siclaw 0.1.0

package/dist/tools/netns-script.js

@@ -0,0 +1,394 @@
+import { Type } from "@sinclair/typebox";
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { Text } from "@mariozechner/pi-tui";
+import { resolveScript } from "./script-resolver.js";
+import { processToolOutput, renderTextResult } from "./tool-render.js";
+import { checkNodeReady } from "./k8s-checks.js";
+import { loadConfig } from "../core/config.js";
+import { sanitizeEnv } from "./sanitize-env.js";
+import { parseArgs, shellEscape } from "./command-sets.js";
+const DEFAULT_IMAGE = loadConfig().debugImage;
+// Valid pod name: RFC 1123 subdomain
+const POD_NAME_RE = /^[a-z0-9][a-z0-9.\-]*$/;
+function spawnAsync(cmd, args, timeout, env, signal) {
+    return new Promise((resolve, reject) => {
+        let stdout = "";
+        let stderr = "";
+        const child = spawn(cmd, args, {
+            stdio: ["ignore", "pipe", "pipe"],
+            env,
+        });
+        const onAbort = () => child.kill("SIGKILL");
+        signal?.addEventListener("abort", onAbort, { once: true });
+        child.stdout.on("data", (chunk) => {
+            stdout += chunk.toString();
+        });
+        child.stderr.on("data", (chunk) => {
+            stderr += chunk.toString();
+        });
+        const timer = setTimeout(() => {
+            child.kill("SIGKILL");
+        }, timeout);
+        child.on("close", (code) => {
+            clearTimeout(timer);
+            signal?.removeEventListener("abort", onAbort);
+            if (code === 0)
+                resolve({ stdout, stderr });
+            else
+                reject(Object.assign(new Error(`exit ${code}`), { code, stdout, stderr }));
+        });
+        child.on("error", (err) => {
+            clearTimeout(timer);
+            signal?.removeEventListener("abort", onAbort);
+            reject(err);
+        });
+    });
+}
+function filterPodNoise(stderr) {
+    return stderr
+        .split("\n")
+        .filter((line) => !line.match(/^pod "node-debug-.*" deleted$/))
+        .join("\n")
+        .trim();
+}
+export function createNetnsScriptTool(kubeconfigRef) {
+    return {
+        name: "pod_netns_script",
+        label: "Pod Netns Script",
+        renderCall(args, theme) {
+            const ns = args?.namespace && args.namespace !== "default" ? `-n ${args.namespace}` : "";
+            return new Text(theme.fg("toolTitle", theme.bold("pod_netns_script")) +
+                " " + theme.fg("accent", args?.pod || "") +
+                (ns ? " " + theme.fg("muted", ns) : "") +
+                " " + theme.fg("accent", args?.node || "") +
+                " " + theme.fg("muted", (args?.skill || "") + "/" + (args?.script || "")) +
+                (args?.args ? " " + args.args : ""), 0, 0);
+        },
+        renderResult: renderTextResult,
+        description: `Execute a skill or user script in a pod's network namespace using the host's tools.
+
+Creates a privileged debug pod on the same node as the target pod, then uses double nsenter:
+1. Outer nsenter: enters the host's full namespaces (to access host tools like tcpdump, ss, ip, etc.)
+2. Inner nsenter: enters only the pod's network namespace (to see the pod's network interfaces, IPs, routes)
+
+This gives the ideal environment for network diagnostics: host tools + pod's network view.
+
+Scripts must come from a skill's scripts/ directory or from user-uploaded scripts.
+
+Node requirements: the host must have jq and crictl installed.
