bash.cpp

Go to the documentation of this file.

// SPDX-License-Identifier: Apache-2.0
#include <entropic/mcp/servers/bash.h>
#include <entropic/types/run_scope.h>
#include <entropic/mcp/tool_base.h>
#include <entropic/mcp/server_base.h>
#include <entropic/types/logging.h>
 
#include <nlohmann/json.hpp>
 
#include <array>
#include <cerrno>
#include <chrono>
#include <csignal>
#include <cstdio>
#include <cstring>
#include <filesystem>
#include <stdexcept>
#include <string>
#include <thread>
 
#include <fcntl.h>
#include <poll.h>
#include <spawn.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
 
extern char** environ;  // NOLINT — POSIX, for posix_spawn
 
static auto logger = entropic::log::get("mcp.bash");
 
namespace entropic {
 
// ── working_dir validation ──────────────────────────────────────
 
static bool is_safe_cwd(const std::string& cwd) {
    static constexpr const char* unsafe_chars = ";&|`$<>\n\r\\\"'*?(){}[]";
    if (cwd.find_first_of(unsafe_chars) != std::string::npos) {
        return false;
    }
    std::error_code ec;
    return std::filesystem::is_directory(cwd, ec);
}
 
// ── Running one command (v2.13.0) ───────────────────────────────
//
// popen() gave no handle on the process: `timeout_` was stored and never
// read, `sleep 30` held the tool call (and the run thread under it) for
// 30 s, a background child that inherited stdout kept the read loop open
// for its whole life, and one that did not simply outlived the call. The
// command now leads its OWN process group, so the whole tree can be killed
// as one: on the deadline, and — for anything left running — when the
// shell exits.
 
namespace {
 
using Clock = std::chrono::steady_clock;
 
constexpr std::chrono::milliseconds kDrainGrace{2000};
 
constexpr int kPollMs = 50;
 
struct ShellRun {
    std::string output;        
    int exit_code = -1;        
    bool timed_out = false;    
    bool cancelled = false;    
    long long elapsed_ms = 0;  
};
 
pid_t spawn_shell(const std::string& cmd, int& read_fd) {
    int fds[2] = {-1, -1};
    read_fd = -1;
    if (::pipe2(fds, O_CLOEXEC) != 0) {
        logger->error("bash: pipe2 failed: {}", std::strerror(errno));
        return -1;
    }
    posix_spawn_file_actions_t actions;
    posix_spawn_file_actions_init(&actions);
    posix_spawn_file_actions_addopen(&actions, STDIN_FILENO, "/dev/null",
                                     O_RDONLY, 0);
    posix_spawn_file_actions_adddup2(&actions, fds[1], STDOUT_FILENO);
    posix_spawn_file_actions_adddup2(&actions, fds[1], STDERR_FILENO);
    posix_spawnattr_t attr;
    posix_spawnattr_init(&attr);
    posix_spawnattr_setflags(&attr, POSIX_SPAWN_SETPGROUP);
    posix_spawnattr_setpgroup(&attr, 0);  // pgid = the child's own pid
    const char* argv[] = {"/bin/sh", "-c", cmd.c_str(), nullptr};
    pid_t pid = -1;
    int rc = ::posix_spawn(&pid, "/bin/sh", &actions, &attr,
                           const_cast<char* const*>(argv), environ);
    posix_spawnattr_destroy(&attr);
    posix_spawn_file_actions_destroy(&actions);
    ::close(fds[1]);
    if (rc != 0) {
        logger->error("bash: posix_spawn failed: {}", std::strerror(rc));
        ::close(fds[0]);
        pid = -1;
    }
    read_fd = pid > 0 ? fds[0] : -1;
    return pid;
}
 
bool pump(int fd, std::string& out, int wait_ms) {
    pollfd pfd{fd, POLLIN, 0};
    if (::poll(&pfd, 1, wait_ms) <= 0) {
        return true;  // nothing yet (or EINTR): still open
    }
    std::array<char, 4096> buf{};
    ssize_t n = ::read(fd, buf.data(), buf.size());
    if (n > 0) {
        out.append(buf.data(), static_cast<size_t>(n));
    }
    return n > 0 || (n < 0 && (errno == EINTR || errno == EAGAIN));
}
 
bool shell_exited(pid_t pid) {
    siginfo_t info{};
    int rc = ::waitid(P_PID, static_cast<id_t>(pid), &info,
                      WEXITED | WNOHANG | WNOWAIT);
    return (rc == 0 && info.si_pid == pid) || (rc == -1 && errno == ECHILD);
}
 
enum class ShellStop {
    running,    
    exited,     
    deadline,   
    cancelled   
};
 
