thincoder 0.12.18 → 0.12.19

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thincoder",
-  "version": "0.12.18",
+  "version": "0.12.19",
   "description": "Thin coding agent - zero dependencies, no build step, Node.js native. Sharp code, zero bloat.",
   "keywords": [
     "ai",

package/src/acp/bridge.mjs

@@ -20,6 +20,7 @@
  * `{ stopReason: "end_turn" }` (kimi session.ts parity).
  */
 import { join } from "node:path"
+import { detectDanger } from "../tools/shared.mjs"
 
 /** ACP ToolKind inference (schema v1 enum) — best-effort, clients render by kind. */
 function inferToolKind(name) {
@@ -99,10 +100,16 @@ export function buildAcpCallbacks({ sessionId, notify, request, log = () => {} }
      * client. Any transport failure → reject (safety-first, kimi parity).
      */
     onPermissionRequest: async (name, args) => {
+      // 危险命令标注(只提示不拦截):kimi 同款模式,帮助编辑器端用户审批
+      const base = name.includes("/") ? name.split("/").pop() : name
+      const danger = base === "bash" ? detectDanger(args?.command ?? "") : undefined
+      const content = [contentBlock(`Requesting approval to run ${name}`)]
+      if (danger) content.push(contentBlock(`⚠️ Dangerous: ${danger}`))
+      content.push(contentBlock(JSON.stringify(args ?? {})))
       const toolCall = {
         toolCallId: toolIds.get(name) ?? toolCallId(),
         title: name,
-        content: [contentBlock(`Requesting approval to run ${name}`), contentBlock(JSON.stringify(args ?? {}))],
+        content,
       }
       try {
         const response = await request("session/request_permission", {

package/src/tools/shared.mjs

@@ -241,27 +241,47 @@ export function hasFileRedirection(command) {
   return /(^|[\s;&|0-9])>{1,2}\s*\S/.test(bare) || /(^|[\s;&|0-9])<\s*\S/.test(bare)
 }
 
-/** Whether a single command segment is a destructive non-git command (conservative: prefer false positives) */
-export function isDestructiveCommand(seg) {
-  const s = seg
-  // rm with recursive (-r/-R/--recursive): destructive WITH or WITHOUT -f
-  // (recursive delete removes trees non-interactively in many setups; -rf is
-  // the classic case). Conservative: prefer blocking. The \s before the flag
-  // requires a separator — "rm-rf" is not a valid command (no such program).
-  if (/\brm\b/.test(s) && (/\s-\S*r/i.test(s) || /\s--recursive\b/i.test(s))) return true
-  if (/\brmdir\b/i.test(s)) return true
-  if (/\bdel\b/i.test(s) && /\/f\b/i.test(s)) return true
-  if (/\brd\b/i.test(s) && /\/s\b/i.test(s)) return true
-  // format called as a command (exclude --format= option false positives)
-  if (/\bformat\b\s+\S/i.test(s) && !/--format\b/i.test(s)) return true
-  if (/\bshred\b/i.test(s)) return true
-  if (/\bdd\b/.test(s) && /\bof=/i.test(s)) return true
-  if (/\bDROP\s+TABLE\b/i.test(s)) return true
-  if (/\bDELETE\s+FROM\b/i.test(s)) return true
-  if (/\bTRUNCATE\b/i.test(s)) return true
+/**
+ * Whether a single command segment is destructive — ALWAYS FALSE (deliberate).
+ *
+ * 决策(2026-08):文本拦截对恶意模型是安全剧场——空白变体/heredoc/node -e/写脚本执行
+ * 都能绕过,拦住的只有正常操作(如清理临时目录、rm node_modules 重装)。
+ * 真实防线在工具审批层(autoApprove)与快照兜底(gitGuardSnapshot / checkpoint auto-snapshot),
+ * 与 env 过滤、git 破坏操作"快照后放行、永不拦截"同一哲学。
+ * 项目工具自带确认门(如 thin5 scripts/db.mjs --write/--danger)不应被双重拦截。
+ */
+export function isDestructiveCommand() {
   return false
 }
 
