@goodandready/dsh-approval-gate 0.1.22 → 0.1.24

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.1.24
+
+- Security: Жесткое исключение критических категорий из механизма авто-обучения (`canLearnOperation` в `lib/learning.js`) с гарантированным запретом запоминания деструктивных операций (`rm`), секретов (`.env`, `.ssh`), эскалации прав (`sudo`) и системных путей (Refs: #81).
+- Feature: Авто-обучение правилам на основе N-1 ручных подтверждений пользователя (`ConfirmationLearner` в `lib/learning.js`) с автоматическим переводом рутинных операций в `learned-auto-allow` на стадии P1 (Refs: #79).
+- Feature: Архитектура независимого ревьюера (Second-Model AI) без права самоодобрения основным агентом (`IndependentReviewer`, `SAFETY_REVIEWER_SYSTEM_PROMPT` в `lib/reviewer.js`) со строгим разделением полномочий (Separation of Duties, Refs: #62).
+- Feature: Автономный раннер бенчмарков безопасности (`runEvaluation`, `formatEvaluationReport` в `lib/eval-runner.js`, CLI `bin/eval.mjs`) для объективного замера False Positive Rate (FPR) и False Negative Rate (FNR) с интеграцией в `npm run eval` (Refs: #69).
+- Feature: Валидация семантического сходства команд (`canonicalizeCommand`, `isSemanticallyEquivalent`, `validateSemanticSimilarity` в `lib/similarity.js`) с поддержкой эквивалентностей пакетных менеджеров (`npm test` vs `pnpm test`) и Flash-модели (Refs: #85).
+
+## 0.1.23
+
+- Tech-debt: Версионирование схемы хранения сессионных вердиктов (`CURRENT_SCHEMA_VERSION = 3` в `lib/ledger.js`) с полной обратной совместимостью и бесшовной миграцией исторических форматов v1/v2/v3 (`migrateVerdictRecord`) (Refs: #73).
+- Feature: Поддержка двухтрековых маркеров (`Dual-Track Markers` в `lib/dualtrack.js`: `TRACK_TYPES.INTERNAL` vs `TRACK_TYPES.EXTERNAL`) для четкого разделения скрытых служебных шагов агента и пользовательских мутаций проекта (Refs: #92).
+- Feature: Сессионное переключение режимов гейта (`auto-approval` vs `manual` / `strict` / `hybrid` в `lib/session-modes.js`) на основе активного пресета сессии (`resolveSessionGateMode`, `applySessionModePolicy`, `SessionModeRegistry`) (Refs: #61).
+- Feature: Сбор доказательного досье (`Evidence Dossier` в `lib/dossier.js`: инструмент, diff, терминал, исходный промпт юзера) с безопасной санитизацией чувствительных токенов и защитой от переполнения памяти (Refs: #64).
+- Security: Детекция отклонения от траектории задачи (`Trajectory Drift Detection` в `lib/drift.js`: `TrajectoryTracker`) с перехватом несанкционированного сканирования сети, поиска учетных данных и системного зондирования вне рамок цели сессии (Refs: #68).
+
 ## 0.1.22
 
 - Feature: Наследование разрешений в иерархии субагентов через `parentSession lineage authority` (`LineageManager` в `lib/lineage.js`) с безопасным обходом дерева предков и защитой от циклических ссылок (Refs: #98).

package/bin/eval.mjs

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+// bin/eval.mjs
+// Command-line entry point for running security benchmarks (#69).
+
+import { SecurityEngine } from "../lib/engine.js";
+import { runEvaluation, formatEvaluationReport } from "../lib/eval-runner.js";
+
+const engine = new SecurityEngine();
+const results = runEvaluation(engine);
+console.log(formatEvaluationReport(results));
+
+if (results.fpr > 0 || results.fnr > 0 || results.failedCases > 0) {
+  process.exit(1);
+} else {
+  process.exit(0);
+}