ShellStop poll_stop(pid_t pid, Clock::time_point deadline) {
    ShellStop stop = ShellStop::running;
    if (shell_exited(pid)) {
        stop = ShellStop::exited;
    } else if (entropic::current_run_cancelled()) {
        stop = ShellStop::cancelled;
    } else if (Clock::now() >= deadline) {
        stop = ShellStop::deadline;
    }
    return stop;
}
 
ShellStop collect_until_exit(pid_t pid, int fd, Clock::time_point deadline,
                             std::string& out) {
    bool open = true;
    ShellStop stop = ShellStop::running;
    while (stop == ShellStop::running) {
        if (open) {
            open = pump(fd, out, kPollMs);
        } else {
            // The shell closed its output but is still running.
            std::this_thread::sleep_for(std::chrono::milliseconds(kPollMs));
        }
        stop = poll_stop(pid, deadline);
    }
    return stop;
}
 
void drain(int fd, std::string& out) {
    const auto until = Clock::now() + kDrainGrace;
    bool open = true;
    while (open && Clock::now() < until) {
        open = pump(fd, out, kPollMs);
    }
    if (open) {
        logger->warn("bash: output pipe still open {} ms after the process "
                     "group was killed — a process that left the group "
                     "holds it; returning without its output",
                     kDrainGrace.count());
    }
}
 
int reap(pid_t pid) {
    int status = 0;
    pid_t rc = -1;
    do {
        rc = ::waitpid(pid, &status, 0);
    } while (rc == -1 && errno == EINTR);
    int code = -1;
    if (rc == pid && WIFEXITED(status)) {
        code = WEXITSTATUS(status);
    } else if (rc == pid && WIFSIGNALED(status)) {
        code = 128 + WTERMSIG(status);
    }
    return code;
}
 
ShellRun run_shell(const std::string& cmd, int timeout_s) {
    ShellRun run;
    const auto start = Clock::now();
    int fd = -1;
    const pid_t pid = spawn_shell(cmd, fd);
    if (pid < 0) {
        run.output = "Failed to start /bin/sh";
        return run;
    }
    const auto stop = collect_until_exit(
        pid, fd, start + std::chrono::seconds(timeout_s), run.output);
    run.timed_out = stop == ShellStop::deadline;
    run.cancelled = stop == ShellStop::cancelled;
    // The whole group: a timed-out or cancelled tree, or what a finished
    // command left running in the background.
    ::kill(-pid, SIGKILL);
    drain(fd, run.output);
    ::close(fd);
    run.exit_code = reap(pid);
    run.elapsed_ms = std::chrono::duration_cast<std::chrono::milliseconds>(
        Clock::now() - start).count();
    return run;
}
 
nlohmann::json timeout_error(const ShellRun& run, int limit_s) {
    std::array<char, 32> secs{};
    std::snprintf(secs.data(), secs.size(), "%.1f",
                  static_cast<double>(run.elapsed_ms) / 1000.0);
    nlohmann::json err;
    err["error"] = "timeout";
    err["message"] = "Command exceeded the bash tool's "
        + std::to_string(limit_s) + " s timeout (ran " + secs.data()
        + " s) and was killed, together with every process it started. "
          "Output printed before the kill is in `output`. Split the work "
          "into shorter commands; the limit is set by the operator "
          "(mcp.bash.timeout_seconds).";
    err["timeout_seconds"] = limit_s;
    err["elapsed_ms"] = run.elapsed_ms;
    err["output"] = run.output;
    return err;
}
 
