siclaw 0.1.0

package/dist/tools/node-exec.js

@@ -0,0 +1,342 @@
+import { Type } from "@sinclair/typebox";
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { Text } from "@mariozechner/pi-tui";
+import { renderTextResult, processToolOutput } from "./tool-render.js";
+import { checkNodeReady, waitForPodDone } from "./k8s-checks.js";
+import { resolveKubeconfigPath } from "./kubeconfig-resolver.js";
+import { sanitizeEnv } from "./sanitize-env.js";
+import { loadConfig } from "../core/config.js";
+import { ALLOWED_COMMANDS, parseArgs, getCommandBinary, validateCommandRestrictions, } from "./command-sets.js";
+import { validateShellOperators, extractCommands } from "./restricted-bash.js";
+function spawnAsync(cmd, args, timeout, env, signal) {
+    return new Promise((resolve, reject) => {
+        let stdout = "";
+        let stderr = "";
+        const child = spawn(cmd, args, {
+            stdio: ["ignore", "pipe", "pipe"],
+            env,
+        });
+        const onAbort = () => child.kill("SIGKILL");
+        signal?.addEventListener("abort", onAbort, { once: true });
+        child.stdout.on("data", (chunk) => {
+            stdout += chunk.toString();
+        });
+        child.stderr.on("data", (chunk) => {
+            stderr += chunk.toString();
+        });
+        const timer = setTimeout(() => {
+            child.kill("SIGKILL");
+        }, timeout);
+        child.on("close", (code) => {
+            clearTimeout(timer);
+            signal?.removeEventListener("abort", onAbort);
+            if (code === 0)
+                resolve({ stdout, stderr });
+            else
+                reject(Object.assign(new Error(`exit ${code}`), { code, stdout, stderr }));
+        });
+        child.on("error", (err) => {
+            clearTimeout(timer);
+            signal?.removeEventListener("abort", onAbort);
+            reject(err);
+        });
+    });
+}
+const DEFAULT_IMAGE = loadConfig().debugImage;
+// Re-export shared ALLOWED_COMMANDS for backward compatibility
+export { ALLOWED_COMMANDS } from "./command-sets.js";
+// Valid node name: alphanumeric, hyphens, dots only
+const NODE_NAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9.\-]*$/;
+/**
+ * Validate a Kubernetes node name.
+ * Returns an error message if invalid, or null if valid.
+ */
+export function validateNodeName(node) {
+    if (!node || !node.trim()) {
+        return "Node name must not be empty.";
+    }
+    if (!NODE_NAME_RE.test(node)) {
+        return `Invalid node name "${node}". Node names may only contain letters, digits, hyphens, and dots.`;
+    }
+    return null;
+}
+/**
+ * Validate a command intended for node-exec.
+ * Uses the same validation pipeline as restricted-bash:
+ * 1. validateShellOperators — blocks dangerous shell constructs
+ * 2. extractCommands — splits pipelines
+ * 3. Per-command: whitelist check + validateCommandRestrictions
+ * Returns an error message if blocked, or null if allowed.
+ */
+export function validateCommand(command) {
+    if (!command || !command.trim()) {
+        return "Command must not be empty.";
+    }
+    // Block dangerous shell operators ($(), backticks, redirections, process substitution)
+    const shellOpErr = validateShellOperators(command);
+    if (shellOpErr)
+        return shellOpErr;
+    // Split pipelines (|, &&, ;, ||) and validate each sub-command
+    const commands = extractCommands(command);
+    if (commands.length === 0) {
+        return "Command must not be empty.";
+    }
+    for (const cmd of commands) {
+        const baseName = getCommandBinary(cmd);
+        if (!baseName)
+            continue;
+        if (!ALLOWED_COMMANDS.has(baseName)) {
+            return JSON.stringify({
+                error: `Command "${baseName}" is not in the allowed command list.`,
+                allowed_categories: {
+                    network: "ip, ifconfig, ping, traceroute, tracepath, ss, netstat, route, arp, ethtool, mtr, bridge, tc, conntrack, nslookup, dig, host, curl",
+                    rdma: "ibstat, ibstatus, ibv_devinfo, ibv_devices, rdma, ibaddr, iblinkinfo, ibportstate, ibswitches, ibroute, show_gids, ibdev2netdev",
+                    perftest: "ib_write_bw, ib_write_lat, ib_read_bw, ib_read_lat, ib_send_bw, ib_send_lat, ib_atomic_bw, ib_atomic_lat, raw_ethernet_bw, raw_ethernet_lat, raw_ethernet_burst_lat",
+                    gpu: "nvidia-smi, gpustat, nvtopo",
+                    hardware: "lspci, lsusb, lsblk, lscpu, lsmem, lshw, dmidecode",
+                    kernel: "uname, hostname, uptime, dmesg, sysctl, lsmod, modinfo",
+                    process: "ps, pgrep, top, free, vmstat, iostat, mpstat, df, du, mount, findmnt, nproc",
+                    file: "cat, ls, pwd, stat, file, find, readlink, realpath, basename, dirname, diff, md5sum, sha256sum",
+                    general: "date, whoami, id, env, printenv, which",
+                },
+            }, null, 2);
+        }
+        // Apply unified command-level restrictions (find -exec, sysctl -w, curl -o, etc.)
