samagotchi 0.128.0 → 0.129.0

data/lib/samagotchi/guardrails/child_boundary.rb

@@ -26,8 +26,11 @@ module Samagotchi
     #     share, from anywhere (SharedGit: config, update-ref, worktree add,
     #     stash clear, tags, another branch's delete).
     # Paths elsewhere in a command (/usr/bin, ~/.gem) don't count, and
-    # read-only commands never ask. Text heuristics: sh -c bodies, scripts
-    # and $(…) aren't looked into.
+    # read-only commands never ask, nor do ones that only write into a tmp
+    # dir (> / >>, cp's destination, tee; Targets#read_only_but_tmp_writes?). Paths resolve under chi's env and the
+    # call's env: (Targets#shell_envs), and an env: that redefines the shell
+    # (BASH_ENV, CDPATH, …) always asks, from its own folder too. Text heuristics: sh
+    # -c bodies, scripts and $(…) aren't looked into.
     class ChildBoundary
       RULE = "child-boundary"
       SOURCE = "core"
@@ -73,26 +76,33 @@ module Samagotchi
       def shell_crosses?(targets, root)
         return true if targets.git_dirs.any? { |dir| dir.is_a?(String) && Outside.outside?(dir, root: root) }
         return :shared if SharedGit.changes?(targets.command, own_branch: @branch.call)
-        return false if targets.read_only?
+        # A redefined shell (BASH_ENV, BASH_FUNC_…) runs what no word says.
+        return true if targets.redefines_shell?
+        return false if targets.read_only? || targets.read_only_but_tmp_writes?(root: root)
         return true if targets.cwd && Outside.outside?(targets.cwd, root: root)
 
-        names_other_checkout?(targets.command, targets.cwd, root)
+        names_other_checkout?(targets, root)
       end
 
-      # Whether a word of +command+ resolves into another checkout of the
-      # repository (and not into root, which may sit inside the main one).
-      def names_other_checkout?(command, cwd, root)
+      # Whether a word of the command resolves into another checkout of the
+      # repository (and not into root, which may sit inside the main one),
+      # under chi's env or the call's env: (Targets#shell_envs).
+      def names_other_checkout?(targets, root)
         real_root = ProtectedPaths.real(root)
         others = [*@worktrees.call, @common_dir.call].compact.map { |dir| ProtectedPaths.real(dir) } - [real_root]
         return false if others.empty?
 
-        walk = ShellPaths::Walk.new(cwd, Dir.home, ENV)
-        ShellLex.simple_commands(ShellLex.lex(command.to_s)).any? do |words|
-          walk.step(words).any? do |_word, path|
-            next false unless path
+        commands = ShellLex.simple_commands(ShellLex.lex(targets.command.to_s))
+        targets.shell_envs.any? do |home, env|
+          walk = ShellPaths::Walk.new(targets.cwd, home, env)
+          commands.any? do |words|
+            walk.step(words).any? do |_word, path|
+              next false unless path
 
-            real = ProtectedPaths.real(path)
-            !ShellPaths.within?(real, real_root) && others.any? { |dir| ShellPaths.within?(real, dir) }
+              ProtectedPaths.reals(path).any? do |real|
+                !ShellPaths.within?(real, real_root) && others.any? { |dir| ShellPaths.within?(real, dir) }
+              end
+            end
           end
         end
       rescue ArgumentError, EncodingError

data/lib/samagotchi/guardrails/outside.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "pathname"
 require "tmpdir"
 require_relative "protected_paths"
 require_relative "../memory_bundle/index_sync"
@@ -16,19 +17,67 @@ module Samagotchi
     #   is itself in that tmp dir (a sandbox there still gets the check
     #   between its siblings).
     # chi's state dir is not special: nothing there is the model's to write.
+    # A path whose landing place resolving can't tell (.resolve: a dangling
+    # symlink, a file with another hard link) is always outside.
     module Outside
       TMP_DIRS = %w[/tmp /var/tmp].freeze
 
       # @param path [String] absolute
       # @param root [String] the session's repo root (or cwd)
       def self.outside?(path, root:)
-        real = ProtectedPaths.real(path)
+        reals = resolve(path) or return true
         session = ProtectedPaths.real(root)
-        return false if within?(real, session)
-        return false if MemoryBundle::IndexSync.memory_scope(path)
-        return false if tmp_roots.any? { |tmp| within?(real, tmp) && !within?(session, tmp) }
+        reals.any? do |real|
+          next false if within?(real, session)
+          next false if MemoryBundle::IndexSync.memory_scope(path)
+          next false if tmp_roots.any? { |tmp| within?(real, tmp) && !within?(session, tmp) }
 
