@harness-engineering/cli 5.0.0 → 6.0.1

package/dist/hooks/sentinel-post.js

@@ -11,73 +11,146 @@ import process from 'node:process';
 // Minimal inline patterns for when @harness-engineering/core isn't available.
 // Keep in sync with @harness-engineering/core injection-patterns.ts ALL_PATTERNS.
 // Covers all HIGH-severity patterns and key MEDIUM patterns for degraded-mode safety.
+//
+// Rules are declared as a data table and applied in order, one regex per line.
+// This is a pure structural extraction of the original per-rule `if` blocks —
+// every rule's pattern, severity, ruleId, and ordering is byte-for-byte preserved.
+const INLINE_RULES = [
+  // HIGH: INJ-UNI-001 — Zero-width characters
+  // eslint-disable-next-line no-misleading-character-class -- intentional: detects zero-width chars for security
+  { severity: 'high', ruleId: 'INJ-UNI-001', pattern: /[\u200B\u200C\u200D\uFEFF\u2060]/ },
+  // HIGH: INJ-UNI-002 — RTL/LTR override characters
+  { severity: 'high', ruleId: 'INJ-UNI-002', pattern: /[\u202A-\u202E\u2066-\u2069]/ },
+  // HIGH: INJ-REROL-001 — Ignore previous instructions
+  { severity: 'high', ruleId: 'INJ-REROL-001', pattern: /(?:ignore|disregard|forget)\s+(?:all\s+)?(?:previous|prior|above|earlier)\s+(?:instructions?|prompts?|context|rules?|guidelines?)/i },
+  // HIGH: INJ-REROL-002 — Role reassignment
+  { severity: 'high', ruleId: 'INJ-REROL-002', pattern: /you\s+are\s+now\s+(?:a\s+|an\s+)?(?:new\s+)?(?:helpful\s+)?(?:my\s+)?(?:\w+\s+)?(?:assistant|agent|AI|bot|chatbot|system|persona)\b/i },
+  // HIGH: INJ-REROL-003 — Direct instruction override
+  { severity: 'high', ruleId: 'INJ-REROL-003', pattern: /(?:new\s+)?(?:system\s+)?(?:instruction|directive|role|persona)\s*[:=]\s*/i },
+  // HIGH: INJ-PERM-001 — Enable all tools/permissions
+  { severity: 'high', ruleId: 'INJ-PERM-001', pattern: /(?:allow|enable|grant)\s+all\s+(?:tools?|permissions?|access)/i },
+  // HIGH: INJ-PERM-002 — Disable safety/security
+  { severity: 'high', ruleId: 'INJ-PERM-002', pattern: /(?:disable|turn\s+off|remove|bypass)\s+(?:all\s+)?(?:safety|security|restrictions?|guardrails?|protections?|checks?)/i },
+  // HIGH: INJ-PERM-003 — Auto-approve directive
+  { severity: 'high', ruleId: 'INJ-PERM-003', pattern: /(?:auto[- ]?approve|--no-verify|--dangerously-skip-permissions)/i },
+  // HIGH: INJ-ENC-001 — Suspicious base64
+  { severity: 'high', ruleId: 'INJ-ENC-001', pattern: /(?<!Bearer\s)(?<![:])(?<![A-Za-z0-9/])(?!eyJ)(?:[A-Za-z0-9+/]{4}){7,}(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?(?![A-Za-z0-9/])/ },
+  // MEDIUM: INJ-CTX-001 — System prompt claims
+  { severity: 'medium', ruleId: 'INJ-CTX-001', pattern: /(?:the\s+)?(?:system\s+prompt|system\s+message|hidden\s+instructions?)\s+(?:says?|tells?|instructs?|contains?|is)/i },
+];
+
+/** Apply every inline rule to one line, appending findings in rule order. */
+function scanLine(line, lineNumber, findings) {
+  for (const rule of INLINE_RULES) {
+    if (rule.pattern.test(line)) {
+      findings.push({
+        severity: rule.severity,
+        ruleId: rule.ruleId,
+        match: line.trim(),
+        line: lineNumber,
+      });
+    }
+  }
+}
+
