whale-code 6.5.5 → 6.5.7

package/dist/cli/services/tools/shell-exec.js

@@ -3,6 +3,7 @@
  *
  * Extracted from local-tools.ts for single-responsibility.
  */
+
 import { join } from "path";
 import { spawn } from "child_process";
 import { homedir } from "os";
@@ -11,168 +12,213 @@ import { getGlobalEmitter } from "../agent-events.js";
 import { sandboxCommand, cleanupSandbox } from "../sandbox.js";
 import { debugLog } from "../debug-log.js";
 function resolvePath(p) {
-    if (p.startsWith("~/"))
-        return join(homedir(), p.slice(2));
-    return p;
+  if (p.startsWith("~/")) return join(homedir(), p.slice(2));
+  return p;
 }
 export async function runCommand(input) {
-    let command = input.command;
-    const cwd = input.working_directory ? resolvePath(input.working_directory) : undefined;
-    const timeout = Math.min(input.timeout || 30000, 300000);
-    const background = input.run_in_background;
-    const description = input.description;
-    debugLog("tools", `run_command: ${description || command.slice(0, 80)}`, { cwd, timeout, background });
-    // ── Safety guardrail ──
-    // Minimal filter for catastrophic commands that bypass the macOS sandbox.
-    // The sandbox (sandbox-exec) is the real security boundary — it restricts
-    // file writes to cwd + /tmp + ~/.swagmanager only.
-    //
-    // Philosophy: block ONLY what the sandbox cannot prevent.
-    //   - Hardware/filesystem damage (mkfs, dd to block devices)
-    //   - Process-level DoS (fork bomb)
-    //   - rm on literal root / or home ~ (sanity check)
-    //
-    // Everything else is allowed — chmod, chown, curl|bash, npm, pip, etc.
-    // are either harmless within the sandbox or need sudo to do real damage.
-    if (command.length > 10000) {
-        return { success: false, output: "Command too long (max 10000 chars)" };
-    }
-    const DANGEROUS_PATTERNS = [
-        // rm on literal root (/) or (/*) — NOT subdirectories like /tmp, /Users/...
-        /\brm\b[^|;]*\s\/(\*)?(\s*$|\s*[;|&])/i,
-        // rm on literal home (~) or (~/) or (~/*) — NOT subdirs like ~/project
-        /\brm\b[^|;]*\s~\/?(\*)?(\s*$|\s*[;|&])/i,
-        // Format filesystem — irreversible hardware damage
-        /\bmkfs\b/i,
-        // dd writing to raw block devices — irreversible hardware damage
-        /\bdd\b.*\bof=\s*\/dev\/(sd|hd|nvme|disk|rdisk|vd)/i,
-        // Redirect to raw block devices
-        />\s*\/dev\/(sd|hd|nvme|disk|rdisk|vd)/,
-        // Fork bomb — process-level DoS, sandbox cannot prevent
-        /:\(\)\s*\{.*\|.*&\s*\}\s*;/,
-    ];
-    const command_lower = command.toLowerCase().replace(/\s+/g, " ");
-    if (DANGEROUS_PATTERNS.some((p) => p.test(command_lower))) {
-        return { success: false, output: "Command blocked for safety" };
-    }
-    // Apply sandbox wrapping (macOS only)
-    let sandboxProfilePath = null;
-    {
-        const effectiveCwd = cwd || process.cwd();
-        const sandboxResult = sandboxCommand(command, effectiveCwd);
-        command = sandboxResult.wrapped;
-        sandboxProfilePath = sandboxResult.profilePath;
-    }
-    // Background mode — spawn detached, validate, return with status
-    if (background) {
-        const result = await spawnBackground(command, { cwd, timeout: 600_000, description: input.description });
-        return { success: result.status === "running", output: result.message };
-    }
-    // Foreground async — spawn + stream output via events
-    return new Promise((resolve) => {
-        const stdout = [];
-        const stderr = [];
-        let killed = false;
-        const child = spawn(command, [], {
-            shell: true,
-            cwd,
-            env: { ...process.env, FORCE_COLOR: "0" },
-            stdio: ["pipe", "pipe", "pipe"],
-        });
-        const emitter = getGlobalEmitter();
-        child.stdout?.on("data", (data) => {
-            const text = data.toString();
-            stdout.push(text);
-            // Emit live output for UI streaming
-            for (const line of text.split("\n")) {
-                if (line.trim())
-                    emitter.emitToolOutput("run_command", line);
-            }
-        });
-        child.stderr?.on("data", (data) => {
-            const text = data.toString();
-            stderr.push(text);
-            for (const line of text.split("\n")) {
-                if (line.trim())
-                    emitter.emitToolOutput("run_command", line);
-            }
+  let command = input.command;
+  const cwd = input.working_directory ? resolvePath(input.working_directory) : undefined;
+  const timeout = Math.min(input.timeout || 30000, 300000);
+  const background = input.run_in_background;
+  const description = input.description;
+  debugLog("tools", `run_command: ${description || command.slice(0, 80)}`, {
+    cwd,
+    timeout,
+    background
+  });
+
+  // ── Safety guardrail ──
+  // Minimal filter for catastrophic commands that bypass the macOS sandbox.
+  // The sandbox (sandbox-exec) is the real security boundary — it restricts
+  // file writes to cwd + /tmp + ~/.whale only.
+  //
+  // Philosophy: block ONLY what the sandbox cannot prevent.
+  //   - Hardware/filesystem damage (mkfs, dd to block devices)
+  //   - Process-level DoS (fork bomb)
+  //   - rm on literal root / or home ~ (sanity check)
+  //
+  // Everything else is allowed — chmod, chown, curl|bash, npm, pip, etc.
+  // are either harmless within the sandbox or need sudo to do real damage.
+  if (command.length > 10000) {
+    return {
+      success: false,
+      output: "Command too long (max 10000 chars)"
+    };
+  }
+  const DANGEROUS_PATTERNS = [
+  // rm on literal root (/) or (/*) — NOT subdirectories like /tmp, /Users/...
