@aitne/daemon 0.1.7 → 0.1.9

package/dist/safety/agent-write-tracker.js

@@ -1,6 +1,14 @@
 import { createHash } from "node:crypto";
 import { createLogger } from "../logging.js";
 const logger = createLogger("agent-write-tracker");
+const SHA_PATTERN = /^[0-9a-f]{7,40}$/i;
+/**
+ * Commit-tracking TTL default. Outlives the 5-min `GitWatcher` poll
+ * default at `git-watcher.ts` so a commit made just after a poll cycle
+ * still wins attribution at the next cycle. Constructor lets tests
+ * override.
+ */
+const DEFAULT_COMMIT_TTL_MS = 15 * 60_000;
 /**
  * AgentWriteTracker — short-lived, in-memory record of paths the agent is
  * currently writing via the daemon API. Observers consult it to classify
@@ -34,8 +42,18 @@ const logger = createLogger("agent-write-tracker");
 export class AgentWriteTracker {
     ttlMs;
     recentWrites = new Map();
-    constructor(ttlMs = 30_000) {
+    /**
+     * Parallel commit-tracking map keyed by `<repoPath>::<sha-lower>`. Used by
+     * `GitWatcher` to flip observations of agent-originated commits from
+     * `actor='user'` / `'unknown'` to `actor='agent'` so the hourly_check
+     * pending-floor does not count the daemon's own commits as user
+     * activity (C1).
+     */
+    recentCommits = new Map();
+    commitTtlMs;
+    constructor(ttlMs = 30_000, opts) {
         this.ttlMs = ttlMs;
+        this.commitTtlMs = opts?.commitTtlMs ?? DEFAULT_COMMIT_TTL_MS;
     }
     markWriting(absolutePath, content, opts) {
         const mode = typeof content === "string" ? "content-hash" : "path-only";
@@ -47,6 +65,19 @@ export class AgentWriteTracker {
         logger.debug({ path: absolutePath, mode, ttlMs }, "Write marked for agent attribution");
         this.cleanup();
     }
+    /**
+     * Remove a mark for `absolutePath`, regardless of mode (content-hash or
+     * path-only). Used by writers that mark **before** the visible-write
+     * boundary (C2 fix — `markWriting` must precede `writeFileAtomically` /
+     * `writeFileSync` so FS-watch consumers see a populated tracker the
+     * moment the rename/write completes). If the write throws, the caller
+     * rolls the mark back via `unmark` so a stale mark cannot suppress a
+     * later legitimate user edit. Idempotent — `Map.delete` on an unknown
+     * key is a no-op, so callers can `unmark` unconditionally in a catch.
+     */
+    unmark(absolutePath) {
+        this.recentWrites.delete(absolutePath);
+    }
     isMarked(absolutePath, content) {
         const entry = this.recentWrites.get(absolutePath);
         if (!entry) {
@@ -78,5 +109,53 @@ export class AgentWriteTracker {
     hashContent(content) {
         return createHash("sha256").update(content).digest("hex");
     }
+    // ── Commit attribution (C1) ──────────────────────────────────────────
+    /**
+     * Register a git SHA the daemon just committed in `repoPath`. The next
+     * `GitWatcher` observation of that SHA is flipped from `actor='user'` /
+     * `'unknown'` to `actor='agent'` via `isAgentCommit`, which keeps the
+     * hourly_check pending-floor from counting the daemon's own commits as
+     * user activity (the loop bug described in C1).
+     *
+     * Production callers pass the full 40-char SHA from `git rev-parse HEAD`.
+     * The minimum-length guard (≥7 hex chars) prevents accidental cross-repo
+     * collisions when tests feed abbreviated hashes. Malformed input is a
+     * silent no-op rather than an error — this is best-effort attribution,
+     * never a correctness gate.