 function inlineScan(text) {
   console.error('[sentinel] Running in degraded mode: core import failed, using inline patterns');
   const findings = [];
   const lines = text.split('\n');
   for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    // HIGH: INJ-UNI-001 — Zero-width characters
-    // eslint-disable-next-line no-misleading-character-class -- intentional: detects zero-width chars for security
-    if (/[\u200B\u200C\u200D\uFEFF\u2060]/.test(line)) {
-      findings.push({ severity: 'high', ruleId: 'INJ-UNI-001', match: line.trim(), line: i + 1 });
-    }
-    // HIGH: INJ-UNI-002 — RTL/LTR override characters
-    if (/[\u202A-\u202E\u2066-\u2069]/.test(line)) {
-      findings.push({ severity: 'high', ruleId: 'INJ-UNI-002', match: line.trim(), line: i + 1 });
-    }
-    // HIGH: INJ-REROL-001 — Ignore previous instructions
-    if (/(?:ignore|disregard|forget)\s+(?:all\s+)?(?:previous|prior|above|earlier)\s+(?:instructions?|prompts?|context|rules?|guidelines?)/i.test(line)) {
-      findings.push({ severity: 'high', ruleId: 'INJ-REROL-001', match: line.trim(), line: i + 1 });
-    }
-    // HIGH: INJ-REROL-002 — Role reassignment
-    if (/you\s+are\s+now\s+(?:a\s+|an\s+)?(?:new\s+)?(?:helpful\s+)?(?:my\s+)?(?:\w+\s+)?(?:assistant|agent|AI|bot|chatbot|system|persona)\b/i.test(line)) {
-      findings.push({ severity: 'high', ruleId: 'INJ-REROL-002', match: line.trim(), line: i + 1 });
-    }
-    // HIGH: INJ-REROL-003 — Direct instruction override
-    if (/(?:new\s+)?(?:system\s+)?(?:instruction|directive|role|persona)\s*[:=]\s*/i.test(line)) {
-      findings.push({ severity: 'high', ruleId: 'INJ-REROL-003', match: line.trim(), line: i + 1 });
-    }
-    // HIGH: INJ-PERM-001 — Enable all tools/permissions
-    if (/(?:allow|enable|grant)\s+all\s+(?:tools?|permissions?|access)/i.test(line)) {
-      findings.push({ severity: 'high', ruleId: 'INJ-PERM-001', match: line.trim(), line: i + 1 });
-    }
-    // HIGH: INJ-PERM-002 — Disable safety/security
-    if (/(?:disable|turn\s+off|remove|bypass)\s+(?:all\s+)?(?:safety|security|restrictions?|guardrails?|protections?|checks?)/i.test(line)) {
-      findings.push({ severity: 'high', ruleId: 'INJ-PERM-002', match: line.trim(), line: i + 1 });
-    }
-    // HIGH: INJ-PERM-003 — Auto-approve directive
-    if (/(?:auto[- ]?approve|--no-verify|--dangerously-skip-permissions)/i.test(line)) {
-      findings.push({ severity: 'high', ruleId: 'INJ-PERM-003', match: line.trim(), line: i + 1 });
-    }
-    // HIGH: INJ-ENC-001 — Suspicious base64
-    if (/(?<!Bearer\s)(?<![:])(?<![A-Za-z0-9/])(?!eyJ)(?:[A-Za-z0-9+/]{4}){7,}(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?(?![A-Za-z0-9/])/.test(line)) {
-      findings.push({ severity: 'high', ruleId: 'INJ-ENC-001', match: line.trim(), line: i + 1 });
-    }
-    // MEDIUM: INJ-CTX-001 — System prompt claims
-    if (/(?:the\s+)?(?:system\s+prompt|system\s+message|hidden\s+instructions?)\s+(?:says?|tells?|instructs?|contains?|is)/i.test(line)) {
-      findings.push({ severity: 'medium', ruleId: 'INJ-CTX-001', match: line.trim(), line: i + 1 });
-    }
+    scanLine(lines[i], i + 1, findings);
   }
   return findings;
 }
 
