@amsterdamdatalabs/adl-agent-control-darwin-arm64 0.1.4

package/packages/agent-hooks/src/rules/impl/advisory-finder.ts

@@ -0,0 +1,62 @@
+/**
+ * Finder-policy advice.
+ *
+ * Ported from `finderAdvice` in deny.mjs:66-84. Non-blocking: the original
+ * only ever computed this when the command was NOT already denied
+ * (decide-render.mjs:32-33 — `blockedReason` returned null first, so a
+ * denied command's advice was never computed at all), and it surfaces on an
+ * otherwise-allowed call as `additionalContext`/`agent_message`.
+ *
+ * `find` itself is deliberately absent from the finder set: it is not
+ * advised against, it is tool.find's hard deny. `walk.mjs` used to just
+ * return `[]` for every read-only consumer and finder name, which is
+ * indistinguishable from "nothing happened" — the original's `finderAdvice`
+ * worked from the raw command line instead, entirely outside the
+ * invocation-classification pipeline. Here shell/invocation.ts's `walk`
+ * carries the name through as `{ kind: 'read-only', name }` (still an
+ * *allow* to every other rule, which only ever checks the kinds it cares
+ * about), so this rule can `match()` it like any other.
+ */
+
+import type { Invocation } from '../shell/invocation.ts'
+import type { Finding, MessageContext, RuleSpec } from '../spec.ts'
+import { noParams } from '../spec.ts'
+import { detailString } from './messages.ts'
+
+const FINDER_ADVICE = [
+  'Finder policy (AGENTS.md `## Finding things`). You ran `%s`; that is allowed, but',
+  'pick the finder by the question being asked -- and verify hits against current',
+  'source, since an empty result means the query found nothing, not that the thing',
+  'does not exist:',
+  '',
+  '  crg          symbols, callers, impact (prebuilt graph, not a text sweep)',
+  '                 crg query callers_of try_claim_turn',
+  '  ast-grep     syntax shapes rather than strings',
+  '                 ast-grep scan --config .code-quality/typescript/sgconfig.yml \\',
+  "                   --filter '^no-eval$' frontend/",
+  '  rg           literal text; honours .gitignore, so no node_modules/ or target/',
+  "                 rg -n 'try_claim_turn' backend/crates",
+  "  search       this repository's canonical docs, plans, and specs",
+  '                 search "how crate boundaries are defined?"',
+].join('\n')
+
+export const advisoryFinder: RuleSpec = {
+  id: 'advisory.finder',
+  category: 'advisory',
+  severity: 'advise',
+  enabledByDefault: true,
+  summary: 'Advise on finder-tool choice for grep/egrep/fgrep/rgrep/ack/ag.',
+  params: noParams,
+  match(inv: Invocation): Finding | null {
+    if (inv.kind !== 'read-only') return null
+    return { ruleId: 'advisory.finder', severity: 'advise', detail: { name: inv.name } }
+  },
+  message(finding: Finding, _ctx: MessageContext) {
+    const text = FINDER_ADVICE.replace('%s', detailString(finding, 'name'))
+    return { user: text, agent: text }
+  },
+  corpus: {
+    deny: [],
+    allow: ["rg -n 'git push' docs/", 'ack -r TODO find', 'rg -c cargo', "rg -n 'fn.*cargo' src/", 'cat README.md | rg cargo'],
+  },
+}

package/packages/agent-hooks/src/rules/impl/agent-secrets-stay-unread.ts

@@ -0,0 +1,173 @@
+/**
+ * Reading or printing vault files or vault env vars.
+ *
+ * Handoff 5, rule 4: deny any shell command, Read/Edit/Bash tool call, or
+ * printenv dump that would expose `~/.config/enact/...`,
+ * `/etc/enact/...`, or any `AGENT_VAULT_*` variable. A read of these files
+ * is what makes a stolen token usable; a printenv dump is what makes a
+ * screenshot exfiltrate one.
