@event4u/agent-config 9.7.0 → 9.9.0

package/src/scripts/_lib/secret_detector_adversarial.test.ts

@@ -0,0 +1,116 @@
+// Adversarial precision/recall measurement for the secret detector
+// (road-to-feedback-9.8.0-followups Phase 3). Runs the REAL scanText over
+// the committed fixture corpus plus runtime-constructed multiline cases
+// (assembled from parts so nothing key-shaped beyond the existing corpus
+// convention lands in the tree), computes precision / recall / FP-rate, and
+// publishes the rates to internal/reports/secret-scanner-adversarial.json.
+//
+// Hard floor: recall = 100% on positives, FP-rate = 0% on negative controls.
+// A genuine detector miss must NOT be papered over by weakening a fixture —
+// it gets a known_gap entry excluded from the hard assertion and REPORTED.
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { describe, expect, it } from 'vitest';
+
+import { scanText, type SecretFinding } from './secret_detector.js';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const FIXTURES = path.join(HERE, 'fixtures', 'secret-detector');
+const REPO = path.resolve(HERE, '..', '..', '..');
+const REPORT = path.join(REPO, 'internal', 'reports', 'secret-scanner-adversarial.json');
+
+/** Measured, documented gaps — excluded from the hard floor, published. */
+const KNOWN_GAPS: string[] = [];
+
+const isReal = (f: SecretFinding): boolean => f.confidence === 'high' || f.confidence === 'medium';
+
+interface Case { id: string; text: string; expect_hit: boolean }
+
+function corpusCases(): Case[] {
+    const cases: Case[] = [];
+    for (const [file, expectHit] of [['positives.txt', true], ['negatives.txt', false]] as const) {
+        const lines = fs.readFileSync(path.join(FIXTURES, file), 'utf-8').split('\n');
+        lines.forEach((line, i) => {
+            if (line.trim().length === 0 || line.startsWith('#')) return;
+            const value = expectHit ? (line.split('|')[1] ?? line) : line;
+            cases.push({ id: `${file}:${i + 1}`, text: value, expect_hit: expectHit });
+        });
+    }
+    return cases;
+}
+
+/** Multiline / wrapped positives assembled at runtime. */
+function constructedCases(): Case[] {
+    // A fake PEM body: base64-ish filler between real BEGIN/END framing.
+    const pem = [
+        ['-----BEGIN', 'RSA PRIVATE KEY-----'].join(' '),
+        'MIIEpAIBAAKCAQEA7fakebodyfakebodyfakebodyfakebodyfakebody12345678',
+        'q7fakebodyfakebodyfakebodyfakebodyfakebodyfakebodyfakebody901234',
+        ['-----END', 'RSA PRIVATE KEY-----'].join(' '),
+    ].join('\n');
+    // A base64-WRAPPED credential next to a keyword: the wrapped payload is a
+    // fake AWS key; the wrapper alone must still trip entropy+keyword.
+    const wrapped = `api_key = "${Buffer.from('AKIA' + '1234567890ABCDEF').toString('base64')}"`;
+    // .env multiline block (several assignments in one scan call).
+    const envBlock = ['APP_ENV=production', 'DB_PASSWORD=q7Xp2Vr9kLm4Nt8wYz3BdF6h', 'MAIL_FROM=noreply@example.com'].join('\n');
+    return [
+        { id: 'constructed:pem-multiline', text: pem, expect_hit: true },
+        { id: 'constructed:base64-wrapped-key', text: wrapped, expect_hit: true },
+        { id: 'constructed:env-block', text: envBlock, expect_hit: true },
+        // Negative: random base64 with NO credential keyword nearby.
+        { id: 'constructed:naked-base64-no-keyword-short', text: 'blob dGhpcyBpcyBmaWxsZXI=', expect_hit: false },
+    ];
+}
+
+describe('secret detector — adversarial corpus measurement', () => {
+    const cases = [...corpusCases(), ...constructedCases()];
+    const rows = cases.map((c) => {
+        const real = scanText(c.text).filter(isReal);
+        return { ...c, hit: real.length > 0, kinds: [...new Set(real.map((f) => f.kind))] };
+    });
+
+    const positives = rows.filter((r) => r.expect_hit);
+    const negatives = rows.filter((r) => !r.expect_hit);
+    const detected = positives.filter((r) => r.hit);
+    const missed = positives.filter((r) => !r.hit).map((r) => r.id);
+    const falsePositives = negatives.filter((r) => r.hit).map((r) => r.id);
+    const recall = positives.length > 0 ? detected.length / positives.length : 1;
+    const fpRate = negatives.length > 0 ? falsePositives.length / negatives.length : 0;
+    const precision =
+        detected.length + falsePositives.length > 0
+            ? detected.length / (detected.length + falsePositives.length)
+            : 1;
+
+    it('publishes the measured rates', () => {
+        const report = {
+            _doc:
+                'Adversarial fixture measurement of the secret detector (scanText). ' +
+                'Regenerated by src/scripts/_lib/secret_detector_adversarial.test.ts on every run; ' +
+                'hard floor asserted there (recall 100% / FP 0% outside known_gaps).',
+            generated: new Date().toISOString().slice(0, 10),
+            corpus_size: rows.length,
+            positives: positives.length,
+            negatives: negatives.length,
+            detected: detected.length,
+            missed,
+            false_positives: falsePositives,
+            known_gaps: KNOWN_GAPS,
+            precision: +precision.toFixed(3),
+            recall: +recall.toFixed(3),
+            fp_rate: +fpRate.toFixed(3),
+        };
+        fs.mkdirSync(path.dirname(REPORT), { recursive: true });
+        fs.writeFileSync(REPORT, `${JSON.stringify(report, null, 2)}\n`);
+        expect(fs.existsSync(REPORT)).toBe(true);
+    });
+
+    it('recall floor: every positive outside known_gaps is detected', () => {
+        const hardMisses = missed.filter((id) => !KNOWN_GAPS.includes(id));
+        expect(hardMisses, `detector missed: ${hardMisses.join(', ')}`).toHaveLength(0);
+    });
+
+    it('FP floor: no negative control fires high/medium', () => {
+        expect(falsePositives, `false positives: ${falsePositives.join(', ')}`).toHaveLength(0);
+    });
+});