-async function main() {
-  let raw = '';
+/** Read stdin (fd 0) and parse it as JSON. Returns null when it should exit-0. */
+function readStdinJson() {
+  let raw;
   try {
     raw = readFileSync(0, 'utf-8');
   } catch {
-    process.exit(0);
+    return null;
+  }
+  if (!raw.trim()) return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
   }
+}
 
-  if (!raw.trim()) {
-    process.exit(0);
+/** Run injection detection via core, falling back to inline patterns. */
+async function detectFindings(toolOutput) {
+  try {
+    const core = await import('@harness-engineering/core');
+    return core.scanForInjection(toolOutput);
+  } catch {
+    return inlineScan(toolOutput);
   }
+}
 
-  let input;
+/**
+ * Fallback inline taint writer — merges with existing taint state.
+ * Used only when @harness-engineering/core.writeTaint is unavailable.
+ */
+function writeTaintFallback(workspaceRoot, sessionId, toolName, actionable) {
   try {
-    input = JSON.parse(raw);
+    const id = sessionId || 'default';
+    const taintPath = resolve(workspaceRoot, '.harness', `session-taint-${id}.json`);
+    mkdirSync(dirname(taintPath), { recursive: true });
+    const now = new Date().toISOString();
+    const maxSev = actionable.some((f) => f.severity === 'high') ? 'high' : 'medium';
+    const newFindings = actionable.map((f) => ({
+      ruleId: f.ruleId, severity: f.severity, match: f.match,
+      source: `PostToolUse:${toolName}`, detectedAt: now,
+    }));
+    // Read and merge existing taint state to preserve earlier taintedAt and findings
+    let existing = null;
+    try { existing = JSON.parse(readFileSync(taintPath, 'utf-8')); } catch { /* no existing */ }
+    const state = {
+      sessionId: id,
+      taintedAt: existing?.taintedAt ?? now,
+      expiresAt: new Date(Date.now() + 30 * 60 * 1000).toISOString(),
+      reason: existing?.reason ?? `Injection pattern detected in PostToolUse:${toolName} result`,
+      severity: maxSev,
+      findings: [...(existing?.findings ?? []), ...newFindings],
+    };
+    writeFileSync(taintPath, JSON.stringify(state, null, 2) + '\n');
+  } catch { /* best-effort */ }
+}
+
+/** Persist taint via core.writeTaint, falling back to the inline writer. */
+async function recordTaint(workspaceRoot, sessionId, toolName, actionable) {
+  try {
+    const core = await import('@harness-engineering/core');
+    core.writeTaint(
+      workspaceRoot,
+      sessionId,
+      `Injection pattern detected in PostToolUse:${toolName} result`,
+      actionable,
+      `PostToolUse:${toolName}`
+    );
   } catch {
+    writeTaintFallback(workspaceRoot, sessionId, toolName, actionable);
+  }
+}
+
+/** Emit stderr lines for actionable (high/medium) and low findings. */
+function reportFindings(findings, actionable, toolName) {
+  for (const f of actionable) {
+    process.stderr.write(
+      `Sentinel [${f.severity}] ${f.ruleId}: detected in ${toolName} output\n`
+    );
+  }
+  const low = findings.filter((f) => f.severity === 'low');
+  for (const f of low) {
+    process.stderr.write(`Sentinel [low] ${f.ruleId}: ${f.match.slice(0, 80)}\n`);
+  }
+}
+
+async function main() {
+  const input = readStdinJson();
+  if (input === null) {
     process.exit(0);
   }
 
@@ -91,64 +164,14 @@ async function main() {
       process.exit(0);
     }
 
-    let findings;
-    try {
-      const core = await import('@harness-engineering/core');
-      findings = core.scanForInjection(toolOutput);
-    } catch {
-      findings = inlineScan(toolOutput);
-    }
-
+    const findings = await detectFindings(toolOutput);
     const actionable = findings.filter((f) => f.severity === 'high' || f.severity === 'medium');
 
     if (actionable.length > 0) {
-      try {
-        const core = await import('@harness-engineering/core');
-        core.writeTaint(
-          workspaceRoot,
-          sessionId,
-          `Injection pattern detected in PostToolUse:${toolName} result`,
-          actionable,
-          `PostToolUse:${toolName}`
-        );
-      } catch {
-        // Fallback inline taint writer — merges with existing taint state
-        try {
-          const id = sessionId || 'default';
-          const taintPath = resolve(workspaceRoot, '.harness', `session-taint-${id}.json`);
-          mkdirSync(dirname(taintPath), { recursive: true });
-          const now = new Date().toISOString();
-          const maxSev = actionable.some((f) => f.severity === 'high') ? 'high' : 'medium';
-          const newFindings = actionable.map((f) => ({
-            ruleId: f.ruleId, severity: f.severity, match: f.match,
-            source: `PostToolUse:${toolName}`, detectedAt: now,
-          }));
-          // Read and merge existing taint state to preserve earlier taintedAt and findings
-          let existing = null;
-          try { existing = JSON.parse(readFileSync(taintPath, 'utf-8')); } catch { /* no existing */ }
-          const state = {
-            sessionId: id,
-            taintedAt: existing?.taintedAt ?? now,
-            expiresAt: new Date(Date.now() + 30 * 60 * 1000).toISOString(),
-            reason: existing?.reason ?? `Injection pattern detected in PostToolUse:${toolName} result`,
-            severity: maxSev,
-            findings: [...(existing?.findings ?? []), ...newFindings],
-          };
-          writeFileSync(taintPath, JSON.stringify(state, null, 2) + '\n');
-        } catch { /* best-effort */ }
-      }
-
-      for (const f of actionable) {
-        process.stderr.write(
-          `Sentinel [${f.severity}] ${f.ruleId}: detected in ${toolName} output\n`
-        );
-      }
+      await recordTaint(workspaceRoot, sessionId, toolName, actionable);
     }
 
