kairos-chain 3.88.0 → 3.88.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6ab07b57ae1574d18326409b3db66f61dabd697c9bc8d52e6ba20b00ee078bb6
-  data.tar.gz: ad59a3b0ddaca3913faffcd102cf7a361ad4772b90dcd0950c703884f6a8d0b9
+  metadata.gz: 8a785289fdb24dc921cad6c727b74168557a7dcf90593cb7ae267d2cb6b3501f
+  data.tar.gz: 422bb014ce8b479f765972b4f05fe57f86c71c09bae7c48277e8625b798767af
 SHA512:
-  metadata.gz: bed9eb85e62df8c52384e0ead71655d1c44b375abd79cf4dc85797e910644ce8360743073572d12edd52d515c1bae9eecdf524c22811a44c444cca0766839a1c
-  data.tar.gz: 39d2c4d7b801d8cfb9f73e3f2075e87178d7ea2d2bbbb57dd967b24dbf69f72a3812a4f9782c793bebd7a27525793f144226fb7a00ae6712851ef276ceefee6e
+  metadata.gz: b399c8a6e440d323ce30c73fb1c62acbb6fcefe7c67e76b89bed4171a3a9bc57d3af48de2ffb4cfc9ac4a802498dde65a868e0435564824d1f29a638748f3e73
+  data.tar.gz: 6b2fc4894c4d52489bb86580386a50121c64ebcdc7f1e363e18813f0a9a548d2a9f974104206fc66d4255b00119cb6f9d4c4b3b81523776a365c4b37be58779b

data/CHANGELOG.md

@@ -4,6 +4,108 @@ All notable changes to the `kairos-chain` gem will be documented in this file.
 
 This project follows [Semantic Versioning](https://semver.org/).
 
