@harness-engineering/orchestrator 0.2.3 → 0.2.4

package/dist/index.js

@@ -988,7 +988,41 @@ var StructuredLogger = class {
   }
 };
 
+// src/workspace/config-scanner.ts
+var import_node_fs = require("fs");
+var import_node_path = require("path");
+var import_core2 = require("@harness-engineering/core");
+var CONFIG_FILES = ["CLAUDE.md", "AGENTS.md", ".gemini/settings.json", "skill.yaml"];
+function scanSingleFile(filePath, targetDir, scanner) {
+  if (!(0, import_node_fs.existsSync)(filePath)) return null;
+  let content;
+  try {
+    content = (0, import_node_fs.readFileSync)(filePath, "utf8");
+  } catch {
+    return null;
+  }
+  const injectionFindings = (0, import_core2.scanForInjection)(content);
+  const findings = (0, import_core2.mapInjectionFindings)(injectionFindings);
+  const secFindings = scanner.scanContent(content, filePath);
+  findings.push(...(0, import_core2.mapSecurityFindings)(secFindings, findings));
+  return {
+    file: (0, import_node_path.relative)(targetDir, filePath).replaceAll("\\", "/"),
+    findings,
+    overallSeverity: (0, import_core2.computeOverallSeverity)(findings)
+  };
+}
+async function scanWorkspaceConfig(workspacePath) {
+  const scanner = new import_core2.SecurityScanner((0, import_core2.parseSecurityConfig)({}));
+  const results = [];
+  for (const configFile of CONFIG_FILES) {
+    const result = scanSingleFile((0, import_node_path.join)(workspacePath, configFile), workspacePath, scanner);
+    if (result) results.push(result);
+  }
+  return { exitCode: (0, import_core2.computeScanExitCode)(results), results };
+}
+
 // src/orchestrator.ts
+var import_core4 = require("@harness-engineering/core");
 var Orchestrator = class extends import_node_events.EventEmitter {
   state;
   config;
@@ -1113,6 +1147,42 @@ var Orchestrator = class extends import_node_events.EventEmitter {
       const workspaceResult = await this.workspace.ensureWorkspace(issue.identifier);
       if (!workspaceResult.ok) throw workspaceResult.error;
       const workspacePath = workspaceResult.value;
+      const scanResult = await scanWorkspaceConfig(workspacePath);
+      if (scanResult.exitCode === 2) {
+        const findingSummary = scanResult.results.flatMap((r) => r.findings.filter((f) => f.severity === "high")).map((f) => `${f.ruleId}: ${f.message}`).join("; ");
+        this.logger.error(
+          `Config scan blocked dispatch for ${issue.identifier}: ${findingSummary}`,
+          { issueId: issue.id }
+        );
+        await this.emitWorkerExit(
+          issue.id,
+          "error",
+          attempt,
+          `Config scan found high-severity injection patterns: ${findingSummary}`
+        );
+        return;
+      }
+      if (scanResult.exitCode === 1) {
+        const findings = scanResult.results.flatMap(
+          (r) => r.findings.filter((f) => f.severity === "medium").map((f) => ({
+            ruleId: f.ruleId,
+            severity: f.severity,
+            match: f.match,
+            ...f.line !== void 0 ? { line: f.line } : {}
+          }))
+        );
+        (0, import_core4.writeTaint)(
+          workspacePath,
+          issue.id,
+          "Medium-severity injection patterns found in workspace config files",
+          findings,
+          "orchestrator:scan-config"
+        );
+        this.logger.warn(
+          `Config scan found medium-severity patterns for ${issue.identifier}. Session tainted.`,
+          { issueId: issue.id }
+        );
+      }
       const hookResult = await this.hooks.beforeRun(workspacePath);
       if (!hookResult.ok) throw hookResult.error;
       const prompt = await this.renderer.render(this.promptTemplate, {

package/dist/index.mjs

@@ -939,7 +939,49 @@ var StructuredLogger = class {
   }
 };
 