package/lib/dossier.js

@@ -0,0 +1,122 @@
+// lib/dossier.js
+// Evidence Dossier Gathering (#64).
+// Assembles compact evidence packets for tool calls, diffs, terminal output, and user prompts.
+
+export const MAX_PROMPT_CHARS = 200;
+export const MAX_DIFF_CHARS = 400;
+export const MAX_OUTPUT_CHARS = 300;
+
+/**
+ * Truncates a string safely with ellipsis.
+ * @param {any} str
+ * @param {number} max
+ * @returns {string}
+ */
+function truncate(str, max) {
+  if (typeof str !== "string") return "";
+  const trimmed = str.trim();
+  if (trimmed.length <= max) return trimmed;
+  return trimmed.slice(0, max - 3) + "...";
+}
+
+/**
+ * Extracts a concise summary of arguments without sensitive credentials.
+ * @param {Record<string, any>} [args]
+ * @returns {Record<string, any>}
+ */
+function sanitizeArgs(args) {
+  if (!args || typeof args !== "object") return {};
+  const summary = {};
+  for (const [k, v] of Object.entries(args)) {
+    if (k.toLowerCase().includes("token") || k.toLowerCase().includes("secret") || k.toLowerCase().includes("password")) {
+      summary[k] = "[REDACTED]";
+    } else if (typeof v === "string") {
+      summary[k] = v.length > 80 ? v.slice(0, 77) + "..." : v;
+    } else if (typeof v === "number" || typeof v === "boolean") {
+      summary[k] = v;
+    } else if (Array.isArray(v)) {
+      summary[k] = `Array(${v.length})`;
+    } else if (typeof v === "object" && v !== null) {
+      summary[k] = `Object(${Object.keys(v).length})`;
+    }
+  }
+  return summary;
+}
+
+/**
+ * Builds an evidence dossier object for an execution (#64).
+ *
+ * @param {Object} params
+ * @param {Record<string, any>} [params.execution]
+ * @param {Record<string, any>} [params.decision]
+ * @param {Record<string, any>} [params.context]
+ * @param {string} [params.toolName]
+ * @param {string} [params.command]
+ * @param {Record<string, any>} [params.args]
+ * @param {string} [params.userPrompt]
+ * @param {string} [params.diffSnippet]
+ * @param {string} [params.terminalOutput]
+ * @param {string} [params.track]
+ * @param {string} [params.riskBucket]
+ * @returns {{
+ *   toolName: string,
+ *   command: string,
+ *   argsSummary: Record<string, any>,
+ *   userPrompt: string,
+ *   diffSnippet: string,
+ *   terminalOutput: string,
+ *   track: string,
+ *   riskBucket: string,
+ *   timestamp: number
+ * }}
+ */
+export function buildEvidenceDossier({
+  execution = {},
+  decision = {},
+  context = {},
+  toolName,
+  command,
+  args,
+  userPrompt,
+  diffSnippet,
+  terminalOutput,
+  track,
+  riskBucket,
+} = {}) {
+  const tool = String(toolName || execution?.name || execution?.toolName || "").trim();
+  const cmd = String(command || execution?.arguments?.command || execution?.command || "").trim();
+  const rawArgs = args || execution?.arguments || {};
+  const prompt = userPrompt || context?.userPrompt || context?.prompt || context?.goal || "";
+  const diff = diffSnippet || context?.diffSnippet || context?.diff || rawArgs?.diff || "";
+  const output = terminalOutput || context?.terminalOutput || context?.output || "";
+  const assignedTrack = track || decision?.track || context?.track || "external";
+  const assignedRisk = riskBucket || decision?.riskBucket || context?.riskBucket || "medium";
+
+  return {
+    toolName: tool,
+    command: cmd,
+    argsSummary: sanitizeArgs(rawArgs),
+    userPrompt: truncate(prompt, MAX_PROMPT_CHARS),
+    diffSnippet: truncate(diff, MAX_DIFF_CHARS),
+    terminalOutput: truncate(output, MAX_OUTPUT_CHARS),
+    track: assignedTrack,
+    riskBucket: assignedRisk,
+    timestamp: Date.now(),
+  };
+}
+
+/**
+ * Formats a single-line summary of an evidence dossier.
+ * @param {ReturnType<typeof buildEvidenceDossier>} dossier
+ * @returns {string}
+ */
+export function formatDossierSummary(dossier) {
+  if (!dossier) return "[Dossier: empty]";
+  const parts = [];
+  if (dossier.toolName) parts.push(`tool=${dossier.toolName}`);
+  if (dossier.track) parts.push(`track=${dossier.track}`);
+  if (dossier.riskBucket) parts.push(`risk=${dossier.riskBucket}`);
+  if (dossier.userPrompt) parts.push(`prompt="${dossier.userPrompt.slice(0, 30)}"`);
+  if (dossier.diffSnippet) parts.push(`diff="${dossier.diffSnippet.slice(0, 30)}"`);
+  return `[Dossier: ${parts.join(" ")}]`;
+}

