@aitne/daemon 0.1.8 → 0.1.10

package/dist/services/browser-history/automation/cdp-network-interception.d.ts

@@ -0,0 +1,74 @@
+/**
+ * CDP-layer network interception for Instance A workflows.
+ *
+ * MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §8.2 / §8.6.
+ *
+ * Defence-in-depth ring 3 (innermost): the OS sandbox primitive is the
+ * outer ring; Chromium's own renderer sandbox is ring 2; this Playwright
+ * `context.route("**\/*")` handler is the per-workflow positive selector
+ * + global negative selector.
+ *
+ * The handler runs on every outbound request originating from a page
+ * that the workflow's Playwright context creates:
+ *
+ *   1. Global hostname / CIDR denylist (§8.6) — block immediately and
+ *      record the blocked-request URL in the workflow's counter.
+ *   2. Per-workflow allowlist (declared by the workflow's
+ *      `allowlistRegex`) — `route.continue()` on match.
+ *   3. Default — block. Deny-on-unknown.
+ *
+ * Each blocked request is counted per workflow so the supervisor (§9.4)
+ * can pause the automation surface when blocked-counts spike.
+ *
+ * Excluded from the 100% coverage gate — calls into the Playwright
+ * `BrowserContext.route` async path which the test suite cannot exercise
+ * without booting a real Chromium. The pure decision logic in
+ * `egress-denylist.ts` IS covered, which is the safety-critical bit.
+ */
+/** Per-task blocked-request counter. The browser-task runner reads
+ *  this at cleanup time and persists the count onto the parent
+ *  `browser_task` row (BROWSER_TASK_REDESIGN_PLAN.md §14.2). The
+ *  pre-Phase-6 workflow-runner wrote the same list into
+ *  `browser_automation_workflows.blocked_requests`; that audit table
+ *  is retained as a read-only historical store. */
+export interface BlockedRequestRecorder {
+    record(url: string, reason: "denylist" | "not_allowlisted"): void;
+    list(): readonly string[];
+}
+export declare function makeBlockedRequestRecorder(): BlockedRequestRecorder;
+export interface CdpInterceptionOptions {
+    workflowId: string;
+    /**
+     * Per-workflow positive selector. When `null`, no positive
+     * allowlist is enforced — only the denylist gate (hostname +
+     * IP CIDR + DNS-rebind resolve) decides. The browser-task surface
+     * passes `null` here as of the 2026-05-27 open-navigation revision;
+     * the legacy Instance A workflow path may still pass a real regex.
+     */
+    allowlistRegex: RegExp | null;
+    /** Where to record blocked URLs for the audit row. */
+    recorder: BlockedRequestRecorder;
+    /** DNS resolver — injected so tests can stub. Production wires
+     *  `dns.promises.lookup`. */
+    resolveIps?: (hostname: string) => Promise<readonly string[]>;
+    /**
+     * User-managed hostname denylist (compiled regexes). Sourced from
+     * `runtime-settings.browserTaskHostnameDenylist` by the runner /
+     * driver. When omitted, the (empty) module default is used and
+     * the only domain-level gate is whatever the user explicitly added.
+     * The IP CIDR layer (RFC1918 / loopback / cloud-metadata) remains
+     * hardcoded inside `shouldDenyEgress` and is not configurable here.
+     */
+    hostnameDenylist?: ReadonlyArray<RegExp>;
+}
+/**
+ * Install the per-request route handler on the given Playwright
+ * `BrowserContext`. Returns a noop — `context.close()` will unwind the
+ * handler so callers do not need to detach it.
+ *
+ * Typed against `unknown` so this file does not transitively pull
+ * `playwright-core` types into modules that import it for the pure
+ * helpers above; the structural cast happens at the route-install
+ * boundary.
+ */
+export declare function applyCDPInterception(context: unknown, opts: CdpInterceptionOptions): Promise<void>;

package/dist/services/browser-history/automation/cdp-network-interception.js

@@ -0,0 +1,106 @@
+/**
+ * CDP-layer network interception for Instance A workflows.
+ *
+ * MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §8.2 / §8.6.
+ *
+ * Defence-in-depth ring 3 (innermost): the OS sandbox primitive is the
+ * outer ring; Chromium's own renderer sandbox is ring 2; this Playwright
+ * `context.route("**\/*")` handler is the per-workflow positive selector
+ * + global negative selector.
