opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

perf(tools): move path regex compilation from per-call to package init

Browse source 
The path regex in guardCommand was compiled on every call. Hoist it
to a package-level var (absolutePathPattern) alongside defaultDenyPatterns
in a single var block, so it is compiled once at init time.
This commit is contained in:
ItsT0ng 2026-03-01 00:48:10 +11:00
parent c3edb3d1d3
commit bdc8ef1f9d
1 changed files with 50 additions and 46 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

96
pkg/tools/shell.go
View file

@ -24,50 +24,55 @@ type ExecTool struct {
restrictToWorkspace bool restrictToWorkspace bool
} }
var defaultDenyPatterns = []*regexp.Regexp{ var (
regexp.MustCompile(`\brm\s+-[rf]{1,2}\b`), defaultDenyPatterns = []*regexp.Regexp{
regexp.MustCompile(`\bdel\s+/[fq]\b`), regexp.MustCompile(`\brm\s+-[rf]{1,2}\b`),
regexp.MustCompile(`\brmdir\s+/s\b`), regexp.MustCompile(`\bdel\s+/[fq]\b`),
regexp.MustCompile(`\b(format|mkfs|diskpart)\b\s`), // Match disk wiping commands (must be followed by space/args) regexp.MustCompile(`\brmdir\s+/s\b`),
regexp.MustCompile(`\bdd\s+if=`), regexp.MustCompile(`\b(format|mkfs|diskpart)\b\s`), // Match disk wiping commands (must be followed by space/args)
regexp.MustCompile(`>\s*/dev/sd[a-z]\b`), // Block writes to disk devices (but allow /dev/null) regexp.MustCompile(`\bdd\s+if=`),
regexp.MustCompile(`\b(shutdown|reboot|poweroff)\b`), regexp.MustCompile(`>\s*/dev/sd[a-z]\b`), // Block writes to disk devices (but allow /dev/null)
regexp.MustCompile(`:\(\)\s*\{.*\};\s*:`), regexp.MustCompile(`\b(shutdown|reboot|poweroff)\b`),
regexp.MustCompile(`\$\([^)]+\)`), regexp.MustCompile(`:\(\)\s*\{.*\};\s*:`),
regexp.MustCompile(`\$\{[^}]+\}`), regexp.MustCompile(`\$\([^)]+\)`),
regexp.MustCompile("`[^`]+`"), regexp.MustCompile(`\$\{[^}]+\}`),
regexp.MustCompile(`\|\s*sh\b`), regexp.MustCompile("`[^`]+`"),
regexp.MustCompile(`\|\s*bash\b`), regexp.MustCompile(`\|\s*sh\b`),
regexp.MustCompile(`;\s*rm\s+-[rf]`), regexp.MustCompile(`\|\s*bash\b`),
regexp.MustCompile(`&&\s*rm\s+-[rf]`), regexp.MustCompile(`;\s*rm\s+-[rf]`),
regexp.MustCompile(`\|\|\s*rm\s+-[rf]`), regexp.MustCompile(`&&\s*rm\s+-[rf]`),
regexp.MustCompile(`>\s*/dev/null\s*>&?\s*\d?`), regexp.MustCompile(`\|\|\s*rm\s+-[rf]`),
regexp.MustCompile(`<<\s*EOF`), regexp.MustCompile(`>\s*/dev/null\s*>&?\s*\d?`),
regexp.MustCompile(`\$\(\s*cat\s+`), regexp.MustCompile(`<<\s*EOF`),
regexp.MustCompile(`\$\(\s*curl\s+`), regexp.MustCompile(`\$\(\s*cat\s+`),
regexp.MustCompile(`\$\(\s*wget\s+`), regexp.MustCompile(`\$\(\s*curl\s+`),
regexp.MustCompile(`\$\(\s*which\s+`), regexp.MustCompile(`\$\(\s*wget\s+`),
regexp.MustCompile(`\bsudo\b`), regexp.MustCompile(`\$\(\s*which\s+`),
regexp.MustCompile(`\bchmod\s+[0-7]{3,4}\b`), regexp.MustCompile(`\bsudo\b`),
regexp.MustCompile(`\bchown\b`), regexp.MustCompile(`\bchmod\s+[0-7]{3,4}\b`),
regexp.MustCompile(`\bpkill\b`), regexp.MustCompile(`\bchown\b`),
regexp.MustCompile(`\bkillall\b`), regexp.MustCompile(`\bpkill\b`),
regexp.MustCompile(`\bkill\s+-[9]\b`), regexp.MustCompile(`\bkillall\b`),
regexp.MustCompile(`\bcurl\b.*\|\s*(sh|bash)`), regexp.MustCompile(`\bkill\s+-[9]\b`),
regexp.MustCompile(`\bwget\b.*\|\s*(sh|bash)`), regexp.MustCompile(`\bcurl\b.*\|\s*(sh|bash)`),
regexp.MustCompile(`\bnpm\s+install\s+-g\b`), regexp.MustCompile(`\bwget\b.*\|\s*(sh|bash)`),
regexp.MustCompile(`\bpip\s+install\s+--user\b`), regexp.MustCompile(`\bnpm\s+install\s+-g\b`),
regexp.MustCompile(`\bapt\s+(install|remove|purge)\b`), regexp.MustCompile(`\bpip\s+install\s+--user\b`),
regexp.MustCompile(`\byum\s+(install|remove)\b`), regexp.MustCompile(`\bapt\s+(install|remove|purge)\b`),
regexp.MustCompile(`\bdnf\s+(install|remove)\b`), regexp.MustCompile(`\byum\s+(install|remove)\b`),
regexp.MustCompile(`\bdocker\s+run\b`), regexp.MustCompile(`\bdnf\s+(install|remove)\b`),
regexp.MustCompile(`\bdocker\s+exec\b`), regexp.MustCompile(`\bdocker\s+run\b`),
regexp.MustCompile(`\bgit\s+push\b`), regexp.MustCompile(`\bdocker\s+exec\b`),
regexp.MustCompile(`\bgit\s+force\b`), regexp.MustCompile(`\bgit\s+push\b`),
regexp.MustCompile(`\bssh\b.*@`), regexp.MustCompile(`\bgit\s+force\b`),
regexp.MustCompile(`\beval\b`), regexp.MustCompile(`\bssh\b.*@`),
regexp.MustCompile(`\bsource\s+.*\.sh\b`), regexp.MustCompile(`\beval\b`),
} regexp.MustCompile(`\bsource\s+.*\.sh\b`),
}
// absolutePathPattern matches absolute file paths in commands (Unix and Windows).
absolutePathPattern = regexp.MustCompile(`[A-Za-z]:\\[^\\\"']+|/[^\s\"']+`)
)
func NewExecTool(workingDir string, restrict bool) (*ExecTool, error) { func NewExecTool(workingDir string, restrict bool) (*ExecTool, error) {
return NewExecToolWithConfig(workingDir, restrict, nil) return NewExecToolWithConfig(workingDir, restrict, nil)
@ -287,8 +292,7 @@ func (t *ExecTool) guardCommand(command, cwd string) string {
return "" return ""
} }
pathPattern := regexp.MustCompile(`[A-Za-z]:\\[^\\\"']+|/[^\s\"']+`) matches := absolutePathPattern.FindAllString(cmd, -1)
matches := pathPattern.FindAllString(cmd, -1)
for _, raw := range matches { for _, raw := range matches {
p, err := filepath.Abs(raw) p, err := filepath.Abs(raw)