+
+Parameters:
+- pod: Target pod name (the pod whose network namespace to enter)
+- namespace: Namespace (default: "default")
+- container: Container name (for multi-container pods, to determine which netns)
+- skill: Skill name. If omitted, looks in user scripts
+- script: Script filename
+- args: Optional arguments to pass to the script
+- image: Debug container image (default: SICLAW_DEBUG_IMAGE)
+- timeout_seconds: Timeout (default: 180, max: 300)
+
+Examples:
+- pod: "my-app-pod", namespace: "production", skill: "pod-network-debug", script: "capture-traffic.sh", args: "--port 8080"
+- pod: "gateway-pod", script: "check-routes.sh"`,
+        parameters: Type.Object({
+            pod: Type.String({
+                description: "Target pod name (whose network namespace to enter)",
+            }),
+            namespace: Type.Optional(Type.String({ description: 'Namespace (default: "default")' })),
+            container: Type.Optional(Type.String({
+                description: "Container name (for multi-container pods, to determine netns)",
+            })),
+            skill: Type.Optional(Type.String({
+                description: "Skill name (omit to use user scripts)",
+            })),
+            script: Type.String({ description: "Script filename" }),
+            args: Type.Optional(Type.String({ description: "Arguments to pass to the script" })),
+            image: Type.Optional(Type.String({
+                description: `Debug container image (default: ${DEFAULT_IMAGE})`,
+            })),
+            timeout_seconds: Type.Optional(Type.Number({
+                description: "Timeout in seconds (default: 180, max: 300)",
+            })),
+        }),
+        async execute(_toolCallId, rawParams, signal) {
+            const params = rawParams;
+            const env = {
+                ...sanitizeEnv(process.env),
+                ...(kubeconfigRef?.credentialsDir ? { SICLAW_CREDENTIALS_DIR: kubeconfigRef.credentialsDir } : {}),
+                KUBECONFIG: "/dev/null",
+            };
+            const pod = params.pod?.trim();
+            const namespace = params.namespace?.trim() || "default";
+            if (!pod || !POD_NAME_RE.test(pod)) {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `Error: invalid pod name "${pod}". Pod names may only contain lowercase letters, digits, hyphens, and dots.`,
+                        },
+                    ],
+                    details: { error: true },
+                };
+            }
+            // Resolve script
+            const resolved = resolveScript({
+                skill: params.skill,
+                script: params.script,
+            });
+            if ("error" in resolved) {
+                return {
+                    content: [{ type: "text", text: `Error: ${resolved.error}` }],
+                    details: { error: true },
+                };
+            }
+            const image = params.image || DEFAULT_IMAGE;
+            const timeout = Math.min(params.timeout_seconds ?? 180, 300) * 1000;
+            const args = params.args?.trim() || "";
+            // Step 1: Get pod phase + node in one call
+            let nodeName;
+            try {
+                const result = await spawnAsync("kubectl", [
+                    "get",
+                    "pod",
+                    pod,
+                    "-n",
+                    namespace,
+                    "-o",
+                    "jsonpath={.status.phase},{.spec.nodeName}",
+                ], 10_000, env);
+                const parts = result.stdout.trim().split(",");
+                const phase = parts[0];
+                nodeName = parts[1] || "";
+                if (phase !== "Running") {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `Error: Pod "${pod}" in namespace "${namespace}" is not Running (phase: ${phase || "unknown"}). Cannot enter its network namespace.`,
+                            },
+                        ],
+                        details: { error: true },
+                    };
+                }
+                if (!nodeName) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `Error: could not determine node for pod "${pod}" in namespace "${namespace}".`,
+                            },
+                        ],
+                        details: { error: true },
+                    };
+                }
+            }
+            catch (err) {
+                const stderr = (err.stderr?.trim() || err.message);
+                if (stderr.includes("not found")) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `Error: Pod "${pod}" not found in namespace "${namespace}". Check the pod name and namespace.`,
+                            },
+                        ],
+                        details: { error: true },
+                    };
+                }
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `Error: failed to get pod info: ${stderr}`,
+                        },
+                    ],
+                    details: { error: true },
+                };
+            }
+            // Check node is Ready before creating debug pod
+            const nodeCheckErr = await checkNodeReady(nodeName, env);
+            if (nodeCheckErr) {
+                return {
+                    content: [{ type: "text", text: `Error: ${nodeCheckErr}` }],
+                    details: { error: true },
+                };
+            }
+            // Step 2: Get the container ID
+            let containerID;
+            try {
+                const jsonpathExpr = params.container?.trim()
+                    ? `{.status.containerStatuses[?(@.name=="${params.container.trim()}")].containerID}`
+                    : "{.status.containerStatuses[0].containerID}";
+                const result = await spawnAsync("kubectl", ["get", "pod", pod, "-n", namespace, "-o", `jsonpath=${jsonpathExpr}`], 10_000, env);
+                containerID = result.stdout.trim();
+                if (!containerID) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: `Error: could not determine container ID for pod "${pod}". Is the pod running?`,
+                            },
+                        ],
+                        details: { error: true },
+                    };
+                }
+                // Strip the runtime prefix (e.g. "containerd://")
+                const prefixIdx = containerID.indexOf("://");
+                if (prefixIdx !== -1) {
+                    containerID = containerID.slice(prefixIdx + 3);
+                }
+            }
+            catch (err) {
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `Error: failed to get container ID: ${err.stderr?.trim() || err.message}`,
+                        },
+                    ],
+                    details: { error: true },
+                };
+            }
+            // Step 3: Build debug pod with double nsenter
+            const b64 = Buffer.from(resolved.content).toString("base64");
+            const ext = resolved.interpreter === "python3" ? ".py" : ".sh";
+            // Security: shell-escape each argument to prevent injection via args parameter
+            const escapedArgs = args ? parseArgs(args).map(shellEscape).join(" ") : "";
+            const scriptArgs = escapedArgs ? ` ${escapedArgs}` : "";
+            // The inner script that runs inside nsenter on the host.
