@cirvix_ai/agent-control 0.1.3 → 0.2.0

package/src/core/verified.mjs

@@ -0,0 +1,108 @@
+/**
+ * Cirvix Verified & MCP Trust Layer.
+ *
+ * Implements security verification for MCP servers and tools:
+ * - Provenance and publisher tracking
+ * - Tool poisoning / description tampering detection
+ * - Unpinned network egress analysis
+ * - Trust score computation (0-100)
+ * - Verification status: VERIFIED | REVIEW_REQUIRED | SUSPICIOUS | BLOCKED
+ */
+
+export const VERIFICATION_STATUS = {
+  VERIFIED: "VERIFIED",
+  REVIEW_REQUIRED: "REVIEW_REQUIRED",
+  SUSPICIOUS: "SUSPICIOUS",
+  BLOCKED: "BLOCKED",
+};
+
+/**
+ * Scans an MCP server declaration and its tools for security risks and assigns trust score.
+ *
+ * @param {Object} server
+ * @param {string} server.name
+ * @param {string} [server.publisher]
+ * @param {string} [server.version]
+ * @param {Array}  [server.tools]
+ * @param {Array}  [server.destinations]
+ * @returns {Object} Inspection report
+ */
+export function inspectMcpServer({
+  name,
+  publisher = null,
+  version = null,
+  tools = [],
+  destinations = [],
+} = {}) {
+  let trustScore = 70; // Starting baseline for unverified server
+  const findings = [];
+
+  // Publisher trust
+  const knownTrustedPublishers = ["anthropic", "google", "github", "stripe", "aws", "cirvix"];
+  if (publisher && knownTrustedPublishers.includes(publisher.toLowerCase())) {
+    trustScore += 25;
+  } else if (!publisher) {
+    trustScore -= 15;
+    findings.push("Missing publisher provenance metadata");
+  }
+
+  // Network destinations check
+  for (const dest of destinations) {
+    const dLower = String(dest).toLowerCase();
+    if (dLower.includes("169.254.") || dLower.includes("metadata.google")) {
+      trustScore = 0;
+      findings.push(`Dangerous cloud metadata destination declared: ${dest}`);
+      return {
+        name,
+        trustScore: 0,
+        status: VERIFICATION_STATUS.BLOCKED,
+        findings,
+      };
+    }
+  }
+
+  // Tools inspection
+  for (const tool of tools) {
+    const desc = (tool.description ?? "").toLowerCase();
+    const toolName = (tool.name ?? "").toLowerCase();
+
+    // Check for tool poisoning / prompt injection markers in description
+    if (
+      desc.includes("ignore previous instructions") ||
+      desc.includes("system prompt") ||
+      desc.includes("do not tell the user") ||
+      desc.includes("send secrets to")
+    ) {
+      trustScore = 0;
+      findings.push(`Tool poisoning detected in tool '${tool.name}': suspicious prompt injection phrases in description`);
+      return {
+        name,
+        trustScore: 0,
+        status: VERIFICATION_STATUS.BLOCKED,
+        findings,
+      };
+    }
+
+    // Check for excessive wildcard permissions or raw shell execution
+    if (toolName === "bash" || toolName === "exec" || toolName === "eval") {
+      trustScore -= 20;
+      findings.push(`Tool '${tool.name}' exposes raw shell/process execution capability`);
+    }
+  }
+
+  trustScore = Math.max(0, Math.min(100, trustScore));
+
+  let status = VERIFICATION_STATUS.REVIEW_REQUIRED;
+  if (trustScore >= 85) status = VERIFICATION_STATUS.VERIFIED;
+  else if (trustScore < 50) status = VERIFICATION_STATUS.SUSPICIOUS;
+
+  return {
+    name,
+    publisher,
+    version,
+    trustScore,
+    status,
+    findings,
+    scannedAt: new Date().toISOString(),
+  };
+}

package/src/core/windows.mjs

@@ -0,0 +1,270 @@
+/**
+ * Windows first-class platform support for CIRVIX AgentControl.