+        const restrictionErr = validateCommandRestrictions(cmd);
+        if (restrictionErr)
+            return restrictionErr;
+    }
+    return null;
+}
+export function createNodeExecTool(kubeconfigRef) {
+    return {
+        name: "node_exec",
+        label: "Node Exec",
+        description: `Execute diagnostic commands directly on a Kubernetes node.
+Creates a privileged debug pod with nsenter to run the command in the host's full namespaces (mount, UTS, IPC, network, PID).
+The pod is automatically cleaned up after execution (--rm).
+
+Commands run on the HOST — they have access to the host's tools, filesystem, devices, /proc, /sys, and /dev.
+
+Use this tool for host-level diagnostics that cannot be done from within a pod, such as:
+- Inspecting host network interfaces, routes, and RDMA devices
+- Running RDMA perftest tools (ib_write_bw, ib_read_bw, etc.) on the node
+- Checking GPU status with nvidia-smi on the node
+- Reading host kernel parameters (sysctl, dmesg, lsmod)
+- Listing host hardware (lspci, lsblk, dmidecode)
+- Checking network connectivity with curl
+
+Allowed commands (ONLY these are permitted — do NOT use \`which\` to check, just run the command directly):
+  network: ip, ifconfig, ping, traceroute, tracepath, ss, netstat, route, arp, ethtool, mtr, bridge, tc, conntrack, nslookup, dig, host, curl
+  RDMA/RoCE: ibstat, ibstatus, ibv_devinfo, ibv_devices, rdma, ibaddr, iblinkinfo, ibportstate, show_gids, ibdev2netdev
+  perftest: ib_write_bw, ib_write_lat, ib_read_bw, ib_read_lat, ib_send_bw, ib_send_lat, ib_atomic_bw, ib_atomic_lat, raw_ethernet_bw, raw_ethernet_lat, raw_ethernet_burst_lat
+  GPU: nvidia-smi, gpustat, nvtopo
+  hardware: lspci, lsusb, lsblk, lscpu, lsmem, lshw, dmidecode
+  kernel: uname, hostname, uptime, dmesg, sysctl, lsmod, modinfo
+  process: ps, pgrep, top, free, vmstat, iostat, mpstat, df, du, mount, findmnt, nproc
+  file (read-only): cat, head, tail, ls, stat, file, wc, find, grep, diff, md5sum, sha256sum
+  text processing: sort, uniq, cut, tr, jq, yq, column
+  logs/services: journalctl, systemctl, timedatectl, hostnamectl
+  container: crictl, ctr
+  firewall (read-only): iptables, ip6tables
+  general: date, whoami, id, env, printenv, which, readlink, echo
+
+Pipes (|), && and ; are supported — each command in the pipeline must be in the whitelist.
+Output redirection (> file), input redirection (< file), $() and backticks are blocked.
+Some commands have extra restrictions: find blocks -exec/-delete, sysctl blocks -w, mount blocks actual mounting,
+curl blocks -o/-O/-T (file output/upload), env only allows listing (no command execution),
+systemctl only allows read-only subcommands, iptables only allows list operations.
+
+Examples:
+- node: "node-1", command: "ip addr show"
+- node: "node-1", command: "ip addr show | grep 10.0.0"
+- node: "node-1", command: "nvidia-smi"
+- node: "node-1", command: "ibstat"
+- node: "node-1", command: "ib_write_bw --help"
+- node: "node-1", command: "dmesg --level=err"
+- node: "node-1", command: "sysctl net.ipv4.ip_forward"
+- node: "node-1", command: "cat /etc/os-release"
+- node: "node-1", command: "curl -s http://10.0.0.1:8080/healthz"
+- node: "node-1", command: "ps aux | head -20"
+- node: "node-1", command: "journalctl -u kubelet -n 100 | grep error"`,
+        parameters: Type.Object({
+            node: Type.String({
+                description: "Kubernetes node name to debug",
+            }),
+            command: Type.String({
+                description: 'Diagnostic command to run on the node (e.g. "ip addr show", "nvidia-smi")',
+            }),
+            image: Type.Optional(Type.String({
+                description: `Debug container image (default: ${DEFAULT_IMAGE})`,
+            })),
+            timeout_seconds: Type.Optional(Type.Number({
+                description: "Timeout in seconds (default: 30, max: 120)",
+            })),
+        }),
+        renderCall(args, theme) {
+            const node = args?.node || "...";
+            const cmd = args?.command || "...";
+            return new Text(theme.fg("toolTitle", theme.bold("node_exec")) +
+                " " + theme.fg("accent", node) +
+                " " + theme.fg("toolTitle", theme.bold("$")) +
+                " " + cmd, 0, 0);
+        },
+        renderResult: renderTextResult,
+        async execute(_toolCallId, rawParams, signal) {
+            const params = rawParams;
+            const kubeconfigPath = resolveKubeconfigPath(kubeconfigRef?.credentialsDir);
+            const kubeconfigArgs = kubeconfigPath ? [`--kubeconfig=${kubeconfigPath}`] : [];
+            const childEnv = {
+                ...sanitizeEnv(process.env),
+                ...(kubeconfigRef?.credentialsDir ? { SICLAW_CREDENTIALS_DIR: kubeconfigRef.credentialsDir } : {}),
+                KUBECONFIG: "/dev/null",
+            };
+            // Validate node name
+            const nodeErr = validateNodeName(params.node);
+            if (nodeErr) {
+                return {
+                    content: [{ type: "text", text: JSON.stringify({ error: nodeErr }, null, 2) }],
+                    details: { blocked: true, reason: "invalid_node_name" },
+                };
+            }
+            // Validate command
+            const cmdErr = validateCommand(params.command);
+            if (cmdErr) {
+                return {
+                    content: [{ type: "text", text: cmdErr }],
+                    details: { blocked: true, reason: "command_blocked" },
+                };
+            }
+            // Check node exists and is Ready (after all local validation passes)
