {
+    const resolved = resolveSensitivePath(token, projectRoot);
+    if (!resolved) continue;
+    const normalized = pathMod2.normalize(resolved);
+    for (const pfx of prefixes) {
+      if (pathStartsWithPrefix(normalized, pfx)) return true;
+    }
+    const base = pathMod2.basename(normalized);
+    for (const pat of patterns) {
+      if (matchesGlob(base, pat)) return true;
+    }
+  }
+  return false;
+}
+function isAllowed(cmd, extra = [], projectRoot, sensitivePathConfig) {
   let argv;
   try {
     argv = tokenizeCommand(cmd);
@@ -765,19 +829,26 @@ function isAllowed(cmd, extra = []) {
     if (!match) continue;
     const risky = RISKY_ARGS[prefix];
     if (risky && tailHasRisky(argv.slice(prefixTokens.length), risky)) return false;
+    if (projectRoot && hasSensitivePathArgs(
+      argv,
+      projectRoot,
+      sensitivePathConfig?.prefixes,
+      sensitivePathConfig?.patterns
+    ))
+      return false;
     return true;
   }
   return false;
 }
-function isCommandAllowed(cmd, extra = []) {
+function isCommandAllowed(cmd, extra = [], projectRoot, sensitivePathConfig) {
   let chain;
   try {
     chain = parseCommandChain(cmd);
   } catch {
     return false;
   }
-  if (chain === null) return isAllowed(cmd, extra);
-  return chainAllowed(chain, (seg) => isAllowed(seg, extra));
+  if (chain === null) return isAllowed(cmd, extra, projectRoot, sensitivePathConfig);
+  return chainAllowed(chain, (seg) => isAllowed(seg, extra, projectRoot, sensitivePathConfig));
 }
 
 // src/tools/shell/exec.ts
@@ -824,8 +895,15 @@ async function runCommand(cmd, opts) {
   const spawnOpts = {
     cwd: opts.cwd,
     shell: false,
-    // no shell-expansion — see header comment
     windowsHide: true,
+    // POSIX: detach so the child becomes its own process-group leader.
+    // Required for `process.kill(-pid, …)` in killProcessTree to
+    // terminate the whole subtree (child + grandchildren) instead of
+    // only the leader — without this grandchildren like npm→node→esbuild
+    // become orphaned.
+    // Windows: detached would spawn a new console window; leave the
+    // default and use taskkill /T for tree termination (see killProcessTree).
+    detached: process.platform !== "win32",
     // PYTHONIOENCODING + PYTHONUTF8 force any spawned Python child
     // (run_command running `python script.py`, etc.) to emit UTF-8
     // on stdout/stderr. Without this, Chinese-Windows defaults
@@ -838,7 +916,7 @@ async function runCommand(cmd, opts) {
   };
   const { bin, args, spawnOverrides } = prepareSpawn(argv, { env: normalizedEnv });
   const effectiveSpawnOpts = { ...spawnOpts, ...spawnOverrides };
-  return await new Promise((resolve4, reject) => {
+  return await new Promise((resolve5, reject) => {
     let child;
     try {
       child = spawn2(bin, args, effectiveSpawnOpts);
@@ -892,7 +970,7 @@ async function runCommand(cmd, opts) {
       const output = buf.length > maxChars ? `${buf.slice(0, maxChars)}
 
 [\u2026 truncated ${buf.length - maxChars} chars \u2026]` : buf;
-      resolve4({ exitCode: code, output, timedOut });
+      resolve5({ exitCode: code, output, timedOut });
     });
   });
 }
@@ -914,16 +992,16 @@ function resolveExecutable(cmd, opts = {}) {
   const platform = opts.platform ?? process.platform;
   if (platform !== "win32") return cmd;
   if (!cmd) return cmd;
-  if (cmd.includes("/") || cmd.includes("\\") || pathMod2.isAbsolute(cmd)) return cmd;
-  if (pathMod2.extname(cmd)) return cmd;
+  if (cmd.includes("/") || cmd.includes("\\") || pathMod3.isAbsolute(cmd)) return cmd;
+  if (pathMod3.extname(cmd)) return cmd;
   const env = opts.env ?? process.env;
   const pathExt = (getEnvCaseInsensitive(env, "PATHEXT") ?? ".COM;.EXE;.BAT;.CMD").split(";").map((e) => e.trim()).filter(Boolean);
-  const delimiter2 = opts.pathDelimiter ?? (platform === "win32" ? ";" : pathMod2.delimiter);
+  const delimiter2 = opts.pathDelimiter ?? (platform === "win32" ? ";" : pathMod3.delimiter);
   const pathDirs = (getEnvCaseInsensitive(env, "PATH") ?? "").split(delimiter2).filter(Boolean);
   const isFile = opts.isFile ?? defaultIsFile;
   for (const dir of pathDirs) {
     for (const ext of pathExt) {
-      const full = pathMod2.win32.join(dir, cmd + ext);
+      const full = pathMod3.win32.join(dir, cmd + ext);
       if (isFile(full)) return full;
     }
   }
@@ -1039,8 +1117,8 @@ function withUtf8Codepage(cmdline) {
 function isBareWindowsName(s) {
   if (!s) return false;
   if (s.includes("/") || s.includes("\\")) return false;
-  if (pathMod2.isAbsolute(s)) return false;