+  /\brm\b[^|;]*\s\/(\*)?(\s*$|\s*[;|&])/i,
+  // rm on literal home (~) or (~/) or (~/*) — NOT subdirs like ~/project
+  /\brm\b[^|;]*\s~\/?(\*)?(\s*$|\s*[;|&])/i,
+  // Format filesystem — irreversible hardware damage
+  /\bmkfs\b/i,
+  // dd writing to raw block devices — irreversible hardware damage
+  /\bdd\b.*\bof=\s*\/dev\/(sd|hd|nvme|disk|rdisk|vd)/i,
+  // Redirect to raw block devices
+  />\s*\/dev\/(sd|hd|nvme|disk|rdisk|vd)/,
+  // Fork bomb — process-level DoS, sandbox cannot prevent
+  /:\(\)\s*\{.*\|.*&\s*\}\s*;/];
+  const command_lower = command.toLowerCase().replace(/\s+/g, " ");
+  if (DANGEROUS_PATTERNS.some(p => p.test(command_lower))) {
+    return {
+      success: false,
+      output: "Command blocked for safety"
+    };
+  }
+
+  // Apply sandbox wrapping (macOS only)
+  let sandboxProfilePath = null;
+  {
+    const effectiveCwd = cwd || process.cwd();
+    const sandboxResult = sandboxCommand(command, effectiveCwd);
+    command = sandboxResult.wrapped;
+    sandboxProfilePath = sandboxResult.profilePath;
+  }
+
+  // Background mode — spawn detached, validate, return with status
+  if (background) {
+    const result = await spawnBackground(command, {
+      cwd,
+      timeout: 600_000,
+      description: input.description
+    });
+    return {
+      success: result.status === "running",
+      output: result.message
+    };
+  }
+
+  // Foreground async — spawn + stream output via events
+  return new Promise(resolve => {
+    const stdout = [];
+    const stderr = [];
+    let killed = false;
+    const child = spawn(command, [], {
+      shell: true,
+      cwd,
+      env: {
+        ...process.env,
+        FORCE_COLOR: "0"
+      },
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    const emitter = getGlobalEmitter();
+    child.stdout?.on("data", data => {
+      const text = data.toString();
+      stdout.push(text);
+      // Emit live output for UI streaming
+      for (const line of text.split("\n")) {
+        if (line.trim()) emitter.emitToolOutput("run_command", line);
+      }
+    });
+    child.stderr?.on("data", data => {
+      const text = data.toString();
+      stderr.push(text);
+      for (const line of text.split("\n")) {
+        if (line.trim()) emitter.emitToolOutput("run_command", line);
+      }
+    });
+
+    // Timeout kill
+    const timer = setTimeout(() => {
+      if (!killed) {
+        killed = true;
+        child.kill("SIGTERM");
+        setTimeout(() => child.kill("SIGKILL"), 3000);
+      }
+    }, timeout);
+    child.on("exit", code => {
+      clearTimeout(timer);
+      cleanupSandbox(sandboxProfilePath);
+      const output = stdout.join("") + (stderr.length > 0 ? "\n" + stderr.join("") : "");
+      if (killed) {
+        resolve({
+          success: false,
+          output: `Command timed out after ${timeout}ms.\n${output}`.slice(0, 5000)
         });
-        // Timeout kill
-        const timer = setTimeout(() => {
-            if (!killed) {
-                killed = true;
-                child.kill("SIGTERM");
-                setTimeout(() => child.kill("SIGKILL"), 3000);
-            }
-        }, timeout);
-        child.on("exit", (code) => {
-            clearTimeout(timer);
-            cleanupSandbox(sandboxProfilePath);
-            const output = stdout.join("") + (stderr.length > 0 ? "\n" + stderr.join("") : "");
-            if (killed) {
-                resolve({ success: false, output: `Command timed out after ${timeout}ms.\n${output}`.slice(0, 5000) });
-            }
-            else if (code === 0) {
-                let out = output || "(no output)";
-                if (out.length > 500_000) {
-                    out = out.slice(0, 500_000) + `\n\n... (safety truncated — ${output.length.toLocaleString()} chars total)`;
-                }
-                resolve({ success: true, output: out });
-            }
-            else {
-                resolve({ success: false, output: `Exit code ${code ?? "?"}:\n${output}`.slice(0, 5000) });
-            }
+      } else if (code === 0) {
+        let out = output || "(no output)";
+        if (out.length > 500_000) {
+          out = out.slice(0, 500_000) + `\n\n... (safety truncated — ${output.length.toLocaleString()} chars total)`;
+        }
+        resolve({
+          success: true,
+          output: out
         });
-        child.on("error", (err) => {
-            clearTimeout(timer);
-            cleanupSandbox(sandboxProfilePath);
-            resolve({ success: false, output: `Spawn error: ${err.message}` });
+      } else {
+        resolve({
+          success: false,
+          output: `Exit code ${code ?? "?"}:\n${output}`.slice(0, 5000)