package/src/scripts/_lib/spawn_env.ts

@@ -54,6 +54,13 @@ const DENY_EXACT: ReadonlySet<string> = new Set([
     // attacker-controlled object stores; the GIT_CONFIG* family is handled by
     // prefix below (it is a general arbitrary-config-injection primitive).
     'GIT_ALTERNATE_OBJECT_DIRECTORIES',
+    // git path-redirection: GIT_DIR / GIT_INDEX_FILE / GIT_NAMESPACE point a
+    // child's git at an attacker-controlled repo, index file, or ref namespace
+    // — ordinary git ops then read and write attacker state (low severity,
+    // same family as GIT_ALTERNATE_OBJECT_DIRECTORIES above).
+    'GIT_DIR',
+    'GIT_INDEX_FILE',
+    'GIT_NAMESPACE',
     // resolver hijack: HOSTALIASES remaps hostnames via an attacker file,
     // redirecting any network fetch the child performs (CWE-427-adjacent).
     'HOSTALIASES',

package/src/scripts/_lib/sqlite_guard.ts

@@ -0,0 +1,191 @@
+// Shared `node:sqlite` guard — lazy import, availability probe, FTS5 probe,
+// and `PRAGMA user_version` helpers (road-to-reachable-code-memory Phase 6/7).
+//
+// Extracted from the two telemetry twins (mcp_telemetry_store.ts /
+// mcp_telemetry_query.ts) so every derived SQLite store (telemetry, the
+// memory FTS index, the graph store) shares one guard instead of three
+// copies of the same lazy-import + warning-silencer dance.
+//
+// `node:sqlite` ships from Node 22.5 (experimental on 22.x, stable/silent on
+// >= 23); the package's supported floor is `>=20.11` (package.json
+// `engines`), so every caller MUST treat this module's failure modes as
+// expected, not exceptional — lazy import + graceful fallback, never a hard
+// dependency (ADR-129).
+import { createRequire } from 'node:module';
+import type { DatabaseSync } from 'node:sqlite';
+import type * as NodeSqlite from 'node:sqlite';
+
+/** Thrown by {@link loadSqlite} when `node:sqlite` cannot be imported here. */
+export class SqliteUnavailableError extends Error {
+    constructor(callerName: string, cause: string) {
+        super(
+            `node:sqlite is unavailable in this runtime (${cause}). ` +
+                `${callerName} requires Node with the built-in SQLite module.`,
+        );
+        this.name = 'SqliteUnavailableError';
+    }
+}
+
+// Node 22 flags `node:sqlite` experimental and prints an `ExperimentalWarning:
+// SQLite …` line to stderr on first import (stable / silent on Node >= 23).
+// Drop only that specific warning so stderr stays byte-stable across Node
+// versions (CLI intent tests pin exact stderr bytes). Installed once,
+// narrowly matched — every other `emitWarning` call passes through unchanged.
+let _sqliteWarningSilenced = false;
+function _silenceSqliteExperimentalWarning(): void {
+    if (_sqliteWarningSilenced) return;
+    _sqliteWarningSilenced = true;
+    const orig = process.emitWarning.bind(process);
+    process.emitWarning = ((warning: string | Error, ...rest: unknown[]): void => {
+        const text = typeof warning === 'string' ? warning : (warning?.message ?? '');
+        if (/SQLite is an experimental/i.test(text)) return;
+        (orig as (w: string | Error, ...a: unknown[]) => void)(warning, ...rest);
+    }) as typeof process.emitWarning;
+}
+
+/**
+ * Lazy `node:sqlite` import — keeps the caller module loadable on a runtime
+ * without it. `callerName` (e.g. `"mcp_telemetry_store"`) is folded into the
+ * thrown message so each caller's error text stays distinguishable.
+ *
+ * Throws {@link SqliteUnavailableError} on failure; callers that want a
+ * non-throwing check should use {@link isSqliteAvailable} first.
+ */
+export async function loadSqlite(callerName: string): Promise<typeof NodeSqlite> {
+    _silenceSqliteExperimentalWarning();
+    try {
+        return await import('node:sqlite');
+    } catch (exc) {
+        const message = exc instanceof Error ? exc.message : String(exc);
+        throw new SqliteUnavailableError(callerName, message);
+    }
+}
+
+/** Non-throwing availability probe — true iff `node:sqlite` imports cleanly. */
+export async function isSqliteAvailable(): Promise<boolean> {
+    _silenceSqliteExperimentalWarning();
+    try {
+        await import('node:sqlite');
+        return true;
+    } catch {
+        return false;
+    }
+}
+
+/**
+ * Whether this runtime's `node:sqlite` supports FTS5 — probed via an