+## [3.88.2] - 2026-10-06
+
+### Security — agent: the act and its LLM bodies stay inside their gates
+
+A design review of approval delegation found several ways for the agent to get
+around the gates it runs inside: the tool blacklist, the risk budget and the
+guard. Each was confirmed in code; none was observed in use. Four review rounds
+followed. **The act route is still deny-based. Do not run the agent unattended
+until an act-route allow-list lands** (next version, designed with approval
+delegation).
+
+**No LLM body launched for the agent carries tools in the project root.**
+- **Agent phases.** ORIENT, DECIDE, REFLECT and the persona reviews launched
+  `claude -p` in the project root. It read the project's instruction files and
+  inherited its permission rules (on one instance, `Bash(*)`, `Write` and
+  `Edit`). Every agent LLM call is now sandboxed.
+- **llm_call steps in the act.** The driver forces `sandbox_mode` on them. A
+  step whose provider carries tools (codex, cursor, codex_mcp), or any provider
+  outside claude_code / anthropic / openai / bedrock, is refused before the
+  act. This includes the instance's default provider when the step names
+  none, and the default provider used by `write_section`.
+- **`write_section`.** Its section writer now always calls the LLM sandboxed.
+- **multi_llm_review cursor seat.** It ran `agent -p` (every tool, write and
+  shell included) in the server's working directory. It now runs
+  `agent -p --trust --mode plan` (read-only) in an empty directory made for
+  each call. Cursor reviews therefore see only the artifact.
+
+**An act does not touch what constrains the agent or its operator.**
+- **Protected locations.** A step whose path arguments, at any depth and
+  whatever the tool, reach a protected location is refused before ACT. The
+  protected locations are:
+  - the KairosChain stores (`.kairos`: config, sessions, L1, the instruction
+    mode, the chain, the keys);
+  - `.claude` and `.codex`;
+  - `.mcp.json`, `CLAUDE.md` and `AGENTS.md`;
+  - anything outside the project (`$HOME` and `/` never count as the
+    project).
+- **How paths are judged.** Paths are resolved against the step's own root
+  arguments and against the tools' default roots, so a decoy root cannot move
+  the check. `..` segments, unresolvable paths and dangling symlinks are
+  refused. A symlink is judged by its target.
+- **Recording.** The refusal is recorded on the chain (`agent_act_refused`,
+  with the rule that fired) whether or not the guard is on.
+- **Record-store writers** (`chain_record`, attestation and state commits) are
+  now refused on the act route with the guard off as well. The record judges
+  the act, so the act may not write it.
+- **Configuration writers** (`llm_configure`, `mode_hooks_add` /
+  `mode_hooks_project`, `plugin_project`), `hermes_*` and `multi_llm_review*`
+  are refused on the act route. All of these are also hidden from DECIDE's
+  tool catalog, and DECIDE's norms name the rule.
+- **Instances whose `safety.yml` sets no `safe_root`.** The file tools resolve
+  relative paths inside the stores there, so the act refuses them. The refusal
+  says to set `safe_root`.
+
+**Not covered yet.**
+- `.git/hooks` and `.git/config`, `.cursor*`, `.gemini`,
+  `.github/copilot-instructions.md`, `.envrc` and `.vscode/tasks.json` are not
+  in the protected set.
+- A path-less tool not named above is not stopped (the allow-list will).
+- `agent_execute` remains unregistered.
+- In an operator's own multi_llm_review runs, the codex seat can still read
+  the repository.
+
+## [3.88.1] - 2026-10-06
+
+### Fixed — agent guard: the verdict reaches the record
+
+Found in a guarded trial on 3.88.0. The guard judged correctly, but its
+judgment never reached the record: the chain held only autoexec's "execution
+complete" for an act the guard had failed, progress said `completed`, and the
+FAIL survived only in a mutable session file.
+
+- **The verdict is chain-recorded.** Right after judging, before any halt
+  checkpoint and before any merge, the driver records `kind:
+  agent_guard_verdict`: the verdict, the pinned spec hash, the failed checks,
+  the planned route, and the act's error if it had one.
+- **A verdict the chain does not take stops the loop.** Whatever the verdict,
+  nothing merges and the cycle halts for the operator. The halt reason names
+  the lost verdict and its reason, why the record failed, and whether the act
+  already took effect (in-process) or stays quarantined (confined). Responses
+  and the progress `guard_record` carry `verdict_recorded: false` and
+  `lost_verdict`. On a backend whose chain cannot be appended to (sqlite and
+  postgresql do not declare a ledger path), every guarded cycle now halts
+  this way instead of running unrecorded.
+- **Progress and responses follow the verdict.** A failed verdict is recorded
+  and reported as `failed`, not `completed`; REFLECT is shown the verdict, and
+  the next cycle's executor context says the cycle failed. Manual responses
+  carry `guard` (verdict, failed checks) and `act_error`. The manual risk-resume
+  path reports a guard halt as `guard_halt`, not `ok`. Autonomous responses
+  carry the halt reason and, per cycle, `guard_verdict`, `guard_reason` and
+  `verdict_recorded`; steps set aside for a person are still listed when a
+  cycle halts. A result carrying only an error is no longer reported as
+  `completed`.
+
+Not fixed here: the confined route still cannot run. `agent_execute` is not
+registered by the agent SkillSet, so a plan naming a file tool fails at ACT
+(with the guard on, that FAIL is now recorded), and a file acceptance check
+cannot PASS in this version. Wiring it is separate work.
+
+Also ships `minimum_nomic`'s `bin/run_gm.rb` instance-local changes (a11d103),
+so `system_upgrade` stops reverting them.
+
 ## [3.88.0] - 2026-09-30
 
 ### Added — `multi_llm_review` 0.11.1: an artifact named by path and sha256

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.88.0"
+  VERSION = "3.88.2"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/skillsets/agent/lib/agent/admission.rb

@@ -54,8 +54,208 @@ module KairosMcp
         # route, where the scratch area quarantines it until the verdict.
         LIVE_TREE_WRITE_TOOLS = %w[write_section sc_scaffold plugin_project].freeze
 
