Files
shockbot/prep/types.ts
T
David Blass bc28c658f2 harden sandbox escape vectors for bash disabled/restricted modes (#257)
* harden sandbox escape vectors for bash disabled/restricted modes

block git config injection (-c flag as subcommand), dangerous subcommands
(config, submodule, rebase, bisect), code-executing arg flags (--exec,
--extcmd), .gitattributes/.gitmodules writes, and package lifecycle scripts.
add retry logic to test runner for transient failures. add security unit
tests and adhoc attack tests.

Co-authored-by: Cursor <cursoragent@cursor.com>

* only filter subcommands in nobash, remove nobash from ui

* use regex matching

* iterate on tests

* simplify githooks

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-11 02:02:41 +00:00

37 lines
956 B
TypeScript

interface PrepResultBase {
dependenciesInstalled: boolean;
issues: string[];
}
export type NodePackageManager = "npm" | "pnpm" | "yarn" | "bun" | "deno";
export interface NodePrepResult extends PrepResultBase {
language: "node";
packageManager: NodePackageManager;
}
export type PythonPackageManager = "pip" | "pipenv" | "poetry";
export interface PythonPrepResult extends PrepResultBase {
language: "python";
packageManager: PythonPackageManager;
configFile: string;
}
export interface UnknownLanguagePrepResult extends PrepResultBase {
language: "unknown";
}
export type PrepResult = NodePrepResult | PythonPrepResult | UnknownLanguagePrepResult;
export type PrepOptions = {
/** when true, lifecycle scripts (postinstall, etc.) are suppressed */
ignoreScripts: boolean;
};
export interface PrepDefinition {
name: string;
shouldRun: () => Promise<boolean> | boolean;
run: (options: PrepOptions) => Promise<PrepResult>;
}