+ *
+ * The hard-coded paths (`~/.config/enact/`, `/etc/enact/`) are added to the
+ * runtime `deniedTrees` (engine.ts's `classifyConfigFor`) so `cat`, `less`,
+ * and the other read-only consumers — which return `[]` from the shell
+ * classifier and are otherwise invisible to rules — emit a `denied-path`
+ * invocation the rule can match on. The env-var names
+ * (`AGENT_VAULT_*`) are deliberately NOT in `adl-config.toml`: a security
+ * rule the repo can switch off is one the agent can route around, and the
+ * `~/.config/enact/` root is the same on every machine the fleet ships to.
+ *
+ * `env` and `printenv` with NO arguments print every variable the process
+ * inherited, including `AGENT_VAULT_*`. They are denied unconditionally.
+ * `env -u AGENT_VAULT_VAULT` strips the var before running, so it stays
+ * allowed; the rule only inspects the argument list, not what was unset.
+ * (A bare `env` is also stripped by the shell parser as a wrapper prefix,
+ * so this branch only fires for the explicit `printenv` form.)
+ *
+ * `Bash` tool-calls carry the shell command in `input.command` and are
+ * matched here on the raw text — the engine does not classify tool-call
+ * inputs as shell, and treating a Bash tool call as if it were a single
+ * shell command line keeps the detection consistent with what the agent
+ * actually runs.
+ */
+import type { Invocation } from '../shell/invocation.ts'
+import type { Finding, MessageContext, RuleSpec } from '../spec.ts'
+import { noParams } from '../spec.ts'
+
+const VAULT_ENV_NAMES = ['AGENT_VAULT_VAULT', 'AGENT_VAULT_ADDR', 'AGENT_VAULT_TOKEN'] as const
+
+/**
+ * Path prefixes that mark a `denied-path` invocation as a vault read. Both
+ * spellings of the per-machine form (`~/.config/enact/` and the
+ * `classifyConfigFor`-expanded absolute form) plus the system form
+ * (`/etc/enact/`). The check is `path === prefix || path.startsWith(prefix)`
+ * so a clone whose name merely starts with the vault root (e.g.
+ * `~/.config/enact-old/`) is a different directory and stays usable — same
+ * boundary `fs.canonical-checkout` draws for `~/enact-vps`.
+ */
+// adl roots plus the legacy enact roots (still present until a machine is cut over).
+const VAULT_DENIED_PREFIXES = ['~/.config/adl/', '/etc/adl/', '~/.config/enact/', '/etc/enact/'] as const
+const VAULT_DENIED_SUFFIXES = ['/.config/adl/', '/.config/enact/'] as const
+
+function tokenValue(token: { readonly value: string }): string {
+  return token.value
+}
+
+function isVaultDeniedPath(path: string): boolean {
+  for (const prefix of VAULT_DENIED_PREFIXES) {
+    if (path === prefix.slice(0, -1) || path === prefix || path.startsWith(prefix)) return true
+  }
+  for (const suffix of VAULT_DENIED_SUFFIXES) {
+    if (path.includes(suffix)) return true
+  }
+  return false
+}
+
+function isVaultPath(s: string): boolean {
+  return isVaultDeniedPath(s)
+}
+
+function mentionsVaultEnv(s: string): boolean {
+  for (const name of VAULT_ENV_NAMES) {
+    if (s.includes(name)) return true
+  }
+  return false
+}
+
+function argsContain(parts: readonly { readonly value: string }[], predicate: (s: string) => boolean): boolean {
+  for (const token of parts) if (predicate(tokenValue(token))) return true
+  return false
+}
+
+function readStringField(input: Readonly<Record<string, unknown>>, key: string): string {
+  const value = input[key]
+  return typeof value === 'string' ? value : ''
+}
+
+export const agentSecretsStayUnread: RuleSpec = {
+  id: 'agent.secrets-stay-unread',
+  category: 'tool-call',
+  severity: 'deny',
+  enabledByDefault: true,
+  summary: 'Deny reading vault files or printing AGENT_VAULT_* env vars.',
+  params: noParams,
+  match(inv: Invocation): Finding | null {
+    if (inv.kind === 'denied-path') {
+      return isVaultDeniedPath(inv.path)
+        ? { ruleId: 'agent.secrets-stay-unread', severity: 'deny', detail: { path: inv.path, name: inv.name } }
+        : null
+    }
+    if (inv.kind === 'tool-call') {
+      const filePath = readStringField(inv.input, 'file_path') + readStringField(inv.input, 'notebook_path')
+      const path = readStringField(inv.input, 'path')
+      const command = readStringField(inv.input, 'command')
+      if (isVaultPath(filePath) || isVaultPath(path) || isVaultPath(command) || mentionsVaultEnv(command)) {
+        return { ruleId: 'agent.secrets-stay-unread', severity: 'deny', detail: {} }
+      }
+      return null
+    }
+    if (inv.kind === 'command') {
+      if (inv.name === 'printenv') {
+        // Bare `printenv` dumps every variable the process inherited,
+        // including AGENT_VAULT_*. A name that names a non-vault var
+        // (e.g. `printenv PATH`) prints only that one — safe. A name
+        // that names a vault var (e.g. `printenv AGENT_VAULT_TOKEN`) is
+        // the exfiltration we want to deny.