+        # What constrains the agent or its operator, and so may not be touched
+        # by an act (read or written) through any path argument of any tool:
+        # the KairosChain stores (the agent's own config and session files,
+        # L1, the instruction mode, the chain), the harness configuration
+        # (.claude: permission rules and hooks that run as the operator;
+        # .codex; .mcp.json) and the instruction files every agent body reads
+        # (CLAUDE.md, AGENTS.md). Checked by destination, not by tool name, so
+        # a tool that was not anticipated is covered by its arguments.
+        PROTECTED_SEGMENTS = %w[.kairos .claude .codex].freeze
+        PROTECTED_BASENAMES = %w[claude.md agents.md .mcp.json].freeze
+
+        # Argument names that carry a filesystem location, matched by word
+        # (split on '_' / '-') so 'profile' or 'output_format' is not a path.
+        # Tokens come from splitting on '_', '-' and camelCase. A token also
+        # matches when it ends in 'dir' or 'path' (workdir, outdir, filepath)
+        # — not 'file', or 'profile' would match.
+        PATH_TOKENS = %w[path paths file files filename filenames dir dirs dirname directory dest
+                         destination source target root workspace src dst cwd folder location].freeze
+        PATH_SUFFIXES = %w[dir path].freeze
+        ROOT_TOKENS = %w[root workspace cwd].freeze
+
+        # Tools an act may not call, with or without the guard: they rewrite
+        # the configuration that governs every later call (llm_configure:
+        # provider, endpoint and which key is sent; the mode-hook tools and
+        # plugin_project: .claude hooks and permission surfaces) without
+        # naming a path, or launch an external agent body (hermes_*).
+        # multi_llm_review is here too: its codex seat runs `codex exec` (read-
+        # only, but able to read files) in the project root, and its cursor
+        # seat may read absolute paths, so a plan-authored artifact could have
+        # a seat read the instance's keys. The driver's own review gate is not
+        # the act route and is unaffected.
+        ACT_CONFIG_WRITERS = %w[llm_configure mode_hooks_add mode_hooks_project plugin_project hermes_*
+                                multi_llm_review*].freeze
+
+        # llm_call providers an act may use: claude_code runs sandboxed (the
+        # driver forces sandbox_mode); the API providers carry no tools. CLI
+        # bodies that carry tools (codex, codex_mcp, cursor) and any provider
+        # not named here are refused.
+        # (openrouter is not listed: without a configured base_url it falls
+        # back to the OpenAI endpoint and would send the OpenRouter key there.)
+        ACT_SAFE_LLM_PROVIDERS = %w[claude_code anthropic openai bedrock].freeze
+
+        # Tools that call llm_call internally with the instance's default
+        # provider (no override possible from the plan).
+        DEFAULT_PROVIDER_LLM_TOOLS = %w[write_section].freeze
+
         module_function
 