+ * in-memory `CREATE VIRTUAL TABLE ... USING fts5` + `MATCH` round-trip
+ * (ADR-129: re-verified live on v25.9.0). Some minimal SQLite builds omit
+ * the FTS5 extension even when `node:sqlite` itself loads, so this is a
+ * separate probe from {@link isSqliteAvailable}.
+ */
+export async function probeFts5(): Promise<boolean> {
+    let sqlite: typeof NodeSqlite;
+    try {
+        sqlite = await loadSqlite('sqlite_guard.probeFts5');
+    } catch {
+        return false;
+    }
+    let conn: DatabaseSync | null = null;
+    try {
+        conn = new sqlite.DatabaseSync(':memory:');
+        conn.exec("CREATE VIRTUAL TABLE _fts5_probe USING fts5(body)");
+        conn.exec("INSERT INTO _fts5_probe(body) VALUES ('probe')");
+        const row = conn.prepare("SELECT body FROM _fts5_probe WHERE _fts5_probe MATCH 'probe'").get();
+        return row !== undefined;
+    } catch {
+        return false;
+    } finally {
+        try {
+            conn?.close();
+        } catch {
+            /* best-effort */
+        }
+    }
+}
+
+// --- Synchronous variants ---------------------------------------------------
+//
+// `node:sqlite`'s `DatabaseSync` API is itself fully synchronous; the async
+// variants above exist only because the two telemetry twins happen to be
+// async CLIs. A caller that must stay synchronous end-to-end (memory_lookup.ts
+// — `retrieve()` is called synchronously all over the codebase and by tests)
+// uses `createRequire` for a sync `require('node:sqlite')` instead of the
+// dynamic `import()`, mirroring the file's own existing `_lazy_tokenizer()`
+// sync-require pattern for `./_lib/token_count.js`.
+let _require: NodeJS.Require | undefined;
+function _syncRequire(): NodeJS.Require {
+    if (_require === undefined) {
+        _require = createRequire(import.meta.url);
+    }
+    return _require;
+}
+
+/** Synchronous `node:sqlite` require — see "Synchronous variants" above. */
+export function loadSqliteSync(callerName: string): typeof NodeSqlite {
+    _silenceSqliteExperimentalWarning();
+    try {
+        return _syncRequire()('node:sqlite') as typeof NodeSqlite;
+    } catch (exc) {
+        const message = exc instanceof Error ? exc.message : String(exc);
+        throw new SqliteUnavailableError(callerName, message);
+    }
+}
+
+/** Non-throwing sync availability probe — true iff `node:sqlite` requires cleanly. */
+export function isSqliteAvailableSync(): boolean {
+    _silenceSqliteExperimentalWarning();
+    try {
+        _syncRequire()('node:sqlite');
+        return true;
+    } catch {
+        return false;
+    }
+}
+
+/** Sync twin of {@link probeFts5} — see "Synchronous variants" above. */
+export function probeFts5Sync(): boolean {
+    let sqlite: typeof NodeSqlite;
+    try {
+        sqlite = loadSqliteSync('sqlite_guard.probeFts5Sync');
+    } catch {
+        return false;
+    }
+    let conn: DatabaseSync | null = null;
+    try {
+        conn = new sqlite.DatabaseSync(':memory:');
+        conn.exec("CREATE VIRTUAL TABLE _fts5_probe USING fts5(body)");
+        conn.exec("INSERT INTO _fts5_probe(body) VALUES ('probe')");
+        const row = conn.prepare("SELECT body FROM _fts5_probe WHERE _fts5_probe MATCH 'probe'").get();
+        return row !== undefined;
+    } catch {
+        return false;
+    } finally {
+        try {
+            conn?.close();
+        } catch {
+            /* best-effort */
+        }
+    }
+}
+
+/** Read `PRAGMA user_version` — 0 on a freshly created (never-stamped) DB. */
+export function readUserVersion(conn: DatabaseSync): number {
+    const row = conn.prepare('PRAGMA user_version').get();
+    const v = row?.['user_version'];
+    if (typeof v === 'bigint') return Number(v);
+    if (typeof v === 'number') return v;
+    return 0;
+}
+
+/**
+ * Stamp `PRAGMA user_version`. SQLite's `PRAGMA` statements take no bind
+ * parameters, so `version` is range-checked (small non-negative 32-bit
+ * integer) before string interpolation.
+ */
+export function stampUserVersion(conn: DatabaseSync, version: number): void {
+    if (!Number.isInteger(version) || version < 0 || version > 2 ** 31 - 1) {
+        throw new RangeError(`stampUserVersion: version out of range: ${version}`);
+    }
+    conn.exec(`PRAGMA user_version = ${version}`);
+}

