@cairnkeep/cli 2.20.0 → 2.21.0

package/scripts/verify-security-baseline.mjs

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+
+import assert from "node:assert/strict";
+import { readFileSync, readdirSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { parse } from "yaml";
+
+const root = resolve(fileURLToPath(new URL("..", import.meta.url)));
+const workflowDirectory = join(root, ".github", "workflows");
+const workflowFiles = readdirSync(workflowDirectory).filter((name) => /\.ya?ml$/.test(name)).sort();
+const sources = workflowFiles.map((name) => {
+    const text = readFileSync(join(workflowDirectory, name), "utf8");
+    return { name, text, workflow: parse(text) };
+});
+const ALLOWED_ACTIONS = [
+    /^actions\//,
+    /^github\/codeql-action\//,
+    /^docker\//,
+    /^ossf\/scorecard-action(?:\/|$)/,
+];
+
+function walk(value, visit, path = "workflow") {
+    if (!value || typeof value !== "object") return;
+    if (Array.isArray(value)) {
+        value.forEach((entry, index) => walk(entry, visit, `${path}[${index}]`));
+        return;
+    }
+    for (const [key, child] of Object.entries(value)) {
+        visit(key, child, `${path}.${key}`);
+        walk(child, visit, `${path}.${key}`);
+    }
+}
+
+function validateWorkflow(name, workflow) {
+    assert.ok(workflow && typeof workflow === "object" && !Array.isArray(workflow), `${name} is not a workflow mapping`);
+    const triggers = workflow.on;
+    const triggerNames = typeof triggers === "string" ? [triggers] : Array.isArray(triggers) ? triggers : Object.keys(triggers ?? {});
+    assert.ok(!triggerNames.includes("pull_request_target"), `${name} uses pull_request_target`);
+    walk(workflow, (key, value, path) => {
+        if (key === "permissions" && typeof value === "string") {
+            assert.ok(!["read-all", "write-all"].includes(value), `${name} has broad scalar permissions at ${path}`);
+        }
+        if (key !== "uses") return;
+        assert.equal(typeof value, "string", `${name} has a non-string action reference at ${path}`);
+        if (value.startsWith("./")) return;
+        assert.match(value, /^[^@\s]+@[a-f0-9]{40}$/, `${name} action is not pinned to a full commit at ${path}: ${value}`);
+        const action = value.slice(0, value.lastIndexOf("@"));
+        assert.ok(ALLOWED_ACTIONS.some((allowed) => allowed.test(action)), `${name} action is not on the maintained allowlist at ${path}: ${action}`);
+    });
+}
+
+for (const { name, workflow } of sources) validateWorkflow(name, workflow);
+
+const maliciousFixtures = [
+    "name: bad\non: push\npermissions: write-all\njobs: {}\n",
+    "name: bad\non: pull_request_target\njobs: {}\n",
+    "name: bad\non: push\njobs:\n  test:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: >-\n          actions/checkout@v7\n",
+    "name: bad\non: push\njobs:\n  call:\n    uses: 'owner/repo/.github/workflows/reuse.yml@main'\n",
+    `name: bad\non: push\njobs:\n  test:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: evil/action@${"a".repeat(40)}\n`,
+];
+for (const [index, fixture] of maliciousFixtures.entries()) {
+    assert.throws(() => validateWorkflow(`malicious-${index}.yml`, parse(fixture)), undefined, `malicious workflow fixture ${index} was accepted`);
+}
+
+const security = sources.find(({ name }) => name === "security.yml")?.text ?? "";
+assert.match(security, /github\/codeql-action\/init@[a-f0-9]{40}/);
+assert.match(security, /actions\/dependency-review-action@[a-f0-9]{40}/);
+assert.match(security, /queries:\s*security-extended/);
+const scorecard = sources.find(({ name }) => name === "scorecard.yml")?.text ?? "";
+assert.match(scorecard, /ossf\/scorecard-action@[a-f0-9]{40}/);
+assert.match(scorecard, /publish_results:\s*true/);
+
+const rootPackage = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
+assert.match(rootPackage.scripts["audit:runtime"] ?? "", /npm audit --omit=dev/);
+assert.match(rootPackage.scripts["check:public"] ?? "", /security:baseline/);
+
+console.log(`PASS: ${workflowFiles.length} workflows and ${maliciousFixtures.length} adversarial fixtures enforce parsed YAML, allowlisted full-SHA actions, bounded triggers, and required security controls`);

