@hilbras/omninode 2.0.0-alpha.11 → 2.0.0-alpha.13

package/README.md

@@ -18,7 +18,7 @@ existing intelligence; it does not try to become another model.
 
 ## Status
 
-**v2.0.0-alpha.11 — v2 Phase 11: Planner v2**
+**v2.0.0-alpha.13 — v2 Phase 13: Security Hardening**
 (the reliability & interoperability line: architecture → execution →
 protocol → adapters → pipelines → providers → OmniHilbras → memory → reports) (the v2
 roadmap is [docs/ROADMAP_V2.md](docs/ROADMAP_V2.md); the v1 plan is complete:
@@ -31,6 +31,20 @@ for the plan and [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) for the design).
 
 ### What's new in v2 (so far)
 
+- **Phase 13 — Security Hardening**: configuration containing literal
+  credentials is **rejected before parsing** (with a redacted, actionable
+  error); reports over 256 KiB are rejected rather than persisted; static
+  guards keep shell execution out of the codebase; and `omninode security
+  audit` reviews a project's posture (environment exposure, external working
+  directories, credential references) and states the agent trust model
+  plainly — agents run with your OS user's permissions, and OmniNode is not
+  a sandbox.
+- **Phase 12 — Persistence Layer v2**: writes are now **fsynced and atomic**
+  (temp → fsync → rename → directory fsync), corrupt store files are
+  **quarantined instead of lost**, documents carry a **schema version** with
+  v1 data migrated in place (`omninode migrate [--check]`), and files from a
+  newer OmniNode are refused rather than misread. Details:
+  [PERSISTENCE.md](docs/PERSISTENCE.md).
 - **Phase 11 — Planner v2**: the planner now receives the full §15 input —
   task, project context, agent reports, **aggregated findings (consensus and
   conflicts included)**, memory and **constraints** (settable per pipeline
@@ -359,7 +373,7 @@ required for the core engine.
 - [Architecture](docs/ARCHITECTURE.md) — module map, workflow, local state
 - [Security model](docs/SECURITY.md) — secrets, process execution, env isolation, audit log
 - [API stability policy](docs/API_STABILITY.md) and [public API inventory](docs/API.md)
-- [Agent Protocol v2 spec](docs/PROTOCOL.md) · [Providers](docs/PROVIDERS.md) · [Memory](docs/MEMORY.md) · [Reports](docs/REPORTS.md) · [Deprecations](docs/DEPRECATIONS.md) · [Changelog](CHANGELOG.md) · [v2 roadmap](docs/ROADMAP_V2.md)
+- [Agent Protocol v2 spec](docs/PROTOCOL.md) · [Providers](docs/PROVIDERS.md) · [Memory](docs/MEMORY.md) · [Reports](docs/REPORTS.md) · [Persistence](docs/PERSISTENCE.md) · [Deprecations](docs/DEPRECATIONS.md) · [Changelog](CHANGELOG.md) · [v2 roadmap](docs/ROADMAP_V2.md)
 - [Example project](examples/demo/) — a runnable end-to-end demo (`./demo.sh`)
 
 Prefer a container? `docker build -t omninode .` then

package/dist/cli/index.js

@@ -6,7 +6,7 @@ import { realpathSync } from "fs";
 import { Command } from "commander";
 
 // src/version.ts
-var OMNINODE_VERSION = "2.0.0-alpha.11";
+var OMNINODE_VERSION = "2.0.0-alpha.13";
 
 // src/errors/index.ts
 var OmniNodeError = class extends Error {
@@ -145,6 +145,39 @@ var appConfigSchema = z.object({
   logging: z.object({ level: z.enum(["debug", "info", "warn", "error"]) }).strict().optional()
 }).strict();
 