-        true
+          true
+        end
+      end
+
+      # Whether +path+ lands in the session's root every way it resolves
+      # (.resolve: never a dangling symlink, nor a file with another hard
+      # link). A pair turn's test for a path its command may name
+      # (PairCommand), with .tmp_write? for the rest.
+      # @param path [String] absolute
+      # @param root [String] the session's project root
+      def self.inside?(path, root:)
+        reals = resolve(path) or return false
+        session = ProtectedPaths.real(root)
+        reals.all? { |real| within?(real, session) }
+      end
+
+      # Whether a shell command may write +path+ as a tmp file (the child
+      # boundary's tmp writes): it resolves (.resolve, every way) into a tmp
+      # dir the session's root isn't in.
+      # @param path [String] absolute
+      # @param root [String] the session's repo root (or cwd)
+      def self.tmp_write?(path, root:)
+        reals = resolve(path) or return false
+        session = ProtectedPaths.real(root)
+        reals.all? { |real| tmp_roots.any? { |tmp| within?(real, tmp) && !within?(session, tmp) } }
+      end
+
+      # +path+ resolved (ProtectedPaths.reals: the lexical answer and where
+      # the kernel lands, a `..` after a symlinked dir climbing out of its
+      # target), or nil when that doesn't say where a write lands: the path
+      # is or goes through a dangling symlink (a write would create its
+      # target; ProtectedPaths.real follows it, the lexical answer stops at
+      # it, and either way the link's own place doesn't count as where the
+      # file is), or is a file with another hard link (a write would change
+      # that file too). Both outside? and tmp_write? read it, so neither
+      # counts such a path as inside or in tmp.
+      # @param path [String] absolute
+      # @return [Array<String>, nil]
+      def self.resolve(path)
+        reals = ProtectedPaths.reals(path)
+        return nil if reals.any? { |real| Pathname.new(real).ascend.any?(&:symlink?) }
+        return nil if reals.any? { |real| File.file?(real) && File.stat(real).nlink > 1 }
+
+        reals
+      rescue SystemCallError
+        nil
       end
 
       # The tmp dirs that exist, resolved.

data/lib/samagotchi/guardrails/pair_boundary.rb

@@ -24,19 +24,25 @@ module Samagotchi
     #     credential files; project secret files) on every file tool's path,
     #     read or written (read, write, edit, a plugin's targets: paths), and
     #     on what a command does (execute, and any call whose targets carry
-    #     a command: PairCommand, which also refuses chi, background jobs,
-    #     the environment, git settings that run commands and home sweeps);
+    #     a command: PairCommand, which also refuses chi and chi web on a
+    #     loopback name, background and scheduled jobs, the environment and
+    #     credential printers, git settings that run commands, home sweeps
+    #     and links to them, and a program named by a $var or a glob); a
+    #     write or edit of git's hooks (GIT_HOOKS);
     #   - owner-voiced tools (OWNER_VOICED, and any delegate_* tool): what
     #     speaks or acts in the owner's name beyond this turn (a delegate, a
     #     reminder, a note to another session, a background task, a
-    #     forgotten output, the session's loaded tools); and memory_write:
+    #     forgotten output, the session's loaded tools); the tools that read
+    #     the owner's background tasks (OWNER_TASK_READERS); and memory_write:
     #     a memory reaches the owner's later sessions;
     #   - ask_user_question: there is no one on the participant's side to
     #     answer it here; the model asks in its reply instead.
     # And it asks the owner, always (Verdict#fresh_ask: no stored approval
-    # answers it, and the rules can't lower it), before a write, an edit or a
-    # command that writes outside the session's project root (the tmp dirs
-    # aside).
+    # answers it, and the rules can't lower it), before a write or an edit
+    # that may land outside the session's project root, or a command that
+    # may write there (failing closed: PairCommand#outside_writes?); a tmp
+    # dir the project isn't in aside (PairCommand.writable?). No project
+    # (the home folder or above it): every write asks.
     # Everything else goes on to the owner's checks and rules as for the
     # owner's turns.
     class PairBoundary
@@ -45,6 +51,10 @@ module Samagotchi
       OWNER_VOICED = %w[delegate register_reminder cancel_reminder send_note forget_outputs task_create task_stop
                         find_tools].freeze
       OWNER_VOICED_PREFIX = "delegate_"
+      # The background task tools that read the owner's tasks (a pair turn
+      # starts none: task_create is owner-voiced, and its execute is never
+      # handed over).
+      OWNER_TASK_READERS = %w[task_wait task_get task_list].freeze
       ASK_TOOL = "ask_user_question"
       WRITE_TOOLS = %w[write edit].freeze
 