+        # Steps of a plan that would touch a protected location or leave the
+        # project, as [{ 'step_id', 'tool_name', 'path' }].
+        #   protected_dirs  absolute protected directories (the stores,
+        #                   <project>/.claude, <project>/.codex)
+        #   roots           every directory a tool may resolve a relative path
+        #                   against
+        #   allowed_roots   where an act may touch anything at all (the
+        #                   project); a path or a root argument resolving
+        #                   outside them is refused, so an explicit
+        #                   workspace_root cannot turn the check into a
+        #                   deny-list over the whole disk
+        # Every argument at any depth whose name is path-like is checked.
+        # Fail-closed throughout: arguments that are not an object, a '..'
+        # segment, an unresolvable path and a dangling symlink are hits.
+        # Comparison ignores case (APFS is case-insensitive by default).
+        def protected_path_violations(task_json, protected_dirs, roots, allowed_roots = nil)
+          protected = Array(protected_dirs).map { |d| safe_canonical(d).downcase }
+          allowed = Array(allowed_roots).compact.map { |d| safe_canonical(d) }
+          steps = task_json.is_a?(Hash) ? task_json['steps'] : nil
+          return [] unless steps.is_a?(Array)
+
+          steps.flat_map do |step|
+            next [{ 'step_id' => nil, 'tool_name' => nil, 'path' => '(malformed step)' }] unless step.is_a?(Hash)
+
+            args = step['tool_arguments']
+            next [] if args.nil?
+            unless args.is_a?(Hash)
+              next [{ 'step_id' => step['step_id'], 'tool_name' => step['tool_name'], 'path' => '(arguments not an object)' }]
+            end
+
+            pairs = path_pairs(args)
+            explicit_roots = pairs.select { |k, _| (key_tokens(k) & ROOT_TOKENS).any? }.map(&:last)
+            # Resolve against the explicit roots AND the tools' default roots: a
+            # root argument in the plan is text the planner writes, while the
+            # tool decides where it actually resolves (some tools ignore the
+            # argument). Judging only at the plan's root would let a decoy
+            # 'workspace_root' move the check away from the real write. On an
+            # instance whose default root is the stores this over-refuses; the
+            # refusal tells the operator to set safe_root.
+            candidate_roots = (explicit_roots + Array(roots)).compact.map(&:to_s).reject(&:empty?)
+            # No root to resolve against means the check cannot be made.
+            next [{ 'step_id' => step['step_id'], 'tool_name' => step['tool_name'], 'path' => '(no root)',
+                    'rule' => 'unresolvable' }] if candidate_roots.empty? && !pairs.empty?
+            pairs.filter_map do |_key, raw|
+              rule = if protected_name?(raw) then 'protected'
+                     elsif raw.split(%r{[/\\]}).include?('..') then 'dotdot'
+                     else candidate_roots.lazy.map { |root| touch_rule(raw, root, protected, allowed) }.find(&:itself)
+                     end
+              { 'step_id' => step['step_id'], 'tool_name' => step['tool_name'], 'path' => raw, 'rule' => rule } if rule
+            end
+          end
+        end
+
+        def key_tokens(key)
+          key.to_s.gsub(/([a-z0-9])([A-Z])/, '\\1_\\2').downcase.split(/[_\-]/)
+        end
+
+        def path_key?(key)
+          key_tokens(key).any? do |t|
+            PATH_TOKENS.include?(t) || PATH_SUFFIXES.any? { |suf| t.end_with?(suf) }
+          end
+        end
+
+        # [key, string] for every path-like key at any depth; an array takes
+        # its key from the parent.
+        def path_pairs(node, key = nil)
+          case node
+          when Hash then node.flat_map { |k, v| path_pairs(v, k) }
+          when Array then node.flat_map { |v| path_pairs(v, key) }
+          when String
+            key && path_key?(key) && !node.strip.empty? ? [[key.to_s, node]] : []
+          else []
+          end
+        end
+
+        # llm_call steps whose provider would launch a tool-carrying body:
+        # [{ 'step_id', 'tool_name', 'path' => '(provider X)', 'rule' }].
+        # default_provider is the instance's configured provider (nil when it
+        # cannot be read, which refuses steps that do not name a safe one).
+        def unsafe_llm_steps(task_json, default_provider)
+          steps = task_json.is_a?(Hash) && task_json['steps'].is_a?(Array) ? task_json['steps'] : []
+          steps.filter_map do |step|
+            next unless step.is_a?(Hash)
+
+            tool = step['tool_name'].to_s
+            next unless tool == 'llm_call' || DEFAULT_PROVIDER_LLM_TOOLS.include?(tool)
+
+            args = step['tool_arguments'].is_a?(Hash) ? step['tool_arguments'] : {}
+            provider = tool == 'llm_call' ? args['provider_override'].to_s : ''
+            provider = default_provider.to_s if provider.empty?
+            next if ACT_SAFE_LLM_PROVIDERS.include?(provider)
+
+            { 'step_id' => step['step_id'], 'tool_name' => tool,
+              'path' => "(provider #{provider.empty? ? 'unknown' : provider})", 'rule' => 'unsafe_provider' }
+          end
+        end
+
+        # A protected segment or file name anywhere in the path refuses it,
+        # whatever root the tool resolves against.
+        def protected_name?(raw)
+          parts = raw.split(%r{[/\\]}).map(&:downcase)
+          parts.any? { |p| PROTECTED_SEGMENTS.include?(p) } || PROTECTED_BASENAMES.include?(parts.last)
+        end
+
+        # True when the path, resolved against root, lands in a protected
+        # directory, lies outside every allowed root, or has a protected name
+        # once symlinks are resolved. Names are checked only below the allowed
+        # root, so a project that itself lives under a protected segment (a
+        # Claude Code worktree under .claude/worktrees) is not refused wholesale.
+        # The rule a path breaks when resolved against root, or nil.
+        # Protected directories compare case-insensitively (fail-closed on
+        # case-insensitive filesystems); containment compares with case kept,
+        # so on a case-sensitive filesystem /srv/project is not inside
+        # /srv/Project. No allowed root at all means nothing is allowed.
+        def touch_rule(path, root, protected, allowed)
+          full = canonical(File.expand_path(path, root))
+          low = full.downcase
+          return 'protected' if protected.any? { |dir| low == dir || low.start_with?("#{dir}/") }
+          return 'outside' if allowed.empty?
+
+          base = allowed.select { |dir| full == dir || full.start_with?("#{dir}/") }.max_by(&:length)
+          return 'outside' unless base
+
+          below = full.delete_prefix(base).delete_prefix('/')
+          !below.empty? && protected_name?(below) ? 'protected' : nil
+        rescue StandardError
+          'unresolvable'
+        end
+
+        def touches?(path, root, protected, allowed)
+          !touch_rule(path, root, protected, allowed).nil?
+        end
+
+        # realpath of the deepest existing ancestor, with the rest appended,
+        # so a symlink inside the workspace that points at a protected
+        # location is seen. A symlink counts as existing even when its target
+        # does not, and its realpath then raises: a dangling link is a hit.
+        def canonical(path)
+          existing = path
+          rest = []
+          until File.exist?(existing) || File.symlink?(existing) || existing == File.dirname(existing)
+            rest.unshift(File.basename(existing))
+            existing = File.dirname(existing)
+          end
+          base = File.exist?(existing) || File.symlink?(existing) ? File.realpath(existing) : existing
+          rest.empty? ? base : File.join(base, *rest)
+        end
+
+        def safe_canonical(path)
+          canonical(File.expand_path(path.to_s))
+        rescue StandardError
+          File.expand_path(path.to_s)
+        end
+
         # Validate a declared layer surface fail-closed: unknown entries are
         # refused, and any attempt to declare the record store is refused with
         # its own message (AGT-5: never declarable).

