@forwardimpact/outpost 3.4.0 → 3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forwardimpact/outpost",
-  "version": "3.4.0",
+  "version": "3.5.0",
   "description": "Personal operations center — context from email, calendar, and knowledge assembled so preparation is continuous, not a morning scramble.",
   "homepage": "https://www.forwardimpact.team",
   "repository": {
@@ -45,9 +45,7 @@
   "scripts": {
     "start": "bun ./bin/fit-outpost.js",
     "status": "bun ./bin/fit-outpost.js status",
-    "build": "bun pkg/build.js",
-    "build:app": "bun pkg/build.js --app",
-    "build:pkg": "bun pkg/build.js --pkg"
+    "build": "bun pkg/build.js"
   },
   "dependencies": {
     "@forwardimpact/libcli": "^0.1.0",

package/src/agent-path.js

@@ -0,0 +1,42 @@
+/**
+ * agent-path — validate a config-supplied agent name before using it as a
+ * filesystem path component.
+ *
+ * The agent-state writer maps an agent name to a per-agent state filename.
+ * A name carrying `/` or `..` segments would let a rewritten `scheduler.json`
+ * direct writes outside `~/.cache/fit/outpost/state/`. This module validates
+ * and rejects rather than silently sanitising, so an unexpected path segment
+ * surfaces as an intrusion signal instead of a quietly rewritten filename.
+ */
+
+/** Raised when an agent name cannot map to a safe state-file prefix. */
+export class UnsafeAgentNameError extends Error {
+  /** @param {string} name */
+  constructor(name) {
+    super(`unsafe agent name for state path: ${JSON.stringify(name)}`);
+    this.name = "UnsafeAgentNameError";
+    this.agentName = name;
+  }
+}
+
+/**
+ * Map an agent name to a safe state-file prefix (hyphen → underscore).
+ * @param {string} name
+ * @returns {string} safe filename prefix
+ * @throws {UnsafeAgentNameError} when `name` is empty, non-string, or contains
+ *   `/`, `\`, `..`, NUL, or a leading `~`.
+ */
+export function agentNameToStatePrefix(name) {
+  if (
+    typeof name !== "string" ||
+    name.length === 0 ||
+    name.includes("/") ||
+    name.includes("\\") ||
+    name.includes("..") ||
+    name.includes("\0") ||
+    name.startsWith("~")
+  ) {
+    throw new UnsafeAgentNameError(String(name));
+  }
+  return name.replace(/-/g, "_");
+}

package/src/agent-runner.js

@@ -11,6 +11,7 @@ import {
   loadManifest,
   draftSkills,
 } from "./posture.js";
+import { buildSpawnEnv } from "./spawn-env.js";
 
 /**
  * System-prompt directive injected under the `brief` posture. Neutralises any
@@ -167,25 +168,6 @@ export class AgentRunner {
     return args;
   }
 
-  /**
-   * Build environment for a child process.
-   * Merges the current process env with config-level env overrides.
-   * Expands ~ in values to the user's home directory.
-   * @param {Record<string, string>} [configEnv]
-   * @returns {Record<string, string>}
-   */
-  #buildSpawnEnv(configEnv) {
-    const env = { ...this.#proc.env };
-    if (configEnv) {
-      const home = homedir();
-      for (const [key, value] of Object.entries(configEnv)) {
-        const v = String(value);
-        env[key] = v.startsWith("~/") ? join(home, v.slice(2)) : v;
-      }
-    }
-    return env;
-  }
-
   /**
    * Validate the agent's kb path exists, spawn `claude --agent` with the prompt "Observe and act.", and update agent state to active/idle/failed.
    * @param {string} agentName
@@ -225,7 +207,16 @@ export class AgentRunner {
       "Observe and act.",
     ];
 
-    const env = this.#buildSpawnEnv(configEnv);
+    const { env, rejections } = buildSpawnEnv(configEnv, this.#proc.env);
+    for (const key of rejections) {
+      this.#log(
+        JSON.stringify({
+          event: "outpost.spawn_env.rejected",
+          key,
+          agent: agentName,
+        }),
+      );
+    }
     const spawnMod = await this.#resolveSpawn();
 
     try {
@@ -257,6 +248,7 @@ export class AgentRunner {
           stdout,
           agentName,
           this.#cacheDir,
+          this.#log,
         );
       } else {
         const errMsg = stderr || stdout || `Exit code ${exitCode}`;

package/src/outpost.js

@@ -445,7 +445,7 @@ export async function run(runtime, version) {
         );
         return 1;
       }
-      await agentRunner.wake(args[0], agent, state);
+      await agentRunner.wake(args[0], agent, state, config.env);
       return 0;
     },
     init: async () => {

package/src/socket-server.js

@@ -8,6 +8,7 @@ import { createLogger } from "@forwardimpact/libtelemetry";
 import { join, resolve } from "node:path";
 import { homedir } from "node:os";
 import { computeNextWakeAt, nowFromClock } from "./scheduler.js";
+import { agentNameToStatePrefix, UnsafeAgentNameError } from "./agent-path.js";
 