+ *
+ * The handler runs on every outbound request originating from a page
+ * that the workflow's Playwright context creates:
+ *
+ *   1. Global hostname / CIDR denylist (§8.6) — block immediately and
+ *      record the blocked-request URL in the workflow's counter.
+ *   2. Per-workflow allowlist (declared by the workflow's
+ *      `allowlistRegex`) — `route.continue()` on match.
+ *   3. Default — block. Deny-on-unknown.
+ *
+ * Each blocked request is counted per workflow so the supervisor (§9.4)
+ * can pause the automation surface when blocked-counts spike.
+ *
+ * Excluded from the 100% coverage gate — calls into the Playwright
+ * `BrowserContext.route` async path which the test suite cannot exercise
+ * without booting a real Chromium. The pure decision logic in
+ * `egress-denylist.ts` IS covered, which is the safety-critical bit.
+ */
+import { lookup as dnsLookup } from "node:dns/promises";
+import { createLogger } from "../../../logging.js";
+import { matchesHostnameDenylist, shouldDenyEgress, } from "./egress-denylist.js";
+const logger = createLogger("browser-automation-cdp-interception");
+export function makeBlockedRequestRecorder() {
+    const items = [];
+    return {
+        record(url, reason) {
+            // Cap per-workflow to 200 entries — anything beyond that is a
+            // run-away page and the supervisor's compromise-detection signal
+            // (§9.4 "Blocked-request count >100 per workflow → abort") fires
+            // off the counter, not the list itself.
+            if (items.length >= 200)
+                return;
+            items.push(`${reason}:${url}`);
+        },
+        list() {
+            return items;
+        },
+    };
+}
+/**
+ * Install the per-request route handler on the given Playwright
+ * `BrowserContext`. Returns a noop — `context.close()` will unwind the
+ * handler so callers do not need to detach it.
+ *
+ * Typed against `unknown` so this file does not transitively pull
+ * `playwright-core` types into modules that import it for the pure
+ * helpers above; the structural cast happens at the route-install
+ * boundary.
+ */
+export async function applyCDPInterception(context, opts) {
+    const resolveIps = opts.resolveIps
+        ?? (async (hostname) => {
+            const addresses = await dnsLookup(hostname, { all: true });
+            return addresses.map((a) => a.address);
+        });
+    await context.route("**/*", async (route) => {
+        const request = route.request();
+        const url = request.url();
+        let parsed;
+        try {
+            parsed = new URL(url);
+        }
+        catch {
+            opts.recorder.record(url, "denylist");
+            await route.abort("blockedbyclient");
+            return;
+        }
+        // Fast-path hostname denylist BEFORE the async DNS leg — when the
+        // user has curated entries this short-circuits common matches; with
+        // an empty list (default), this is a one-pass no-op.
+        if (matchesHostnameDenylist(parsed.hostname, opts.hostnameDenylist)) {
+            opts.recorder.record(url, "denylist");
+            await route.abort("blockedbyclient");
+            return;
+        }
+        const decision = await shouldDenyEgress(url, {
+            resolveIps,
+            hostnameDenylist: opts.hostnameDenylist,
+        });
+        if (decision.denied) {
+            opts.recorder.record(url, "denylist");
+            await route.abort("blockedbyclient");
+            return;
+        }
+        // 2026-05-27 open-navigation revision: when `allowlistRegex` is null
+        // (the new browser-task default), no positive selector applies and
+        // the request continues if it survived the denylist gate above. The
+        // legacy Instance A workflow path may still pin a real regex.
+        if (opts.allowlistRegex === null || opts.allowlistRegex.test(url)) {
+            await route.continue();
+            return;
+        }
+        opts.recorder.record(url, "not_allowlisted");
+        await route.abort("blockedbyclient");
+    });
+    logger.debug({ workflowId: opts.workflowId }, "CDP interception installed for workflow");
+}

package/dist/services/browser-history/automation/egress-denylist.d.ts

@@ -0,0 +1,167 @@
+/**
+ * Global egress denylist for the browser-task surface.
+ *
+ * Two layers:
+ *
+ *   1. **Hostname denylist (DI-injected, user-managed)** — list of
+ *      suffix-anchored regexes the *caller* supplies. The list is
+ *      sourced from `runtime-settings.browserTaskHostnameDenylist`
+ *      (Dashboard `/settings/browser` exclusion list, default empty).