package/src/scripts/_lib/subagent_spawn.ts

@@ -11,6 +11,8 @@
  * into a subagent — keep the private-data leg narrow.
  */
 
+import * as crypto from 'node:crypto';
+
 export type RoleMode = 'developer' | 'reviewer' | 'tester' | 'po' | 'incident' | 'planner';
 
 const ROLE_MODES: ReadonlySet<string> = new Set<RoleMode>([
@@ -37,6 +39,12 @@ export interface SpawnSelection {
     personas?: string[];
     /** Knowledge slice REFERENCES (ids / paths) — never inline bodies. */
     knowledge_refs?: string[];
+    /**
+     * Hard per-worker token stop-loss (L0b), resolved from the worker's tier
+     * via `worker_budget.budgetForTier`. Null/absent = orchestrator did not
+     * set one (legacy dispatch).
+     */
+    max_tokens_per_worker?: number | null;
 }
 
 export interface SpawnBrief {
@@ -45,6 +53,8 @@ export interface SpawnBrief {
     profile: string | null;
     personas: string[];
     knowledge_refs: string[];
+    /** Per-worker token stop-loss; null = unset (legacy dispatch). */
+    max_tokens_per_worker: number | null;
     warnings: string[];
 }
 
@@ -86,12 +96,55 @@ export function composeSpawnBrief(sel: SpawnSelection): SpawnBrief {
         knowledge_refs = knowledge_refs.slice(0, MAX_KNOWLEDGE_REFS);
     }
 
+    let max_tokens_per_worker: number | null = null;
+    if (sel.max_tokens_per_worker != null) {
+        if (Number.isInteger(sel.max_tokens_per_worker) && sel.max_tokens_per_worker > 0) {
+            max_tokens_per_worker = sel.max_tokens_per_worker;
+        } else {
+            warnings.push(`invalid max_tokens_per_worker '${sel.max_tokens_per_worker}' dropped (positive integer required)`);
+        }
+    }
+
     return {
         task: sel.task,
         role_mode,
         profile: sel.profile ?? null,
         personas,
         knowledge_refs,
+        max_tokens_per_worker,
         warnings,
     };
 }
+
+// ── Prefix-stable payload serialization (road-to-lean-agent-init Phase 4) ──
+
+/**
+ * Serialize a brief into the spawn payload with DETERMINISTIC ordering:
+ * static prefix first (role contract, profile, personas, budget — stable
+ * across dispatches of the same configuration), variable task part last.
+ * No timestamps, no random IDs — the prefix is byte-identical for identical
+ * configurations, which is what provider prompt-caching keys on. The
+ * `cache_hit` audit field records whether the provider actually reused it;
+ * measurement only — no savings claim without provider-response evidence.
+ */
+export function serializeSpawnPayload(brief: SpawnBrief): string {
+    const staticPrefix = JSON.stringify({
+        role_mode: brief.role_mode,
+        profile: brief.profile,
+        personas: brief.personas,
+        max_tokens_per_worker: brief.max_tokens_per_worker,
+    });
+    const variableTail = JSON.stringify({
+        task: brief.task,
+        knowledge_refs: brief.knowledge_refs,
+    });
+    return `${staticPrefix}\n${variableTail}`;
+}
+
+/**
+ * Hex digest of a serialized payload — the `payload_hash` audit field
+ * (never content; 16 hex chars satisfy the audit schema's 8–64 window).
+ */
+export function spawnPayloadHash(payload: string): string {
+    return crypto.createHash('sha256').update(payload, 'utf8').digest('hex').slice(0, 16);
+}