skimpyclaw 0.3.14 → 0.4.0

package/dist/skills.js

@@ -64,17 +64,10 @@ export function checkEligibility(skill, toolConfig) {
         if (!toolConfig?.enabled) {
             return { eligible: false, reason: `Tools not enabled (needs: ${reqs.tools.join(', ')})` };
         }
-        const missing = [];
-        for (const tool of reqs.tools) {
-            const t = tool.toLowerCase();
-            if (t === 'browser') {
-                if (!toolConfig.browser?.enabled)
-                    missing.push(tool);
-            }
-            // built-in tools are available whenever tools.enabled is true
-        }
+        const supportedTools = new Set(['read', 'write', 'glob', 'bash', 'fetch', 'code_with_agent', 'check_code_agent', 'delegate_to_agent']);
+        const missing = reqs.tools.filter(tool => !supportedTools.has(tool.toLowerCase()));
         if (missing.length > 0) {
-            return { eligible: false, reason: `Tools not enabled (needs: ${missing.join(', ')})` };
+            return { eligible: false, reason: `Unsupported tools requested: ${missing.join(', ')}` };
         }
     }
     return { eligible: true };
@@ -156,7 +149,6 @@ export function loadSkills(skillConfig, toolConfig) {
         entries: skillConfig?.entries,
         enabled: skillConfig?.enabled,
         toolEnabled: toolConfig?.enabled,
-        browserEnabled: toolConfig?.browser?.enabled,
     });
     const cached = skillsCache.get(cacheKey);
     if (cached)

package/dist/tools/agent-delegation.d.ts

@@ -0,0 +1,19 @@
+import type { Config } from '../types.js';
+import type { ExecuteToolContext } from './execute-context.js';
+export interface DelegateToAgentInput {
+    alias?: string;
+    task?: string;
+    mode?: string;
+    wait?: boolean;
+    allowSelf?: boolean;
+}
+export interface NormalizedDelegateToAgentInput {
+    alias: string;
+    task: string;
+    mode: 'new_thread';
+    wait: boolean;
+    allowSelf: boolean;
+}
+export type DelegateToAgentHandler = (input: NormalizedDelegateToAgentInput, config: Config, context?: ExecuteToolContext) => Promise<string>;
+export declare function registerDelegateToAgentHandler(nextHandler: DelegateToAgentHandler | null): void;
+export declare function executeDelegateToAgent(input: DelegateToAgentInput, config: Config, context?: ExecuteToolContext): Promise<string>;

package/dist/tools/agent-delegation.js

@@ -0,0 +1,49 @@
+const MAX_DELEGATION_DEPTH = 2;
+const ALIAS_RE = /^[a-z][a-z0-9_-]{0,63}$/;
+let handler = null;
+function normalizeAlias(value) {
+    const normalized = typeof value === 'string'
+        ? value.trim().replace(/^@/, '').toLowerCase()
+        : '';
+    return ALIAS_RE.test(normalized) ? normalized : null;
+}
+export function registerDelegateToAgentHandler(nextHandler) {
+    handler = nextHandler;
+}
+export async function executeDelegateToAgent(input, config, context) {
+    const alias = normalizeAlias(input.alias);
+    if (!alias) {
+        return 'Error: alias must start with a letter and use only letters, numbers, underscore, or dash.';
+    }
+    const task = typeof input.task === 'string' ? input.task.trim() : '';
+    if (!task) {
+        return 'Error: task is required.';
+    }
+    const mode = input.mode?.trim() || 'new_thread';
+    if (mode !== 'new_thread') {
+        return 'Error: delegate_to_agent currently supports mode "new_thread" only.';
+    }
+    if (context?.channel !== 'discord') {
+        return 'Error: delegate_to_agent is currently Discord-only.';
+    }
+    if (context?.isDm) {
+        return 'Error: delegate_to_agent requires a Discord server channel. Direct messages do not support task threads.';
+    }
+    const depth = context?.delegationDepth ?? 0;
+    if (depth >= MAX_DELEGATION_DEPTH) {
+        return `Error: maximum agent delegation depth reached (${MAX_DELEGATION_DEPTH}).`;
+    }
+    if (!input.allowSelf && context?.threadAgentAlias === alias) {
+        return `Error: @${alias} cannot delegate to itself. Choose another agent profile.`;
+    }
+    if (!handler) {
+        return 'Error: Discord agent delegation is not available.';
+    }
+    return handler({
+        alias,
+        task,
+        mode,
+        wait: input.wait === true,
+        allowSelf: input.allowSelf === true,
+    }, config, context);
+}

