@haposoft/cafekit 0.16.0-rc.2 → 0.16.0-rc.4

package/src/claude/hooks/privacy-block.cjs

@@ -17,6 +17,10 @@
 try {
   const fs = require('fs');
   const path = require('path');
+  const {
+    DYNAMIC_READ_PATH,
+    commandAccess,
+  } = require('./lib/privacy-command-analysis.cjs');
 
   const RESTRICTED_PATTERNS = [
     /^\.env(?:[.\[*?{]|$)/i,
@@ -33,7 +37,13 @@ try {
     /\.keystore$/i,
     /\.jks$/i,
     /auth\.json$/i,
-    /token(s)?\.json$/i
+    /token(s)?\.json$/i,
+    /\.cafekit/i,
+    /hmac\.key/i,
+    /completion-authority/i,
+    /session-state/i,
+    /hook-log/i,
+    /sessions/i
   ];
 
   const ALLOWED_EXEMPTIONS = [
@@ -55,6 +65,7 @@ try {
   }
 
   function isSensitive(filePath) {
+    if (filePath === DYNAMIC_READ_PATH) return true;
     const base = path.basename(filePath);
     return RESTRICTED_PATTERNS.some((rule) => rule.test(base) || rule.test(filePath));
   }
@@ -63,7 +74,7 @@ try {
    * Resolve a symlink to its real target so a harmless-looking name that points
    * at a sensitive file cannot slip through the basename check. Returns null
    * when the path cannot be resolved (missing file, broken link) — fail-open to
-   * the original-path check in that case.
+   * the original-path check in that case. See isSymlinkToSensitive for dangling handling.
    */
   function resolveTarget(filePath, cwd) {
     try {
@@ -74,19 +85,58 @@ try {
     }
   }
 
-  function extractBashPaths(command) {
-    const paths = new Set();
-    // Quotes are delimiters rather than grouped tokens so nested shell
-    // commands such as `bash -c 'cat .env'` cannot hide the sensitive path.
-    const tokens = command.split(/[\s|;&<>"']+/).filter(Boolean);
-    for (const token of tokens) {
-      const cleaned = token.replace(/^["'()`]+|["'(),]+$/g, '');
-      for (const candidate of cleaned.split('=')) {
-        const value = candidate.replace(/^["'()`]+|["'(),]+$/g, '');
-        if (value && (isSensitive(value) || isSafe(value))) paths.add(value);
+  /**
+   * When realpath fails, check whether the requested path is a symlink (or chain)
+   * whose lexical target is sensitive. Dangling link to protected target -> true (fail-closed ask);
+   * dangling benign link or link to allowed example/template -> false (allow).
+   * Limit hops to avoid loops; malformed/looping -> fail closed.
+   * TOCTOU note: check and use are not atomic; target could be swapped between this check and the actual read.
+   * This is a best-effort guardrail, not an arbitrary-shell security boundary. For strong isolation use OS sandbox.
+   */
+  function isSymlinkToSensitive(filePath, cwd) {
+    try {
+      const requested = path.isAbsolute(filePath) ? filePath : path.resolve(cwd, filePath);
+      let current = requested;
+      let hops = 0;
+      const MAX_HOPS = 8;
+      while (hops < MAX_HOPS) {
+        let stat;
+        try {
+          stat = fs.lstatSync(current);
+        } catch {
+          return false;
+        }
+        if (!stat.isSymbolicLink()) return false;
+        let linkTarget;
+        try {
+          linkTarget = fs.readlinkSync(current);
+        } catch {
+          return true;
+        }
+        if (isSensitive(linkTarget) && !isSafe(linkTarget)) return true;
+        if (isSafe(linkTarget)) return false;
+        const next = path.isAbsolute(linkTarget) ? linkTarget : path.resolve(path.dirname(current), linkTarget);
+        if (next === current) return true;
+        try {
+          const real = fs.realpathSync(next);
+          if (isSensitive(real) && !isSafe(real)) return true;
+          if (isSafe(real)) return false;
+          return false;
+        } catch {
+          current = next;
+          hops += 1;
+          continue;
+        }
       }
+      return true;
+    } catch {
+      return true;
     }
-    return [...paths];
+  }
+
+  function extractBashPaths(command) {
+    const access = commandAccess(command);
+    return access.dynamic ? [...access.paths, DYNAMIC_READ_PATH] : access.paths;
   }
 