+            const nodeCheckErr = await checkNodeReady(params.node, childEnv, kubeconfigPath ?? undefined);
+            if (nodeCheckErr) {
+                return {
+                    content: [{ type: "text", text: JSON.stringify({ error: nodeCheckErr }, null, 2) }],
+                    details: { error: true },
+                };
+            }
+            const image = params.image || DEFAULT_IMAGE;
+            const timeout = Math.min(params.timeout_seconds ?? 30, 120) * 1000;
+            const commands = extractCommands(params.command);
+            const needsShell = commands.length > 1;
+            const cmdArgs = parseArgs(params.command);
+            // Generate a unique pod name
+            const podId = randomBytes(4).toString("hex");
+            const podName = `node-debug-${podId}`;
+            const cleanup = () => {
+                spawnAsync("kubectl", [
+                    ...kubeconfigArgs, "delete", "pod", podName, "--force", "--grace-period=0",
+                ], 10_000, childEnv).catch(() => { });
+            };
+            // Build overrides: privileged + hostPID + hostNetwork + nsenter
+            // Single command: pass args directly (no shell overhead)
+            // Pipeline: wrap in sh -c for shell interpretation
+            const nsenterCmd = needsShell
+                ? ["nsenter", "-t", "1", "-m", "-u", "-i", "-n", "-p", "--", "sh", "-c", params.command]
+                : ["nsenter", "-t", "1", "-m", "-u", "-i", "-n", "-p", "--", ...cmdArgs];
+            const overrides = JSON.stringify({
+                spec: {
+                    nodeName: params.node,
+                    hostPID: true,
+                    hostNetwork: true,
+                    containers: [{
+                            name: podName,
+                            image,
+                            securityContext: { privileged: true },
+                            command: nsenterCmd,
+                        }],
+                },
+            });
+            try {
+                // Phase 1: Create pod
+                await spawnAsync("kubectl", [
+                    ...kubeconfigArgs,
+                    "run", podName,
+                    "--restart=Never",
+                    `--image=${image}`,
+                    `--overrides=${overrides}`,
+                ], 30_000, childEnv, signal);
+                // Phase 2: Wait for pod to reach terminal phase (Succeeded or Failed)
+                try {
+                    await waitForPodDone(podName, timeout, childEnv, signal, kubeconfigPath ?? undefined);
+                }
+                catch {
+                    // Timed out — still fetch logs before cleanup
+                }
+                if (signal?.aborted) {
+                    cleanup();
+                    return {
+                        content: [{ type: "text", text: "Aborted." }],
+                        details: { error: true },
+                    };
+                }
+                // Phase 3: Fetch logs
+                let stdout = "";
+                let stderr = "";
+                try {
+                    const logsResult = await spawnAsync("kubectl", [
+                        ...kubeconfigArgs, "logs", podName,
+                    ], 10_000, childEnv);
+                    stdout = logsResult.stdout;
+                    stderr = logsResult.stderr;
+                }
+                catch (logErr) {
+                    stdout = logErr.stdout ?? "";
+                    stderr = logErr.stderr ?? "";
+                }
+                // Phase 4: Get exit code from pod status
+                let exitCode = null;
+                try {
+                    const statusResult = await spawnAsync("kubectl", [
+                        ...kubeconfigArgs, "get", "pod", podName,
+                        "-o", "jsonpath={.status.containerStatuses[0].state.terminated.exitCode}",
+                    ], 5_000, childEnv);
+                    const code = parseInt(statusResult.stdout.trim(), 10);
+                    if (!isNaN(code))
+                        exitCode = code;
+                }
+                catch {
+                    // ignore — exitCode stays null
+                }
+                // Phase 5: Cleanup
+                cleanup();
+                const filteredStderr = filterPodNoise(stderr);
+                const output = stdout.trim() + (filteredStderr ? `\n\nSTDERR:\n${filteredStderr}` : "");
+                if (exitCode === 0 || (exitCode === null && stdout.trim())) {
+                    return {
+                        content: [{ type: "text", text: processToolOutput(output) }],
+                        details: { exitCode: exitCode ?? 0 },
+                    };
+                }
+                else {
+                    const errOutput = `Exit code: ${exitCode ?? "unknown"}\n${output}`;
+                    return {
+                        content: [{ type: "text", text: processToolOutput(errOutput) }],
+                        details: { exitCode, error: true },
+                    };
+                }
+            }
+            catch (err) {
+                cleanup();
+                const output = `Exit code: ${err.code ?? "unknown"}\n${err.stdout?.trim() ?? ""}\n${err.stderr?.trim() ?? err.message}`;
+                return {
+                    content: [{ type: "text", text: processToolOutput(output) }],
+                    details: { exitCode: err.code, error: true },
+                };
+            }
+        },
+    };
+}
+/**
+ * Filter out kubectl run informational lines from stderr
+ * (e.g. 'pod "node-debug-xxx" deleted').