data/templates/skillsets/agent/lib/agent/cognitive_loop.rb

@@ -160,6 +160,15 @@ module KairosMcp
         # switch provider, compress, disable thinking).
         # Falls back to legacy auth_error-only handling when disabled.
         def call_llm_with_fallback(arguments)
+          # Every agent phase reasons; none acts. The agent's tools run through
+          # this loop's own tool_use handling, under the session's blacklist.
+          # Without sandbox_mode a claude_code provider launches `claude -p`
+          # in the project root, where it reads the project's instruction
+          # files and inherits its permission rules (a project allowing Bash
+          # or Write let a planning call run commands outside every gate).
+          # The retry and fallback paths reuse these arguments, so they are
+          # sandboxed too.
+          arguments = arguments.merge('sandbox_mode' => true)
           llm_result = @caller.invoke_tool('llm_call', arguments,
                                             context: @session.invocation_context)
           parsed = JSON.parse(llm_result.map { |b| b[:text] || b['text'] }.compact.join)

data/templates/skillsets/agent/plugin/SKILL.md

@@ -48,8 +48,15 @@ the agent to write design drafts to `docs/drafts/` or other project paths.
 
 ### MCP Tool Access
 
-All KairosChain MCP tools (`context_save`, `multi_llm_review`, `chain_record`,
-`knowledge_get`, etc.) are available via `invoke_tool` in the Act phase.
+KairosChain MCP tools (`context_save`, `knowledge_get`, etc.) are available via
+`invoke_tool` in the Act phase, except what the act route always refuses:
+record-store writers such as `chain_record` (the record judges the act, so the
+act may not write it); configuration writers (`llm_configure`, `mode_hooks_*`,
+`plugin_project`), `hermes_*` and `multi_llm_review*`; `llm_call` with a provider
+that carries tools (codex, cursor); and any step whose path arguments reach the
+KairosChain stores, `.claude/`, `.codex/`, `.mcp.json`, `CLAUDE.md`, `AGENTS.md`
+or anywhere outside the project. LLM calls made by the agent or its act run
+sandboxed. The act route is still deny-based: do not run the agent unattended.
 
 ## Sub-Agents