   function extractPaths(toolName, input) {
@@ -129,7 +179,7 @@ try {
   const data = JSON.parse(stdin);
   const toolName = data.tool_name || '';
   const toolInput = data.tool_input || {};
-  const cwd = data.cwd || process.cwd();
+  const cwd = typeof data.cwd === 'string' && data.cwd.trim() ? data.cwd : process.cwd();
   const runtime = readRuntime(cwd);
 
   if (runtime.privacyBlock === false) process.exit(0);
@@ -148,6 +198,11 @@ try {
         process.exit(0);
       }
       if (isSafe(target)) continue;
+    } else {
+      if (isSymlinkToSensitive(filePath, cwd)) {
+        askForPermission(filePath);
+        process.exit(0);
+      }
     }
 
     if (isSafe(filePath) || !isSensitive(filePath)) continue;
@@ -156,21 +211,13 @@ try {
   }
 
   process.exit(0);
-} catch (error) {
-  try {
-    const fs = require('fs');
-    const path = require('path');
-    const logDir = path.join(__dirname, '.logs');
-    if (!fs.existsSync(logDir)) fs.mkdirSync(logDir, { recursive: true });
-    fs.appendFileSync(
-      path.join(logDir, 'hook-log.jsonl'),
-      JSON.stringify({
-        ts: new Date().toISOString(),
-        hook: 'privacy-block',
-        status: 'crash',
-        error: error.message
-      }) + '\n'
-    );
-  } catch (_) {}
+} catch (_) {
+  process.stdout.write(JSON.stringify({
+    hookSpecificOutput: {
+      hookEventName: 'PreToolUse',
+      permissionDecision: 'ask',
+      permissionDecisionReason: 'Sensitive access could not be evaluated safely.'
+    }
+  }) + '\n');
   process.exit(0);
 }