+            // Uses unshare --mount + sysfs remount so that /sys reflects the pod's
+            // network namespace (sysfs is mount-namespace-dependent, not netns-dependent).
+            const innerScript = `
+CONTAINER_ID="${containerID}"
+PID=$(crictl inspect "$CONTAINER_ID" 2>/dev/null | jq -r ".info.pid")
+if [ -z "$PID" ] || [ "$PID" = "null" ]; then
+  echo "Error: cannot find PID for container $CONTAINER_ID" >&2
+  exit 1
+fi
+echo '${b64}' | base64 -d > /tmp/_s${ext}
+unshare --mount nsenter -t "$PID" -n -- sh -c 'mount -t sysfs none /sys 2>/dev/null; ${resolved.interpreter} /tmp/_s${ext}${scriptArgs}'
+`.trim();
+            const podId = randomBytes(4).toString("hex");
+            const podName = `node-debug-${podId}`;
+            const cleanup = () => {
+                spawnAsync("kubectl", ["delete", "pod", podName, "--force", "--grace-period=0"], 10_000, env).catch(() => { });
+            };
+            const overrides = JSON.stringify({
+                spec: {
+                    nodeName: nodeName,
+                    hostPID: true,
+                    hostNetwork: true,
+                    containers: [
+                        {
+                            name: podName,
+                            image,
+                            securityContext: { privileged: true },
+                            command: [
+                                "nsenter",
+                                "-t",
+                                "1",
+                                "-m",
+                                "-u",
+                                "-i",
+                                "-n",
+                                "-p",
+                                "--",
+                                "sh",
+                                "-c",
+                                innerScript,
+                            ],
+                        },
+                    ],
+                    restartPolicy: "Never",
+                },
+            });
+            try {
+                // Phase 1: Create pod
+                await spawnAsync("kubectl", [
+                    "run",
+                    podName,
+                    "--restart=Never",
+                    `--image=${image}`,
+                    `--overrides=${overrides}`,
+                ], 30_000, env, signal);
+                // Phase 2: Wait for pod to complete
+                const waitTimeout = Math.ceil(timeout / 1000);
+                try {
+                    await spawnAsync("kubectl", [
+                        "wait",
+                        `--for=jsonpath={.status.phase}=Succeeded`,
+                        `pod/${podName}`,
+                        `--timeout=${waitTimeout}s`,
+                    ], timeout + 5_000, env, signal);
+                }
+                catch {
+                    // Pod may have failed — still fetch logs
+                }
+                if (signal?.aborted) {
+                    cleanup();
+                    return {
+                        content: [{ type: "text", text: "Aborted." }],
+                        details: { error: true },
+                    };
+                }
+                // Phase 3: Fetch logs
+                let stdout = "";
+                let stderr = "";
+                try {
+                    const logsResult = await spawnAsync("kubectl", ["logs", podName], 10_000, env);
+                    stdout = logsResult.stdout;
+                    stderr = logsResult.stderr;
+                }
+                catch (logErr) {
+                    stdout = logErr.stdout ?? "";
+                    stderr = logErr.stderr ?? "";
+                }
+                // Phase 4: Get exit code
+                let exitCode = null;
+                try {
+                    const statusResult = await spawnAsync("kubectl", [
+                        "get",
+                        "pod",
+                        podName,
+                        "-o",
+                        "jsonpath={.status.containerStatuses[0].state.terminated.exitCode}",
+                    ], 5_000, env);
