fix(product-run): execute direct run commands

Author: dollspace-gay

Cargo.lock

@@ -17,6 +17,7 @@ peritus-codec = { version = "=0.0.0", path = "../../foundation/peritus-codec" }
 peritus-launcher = { version = "=0.0.0", path = "../peritus-launcher" }
 peritus-product-runner = { version = "=0.0.0", path = "../peritus-product-runner" }
 peritus-run-settlement = { version = "=0.0.0", path = "../../orchestration/peritus-run-settlement" }
+peritus-tools-shell = { version = "=0.0.0", path = "../../tools/peritus-tools-shell" }
 peritus-types = { version = "=0.0.0", path = "../../foundation/peritus-types" }
 serde_json.workspace = true
 sha2.workspace = true

crates/app/peritus-cli/Cargo.toml

@@ -11,6 +11,7 @@ use peritus_product_runner::ProductRunner;
 use peritus_run_settlement::{
     CandidateCheckpoint, CandidateStage, EvidenceStatus, QualificationEvidence, RunSettlement,
 };
+use peritus_tools_shell::ExecInput;
 use peritus_types::{RunId, SessionId};
 
 use crate::{
@@ -364,16 +365,32 @@ const fn evidence_name(value: &EvidenceStatus<QualificationEvidence>) -> &'stati
     }
 }
 
-#[cfg(unix)]
 fn run_command(root: &str, instruction: &str) -> Result<std::process::ExitStatus, CliError> {
-    Command::new("sh").args(["-lc", instruction]).current_dir(Path::new(root)).status().map_err(
-        |error| CliError::local_io("run candidate", Some(Path::new(root).to_owned()), error),
-    )
+    let input = ExecInput::from_command_line(instruction).map_err(|error| {
+        CliError::usage(format!("candidate run instruction is not executable: {}", error.detail()))
+    })?;
+    Command::new(input.executable())
+        .args(input.arguments())
+        .current_dir(Path::new(root))
+        .status()
+        .map_err(|error| {
+            CliError::local_io("run candidate", Some(Path::new(root).to_owned()), error)
+        })
 }
 
-#[cfg(windows)]
-fn run_command(root: &str, instruction: &str) -> Result<std::process::ExitStatus, CliError> {
-    Command::new("cmd").args(["/C", instruction]).current_dir(Path::new(root)).status().map_err(
-        |error| CliError::local_io("run candidate", Some(Path::new(root).to_owned()), error),
-    )
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn candidate_command_executes_directly_and_rejects_shell_text() {
+        assert!(
+            run_command(env!("CARGO_MANIFEST_DIR"), "rustc --version")
+                .expect("direct command")
+                .success()
+        );
+        assert!(
+            run_command(env!("CARGO_MANIFEST_DIR"), "rustc --version && rustc --version",).is_err()
+        );
+    }
 }

crates/app/peritus-cli/src/product_run.rs

@@ -114,7 +114,9 @@ pub async fn complete_developer_turn(
         ) else {
             continue;
         };
-        let terminal = match parse_grounded_terminal(&tools, &result) {
+        let terminal = match parse_grounded_terminal(&tools, &result).and_then(|terminal| {
+            terminal::validate_run_instructions(input.delivery_scope, terminal)
+        }) {
             Ok(terminal) => terminal,
             Err(error) => {
                 let current = WorkspaceCheckpoint::capture(&input.workspace_root)?;
@@ -330,7 +332,7 @@ fn writer_system(
 ) -> String {
     let delivery = match delivery_scope {
         super::ProductDeliveryScope::WorkspaceChanges => {
-            "This run accepts exact workspace changes. Label build, test, lint, and other inspection commands with purpose `verification`; external effects are not an alternate completion path. The workspace_list result gives the exact workspace_root and declares workspace tool paths to be relative to it. When the task names an absolute path below that exact root, remove the root prefix once; never repeat the root directory inside itself."
+            "This run accepts exact workspace changes. Label build, test, lint, and other inspection commands with purpose `verification`; external effects are not an alternate completion path. The workspace_list result gives the exact workspace_root and declares workspace tool paths to be relative to it. When the task names an absolute path below that exact root, remove the root prefix once; never repeat the root directory inside itself. For `run_instructions`, return exactly one direct command such as `cargo run --quiet`: use whitespace-separated executable and arguments only, with no prose, Markdown, quotes, environment assignments, redirections, expansions, or shell operators."
         }
         super::ProductDeliveryScope::AuthorizedExternalEffects => {
             if effect_requirement.is_required() {

crates/app/peritus-product-runner/src/turn.rs

@@ -2,7 +2,9 @@
 
 use serde::Deserialize;
 
-use crate::{ProductRunnerError, ProductRunnerErrorKind};
+use peritus_tools_shell::ExecInput;
+
+use crate::{ProductDeliveryScope, ProductRunnerError, ProductRunnerErrorKind};
 
