Several QoL updates based on my local Crush modifications

[VictorLowther]

Been working on some Quality of Life stuff for crush, this the right place to get feedback before going htrough the whole issue/pr process? Goodies include:

• a Javascript sandbox for local calculator/LLM code execution. Basically embeds github.com/grafana/sobek into Crush as an exec tool that you feed Javascript in and get output in the same format the bash tool uses. Unlike the bash tool, tho, each session has one sorta-persistent exec session (it does not survive a restart). useful for having the LLM perform accurate math and some basic data processing.
• a config_schema tool that the crush-config skill has been updated to use to sanity-check any changes it makes to a crush.json.
• bash tool unifying stderr and stdout instead of having them be separate. Waaay too much stuff I do involves running unit tests that generate lots of output on stderr and stdout, and having them be presented separately in tool output destroys valuable sequencing.
• An rm tool that does what you might expect. It also blocks the rm shell command.
• Per-session temporary directores. The session is allowed to read/write/remove files in its own temp directories with no permissions checks at all. The temp directories are stored in the per-project .crush directory so they cannot get orphaned.
• bash writes all output for every tool invocation to a log file in the per-session temp directory, and job_output updated to always read the last 100 lines / 30k bytes (whichever is smaller), with a hint to use the view and grep tools on the file for more precise control. Very useful to avoid inadvertently nuking your context with a larger-than-expected output.
• AST driven bash interceptor (off by default) that catches common LLM abuses (echo > file to create a file, sed -i / awk -i inplace / perl -pi to edit a file instead of edit or muiltiedit), and auto-declines the tool call with a redirect message to the tool that is actually used. Rules can be added / removed to crush.json
• AST driven bash rewrites that silently turn leading cd wherever into a working_dir tool argument, silently deletes trailing 2 >& 1 since bash does that by default now.
• AST driven denial and redirect of |head and |tail pipes, since job_output captures everything and the LLM can use targeted grep and view on all bash output. Denial contains an AST rewrite of what the LLM should actually try to run.

Currently it is all sorta smashed together in my fork at github.com/VictorLowther/crush, but I can refactor into mostly-independent pull requests depending.

[meowgorithm]

Hey! Thanks for opening a discussion on this! We’d love it if you could contribute all of this to Crush. @taciturnaxolotl can work with you on getting it in.

Also, question on config_schema: does it make sense to elevate the crush_config skill into its own tool, possibly combined with the schema tool?