+     */
+    markAgentCommit(repoPath, sha, opts) {
+        if (!SHA_PATTERN.test(sha))
+            return;
+        const ttlMs = opts?.ttlMs ?? this.commitTtlMs;
+        this.recentCommits.set(this.commitKey(repoPath, sha), {
+            expiresAt: Date.now() + ttlMs,
+        });
+        logger.debug({ repoPath, sha: sha.slice(0, 8), ttlMs }, "Agent commit marked for attribution");
+        this.cleanupCommits();
+    }
+    isAgentCommit(repoPath, sha) {
+        if (!sha)
+            return false;
+        const key = this.commitKey(repoPath, sha);
+        const entry = this.recentCommits.get(key);
+        if (!entry)
+            return false;
+        if (Date.now() > entry.expiresAt) {
+            this.recentCommits.delete(key);
+            return false;
+        }
+        return true;
+    }
+    commitKey(repoPath, sha) {
+        // Normalise: trailing slash and case differences should hit the same
+        // bucket. `realpathSync` (symlink resolution) is intentionally out of
+        // scope — audit follow-up H12 covers it.
+        return `${repoPath.replace(/\/+$/, "")}::${sha.toLowerCase()}`;
+    }
+    cleanupCommits(now = Date.now()) {
+        for (const [key, entry] of this.recentCommits.entries()) {
+            if (entry.expiresAt <= now)
+                this.recentCommits.delete(key);
+        }
+    }
 }
-//# sourceMappingURL=agent-write-tracker.js.map

package/dist/safety/always-disallowed.d.ts

@@ -36,7 +36,7 @@
  * are matched as shell-command globs, Read/Write/Edit arguments as path
  * globs.
  */
-export declare const ALWAYS_DISALLOWED_TOOLS: readonly ["Bash(rm -rf *)", "Bash(rm -rf /*)", "Bash(rm -rf ~*)", "Bash(rm -rf .*)", "Bash(rm -r *)", "Bash(rm -rf*)", "Bash(rm -rv*)", "Bash(rm -ri*)", "Bash(rm -rd*)", "Bash(rm -rI*)", "Bash(rm -fr*)", "Bash(rm -vr*)", "Bash(rm -ir*)", "Bash(rm -dr*)", "Bash(rm -Ir*)", "Bash(rm -R*)", "Bash(rm -fR*)", "Bash(rm -vR*)", "Bash(rm -iR*)", "Bash(rm -dR*)", "Bash(rm -IR*)", "Bash(rm --recursive*)", "Bash(rm --force --recursive*)", "Bash(rm --recursive --force*)", "Bash(sudo *)", "Bash(doas *)", "Bash(su *)", "Bash(curl * | sh*)", "Bash(curl * | bash*)", "Bash(wget * | sh*)", "Bash(wget * | bash*)", "Bash(bash <(*)*)", "Bash(sh <(*)*)", "Bash(bash<*)", "Bash(sh<*)", "Bash(eval *)", "Bash(source *)", "Bash(security *)", "Bash(secret-tool *)", "Bash(cmdkey *)", "Read(.env)", "Read(.env.*)", "Read(**/.env)", "Read(**/.env.*)", "Read(id_rsa*)", "Read(id_ed25519*)", "Read(~/.ssh/**)", "Read(~/.gnupg/**)", "Read(~/.aws/**)", "Read(~/.config/gcloud/**)", "Read(~/.config/gh/hosts.yml)", "Read(~/.netrc)", "Read(~/Library/Keychains/**)", "Read(~/.local/share/keyrings/**)", "Read(~/.personal-agent/backups/**)", "Read(~/.personal-agent/whatsapp/auth/**)", "Read(~/.personal-agent/secrets/**)", "Write(.env)", "Edit(.env)", "Write(.env.*)", "Edit(.env.*)", "Write(**/.env)", "Edit(**/.env)", "Write(**/.env.*)", "Edit(**/.env.*)", "Write(id_rsa*)", "Edit(id_rsa*)", "Write(id_ed25519*)", "Edit(id_ed25519*)", "Write(~/.ssh/**)", "Edit(~/.ssh/**)", "Write(~/.gnupg/**)", "Edit(~/.gnupg/**)", "Write(~/.aws/**)", "Edit(~/.aws/**)", "Write(~/.config/gcloud/**)", "Edit(~/.config/gcloud/**)", "Write(~/.config/gh/hosts.yml)", "Edit(~/.config/gh/hosts.yml)", "Write(~/.netrc)", "Edit(~/.netrc)", "Write(~/Library/Keychains/**)", "Edit(~/Library/Keychains/**)", "Write(~/.local/share/keyrings/**)", "Edit(~/.local/share/keyrings/**)", "Write(~/.personal-agent/backups/**)", "Edit(~/.personal-agent/backups/**)", "Write(~/.personal-agent/whatsapp/auth/**)", "Edit(~/.personal-agent/whatsapp/auth/**)", "Write(~/.personal-agent/secrets/**)", "Edit(~/.personal-agent/secrets/**)", "CronCreate", "CronList", "CronDelete", "RemoteTrigger", "PushNotification"];