+ */
+function filterPodNoise(stderr) {
+    return stderr
+        .split("\n")
+        .filter((line) => !line.match(/^pod "node-debug-.*" deleted$/))
+        .join("\n")
+        .trim();
+}
+//# sourceMappingURL=node-exec.js.map

package/dist/tools/node-exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-exec.js","sourceRoot":"","sources":["../../src/tools/node-exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAG5C,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,gBAAgB,EAChB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE/E,SAAS,UAAU,CACjB,GAAW,EACX,IAAc,EACd,OAAe,EACf,GAAuB,EACvB,MAAoB;IAEpB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;YAC7B,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,GAAG;SACJ,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC,EAAE,OAAO,CAAC,CAAC;QACZ,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;;gBAE1C,MAAM,CACJ,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CACnE,CAAC;QACN,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC,UAAU,CAAC;AAE9C,+DAA+D;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,oDAAoD;AACpD,MAAM,YAAY,GAAG,8BAA8B,CAAC;AAEpD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1B,OAAO,8BAA8B,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO,sBAAsB,IAAI,oEAAoE,CAAC;IACxG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,OAAO,4BAA4B,CAAC;IACtC,CAAC;IAED,uFAAuF;IACvF,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,4BAA4B,CAAC;IACtC,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ;YAAE,SAAS;QAExB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,SAAS,CACnB;gBACE,KAAK,EAAE,YAAY,QAAQ,uCAAuC;gBAClE,kBAAkB,EAAE;oBAClB,OAAO,EAAE,oIAAoI;oBAC7I,IAAI,EAAE,iIAAiI;oBACvI,QAAQ,EAAE,qKAAqK;oBAC/K,GAAG,EAAE,6BAA6B;oBAClC,QAAQ,EAAE,oDAAoD;oBAC9D,MAAM,EAAE,wDAAwD;oBAChE,OAAO,EAAE,6EAA6E;oBACtF,IAAI,EAAE,gGAAgG;oBACtG,OAAO,EAAE,wCAAwC;iBAClD;aACF,EACD,IAAI,EACJ,CAAC,CACF,CAAC;QACJ,CAAC;QAED,kFAAkF;QAClF,MAAM,cAAc,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC;QACxD,IAAI,cAAc;YAAE,OAAO,cAAc,CAAC;IAC5C,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AASD,MAAM,UAAU,kBAAkB,CAAC,aAA6B;IAC9D,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,KAAK,EAAE,WAAW;QAClB,WAAW,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uEA8CsD;QACnE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;YACtB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;gBAChB,WAAW,EAAE,+BAA+B;aAC7C,CAAC;YACF,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC;gBACnB,WAAW,EACT,2EAA2E;aAC9E,CAAC;YACF,KAAK,EAAE,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,MAAM,CAAC;gBACV,WAAW,EAAE,mCAAmC,aAAa,GAAG;aACjE,CAAC,CACH;YACD,eAAe,EAAE,IAAI,CAAC,QAAQ,CAC5B,IAAI,CAAC,MAAM,CAAC;gBACV,WAAW,EAAE,4CAA4C;aAC1D,CAAC,CACH;SACF,CAAC;QACF,UAAU,CAAC,IAAS,EAAE,KAAU;YAC9B,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,KAAK,CAAC;YACjC,MAAM,GAAG,GAAG,IAAI,EAAE,OAAO,IAAI,KAAK,CAAC;YACnC,OAAO,IAAI,IAAI,CACb,KAAK,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC5C,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC;gBAC9B,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC5C,GAAG,GAAG,GAAG,EACX,CAAC,EAAE,CAAC,CACL,CAAC;QACJ,CAAC;QACD,YAAY,EAAE,gBAAgB;QAC9B,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM;YAC1C,MAAM,MAAM,GAAG,SAA2B,CAAC;YAC3C,MAAM,cAAc,GAAG,qBAAqB,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YAC5E,MAAM,cAAc,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,gBAAgB,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,MAAM,QAAQ,GAAG;gBACf,GAAG,WAAW,CAAC,OAAO,CAAC,GAA6B,CAAC;gBACrD,GAAG,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,aAAa,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClG,UAAU,EAAE,WAAW;aACxB,CAAC;YAEF,qBAAqB;YACrB,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;oBAC9E,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE;iBACxD,CAAC;YACJ,CAAC;YAED,mBAAmB;YACnB,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;oBACzC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE;iBACtD,CAAC;YACJ,CAAC;YAED,qEAAqE;YACrE,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,IAAI,SAAS,CAAC,CAAC;YAC9F,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;oBACnF,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;iBACzB,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,aAAa,CAAC;YAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;YACnE,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAE1C,6BAA6B;YAC7B,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC7C,MAAM,OAAO,GAAG,cAAc,KAAK,EAAE,CAAC;YAEtC,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,UAAU,CAAC,SAAS,EAAE;oBACpB,GAAG,cAAc,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,kBAAkB;iBAC3E,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACvC,CAAC,CAAC;YAEF,gEAAgE;YAChE,yDAAyD;YACzD,mDAAmD;YACnD,MAAM,UAAU,GAAG,UAAU;gBAC3B,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC;gBACxF,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,CAAC;YAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC/B,IAAI,EAAE;oBACJ,QAAQ,EAAE,MAAM,CAAC,IAAI;oBACrB,OAAO,EAAE,IAAI;oBACb,WAAW,EAAE,IAAI;oBACjB,UAAU,EAAE,CAAC;4BACX,IAAI,EAAE,OAAO;4BACb,KAAK;4BACL,eAAe,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;4BACrC,OAAO,EAAE,UAAU;yBACpB,CAAC;iBACH;aACF,CAAC,CAAC;YAEH,IAAI,CAAC;gBACH,sBAAsB;gBACtB,MAAM,UAAU,CAAC,SAAS,EAAE;oBAC1B,GAAG,cAAc;oBACjB,KAAK,EAAE,OAAO;oBACd,iBAAiB;oBACjB,WAAW,KAAK,EAAE;oBAClB,eAAe,SAAS,EAAE;iBAC3B,