+        if (inv.args.length === 0 || argsContain(inv.args, mentionsVaultEnv)) {
+          return { ruleId: 'agent.secrets-stay-unread', severity: 'deny', detail: {} }
+        }
+        return null
+      }
+      if (argsContain(inv.args, isVaultPath) || argsContain(inv.args, mentionsVaultEnv)) {
+        return { ruleId: 'agent.secrets-stay-unread', severity: 'deny', detail: {} }
+      }
+    }
+    return null
+  },
+  message(_finding: Finding, ctx: MessageContext) {
+    return {
+      user: 'Blocked reading or printing vault files / AGENT_VAULT_* env vars. These are private to the host; ask the user to read them for you.',
+      agent:
+        'DENIED reading or printing vault files / AGENT_VAULT_* env vars. Anything under ' +
+        '`~/.config/adl/`, `/etc/adl/` or the legacy `~/.config/enact/`, `/etc/enact/` (the per-vault files, the lock file, the daemon ' +
+        'state) and the `AGENT_VAULT_VAULT` / `AGENT_VAULT_ADDR` / `AGENT_VAULT_TOKEN` env vars ' +
+        'stay unread by you. If you need a vault value, ask the user to run the command and paste ' +
+        'the result. A bare `printenv` (and the implicit `env` to a pipe) would print every ' +
+        'inherited variable including the vault ones, so it is denied unconditionally. ' +
+        `Blocked call: ${ctx.snippet}`,
+    }
+  },
+  corpus: {
+    deny: [
+      // shell: file read — ~/.config/enact/ (~/ expands to /Users/tester in fixtures)
+      'cat /Users/tester/.config/enact/vaults/agent-tarun.env',
+      'less /Users/tester/.config/enact/agent-vault.env',
+      'head /Users/tester/.config/enact/x.env',
+      // shell: file read — /etc/enact/
+      'cat /etc/enact/vaults/agent-vivek.env',
+      'cat /etc/enact/agent-vault.env',
+      'tail /etc/enact/x.env',
+      // shell: printenv dumps
+      'printenv',
+      'printenv AGENT_VAULT_TOKEN',
+      'printenv AGENT_VAULT_ADDR',
+      // tool-call: Read on a vault path
+      'Read /etc/enact/agent-vault.env',
+      // tool-call: Bash with a vault path or env reference
+      'Bash cat ~/.config/enact/vaults/agent-tarun.env',
+      'Bash printenv AGENT_VAULT_TOKEN',
+    ],
+    allow: [
+      // The project's own .env file is not a vault file
+      'cat .env',
+      'cat src/config.ts',
+      // env WITHOUT the vault vars set, used to spawn a single command
+      'env -u AGENT_VAULT_VAULT -u AGENT_VAULT_ADDR -u AGENT_VAULT_TOKEN bash -lc "ls"',
+      'env PATH=/usr/bin ls',
+      // printenv of a non-vault variable — single safe var, no leak
+      'printenv PATH',
+      'printenv HOME',
+      // Read on a non-vault file
+      'Read src/main.ts',
+    ],
+  },
+}