+export declare const ALWAYS_DISALLOWED_TOOLS: readonly ["Bash(rm -rf *)", "Bash(rm -rf /*)", "Bash(rm -rf ~*)", "Bash(rm -rf .*)", "Bash(rm -r *)", "Bash(rm -rf*)", "Bash(rm -rv*)", "Bash(rm -ri*)", "Bash(rm -rd*)", "Bash(rm -rI*)", "Bash(rm -fr*)", "Bash(rm -vr*)", "Bash(rm -ir*)", "Bash(rm -dr*)", "Bash(rm -Ir*)", "Bash(rm -R*)", "Bash(rm -fR*)", "Bash(rm -vR*)", "Bash(rm -iR*)", "Bash(rm -dR*)", "Bash(rm -IR*)", "Bash(rm --recursive*)", "Bash(rm --force --recursive*)", "Bash(rm --recursive --force*)", "Bash(sudo *)", "Bash(doas *)", "Bash(su *)", "Bash(curl * | sh*)", "Bash(curl * | bash*)", "Bash(wget * | sh*)", "Bash(wget * | bash*)", "Bash(bash <(*)*)", "Bash(sh <(*)*)", "Bash(bash<*)", "Bash(sh<*)", "Bash(eval *)", "Bash(source *)", "Bash(security *)", "Bash(secret-tool *)", "Bash(cmdkey *)", "Bash(certutil *)", "Bash(rundll32.exe *)", "Read(.env)", "Read(.env.*)", "Read(**/.env)", "Read(**/.env.*)", "Read(id_rsa*)", "Read(id_ed25519*)", "Read(~/.ssh/**)", "Read(~/.gnupg/**)", "Read(~/.aws/**)", "Read(~/.config/gcloud/**)", "Read(~/.config/gh/hosts.yml)", "Read(~/.netrc)", "Read(~/Library/Keychains/**)", "Read(~/.local/share/keyrings/**)", "Read(~/.personal-agent/backups/**)", "Read(~/.personal-agent/whatsapp/auth/**)", "Read(~/.personal-agent/secrets/**)", "Write(.env)", "Edit(.env)", "Write(.env.*)", "Edit(.env.*)", "Write(**/.env)", "Edit(**/.env)", "Write(**/.env.*)", "Edit(**/.env.*)", "Write(id_rsa*)", "Edit(id_rsa*)", "Write(id_ed25519*)", "Edit(id_ed25519*)", "Write(~/.ssh/**)", "Edit(~/.ssh/**)", "Write(~/.gnupg/**)", "Edit(~/.gnupg/**)", "Write(~/.aws/**)", "Edit(~/.aws/**)", "Write(~/.config/gcloud/**)", "Edit(~/.config/gcloud/**)", "Write(~/.config/gh/hosts.yml)", "Edit(~/.config/gh/hosts.yml)", "Write(~/.netrc)", "Edit(~/.netrc)", "Write(~/Library/Keychains/**)", "Edit(~/Library/Keychains/**)", "Write(~/.local/share/keyrings/**)", "Edit(~/.local/share/keyrings/**)", "Write(~/.personal-agent/backups/**)", "Edit(~/.personal-agent/backups/**)", "Write(~/.personal-agent/whatsapp/auth/**)", "Edit(~/.personal-agent/whatsapp/auth/**)", "Write(~/.personal-agent/secrets/**)", "Edit(~/.personal-agent/secrets/**)", "Bash(sqlite3 *)", "Bash(cp ~/Library/Application Support/Google/Chrome/*)", "Bash(cp ~/Library/Application Support/Chromium/*)", "Bash(cp ~/Library/Application Support/Microsoft Edge/*)", "Bash(cp ~/Library/Application Support/BraveSoftware/*)", "Bash(cp ~/Library/Application Support/Comet/*)", "Bash(cp ~/Library/Application Support/Perplexity Comet/*)", "Bash(cp ~/Library/Application Support/com.openai.atlas/*)", "Bash(cp ~/.config/google-chrome/*)", "Bash(cp ~/.config/chromium/*)", "Bash(cp ~/.config/microsoft-edge/*)", "Bash(cp ~/.config/BraveSoftware/*)", "Bash(cp ~/.config/Comet/*)", "Bash(cp ~/.var/app/com.google.Chrome/*)", "Bash(cp /mnt/c/Users/*)", "Bash(curl