Function _bash_call

src/tool_system/tools/bash/bash_tool.py:234–465

(tool_input: dict[str, Any], context: ToolContext)

def _bash_call(tool_input: dict[str, Any], context: ToolContext) -> ToolResult:
    command = tool_input["command"]
    if not isinstance(command, str) or not command.strip():
        raise ToolInputError("command must be a non-empty string")
    if "\x00" in command:
        raise ToolInputError("command contains NUL byte")

    # Defense-in-depth: block obviously dangerous commands even when called
    # directly (bypassing the registry's check_permissions flow).
    for pat in _HARDCODED_DANGEROUS_PATTERNS:
        if pat.search(command):
            raise ToolPermissionError("refusing to run potentially dangerous command")

    explicit_cwd = tool_input.get("cwd")
    if explicit_cwd is not None:
        if not isinstance(explicit_cwd, str) or not explicit_cwd.startswith("/"):
            raise ToolInputError("cwd must be an absolute path when provided")
        cwd = context.ensure_allowed_path(explicit_cwd)
    else:
        cwd = context.cwd or context.workspace_root

    # ``run_in_background: true`` detaches the command so the agent can keep
    # coordinating while a long-running job (dev server, build, long test
    # suite, ...) makes progress. Mirrors
    # ``typescript/src/tools/BashTool/BashTool.tsx`` ``spawnBackgroundTask``
    # behaviour: we return immediately with a task id and let the model poll
    # the output via ``TaskOutput``.
    if tool_input.get("run_in_background"):
        bg_output = spawn_background_bash(
            command=command,
            cwd=cwd,
            description=tool_input.get("description"),
            context=context,
        )
        return ToolResult(name=BASH_TOOL_NAME, output=bg_output)

    cd_target = _try_extract_cd(command)
    if (
        cd_target is not None
        and command.strip().startswith("cd ")
        and len(command.strip().splitlines()) == 1
    ):
        if not cd_target.is_absolute():
            next_dir = (cwd / cd_target).expanduser().resolve()
        else:
            next_dir = cd_target.expanduser().resolve()
        next_dir = context.ensure_allowed_path(next_dir)
        if not next_dir.exists() or not next_dir.is_dir():
            return ToolResult(
                name=BASH_TOOL_NAME,
                output={"error": f"directory does not exist: {next_dir}"},
                is_error=True,
            )
        context.cwd = next_dir
        return ToolResult(
            name=BASH_TOOL_NAME,
            output={"cwd": str(context.cwd), "stdout": "", "stderr": ""},
        )