package/scripts/windows-platform.mjs

@@ -275,6 +275,7 @@ export function bootstrapWindows(root, args) {
   if (!existsSync(modulePath)) atomicWrite(modulePath, launcherModule(), 0o755);
   const powershellPath = join(target, ".ai", "start-harness.ps1");
   if (!existsSync(powershellPath)) atomicWrite(powershellPath, launcherPowerShell(), 0o600);
+  hardenWindowsAcl(join(target, ".ai"));
   if (!options.has("--untracked")) {
     reconcilePlaybookInstructions(target);
   }
@@ -729,12 +730,13 @@ export function powershellCompletion() {
   const harnesses = HARNESS_IDS.map((id) => `'${id}'`).join(",");
   return `Register-ArgumentCompleter -Native -CommandName cairn -ScriptBlock {
   param($wordToComplete, $commandAst, $cursorPosition)
-  $commands = 'bootstrap','setup','memory-server','sync','sync-pi','sync-kimi','doctor','trajectory','artifact','evidence','playbook','capabilities','mcp-tools','pack','proposals','notes','eval','skill','graph','memory','audit-timer','uninstall','completion','version','help'
+  $commands = 'bootstrap','setup','memory-server','sync','sync-pi','sync-kimi','doctor','security','trajectory','artifact','evidence','playbook','capabilities','mcp-tools','pack','proposals','notes','eval','skill','graph','memory','audit-timer','uninstall','completion','version','help'
   $setup = '--git','--harness','--memory','--policy','--yes','--json','init','existing','none',${harnesses},'local'
   $playbook = 'list','status','init','set','enable','disable','reset','check','record','receipts','instructions','doctor','minimal','balanced','strict','must','should','may','off','start','finish','install','remove','context.recall','context.explore','work.plan','verify.tests','review.repository','review.security','docs.update','learning.capture','--project','--json','--enforce','--complexity','--familiarity','--risk','--public-change','--changed','--change-type','--completed','--skipped','--failed','--actor','--actor-kind','--session','--policy','--decision','--event','--action','--outcome','--reason'
   $pack = 'init','lock','validate','install','import-okf','validate-okf','export-okf','list','show','remove','enable','disable','update','skills','approve-skill','revoke-skill','doctor','--repair','--project','--project-id','--json'
   $proposals = 'create','list','show','apply','doctor','--session','--scope','--model','--category','--project','--json'
-  $candidates = if ($commandAst.ToString() -match '^\\s*cairn\\s+setup(?:\\s|$)') { $setup } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+playbook(?:\\s|$)') { $playbook } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+pack(?:\\s|$)') { $pack } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+proposals(?:\\s|$)') { $proposals } else { $commands }
+  $security = 'doctor','--project','--json'
+  $candidates = if ($commandAst.ToString() -match '^\\s*cairn\\s+setup(?:\\s|$)') { $setup } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+playbook(?:\\s|$)') { $playbook } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+pack(?:\\s|$)') { $pack } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+proposals(?:\\s|$)') { $proposals } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+security(?:\\s|$)') { $security } else { $commands }
   $candidates | Where-Object { $_ -like "$wordToComplete*" } | ForEach-Object {
     [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterValue', $_)
   }