+                    const code = parseInt(statusResult.stdout.trim(), 10);
+                    if (!isNaN(code))
+                        exitCode = code;
+                }
+                catch {
+                    // ignore
+                }
+                // Phase 5: Cleanup
+                cleanup();
+                const filteredStderr = filterPodNoise(stderr);
+                const output = stdout.trim() +
+                    (filteredStderr ? `\n\nSTDERR:\n${filteredStderr}` : "");
+                if (exitCode === 0 || (exitCode === null && stdout.trim())) {
+                    return {
+                        content: [{ type: "text", text: processToolOutput(output) }],
+                        details: { exitCode: exitCode ?? 0 },
+                    };
+                }
+                else {
+                    const errOutput = `Exit code: ${exitCode ?? "unknown"}\n${output}`;
+                    return {
+                        content: [{ type: "text", text: processToolOutput(errOutput) }],
+                        details: { exitCode, error: true },
+                    };
+                }
+            }
+            catch (err) {
+                cleanup();
+                const output = `Exit code: ${err.code ?? "unknown"}\n${err.stdout?.trim() ?? ""}\n${err.stderr?.trim() ?? err.message}`;
+                return {
+                    content: [{ type: "text", text: processToolOutput(output) }],
+                    details: { exitCode: err.code, error: true },
+                };
+            }
+        },
+    };
+}
+//# sourceMappingURL=netns-script.js.map

package/dist/tools/netns-script.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"netns-script.js","sourceRoot":"","sources":["../../src/tools/netns-script.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAE5C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE3D,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC,UAAU,CAAC;AAE9C,qCAAqC;AACrC,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAE7C,SAAS,UAAU,CACjB,GAAW,EACX,IAAc,EACd,OAAe,EACf,GAAuB,EACvB,MAAoB;IAEpB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;YAC7B,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,GAAG;SACJ,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC,EAAE,OAAO,CAAC,CAAC;QACZ,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;;gBAE1C,MAAM,CACJ,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CACnE,CAAC;QACN,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;SAC9D,IAAI,CAAC,IAAI,CAAC;SACV,IAAI,EAAE,CAAC;AACZ,CAAC;AAaD,MAAM,UAAU,qBAAqB,CAAC,aAA6B;IACjE,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,kBAAkB;QACzB,UAAU,CAAC,IAAS,EAAE,KAAU;YAC9B,MAAM,EAAE,GAAG,IAAI,EAAE,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,OAAO,IAAI,IAAI,CACb,KAAK,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBACnD,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;gBACzC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;gBAC1C,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;gBACzE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EACrC,CAAC,EAAE,CAAC,CACL,CAAC;QACJ,CAAC;QACD,YAAY,EAAE,gBAAgB;QAC9B,WAAW,EAAE;;;;;;;;;;;;;;;;;;;;;;;;gDAwB+B;QAC5C,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;YACtB,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC;gBACf,WAAW,EAAE,oDAAoD;aAClE,CAAC;YACF,SAAS,EAAE,IAAI,CAAC,QAAQ,CACtB,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC,CAC/D;YACD,SAAS,EAAE,IAAI,CAAC,QAAQ,CACtB,IAAI,CAAC,MAAM,CAAC;gBACV,WAAW,EACT,+DAA+D;aAClE,CAAC,CACH;YACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,MAAM,CAAC;gBACV,WAAW,EAAE,uCAAuC;aACrD,CAAC,CACH;YACD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;YACvD,IAAI,EAAE,IAAI,CAAC,QAAQ,CACjB,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,iCAAiC,EAAE,CAAC,CAChE;YACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,MAAM,CAAC;gBACV,WAAW,EAAE,mCAAmC,aAAa,GAAG;aACjE,CAAC,CACH;YACD,eAAe,EAAE,IAAI,CAAC,QAAQ,CAC5B,IAAI,CAAC,MAAM,CAAC;gBACV,WAAW,EAAE,6CAA6C;aAC3D,CAAC,CACH;SACF,CAAC;QACF,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM;YAC1C,MAAM,MAAM,GAAG,SAA8B,CAAC;YAC9C,MAAM,GAAG,GAAG;gBACV,GAAG,WAAW,CAAC,OAAO,CAAC,GAA6B,CAAC;gBACrD,GAAG,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,aAAa,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClG,UAAU,EAAE,WAAW;aACxB,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;YAExD,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,4BAA4B,GAAG,6EAA6E;yBACnH;qBACF;oBACD,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;iBACzB,CAAC;YACJ,CAAC;YAED,iBAAiB;YACjB,MAAM,QAAQ,GAAG,aAAa,CAAC;gBAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAC;YACH,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;oBAC7D,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;iBACzB,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,aAAa,CAAC;YAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;YACpE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAEvC,2CAA2C;YAC3C,IAAI,QAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,SAAS,EACT;oBACE,KAAK;oBACL,KAAK;oBACL,GAAG;oBACH,IAAI;oBACJ,SAAS;oBACT,IAAI;oBACJ,2CAA2C;iBAC5C,EACD,MAAM,EACN,GAAG,CACJ,CAAC;gBACF,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACvB,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC1B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,OAAO;wBACL,OAAO,EAAE;4BACP;gCACE,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,eAAe,GAAG,mBAAmB,SAAS,4BAA4B,KAAK,IAAI,SAAS,wCAAwC;6BAC3I;yBACF;wBACD,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;qBACzB,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO;wBACL,OAAO,EAAE;4BACP;gCACE,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,4CAA4C,GAAG,mBAAmB,SAAS,IAAI;6BACtF;yBACF;wBACD,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;qBACzB,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,CAAW,CAAC;gBAC7D,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBACjC,OAAO;wBACL,OAAO,EAAE;4BACP;gCACE,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,eAAe,GAAG,6BAA6B,SAAS,sCAAsC;6BACrG;yBACF;wBACD,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;qBACzB,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,kCAAkC,MAAM,EAAE;yBACjD;qBACF;oBACD,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;iBACzB,CAAC;YACJ,CAAC;YAED,gDAAgD;YAChD,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACzD,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,YAAY,EAAE,EAAE,CAAC;oBAC3D,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;iBACzB,CAAC;YACJ,CAAC;YAED,+BAA+B;YAC/B,IAAI,WAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE;oBAC3C,CAAC,CAAC,yCAAyC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,kBAAkB;oBACpF,CAAC,CAAC,4CAA4C,CAAC;gBACjD,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,SAAS,EACT,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,YAAY,EAAE,CAAC,EACtE,MAAM,EACN,GAAG,CACJ,CAAC;gBACF,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACnC,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,OAAO;wBACL,OAAO,EAAE;4BACP;gCACE,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,oDAAoD,GAAG,wBAAwB;6BACtF;yBACF;wBACD,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;qBACzB,CAAC;gBACJ,CAAC;gBACD,kDAAkD;gBAClD,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC7C,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;oBACrB,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,sCAAsC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE;yBAChF;qBACF;oBACD,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;iBACzB,CAAC;YACJ,CAAC;YAED,8CAA8C;YAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC7D,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;YAC/D,+EAA+E;YAC/E,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAExD,yDAAyD;YACzD,uEAAuE;YACvE,+EAA+E;YAC/E,MAAM,WAAW,GAAG;gBACV,WAAW;;;;;;QAMnB,GAAG,0BAA0B,GAAG;uFAC+C,QAAQ,CAAC,WAAW,WAAW,GAAG,GAAG,UAAU;CACrI,CAAC,IAAI,EAAE,CAAC;YAEH,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC7C,MAAM,OAAO,GAAG,cAAc,KAAK,EAAE,CAAC;YAEtC,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,UAAU,CACR,SAAS,EACT,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,kBAAkB,CAAC,EACzD,MAAM,EACN,GAAG,CACJ,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACpB,CAAC,CAAC;YAEF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC/B,IAAI,EAAE;oBACJ,QAAQ,EAAE,QAAQ;oBAClB,OAAO,EAAE,IAAI;oBACb,WAAW,EAAE,IAAI;oBACjB,UAAU,EAAE;wBACV;4BACE,IAAI,EAAE,OAAO;4BACb,KAAK;4BACL,eAAe,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;4BACrC,OAAO,EAAE;gCACP,SAAS;gCACT,IAAI;gCACJ,GAAG;gCACH,IAAI;gCACJ,IAAI;gCACJ,IAAI;gCACJ,IAAI;gCACJ,IAAI;gCACJ,IAAI;gCACJ,IAAI;gCACJ,IAAI;gCACJ,WAAW;6BACZ;yBACF;qBACF;oBACD,aAAa,EAAE,OAAO;iBACvB;aACF,CAAC,CAAC;YAEH,IAAI,CAAC;gBACH,sBAAsB;gBACtB,MAAM,UAAU,CACd,SAAS,EACT;oBACE,KAAK;oBACL,OAAO;oBACP,iBAAiB;oBACjB,WAAW,KAAK,EAAE;oBAClB,eAAe,SAAS,EAAE;iBAC3B,EACD,MAAM,EACN,GAAG,EACH,MAAM,CACP,CAAC;gBAEF,oCAAoC;gBACpC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;gBAC9C,IAAI,CAAC;oBACH,MAAM,UAAU,CACd,SAAS,EACT;wBACE,MAAM;wBACN,0CAA0C;wBAC1C,OAAO,OAAO,EAAE;wBAChB,aAAa,WAAW,GAAG;qBAC5B,EACD,OAAO,GAAG,KAAK,EACf,GAAG,EACH,MAAM,CACP,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACP,yCAAyC;gBAC3C,CAAC;gBAED,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;oBACpB,OAAO,EAAE,CAAC;oBACV,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;wBAC7C,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;qBACzB,CAAC;gBACJ,CAAC;gBAED,sBAAsB;gBACtB,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,UAAU,GAAG,MAAM,UAAU,CACjC,SAAS,EACT,CAAC,MAAM,EAAE,OAAO,CAAC,EACjB,MAAM,EACN,GAAG,CACJ,CAAC;oBACF,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;oBAC3B,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;gBAC7B,CAAC;gBAAC,OAAO,MAAW,EAAE,CAAC;oBACrB,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;oBAC7B,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;gBAC/B,CAAC;gBAED,yBAAyB;gBACzB,IAAI,QAAQ,GAAkB,IAAI,CAAC;gBACnC,IAAI,CAAC;oBACH,MAAM,YAAY,GAAG,MAAM,UAAU,CACnC,SAAS,EACT;wBACE,KAAK;wBACL,KAAK;wBACL,OAAO;wBACP,IAAI;wBACJ,mEAAmE;qBACpE,EACD,KAAK,EACL,GAAG,CACJ,CAAC;oBACF,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;oBACtD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;wBAAE,QAAQ,GAAG,IAAI,CAAC;gBACpC,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBAED,mBAAmB;gBACnB,OAAO,EAAE,CAAC;gBAEV,MAAM,cAAc,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC9C,MAAM,MAAM,GACV,MAAM,CAAC,IAAI,EAAE;oBACb,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAE3D,IAAI,QAAQ,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;oBAC3D,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;wBAC5D,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,IAAI,CAAC,EAAE;qBACrC,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,SAAS,GAAG,cAAc,QAAQ,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;oBACnE,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;wBAC/D,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE;qBACnC,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,OAAO,EAAE,CAAC;gBACV,MAAM,MAAM,GAAG,cAAc,GAAG,CAAC,IAAI,IAAI,SAAS,KAAK,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;gBACxH,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC5D,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;iBAC7C,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/tools/node-exec.d.ts

@@ -0,0 +1,18 @@
+import type { ToolDefinition } from "@mariozechner/pi-coding-agent";
+import type { KubeconfigRef } from "../core/agent-factory.js";
+export { ALLOWED_COMMANDS } from "./command-sets.js";
+/**
+ * Validate a Kubernetes node name.
+ * Returns an error message if invalid, or null if valid.
+ */
+export declare function validateNodeName(node: string): string | null;
+/**
+ * Validate a command intended for node-exec.
+ * Uses the same validation pipeline as restricted-bash:
+ * 1. validateShellOperators — blocks dangerous shell constructs
+ * 2. extractCommands — splits pipelines
+ * 3. Per-command: whitelist check + validateCommandRestrictions
+ * Returns an error message if blocked, or null if allowed.
+ */
+export declare function validateCommand(command: string): string | null;
+export declare function createNodeExecTool(kubeconfigRef?: KubeconfigRef): ToolDefinition;