         });
+      }
+    });
+    child.on("error", err => {
+      clearTimeout(timer);
+      cleanupSandbox(sandboxProfilePath);
+      resolve({
+        success: false,
+        output: `Spawn error: ${err.message}`
+      });
     });
+  });
 }
+
 // Background tool handlers
 export function bashOutput(input) {
-    const id = input.bash_id;
-    const filter = input.filter;
-    const result = readProcessOutput(id, { filter });
-    if ("error" in result)
-        return { success: false, output: result.error };
-    const statusIcon = result.status === "running" ? "\u25CF" : result.status === "completed" ? "\u2713" : "\u2715";
-    const statusColor = result.status === "running" ? "running" : result.status === "completed" ? "completed" : "failed";
-    const lines = [];
-    lines.push(`${statusIcon} Process ${id} — ${statusColor}`);
-    if (result.exitCode !== undefined)
-        lines.push(`  Exit code: ${result.exitCode}`);
-    if (result.newOutput) {
-        lines.push(`  Output:`);
-        lines.push(result.newOutput);
-    }
-    if (result.newErrors) {
-        lines.push(`  Errors:`);
-        lines.push(result.newErrors);
-    }
-    if (!result.newOutput && !result.newErrors)
-        lines.push("  (no new output since last check)");
-    return { success: true, output: lines.join("\n") };
+  const id = input.bash_id;
+  const filter = input.filter;
+  const result = readProcessOutput(id, {
+    filter
+  });
+  if ("error" in result) return {
+    success: false,
+    output: result.error
+  };
+  const statusIcon = result.status === "running" ? "\u25CF" : result.status === "completed" ? "\u2713" : "\u2715";
+  const statusColor = result.status === "running" ? "running" : result.status === "completed" ? "completed" : "failed";
+  const lines = [];
+  lines.push(`${statusIcon} Process ${id} — ${statusColor}`);
+  if (result.exitCode !== undefined) lines.push(`  Exit code: ${result.exitCode}`);
+  if (result.newOutput) {
+    lines.push(`  Output:`);
+    lines.push(result.newOutput);
+  }
+  if (result.newErrors) {
+    lines.push(`  Errors:`);
+    lines.push(result.newErrors);
+  }
+  if (!result.newOutput && !result.newErrors) lines.push("  (no new output since last check)");
+  return {
+    success: true,
+    output: lines.join("\n")
+  };
 }
 export function killShell(input) {
-    const id = (input.shell_id || input.bash_id);
-    const result = killProcess(id);
-    return { success: result.success, output: result.message };
+  const id = input.shell_id || input.bash_id;
+  const result = killProcess(id);
+  return {
+    success: result.success,
+    output: result.message
+  };
 }
 export function listShellsFn() {
-    const procs = listProcesses();
-    if (procs.length === 0)
-        return { success: true, output: "No background processes." };
-    const lines = [`${procs.length} background process${procs.length !== 1 ? "es" : ""}:`, ""];
-    for (const p of procs) {
-        const icon = p.status === "running" ? "\u25CF" : p.status === "completed" ? "\u2713" : "\u2715";
-        lines.push(`  ${icon} ${p.id}  ${p.status}  ${p.runtime}`);
-        lines.push(`    ${p.command}`);
-        if (p.pid)
-            lines.push(`    PID: ${p.pid}`);
-        lines.push(`    stdout: ${p.outputLines} lines  stderr: ${p.errorLines} lines`);
-        lines.push("");
-    }
-    return { success: true, output: lines.join("\n") };
+  const procs = listProcesses();
+  if (procs.length === 0) return {
+    success: true,
+    output: "No background processes."
+  };
+  const lines = [`${procs.length} background process${procs.length !== 1 ? "es" : ""}:`, ""];
+  for (const p of procs) {
+    const icon = p.status === "running" ? "\u25CF" : p.status === "completed" ? "\u2713" : "\u2715";
+    lines.push(`  ${icon} ${p.id}  ${p.status}  ${p.runtime}`);
+    lines.push(`    ${p.command}`);
+    if (p.pid) lines.push(`    PID: ${p.pid}`);
+    lines.push(`    stdout: ${p.outputLines} lines  stderr: ${p.errorLines} lines`);
+    lines.push("");
+  }
+  return {
+    success: true,
+    output: lines.join("\n")
+  };
 }
+//# sourceMappingURL=shell-exec.js.map

