@coworker-jp/aidr 0.1.10 → 0.1.18

package/src/env-gate.mjs

@@ -0,0 +1,208 @@
+// Install-environment gate (issue #243).
+//
+// ai-scanner's hook integration targets environments where coworker-sentinel
+// cannot run: cloud coding-agent sandboxes (cloud Claude Code), CI jobs,
+// devcontainers, and other ephemeral machines. The protection layer for a
+// person's own PC is the coworker-sentinel daemon (OS-native installer).
+//
+// Engineers routinely run `npx @coworker-jp/aidr install` on their laptop
+// without reading the docs, then assume the endpoint is protected — leaving a
+// DLP/EDR gap because sentinel was never installed. This module is the
+// poka-yoke: when the environment looks like a personal PC (interactive
+// terminal, zero cloud/CI/remote indicators), `aidr install` stops and points
+// at the sentinel installer instead. `--local` (or AIDR_ALLOW_LOCAL_INSTALL=1)
+// explicitly overrides.
+//
+// Fail-safe direction: any remote indicator, or a non-interactive stdin
+// (= automation / an agent running the command), passes silently — those are
+// exactly the environments ai-scanner is for, and we must never break CI or
+// cloud sandboxes with a prompt they cannot answer.
+
+import fs from "node:fs";
+import { downloadBase } from "./verify.mjs";
+
+// Environment variables that mark a CI system, a cloud dev environment, or a
+// remote shell. Presence of ANY (with a non-falsy value) means "not a personal
+// PC install" and the gate stays open.
+//
+// Measured reference point (cloud Claude Code / agent-run shells): when an AI
+// agent executes the install command, stdin is not a TTY — so even an agent on
+// an unusual host without these vars still passes via the TTY rule. A human
+// typing in a terminal on their own laptop has a TTY and none of these vars.
+const REMOTE_ENV_FLAGS = [
+  // CI systems (most set CI=true; the rest are vendor-specific)
+  "CI",
+  "GITHUB_ACTIONS",
+  "GITLAB_CI",
+  "CIRCLECI",
+  "TRAVIS",
+  "BUILDKITE",
+  "JENKINS_URL",
+  "TEAMCITY_VERSION",
+  "TF_BUILD",
+  "CODEBUILD_BUILD_ID",
+  // Cloud dev environments / hosted sandboxes
+  "CODESPACES",
+  "GITPOD_WORKSPACE_ID",
+  "CLOUD_SHELL",
+  "REPL_ID",
+  // Remote shell: someone SSH'd into this machine, so it is a server (or a
+  // remotely-managed box), not the operator's own desktop session.
+  "SSH_CONNECTION",
+  "SSH_CLIENT",
+  "SSH_TTY",
+  // Kubernetes pod
+  "KUBERNETES_SERVICE_HOST",
+  // systemd-nspawn / podman export `container=`
+  "container",
+];
+
+function envFlagSet(env, name) {
+  const v = env[name];
+  if (v === undefined || v === "") return false;
+  // A handful of tools export CI=false / CI=0 to mean "not CI".
+  if (/^(false|0)$/i.test(String(v).trim())) return false;
+  return true;
+}
+
+function safeExists(p) {
+  try {
+    fs.statSync(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function safeRead(p) {
+  try {
+    return fs.readFileSync(p, "utf8");
+  } catch {
+    return "";
+  }
+}
+
+/**
+ * Collect indicators that this process is running in a cloud / CI / container
+ * / remote environment. Returns human-readable reason strings (empty array =
+ * no remote indicator found).
+ */
+export function collectRemoteIndicators({
+  env = process.env,
+  platform = process.platform,
+  exists = safeExists,
+  read = safeRead,
+} = {}) {
+  const reasons = [];
+  for (const name of REMOTE_ENV_FLAGS) {
+    if (envFlagSet(env, name)) reasons.push(`env ${name} is set`);
+  }
+  if (platform === "linux") {
+    // Container runtimes leave marker files / cgroup names behind.