file://*)", "Read(~/Library/Application Support/Google/Chrome/**)", "Read(~/Library/Application Support/Chromium/**)", "Read(~/Library/Application Support/Microsoft Edge/**)", "Read(~/Library/Application Support/BraveSoftware/**)", "Read(~/Library/Application Support/Comet/**)", "Read(~/Library/Application Support/Perplexity Comet/**)", "Read(~/Library/Application Support/com.openai.atlas/**)", "Read(~/.config/google-chrome/**)", "Read(~/.config/chromium/**)", "Read(~/.config/microsoft-edge/**)", "Read(~/.config/BraveSoftware/**)", "Read(~/.config/Comet/**)", "Read(~/.var/app/com.google.Chrome/**)", "Read(/mnt/c/Users/**)", "Write(~/Library/Application Support/Google/Chrome/**)", "Edit(~/Library/Application Support/Google/Chrome/**)", "Write(~/Library/Application Support/Chromium/**)", "Edit(~/Library/Application Support/Chromium/**)", "Write(~/Library/Application Support/Microsoft Edge/**)", "Edit(~/Library/Application Support/Microsoft Edge/**)", "Write(~/Library/Application Support/BraveSoftware/**)", "Edit(~/Library/Application Support/BraveSoftware/**)", "Write(~/Library/Application Support/Comet/**)", "Edit(~/Library/Application Support/Comet/**)", "Write(~/Library/Application Support/Perplexity Comet/**)", "Edit(~/Library/Application Support/Perplexity Comet/**)", "Write(~/Library/Application Support/com.openai.atlas/**)", "Edit(~/Library/Application Support/com.openai.atlas/**)", "Write(~/.config/google-chrome/**)", "Edit(~/.config/google-chrome/**)", "Write(~/.config/chromium/**)", "Edit(~/.config/chromium/**)", "Write(~/.config/microsoft-edge/**)", "Edit(~/.config/microsoft-edge/**)", "Write(~/.config/BraveSoftware/**)", "Edit(~/.config/BraveSoftware/**)", "Write(~/.config/Comet/**)", "Edit(~/.config/Comet/**)", "Write(~/.var/app/com.google.Chrome/**)", "Edit(~/.var/app/com.google.Chrome/**)", "Write(/mnt/c/Users/**)", "Edit(/mnt/c/Users/**)", "Bash(cp ~/.personal-agent/chromium-*)", "Bash(mv ~/.personal-agent/chromium-*)", "Bash(tar ~/.personal-agent/chromium-*)", "Bash(zip ~/.personal-agent/chromium-*)", "Bash(rsync ~/.personal-agent/chromium-*)", "Bash(cp $HOME/.personal-agent/chromium-*)", "Bash(mv $HOME/.personal-agent/chromium-*)", "Bash(tar $HOME/.personal-agent/chromium-*)", "Bash(zip $HOME/.personal-agent/chromium-*)", "Bash(rsync $HOME/.personal-agent/chromium-*)", "Read(~/.personal-agent/chromium-sync/**)", "Read(~/.personal-agent/chromium-automation/**)", "Read(~/.personal-agent/chromium-automation-anon/**)", "Read(~/.personal-agent/chromium-automation-auth/**)", "Read(~/.personal-agent/chromium-automation-purchase/**)", "Write(~/.personal-agent/chromium-sync/**)", "Edit(~/.personal-agent/chromium-sync/**)", "Write(~/.personal-agent/chromium-automation/**)", "Edit(~/.personal-agent/chromium-automation/**)", "Write(~/.personal-agent/chromium-automation-anon/**)", "Edit(~/.personal-agent/chromium-automation-anon/**)", "Write(~/.personal-agent/chromium-automation-auth/**)", "Edit(~/.personal-agent/chromium-automation-auth/**)", "Write(~/.personal-agent/chromium-automation-purchase/**)", "Edit(~/.personal-agent/chromium-automation-purchase/**)", "CronCreate", "CronList", "CronDelete", "RemoteTrigger", "PushNotification"];
 /**
  * Structured classification of an attempted command or path against the
  * absolute-block list, used by the §6.3 audit path.