package/dist/cli/services/tools/shell-exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-exec.js","names":["join","spawn","homedir","spawnBackground","readProcessOutput","killProcess","listProcesses","getGlobalEmitter","sandboxCommand","cleanupSandbox","debugLog","resolvePath","p","startsWith","slice","runCommand","input","command","cwd","working_directory","undefined","timeout","Math","min","background","run_in_background","description","length","success","output","DANGEROUS_PATTERNS","command_lower","toLowerCase","replace","some","test","sandboxProfilePath","effectiveCwd","process","sandboxResult","wrapped","profilePath","result","status","message","Promise","resolve","stdout","stderr","killed","child","shell","env","FORCE_COLOR","stdio","emitter","on","data","text","toString","push","line","split","trim","emitToolOutput","timer","setTimeout","kill","code","clearTimeout","out","toLocaleString","err","bashOutput","id","bash_id","filter","error","statusIcon","statusColor","lines","exitCode","newOutput","newErrors","killShell","shell_id","listShellsFn","procs","icon","runtime","pid","outputLines","errorLines"],"sources":["../../../../src/cli/services/tools/shell-exec.ts"],"sourcesContent":["/**\n * Shell Execution — run_command and background process tools\n *\n * Extracted from local-tools.ts for single-responsibility.\n */\n\nimport { join } from \"path\";\nimport { spawn } from \"child_process\";\nimport { homedir } from \"os\";\nimport { spawnBackground, readProcessOutput, killProcess, listProcesses } from \"../background-processes.js\";\nimport { getGlobalEmitter } from \"../agent-events.js\";\nimport { sandboxCommand, cleanupSandbox } from \"../sandbox.js\";\nimport { debugLog } from \"../debug-log.js\";\nimport { ToolResult } from \"../../../shared/types.js\";\n\nfunction resolvePath(p: string): string {\n  if (p.startsWith(\"~/\")) return join(homedir(), p.slice(2));\n  return p;\n}\n\nexport async function runCommand(input: Record<string, unknown>): Promise<ToolResult> {\n  let command = input.command as string;\n  const cwd = input.working_directory ? resolvePath(input.working_directory as string) : undefined;\n  const timeout = Math.min((input.timeout as number) || 30000, 300000);\n  const background = input.run_in_background as boolean;\n  const description = input.description as string | undefined;\n\n  debugLog(\"tools\", `run_command: ${description || command.slice(0, 80)}`, { cwd, timeout, background });\n\n  // ── Safety guardrail ──\n  // Minimal filter for catastrophic commands that bypass the macOS sandbox.\n  // The sandbox (sandbox-exec) is the real security boundary — it restricts\n  // file writes to cwd + /tmp + ~/.whale only.\n  //\n  // Philosophy: block ONLY what the sandbox cannot prevent.\n  //   - Hardware/filesystem damage (mkfs, dd to block devices)\n  //   - Process-level DoS (fork bomb)\n  //   - rm on literal root / or home ~ (sanity check)\n  //\n  // Everything else is allowed — chmod, chown, curl|bash, npm, pip, etc.\n  // are either harmless within the sandbox or need sudo to do real damage.\n  if (command.length > 10000) {\n    return { success: false, output: \"Command too long (max 10000 chars)\" };\n  }\n  const DANGEROUS_PATTERNS: RegExp[] = [\n    // rm on literal root (/) or (/*) — NOT subdirectories like /tmp, /Users/...\n    /\\brm\\b[^|;]*\\s\\/(\\*)?(\\s*$|\\s*[;|&])/i,\n    // rm on literal home (~) or (~/) or (~/*) — NOT subdirs like ~/project\n    /\\brm\\b[^|;]*\\s~\\/?(\\*)?(\\s*$|\\s*[;|&])/i,\n    // Format filesystem — irreversible hardware damage\n    /\\bmkfs\\b/i,\n    // dd writing to raw block devices — irreversible hardware damage\n    /\\bdd\\b.*\\bof=\\s*\\/dev\\/(sd|hd|nvme|disk|rdisk|vd)/i,\n    // Redirect to raw block devices\n    />\\s*\\/dev\\/(sd|hd|nvme|disk|rdisk|vd)/,\n    // Fork bomb — process-level DoS, sandbox cannot prevent\n    /:\\(\\)\\s*\\{.*\\|.*&\\s*\\}\\s*;/,\n  ];\n  const command_lower = command.toLowerCase().replace(/\\s+/g, \" \");\n  if (DANGEROUS_PATTERNS.some((p) => p.test(command_lower))) {\n    return { success: false, output: \"Command blocked for safety\" };\n  }\n\n  // Apply sandbox wrapping (macOS only)\n  let sandboxProfilePath: string | null = null;\n  {\n    const effectiveCwd = cwd || process.cwd();\n    const sandboxResult = sandboxCommand(command, effectiveCwd);\n    command = sandboxResult.wrapped;\n    sandboxProfilePath = sandboxResult.profilePath;\n  }\n\n  // Background mode — spawn detached, validate, return with status\n  if (background) {\n    const result = await spawnBackground(command, { cwd, timeout: 600_000, description: input.description as string });\n    return { success: result.status === \"running\", output: result.message };\n  }\n\n  // Foreground async — spawn + stream output via events\n  return new Promise<ToolResult>((resolve) => {\n    const stdout: string[] = [];\n    const stderr: string[] = [];\n    let killed = false;\n\n    const child = spawn(command, [], {\n      shell: true,\n      cwd,\n      env: { ...process.env, FORCE_COLOR: \"0\" },\n      stdio: [\"pipe\", \"pipe\", \"pipe\"],\n    });\n\n    const emitter = getGlobalEmitter();\n\n    child.stdout?.on(\"data\", (data: Buffer) => {\n      const text = data.toString();\n      stdout.push(text);\n      // Emit live output for UI streaming\n      for (const line of text.split(\"\\n\")) {\n        if (line.trim()) emitter.emitToolOutput(\"run_command\", line);\n      }\n    });\n\n    child.stderr?.on(\"data\", (data: Buffer) => {\n      const text = data.toString();\n      stderr.push(text);\n      for (const line of text.split(\"\\n\")) {\n        if (line.trim()) emitter.emitToolOutput(\"run_command\", line);\n      }\n    });\n\n    // Timeout kill\n    const timer = setTimeout(() => {\n      if (!killed) {\n        killed = true;\n        child.kill(\"SIGTERM\");\n        setTimeout(() => child.kill(\"SIGKILL\"), 3000);\n      }\n    }, timeout);\n\n    child.on(\"exit\", (code) => {\n      clearTimeout(timer);\n      cleanupSandbox(sandboxProfilePath);\n      const output = stdout.join(\"\") + (stderr.length > 0 ? \"\\n\" + stderr.join(\"\") : \"\");\n      if (killed) {\n        resolve({ success: false, output: `Command timed out after ${timeout}ms.\\n${output}`.slice(0, 5000) });\n      } else if (code === 0) {\n        let out = output || \"(no output)\";\n        if (out.length > 500_000) {\n          out = out.slice(0, 500_000) + `\\n\\n... (safety truncated — ${output.length.toLocaleString()} chars total)`;\n        }\n        resolve({ success: true, output: out });\n      } else {\n        resolve({ success: false, output: `Exit code ${code ?? \"?\"}:\\n${output}`.slice(0, 5000) });\n      }\n    });\n\n    child.on(\"error\", (err) => {\n      clearTimeout(timer);\n      cleanupSandbox(sandboxProfilePath);\n      resolve({ success: false, output: `Spawn error: ${err.message}` });\n    });\n  });\n}\n\n// Background tool handlers\nexport function bashOutput(input: Record<string, unknown>): ToolResult {\n  const id = input.bash_id as string;\n  const filter = input.filter as string | undefined;\n  const result = readProcessOutput(id, { filter });\n  if (\"error\" in result) return { success: false, output: result.error };\n\n  const statusIcon = result.status === \"running\" ? \"\\u25CF\" : result.status === \"completed\" ? \"\\u2713\" : \"\\u2715\";\n  const statusColor = result.status === \"running\" ? \"running\" : result.status === \"completed\" ? \"completed\" : \"failed\";\n  const lines: string[] = [];\n  lines.push(`${statusIcon} Process ${id} — ${statusColor}`);\n  if (result.exitCode !== undefined) lines.push(`  Exit code: ${result.exitCode}`);\n  if (result.newOutput) {\n    lines.push(`  Output:`);\n    lines.push(result.newOutput);\n  }\n  if (result.newErrors) {\n    lines.push(`  Errors:`);\n    lines.push(result.newErrors);\n  }\n  if (!result.newOutput && !result.newErrors) lines.push(\"  (no new output since last check)\");\n  return { success: true, output: lines.join(\"\\n\") };\n}\n\nexport function killShell(input: Record<string, unknown>): ToolResult {\n  const id = (input.shell_id || input.bash_id) as string;\n  const result = killProcess(id);\n  return { success: result.success, output: result.message };\n}\n\nexport function listShellsFn(): ToolResult {\n  const procs = listProcesses();\n  if (procs.length === 0) return { success: true, output: \"No background processes.\" };\n  const lines: string[] = [`${procs.length} background process${procs.length !== 1 ? \"es\" : \"\"}:`, \"\"];\n  for (const p of procs) {\n    const icon = p.status === \"running\" ? \"\\u25CF\" : p.status === \"completed\" ? \"\\u2713\" : \"\\u2715\";\n    lines.push(`  ${icon} ${p.id}  ${p.status}  ${p.runtime}`);\n    lines.push(`    ${p.command}`);\n    if (p.pid) lines.push(`    PID: ${p.pid}`);\n    lines.push(`    stdout: ${p.outputLines} lines  stderr: ${p.errorLines} lines`);\n    lines.push(\"\");\n  }\n  return { success: true, output: lines.join(\"\\n\") };\n}\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;;AAEA,SAASA,IAAI,QAAQ,MAAM;AAC3B,SAASC,KAAK,QAAQ,eAAe;AACrC,SAASC,OAAO,QAAQ,IAAI;AAC5B,SAASC,eAAe,EAAEC,iBAAiB,EAAEC,WAAW,EAAEC,aAAa,QAAQ,4BAA4B;AAC3G,SAASC,gBAAgB,QAAQ,oBAAoB;AACrD,SAASC,cAAc,EAAEC,cAAc,QAAQ,eAAe;AAC9D,SAASC,QAAQ,QAAQ,iBAAiB;AAG1C,SAASC,WAAWA,CAACC,CAAS,EAAU;EACtC,IAAIA,CAAC,CAACC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAOb,IAAI,CAACE,OAAO,CAAC,CAAC,EAAEU,CAAC,CAACE,KAAK,CAAC,CAAC,CAAC,CAAC;EAC1D,OAAOF,CAAC;AACV;AAEA,OAAO,eAAeG,UAAUA,CAACC,KAA8B,EAAuB;EACpF,IAAIC,OAAO,GAAGD,KAAK,CAACC,OAAiB;EACrC,MAAMC,GAAG,GAAGF,KAAK,CAACG,iBAAiB,GAAGR,WAAW,CAACK,KAAK,CAACG,iBAA2B,CAAC,GAAGC,SAAS;EAChG,MAAMC,OAAO,GAAGC,IAAI,CAACC,GAAG,CAAEP,KAAK,CAACK,OAAO,IAAe,KAAK,EAAE,MAAM,CAAC;EACpE,MAAMG,UAAU,GAAGR,KAAK,CAACS,iBAA4B;EACrD,MAAMC,WAAW,GAAGV,KAAK,CAACU,WAAiC;EAE3DhB,QAAQ,CAAC,OAAO,EAAE,gBAAgBgB,WAAW,IAAIT,OAAO,CAACH,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;IAAEI,GAAG;IAAEG,OAAO;IAAEG;EAAW,CAAC,CAAC;;EAEtG;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,IAAIP,OAAO,CAACU,MAAM,GAAG,KAAK,EAAE;IAC1B,OAAO;MAAEC,OAAO,EAAE,KAAK;MAAEC,MAAM,EAAE;IAAqC,CAAC;EACzE;EACA,MAAMC,kBAA4B,GAAG;EACnC;EACA,uCAAuC;EACvC;EACA,yCAAyC;EACzC;EACA,WAAW;EACX;EACA,oDAAoD;EACpD;EACA,uCAAuC;EACvC;EACA,4BAA4B,CAC7B;EACD,MAAMC,aAAa,GAAGd,OAAO,CAACe,WAAW,CAAC,CAAC,CAACC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;EAChE,IAAIH,kBAAkB,CAACI,IAAI,CAAEtB,CAAC,IAAKA,CAAC,CAACuB,IAAI,CAACJ,aAAa,CAAC,CAAC,EAAE;IACzD,OAAO;MAAEH,OAAO,EAAE,KAAK;MAAEC,MAAM,EAAE;IAA6B,CAAC;EACjE;;EAEA;EACA,IAAIO,kBAAiC,GAAG,IAAI;EAC5C;IACE,MAAMC,YAAY,GAAGnB,GAAG,IAAIoB,OAAO,CAACpB,GAAG,CAAC,CAAC;IACzC,MAAMqB,aAAa,GAAG/B,cAAc,CAACS,OAAO,EAAEoB,YAAY,CAAC;IAC3DpB,OAAO,GAAGsB,aAAa,CAACC,OAAO;IAC/BJ,kBAAkB,GAAGG,aAAa,CAACE,WAAW;EAChD;;EAEA;EACA,IAAIjB,UAAU,EAAE;IACd,MAAMkB,MAAM,GAAG,MAAMvC,eAAe,CAACc,OAAO,EAAE;MAAEC,GAAG;MAAEG,OAAO,EAAE,OAAO;MAAEK,WAAW,EAAEV,KAAK,CAACU;IAAsB,CAAC,CAAC;IAClH,OAAO;MAAEE,OAAO,EAAEc,MAAM,CAACC,MAAM,KAAK,SAAS;MAAEd,MAAM,EAAEa,MAAM,CAACE;IAAQ,CAAC;EACzE;;EAEA;EACA,OAAO,IAAIC,OAAO,CAAcC,OAAO,IAAK;IAC1C,MAAMC,MAAgB,GAAG,EAAE;IAC3B,MAAMC,MAAgB,GAAG,EAAE;IAC3B,IAAIC,MAAM,GAAG,KAAK;IAElB,MAAMC,KAAK,GAAGjD,KAAK,CAACgB,OAAO,EAAE,EAAE,EAAE;MAC/BkC,KAAK,EAAE,IAAI;MACXjC,GAAG;MACHkC,GAAG,EAAE;QAAE,GAAGd,OAAO,CAACc,GAAG;QAAEC,WAAW,EAAE;MAAI,CAAC;MACzCC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM;IAChC,CAAC,CAAC;IAEF,MAAMC,OAAO,GAAGhD,gBAAgB,CAAC,CAAC;IAElC2C,KAAK,CAACH,MAAM,EAAES,EAAE,CAAC,MAAM,EAAGC,IAAY,IAAK;MACzC,MAAMC,IAAI,GAAGD,IAAI,CAACE,QAAQ,CAAC,CAAC;MAC5BZ,MAAM,CAACa,IAAI,CAACF,IAAI,CAAC;MACjB;MACA,KAAK,MAAMG,IAAI,IAAIH,IAAI,CAACI,KAAK,CAAC,IAAI,CAAC,EAAE;QACnC,IAAID,IAAI,CAACE,IAAI,CAAC,CAAC,EAAER,OAAO,CAACS,cAAc,CAAC,aAAa,EAAEH,IAAI,CAAC;MAC9D;IACF,CAAC,CAAC;IAEFX,KAAK,CAACF,MAAM,EAAEQ,EAAE,CAAC,MAAM,EAAGC,IAAY,IAAK;MACzC,MAAMC,IAAI,GAAGD,IAAI,CAACE,QAAQ,CAAC,CAAC;MAC5BX,MAAM,CAACY,IAAI,CAACF,IAAI,CAAC;MACjB,KAAK,MAAMG,IAAI,IAAIH,IAAI,CAACI,KAAK,CAAC,IAAI,CAAC,EAAE;QACnC,IAAID,IAAI,CAACE,IAAI,CAAC,CAAC,EAAER,OAAO,CAACS,cAAc,CAAC,aAAa,EAAEH,IAAI,CAAC;MAC9D;IACF,CAAC,CAAC;;IAEF;IACA,MAAMI,KAAK,GAAGC,UAAU,CAAC,MAAM;MAC7B,IAAI,CAACjB,MAAM,EAAE;QACXA,MAAM,GAAG,IAAI;QACbC,KAAK,CAACiB,IAAI,CAAC,SAAS,CAAC;QACrBD,UAAU,CAAC,MAAMhB,KAAK,CAACiB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;MAC/C;IACF,CAAC,EAAE9C,OAAO,CAAC;IAEX6B,KAAK,CAACM,EAAE,CAAC,MAAM,EAAGY,IAAI,IAAK;MACzBC,YAAY,CAACJ,KAAK,CAAC;MACnBxD,cAAc,CAAC2B,kBAAkB,CAAC;MAClC,MAAMP,MAAM,GAAGkB,MAAM,CAAC/C,IAAI,CAAC,EAAE,CAAC,IAAIgD,MAAM,CAACrB,MAAM,GAAG,CAAC,GAAG,IAAI,GAAGqB,MAAM,CAAChD,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC;MAClF,IAAIiD,MAAM,EAAE;QACVH,OAAO,CAAC;UAAElB,OAAO,EAAE,KAAK;UAAEC,MAAM,EAAE,2BAA2BR,OAAO,QAAQQ,MAAM,EAAE,CAACf,KAAK,CAAC,CAAC,EAAE,IAAI;QAAE,CAAC,CAAC;MACxG,CAAC,MAAM,IAAIsD,IAAI,KAAK,CAAC,EAAE;QACrB,IAAIE,GAAG,GAAGzC,MAAM,IAAI,aAAa;QACjC,IAAIyC,GAAG,CAAC3C,MAAM,GAAG,OAAO,EAAE;UACxB2C,GAAG,GAAGA,GAAG,CAACxD,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,+BAA+Be,MAAM,CAACF,MAAM,CAAC4C,cAAc,CAAC,CAAC,eAAe;QAC5G;QACAzB,OAAO,CAAC;UAAElB,OAAO,EAAE,IAAI;UAAEC,MAAM,EAAEyC;QAAI,CAAC,CAAC;MACzC,CAAC,MAAM;QACLxB,OAAO,CAAC;UAAElB,OAAO,EAAE,KAAK;UAAEC,MAAM,EAAE,aAAauC,IAAI,IAAI,GAAG,MAAMvC,MAAM,EAAE,CAACf,KAAK,CAAC,CAAC,EAAE,IAAI;QAAE,CAAC,CAAC;MAC5F;IACF,CAAC,CAAC;IAEFoC,KAAK,CAACM,EAAE,CAAC,OAAO,EAAGgB,GAAG,IAAK;MACzBH,YAAY,CAACJ,KAAK,CAAC;MACnBxD,cAAc,CAAC2B,kBAAkB,CAAC;MAClCU,OAAO,CAAC;QAAElB,OAAO,EAAE,KAAK;QAAEC,MAAM,EAAE,gBAAgB2C,GAAG,CAAC5B,OAAO;MAAG,CAAC,CAAC;IACpE,CAAC,CAAC;EACJ,CAAC,CAAC;AACJ;;AAEA;AACA,OAAO,SAAS6B,UAAUA,CAACzD,KAA8B,EAAc;EACrE,MAAM0D,EAAE,GAAG1D,KAAK,CAAC2D,OAAiB;EAClC,MAAMC,MAAM,GAAG5D,KAAK,CAAC4D,MAA4B;EACjD,MAAMlC,MAAM,GAAGtC,iBAAiB,CAACsE,EAAE,EAAE;IAAEE;EAAO,CAAC,CAAC;EAChD,IAAI,OAAO,IAAIlC,MAAM,EAAE,OAAO;IAAEd,OAAO,EAAE,KAAK;IAAEC,MAAM,EAAEa,MAAM,CAACmC;EAAM,CAAC;EAEtE,MAAMC,UAAU,GAAGpC,MAAM,CAACC,MAAM,KAAK,SAAS,GAAG,QAAQ,GAAGD,MAAM,CAACC,MAAM,KAAK,WAAW,GAAG,QAAQ,GAAG,QAAQ;EAC/G,MAAMoC,WAAW,GAAGrC,MAAM,CAACC,MAAM,KAAK,SAAS,GAAG,SAAS,GAAGD,MAAM,CAACC,MAAM,KAAK,WAAW,GAAG,WAAW,GAAG,QAAQ;EACpH,MAAMqC,KAAe,GAAG,EAAE;EAC1BA,KAAK,CAACpB,IAAI,CAAC,GAAGkB,UAAU,YAAYJ,EAAE,MAAMK,WAAW,EAAE,CAAC;EAC1D,IAAIrC,MAAM,CAACuC,QAAQ,KAAK7D,SAAS,EAAE4D,KAAK,CAACpB,IAAI,CAAC,gBAAgBlB,MAAM,CAACuC,QAAQ,EAAE,CAAC;EAChF,IAAIvC,MAAM,CAACwC,SAAS,EAAE;IACpBF,KAAK,CAACpB,IAAI,CAAC,WAAW,CAAC;IACvBoB,KAAK,CAACpB,IAAI,CAAClB,MAAM,CAACwC,SAAS,CAAC;EAC9B;EACA,IAAIxC,MAAM,CAACyC,SAAS,EAAE;IACpBH,KAAK,CAACpB,IAAI,CAAC,WAAW,CAAC;IACvBoB,KAAK,CAACpB,IAAI,CAAClB,MAAM,CAACyC,SAAS,CAAC;EAC9B;EACA,IAAI,CAACzC,MAAM,CAACwC,SAAS,IAAI,CAACxC,MAAM,CAACyC,SAAS,EAAEH,KAAK,CAACpB,IAAI,CAAC,oCAAoC,CAAC;EAC5F,OAAO;IAAEhC,OAAO,EAAE,IAAI;IAAEC,MAAM,EAAEmD,KAAK,CAAChF,IAAI,CAAC,IAAI;EAAE,CAAC;AACpD;AAEA,OAAO,SAASoF,SAASA,CAACpE,KAA8B,EAAc;EACpE,MAAM0D,EAAE,GAAI1D,KAAK,CAACqE,QAAQ,IAAIrE,KAAK,CAAC2D,OAAkB;EACtD,MAAMjC,MAAM,GAAGrC,WAAW,CAACqE,EAAE,CAAC;EAC9B,OAAO;IAAE9C,OAAO,EAAEc,MAAM,CAACd,OAAO;IAAEC,MAAM,EAAEa,MAAM,CAACE;EAAQ,CAAC;AAC5D;AAEA,OAAO,SAAS0C,YAAYA,CAAA,EAAe;EACzC,MAAMC,KAAK,GAAGjF,aAAa,CAAC,CAAC;EAC7B,IAAIiF,KAAK,CAAC5D,MAAM,KAAK,CAAC,EAAE,OAAO;IAAEC,OAAO,EAAE,IAAI;IAAEC,MAAM,EAAE;EAA2B,CAAC;EACpF,MAAMmD,KAAe,GAAG,CAAC,GAAGO,KAAK,CAAC5D,MAAM,sBAAsB4D,KAAK,CAAC5D,MAAM,KAAK,CAAC,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;EACpG,KAAK,MAAMf,CAAC,IAAI2E,KAAK,EAAE;IACrB,MAAMC,IAAI,GAAG5E,CAAC,CAAC+B,MAAM,KAAK,SAAS,GAAG,QAAQ,GAAG/B,CAAC,CAAC+B,MAAM,KAAK,WAAW,GAAG,QAAQ,GAAG,QAAQ;IAC/FqC,KAAK,CAACpB,IAAI,CAAC,KAAK4B,IAAI,IAAI5E,CAAC,CAAC8D,EAAE,KAAK9D,CAAC,CAAC+B,MAAM,KAAK/B,CAAC,CAAC6E,OAAO,EAAE,CAAC;IAC1DT,KAAK,CAACpB,IAAI,CAAC,OAAOhD,CAAC,CAACK,OAAO,EAAE,CAAC;IAC9B,IAAIL,CAAC,CAAC8E,GAAG,EAAEV,KAAK,CAACpB,IAAI,CAAC,YAAYhD,CAAC,CAAC8E,GAAG,EAAE,CAAC;IAC1CV,KAAK,CAACpB,IAAI,CAAC,eAAehD,CAAC,CAAC+E,WAAW,mBAAmB/E,CAAC,CAACgF,UAAU,QAAQ,CAAC;IAC/EZ,KAAK,CAACpB,IAAI,CAAC,EAAE,CAAC;EAChB;EACA,OAAO;IAAEhC,OAAO,EAAE,IAAI;IAAEC,MAAM,EAAEmD,KAAK,CAAChF,IAAI,CAAC,IAAI;EAAE,CAAC;AACpD","ignoreList":[]}

package/dist/cli/services/tools/shell-exec.test.js

@@ -0,0 +1,148 @@
+import { describe, it, expect, vi } from "vitest";
+// Mock child_process.spawn so commands are NOT actually executed.
+// We only need to test the safety filter (blocked vs allowed), not run real commands.
+vi.mock("child_process", async () => {
+  const actual = await vi.importActual("child_process");
+  return {
+    ...actual,
+    spawn: vi.fn(() => {
+      // Return a fake child process that immediately exits with code 0
+      const {
+        EventEmitter
+      } = require("events");
+      const {
+        Readable
+      } = require("stream");
+      const child = new EventEmitter();
+      child.stdout = new Readable({
+        read() {
+          this.push(null);
+        }
+      });
+      child.stderr = new Readable({
+        read() {
+          this.push(null);
+        }
+      });
+      child.stdin = {
+        write: vi.fn(),
+        end: vi.fn()
+      };
+      child.pid = 99999;
+      child.kill = vi.fn();
+      // Emit close on next tick so the promise resolves
+      setTimeout(() => child.emit("exit", 0), 5);
+      return child;
+    })
+  };
+});
+vi.mock("../sandbox.js", () => ({
+  sandboxCommand: vi.fn(cmd => ({
+    wrapped: cmd,
+    profilePath: null
+  })),
+  cleanupSandbox: vi.fn()
+}));
+vi.mock("../background-processes.js", () => ({
+  spawnBackground: vi.fn(async () => ({
+    status: "running",
+    message: "ok"
+  })),
+  readProcessOutput: vi.fn(() => ({
+    status: "completed",
+    exitCode: 0,
+    newOutput: "ok",
+    newErrors: ""
+  })),
+  killProcess: vi.fn(() => ({
+    success: true,
+    message: "killed"
+  })),
+  listProcesses: vi.fn(() => [])
+}));
+vi.mock("../agent-events.js", () => ({
+  getGlobalEmitter: vi.fn(() => ({
+    emitToolOutput: vi.fn()
+  }))
+}));
+vi.mock("../debug-log.js", () => ({
+  debugLog: vi.fn()
+}));
+import { runCommand } from "./shell-exec.js";
+async function allowed(cmd) {
+  const r = await runCommand({
+    command: cmd,
+    timeout: 2000
+  });
+  return !r.output.includes("blocked for safety");
+}
+async function blocked(cmd) {
+  const r = await runCommand({
+    command: cmd,
+    timeout: 2000
+  });
+  return r.output.includes("blocked for safety");
+}
+describe("BLOCKED — catastrophic", () => {
+  it("rm -rf /", async () => expect(await blocked("rm -rf /")).toBe(true));
+  it("rm -rf /*", async () => expect(await blocked("rm -rf /*")).toBe(true));
+  it("rm -fr /", async () => expect(await blocked("rm -fr /")).toBe(true));
+  it("rm -r -f /", async () => expect(await blocked("rm -r -f /")).toBe(true));
+  it("rm -rf / chained", async () => expect(await blocked("rm -rf / && echo done")).toBe(true));
+  it("rm -rf / ; cmd", async () => expect(await blocked("rm -rf / ; echo hi")).toBe(true));
+  it("rm -rf ~", async () => expect(await blocked("rm -rf ~")).toBe(true));
+  it("rm -rf ~/", async () => expect(await blocked("rm -rf ~/")).toBe(true));
+  it("rm -rf ~/*", async () => expect(await blocked("rm -rf ~/*")).toBe(true));
+  it("rm -rf ~ chained", async () => expect(await blocked("rm -rf ~ && echo done")).toBe(true));