package/src/claude/hooks/semantic-review-authority.cjs

@@ -0,0 +1,152 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const STATE = require('./completion-authority-state.cjs');
+const PATH_SAFETY = require('./lib/runtime-path-safety.cjs');
+
+const SCHEMA_VERSION = 1;
+const MARKER = 'CAFEKIT_SEMANTIC_REVIEW_ATTESTATION ';
+const SHA256_RE = /^sha256:[a-f0-9]{64}$/;
+const REVIEWER_ROLE_ALLOWLIST = new Set(['code-auditor', 'code_auditor']);
+const RECORD_FIELDS = ['schema_version', 'kind', 'identity', 'semantic_digest', 'event', 'verdict', 'host_session_id', 'reviewer_agent_id', 'reviewer_agent_type', 'issued_at', 'mac'];
+
+function plain(value) {
+  return Boolean(value && typeof value === 'object' && !Array.isArray(value));
+}
+
+function exactKeys(value, fields) {
+  return plain(value) && JSON.stringify(Object.keys(value).sort()) === JSON.stringify([...fields].sort());
+}
+
+function inside(root, target) {
+  const relative = path.relative(root, target);
+  return relative !== '' && relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+
+function projectRoot(payload = {}) {
+  const installedRoot = path.resolve(__dirname, '..', '..');
+  if (fs.existsSync(path.join(installedRoot, '.claude', 'hooks', path.basename(__filename)))) {
+    try { return STATE.canonicalProjectRoot(installedRoot); } catch {}
+  }
+  for (const candidate of [process.env.CLAUDE_PROJECT_DIR, process.env.PROJECT_ROOT]) {
+    if (typeof candidate === 'string' && candidate.trim()) {
+      try { return STATE.canonicalProjectRoot(candidate); } catch { /* continue */ }
+    }
+  }
+  const cwd = typeof payload.cwd === 'string' && payload.cwd.trim() ? payload.cwd : process.cwd();
+  return STATE.canonicalProjectRoot(cwd);
+}
+
+function identityFor(root, specFile, featureName) {
+  if (typeof featureName !== 'string' || !featureName.trim() || featureName.includes('/') || featureName.includes('\\') || featureName === '.' || featureName === '..' || featureName.includes('..')) throw new Error('feature identity is malformed');
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(featureName)) throw new Error('feature identity is malformed');
+  const canonicalRoot = STATE.canonicalProjectRoot(root);
+  const canonicalSpec = fs.realpathSync(path.resolve(specFile));
+  if (!inside(canonicalRoot, canonicalSpec) || path.basename(canonicalSpec) !== 'spec.json') throw new Error('spec identity escapes the project');
+  const relative = path.relative(canonicalRoot, canonicalSpec);
+  const expected = path.join('specs', featureName, 'spec.json');
+  if (relative !== expected) throw new Error(`spec identity must be ${expected}, not ${relative}`);
+  const spec = JSON.parse(fs.readFileSync(canonicalSpec, 'utf8'));
+  if (spec.feature_name !== featureName) throw new Error('feature identity does not match spec.json');
+  return { project_root: canonicalRoot, spec_file: canonicalSpec, feature_name: featureName };
+}
+
+function recordPath(root, identity) {
+  const name = STATE.digest({ namespace: 'cafekit-semantic-review-observation-v1', identity });
+  return path.join(STATE.stateDir(root), 'semantic-reviews', `observation-${name}.json`);
+}
+
+function parseClaim(message) {
+  const lines = String(message || '').split(/\r?\n/).filter((line) => line.startsWith(MARKER));
+  if (lines.length === 0) return null;
+  if (lines.length !== 1) throw new Error('exactly one semantic review attestation marker is required');
+  const claim = JSON.parse(lines[0].slice(MARKER.length));
+  if (!exactKeys(claim, ['feature_name', 'spec_file', 'semantic_digest', 'verdict'])) throw new Error('semantic review claim fields are malformed');
+  if (claim.verdict !== 'PASS' || !SHA256_RE.test(claim.semantic_digest || '')) throw new Error('semantic review claim must contain literal PASS and a sha256 digest');
+  return claim;
+}
+
+function validatorFor(root) {
+  const installedRoot = path.join(root, '.claude');
+  const installedHook = path.join(installedRoot, 'hooks', path.basename(__filename));
+  if (fs.existsSync(installedHook)) {
+    const canonicalHook = PATH_SAFETY.canonicalRegularFile(root, installedHook, 'installed semantic hook');
+    if (canonicalHook !== fs.realpathSync(__filename)) throw new Error('installed semantic hook identity is invalid');
+    const validator = path.join(installedRoot, 'scripts', 'validate-spec-output.cjs');
+    PATH_SAFETY.verifyCommonJsClosure(installedRoot, validator);
+    return PATH_SAFETY.canonicalRegularFile(installedRoot, validator, 'semantic validator');