+ *
+ * Provides cross-platform utilities designed to eliminate POSIX-only
+ * assumptions without bringing in external dependencies:
+ * - PATH and PATHEXT binary resolution (.exe, .cmd, .bat, etc.)
+ * - Global and user-level npm/node binary location discovery
+ * - Argument quoting and escaping for Windows shells
+ * - Process tree termination (preventing orphaned background processes)
+ * - Path canonicalization and case-folding
+ */
+
+import { execFileSync, spawn } from "node:child_process";
+import { accessSync, constants, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { delimiter, dirname, isAbsolute, join, normalize, resolve } from "node:path";
+
+export const IS_WINDOWS = process.platform === "win32";
+
+/**
+ * Standard executable extensions on Windows.
+ */
+export const DEFAULT_PATHEXT = IS_WINDOWS
+  ? (process.env.PATHEXT || ".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC")
+      .split(";")
+      .map((ext) => ext.toLowerCase())
+  : [""];
+
+/**
+ * Normalizes a filesystem path across platforms.
+ * Replaces backslashes with forward slashes for internal consistency
+ * and normalizes drive letters to uppercase.
+ */
+export function normalizeFsPath(inputPath) {
+  if (typeof inputPath !== "string" || !inputPath) return "";
+  let p = inputPath.replace(/\\/g, "/");
+  // Normalize drive letter: 'c:/...' -> 'C:/...'
+  if (/^[a-zA-Z]:\//.test(p)) {
+    p = p.charAt(0).toUpperCase() + p.slice(1);
+  }
+  return p;
+}
+
+/**
+ * Checks if two filesystem paths refer to the same target (case-insensitive on Windows).
+ */
+export function arePathsEqual(pathA, pathB) {
+  const a = normalizeFsPath(resolve(pathA));
+  const b = normalizeFsPath(resolve(pathB));
+  return IS_WINDOWS ? a.toLowerCase() === b.toLowerCase() : a === b;
+}
+
+/**
+ * Checks if a file exists and is executable.
+ */
+function isFileExecutable(filePath) {
+  try {
+    const st = statSync(filePath);
+    if (!st.isFile()) return false;
+    accessSync(filePath, constants.X_OK | constants.R_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Discovers common npm and global tool binary directories.
+ */
+export function getGlobalBinaryDirectories() {
+  const dirs = [];
+  const home = homedir();
+
+  if (IS_WINDOWS) {
+    if (process.env.APPDATA) {
+      dirs.push(join(process.env.APPDATA, "npm"));
+    }
+    if (process.env.LOCALAPPDATA) {
+      dirs.push(join(process.env.LOCALAPPDATA, "Programs"));
+      dirs.push(join(process.env.LOCALAPPDATA, "pnpm"));
+    }
+    if (process.env.ProgramFiles) {
+      dirs.push(join(process.env.ProgramFiles, "nodejs"));
+    }
+    if (process.env["ProgramFiles(x86)"]) {
+      dirs.push(join(process.env["ProgramFiles(x86)"], "nodejs"));
+    }
+    dirs.push(join(home, "AppData", "Roaming", "npm"));
+    dirs.push(join(home, ".cargo", "bin"));
+  } else {
+    dirs.push("/usr/local/bin");
+    dirs.push("/usr/bin");
+    dirs.push(join(home, ".nvm", "versions", "node", process.version, "bin"));
+    dirs.push(join(home, ".local", "bin"));
+    dirs.push(join(home, ".cargo", "bin"));
+  }
+
+  return dirs.filter((d) => {
+    try {
+      return statSync(d).isDirectory();
+    } catch {
+      return false;
+    }
+  });
+}
+
+/**
+ * Resolves an executable command name to an absolute file path.
+ * On Windows, handles PATHEXT extensions (.exe, .cmd, .bat) and npm globals.