@@ -52,21 +62,46 @@ module Samagotchi
                "only the owner can do."
       SECRET = "a participant's turn can't read or write secrets or chi's own files"
       OWNER_ONLY = "a participant's turn can't use %s: it acts in the owner's name beyond this turn"
+      OWNER_TASKS = "a participant's turn can't use %s: the background tasks are the owner's, and their output with them"
       MEMORY_WRITE = "a participant's turn writes no memories: they reach the owner's later sessions; say in your " \
                      "reply what to remember"
       ASK = "a participant's turn can't ask the user: ask in your reply"
       OUTSIDE_WRITE = "a participant's turn writes outside the session's project"
+      NO_PROJECT = "a participant's turn writes, and this session's folder is the home folder or above it (or none): " \
+                   "there is no project to keep it in"
       CHI = "a participant's turn can't run chi: its commands act in the owner's name (sessions, shares, answers)"
       BACKGROUND = "a participant's turn can't leave a command running in the background: it would outlive the turn"
       ENVIRONMENT = "a participant's turn can't read the environment or the keychain: they hold the owner's secrets"
-      HOME_SWEEP = "a participant's turn can't search or copy a folder that holds secrets or chi's own files"
+      HOME_SWEEP = "a participant's turn can't search, copy or link a folder that holds secrets or chi's own files"
+      LINK = "a participant's turn makes a link: a path through it can lead out of the project, so the owner " \
+             "approves it"
       GIT_CONFIG = "a participant's turn can't change git's global config or set what makes git run a command " \
                    "(core.hooksPath, core.fsmonitor, core.sshCommand, core.pager, core.editor, ! aliases)"
+      GIT_HOOKS = "a participant's turn can't write git's hooks (.git/hooks): git runs them in the owner's name"
+      CHI_WEB = "a participant's turn can't call chi web on this machine: on loopback it answers as the owner " \
+                "(sessions, shares, answers)"
+      VERB = "a participant's turn runs only a program named plainly: no $, $(…) or glob in a command's name"
       UNREADABLE = "a participant's turn runs only commands chi can read: split this command, or write the file " \
                    "with the write tool"
       # A pair turn's execute runs without the environment variables whose
       # names say they hold a secret (Tools::Builtins, PairBoundary.scrubbed_env).
       SECRET_ENV_NAME = /KEY|TOKEN|SECRET|PASS|CREDENTIAL|AUTH/i
+      # chi web's port when config names none (Config's web.port default).
+      DEFAULT_WEB_PORT = 4567
+
+      # The ports chi web may answer on here: the one the running chi web
+      # recorded (Web::Running), config's web.port, and the default. A
+      # Bridge's port needs no entry: it answers only with its secret, in
+      # the worker's bridge.json under chi's state dir (denied).
+      # @return [Array<Integer>]
+      def self.web_ports
+        require_relative "../config"
+        require_relative "../web/running"
+        configured = Config.get("web.port").to_s.to_i
+        [Web::Running.port, (configured if configured.positive?), DEFAULT_WEB_PORT].compact.uniq
+      rescue StandardError, LoadError
+        [DEFAULT_WEB_PORT]
+      end
 
       # The unsets a pair turn's execute adds to its environment: every
       # variable of +env+ whose name SECRET_ENV_NAME matches.
@@ -92,14 +127,14 @@ module Samagotchi
       # @param home [#call] → String, nil
       # @param root [#call] → String, nil: the session's project root (the
       #   work tree top of its folder); a write outside it asks the owner
-      #   (none: every write asks)
-      # @param tmp_roots [#call] → Array<String>: where a write neither asks
-      #   nor is denied (PairCommand.tmp_roots)
+      #   (none, or the home folder or above it: every write asks)
+      # @param web_ports [#call] → Array<Integer>: chi web's ports here
+      #   (.web_ports); a command naming one on a loopback name is denied
       def initialize(author:, root: -> {}, denied_dirs: -> { ReviewPaths.chi_dirs }, home: -> { Dir.home },
-                     tmp_roots: -> { PairCommand.tmp_roots })
+                     web_ports: -> { PairBoundary.web_ports })
+        @web_ports = web_ports
         @author = author
         @root = root
-        @tmp_roots = tmp_roots
         @denied_dirs = denied_dirs
         @home = home
       end
@@ -112,8 +147,8 @@ module Samagotchi
           return verdict.deny!(reason, rule: RULE, source: SOURCE, decided_by: "core", advice: ADVICE)
         end
 