-    const low = findings.filter((f) => f.severity === 'low');
-    for (const f of low) {
-      process.stderr.write(`Sentinel [low] ${f.ruleId}: ${f.match.slice(0, 80)}\n`);
-    }
+    reportFindings(findings, actionable, toolName);
 
     process.exit(0);
   } catch {

package/dist/hooks/sentinel-pre.js

@@ -39,22 +39,82 @@ function isOutsideWorkspace(filePath, workspaceRoot) {
   return !realResolved.startsWith(workspaceRoot);
 }
 
-async function main() {
-  let raw = '';
+/** Read stdin (fd 0) and parse it as JSON. Returns null when it should exit-0. */
+function readStdinJson() {
+  let raw;
   try {
     raw = readFileSync(0, 'utf-8');
   } catch {
-    process.exit(0);
+    return null;
   }
-
-  if (!raw.trim()) {
-    process.exit(0);
+  if (!raw.trim()) return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
   }
+}
 
-  let input;
+/**
+ * Determine whether the session is currently tainted. Deletes and reports an
+ * expired taint file as a side effect (behavior preserved from inline logic).
+ */
+function isSessionTainted(workspaceRoot, sessionId) {
   try {
-    input = JSON.parse(raw);
+    const taintPath = resolve(
+      workspaceRoot,
+      '.harness',
+      `session-taint-${sessionId || 'default'}.json`
+    );
+    const taintRaw = readFileSync(taintPath, 'utf-8');
+    const taintState = JSON.parse(taintRaw);
+
+    const expiresAt = new Date(taintState.expiresAt);
+    if (new Date() >= expiresAt) {
+      try { unlinkSync(taintPath); } catch { /* ignore */ }
+      process.stderr.write(
+        'Sentinel: session taint expired. Destructive operations re-enabled.\n'
+      );
+      return false;
+    }
+    return true;
   } catch {
+    // No taint file or malformed — not tainted
+    return false;
+  }
+}
+
+/**
+ * Enforce taint restrictions for the given tool. Exits 2 (block) when a
+ * destructive Bash command or an out-of-workspace Write/Edit is attempted.
+ */
+function enforceTaint(toolName, toolInput, workspaceRoot) {
+  if (toolName === 'Bash') {
+    const command = toolInput?.command ?? '';
+    if (isDestructiveBash(command)) {
+      process.stderr.write(
+        `BLOCKED by Sentinel: "${toolName}" blocked during tainted session. ` +
+        `Destructive operations are restricted. Run "harness taint clear" to lift.\n`
+      );
+      process.exit(2);
+    }
+  }
+
+  if (toolName === 'Write' || toolName === 'Edit') {
+    const filePath = toolInput?.file_path ?? '';
+    if (isOutsideWorkspace(filePath, workspaceRoot)) {
+      process.stderr.write(
+        `BLOCKED by Sentinel: "${toolName}" to "${filePath}" blocked during tainted session. ` +
+        `File is outside workspace. Run "harness taint clear" to lift.\n`
+      );
+      process.exit(2);
+    }
+  }
+}
+
+async function main() {
+  const input = readStdinJson();
+  if (input === null) {
     process.exit(0);
   }
 