package/dist/tools/bash-tool.js

@@ -1,33 +1,51 @@
-import { exec } from 'child_process';
+import { spawn } from 'child_process';
 import { isBashCommandSafe } from '../security.js';
 import { classifyCommandRisk, requiresApproval, createApprovalRequest, waitForApproval, } from '../exec-approval.js';
 import { isPathAllowed } from './path-utils.js';
 import { validateBashPaths } from './bash-path-validation.js';
-/** Env var name patterns that should never be exposed to model-executed commands. */
-const SENSITIVE_ENV_PATTERNS = [
-    /api.?key/i, /token/i, /secret/i, /password/i, /credential/i,
-    /^ANTHROPIC_/i, /^OPENAI_/i, /^CLAUDE/i, /^CODEX_/i, /^MINIMAX_/i,
-    /^KIMI_/i, /^TOGETHER_/i, /^GROQ_/i, /^OPENROUTER_/i,
-];
-/** Env vars that match SENSITIVE_ENV_PATTERNS but should be kept (e.g. tool auth). */
-const SENSITIVE_ENV_ALLOWLIST = new Set(['GH_TOKEN']);
-/** Common tool paths that may be missing when launched as a service/daemon. */
-const EXTRA_PATH_DIRS = ['/opt/homebrew/bin', '/opt/homebrew/sbin', '/usr/local/bin'];
-/** Create a sanitized copy of process.env with secrets stripped. */
-function sanitizeEnv() {
-    const env = { ...process.env };
-    for (const key of Object.keys(env)) {
-        if (!SENSITIVE_ENV_ALLOWLIST.has(key) && SENSITIVE_ENV_PATTERNS.some(p => p.test(key))) {
-            delete env[key];
+import { sanitizeExecEnv } from '../env-sanitizer.js';
+const SHELL_CONTROL_PATTERN = /[|&;<>()`$\n]/;
+function tokenizeCommand(command) {
+    const tokens = [];
+    let current = '';
+    let quote = null;
+    for (let i = 0; i < command.length; i++) {
+        const ch = command[i];
+        if (ch === '\\' && quote !== "'") {
+            const next = command[i + 1];
+            if (next) {
+                current += next;
+                i++;
+            }
+            continue;
         }
+        if (quote) {
+            if (ch === quote) {
+                quote = null;
+            }
+            else {
+                current += ch;
+            }
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            continue;
+        }
+        if (/\s/.test(ch)) {
+            if (current) {
+                tokens.push(current);
+                current = '';
+            }
+            continue;
+        }
+        current += ch;
     }
-    // Ensure common tool directories are in PATH (daemon/service launches often have a minimal PATH)
-    const currentPath = env.PATH || '';
-    const missing = EXTRA_PATH_DIRS.filter(d => !currentPath.includes(d));
-    if (missing.length > 0) {
-        env.PATH = `${currentPath}:${missing.join(':')}`;
-    }
-    return env;
+    if (quote)
+        return null;
+    if (current)
+        tokens.push(current);
+    return tokens;
 }
 export async function executeBash(command, cwd, config, context) {
     // Hard block: existing safety filter (always enforced)
@@ -79,21 +97,58 @@ export async function executeBash(command, cwd, config, context) {
             // Approved — fall through to execution below
         }
     }
+    if (SHELL_CONTROL_PATTERN.test(command)) {
+        return 'Error: Shell control operators are blocked in safe mode. Run a single executable with explicit arguments (no pipes, redirects, chaining, or subshell expansion).';
+    }
+    const argv = tokenizeCommand(command);
+    if (!argv || argv.length === 0) {
+        return 'Error: Invalid command syntax.';
+    }
     const timeout = config.bashTimeout || 30_000;
+    const [executable, ...args] = argv;
     return new Promise((res) => {
-        exec(command, {
+        const child = spawn(executable, args, {
             cwd: cwd || undefined,
-            timeout,
-            env: sanitizeEnv(),
-            maxBuffer: 5 * 1024 * 1024,
-        }, (error, stdout, stderr) => {
-            if (error) {
-                const parts = [stdout, stderr, `Exit code: ${error.code ?? 'unknown'}`].filter(Boolean);
-                res(parts.join('\n').slice(0, 50_000));
+            env: sanitizeExecEnv(),
+            stdio: ['ignore', 'pipe', 'pipe'],
+            shell: false,
+        });
+        let stdout = '';
+        let stderr = '';
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            child.kill('SIGTERM');
+            setTimeout(() => child.kill('SIGKILL'), 1000);
+        }, timeout);
+        child.stdout.on('data', (chunk) => {
+            stdout += chunk.toString();
+            if (stdout.length > 60_000)
+                stdout = stdout.slice(-60_000);
+        });
+        child.stderr.on('data', (chunk) => {
+            stderr += chunk.toString();
+            if (stderr.length > 60_000)
+                stderr = stderr.slice(-60_000);
+        });
+        child.on('error', (error) => {
+            clearTimeout(timer);
+            res(`Error: ${error.message}`);
+        });
+        child.on('close', (code, signal) => {
+            clearTimeout(timer);
+            if (timedOut) {
+                const output = [stdout, stderr].filter(Boolean).join('\n');
+                res((output ? `${output}\n` : '') + `Exit code: timeout after ${timeout}ms`);
+                return;
+            }
+            const output = [stdout, stderr].filter(Boolean).join('\n').slice(0, 50_000);
+            if (code && code !== 0) {
+                const reason = signal ? `signal ${signal}` : `Exit code: ${code}`;
+                res((output ? `${output}\n` : '') + reason);
                 return;
             }
-            const output = [stdout, stderr].filter(Boolean).join('\n');
-            res(output.slice(0, 50_000) || '(no output)');
+            res(output || '(no output)');
         });
     });
 }