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAE7B,sEAAsE;gBACtE,IAAI,CAAC;oBACH,MAAM,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,IAAI,SAAS,CAAC,CAAC;gBACxF,CAAC;gBAAC,MAAM,CAAC;oBACP,8CAA8C;gBAChD,CAAC;gBAED,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;oBACpB,OAAO,EAAE,CAAC;oBACV,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;wBAC7C,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;qBACzB,CAAC;gBACJ,CAAC;gBAED,sBAAsB;gBACtB,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE;wBAC7C,GAAG,cAAc,EAAE,MAAM,EAAE,OAAO;qBACnC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;oBACrB,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;oBAC3B,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;gBAC7B,CAAC;gBAAC,OAAO,MAAW,EAAE,CAAC;oBACrB,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;oBAC7B,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;gBAC/B,CAAC;gBAED,yCAAyC;gBACzC,IAAI,QAAQ,GAAkB,IAAI,CAAC;gBACnC,IAAI,CAAC;oBACH,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE;wBAC/C,GAAG,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO;wBACxC,IAAI,EAAE,mEAAmE;qBAC1E,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;oBACpB,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;oBACtD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;wBAAE,QAAQ,GAAG,IAAI,CAAC;gBACpC,CAAC;gBAAC,MAAM,CAAC;oBACP,+BAA+B;gBACjC,CAAC;gBAED,mBAAmB;gBACnB,OAAO,EAAE,CAAC;gBAEV,MAAM,cAAc,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAExF,IAAI,QAAQ,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;oBAC3D,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;wBAC5D,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,IAAI,CAAC,EAAE;qBACrC,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,SAAS,GAAG,cAAc,QAAQ,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;oBACnE,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;wBAC/D,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE;qBACnC,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,OAAO,EAAE,CAAC;gBACV,MAAM,MAAM,GAAG,cAAc,GAAG,CAAC,IAAI,IAAI,SAAS,KAAK,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;gBACxH,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC5D,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;iBAC7C,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,MAAc;IACpC,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;SAC9D,IAAI,CAAC,IAAI,CAAC;SACV,IAAI,EAAE,CAAC;AACZ,CAAC"}

package/dist/tools/node-script.d.ts

@@ -0,0 +1,3 @@
+import type { ToolDefinition } from "@mariozechner/pi-coding-agent";
+import type { KubeconfigRef } from "../core/agent-factory.js";
+export declare function createNodeScriptTool(kubeconfigRef?: KubeconfigRef): ToolDefinition;

package/dist/tools/node-script.js

@@ -0,0 +1,266 @@
+import { Type } from "@sinclair/typebox";
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { Text } from "@mariozechner/pi-tui";
+import { validateNodeName } from "./node-exec.js";
+import { checkNodeReady, waitForPodDone } from "./k8s-checks.js";
+import { resolveKubeconfigPath } from "./kubeconfig-resolver.js";
+import { sanitizeEnv } from "./sanitize-env.js";
+import { resolveScript } from "./script-resolver.js";
+import { processToolOutput, renderTextResult } from "./tool-render.js";
+import { loadConfig } from "../core/config.js";
+import { parseArgs, shellEscape } from "./command-sets.js";
+const DEFAULT_IMAGE = loadConfig().debugImage;
+function spawnAsync(cmd, args, timeout, env, signal) {
+    return new Promise((resolve, reject) => {
+        let stdout = "";
+        let stderr = "";
+        const child = spawn(cmd, args, {
+            stdio: ["ignore", "pipe", "pipe"],
+            env,
+        });
+        const onAbort = () => child.kill("SIGKILL");
+        signal?.addEventListener("abort", onAbort, { once: true });
+        child.stdout.on("data", (chunk) => {
+            stdout += chunk.toString();
+        });
+        child.stderr.on("data", (chunk) => {
+            stderr += chunk.toString();
+        });
+        const timer = setTimeout(() => {
+            child.kill("SIGKILL");
+        }, timeout);
+        child.on("close", (code) => {
+            clearTimeout(timer);
+            signal?.removeEventListener("abort", onAbort);
+            if (code === 0)
+                resolve({ stdout, stderr });
+            else
+                reject(Object.assign(new Error(`exit ${code}`), { code, stdout, stderr }));
+        });
+        child.on("error", (err) => {
+            clearTimeout(timer);
+            signal?.removeEventListener("abort", onAbort);
+            reject(err);
+        });
+    });
+}
+function filterPodNoise(stderr) {
+    return stderr
+        .split("\n")
+        .filter((line) => !line.match(/^pod "node-debug-.*" deleted$/))
+        .join("\n")
+        .trim();
+}
+export function createNodeScriptTool(kubeconfigRef) {
+    return {
+        name: "node_script",
+        label: "Node Script",
+        renderCall(args, theme) {
+            return new Text(theme.fg("toolTitle", theme.bold("node_script")) +
+                " " + theme.fg("accent", args?.node || "") +
+                " " + theme.fg("muted", (args?.skill || "") + "/" + (args?.script || "")) +
+                (args?.args ? " " + args.args : ""), 0, 0);
+        },
+        renderResult: renderTextResult,
+        description: `Execute a skill or user script on a Kubernetes node via a privileged debug pod with nsenter.
