Function createBashTool

src/node/services/tools/bash.ts:875–1570

(config: ToolConfiguration)

 * @param config Required configuration including working directory
 */
export const createBashTool: ToolFactory = (config: ToolConfiguration) => {
  // Select limits based on overflow policy
  // truncate = IPC calls (generous limits for UI features, no line limit, no per-line limit)
  // tmpfile = AI agent calls (conservative limits for LLM context)
  const overflowPolicy = config.overflow_policy ?? "tmpfile";
  const maxTotalBytes =
    overflowPolicy === "truncate" ? BASH_TRUNCATE_MAX_TOTAL_BYTES : BASH_MAX_TOTAL_BYTES;
  const maxFileBytes =
    overflowPolicy === "truncate" ? BASH_TRUNCATE_MAX_FILE_BYTES : BASH_MAX_FILE_BYTES;
  const maxLines = overflowPolicy === "truncate" ? Infinity : BASH_HARD_MAX_LINES;
  const maxLineBytes = overflowPolicy === "truncate" ? Infinity : BASH_MAX_LINE_BYTES;

  return tool({
    description: buildBashToolDescription(config.cwd, config.projects ?? []),
    inputSchema: TOOL_DEFINITIONS.bash.schema,
    execute: async (
      { script, timeout_secs, run_in_background, display_name, monitor },
      { abortSignal, toolCallId }
    ): Promise<BashToolResult> => {
      // Validate script input

      // Treat display_name as untrusted input: it ends up in filesystem paths.
      const safeDisplayName = resolveBashDisplayName(script, display_name);
      const validationError = validateScript(script, config);
      if (validationError) return validationError;

      // Warn when the model appears to be reading files via bash output (cat/rg/grep).
      // Reading files via bash output is fragile (may be truncated or auto-filtered);
      // file_read supports paging and avoids silent context loss.
      const fileReadNotice =
        detectCatFileRead(script) || detectRipgrepFileDump(script) || detectGrepFileDump(script)
          ? CAT_FILE_READ_NOTICE
          : undefined;

      // Look up .mux/tool_env to source before script (for direnv, nvm, venv, etc.)
      // Skip for untrusted projects — tool_env is repo-controlled code
      const toolEnvPath =
        config.trusted && config.runtime ? await getToolEnvPath(config.runtime, config.cwd) : null;
      const toolEnvPrelude = buildToolEnvPrelude(toolEnvPath);

      // Neutralize git hooks for untrusted projects — prevent repository-controlled
      // hooks from executing when the model runs git subcommands (for example,
      // `git commit` or `git am`) through this bash tool.
      const hooksEnv = config.trusted !== true ? GIT_NO_HOOKS_ENV : {};

      // On Windows, models sometimes emit cmd.exe-style `>nul` / `2>nul` redirections.
      // Since the bash tool runs via bash, `nul` becomes a real file in the workspace.
      // Only rewrite for local Windows runtimes so non-Windows scripts keep their semantics.
      const shouldRewriteNullRedirects =
        process.platform === "win32" && config.runtime instanceof LocalBaseRuntime;
      const nulRedirectRewrite = shouldRewriteNullRedirects
        ? rewriteWindowsNullRedirects(script)
        : { script, didRewrite: false };
      const scriptWithEnv = toolEnvPrelude + nulRedirectRewrite.script;

      const nulRedirectNote = nulRedirectRewrite.didRewrite
        ? "Rewrote `>nul`/`2>nul` → `/dev/null` (bash tool runs in bash; use `/dev/null` to discard output)."
        : undefined;