 #[derive(Deserialize)]
 #[serde(deny_unknown_fields)]
@@ -44,6 +46,24 @@ pub(super) fn parse(value: &str) -> Result<TerminalTurn, ProductRunnerError> {
     }
 }
 
+pub(super) fn validate_run_instructions(
+    scope: ProductDeliveryScope,
+    terminal: TerminalTurn,
+) -> Result<TerminalTurn, ProductRunnerError> {
+    if let (ProductDeliveryScope::WorkspaceChanges, TerminalTurn::Complete((_, command))) =
+        (scope, &terminal)
+    {
+        ExecInput::from_command_line(command).map_err(|error| {
+            ProductRunnerError::new(
+                ProductRunnerErrorKind::InvalidModelOutput,
+                "validate candidate run command",
+                error.detail(),
+            )
+        })?;
+    }
+    Ok(terminal)
+}
+
 fn invalid(detail: &'static str) -> ProductRunnerError {
     ProductRunnerError::new(
         ProductRunnerErrorKind::InvalidModelOutput,

crates/app/peritus-product-runner/src/turn/terminal.rs

@@ -165,6 +165,46 @@ fn writer_batches_tools_and_respects_artifact_workspaces() {
     assert!(prompt.contains("missing controlling fact"));
     assert!(prompt.contains("preserve the complete selected source value"));
     assert!(prompt.contains("apply only explicitly named transformations"));
+    assert!(prompt.contains("return exactly one direct command"));
+    assert!(prompt.contains("no prose, Markdown, quotes"));
+}
+
+#[test]
+fn workspace_completion_requires_a_direct_run_command() {
+    let invalid = terminal::parse(
+        r#"{"kind":"complete","summary":"done","run_instructions":"From the root, run `cargo run`."}"#,
+    )
+    .expect("terminal shape");
+    let Err(error) =
+        terminal::validate_run_instructions(ProductDeliveryScope::WorkspaceChanges, invalid)
+    else {
+        panic!("prose must not qualify as a run command");
+    };
+    assert_eq!(error.kind(), ProductRunnerErrorKind::InvalidModelOutput);
+    assert_eq!(error.operation(), "validate candidate run command");
+
+    let direct = terminal::parse(
+        r#"{"kind":"complete","summary":"done","run_instructions":"cargo run --quiet"}"#,
+    )
+    .expect("terminal shape");
+    assert!(
+        terminal::validate_run_instructions(ProductDeliveryScope::WorkspaceChanges, direct).is_ok()
+    );
+}
+
+#[test]
+fn external_effect_completion_may_retain_concise_steps() {
+    let instructions = terminal::parse(
+        r#"{"kind":"complete","summary":"done","run_instructions":"Inspect the configured service."}"#,
+    )
+    .expect("terminal shape");
+    assert!(
+        terminal::validate_run_instructions(
+            ProductDeliveryScope::AuthorizedExternalEffects,
+            instructions,
+        )
+        .is_ok()
+    );
 }
 
 #[test]

crates/app/peritus-product-runner/src/turn/tests.rs

@@ -18,6 +18,7 @@ peritus-codec = { version = "=0.0.0", path = "../../foundation/peritus-codec" }
 peritus-protocol = { version = "=0.0.0", path = "../../foundation/peritus-protocol" }
 peritus-product-runner = { version = "=0.0.0", path = "../peritus-product-runner" }
 peritus-run-settlement = { version = "=0.0.0", path = "../../orchestration/peritus-run-settlement" }
+peritus-tools-shell = { version = "=0.0.0", path = "../../tools/peritus-tools-shell" }
 peritus-types = { version = "=0.0.0", path = "../../foundation/peritus-types" }
 ratatui.workspace = true
 sha2.workspace = true

crates/app/peritus-tui/Cargo.toml

@@ -3,6 +3,7 @@
 use std::{path::PathBuf, process::Command};
 
 use peritus_product_runner::ProductRunner;
+use peritus_tools_shell::ExecInput;
 use peritus_types::Sha256Digest;
 
 /// Runs the candidate while the full-screen terminal is suspended.
@@ -31,26 +32,21 @@ fn execute_blocking(
                 .to_owned(),
         );
     }
-    let mut command = shell_command(instruction);
+    let mut command = direct_command(instruction)?;
     let status = command
         .current_dir(workspace)
         .status()
         .map_err(|error| format!("could not start candidate command: {error}"))?;
     if status.success() { Ok(()) } else { Err(format!("candidate command exited with {status}")) }
 }
 