+// src/workspace/config-scanner.ts
+import { existsSync, readFileSync } from "fs";
+import { join as join2, relative } from "path";
+import {
+  scanForInjection,
+  SecurityScanner,
+  parseSecurityConfig,
+  mapInjectionFindings,
+  mapSecurityFindings,
+  computeOverallSeverity,
+  computeScanExitCode
+} from "@harness-engineering/core";
+var CONFIG_FILES = ["CLAUDE.md", "AGENTS.md", ".gemini/settings.json", "skill.yaml"];
+function scanSingleFile(filePath, targetDir, scanner) {
+  if (!existsSync(filePath)) return null;
+  let content;
+  try {
+    content = readFileSync(filePath, "utf8");
+  } catch {
+    return null;
+  }
+  const injectionFindings = scanForInjection(content);
+  const findings = mapInjectionFindings(injectionFindings);
+  const secFindings = scanner.scanContent(content, filePath);
+  findings.push(...mapSecurityFindings(secFindings, findings));
+  return {
+    file: relative(targetDir, filePath).replaceAll("\\", "/"),
+    findings,
+    overallSeverity: computeOverallSeverity(findings)
+  };
+}
+async function scanWorkspaceConfig(workspacePath) {
+  const scanner = new SecurityScanner(parseSecurityConfig({}));
+  const results = [];
+  for (const configFile of CONFIG_FILES) {
+    const result = scanSingleFile(join2(workspacePath, configFile), workspacePath, scanner);
+    if (result) results.push(result);
+  }
+  return { exitCode: computeScanExitCode(results), results };
+}
+
 // src/orchestrator.ts
+import { writeTaint } from "@harness-engineering/core";
 var Orchestrator = class extends EventEmitter {
   state;
   config;
@@ -1064,6 +1106,42 @@ var Orchestrator = class extends EventEmitter {
       const workspaceResult = await this.workspace.ensureWorkspace(issue.identifier);
       if (!workspaceResult.ok) throw workspaceResult.error;
       const workspacePath = workspaceResult.value;
+      const scanResult = await scanWorkspaceConfig(workspacePath);
+      if (scanResult.exitCode === 2) {
+        const findingSummary = scanResult.results.flatMap((r) => r.findings.filter((f) => f.severity === "high")).map((f) => `${f.ruleId}: ${f.message}`).join("; ");
+        this.logger.error(
+          `Config scan blocked dispatch for ${issue.identifier}: ${findingSummary}`,
+          { issueId: issue.id }
+        );
+        await this.emitWorkerExit(
+          issue.id,
+          "error",
+          attempt,
+          `Config scan found high-severity injection patterns: ${findingSummary}`
+        );
+        return;
+      }
+      if (scanResult.exitCode === 1) {
+        const findings = scanResult.results.flatMap(
+          (r) => r.findings.filter((f) => f.severity === "medium").map((f) => ({
+            ruleId: f.ruleId,
+            severity: f.severity,
+            match: f.match,
+            ...f.line !== void 0 ? { line: f.line } : {}
+          }))
+        );
+        writeTaint(
+          workspacePath,
+          issue.id,
+          "Medium-severity injection patterns found in workspace config files",
+          findings,
+          "orchestrator:scan-config"
+        );
+        this.logger.warn(
+          `Config scan found medium-severity patterns for ${issue.identifier}. Session tainted.`,
+          { issueId: issue.id }
+        );
+      }
       const hookResult = await this.hooks.beforeRun(workspacePath);
       if (!hookResult.ok) throw hookResult.error;
       const prompt = await this.renderer.render(this.promptTemplate, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@harness-engineering/orchestrator",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Orchestrator daemon for dispatching coding agents to issues",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -41,8 +41,8 @@
     "chokidar": "^3.5.3",
     "ink": "^4.4.1",
     "react": "^18.2.0",
-    "@harness-engineering/core": "0.13.1",
-    "@harness-engineering/types": "0.3.1"
+    "@harness-engineering/core": "0.16.0",
+    "@harness-engineering/types": "0.6.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",