+
+The script runs in the host's full namespaces (mount, UTS, IPC, network, PID) — it has access to the host's tools, filesystem, devices, /proc, /sys, and /dev.
+
+Use this for complex node-level diagnostics that need scripts (pipes, loops, functions), not just single commands.
+For single commands, use node_exec instead.
+
+Scripts must come from a skill's scripts/ directory or from user-uploaded scripts.
+
+Parameters:
+- node: Target Kubernetes node name
+- skill: Skill name (e.g. "node-logs"). If omitted, looks in user scripts
+- script: Script filename (e.g. "get-node-logs.sh")
+- args: Optional arguments to pass to the script
+- image: Debug container image (default: SICLAW_DEBUG_IMAGE)
+- timeout_seconds: Timeout (default: 180, max: 300)
+
+Examples:
+- node: "node-1", skill: "node-logs", script: "get-node-logs.sh", args: "--lines 100"
+- node: "node-1", script: "my-check.sh"`,
+        parameters: Type.Object({
+            node: Type.String({ description: "Kubernetes node name" }),
+            skill: Type.Optional(Type.String({
+                description: "Skill name (omit to use user scripts)",
+            })),
+            script: Type.String({ description: "Script filename" }),
+            args: Type.Optional(Type.String({ description: "Arguments to pass to the script" })),
+            image: Type.Optional(Type.String({
+                description: `Debug container image (default: ${DEFAULT_IMAGE})`,
+            })),
+            timeout_seconds: Type.Optional(Type.Number({
+                description: "Timeout in seconds (default: 180, max: 300)",
+            })),
+        }),
+        async execute(_toolCallId, rawParams, signal) {
+            const params = rawParams;
+            const kubeconfigPath = resolveKubeconfigPath(kubeconfigRef?.credentialsDir);
+            const kubeconfigArgs = kubeconfigPath ? [`--kubeconfig=${kubeconfigPath}`] : [];
+            const env = {
+                ...sanitizeEnv(process.env),
+                ...(kubeconfigRef?.credentialsDir ? { SICLAW_CREDENTIALS_DIR: kubeconfigRef.credentialsDir } : {}),
+                KUBECONFIG: "/dev/null",
+            };
+            // Validate node name format
+            const nodeErr = validateNodeName(params.node);
+            if (nodeErr) {
+                return {
+                    content: [{ type: "text", text: `Error: ${nodeErr}` }],
+                    details: { error: true },
+                };
+            }
+            // Check node exists and is Ready
+            const nodeCheckErr = await checkNodeReady(params.node, env, kubeconfigPath ?? undefined);
+            if (nodeCheckErr) {
+                return {
+                    content: [{ type: "text", text: `Error: ${nodeCheckErr}` }],
+                    details: { error: true },
+                };
+            }
+            // Resolve script
+            const resolved = resolveScript({
+                skill: params.skill,
+                script: params.script,
+            });
+            if ("error" in resolved) {
+                return {
+                    content: [{ type: "text", text: `Error: ${resolved.error}` }],
+                    details: { error: true },
+                };
+            }
+            const image = params.image || DEFAULT_IMAGE;
+            const timeout = Math.min(params.timeout_seconds ?? 180, 300) * 1000;
+            const args = params.args?.trim() || "";
+            // Security: shell-escape each argument to prevent injection via args parameter
+            const escapedArgs = args ? parseArgs(args).map(shellEscape).join(" ") : "";
+            // Base64 encode script content
+            const b64 = Buffer.from(resolved.content).toString("base64");
+            // Build the command that runs inside nsenter
+            const ext = resolved.interpreter === "python3" ? ".py" : ".sh";
+            const innerCmd = escapedArgs
+                ? `echo '${b64}' | base64 -d > /tmp/_s${ext} && ${resolved.interpreter} /tmp/_s${ext} ${escapedArgs}`
+                : `echo '${b64}' | base64 -d > /tmp/_s${ext} && ${resolved.interpreter} /tmp/_s${ext}`;
+            const podId = randomBytes(4).toString("hex");
+            const podName = `node-debug-${podId}`;
+            const cleanup = () => {
+                spawnAsync("kubectl", [...kubeconfigArgs, "delete", "pod", podName, "--force", "--grace-period=0"], 10_000, env).catch(() => { });
+            };
+            const overrides = JSON.stringify({
+                spec: {
+                    nodeName: params.node,
+                    hostPID: true,
+                    hostNetwork: true,
+                    containers: [
+                        {
+                            name: podName,
+                            image,
+                            securityContext: { privileged: true },
+                            command: [
+                                "nsenter",
+                                "-t",
+                                "1",
+                                "-m",
+                                "-u",
+                                "-i",
+                                "-n",
+                                "-p",
+                                "--",
+                                "sh",
+                                "-c",
+                                innerCmd,
+                            ],
+                        },
+                    ],
+                    restartPolicy: "Never",
+                },