+ *
+ * @param {string} command - e.g. "npx", "node", "cirvix", "git"
+ * @param {object} [options]
+ * @param {string} [options.cwd]
+ * @param {string[]} [options.searchPaths]
+ * @returns {string|null} Absolute path or null if not found
+ */
+export function resolveExecutable(command, { cwd = process.cwd(), searchPaths } = {}) {
+  if (typeof command !== "string" || !command) return null;
+
+  const raw = command.trim();
+  const pathext = DEFAULT_PATHEXT;
+
+  // If path is already absolute or explicitly relative (./ or ../)
+  if (isAbsolute(raw) || raw.startsWith("./") || raw.startsWith("../") || (IS_WINDOWS && /^[a-zA-Z]:[\\/]/.test(raw))) {
+    const candidate = resolve(cwd, raw);
+    if (isFileExecutable(candidate)) return candidate;
+    if (IS_WINDOWS) {
+      for (const ext of pathext) {
+        const withExt = candidate + ext;
+        if (isFileExecutable(withExt)) return withExt;
+      }
+    }
+    return null;
+  }
+
+  // Search in PATH and standard directories
+  const pathEnv = (process.env.PATH || "").split(delimiter).filter(Boolean);
+  const allSearchPaths = [
+    cwd,
+    ...(searchPaths ?? []),
+    ...pathEnv,
+    ...getGlobalBinaryDirectories(),
+  ];
+
+  for (const dir of allSearchPaths) {
+    const candidate = join(dir, raw);
+    if (isFileExecutable(candidate)) return candidate;
+
+    if (IS_WINDOWS) {
+      // Check if command already has an extension
+      const hasExt = pathext.some((ext) => raw.toLowerCase().endsWith(ext));
+      if (!hasExt) {
+        for (const ext of pathext) {
+          const withExt = candidate + ext;
+          if (isFileExecutable(withExt)) return withExt;
+        }
+      }
+    }
+  }
+
+  return null;
+}
+
+/**
+ * Prepares process spawn options for Windows to ensure batch scripts (.cmd, .bat)
+ * and executables with spaces run cleanly.
+ *
+ * @param {string} command
+ * @param {string[]} args
+ * @param {import("node:child_process").SpawnOptions} options
+ * @returns {{ command: string, args: string[], options: import("node:child_process").SpawnOptions }}
+ */
+export function prepareSpawn(command, args = [], options = {}) {
+  const resolved = resolveExecutable(command, { cwd: options.cwd ? String(options.cwd) : process.cwd() });
+  const targetCommand = resolved || command;
+
+  if (IS_WINDOWS) {
+    const lower = targetCommand.toLowerCase();
+    const isBatch = lower.endsWith(".cmd") || lower.endsWith(".bat");
+
+    if (isBatch) {
+      const comspec = process.env.ComSpec || "cmd.exe";
+      return {
+        command: comspec,
+        args: ["/d", "/s", "/c", `"${quoteArg(targetCommand)}"`, ...args.map(quoteArg)],
+        options: {
+          ...options,
+          windowsVerbatimArguments: true,
+        },
+      };
+    }
+  }
+
+  return {
+    command: targetCommand,
+    args,
+    options,
+  };
+}
+
+/**
+ * Escapes and quotes an argument for Windows cmd.exe / PowerShell.
+ */
+export function quoteArg(arg) {
+  const s = String(arg ?? "");
+  if (!s) return '""';
+  if (!/[\s"&|<>()^%!=]/.test(s)) return s;
+  return `"${s.replace(/"/g, '\\"')}"`;
+}
+
+/**
+ * Terminate a process and all of its spawned child processes cleanly.
+ * Uses taskkill /T /F on Windows; process group kill or fallback on POSIX.