package/templates/start-claude.sh.template

@@ -41,10 +41,13 @@ resolve_cairn_root() {
 }
 
 if [[ -f "$ROOT_DIR/.ai/.env" ]]; then
+  local_env_snapshot=$(export -p)
+  readonly local_env_snapshot
   set -a
   # shellcheck disable=SC1091
   . "$ROOT_DIR/.ai/.env"
   set +a
+  eval "$local_env_snapshot"
 fi
 if [[ -f "$ROOT_DIR/.ai/pre-launch.sh" ]]; then
   # shellcheck disable=SC1091

package/templates/start-codex.sh.template

@@ -6,10 +6,13 @@ set -euo pipefail
 ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 
 if [[ -f "$ROOT_DIR/.ai/.env" ]]; then
+  local_env_snapshot=$(export -p)
+  readonly local_env_snapshot
   set -a
   # shellcheck disable=SC1091
   . "$ROOT_DIR/.ai/.env"
   set +a
+  eval "$local_env_snapshot"
 fi
 if [[ -f "$ROOT_DIR/.ai/pre-launch.sh" ]]; then
   # shellcheck disable=SC1091

package/templates/start-kimi.sh.template

@@ -14,10 +14,13 @@ set -euo pipefail
 ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 
 if [[ -f "$ROOT_DIR/.ai/.env" ]]; then
+  local_env_snapshot=$(export -p)
+  readonly local_env_snapshot
   set -a
   # shellcheck disable=SC1091
   . "$ROOT_DIR/.ai/.env"
   set +a
+  eval "$local_env_snapshot"
 fi
 if [[ -f "$ROOT_DIR/.ai/pre-launch.sh" ]]; then
   # shellcheck disable=SC1091

package/templates/start-omp.sh.template

@@ -5,10 +5,13 @@ set -euo pipefail
 ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 
 if [[ -f "$ROOT_DIR/.ai/.env" ]]; then
+  local_env_snapshot=$(export -p)
+  readonly local_env_snapshot
   set -a
   # shellcheck disable=SC1091
   . "$ROOT_DIR/.ai/.env"
   set +a
+  eval "$local_env_snapshot"
 fi
 if [[ -f "$ROOT_DIR/.ai/pre-launch.sh" ]]; then
   # shellcheck disable=SC1091

package/templates/start-opencode.sh.template

@@ -38,10 +38,13 @@ resolve_cairn_root() {
 }
 
 if [[ -f "$ROOT_DIR/.ai/.env" ]]; then
+  local_env_snapshot=$(export -p)
+  readonly local_env_snapshot
   set -a
   # shellcheck disable=SC1091
   . "$ROOT_DIR/.ai/.env"
   set +a
+  eval "$local_env_snapshot"
 fi
 if [[ -f "$ROOT_DIR/.ai/pre-launch.sh" ]]; then
   # shellcheck disable=SC1091

package/templates/start-pi.sh.template

@@ -6,10 +6,13 @@
 set -euo pipefail
 ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 if [[ -f "$ROOT_DIR/.ai/.env" ]]; then
+  local_env_snapshot=$(export -p)
+  readonly local_env_snapshot
   set -a
   # shellcheck disable=SC1091
   . "$ROOT_DIR/.ai/.env"
   set +a
+  eval "$local_env_snapshot"
 fi
 if [[ -f "$ROOT_DIR/.ai/pre-launch.sh" ]]; then
   # shellcheck disable=SC1091

package/templates/start-qwen.sh.template

@@ -7,10 +7,13 @@ set -euo pipefail
 ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 
 if [[ -f "$ROOT_DIR/.ai/.env" ]]; then
+  local_env_snapshot=$(export -p)
+  readonly local_env_snapshot
   set -a
   # shellcheck disable=SC1091
   . "$ROOT_DIR/.ai/.env"
   set +a
+  eval "$local_env_snapshot"
 fi
 if [[ -f "$ROOT_DIR/.ai/pre-launch.sh" ]]; then
   # shellcheck disable=SC1091