Commit Graph

4 Commits

Author SHA1 Message Date
0x5487 19c698356c fix(security): workspace sandbox avoid time-of-check/time-of-use (TOCTOU) races (#464)
* chore: Update default host bindings from 0.0.0.0 to 127.0.0.1 for various services and examples.

* config: Update default host bindings to 0.0.0.0 for improved Docker accessibility and add related documentation.

* refactor: reimplement filesystem tools with `os.OpenRoot` for enhanced security and simplified path validation.

* chore: revert other PR content from this branch

* docs: Update Chinese README.

* docs: Update Chinese README.

* docs: Update Chinese README.

* refactor: Reorder filesystem helper functions, extract directory entry formatting logic, and enhance `WriteFileTool`'s result message.

* feat: Enhance `mkdirAllInRoot` to prevent creating directories over existing files and add tests for directory creation functionality.

* Refactor filesystem tools to use a `fileReadWriter` interface for both host and sandboxed I/O, improving atomic writes and error handling.

* refactor: unify filesystem read/write operations with atomic write guarantees and clearer naming.

* refactor: rename `appendFileWithRW` function to `appendFile`

* refactor: unify filesystem access by introducing a `fileSystem` interface and updating tools to use it directly, removing `os.Root` dependency from `sandboxFs`.

* chore: run make fmt

* fix: `validatePath` now returns an error when the workspace is empty.
2026-02-23 20:09:53 +11:00
Artem Yadelskyi 9e120f90ea feat(fmt): Run formatters 2026-02-18 21:48:23 +02:00
yinwm ab20314882 Merge upstream/main into ralph/tool-result-refactor
Resolved conflicts:
- pkg/heartbeat/service.go: merged both 'started' field and 'onHeartbeatWithTools'
- pkg/tools/edit.go: use validatePath() with ToolResult return
- pkg/tools/filesystem.go: fixed return values to use ToolResult
- cmd/picoclaw/main.go: kept active setupCronTool, fixed toolsPkg import
- pkg/tools/cron.go: fixed Execute return value handling

Fixed tests for new function signatures (NewEditFileTool, NewAppendFileTool, NewExecTool)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-13 01:00:26 +08:00
yinwm 35fa64cde8 feat: US-015 - Add EditTool tests
Added comprehensive test coverage for EditTool (EditFileTool, AppendFileTool) with 10 test cases:
- TestEditTool_EditFile_Success: Verifies successful file editing
- TestEditTool_EditFile_NotFound: Verifies error handling for non-existent files
- TestEditTool_EditFile_OldTextNotFound: Verifies error when old_text not found
- TestEditTool_EditFile_MultipleMatches: Verifies error for multiple occurrences
- TestEditTool_EditFile_OutsideAllowedDir: Verifies directory restriction
- TestEditTool_EditFile_MissingPath: Verifies missing path parameter
- TestEditTool_EditFile_MissingOldText: Verifies missing old_text parameter
- TestEditTool_EditFile_MissingNewText: Verifies missing new_text parameter
- TestEditTool_AppendFile_Success: Verifies successful file appending
- TestEditTool_AppendFile_MissingPath: Verifies missing path for append
- TestEditTool_AppendFile_MissingContent: Verifies missing content for append

EditTool implementation already conforms to ToolResult specification:
- EditFile returns SilentResult('File edited: ...')
- AppendFile returns SilentResult('Appended to ...')
- Errors return ErrorResult with IsError=true

EditFileTool includes security feature: optional directory restriction to prevent editing files outside allowed paths.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-12 19:55:57 +08:00