+    if (exists("/.dockerenv")) reasons.push("/.dockerenv exists (container)");
+    if (exists("/run/.containerenv")) reasons.push("/run/.containerenv exists (container)");
+    const cgroup = read("/proc/1/cgroup");
+    if (/docker|containerd|kubepods|libpod|lxc|buildkit|sandbox/i.test(cgroup)) {
+      reasons.push("/proc/1/cgroup names a container runtime");
+    }
+  }
+  return reasons;
+}
+
+/**
+ * WSL is NOT a remote indicator: a WSL distro lives on the user's own Windows
+ * PC, which should be protected by the sentinel Windows installer. Detecting
+ * it only changes which installer we recommend.
+ */
+export function isWsl({ platform = process.platform, read = safeRead } = {}) {
+  if (platform !== "linux") return false;
+  return /microsoft/i.test(read("/proc/version"));
+}
+
+/** Which sentinel installer platform to recommend for this machine. */
+export function sentinelPlatformFor({
+  platform = process.platform,
+  read = safeRead,
+} = {}) {
+  if (platform === "win32") return "windows";
+  if (platform === "darwin") return "macos";
+  if (isWsl({ platform, read })) return "windows"; // WSL = the user's Windows PC
+  return "linux";
+}
+
+/**
+ * Decide whether `aidr install` should stop because this looks like a
+ * personal PC. Pure decision function — injection points exist for tests.
+ *
+ * Returns { block: boolean, reasons: string[], sentinelPlatform: string }.
+ *  - block=false, reasons=[...]  → remote indicators found (silent pass)
+ *  - block=false, reasons=[]     → non-interactive (silent pass)
+ *  - block=true                  → interactive TTY + zero remote indicators
+ */
+export function evaluateInstallGate({
+  env = process.env,
+  platform = process.platform,
+  // AIDR_TEST_ASSUME_TTY=1 lets non-PTY test harnesses exercise the blocking
+  // branch. It only ever forces the fail-safe (more blocking) direction.
+  tty = process.stdin.isTTY === true || env?.AIDR_TEST_ASSUME_TTY === "1",
+  exists = safeExists,
+  read = safeRead,
+} = {}) {
+  const sentinelPlatform = sentinelPlatformFor({ platform, read });
+  if (envFlagSet(env, "AIDR_ALLOW_LOCAL_INSTALL")) {
+    return { block: false, reasons: ["AIDR_ALLOW_LOCAL_INSTALL is set"], sentinelPlatform };
+  }
+  const reasons = collectRemoteIndicators({ env, platform, exists, read });
+  if (reasons.length > 0) return { block: false, reasons, sentinelPlatform };
+  if (!tty) return { block: false, reasons: [], sentinelPlatform };
+  return { block: true, reasons: [], sentinelPlatform };
+}
+
+const PORTAL_DOWNLOAD_PAGES = {
+  prod: "https://aidr-frontend-prod.vercel.app/ja/download",
+  dev: "https://aidr-frontend-dev.vercel.app/ja/download",
+};
+
+const SENTINEL_INSTALLER_LABELS = {
+  windows: "coworker-sentinel-setup.exe (Windows)",
+  macos: "CoworkerSentinel.dmg (macOS)",
+  linux: "coworker-sentinel.deb (Linux, x86_64; arm64 は /linux-arm64)",
+};
+
+/**
+ * The message printed when the gate blocks. Plain-language (情シス /
+ * non-specialist audience), bilingual, and actionable in one read:
+ * what happened, what to run instead, and how to override.