-        if outside_write?(verdict)
-          verdict.ask!(OUTSIDE_WRITE, scopes: %w[once], rule: RULE, source: SOURCE, decided_by: "core")
+        if (reason = ask_reason(verdict))
+          verdict.ask!(reason, scopes: %w[once], rule: RULE, source: SOURCE, decided_by: "core")
           verdict.fresh_ask = true
         end
         verdict
@@ -126,6 +161,7 @@ module Samagotchi
         tool = call[:name].to_s
         return ASK if tool == ASK_TOOL
         return format(OWNER_ONLY, tool) if OWNER_VOICED.include?(tool) || tool.start_with?(OWNER_VOICED_PREFIX)
+        return format(OWNER_TASKS, tool) if OWNER_TASK_READERS.include?(tool)
         return MEMORY_WRITE if tool == "memory_write"
 
         targets = verdict.targets
@@ -133,37 +169,53 @@ module Samagotchi
 
         paths = denylist
         return SECRET if paths.secret_refusal(targets.paths.compact)
+        return GIT_HOOKS if WRITE_TOOLS.include?(tool) && targets.paths.compact.any? { |path| PairCommand.git_hook?(path) }
         return command(targets, paths).refusal if targets.command
 
         nil
       end
 
-      # A write or edit whose path is outside the project root (as given or
-      # as it resolves), or a command that writes there (PairCommand); the
-      # tmp dirs aside.
+      # Why the owner is asked (fresh, once): a command that makes a link
+      # (LINK), a write that may land outside the project (OUTSIDE_WRITE, or
+      # NO_PROJECT without one); nil when nothing asks.
+      def ask_reason(verdict)
+        targets = verdict.targets
+        return LINK if targets&.command && command(targets, nil).links?
+        return nil unless outside_write?(verdict)
+
+        project_root ? OUTSIDE_WRITE : NO_PROJECT
+      end
+
+      # A write or edit whose path may land outside the project root, or a
+      # command that may write there (PairCommand#outside_writes?); a tmp
+      # dir the project isn't in aside (PairCommand.writable?).
       def outside_write?(verdict)
         targets = verdict.targets
         return false unless targets
         return command(targets, nil).outside_writes? if targets.command
         return false unless WRITE_TOOLS.include?(verdict.call&.dig(:name).to_s)
 
-        paths = targets.paths.to_a.compact
-        root = @root.call.to_s
-        paths.any? do |path|
-          real = ProtectedPaths.real(path)
-          next false if @tmp_roots.call.any? { |tmp| ShellPaths.within?(real, tmp) }
-
-          root.empty? || !ShellPaths.within?(real, ProtectedPaths.real(root))
+        targets.paths.to_a.compact.any? do |path|
+          !PairCommand.writable?(File.expand_path(path), root: project_root, cwd: targets.cwd)
         end
       end
 
       def command(targets, paths)
         @command = nil unless @command&.first == targets
-        @command ||= [targets, PairCommand.new(targets.command, cwd: targets.cwd, home: home, root: @root.call,
-                                                                paths: paths || denylist, tmp_roots: @tmp_roots.call)]
+        @command ||= [targets, PairCommand.new(targets.command, cwd: targets.cwd, home: home, root: project_root,
+                                                                paths: paths || denylist, web: web_text)]
         @command.last
       end
 
+      # The session's project root; nil without one, or when it is the home
+      # folder or above it (ReviewPaths.home_root?): then every write asks.
+      def project_root
+        root = @root.call.to_s
+        root.empty? || ReviewPaths.home_root?(root, home) ? nil : root
+      end
+
+      def web_text = PairCommand.web_text(@web_ports.call, hostnames: PairCommand.hostnames)
+
       def denylist = ReviewPaths.new(root: nil, denied_dirs: @denied_dirs.call, home: @home.call)
 
       def home = @home.call.to_s