+ *      No domain is hardcoded here — Aitne ships as a US-targeted
+ *      general-purpose agent and the framework does not embed
+ *      opinions about which third-party brands to block. The owner
+ *      curates the list in Dashboard. The export `HOSTNAME_DENYLIST`
+ *      survives as an empty frozen array for backward-compatible
+ *      imports (tests, callers that haven't yet plumbed the runtime
+ *      list).
+ *
+ *      Historical context: prior revisions of this file pinned ~40
+ *      brand names (paypal/stripe/banks/.gov/.edu/healthcare/JP-banks)
+ *      as a hardcoded "safety floor". That model was removed
+ *      (2026-05-27 — see `feedback_no_jp_special_no_hardcoded_domains`)
+ *      because (a) the JP enumeration leaked an owner-jurisdiction
+ *      assumption into a US-targeted product, (b) the hardcoded list
+ *      made open-ended browser-task requests (e.g. "look up Hitachi
+ *      IR") fail at the registry-check before they hit the denylist,
+ *      and (c) the framework should not opinionate which sites a
+ *      user can read. The `payment-path-blocker` URL-pattern layer
+ *      remains the structural defence against accidental purchases /
+ *      money movement; the per-route allowlist on `browser_task`
+ *      is now permissive by default (no positive selector).
+ *
+ *   2. **IP CIDR denylist (HARDCODED)** — RFC1918 + link-local +
+ *      loopback + multicast + cloud-metadata + IPv6 equivalents. NOT
+ *      domain-level; this is *network infrastructure* protection
+ *      against the agent reaching `169.254.169.254` (AWS instance
+ *      metadata), the user's internal LAN, or the daemon's own
+ *      127.0.0.1 API. The CIDR layer stays hardcoded because removing
+ *      it would expose cloud-instance metadata endpoints + private
+ *      LAN devices — categories whose identity is the IP range itself,
+ *      not a brand name.
+ *
+ * DNS resolution is injected from the caller
+ * (`cdp-network-interception.ts` provides the real `dns.lookup`); this
+ * module never touches the network so it stays unit-testable.
+ */
+/**
+ * Empty by default — the framework no longer hardcodes third-party
+ * domain entries (no payment processors, no banks, no government, no
+ * healthcare, no JP-specific brands). The CDP interception layer reads
+ * the user-curated list from `runtime-settings.browserTaskHostnameDenylist`
+ * and passes it to `matchesHostnameDenylist` / `shouldDenyEgress` at
+ * each call.
+ *
+ * Kept exported as a frozen empty array so legacy imports keep parsing,
+ * the "is-frozen" test invariant still holds, and a future revision
+ * that wants to re-add a single structural entry (e.g. a never-allowed
+ * project-internal hostname) has a clear seam to do so.
+ */
+export declare const HOSTNAME_DENYLIST: ReadonlyArray<RegExp>;
+export declare function compileUserHostnameDenylist(entries: readonly string[]): ReadonlyArray<RegExp>;
+/**
+ * Naïve eTLD+1 extractor — splits on `.` and returns the last two
+ * labels. This misses **public-suffix-list multi-label TLDs**
+ * (`co.uk`, `co.jp`, `com.br`, etc.); for those the hostname denylist
+ * uses an explicit `(?:.*\.)?bk\.mufg\.jp$` form per entry so the
+ * suffix match works regardless. The extractor's purpose is to defang
+ * attacker-controlled SUBDOMAIN prefixes (`evil.paypal.com.attacker.tld`
+ * resolves to `attacker.tld`, missing `paypal.com`) — that defence
+ * holds in both the two-label and the PSL-multi-label cases.
+ *
+ * Trade-off: a fully-correct PSL implementation would pull in ~100 KB
+ * of suffix data. For a hardcoded denylist whose entries each carry
+ * their own suffix anchor, the regex-direct path is simpler and
+ * equivalently safe. Re-evaluate if/when the denylist grows past ~50
+ * entries.
+ */
+export declare function extractEtldPlusOne(hostname: string): string;
+/**
+ * Returns true when ANY entry in the supplied hostname denylist matches
+ * `hostname`. Each compiled regex from `compileUserHostnameDenylist`
+ * already carries the correct anchor (suffix-anchored for bare /
+ * `*.X` patterns; fully `^...$` anchored for general glob patterns) so
+ * the test is a single `re.test(hostname)` per entry.