@@ -47,7 +47,7 @@ export declare const ALWAYS_DISALLOWED_TOOLS: readonly ["Bash(rm -rf *)", "Bash(
  * observability, and the SDK-level `disallowedTools` rejection remains
  * the authoritative block regardless of what this classifier says.
  */
-export type AbsoluteBlockCategory = "recursive_delete" | "privilege_escalation" | "pipe_to_shell" | "secret_cli" | "secret_read" | "secret_write";
+export type AbsoluteBlockCategory = "recursive_delete" | "privilege_escalation" | "pipe_to_shell" | "secret_cli" | "secret_read" | "secret_write" | "browser_profile" | "purchase_token_echo";
 export interface AbsoluteBlockMatch {
     category: AbsoluteBlockCategory;
     /** Redacted form of the offending arg — path for Read/Write, first token for Bash. */
@@ -119,6 +119,55 @@ export interface AbsoluteBlockMatch {
 export declare function stripBashHeredocs(cmd: string): string;
 export declare function stripBashStringContent(cmd: string): string;
 export declare function classifyAbsoluteBlock(toolName: string, rawArg: string | undefined): AbsoluteBlockMatch | null;
+/**
+ * Substring scan for shell commands that read a known secret-file
+ * path via a file-reader command. Mirrors `looksLikeBashSecretRead`'s
+ * sibling pattern for browser-profile paths — runs on the
+ * single-quote/heredoc-stripped command and matches case-insensitively
+ * to close the same macOS/Windows FS bypass that `looksLikeSecretPath`
+ * closes for Read/Write/Edit args.
+ *
+ * Detection shape: the command's first executable token is in
+ * `SECRET_READ_BASH_COMMANDS` (`cat` / `less` / `head` / `xxd` / …) AND
+ * the rest of the command contains a recognised secret-file fragment
+ * (`.ssh/`, `~/.aws/`, `.env`-extension, `/library/keychains/`, …).
+ * Skipping the command anchor would over-block on innocent prose like
+ * `echo "see ~/.ssh/config for details"`; pinning the reader keeps the
+ * false-positive surface to commands that actually exfiltrate the file.
+ *
+ * NOT a substitute for the Read-tool glob list — that layer remains
+ * the authoritative block for the Read tool. This helper closes the
+ * Bash-side hole the glob list cannot express.
+ */
+export declare function looksLikeBashSecretRead(cmd: string): boolean;
+/**
+ * Substring scan for shell commands that touch a browser profile
+ * directory. Independent of the prefix-glob matcher — runs on the
+ * stripped command line (single-quoted contents + heredocs already
+ * collapsed by `stripBashStringContent`) and matches case-insensitively.
+ *
+ * Exported so the per-backend tool hook (Claude PreToolUse, Gemini
+ * admin policy translator) can mirror the same coverage. The substring
+ * set is closed: it lists the parent directories every supported
+ * browser writes its profile under, plus the profile-specific
+ * filenames Chromium uses for high-value tokens.