nlohmann::json cancelled_error(const ShellRun& run) {
    nlohmann::json err;
    err["error"] = "cancelled";
    err["message"] = "The session was interrupted while this command ran; "
        "it was stopped together with every process it started. Output "
        "printed before then is in `output`.";
    err["elapsed_ms"] = run.elapsed_ms;
    err["output"] = run.output;
    return err;
}
 
nlohmann::json shell_result(const ShellRun& run, int limit_s,
                            const std::string& command) {
    nlohmann::json result;
    if (run.cancelled) {
        logger->info("Bash: CANCELLED after {} ms — process group killed, "
                     "cmd='{}'", run.elapsed_ms, command);
        result = cancelled_error(run);
    } else if (run.timed_out) {
        logger->warn("Bash: TIMEOUT after {} ms (limit {} s) — process "
                     "group killed, cmd='{}'", run.elapsed_ms, limit_s, command);
        result = timeout_error(run, limit_s);
    } else {
        logger->info("Bash: exit={}, output={} chars, {} ms, cmd='{}'",
                     run.exit_code, run.output.size(), run.elapsed_ms, command);
        result["exit_code"] = run.exit_code;
        result["output"] = run.output;
    }
    return result;
}
 
}  // namespace
 
// ── ExecuteTool ─────────────────────────────────────────────────
 
class ExecuteTool : public ToolBase {
public:
    ExecuteTool(ToolDefinition def, BashServer& server)
        : ToolBase(std::move(def)), server_(server) {}
 
    ServerResponse execute(const std::string& args_json) override;
 
private:
    BashServer& server_;
};
 
ServerResponse ExecuteTool::execute(const std::string& args_json) {
    auto args = nlohmann::json::parse(args_json);
    std::string command = args.at("command").get<std::string>();
 
    std::string cwd = args.value(
        "working_dir", server_.working_dir().string());
 
    logger->info("[bash.execute] cmd='{}' cwd='{}'", command, cwd);
 
    if (!is_safe_cwd(cwd)) {
        logger->warn("Rejected unsafe working_dir: '{}'", cwd);
        return {"Error: working_dir is not an existing directory or "
                "contains shell metacharacters", {}};
    }
 
    std::string full_cmd =
        "cd " + cwd + " && " + command + " 2>&1";
 
    const int limit = server_.timeout();
    auto run = run_shell(full_cmd, limit);
    return {shell_result(run, limit, command).dump(), {}};
}
 
// ── BashServer ──────────────────────────────────────────────────
 
BashServer::BashServer(
    const std::filesystem::path& working_dir,
    const std::string& data_dir,
    int timeout)
    : MCPServerBase("bash")
    , working_dir_(working_dir)
    , timeout_(timeout) {
 
    auto def = load_tool_definition(
        "execute", "bash", data_dir + "/tools");
 
    execute_tool_ = std::make_unique<ExecuteTool>(
        std::move(def), *this);
 
    register_tool(execute_tool_.get());
 
    logger->info("BashServer initialized: cwd='{}' timeout={}s",
                 working_dir_.string(), timeout_);
}
 
BashServer::~BashServer() = default;
 
std::string
BashServer::get_permission_pattern(const std::string& tool_name, const std::string& args_json) const {
 
    std::string base_cmd = "unknown";
    try {
        auto args = nlohmann::json::parse(args_json);
        std::string cmd = args.at("command").get<std::string>();
        auto space = cmd.find(' ');
        base_cmd = (space != std::string::npos)
            ? cmd.substr(0, space) : cmd;
    } catch (const std::exception& e) {
        logger->warn("Failed to parse command for permission: {}",
                     e.what());
    }
    return tool_name + ":" + base_cmd + " *";
}
 
bool BashServer::set_working_dir(const std::string& path) {
    working_dir_ = path;
    logger->info("Working directory set to: {}", path);
    return true;
}
 
const std::filesystem::path& BashServer::working_dir() const {
    return working_dir_;
}
 
int BashServer::timeout() const {
    return timeout_;
}
 
} // namespace entropic