+  }
+
+  const sourceRuntime = path.resolve(__dirname, '..');
+  const sourceRoot = path.resolve(sourceRuntime, '..');
+  if (path.basename(sourceRuntime) !== 'claude' || path.basename(sourceRoot) !== 'src') {
+    throw new Error('semantic validator runtime root is not recognized');
+  }
+  const validator = path.join(sourceRuntime, 'scripts', 'validate-spec-output.cjs');
+  PATH_SAFETY.verifyCommonJsClosure(sourceRoot, validator);
+  return PATH_SAFETY.canonicalRegularFile(sourceRoot, validator, 'semantic validator');
+}
+
+function currentDigest(root, specFile) {
+  const validator = validatorFor(root);
+  const result = spawnSync(process.execPath, [validator, path.dirname(specFile), '--semantic-digest'], { cwd: root, encoding: 'utf8' });
+  const digest = result.stdout.trim();
+  if (result.status !== 0 || !SHA256_RE.test(digest)) throw new Error(`semantic digest could not be recomputed (${result.stderr.trim() || `exit ${result.status}`})`);
+  return digest;
+}
+
+function recordFromSubagentStop(payload) {
+  // Honest-agent guardrail: the host hook observes this SubagentStop payload.
+  // The worker-authored claim is not authenticated input or a security boundary.
+  if (!plain(payload) || payload.hook_event_name !== 'SubagentStop') return { recorded: false, reason: 'event' };
+  for (const field of ['session_id', 'agent_id', 'agent_type', 'last_assistant_message']) {
+    if (typeof payload[field] !== 'string' || !payload[field].trim()) return { recorded: false, reason: `missing-${field}` };
+  }
+  if (!REVIEWER_ROLE_ALLOWLIST.has(payload.agent_type)) return { recorded: false, reason: 'reviewer-role' };
+  const root = projectRoot(payload);
+  const claim = parseClaim(payload.last_assistant_message);
+  if (claim === null) return { recorded: false, reason: 'no-claim' };
+  const requestedSpec = path.resolve(root, claim.spec_file);
+  const identity = identityFor(root, requestedSpec, claim.feature_name);
+  const digest = currentDigest(root, identity.spec_file);
+  if (digest !== claim.semantic_digest) throw new Error('claimed semantic digest does not match current artifacts');
+  const key = STATE.ensureKey();
+  const record = {
+    schema_version: SCHEMA_VERSION, kind: 'semantic-review-observation', identity,
+    semantic_digest: digest, event: 'SubagentStop', verdict: 'PASS',
+    host_session_id: payload.session_id, reviewer_agent_id: payload.agent_id,
+    reviewer_agent_type: payload.agent_type, issued_at: new Date().toISOString(),
+  };
+  record.mac = STATE.recordMac(record, key);
+  STATE.atomicWrite(recordPath(root, identity), record);
+  return { recorded: true, record };
+}
+
+function verifyAttestation(root, specFile, featureName, semanticDigest) {
+  let identity;
+  try { identity = identityFor(root, specFile, featureName); } catch (error) { return { ok: false, reason: error.message }; }
+  const file = recordPath(root, identity);
+  let record;
+  try { record = JSON.parse(fs.readFileSync(file, 'utf8')); } catch (error) { return { ok: false, reason: error.code === 'ENOENT' ? 'matching host-hook observation is missing' : 'host-hook observation is unreadable' }; }
+  const key = STATE.readKey();
+  if (key.missing) return { ok: false, reason: 'completion authority key is missing' };
+  if (!exactKeys(record, RECORD_FIELDS) || !STATE.macMatches(record, key.key)) return { ok: false, reason: 'host-hook observation is malformed or its MAC is invalid' };
+  if (record.schema_version !== SCHEMA_VERSION || record.kind !== 'semantic-review-observation' || record.event !== 'SubagentStop' || record.verdict !== 'PASS') return { ok: false, reason: 'host-hook observation event or verdict is invalid' };
+  if (STATE.stableStringify(record.identity) !== STATE.stableStringify(identity)) return { ok: false, reason: 'host-hook observation project, feature, or spec identity is invalid' };
+  if (record.semantic_digest !== semanticDigest) return { ok: false, reason: 'host-hook observation semantic digest is stale' };
+  return { ok: true, record };
+}
+
+if (require.main === module) {
+  try {
+    const raw = fs.readFileSync(0, 'utf8').trim();
+    if (raw) recordFromSubagentStop(JSON.parse(raw));
+  } catch (error) {
+    process.stderr.write(`CafeKit semantic review SubagentStop claim rejected: ${error.message}\n`);
+  }
+}
+
+module.exports = { MARKER, REVIEWER_ROLE_ALLOWLIST, recordFromSubagentStop, verifyAttestation, identityFor, recordPath };