-  if (pathMod2.extname(s)) return false;
+  if (pathMod3.isAbsolute(s)) return false;
+  if (pathMod3.extname(s)) return false;
   return true;
 }
 function quoteForCmdExe(arg) {
@@ -1051,7 +1129,7 @@ function quoteForCmdExe(arg) {
 
 // src/tools/shell.ts
 function registerShellTools(registry, opts) {
-  const rootDir = pathMod3.resolve(opts.rootDir);
+  const rootDir = pathMod4.resolve(opts.rootDir);
   const timeoutSec = opts.timeoutSec ?? DEFAULT_TIMEOUT_SEC;
   const maxOutputChars = opts.maxOutputChars ?? DEFAULT_MAX_OUTPUT_CHARS;
   const jobs = opts.jobs ?? new JobRegistry();
@@ -1071,7 +1149,7 @@ function registerShellTools(registry, opts) {
       if (isAllowAll()) return true;
       const cmd = typeof args?.command === "string" ? args.command.trim() : "";
       if (!cmd) return false;
-      return isCommandAllowed(cmd, getExtraAllowed());
+      return isCommandAllowed(cmd, getExtraAllowed(), rootDir, opts.sensitivePaths);
     },
     parameters: {
       type: "object",
@@ -1091,7 +1169,7 @@ function registerShellTools(registry, opts) {
       const cmd = args.command.trim();
       if (!cmd) throw new Error("run_command: empty command");
       const effectiveTimeout = Math.max(1, Math.min(600, args.timeoutSec ?? timeoutSec));
-      if (!isAllowAll() && !isCommandAllowed(cmd, getExtraAllowed())) {
+      if (!isAllowAll() && !isCommandAllowed(cmd, getExtraAllowed(), rootDir, opts.sensitivePaths)) {
         const gate = ctx?.confirmationGate ?? pauseGate;
         const choice = await gate.ask({
           kind: "run_command",
@@ -1117,7 +1195,7 @@ function registerShellTools(registry, opts) {
   });
   registry.register({
     name: "run_background",
-    description: "Spawn a long-running process and detach. Waits up to `waitSec` for startup or a readiness signal ('Local:', 'listening on', 'compiled successfully'), then returns the job id + startup preview. Tail logs with `job_output`, block on completion with `wait_for_job`, kill with `stop_job`, list with `list_jobs`.\n\nSingle process only \u2014 chains / redirects / `cd` work as in run_command, but a typical invocation is one binary. Use the binary's own --cwd / --prefix flag for subdirectories. Vite gotcha: npm's `--prefix` only finds package.json; vite's server root still uses process cwd \u2014 pass `vite <project-dir>` instead.\n\nUSE THIS \u2014 not run_command \u2014 for:\n- Dev servers / watchers: npm/yarn/pnpm dev, uvicorn / flask run, cargo watch, tsc --watch, webpack serve, anything with dev/serve/watch in the name.\n- One-shot long jobs: curl / wget large downloads, `huggingface-cli download`, multi-GB `pip install` / `npm install`, big `cargo build` / `docker build`. Start with `run_background`, then call `wait_for_job` once (default `waitFor: 'exit'`, timeoutMs up to 300_000) \u2014 the harness blocks server-side so a 5-minute download costs ONE tool call, not 30 polls.",
+    description: "Spawn a long-running process and detach. Waits up to `waitSec` for startup or a readiness signal ('Local:', 'listening on', 'compiled successfully'), then returns the job id + startup preview. Tail logs with `job_output`, block on completion with `wait_for_job`, kill with `stop_job`, list with `list_jobs`.\n\nSingle process only \u2014 no chains / redirects. For subdirectories use the `cwd` parameter (workspace-relative or absolute, must stay inside the workspace root); do NOT write `cd X && cmd`, that gets rejected.\n\nUSE THIS \u2014 not run_command \u2014 for:\n- Dev servers / watchers: npm/yarn/pnpm dev, uvicorn / flask run, cargo watch, tsc --watch, webpack serve, anything with dev/serve/watch in the name.\n- One-shot long jobs: curl / wget large downloads, `huggingface-cli download`, multi-GB `pip install` / `npm install`, big `cargo build` / `docker build`. Start with `run_background`, then call `wait_for_job` once (default `waitFor: 'exit'`, timeoutMs up to 300_000) \u2014 the harness blocks server-side so a 5-minute download costs ONE tool call, not 30 polls.",
     parameters: {
       type: "object",
       properties: {
@@ -1125,6 +1203,10 @@ function registerShellTools(registry, opts) {
           type: "string",
           description: "Full command line. Same quoting rules as run_command (no pipes / redirects / chaining)."
         },
+        cwd: {
+          type: "string",
+          description: "Working directory for the spawn. Workspace-relative or absolute. Defaults to the workspace root. Must resolve inside the workspace \u2014 paths escaping the root are rejected."