+ */
+export declare function looksLikeBrowserProfileBash(cmd: string): boolean;
+/**
+ * Path-shape sibling of `looksLikeBrowserProfileBash` for the
+ * `Read(...)` / `Write(...)` / `Edit(...)` tool arg. The prefix-glob
+ * layer covers canonical paths; this catches Windows-style paths and
+ * encoded forms that the glob matcher's POSIX-only patterns miss.
+ */
+export declare function looksLikeBrowserProfilePath(raw: string): boolean;
+/**
+ * Convenience wrapper used by per-backend tool hooks. Identical
+ * coverage to `looksLikeBrowserProfileBash` + `looksLikeBrowserProfilePath`
+ * — re-exposed under the name the implementation plan uses
+ * (MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §7.11) so PreToolUse hooks
+ * can import a single function.
+ */
+export declare function classifyChromiumTokenAccess(toolName: string, rawArg: string | undefined): AbsoluteBlockMatch | null;
 /**
  * Return true when `raw` looks like a path to a credential / secret file.
  *
@@ -126,6 +175,47 @@ export declare function classifyAbsoluteBlock(toolName: string, rawArg: string |
  * read-side denylist enforcement) can mirror this layer without
  * duplicating the pattern table — see
  * `docs/design/appendices/cost-reduction-structural.md` §A "Privacy".
+ *
+ * Patterns match **case-insensitively** to close a bypass on case-
+ * insensitive filesystems (macOS default, Windows): an agent that submits
+ * `Read("~/.SSH/id_rsa")` resolves to the real `~/.ssh/id_rsa` on disk
+ * and would otherwise sidestep the absolute-block audit because the
+ * SDK's minimatch glob (`Read(~/.ssh/**)`) is case-sensitive. Mirrors
+ * the `.toLowerCase()`-on-input strategy already used by
+ * `looksLikeBrowserProfilePath`.
  */
 export declare function looksLikeSecretPath(raw: string): boolean;
-//# sourceMappingURL=always-disallowed.d.ts.map
+/**
+ * docs/design/appendices/opencode-backend.md §5.8 — render `ALWAYS_DISALLOWED_TOOLS`
+ * into an OpenCode-flavoured `permission` block.
+ *
+ * Translation rules (V5-corrected):
+ *   - `Bash(<glob>)` → `permission.bash[<glob>] = "deny"`.
+ *   - `Read(<glob>)` → synthesise `permission.bash[<reader> <glob>] = "deny"`
+ *     for each entry in `SECRET_READ_BASH_COMMANDS`. The `read` permission
+ *     key does not exist in opencode 1.14.50 (V5); per-session sessions
+ *     that should have zero read capability set `tools: { read: false }`
+ *     instead — the per-session translator handles that branch.
+ *   - `Edit(<glob>)` / `Write(<glob>)` → **skipped**. opencode's `edit`
+ *     permission is whole-tool (V5), so emitting `edit: "deny"` would
+ *     lock every edit, including the agent's legitimate workdir writes.
+ *     Coverage falls through to bash-glob denies for canonical write
+ *     idioms (`tee`, `cp`, `mv`, `echo > …`) — but those are an
+ *     **accepted gap** in opencode's absolute-block layer, mirroring
+ *     Codex's allow-mode gap (docs/design/09-safety-cost.md §6).
+ *   - Bare tool names like `CronCreate` / `RemoteTrigger` — these are
+ *     Claude-SDK-specific server-side tools that don't exist on
+ *     OpenCode's surface. Silently skipped (not warned) so future SDK
+ *     additions don't pollute opencode's startup logs.
+ *
+ * Always merged into the per-session permission JSON at the config-
+ * builder layer; absolute-block entries take precedence over user-
+ * configured allow/deny (deny order is `request_overrides ⊕ absolute_block`,
+ * with absolute winning).
+ */
+export declare function buildOpencodeAbsoluteBlockPermission(): {
+    permission: {
+        bash: Record<string, "deny">;
+    };
+    warnings: string[];
+};