@@ -66,51 +126,8 @@ async function main() {
 
     // Check taint state — block destructive ops if the session is already tainted.
     // Taint is written only by sentinel-post (from untrusted tool OUTPUT).
-    let tainted = false;
-    try {
-      const taintPath = resolve(
-        workspaceRoot,
-        '.harness',
-        `session-taint-${sessionId || 'default'}.json`
-      );
-      const taintRaw = readFileSync(taintPath, 'utf-8');
-      const taintState = JSON.parse(taintRaw);
-
-      const expiresAt = new Date(taintState.expiresAt);
-      if (new Date() >= expiresAt) {
-        try { unlinkSync(taintPath); } catch { /* ignore */ }
-        process.stderr.write(
-          'Sentinel: session taint expired. Destructive operations re-enabled.\n'
-        );
-      } else {
-        tainted = true;
-      }
-    } catch {
-      // No taint file or malformed — not tainted
-    }
-
-    if (tainted) {
-      if (toolName === 'Bash') {
-        const command = toolInput?.command ?? '';
-        if (isDestructiveBash(command)) {
-          process.stderr.write(
-            `BLOCKED by Sentinel: "${toolName}" blocked during tainted session. ` +
-            `Destructive operations are restricted. Run "harness taint clear" to lift.\n`
-          );
-          process.exit(2);
-        }
-      }
-
-      if (toolName === 'Write' || toolName === 'Edit') {
-        const filePath = toolInput?.file_path ?? '';
-        if (isOutsideWorkspace(filePath, workspaceRoot)) {
-          process.stderr.write(
-            `BLOCKED by Sentinel: "${toolName}" to "${filePath}" blocked during tainted session. ` +
-            `File is outside workspace. Run "harness taint clear" to lift.\n`
-          );
-          process.exit(2);
-        }
-      }
+    if (isSessionTainted(workspaceRoot, sessionId)) {
+      enforceTaint(toolName, toolInput, workspaceRoot);
     }
 
     process.exit(0);

package/dist/hooks/telemetry-reporter.js

@@ -37,22 +37,37 @@ function sleep(ms) {
 
 // --- Consent ---
 
-function resolveConsent(cwd) {
-  if (process.env.DO_NOT_TRACK === '1') return { allowed: false };
-  if (process.env.HARNESS_TELEMETRY_OPTOUT === '1') return { allowed: false };
-
-  const config = readJsonSafe(join(cwd, 'harness.config.json'));
-  if (config?.telemetry?.enabled === false) return { allowed: false };
-
-  const installId = getOrCreateInstallId(cwd);
-
-  const identityFile = readJsonSafe(join(cwd, '.harness', 'telemetry.json'));
+/** Copy string identity fields (project/team/alias) from the telemetry file. */
+function readIdentityFile(cwd) {
   const identity = {};
-  if (identityFile?.identity) {
-    if (typeof identityFile.identity.project === 'string') identity.project = identityFile.identity.project;
-    if (typeof identityFile.identity.team === 'string') identity.team = identityFile.identity.team;
-    if (typeof identityFile.identity.alias === 'string') identity.alias = identityFile.identity.alias;
+  const identityFile = readJsonSafe(join(cwd, '.harness', 'telemetry.json'));
+  const src = identityFile?.identity;
+  if (src) {
+    if (typeof src.project === 'string') identity.project = src.project;
+    if (typeof src.team === 'string') identity.team = src.team;
+    if (typeof src.alias === 'string') identity.alias = src.alias;
+  }
+  return identity;
+}
+
+/** Resolve the git user.name, or '' when git is unavailable / unset. */
+function resolveGitAlias(cwd) {
+  try {
+    return execFileSync('git', ['config', 'user.name'], {
+      cwd,
+      encoding: 'utf-8',
+      timeout: 2000,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    }).trim();
+  } catch {
+    // Git not available or no user.name set
+    return '';
   }
+}
+
+/** Assemble the telemetry identity, applying config and git fallbacks. */
+function resolveIdentity(cwd, config) {
+  const identity = readIdentityFile(cwd);
 
   // Fallback: project name from harness.config.json
   if (!identity.project && typeof config?.name === 'string') {
@@ -61,19 +76,23 @@ function resolveConsent(cwd) {
 
   // Fallback: alias from git config user.name
   if (!identity.alias) {
-    try {
-      const gitName = execFileSync('git', ['config', 'user.name'], {
-        cwd,
-        encoding: 'utf-8',
-        timeout: 2000,
-        stdio: ['pipe', 'pipe', 'pipe'],
-      }).trim();
-      if (gitName) identity.alias = gitName;
-    } catch {
-      // Git not available or no user.name set
-    }
+    const gitName = resolveGitAlias(cwd);
+    if (gitName) identity.alias = gitName;
   }
 
+  return identity;
+}
+
+function resolveConsent(cwd) {
+  if (process.env.DO_NOT_TRACK === '1') return { allowed: false };
+  if (process.env.HARNESS_TELEMETRY_OPTOUT === '1') return { allowed: false };
+
+  const config = readJsonSafe(join(cwd, 'harness.config.json'));
+  if (config?.telemetry?.enabled === false) return { allowed: false };
+
+  const installId = getOrCreateInstallId(cwd);
+  const identity = resolveIdentity(cwd, config);
+
   return { allowed: true, installId, identity };
 }