package/lib/drift.js

@@ -0,0 +1,214 @@
+// lib/drift.js
+// Trajectory Drift Detection for dsh-approval-gate (#68).
+// Detects when agent deviates from session goal into port scanning, credential hunting, or out-of-scope probing.
+
+export const DRIFT_CATEGORIES = Object.freeze({
+  NETWORK_RECON: "network-recon",
+  CREDENTIAL_HUNT: "credential-hunt",
+  SYSTEM_PROBING: "system-probing",
+  OUT_OF_SCOPE: "out-of-scope",
+});
+
+const NETWORK_RECON_PATTERNS = [
+  /\b(?:nmap|masscan|zmap)\b/i,
+  /\bnetstat\s+-[antulp]+/i,
+  /\bss\s+-[antulp]+/i,
+  /\barp\s+-(?:a|n)\b/i,
+  /\b(?:tcpdump|tshark|wireshark)\b/i,
+  /\b(?:traceroute|tracepath)\b/i,
+];
+
+const NETWORK_GOAL_KEYWORDS = [
+  "network", "port", "scan", "packet", "interface", "traceroute", "traffic", "firewall", "diagnose"
+];
+
+const CREDENTIAL_HUNT_PATTERNS = [
+  /[\\/]\.ssh[\\/](?:id_rsa|id_ed25519|id_ecdsa|authorized_keys|known_hosts)/i,
+  /[\\/]\.aws[\\/]credentials/i,
+  /\/etc\/(?:shadow|gshadow|sudoers)/i,
+  /\bcat\s+[^\n]*(?:id_rsa|id_ed25519|\.ssh|\.aws\/credentials)/i,
+  /\bfind\s+[^\n]*-(?:name|iname)\s+['"]?\*?\.(?:pem|key|pfx|pkcs12)['"]?/i,
+];
+
+const CREDENTIAL_GOAL_KEYWORDS = [
+  "ssh", "key", "credential", "auth", "secret", "password", "token", "certificate", "cert", "deploy key"
+];
+
+const SYSTEM_PROBE_PATTERNS = [
+  /\bfind\s+\/(?:\s|$)[^\n]*-perm\s+-[0-9]+/i,
+  /\/proc\/(?:kallsyms|keys|sched_debug)/i,
+  /\b(?:linpeas|winpeas|chkrootkit|rkhunter)\b/i,
+  /\bls\s+-[la]*\s+\/root\b/i,
+];
+
+const SYSTEM_PROBE_GOAL_KEYWORDS = [
+  "kernel", "root", "audit", "security audit", "permission audit", "probe", "privilege"
+];
+
+/**
+ * Checks if text contains any of the given keywords.
+ * @param {string} text
+ * @param {string[]} keywords
+ * @returns {boolean}
+ */
+function containsKeyword(text, keywords) {
+  if (!text || typeof text !== "string") return false;
+  const lower = text.toLowerCase();
+  return keywords.some((kw) => lower.includes(kw));
+}
+
+/**
+ * Detects trajectory drift for an execution against session goal (#68).
+ *
+ * @param {string} [sessionId]
+ * @param {Record<string, any>} [execution]
+ * @param {Record<string, any>} [context]
+ * @param {{ goal?: string, allowedScopes?: string[] }} [goalInfo]
+ * @returns {{
+ *   hasDrift: boolean,
+ *   driftScore: number,
+ *   driftWarning: boolean,
+ *   category?: string,
+ *   reason?: string,
+ *   detail?: string
+ * }}
+ */
+export function detectTrajectoryDrift(sessionId, execution = {}, context = {}, goalInfo = {}) {
+  const goal = String(
+    goalInfo?.goal ||
+    context?.goal ||
+    context?.userPrompt ||
+    context?.prompt ||
+    ""
+  ).trim();
+
+  const command = String(
+    execution?.arguments?.command ||
+    execution?.command ||
+    ""
+  ).trim();
+
+  const targetPath = String(
+    execution?.arguments?.TargetFile ||
+    execution?.arguments?.targetPath ||
+    execution?.arguments?.path ||
+    execution?.arguments?.file ||
+    ""
+  ).trim();
+
+  const textToScan = `${command} ${targetPath}`.trim();
+  if (!textToScan) {
+    return { hasDrift: false, driftScore: 0, driftWarning: false };
+  }
+
+  // 1. Network reconnaissance check
+  if (NETWORK_RECON_PATTERNS.some((p) => p.test(textToScan))) {
+    if (!containsKeyword(goal, NETWORK_GOAL_KEYWORDS)) {
+      return {
+        hasDrift: true,
+        driftScore: 0.85,