+  it("mkfs", async () => expect(await blocked("mkfs /dev/sda1")).toBe(true));
+  it("mkfs.ext4", async () => expect(await blocked("mkfs.ext4 /dev/sda1")).toBe(true));
+  it("dd to /dev/sda", async () => expect(await blocked("dd if=/dev/zero of=/dev/sda")).toBe(true));
+  it("dd to /dev/disk0", async () => expect(await blocked("dd if=x of=/dev/disk0")).toBe(true));
+  it("dd to /dev/nvme0n1", async () => expect(await blocked("dd if=/dev/zero of=/dev/nvme0n1")).toBe(true));
+  it("> /dev/sda", async () => expect(await blocked("echo x > /dev/sda")).toBe(true));
+  it("> /dev/disk0", async () => expect(await blocked("echo x > /dev/disk0")).toBe(true));
+  it("fork bomb", async () => expect(await blocked(":(){ :|:& };:")).toBe(true));
+});
+describe("ALLOWED — full developer access", () => {
+  // rm on specific paths
+  it("rm -rf node_modules", async () => expect(await allowed("rm -rf node_modules")).toBe(true));
+  it("rm -rf /tmp/build", async () => expect(await allowed("rm -rf /tmp/build")).toBe(true));
+  it("rm -rf /Users/whale/project/nm", async () => expect(await allowed("rm -rf /Users/whale/project/node_modules")).toBe(true));
+  it("rm -rf ~/project/dist", async () => expect(await allowed("rm -rf ~/project/dist")).toBe(true));
+  it("rm -rf ~/Downloads/old", async () => expect(await allowed("rm -rf ~/Downloads/old-stuff")).toBe(true));
+  it("rm -rf ~/.npm-cache", async () => expect(await allowed("rm -rf ~/.npm-cache")).toBe(true));
+  it("rm -rf /var/tmp/cache", async () => expect(await allowed("rm -rf /var/tmp/cache")).toBe(true));
+  it("rm file.txt", async () => expect(await allowed("rm file.txt")).toBe(true));
+  // chmod / chown
+  it("chmod 777 /tmp/test", async () => expect(await allowed("chmod 777 /tmp/test")).toBe(true));
+  it("chmod -R 777 /tmp/test", async () => expect(await allowed("chmod -R 777 /tmp/test")).toBe(true));
+  it("chown -R user ~/.npm", async () => expect(await allowed("chown -R whale ~/.npm")).toBe(true));
+  it("chown -R user /Users/.npm-cache", async () => expect(await allowed("chown -R whale /Users/whale/.npm-cache")).toBe(true));
+  it("sudo chown -R $(whoami) ~/.npm", async () => expect(await allowed("sudo chown -R $(whoami) ~/.npm")).toBe(true));
+  // npm / node
+  it("npm install", async () => expect(await allowed("npm install")).toBe(true));
+  it("npm run build", async () => expect(await allowed("npm run build")).toBe(true));
+  it("npm run dev", async () => expect(await allowed("npm run dev")).toBe(true));
+  it("npm test", async () => expect(await allowed("npm test")).toBe(true));
+  it("npm cache clean --force", async () => expect(await allowed("npm cache clean --force")).toBe(true));
+  it("node -e with require+exec", async () => expect(await allowed("node -e 'require(\"child_process\").execSync(\"ls\")'")).toBe(true));
+  // curl/wget including pipe to bash
+  it("curl | bash install", async () => expect(await allowed("curl -fsSL https://bun.sh/install | bash")).toBe(true));
+  it("wget | bash", async () => expect(await allowed("wget -qO- https://example.com/install.sh | bash")).toBe(true));
+  // python
+  it("python -e with os.system", async () => expect(await allowed("python -e 'import os; os.system(\"ls\")'")).toBe(true));
+  // git
+  it("git push", async () => expect(await allowed("git push")).toBe(true));
+  it("git push --force", async () => expect(await allowed("git push --force")).toBe(true));
+  it("git reset --hard", async () => expect(await allowed("git reset --hard HEAD~1")).toBe(true));
+  // dd on regular files
+  it("dd to regular file", async () => expect(await allowed("dd if=/dev/urandom of=./random.bin bs=1024 count=1")).toBe(true));
+  it("dd to /dev/null", async () => expect(await allowed("dd if=./bigfile of=/dev/null bs=1M")).toBe(true));
+  it("dd to /tmp", async () => expect(await allowed("dd if=/dev/zero of=/tmp/testfile bs=1M count=10")).toBe(true));
+  // base64
+  it("base64 -d | bash", async () => expect(await allowed("base64 -d | bash")).toBe(true));
+  // system tools
+  it("brew install", async () => expect(await allowed("brew install postgresql")).toBe(true));
+  it("terraform apply", async () => expect(await allowed("terraform apply -auto-approve")).toBe(true));
+  it("docker system prune -af", async () => expect(await allowed("docker system prune -af")).toBe(true));
+});

package/dist/cli/services/tools/ssrf-guard.d.ts

@@ -0,0 +1,6 @@
+/**
+ * SSRF Protection — URL validation and DNS resolution checks.
+ * Extracted from web-tools.ts for single-responsibility.
+ */
+export declare function isBlockedUrl(urlStr: string): boolean;
+export declare function resolveAndCheckUrl(url: string): Promise<boolean>;