+/**
+ * 危险命令识别(只标注、不拦截)——参考 kimi-code apps/kimi-code/src/tui/reverse-rpc/approval/adapter.ts
+ * DANGER_PATTERNS。定位:给审批中的人打红色警告标签,提升决策信息,不是机器防线。
+ * 拦截无用(可绕过),标注有用(人看到了才知道该多看一眼)。
+ */
+const DANGER_PATTERNS = [
+  { pattern: /\brm\s+(-[a-zA-Z]*[rRfF][a-zA-Z]*|--recursive|--force)/i, label: "recursive delete" },
+  { pattern: /\bsudo\b/i, label: "sudo" },
+  { pattern: /\b(curl|wget)\b[^|]*\|\s*(sh|bash|zsh)\b/i, label: "pipe to shell" },
+  { pattern: /\bdd\b[^|]*\bof=/i, label: "dd write" },
+  { pattern: /\bmkfs\b/i, label: "mkfs" },
+  { pattern: />\s*\/dev\/(sd|nvme|disk|hd)/i, label: "write to raw device" },
+  { pattern: /\bchmod\s+(?:-[rR]\s+)?777\b/i, label: "chmod 777" },
+  { pattern: /:\(\)\s*\{\s*:\|:&\s*\}/i, label: "fork bomb" },
+]
+
+/** 返回危险标注 label(如 "recursive delete");无危险返回 undefined。
+ *  引号感知:引号(单/双)内的内容清空后再检测——commit message、echo 文本等
+ *  纯文本不误标;危险命令(rm -rf "$dir")的参数在引号外,仍命中。
+ *  反引号内容保留(命令替换会执行)。 */
+export function detectDanger(command) {
+  const s = blankQuoted(String(command ?? ""))
+  for (const { pattern, label } of DANGER_PATTERNS) {
+    if (pattern.test(s)) return label
+  }
+  return undefined
+}
+
 
 /** Convert glob pattern to regex */
 export function globToRegex(pattern) {

package/src/tools/system.mjs

@@ -6,8 +6,6 @@ import {
   BASH_TIMEOUT_MS,
   IGNORED_DIRS,
   resolveInCwd,
-  shellSegments,
-  isDestructiveCommand,
   hasFileRedirection,
   globToRegex,
   normalizeEOL,
@@ -25,21 +23,16 @@ const MAX_STREAM_BUF = 2_000_000
 
 /**
  * Pre-execution safety checks for bash commands.
- * Layers: file redirection → destructive commands (rm -rf etc.).
- * Git destructive ops are deliberately NOT rejected — the model would just find a
- * way around the rejection; instead gitGuardSnapshot copies every uncommitted file
- * and the command is ALLOWED (snapshot-then-proceed, never block).
+ * Layers: file redirection (guides toward structured tools, not a security gate).
+ * Destructive commands (rm -rf, DROP TABLE, ...) are deliberately NOT rejected:
+ * a determined model bypasses text matching anyway — real security is at the
+ * tool approval layer plus snapshot backups (gitGuardSnapshot / checkpoint).
+ * Git destructive ops: snapshot-then-proceed, never block.
  */
 function checkBashSafety(command, cwd) {
   if (hasFileRedirection(command)) {
     throw new Error("File redirection via bash is not allowed — use the write/edit/insert_after tools instead")
   }
-  if (shellSegments(command).some(isDestructiveCommand)) {
-    throw new Error(
-      "Destructive command blocked — use specific tools or confirm with the user first. " +
-      "(If work was already destroyed, recover from auto-snapshot: checkpoint action=list then action=rewind.)"
-    )
-  }
 }
 
 /**

package/src/tui/interaction.mjs

@@ -1,4 +1,5 @@
 import { ansi, C } from "./ansi.mjs"
+import { detectDanger } from "../tools/shared.mjs"
 
 /** Interaction primitives: permission approval + question input.
  *  Extracted from index.mjs, receives closure dependencies via createInteraction(ctx).
@@ -10,7 +11,13 @@ export function createInteraction(ctx) {
   function formatPermission(name, args) {
     const cap = (s, n = 3000) => (s.length > n ? `${s.slice(0, n)}…(${s.length} chars total)` : s)
     const base = name.includes("/") ? name.split("/").pop() : name
-    if (base === "bash") return cap(args.command ?? "").split("\n")
+    if (base === "bash") {
+      // 危险命令标注(只提示不拦截):给人看的红色警告,帮审批决策
+      const danger = detectDanger(args.command ?? "")
+      const lines = []
+      if (danger) lines.push(`${C.error}⚠️ Dangerous: ${danger}${ansi.reset}`)
+      return [...lines, ...cap(args.command ?? "").split("\n")]
+    }
     if (base === "write") {
       // approving file writes must show what's being written: path + content preview
       return [`${args.path} (write ${(args.content ?? "").length} chars)`, ...cap(args.content ?? "", 3000).split("\n")]