+        driftWarning: true,
+        category: DRIFT_CATEGORIES.NETWORK_RECON,
+        reason: "trajectory-drift-detected",
+        detail: `Operation matches network reconnaissance without matching session goal (${goal.slice(0, 50) || "none"})`,
+      };
+    }
+  }
+
+  // 2. Credential hunting check
+  if (CREDENTIAL_HUNT_PATTERNS.some((p) => p.test(textToScan))) {
+    if (!containsKeyword(goal, CREDENTIAL_GOAL_KEYWORDS)) {
+      return {
+        hasDrift: true,
+        driftScore: 0.95,
+        driftWarning: true,
+        category: DRIFT_CATEGORIES.CREDENTIAL_HUNT,
+        reason: "trajectory-drift-detected",
+        detail: `Operation matches credential inspection without matching session goal (${goal.slice(0, 50) || "none"})`,
+      };
+    }
+  }
+
+  // 3. System probing check
+  if (SYSTEM_PROBE_PATTERNS.some((p) => p.test(textToScan))) {
+    if (!containsKeyword(goal, SYSTEM_PROBE_GOAL_KEYWORDS)) {
+      return {
+        hasDrift: true,
+        driftScore: 0.9,
+        driftWarning: true,
+        category: DRIFT_CATEGORIES.SYSTEM_PROBING,
+        reason: "trajectory-drift-detected",
+        detail: `Operation matches system probing/privilege reconnaissance outside session goal`,
+      };
+    }
+  }
+
+  // 4. Allowed scopes check
+  const allowedScopes = goalInfo?.allowedScopes || context?.allowedScopes;
+  if (Array.isArray(allowedScopes) && allowedScopes.length > 0 && targetPath) {
+    const normTarget = targetPath.replace(/\\/g, "/").toLowerCase();
+    const isWithinScope = allowedScopes.some((scope) => {
+      const normScope = String(scope).replace(/\\/g, "/").toLowerCase();
+      return normTarget.startsWith(normScope);
+    });
+    if (!isWithinScope && (normTarget.startsWith("/etc") || normTarget.startsWith("/root") || normTarget.includes("/.ssh"))) {
+      return {
+        hasDrift: true,
+        driftScore: 0.8,
+        driftWarning: true,
+        category: DRIFT_CATEGORIES.OUT_OF_SCOPE,
+        reason: "trajectory-drift-detected",
+        detail: `Access to ${targetPath} is outside declared session scopes`,
+      };
+    }
+  }
+
+  return { hasDrift: false, driftScore: 0, driftWarning: false };
+}
+
+/**
+ * Trajectory Tracker for sessions (#68).
+ */
+export class TrajectoryTracker {
+  constructor() {
+    /** @type {Map<string, { goal: string, allowedScopes: string[], stepCount: number }>} */
+    this.sessions = new Map();
+  }
+
+  setGoal(sessionId, goal, allowedScopes = []) {
+    const key = sessionId || "default";
+    this.sessions.set(key, {
+      goal: String(goal || ""),
+      allowedScopes: Array.isArray(allowedScopes) ? [...allowedScopes] : [],
+      stepCount: 0,
+    });
+  }
+
+  getGoal(sessionId) {
+    const key = sessionId || "default";
+    return this.sessions.get(key) || null;
+  }
+
+  recordStep(sessionId) {
+    const key = sessionId || "default";
+    const entry = this.sessions.get(key);
+    if (entry) {
+      entry.stepCount += 1;
+    }
+  }
+
+  detect(sessionId, execution, context = {}) {
+    const key = sessionId || "default";
+    const goalInfo = this.sessions.get(key) || {};
+    return detectTrajectoryDrift(key, execution, context, goalInfo);
+  }
+
+  clearSession(sessionId) {
+    const key = sessionId || "default";
+    this.sessions.delete(key);
+  }
+
+  reset() {
+    this.sessions.clear();
+  }
+}