+            });
+            try {
+                // Phase 1: Create pod
+                await spawnAsync("kubectl", [
+                    ...kubeconfigArgs,
+                    "run",
+                    podName,
+                    "--restart=Never",
+                    `--image=${image}`,
+                    `--overrides=${overrides}`,
+                ], 30_000, env, signal);
+                // Phase 2: Wait for pod to reach terminal phase (Succeeded or Failed)
+                try {
+                    await waitForPodDone(podName, timeout, env, signal, kubeconfigPath ?? undefined);
+                }
+                catch {
+                    // Timed out — still fetch logs before cleanup
+                }
+                if (signal?.aborted) {
+                    cleanup();
+                    return {
+                        content: [{ type: "text", text: "Aborted." }],
+                        details: { error: true },
+                    };
+                }
+                // Phase 3: Fetch logs
+                let stdout = "";
+                let stderr = "";
+                try {
+                    const logsResult = await spawnAsync("kubectl", [...kubeconfigArgs, "logs", podName], 10_000, env);
+                    stdout = logsResult.stdout;
+                    stderr = logsResult.stderr;
+                }
+                catch (logErr) {
+                    stdout = logErr.stdout ?? "";
+                    stderr = logErr.stderr ?? "";
+                }
+                // Phase 4: Get exit code
+                let exitCode = null;
+                try {
+                    const statusResult = await spawnAsync("kubectl", [
+                        ...kubeconfigArgs,
+                        "get",
+                        "pod",
+                        podName,
+                        "-o",
+                        "jsonpath={.status.containerStatuses[0].state.terminated.exitCode}",
+                    ], 5_000, env);
+                    const code = parseInt(statusResult.stdout.trim(), 10);
+                    if (!isNaN(code))
+                        exitCode = code;
+                }
+                catch {
+                    // ignore
+                }
+                // Phase 5: Cleanup
+                cleanup();
+                const filteredStderr = filterPodNoise(stderr);
+                const output = stdout.trim() +
+                    (filteredStderr ? `\n\nSTDERR:\n${filteredStderr}` : "");
+                if (exitCode === 0 || (exitCode === null && stdout.trim())) {
+                    return {
+                        content: [{ type: "text", text: processToolOutput(output) }],
+                        details: { exitCode: exitCode ?? 0 },
+                    };
+                }
+                else {
+                    const errOutput = `Exit code: ${exitCode ?? "unknown"}\n${output}`;
+                    return {
+                        content: [{ type: "text", text: processToolOutput(errOutput) }],
+                        details: { exitCode, error: true },
+                    };
+                }
+            }
+            catch (err) {
+                cleanup();
+                const output = `Exit code: ${err.code ?? "unknown"}\n${err.stdout?.trim() ?? ""}\n${err.stderr?.trim() ?? err.message}`;
+                return {
+                    content: [{ type: "text", text: processToolOutput(output) }],
+                    details: { exitCode: err.code, error: true },
+                };
+            }
+        },
+    };
+}
+//# sourceMappingURL=node-script.js.map

package/dist/tools/node-script.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-script.js","sourceRoot":"","sources":["../../src/tools/node-script.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE3D,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC,UAAU,CAAC;AAE9C,SAAS,UAAU,CACjB,GAAW,EACX,IAAc,EACd,OAAe,EACf,GAAuB,EACvB,MAAoB;IAEpB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;YAC7B,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,GAAG;SACJ,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC,EAAE,OAAO,CAAC,CAAC;QACZ,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;;gBAE1C,MAAM,CACJ,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CACnE,CAAC;QACN,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;SAC9D,IAAI,CAAC,IAAI,CAAC;SACV,IAAI,EAAE,CAAC;AACZ,CAAC;AAWD,MAAM,UAAU,oBAAoB,CAAC,aAA6B;IAChE,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,aAAa;QACpB,UAAU,CAAC,IAAS,EAAE,KAAU;YAC9B,OAAO,IAAI,IAAI,CACb,KAAK,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBAC9C,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;gBAC1C,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;gBACzE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EACrC,CAAC,EAAE,CAAC,CACL,CAAC;QACJ,CAAC;QACD,YAAY,EAAE,gBAAgB;QAC9B,WAAW,EAAE;;;;;;;;;;;;;;;;;;;wCAmBuB;QACpC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;YACtB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC;YAC1D,KAAK,EAAE,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,MAAM,CAAC;gBACV,WAAW,EAAE,uCAAuC;aACrD,CAAC,CACH;YACD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;YACvD,IAAI,EAAE,IAAI,CAAC,QAAQ,CACjB,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,iCAAiC,EAAE,CAAC,CAChE;YACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,MAAM,CAAC;gBACV,WAAW,EAAE,mCAAmC,aAAa,GAAG;aACjE,CAAC,CACH;YACD,eAAe,EAAE,IAAI,CAAC,QAAQ,CAC5B,IAAI,CAAC,MAAM,CAAC;gBACV,WAAW,EAAE,6CAA6C;aAC3D,CAAC,CACH;SACF,CAAC;QACF,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM;YAC1C,MAAM,MAAM,GAAG,SAA6B,CAAC;YAC7C,MAAM,cAAc,GAAG,qBAAqB,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YAC5E,MAAM,cAAc,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,gBAAgB,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,MAAM,GAAG,GAAG;gBACV,GAAG,WAAW,CAAC,OAAO,CAAC,GAA6B,CAAC;gBACrD,GAAG,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,aAAa,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClG,UAAU,EAAE,WAAW;aACxB,CAAC;YAEF,4BAA4B;YAC5B,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;oBACtD,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;iBACzB,CAAC;YACJ,CAAC;YAED,iCAAiC;YACjC,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,cAAc,IAAI,SAAS,CAAC,CAAC;YACzF,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,YAAY,EAAE,EAAE,CAAC;oBAC3D,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;iBACzB,CAAC;YACJ,CAAC;YAED,iBAAiB;YACjB,MAAM,QAAQ,GAAG,aAAa,CAAC;gBAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAC;YACH,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;oBAC7D,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;iBACzB,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,aAAa,CAAC;YAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;YACpE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACvC,+EAA+E;YAC/E,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAE3E,+BAA+B;YAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAE7D,6CAA6C;YAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;YAC/D,MAAM,QAAQ,GAAG,WAAW;gBAC1B,CAAC,CAAC,SAAS,GAAG,0BAA0B,GAAG,OAAO,QAAQ,CAAC,WAAW,WAAW,GAAG,IAAI,WAAW,EAAE;gBACrG,CAAC,CAAC,SAAS,GAAG,0BAA0B,GAAG,OAAO,QAAQ,CAAC,WAAW,WAAW,GAAG,EAAE,CAAC;YAEzF,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC7C,MAAM,OAAO,GAAG,cAAc,KAAK,EAAE,CAAC;YAEtC,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,UAAU,CACR,SAAS,EACT,CAAC,GAAG,cAAc,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,kBAAkB,CAAC,EAC5E,MAAM,EACN,GAAG,CACJ,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACpB,CAAC,CAAC;YAEF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC/B,IAAI,EAAE;oBACJ,QAAQ,EAAE,MAAM,CAAC,IAAI;oBACrB,OAAO,EAAE,IAAI;oBACb,WAAW,EAAE,IAAI;oBACjB,UAAU,EAAE;wBACV;4BACE,IAAI,EAAE,OAAO;4BACb,KAAK;4BACL,eAAe,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;4BACrC,OAAO,EAAE;gCACP,SAAS;gCACT,IAAI;gCACJ,GAAG;gCACH,IAAI;gCACJ,IAAI;gCACJ,IAAI;gCACJ,IAAI;gCACJ,IAAI;gCACJ,IAAI;gCACJ,IAAI;gCACJ,IAAI;gCACJ,QAAQ;6BACT;yBACF;qBACF;oBACD,aAAa,EAAE,OAAO;iBACvB;aACF,CAAC,CAAC;YAEH,IAAI,CAAC;gBACH,sBAAsB;gBACtB,MAAM,UAAU,CACd,SAAS,EACT;oBACE,GAAG,cAAc;oBACjB,KAAK;oBACL,OAAO;oBACP,iBAAiB;oBACjB,WAAW,KAAK,EAAE;oBAClB,eAAe,SAAS,EAAE;iBAC3B,EACD,MAAM,EACN,GAAG,EACH,MAAM,CACP,CAAC;gBAEF,sEAAsE;gBACtE,IAAI,CAAC;oBACH,MAAM,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,IAAI,SAAS,CAAC,CAAC;gBACnF,CAAC;gBAAC,MAAM,CAAC;oBACP,8CAA8C;gBAChD,CAAC;gBAED,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;oBACpB,OAAO,EAAE,CAAC;oBACV,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;wBAC7C,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;qBACzB,CAAC;gBACJ,CAAC;gBAED,sBAAsB;gBACtB,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,UAAU,GAAG,MAAM,UAAU,CACjC,SAAS,EACT,CAAC,GAAG,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,EACpC,MAAM,EACN,GAAG,CACJ,CAAC;oBACF,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;oBAC3B,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;gBAC7B,CAAC;gBAAC,OAAO,MAAW,EAAE,CAAC;oBACrB,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;oBAC7B,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;gBAC/B,CAAC;gBAED,yBAAyB;gBACzB,IAAI,QAAQ,GAAkB,IAAI,CAAC;gBACnC,IAAI,CAAC;oBACH,MAAM,YAAY,GAAG,MAAM,UAAU,CACnC,SAAS,EACT;wBACE,GAAG,cAAc;wBACjB,KAAK;wBACL,KAAK;wBACL,OAAO;wBACP,IAAI;wBACJ,mEAAmE;qBACpE,EACD,KAAK,EACL,GAAG,CACJ,CAAC;oBACF,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;oBACtD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;wBAAE,QAAQ,GAAG,IAAI,CAAC;gBACpC,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBAED,mBAAmB;gBACnB,OAAO,EAAE,CAAC;gBAEV,MAAM,cAAc,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC9C,MAAM,MAAM,GACV,MAAM,CAAC,IAAI,EAAE;oBACb,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAE3D,IAAI,QAAQ,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;oBAC3D,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;wBAC5D,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,IAAI,CAAC,EAAE;qBACrC,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,SAAS,GAAG,cAAc,QAAQ,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;oBACnE,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;wBAC/D,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE;qBACnC,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,OAAO,EAAE,CAAC;gBACV,MAAM,MAAM,GAAG,cAAc,GAAG,CAAC,IAAI,IAAI,SAAS,KAAK,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;gBACxH,OAAO;oBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC5D,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;iBAC7C,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/tools/pod-exec.d.ts

@@ -0,0 +1,4 @@
+import type { ToolDefinition } from "@mariozechner/pi-coding-agent";
+import type { KubeconfigRef } from "../core/agent-factory.js";
+export declare function validatePodName(pod: string): string | null;
+export declare function createPodExecTool(kubeconfigRef?: KubeconfigRef): ToolDefinition;