 /** Unix-socket IPC server that handles status queries, wake requests, and shutdown commands. */
 export class SocketServer {
@@ -131,7 +132,19 @@ export class SocketServer {
   #resolveBriefingFile(agentName, agentConfig) {
     const stateDir = join(this.#cacheDir, "state");
     if (this.#fsSync.existsSync(stateDir)) {
-      const prefix = agentName.replace(/-/g, "_") + "_";
+      let prefix;
+      try {
+        prefix = agentNameToStatePrefix(agentName) + "_";
+      } catch (err) {
+        if (!(err instanceof UnsafeAgentNameError)) throw err;
+        this.#log(
+          JSON.stringify({
+            event: "outpost.state_path.rejected",
+            agent: agentName,
+          }),
+        );
+        return null;
+      }
       const found = this.#latestFileByMtime(
         stateDir,
         (f) => f.startsWith(prefix) && f.endsWith(".md"),

package/src/spawn-env.js

@@ -0,0 +1,62 @@
+/**
+ * spawn-env — env allow-set and the pure spawn-environment filter.
+ *
+ * The daemon-mediated wake paths forward `config.env` from
+ * `~/.fit/outpost/scheduler.json` into spawned `claude` processes. This module
+ * is the single trust contract that decides which keys are honored.
+ */
+
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+/**
+ * Build a Set whose mutators are neutralised. `Object.freeze` alone does not
+ * stop `Set.prototype.add`/`delete`/`clear` from mutating internal state, so
+ * the allow-set is only a durable trust contract if the mutators themselves
+ * throw.
+ * @param {string[]} keys
+ * @returns {ReadonlySet<string>}
+ */
+function frozenSet(keys) {
+  const set = new Set(keys);
+  for (const m of ["add", "delete", "clear"]) {
+    Object.defineProperty(set, m, {
+      value: () => {
+        throw new TypeError(`AGENT_ENV_ALLOWSET is immutable: ${m}() denied`);
+      },
+    });
+  }
+  return Object.freeze(set);
+}
+
+/**
+ * Env keys the daemon honors for spawned agents. Add new keys here under
+ * code review. This single point is the env trust contract.
+ * @type {ReadonlySet<string>}
+ */
+export const AGENT_ENV_ALLOWSET = frozenSet(["ANTHROPIC_API_KEY"]);
+
+/**
+ * Build the spawn environment from a base env plus allow-set members of
+ * `configEnv`. Keys outside the allow-set are dropped and returned in
+ * `rejections`. Tilde-prefixed values are home-expanded. Pure; the caller logs.
+ * @param {Record<string,string>=} configEnv
+ * @param {NodeJS.ProcessEnv} baseEnv
+ * @returns {{ env: Record<string,string>, rejections: string[] }}
+ */
+export function buildSpawnEnv(configEnv, baseEnv) {
+  const env = { ...baseEnv };
+  const rejections = [];
+  if (configEnv) {
+    const home = homedir();
+    for (const [key, value] of Object.entries(configEnv)) {
+      if (!AGENT_ENV_ALLOWSET.has(key)) {
+        rejections.push(key);
+        continue;
+      }
+      const v = String(value);
+      env[key] = v.startsWith("~/") ? join(home, v.slice(2)) : v;
+    }
+  }
+  return { env, rejections };
+}

package/src/state-manager.js

@@ -4,6 +4,7 @@
 
 import { dirname, join } from "node:path";
 import { isoTimestamp } from "@forwardimpact/libutil";
+import { agentNameToStatePrefix, UnsafeAgentNameError } from "./agent-path.js";
 
 /** Persist and query agent scheduler state from a JSON file on disk. */
 export class StateManager {
@@ -92,9 +93,10 @@ export class StateManager {
    * @param {string} stdout
    * @param {string} agentName
    * @param {string} cacheDir - Cache directory for state files
+   * @param {Function} [logFn] - Optional logger for rejection records
    * @returns {Promise<void>}
    */
-  async updateAgentState(agentState, stdout, agentName, cacheDir) {
+  async updateAgentState(agentState, stdout, agentName, cacheDir, logFn) {
     const lines = stdout.split("\n");
     const decisionLine = lines.find((l) => l.startsWith("Decision:"));
     const actionLine = lines.find((l) => l.startsWith("Action:"));
@@ -113,8 +115,21 @@ export class StateManager {
 
     // Save output as briefing fallback
     const stateDir = join(cacheDir, "state");
+    let prefix;
+    try {
+      prefix = agentNameToStatePrefix(agentName);
+    } catch (err) {
+      if (!(err instanceof UnsafeAgentNameError)) throw err;
+      if (logFn)
+        logFn(
+          JSON.stringify({
+            event: "outpost.state_path.rejected",
+            agent: agentName,
+          }),
+        );
+      return;
+    }
     await this.#fs.mkdir(stateDir, { recursive: true });
-    const prefix = agentName.replace(/-/g, "_");
     await this.#fs.writeFile(
       join(stateDir, `${prefix}_last_output.md`),
       stdout,

package/templates/.claude/settings.json

@@ -62,6 +62,10 @@
       "Bash(killall *)",
       "Bash(launchctl *)",
       "Bash(brew *)",
+      "Edit(~/.fit/outpost/**)",
+      "Edit(~/.cache/fit/outpost/state/**)",
+      "Bash(sed * ~/.fit/outpost/**)",
+      "Bash(sed * ~/.cache/fit/outpost/state/**)",
       "Edit(~/Library/**)",
       "Read(~/Pictures/**)",
       "Read(~/Music/**)",