+ */
+export function formatLocalPcGuidance({ sentinelPlatform, env: targetEnv = "prod" } = {}) {
+  const setupUrl = `${downloadBase(targetEnv)}/setup/${sentinelPlatform}`;
+  const portalUrl = PORTAL_DOWNLOAD_PAGES[targetEnv] || PORTAL_DOWNLOAD_PAGES.prod;
+  const installerLabel = SENTINEL_INSTALLER_LABELS[sentinelPlatform] || sentinelPlatform;
+  return [
+    "────────────────────────────────────────────────────────────",
+    "このマシンは手元の PC (ローカル環境) のようです。インストールを中断しました。",
+    "",
+    "ai-scanner の hook は、クラウドで動く AI コーディングエージェント",
+    "(クラウド版 Claude Code・CI・devcontainer 等) 向けの補助スキャナーです。",
+    "この PC を守るのは coworker-sentinel (常駐の端末保護) です。",
+    "",
+    "This looks like your local PC, so the install was stopped. ai-scanner",
+    "hooks are for cloud / CI coding-agent environments; this machine should",
+    "run coworker-sentinel instead.",
+    "",
+    "  1) この PC の保護: coworker-sentinel をインストール",
+    `     ${installerLabel}`,
+    `     ダウンロード: ${setupUrl}`,
+    `     ポータルの Download ページ (Step 1): ${portalUrl}`,
+    "",
+    "  2) ai-scanner はリポジトリに入れて使います (クラウド側で自動適用):",
+    "     リポジトリ直下で --scope project を付けて実行し、生成された設定",
+    "     (.claude/ 等) をコミットしてください。",
+    "     npx @coworker-jp/aidr install --agent claude --scope project --key ak_xxx",
+    "",
+    "意図的にこの PC へインストールする場合は --local を付けて再実行してください。",
+    "(To install on this PC anyway, re-run with --local.)",
+    "判定理由: 対話ターミナルで実行され、クラウド/CI/リモート環境の指標が見つかりませんでした。",
+    "────────────────────────────────────────────────────────────",
+  ].join("\n");
+}

package/src/red-team.mjs

@@ -0,0 +1,169 @@
+// Red Team ネットワーク脆弱性スキャナを MCP サーバーとして登録する。
+//
+// 従来は Claude Desktop 用の `.mcpb` バンドル (zip) をユーザーが手で展開し、
+// macOS の quarantine 属性を剥がし、バンドル内 manifest.json からアクセスキーを
+// 抜き出して `claude mcp add` に渡す、という 4 段階の手作業だった。`.mcpb` は
+// Claude Desktop の拡張形式であって Claude Code は解釈できないため、Claude Code
+// 側では「Desktop 用の箱を配って中身を自分で取り出させる」形式ミスマッチが
+// 手順の複雑さを生んでいた。
+//
+// ここでは生バイナリを直接取得する。sha256 検証・実行権限付与・quarantine 除去は
+// binary-fetcher の fetchAsset が既に行うため、手作業だった 4 段階が消える。
+// `.mcpb` は Claude Desktop 用の成果物として引き続き配布される。
+
+import fs from "node:fs/promises";
+import path from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+
+import { fetchAsset, detectPlatform } from "./binary-fetcher.mjs";
+import { downloadBase } from "./verify.mjs";
+
+const execFileP = promisify(execFile);
+
+/** MCP サーバー名。`claude mcp remove network-scanner` で消せる。 */
+export const MCP_SERVER_NAME = "network-scanner";
+
+/**
+ * Red Team の生バイナリを取得する。
+ *
+ * verify Lambda の `GET /download/red-team/<platform>` はアクセスキー認証に
+ * 加えて Red Team エンタイトルメント (pro/trial かつ契約シート >= 10) を要求し、
+ * 不適格なら 403 を返す。fetchAsset は非 2xx で throw するため、ここでは
+ * 特別扱いせず呼び出し側にメッセージを見せる。
+ */
+export async function fetchRedTeamBinary(destPath, { env = "prod", accessKey } = {}) {
+  const platform = detectPlatform();
+  const binUrl = `${downloadBase(env)}/red-team/${platform}`;
+  const result = await fetchAsset(binUrl, destPath, { accessKey });
+  return { ...result, platform };
+}
+
+/**
+ * aidr の scope を `claude mcp add` の scope にマップする。
+ *
+ * aidr の `project` を claude の `project` に素直に写さないのは意図的。claude の
+ * `project` scope は `.mcp.json` に書き出す = リポジトリにコミットされる想定の
+ * ファイルであり、そこに MCP の env として渡すアクセスキーが載ると秘密情報が
+ * git 履歴に入る。`local` は同じくプロジェクト単位だが `~/.claude.json` 側に
+ * 保存されるため、コミット対象にならない。
