Commit graph

18 commits

Author SHA1 Message Date
Goksu Ceylan
244eb0b47d
fix (security): ExecTool working_dir sandbox escape (#478)
* fix (security) Shell working_dir bypass

* Feedback from @mengzhuo & Discord
- reuse internal security package to validate path
- add tests for workspace escape
2026-02-21 08:15:46 +08:00
Artem Yadelskyi
ad8c2d48c8
Merge branch 'main' into fix-formatting
# Conflicts:
#	cmd/picoclaw/main.go
#	pkg/agent/context.go
#	pkg/agent/loop.go
#	pkg/channels/dingtalk.go
#	pkg/channels/feishu_64.go
#	pkg/channels/line.go
#	pkg/channels/manager.go
#	pkg/config/config.go
#	pkg/migrate/migrate_test.go
#	pkg/providers/anthropic/provider_test.go
#	pkg/providers/claude_provider_test.go
#	pkg/providers/http_provider.go
#	pkg/providers/openai_compat/provider.go
#	pkg/providers/protocoltypes/types.go
#	pkg/providers/types.go
2026-02-20 20:02:53 +02:00
Meng Zhuo
5b525f6139
Merge pull request #378 from lunareed720/fix/exec-timeout-process-tree
fix(exec): kill child process tree on timeout to prevent orphaned tasks
2026-02-20 23:32:05 +08:00
Artem Yadelskyi
9e120f90ea
feat(fmt): Run formatters 2026-02-18 21:48:23 +02:00
Artem Yadelskyi
b88f4c9ab5
feat(linters): Fix linter 2026-02-18 16:24:55 +02:00
lxowalle
eda6e37332
feat: Support modifying the command filtering list of the exec tool (#410) 2026-02-18 19:31:15 +08:00
lxowalle
01d694b998
fix: Add comprehensive command injection and system abuse prevention patterns (#401)
* Add comprehensive command injection and system abuse prevention patterns

* fix: Container running as root
2026-02-18 15:33:34 +08:00
Luna Reed
acac1972e6 fix(exec): terminate process tree on timeout 2026-02-18 02:01:29 +08:00
yinwm
881999aceb refactor(shell): interpret zero timeout as unlimited execution
Replace unconditional WithTimeout usage with conditional context creation
based on timeout configuration. Zero values now bypass timeout enforcement,
using WithCancel for graceful cancellation while preserving existing timeout
behavior for positive values. Simplifies CronTool initialization by removing
unnecessary conditional timeout assignment.
2026-02-17 21:10:20 +08:00
Meng Zhuo
584a3dcc87 misc: fmt code 2026-02-13 17:51:47 +08:00
yinwm
ab20314882 Merge upstream/main into ralph/tool-result-refactor
Resolved conflicts:
- pkg/heartbeat/service.go: merged both 'started' field and 'onHeartbeatWithTools'
- pkg/tools/edit.go: use validatePath() with ToolResult return
- pkg/tools/filesystem.go: fixed return values to use ToolResult
- cmd/picoclaw/main.go: kept active setupCronTool, fixed toolsPkg import
- pkg/tools/cron.go: fixed Execute return value handling

Fixed tests for new function signatures (NewEditFileTool, NewAppendFileTool, NewExecTool)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-13 01:00:26 +08:00
Satyam Tiwari
71a81eb297 Merge branch 'main' of https://github.com/SatyamDevv/picoclaw 2026-02-12 20:25:31 +05:30
Satyam Tiwari
9c98c11351 Enhance CronTool to support executing shell commands and update job handling 2026-02-12 20:21:49 +05:30
mxrain
53c69ae41e fix: use cmd /c on Windows for shell command execution
The exec tool was hardcoded to use 'sh -c' which doesn't exist on Windows,
causing all tool calls to fail silently in gateway mode.
2026-02-12 22:38:47 +08:00
yinwm
ca781d4b37 feat: US-002 - Modify Tool interface to return *ToolResult
- Update all Tool implementations to return *ToolResult instead of (string, error)
- ShellTool: returns UserResult for command output, ErrorResult for failures
- SpawnTool: returns NewToolResult on success, ErrorResult on failure
- WebTool: returns ToolResult with ForUser=content, ForLLM=summary
- EditTool: returns SilentResult for silent edits, ErrorResult on failure
- FilesystemTool: returns SilentResult/NewToolResult for operations, ErrorResult on failure
- Temporarily disable cronTool in main.go (will be re-enabled in US-016)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-12 19:28:56 +08:00
RinZ27
792639d813
Enforce workspace boundaries with configurable restriction option
Implemented a unified path validation helper to ensure filesystem operations stay within the designated workspace. This now supports a 'restrict_to_workspace' option in config.json (enabled by default) to allow flexibility for specific environments while maintaining a secure default posture. I've updated read_file, write_file, list_dir, append_file, edit_file, and exec tools to respect this setting and included tests for both restricted and unrestricted modes.
2026-02-12 12:46:32 +07:00
yinwm
21d60f63fc Add memory system, dynamic tool loading, and fix logging issues
- Add MemoryStore for persistent long-term and daily notes
- Add dynamic tool summary generation in system prompt
- Fix YAML frontmatter parsing for nanobot skill format
- Add GetSummaries() method to ToolRegistry
- Fix DebugCF logging to use structured metadata
- Improve web_search and shell tool descriptions
2026-02-11 00:14:33 +08:00
lxowalle
e17693b17c * First commit 2026-02-09 19:20:19 +08:00