+ *
+ * @param {import("node:child_process").ChildProcess|number} procOrPid
+ * @param {string} [signal="SIGTERM"]
+ */
+export function killProcessTree(procOrPid, signal = "SIGTERM") {
+  const pid = typeof procOrPid === "number" ? procOrPid : procOrPid?.pid;
+  if (!pid) return;
+
+  if (IS_WINDOWS) {
+    try {
+      if (typeof procOrPid === "object" && typeof procOrPid.kill === "function") {
+        procOrPid.kill();
+      }
+      execFileSync("taskkill.exe", ["/PID", String(pid), "/T", "/F"], {
+        stdio: "ignore",
+        windowsHide: true,
+        timeout: 2000,
+      });
+    } catch {
+      // Process may already have terminated
+    }
+  } else {
+    try {
+      process.kill(-pid, signal);
+    } catch {
+      try {
+        if (typeof procOrPid === "object" && typeof procOrPid.kill === "function") {
+          procOrPid.kill(signal);
+        } else {
+          process.kill(pid, signal);
+        }
+      } catch {}
+    }
+  }
+}
+
+export const isWindows = IS_WINDOWS;
+
+export function getPathext() {
+  return [...DEFAULT_PATHEXT];
+}
+
+export function quoteCmdArg(arg) {
+  return quoteArg(arg);
+}
+
+export function quotePowerShellArg(arg) {
+  const s = String(arg ?? "");
+  if (!s) return "''";
+  if (!/[\s"&|<>()^%!=']/.test(s)) return s;
+  return `'${s.replace(/'/g, "''")}'`;
+}
+
+export function getNamedPipePath(identifier) {
+  const slug = String(identifier).replace(/[^A-Za-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(-64);
+  return `\\\\.\\pipe\\cirvix-${slug || "default"}`;
+}

package/src/index.mjs

@@ -140,4 +140,71 @@ export { scan } from "./commands/scan.mjs";
 export { init, STARTER_POLICY } from "./commands/init.mjs";
 export { status } from "./commands/status.mjs";
 export { demo } from "./commands/demo.mjs";
+export { consoleCmd as console } from "./commands/console.mjs";
+export { onboard } from "./commands/onboard.mjs";
+
+/* Product UI (engine stays presentation-free; these render events) -------- */
+export {
+  THEME_NAMES,
+  THEME_NAMES as THEMES,
+  ROLES,
+  badgeForDecision,
+  colors,
+  roleForDecision,
+  roleForRisk,
+  setTheme,
+  style,
+  themeName,
+} from "./core/theme.mjs";
+export {
+  EVENT,
+  EventBus,
+  attachPipeline,
+  createEvent,
+  initialState,
+  latencyStats,
+  reduce,
+} from "./core/events.mjs";
+export {
+  blockedCard,
+  cirvixRow,
+  explainDecision,
+  frame,
+  header,
+  heldCard,
+  policyCard,
+  rule,
+  spinnerFrame,
+  toolCard,
+  userRow,
+} from "./tui/cards.mjs";
+export { statusBar } from "./tui/status.mjs";
+export { activitySummary, collapsedFeed, activityRow } from "./tui/activity.mjs";
+export { COMMANDS, filterCommands, paletteBox } from "./tui/palette.mjs";
+export { ConsoleApp, parseRequest } from "./tui/app.mjs";
 export { check as policyCheck, explain as policyExplain, list as policyList, loadPolicyFile, test as policyTest } from "./commands/policy.mjs";
+
+/* Adapters & Platform ---------------------------------------------------- */
+export * as adapters from "./adapters/index.mjs";
+export * as windows from "./core/windows.mjs";
+export { ConfigBackupManager, SafeConfigPatcher, parseConfigJson, stripJsonComments } from "./core/config-store.mjs";
+
+/* Platform Transformation Primitives ------------------------------------- */
+export { evaluateIntent, classifyIntent, INTENT_CATEGORIES } from "./core/intent.mjs";
+export { SessionTracker, CHAIN_TYPES } from "./core/session.mjs";
+export { BehavioralBaseline } from "./core/baseline.mjs";
+export { KillSwitchEngine, globalKillSwitch, KILL_SCOPES } from "./core/kill-switch.mjs";
+export { AgentSandbox, SANDBOX_ADAPTERS } from "./core/sandbox.mjs";
+export { ShadowEngine } from "./core/shadow.mjs";
+export { runRedTeamSuite, BUILTIN_ATTACK_PLUGINS, ATTACK_VECTORS } from "./core/redteam/index.mjs";
+export { inspectMcpServer, VERIFICATION_STATUS } from "./core/verified.mjs";
+export {
+  generateAgentKeypair,
+  issueCryptographicPassport,
+  verifyPassportSignature,
+  rotatePassportKeys,
+} from "./core/passport.mjs";
+export {
+  issueActionReceipt,
+  verifyActionReceipt,
+} from "./core/proof.mjs";

package/src/tui/activity.mjs

@@ -0,0 +1,71 @@
+/**
+ * Collapsible activity feed — the fix for the "wall of logs".
