switchroom 0.20.9 → 0.20.11

package/dist/cli/skill-validate-pretool.mjs

@@ -6919,7 +6919,7 @@ var require_public_api = __commonJS((exports) => {
 
 // src/cli/skill-validate-pretool.ts
 import { readFileSync, lstatSync, readdirSync } from "node:fs";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 
 // node_modules/.bun/yaml@2.8.3/node_modules/yaml/dist/index.js
 var composer = require_composer();
@@ -7219,9 +7219,16 @@ function validateSkillMd(content, expectedName) {
 }
 var BANNED_PHRASE = "claude" + " -p";
 
+// src/self-improve/config.ts
+function selfImproveEnabled() {
+  return process.env.SWITCHROOM_SELF_IMPROVE !== "0";
+}
+
 // src/cli/skill-validate-pretool.ts
 var SKILLS_SEGMENT = "/.claude/skills/";
 var EDIT_TOOLS = new Set(["Write", "Edit", "MultiEdit"]);
+var EVALS_JSON_REL = "evals/evals.json";
+var ABS_SKILL_EVALS_RE = /\/\.claude\/skills\/[^/]+\/evals\/evals\.json$/;
 function readStdin() {
   try {
     return readFileSync(0, "utf8");
@@ -7280,6 +7287,72 @@ function fileSize(p) {
     return 0;
   }
 }
+var BASH_WRITERS = new Set([
+  "tee",
+  "cp",
+  "mv",
+  "dd",
+  "install",
+  "truncate",
+  "rsync"
+]);
+function tokenIsSkillEvalsJson(token) {
+  const t = token.replace(/^['"]+/, "").replace(/['"]+$/, "");
+  if (!t.includes(".claude/skills/"))
+    return false;
+  return ABS_SKILL_EVALS_RE.test(resolve("/", t));
+}
+function redirectWritesEvals(command) {
+  const re = /(?:^|[^<>&\d])(?:\d+|&)?>>?(?:&(?![\d-]))?\|?\s*(['"]?)([^\s'"|;&()<>]+)\1/g;
+  let m;
+  while ((m = re.exec(command)) !== null) {
+    if (m[2] && tokenIsSkillEvalsJson(m[2]))
+      return true;
+  }
+  return false;
+}
+function writerVerbWritesEvals(command) {
+  for (const seg of command.split(/&&|\|\||[;|\n]/g)) {
+    const tokens = seg.trim().split(/\s+/).filter((s) => s.length > 0);
+    if (tokens.length === 0)
+      continue;
+    const verb = tokens[0].replace(/^['"]+/, "");
+    const rest = tokens.slice(1);
+    if (BASH_WRITERS.has(verb)) {
+      for (const tok of rest) {
+        const p = tok.startsWith("of=") ? tok.slice(3) : tok;
+        if (tokenIsSkillEvalsJson(p))
+          return true;
+      }
+    }
+    if (verb === "sed" && rest.some((r) => r === "-i" || r.startsWith("-i"))) {
+      for (const tok of rest)
+        if (tokenIsSkillEvalsJson(tok))
+          return true;
+    }
+  }
+  return false;
+}
+function detectBashEvalsWrite(command) {
+  if (redirectWritesEvals(command))
+    return "a shell redirect into";
+  if (writerVerbWritesEvals(command))
+    return "a shell write into";
+  return null;
+}
+function handleBash(event) {
+  if (!selfImproveEnabled())
+    allow();
+  const input = event.tool_input && typeof event.tool_input === "object" ? event.tool_input : {};
+  const command = typeof input.command === "string" ? input.command : "";
+  if (!command)
+    allow();
+  const how = detectBashEvalsWrite(command);
+  if (how) {
+    block(`evals/evals.json is machine-managed under self-improvement \u2014 ${how} it ` + `via Bash bypasses the PII/secret scan and the operator's one-tap ` + `approval. Add a case with: switchroom self-improve add-eval-case ` + `--skill <slug> --prompt "<the correction, as a test prompt>". ` + `(To hand-author evals via skill-creator instead, set ` + `SWITCHROOM_SELF_IMPROVE=0.)`);
+  }
+  allow();
+}
 function main() {
   const raw = readStdin().trim();
   if (!raw)
@@ -7291,12 +7364,15 @@ function main() {
     allow();
   }
   const toolName = typeof event.tool_name === "string" ? event.tool_name : "";
+  if (toolName === "Bash")
+    handleBash(event);
   if (!EDIT_TOOLS.has(toolName))
     allow();
   const input = event.tool_input && typeof event.tool_input === "object" ? event.tool_input : {};
-  const filePath = typeof input.file_path === "string" ? input.file_path : "";
-  if (!filePath)
+  const rawFilePath = typeof input.file_path === "string" ? input.file_path : "";
+  if (!rawFilePath)
     allow();
+  const filePath = resolve(rawFilePath);
   const segIdx = filePath.indexOf(SKILLS_SEGMENT);
   if (segIdx < 0)
     allow();
@@ -7307,6 +7383,9 @@ function main() {
   const slug = segs[0];
   const relPath = segs.slice(1).join("/");
   const skillDir = filePath.slice(0, segIdx + SKILLS_SEGMENT.length) + slug;
+  if (selfImproveEnabled() && relPath === EVALS_JSON_REL) {
+    block(`evals/evals.json is machine-managed under self-improvement \u2014 a direct ` + `write bypasses the PII/secret scan and the operator's one-tap ` + `approval. Add a case with: switchroom self-improve add-eval-case ` + `--skill ${slug} --prompt "<the correction, as a test prompt>". ` + `(To hand-author evals via skill-creator instead, set ` + `SWITCHROOM_SELF_IMPROVE=0.)`);
+  }
   const warnings = [];
   if (!validateSkillName(slug)) {
     warnings.push(`skill slug "${slug}" is invalid \u2014 must match ` + `[a-z0-9][a-z0-9_-]{0,62}. Claude won't discover a skill at an ` + `invalid slug.`);