package/src/claude/hooks/session.cjs

@@ -18,10 +18,10 @@ try {
   const { execSync } = require('child_process');
 
   // ── Utilities ─────────────────────────────────────────────────────────────
-  function run(cmd, fallback = '') {
+  function run(cmd, fallback = '', cwd = process.cwd()) {
     try {
       return execSync(cmd, {
-        encoding: 'utf8', timeout: 3000,
+        cwd, encoding: 'utf8', timeout: 3000,
         stdio: ['pipe', 'pipe', 'pipe']
       }).trim();
     } catch { return fallback; }
@@ -40,6 +40,21 @@ try {
     } catch { /* fail-open */ }
   }
 
+  function projectRoot() {
+    const configured = typeof process.env.CLAUDE_PROJECT_DIR === 'string'
+      ? process.env.CLAUDE_PROJECT_DIR.trim()
+      : '';
+    if (configured) {
+      try { return fs.realpathSync(path.resolve(configured)); } catch { /* continue */ }
+    }
+
+    const installedRoot = path.resolve(__dirname, '..', '..');
+    const installedHook = path.join(installedRoot, '.claude', 'hooks', path.basename(__filename));
+    if (fs.existsSync(installedHook)) return installedRoot;
+
+    try { return fs.realpathSync(process.cwd()); } catch { return path.resolve(process.cwd()); }
+  }
+
   /** Read .claude/runtime.json config */
   function readRuntime(cwd) {
     try {
@@ -50,8 +65,7 @@ try {
 
   // ── Project Detection ──────────────────────────────────────────────────────
 
-  function detectProjectType() {
-    const cwd = process.cwd();
+  function detectProjectType(cwd) {
     if (fs.existsSync(path.join(cwd, 'pnpm-workspace.yaml')) ||
         fs.existsSync(path.join(cwd, 'lerna.json'))) return 'monorepo';
     try {
@@ -62,8 +76,7 @@ try {
     return 'app';
   }
 
-  function detectPackageManager() {
-    const cwd = process.cwd();
+  function detectPackageManager(cwd) {
     if (fs.existsSync(path.join(cwd, 'pnpm-lock.yaml')))  return 'pnpm';
     if (fs.existsSync(path.join(cwd, 'yarn.lock')))        return 'yarn';
     if (fs.existsSync(path.join(cwd, 'bun.lockb')))        return 'bun';
@@ -71,10 +84,10 @@ try {
     return '';
   }
 
-  function detectFramework() {
+  function detectFramework(cwd) {
     try {
       const pkg = JSON.parse(
-        fs.readFileSync(path.join(process.cwd(), 'package.json'), 'utf8')
+        fs.readFileSync(path.join(cwd, 'package.json'), 'utf8')
       );
       const deps = { ...pkg.dependencies, ...pkg.devDependencies };
       if (deps['next'])        return 'next';
@@ -185,31 +198,32 @@ try {
   const payload = stdin ? JSON.parse(stdin) : {};
   const source  = payload.source || 'unknown';
   const envFile = process.env.CLAUDE_ENV_FILE;
-  const cwd     = process.cwd();
+  const cwd     = projectRoot();
   const runtime = readRuntime(cwd);
+  try { require('./completion-authority-state.cjs').clearState(cwd, payload.session_id); } catch { /* old installs remain fail-open */ }
 
   // Check CafeKit update in parallel with project detection (async, fail-open).
   const updateCheckPromise = checkCafeKitUpdate(cwd);
 
   // Project detection
   const projectType = runtime.project?.type !== 'auto'
-    ? (runtime.project?.type || detectProjectType())
-    : detectProjectType();
+    ? (runtime.project?.type || detectProjectType(cwd))
+    : detectProjectType(cwd);
 
   const packageManager = runtime.project?.packageManager !== 'auto'
-    ? (runtime.project?.packageManager || detectPackageManager())
-    : detectPackageManager();
+    ? (runtime.project?.packageManager || detectPackageManager(cwd))
+    : detectPackageManager(cwd);
 
   const framework = runtime.project?.framework !== 'auto'
-    ? (runtime.project?.framework || detectFramework())
-    : detectFramework();
+    ? (runtime.project?.framework || detectFramework(cwd))
+    : detectFramework(cwd);
 
   // Static environment
-  const gitBranch  = run('git branch --show-current');
-  const gitUrl     = run('git remote get-url origin');
-  const gitRoot    = run('git rev-parse --show-toplevel');
+  const gitBranch  = run('git branch --show-current', '', cwd);
+  const gitUrl     = run('git remote get-url origin', '', cwd);
+  const gitRoot    = run('git rev-parse --show-toplevel', '', cwd);
   const nodeVer    = process.version;
-  const pythonVer  = run('python3 --version') || run('python --version');
+  const pythonVer  = run('python3 --version', '', cwd) || run('python --version', '', cwd);
   const user       = process.env.USERNAME || process.env.USER
                      || process.env.LOGNAME || os.userInfo().username;
   const timezone   = Intl.DateTimeFormat().resolvedOptions().timeZone;