Function handleExecCommand

packages/cli/src/server/tools/exec-tools.ts:413–509

(params: zod.infer<typeof ExecCommandSchema>)

// ============ Tool Handlers ============

async function handleExecCommand(params: zod.infer<typeof ExecCommandSchema>) {
	const config = getExecConfig();

	// Check if command is allowed
	const {allowed, reason} = isCommandAllowed(params.command);
	if (!allowed) {
		return {
			success: false,
			error: `Command not allowed: ${reason}`,
		};
	}

	// Determine working directory with scope enforcement
	let dir: string;
	const folders = listFolders();

	if (folders.length > 0) {
		// Scope enforcement: dir must resolve to a folder with `exec` scope
		const target = params.dir || process.cwd();
		const resolved = resolveFolderForPath(target, 'exec');
		if (!resolved) {
			const err = folderScopeError(target, 'exec');
			return {
				success: false,
				error: `${err.error.code}: ${err.error.message}`,
			};
		}
		dir = resolved.absPath;
	} else {
		// Backwards-compatibility fallback — no folders registered
		dir = params.dir || config.defaultDir || DEFAULT_EXEC_DIR;
		if (!warnedFoldersEmpty) {
			warnedFoldersEmpty = true;
			console.warn(
				'[corebrain] DEPRECATION: no folders registered; falling back to ExecConfig.defaultDir. ' +
					'Register folders with `corebrain folder add <path> --scopes exec` to enforce path scope.',
			);
		}
	}

	// Ensure directory exists
	if (!existsSync(dir)) {
		return {
			success: false,
			error: `Directory "${dir}" does not exist`,
		};
	}

	// Execute command
	const timeout = params.timeout || 30000;
	const maxStdoutBytes = readByteCap(
		config.maxStdoutBytes,
		'COREBRAIN_EXEC_MAX_STDOUT_BYTES',
		DEFAULT_MAX_STDOUT_BYTES,
	);
	const maxStderrBytes = readByteCap(
		config.maxStderrBytes,
		'COREBRAIN_EXEC_MAX_STDERR_BYTES',