+ *
+ * Historical note: prior revisions also tested against
+ * `extractEtldPlusOne(hostname)` as belt-and-braces against subdomain-
+ * prefix bypass. That second check is unnecessary now (bare patterns'
+ * `^(?:.*\.)?X$` shape already rejects `evil.X.attacker.tld` because
+ * the hostname must END in X) and was actively HARMFUL for glob
+ * patterns (`tracker*` matched against `analytics.tracker.com` would
+ * false-positive via the `tracker.com` eTLD+1 truncation, even though
+ * the literal hostname starts with `analytics`).
+ *
+ * The `list` parameter is injected by the caller; when omitted, the
+ * module-level (empty) `HOSTNAME_DENYLIST` is used so the function is
+ * still safe to call with no runtime configuration.
+ */
+export declare function matchesHostnameDenylist(hostname: string, list?: ReadonlyArray<RegExp>): boolean;
+/**
+ * MUST-deny CIDRs covering loopback, private (RFC1918), link-local
+ * (incl. cloud metadata `169.254.169.254`), multicast, IPv6 loopback,
+ * IPv6 ULA, IPv6 link-local, and the CGNAT range used by some VPN
+ * carve-outs. Hard-coded so the dashboard cannot widen the surface.
+ *
+ * Cloud-metadata hosts are reachable from the host's network even
+ * inside our OS sandbox (the sandbox primitives carve a network for
+ * Chromium to talk to the open internet but do not block IP-level
+ * routing to RFC1918 / link-local destinations). This list is the
+ * primary defence at the Playwright `context.route` layer.
+ */
+export declare const IP_DENYLIST_CIDRS: ReadonlyArray<string>;
+/**
+ * Parse a dotted-quad string into a 32-bit unsigned integer, or null on
+ * a non-IPv4 input. Strict — rejects octal-prefixed, hex-prefixed, and
+ * `1` (single integer) forms that some shells / curl historically
+ * accept as IP literals.
+ */
+export declare function ipv4ToInt(ip: string): number | null;
+/**
+ * Parse an IPv6 textual address into a 128-bit bigint. Supports `::`
+ * collapsing and embedded-IPv4 form (`::ffff:192.0.2.1`). Returns null
+ * on invalid input.
+ */
+export declare function ipv6ToBigInt(ip: string): bigint | null;
+/**
+ * Test whether `ip` lies within `cidr`. Dispatches to the v4 or v6
+ * arithmetic path based on the CIDR's family. Returns false on any
+ * parse error (defensive — a malformed `ip` should NOT pass the
+ * denylist check by accident).
+ */
+export declare function ipInCidr(ip: string, cidr: string): boolean;
+/**
+ * Returns true when `ip` falls inside any CIDR in `IP_DENYLIST_CIDRS`.
+ * Walks the small fixed list — at ~14 entries the linear scan is faster
+ * than building a trie.
+ */
+export declare function matchesCidrDenylist(ip: string): boolean;
+/**
+ * Pure boolean check used by the CDP route handler: given a URL string,
+ * decide whether it must be blocked.
+ *
+ * Decision order:
+ *   1. Parse the URL — invalid URLs are blocked (defensive — a request
+ *      whose URL we can't parse should not reach the network).
+ *   2. Hostname denylist check (eTLD+1 + suffix-anchored regex array).
+ *   3. If `hostname` is an IP literal (v4 or v6), check it directly
+ *      against the CIDR denylist.
+ *   4. If a `resolveIps` resolver was passed, resolve `hostname` to one
+ *      or more IPs and check each against the CIDR list (catches the
+ *      DNS-rebinding shape — `internal.example.com → 10.0.0.1`).
+ *
+ * The resolver is injected so this module stays test-pure; the wire
+ * caller in `cdp-network-interception.ts` provides
+ * `dns.promises.lookup`.
+ */
+export interface ResolveIps {
+    (hostname: string): Promise<readonly string[]>;
+}
+export declare function shouldDenyEgress(url: string, opts?: {
+    resolveIps?: ResolveIps;
+    hostnameDenylist?: ReadonlyArray<RegExp>;
+}): Promise<{
+    denied: true;
+    reason: "hostname" | "cidr" | "invalid_url";
+} | {
+    denied: false;
+}>;