+ *
+ * 100 tool calls never dump as 100 lines. They collapse to:
+ *
+ *   ✓ Deployment completed
+ *     14 actions  ├─ 8 allowed  ├─ 4 sanitized  └─ 2 blocked
+ *     [Enter] inspect
+ *
+ * Expanding (Enter / click / `inspect`) shows the per-call rows with the
+ * semantic badge (icon + color + WORD — never icon alone).
+ */
+
+import { style, bold, dim, badgeForDecision, roleForDecision } from "../core/theme.mjs";
+
+export function activitySummary(activity) {
+  const counts = { allow: 0, sanitize: 0, deny: 0, require_approval: 0, audit_only: 0 };
+  for (const e of activity) {
+    const d = e.decision ?? e.raw?.decision ?? "allow";
+    if (d in counts) counts[d]++;
+  }
+  return { total: activity.length, ...counts };
+}
+
+export function collapsedFeed(activity, { expanded = false, maxRows = 8 } = {}) {
+  const sum = activitySummary(activity);
+  if (sum.total === 0) return dim("No activity yet. Ask Cirvix to evaluate something.");
+
+  const head = `${style("✓", "allow")} ${bold(summaryTitle(sum))}\n\n` +
+    `  ${dim(`${sum.total} actions`)}\n` +
+    `  ${dim("├─")} ${sum.allow} allowed\n` +
+    `  ${dim("├─")} ${sum.sanitize} sanitized\n` +
+    `  ${dim("└─")} ${sum.deny + sum.require_approval} blocked/held\n\n` +
+    `  ${dim("[Enter] inspect")}`;
+
+  if (!expanded) return head;
+
+  const rows = activity.slice(-maxRows).map((e) => activityRow(e)).join("\n");
+  const more = sum.total > maxRows ? dim(`  … ${sum.total - maxRows} earlier (collapsed)`) + "\n" : "";
+  return `▼ ${bold("Activity")}\n\n${more}${rows}`;
+}
+
+function summaryTitle(sum) {
+  if (sum.deny > 0) return `Session activity — ${sum.deny} blocked`;
+  if (sum.require_approval > 0) return `Session activity — ${sum.require_approval} held`;
+  return `Session activity — all clear`;
+}
+
+export function activityRow(event) {
+  const d = event.decision ?? event.raw?.decision ?? "allow";
+  const badge = badgeForDecision(d);
+  const role = roleForDecision(d);
+  const when = clock(event.ts);
+  const tool = event.tool ?? event.raw?.tool ?? "—";
+  const target = truncate(event.resource ?? event.raw?.resource ?? "", 36);
+  const suffix = d === "deny" ? style(" → blocked", "block")
+    : d === "sanitize" ? style(" → sanitized", "sanitize")
+    : d === "require_approval" ? style(" → held", "hold")
+    : "";
+  return `  ${dim(when)}  ${style(`${badge.icon} ${tool}`, role)}${target ? dim(`  ${target}`) : ""}${suffix}`;
+}
+
+function clock(ts) {
+  const m = String(ts ?? "").match(/T(\d{2}:\d{2}:\d{2})/);
+  return m ? m[1] : "--:--:--";
+}
+
+function truncate(s, n) {
+  const v = String(s ?? "");
+  return v.length <= n ? v : `…${v.slice(-(n - 1))}`;
+}