+ */
+function claudeScopeFor(scope) {
+  return scope === "user" ? "user" : "local";
+}
+
+/** `claude` CLI が PATH にあるか。 */
+async function claudeCliAvailable() {
+  try {
+    await execFileP("claude", ["--version"]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * 手作業に落とす場合のコマンドを組み立てる（`claude` が PATH に無いとき、
+ * および --dry-run のときに表示する）。
+ */
+export function buildMcpAddArgs(binPath, accessKey, scope) {
+  return [
+    "mcp",
+    "add",
+    MCP_SERVER_NAME,
+    "-s",
+    claudeScopeFor(scope),
+    "-e",
+    `AI_SCANNER_ACCESS_KEY=${accessKey}`,
+    "--",
+    binPath,
+  ];
+}
+
+/**
+ * Red Team バイナリを取得し、Claude Code に MCP サーバーとして登録する。
+ *
+ * 冪等: `claude mcp add` は同名サーバーが既にあると失敗するため、先に
+ * `claude mcp remove` を試す（存在しなければ無視）。
+ */
+export async function installRedTeam({
+  accessKey,
+  env = "prod",
+  scope = "user",
+  home,
+  dryRun = false,
+  stdout = console.log,
+  stderr = console.error,
+}) {
+  // 既存の install と同じ配置規約: <base>/.claude/bin/ に置く。
+  const binDir = path.join(home, ".claude", "bin");
+  const binName = process.platform === "win32" ? "network-scanner.exe" : "network-scanner";
+  const binPath = path.join(binDir, binName);
+
+  if (dryRun) {
+    stdout(`[dry-run] would download red-team binary -> ${binPath}`);
+    stdout(`[dry-run] would run: claude ${buildMcpAddArgs(binPath, "<key>", scope).join(" ")}`);
+    return { installed: false, dryRun: true, path: binPath };
+  }
+
+  await fs.mkdir(binDir, { recursive: true });
+  const res = await fetchRedTeamBinary(binPath, { env, accessKey });
+  stdout(
+    `binary: ${res.path} (${res.platform}${res.verified ? ", sha256 verified" : ""})`,
+  );
+
+  const args = buildMcpAddArgs(binPath, accessKey, scope);
+
+  if (!(await claudeCliAvailable())) {
+    stderr("`claude` CLI not found on PATH — the binary is installed but not registered.");
+    stderr("Run this once Claude Code is available:");
+    stderr(`  claude ${args.join(" ")}`);
+    return { installed: false, registered: false, path: binPath };
+  }
+
+  // 再実行を許すため、既存エントリがあれば先に外す。未登録なら失敗するので無視。
+  try {
+    await execFileP("claude", ["mcp", "remove", MCP_SERVER_NAME, "-s", claudeScopeFor(scope)]);
+  } catch {
+    // not registered yet — expected on first install
+  }
+
+  await execFileP("claude", args);
+  stdout(`mcp: registered '${MCP_SERVER_NAME}' (scope=${claudeScopeFor(scope)})`);
+
+  return { installed: true, registered: true, path: binPath };
+}
+
+/** Claude Code から MCP 登録を外し、バイナリを消す。 */
+export async function uninstallRedTeam({
+  scope = "user",
+  home,
+  dryRun = false,
+  stdout = console.log,
+}) {
+  const binPath = path.join(
+    home,
+    ".claude",
+    "bin",
+    process.platform === "win32" ? "network-scanner.exe" : "network-scanner",
+  );
+
+  if (dryRun) {
+    stdout(`[dry-run] would run: claude mcp remove ${MCP_SERVER_NAME} -s ${claudeScopeFor(scope)}`);
+    stdout(`[dry-run] would remove ${binPath}`);
+    return { removed: false, dryRun: true };
+  }
+
+  if (await claudeCliAvailable()) {
+    try {
+      await execFileP("claude", ["mcp", "remove", MCP_SERVER_NAME, "-s", claudeScopeFor(scope)]);
+      stdout(`mcp: removed '${MCP_SERVER_NAME}'`);
+    } catch {
+      // already absent
+    }
+  }
+
+  await fs.rm(binPath, { force: true });
+  stdout(`removed ${binPath}`);
+  return { removed: true };
+}