-#[cfg(unix)]
-fn shell_command(instruction: &str) -> Command {
-    let mut command = Command::new("sh");
-    command.args(["-lc", instruction]);
-    command
-}
-
-#[cfg(windows)]
-fn shell_command(instruction: &str) -> Command {
-    let mut command = Command::new("cmd");
-    command.args(["/D", "/S", "/C", instruction]);
-    command
+fn direct_command(instruction: &str) -> Result<Command, String> {
+    let input = ExecInput::from_command_line(instruction).map_err(|error| {
+        format!("candidate run instruction is not executable: {}", error.detail())
+    })?;
+    let mut command = Command::new(input.executable());
+    command.args(input.arguments());
+    Ok(command)
 }
 
 #[cfg(test)]
@@ -75,6 +71,15 @@ mod tests {
                 .await
                 .is_err()
         );
+        assert!(
+            execute(
+                workspace.path().to_path_buf(),
+                "rustc --version && rustc --version".to_owned(),
+                digest,
+            )
+            .await
+            .is_err()
+        );
         std::fs::write(workspace.path().join("changed.txt"), "changed").expect("candidate change");
         let error = execute(workspace.path().to_path_buf(), success_command().to_owned(), digest)
             .await
@@ -88,23 +93,11 @@ mod tests {
         assert!(status.success());
     }
 
-    #[cfg(unix)]
-    const fn success_command() -> &'static str {
-        "true"
-    }
-
-    #[cfg(unix)]
-    const fn failure_command() -> &'static str {
-        "false"
-    }
-
-    #[cfg(windows)]
     const fn success_command() -> &'static str {
-        "exit /b 0"
+        "rustc --version"
     }
 
-    #[cfg(windows)]
     const fn failure_command() -> &'static str {
-        "exit /b 1"
+        "rustc --definitely-invalid-peritus-option"
     }
 }

crates/app/peritus-tui/src/runtime/candidate.rs

@@ -32,6 +32,31 @@ impl ExecInput {
         Ok(Self { executable, arguments })
     }
 
+    /// Parses one deliberately restricted direct-execution command into literal argv.
+    ///
+    /// This format is intended for persisted user-facing run instructions. It accepts
+    /// whitespace-separated argv only: quoting, command separators, expansions, redirections,
+    /// and multiple lines are rejected rather than interpreted.
+    ///
+    /// # Errors
+    /// Returns a typed failure when the value is empty, contains command-language or markup
+    /// syntax, starts with an environment assignment, or violates the structured-argv contract.
+    pub fn from_command_line(value: &str) -> Result<Self, ShellError> {
+        let value = value.trim();
+        if value.is_empty() || value.chars().any(char::is_control) {
+            return Err(invalid_direct_command());
+        }
+        if value.chars().any(is_command_language_character) {
+            return Err(invalid_direct_command());
+        }
+        let mut words = value.split_ascii_whitespace();
+        let executable = words.next().ok_or_else(invalid_direct_command)?;
+        if executable.contains('=') {
+            return Err(invalid_direct_command());
+        }
+        Self::new(executable, words.map(str::to_owned).collect())
+    }
+
     /// Decodes already schema-validated protocol arguments defensively.
     ///
     /// # Errors
@@ -59,6 +84,20 @@ impl ExecInput {
     }
 }
 
+fn invalid_direct_command() -> ShellError {
+    ShellError::new(
+        ShellErrorKind::InvalidInput,
+        "run instructions must be one direct command with whitespace-separated arguments and no quoting, expansion, redirection, markup, or shell operators",
+    )
+}
+
+const fn is_command_language_character(character: char) -> bool {
+    matches!(
+        character,
+        '\'' | '"' | '`' | '$' | '|' | '&' | ';' | '<' | '>' | '(' | ')' | '{' | '}' | '#'
+    )
+}
+
 /// Explicit interpreter and script input accepted only by `shell.script`.
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct ScriptInput {
@@ -214,6 +253,30 @@ mod tests {
         assert_eq!(command.arguments()[1], "$(touch escaped)");
     }
 
+    #[test]
+    fn direct_command_line_becomes_literal_argv() {
+        let input = ExecInput::from_command_line("cargo run --quiet --features tui,serde")
+            .expect("direct command");
+        assert_eq!(input.executable(), "cargo");
+        assert_eq!(input.arguments(), ["run", "--quiet", "--features", "tui,serde"]);
+    }
+
+    #[test]
+    fn direct_command_line_rejects_shell_syntax_and_markup() {
+        for value in [
+            "cargo test && cargo run",
+            "cargo run > output.txt",
+            "cargo run `whoami`",
+            "From the root, run `cargo run`.",
+            "MODE=release cargo run",
+            "cargo run\ncargo test",
+            "sh -c echo",
+        ] {
+            let error = ExecInput::from_command_line(value).expect_err("restricted command");
+            assert_eq!(error.kind(), ShellErrorKind::InvalidInput, "{value}");
+        }
+    }
+
     #[test]
     fn script_is_one_literal_argument() {
         let input = ScriptInput::new(