package/lib/dualtrack.js

@@ -0,0 +1,101 @@
+// lib/dualtrack.js
+// Dual-Track Markers for separating internal agent chores from external project mutations (#92).
+// Provides classification and predicates to differentiate internal sandbox actions from project changes.
+
+export const TRACK_TYPES = Object.freeze({
+  INTERNAL: "internal",
+  EXTERNAL: "external",
+});
+
+const INTERNAL_TOOL_NAMES = new Set([
+  "read_url_content",
+  "search_web",
+  "web_search",
+  "view_file",
+  "read_file",
+  "view",
+  "inspect_file",
+]);
+
+const INTERNAL_PATH_PATTERNS = [
+  /[\\/]\.dsh[\\/](?:tmp|trash|cache|sessions)[\\/]/i,
+  /[\\/]\.gemini[\\/]/i,
+  /[\\/]scratch[\\/]/i,
+  /[\\/]\.cache[\\/]/i,
+  /[\\/]tmp[\\/]/i,
+];
+
+const INTERNAL_COMMAND_REGEX = /^(?:git\s+(?:status|diff|rev-parse|branch|log)|npm\s+(?:view|help)|node\s+--version|echo\b|cat\s+[^\n]*\.(?:dsh|tmp|cache)|ls\s+-[la]*\s*(?:\.|$))/i;
+
+/**
+ * Classifies an operation into internal or external track (#92).
+ *
+ * @param {string} [toolName]
+ * @param {string} [command]
+ * @param {Record<string, any>} [args]
+ * @param {Record<string, any>} [context]
+ * @returns {'internal' | 'external'}
+ */
+export function classifyTrack(toolName, command, args = {}, context = {}) {
+  // Explicit overrides in context or args
+  if (context.track === TRACK_TYPES.INTERNAL || args?.track === TRACK_TYPES.INTERNAL || context.internal === true || args?.internal === true) {
+    return TRACK_TYPES.INTERNAL;
+  }
+  if (context.track === TRACK_TYPES.EXTERNAL || args?.track === TRACK_TYPES.EXTERNAL || context.external === true || args?.external === true) {
+    return TRACK_TYPES.EXTERNAL;
+  }
+
+  const tool = String(toolName || "").trim();
+  const cmd = String(command || (args && args.command) || "").trim();
+  const target = String((args && (args.TargetFile || args.targetPath || args.path || args.file)) || "").trim();
+
+  // Operations targeting internal scratch/temp paths are internal
+  if (target && INTERNAL_PATH_PATTERNS.some((p) => p.test(target))) {
+    return TRACK_TYPES.INTERNAL;
+  }
+
+  // Pure read-only knowledge tools are internal
+  if (INTERNAL_TOOL_NAMES.has(tool)) {
+    return TRACK_TYPES.INTERNAL;
+  }
+
+  // File mutations on project files are external
+  if (tool === "write_to_file" || tool === "replace_file_content" || tool === "create_file") {
+    return TRACK_TYPES.EXTERNAL;
+  }
+
+  // Shell command classification
+  if (cmd) {
+    if (INTERNAL_PATH_PATTERNS.some((p) => p.test(cmd))) {
+      return TRACK_TYPES.INTERNAL;
+    }
+    if (INTERNAL_COMMAND_REGEX.test(cmd)) {
+      return TRACK_TYPES.INTERNAL;
+    }
+  }
+
+  // Default for non-read commands or mutations
+  return TRACK_TYPES.EXTERNAL;
+}
+
+/**
+ * Checks whether track or decision is marked as internal.
+ * @param {string | { track?: string }} [trackOrDecision]
+ * @returns {boolean}
+ */
+export function isInternalTrack(trackOrDecision) {
+  if (!trackOrDecision) return false;
+  if (typeof trackOrDecision === "string") return trackOrDecision === TRACK_TYPES.INTERNAL;
+  return trackOrDecision.track === TRACK_TYPES.INTERNAL;
+}
+
+/**
+ * Checks whether track or decision is marked as external.
+ * @param {string | { track?: string }} [trackOrDecision]
+ * @returns {boolean}
+ */
+export function isExternalTrack(trackOrDecision) {
+  if (!trackOrDecision) return false;
+  if (typeof trackOrDecision === "string") return trackOrDecision === TRACK_TYPES.EXTERNAL;
+  return trackOrDecision.track === TRACK_TYPES.EXTERNAL;
+}