+        },
         waitSec: {
           type: "integer",
           description: "Max seconds to wait for startup before returning. 0..30, default 3. A ready-signal match short-circuits this."
@@ -1135,11 +1217,12 @@ function registerShellTools(registry, opts) {
     fn: async (args, ctx) => {
       const cmd = args.command.trim();
       if (!cmd) throw new Error("run_background: empty command");
-      if (!isAllowAll() && !isCommandAllowed(cmd, getExtraAllowed())) {
+      const cwd = resolveCwdInsideRoot(rootDir, args.cwd);
+      if (!isAllowAll() && !isCommandAllowed(cmd, getExtraAllowed(), rootDir, opts.sensitivePaths)) {
         const gate = ctx?.confirmationGate ?? pauseGate;
         const choice = await gate.ask({
           kind: "run_background",
-          payload: { command: cmd, cwd: rootDir, waitSec: args.waitSec }
+          payload: { command: cmd, cwd, waitSec: args.waitSec }
         });
         if (choice.type === "deny") {
           throw new Error(
@@ -1151,10 +1234,11 @@ function registerShellTools(registry, opts) {
         }
       }
       const result = await jobs.start(cmd, {
-        cwd: rootDir,
+        cwd,
         waitSec: args.waitSec,
         signal: ctx?.signal
       });
+      opts.onJobsChanged?.();
       return formatJobStart(result);
     }
   });
@@ -1216,6 +1300,7 @@ function registerShellTools(registry, opts) {
         waitFor: args.waitFor
       });
       if (!out) return `job ${args.jobId}: not found (use list_jobs)`;
+      if (out.exited) opts.onJobsChanged?.();
       return {
         jobId: args.jobId,
         exited: out.exited,
@@ -1236,6 +1321,7 @@ function registerShellTools(registry, opts) {
     },
     fn: async (args) => {
       const rec = await jobs.stop(args.jobId);
+      opts.onJobsChanged?.();
       if (!rec) return `job ${args.jobId}: not found`;
       return formatJobStop(rec);
     }
@@ -1255,6 +1341,18 @@ function registerShellTools(registry, opts) {
   });
   return registry;
 }
+function resolveCwdInsideRoot(rootDir, raw) {
+  const root = pathMod4.resolve(rootDir);
+  if (!raw || !raw.trim()) return root;
+  const resolved = pathMod4.resolve(root, raw);
+  const rel = pathMod4.relative(root, resolved);
+  if (rel.startsWith("..") || pathMod4.isAbsolute(rel)) {
+    throw new Error(
+      `run_background: cwd "${raw}" resolves outside the workspace root (${root}). Pass a workspace-relative path.`
+    );
+  }
+  return resolved;
+}
 function formatJobStart(r) {
   const header = r.stillRunning ? `[job ${r.jobId} started \xB7 pid ${r.pid ?? "?"} \xB7 ${r.readyMatched ? "READY signal matched" : "running (no ready signal yet)"}]` : r.exitCode !== null ? `[job ${r.jobId} exited during startup \xB7 exit ${r.exitCode}]` : `[job ${r.jobId} failed to start]`;
   return r.preview ? `${header}
@@ -1355,7 +1453,7 @@ var JobRegistry = class {
     const maxBytes = opts.maxBufferBytes ?? DEFAULT_OUTPUT_CAP_BYTES;
     const { bin, args, spawnOverrides } = prepareSpawn(argv);
     const spawnOpts = {
-      cwd: pathMod4.resolve(opts.cwd),
+      cwd: pathMod5.resolve(opts.cwd),
       shell: false,
       windowsHide: true,
       env: process.env,
@@ -1540,16 +1638,16 @@ ${job.output.slice(start)}`;
     let wakeOutput = null;
     if (waitFor === "output-or-exit") {
       racers.push(
-        new Promise((resolve4) => {
-          wakeOutput = resolve4;
-          job.outputWaiters.add(resolve4);
+        new Promise((resolve5) => {
+          wakeOutput = resolve5;
+          job.outputWaiters.add(resolve5);
         })
       );
     }
     let timer = null;
     racers.push(
-      new Promise((resolve4) => {
-        timer = setTimeout(resolve4, timeoutMs);
+      new Promise((resolve5) => {
+        timer = setTimeout(resolve5, timeoutMs);
       })
     );
     await Promise.race(racers);
@@ -1658,9 +1756,9 @@ function latestOutputSince(before, after) {
 
 // src/tools/fs/edit.ts
 import { promises as fs } from "fs";
-import * as pathMod5 from "path";
+import * as pathMod6 from "path";
 function displayRel(rootDir, full) {
-  return pathMod5.relative(rootDir, full).replaceAll("\\", "/");
+  return pathMod6.relative(rootDir, full).replaceAll("\\", "/");
 }
 async function applyEdit(rootDir, abs, args) {
   if (args.search.length === 0) {
@@ -1823,4 +1921,4 @@ export {
   registerShellTools,
   formatCommandResult
 };
-//# sourceMappingURL=chunk-O52OLQL3.js.map
+//# sourceMappingURL=chunk-RDRC3XDT.js.map