+// src/config/secrets.ts
+var SAFE_KEY_SUFFIXES = ["_env", "_env_var", "_file", "_path", "_ref", "_id", "_url", "_command"];
+var SECRET_KEY = /^\s*([A-Za-z0-9_-]*(?:api[_-]?key|token|password|passwd|secret|credential)[A-Za-z0-9_-]*)\s*:\s*(.*)$/i;
+var SAFE_VALUE = /^\s*(?:\$\{[^}]*\}|\$[A-Z_][A-Z0-9_]*|<[^>]*>|""|''|null|~)\s*$/i;
+function scanForInlineSecrets(source) {
+  const findings = [];
+  source.split("\n").forEach((line, index) => {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("#")) return;
+    const match = SECRET_KEY.exec(line);
+    if (!match) return;
+    const key = match[1] ?? "";
+    const rawValue = (match[2] ?? "").trim().replace(/,\s*$/, "");
+    const keyIsReference = SAFE_KEY_SUFFIXES.some((suffix) => key.toLowerCase().endsWith(suffix));
+    if (keyIsReference) return;
+    const value = rawValue.replace(/^["']|["']$/g, "");
+    if (value.length === 0 || SAFE_VALUE.test(rawValue)) return;
+    if (value.length < 8) return;
+    findings.push({
+      line: index + 1,
+      key,
+      excerpt: `${key}: ${value.slice(0, 3)}\u2026 (${value.length} chars, redacted)`
+    });
+  });
+  return findings;
+}
+function describeSecretFindings(file, findings) {
+  const lines = findings.map((f) => `  line ${f.line}: ${f.excerpt}`).join("\n");
+  return `${file} appears to contain ${findings.length} inline secret(s):
+${lines}
+OmniNode never stores credentials in configuration. Replace each value with an environment-variable reference, e.g. api_key_env_var: MY_API_KEY.`;
+}
+
 // src/config/loader.ts
 import { existsSync, readFileSync } from "fs";
 import { parse as parseYaml } from "yaml";
@@ -181,6 +214,10 @@ function loadConfig(options = {}) {
     );
   }
   const raw = readFileSync(path, "utf8");
+  const secretFindings = scanForInlineSecrets(raw);
+  if (secretFindings.length > 0) {
+    throw new ConfigError("CONFIG_INVALID", describeSecretFindings(path, secretFindings));
+  }
   const expanded = expandEnvRefs(raw, env, path);
   let data;
   try {
@@ -2108,51 +2145,119 @@ function registerRoleCommands(program) {
 }
 
 // src/persistence/json-file-store.ts
-import { mkdir, readFile, rename, writeFile } from "fs/promises";
+import { open, mkdir, readFile, rename, stat } from "fs/promises";
 import { dirname } from "path";
+var SCHEMA_VERSION = 2;
+async function writeFileAtomic(target, contents) {
+  const tmp = `${target}.tmp`;
+  await mkdir(dirname(target), { recursive: true });
+  const handle = await open(tmp, "w");
+  try {
+    await handle.writeFile(contents, "utf8");
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+  await rename(tmp, target);
+  try {
+    const dir = await open(dirname(target), "r");
+    try {
+      await dir.sync();
+    } finally {
+      await dir.close();
+    }
+  } catch {
+  }
+}
+async function inspectDocument(path) {
+  let raw;
+  try {
+    await stat(path);
+  } catch {
+    return { status: "missing" };
+  }
+  try {
+    raw = await readFile(path, "utf8");
+  } catch (error) {
+    return { status: "corrupt", detail: `unreadable: ${error instanceof Error ? error.message : String(error)}` };
+  }
+  if (raw.trim().length === 0) return { status: "empty" };
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error) {
+    return { status: "corrupt", detail: error instanceof Error ? error.message : "invalid JSON" };
+  }
+  if (Array.isArray(parsed)) return { status: "v1-legacy" };
+  if (parsed === null || typeof parsed !== "object") return { status: "corrupt", detail: "not an object" };
+  const doc = parsed;
+  if (!Array.isArray(doc.items)) return { status: "corrupt", detail: "missing items array" };
+  const version = typeof doc.schemaVersion === "number" ? doc.schemaVersion : 1;
+  if (version > SCHEMA_VERSION) return { status: "future", schemaVersion: version };
+  if (version < SCHEMA_VERSION) return { status: "v1-legacy" };
+  return { status: "current", schemaVersion: version, count: doc.items.length };
+}
+async function readDocument(path, onCorrupt, quarantine = true) {
+  const state = await inspectDocument(path);
+  if (state.status === "missing" || state.status === "empty") return [];
+  if (state.status === "future") {
+    const error = new Error(
+      `${path} was written by a newer OmniNode (schema v${state.schemaVersion} > v${SCHEMA_VERSION})`
+    );
+    onCorrupt?.(path, error);
+    return [];
+  }
+  let raw;
+  try {
+    raw = await readFile(path, "utf8");
+  } catch (error) {
+    onCorrupt?.(path, error);
+    return [];
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (Array.isArray(parsed)) return parsed;
+    return parsed.items ?? [];
+  } catch (error) {
+    if (quarantine) {
+      const quarantinePath = `${path}.corrupt-${Date.now()}`;
+      try {
+        await rename(path, quarantinePath);
+        logger.child({ component: "persistence" }).warn(
+          `Quarantined unreadable store file ${path} \u2192 ${quarantinePath}`
+        );
+      } catch {
+      }
+    }
+    onCorrupt?.(path, error);
+    return [];
+  }
+}
 var JsonFileStore = class {
   filePath;
   schemaVersion;
   onCorrupt;
+  quarantine;
   log;
   queue = Promise.resolve();
   constructor(options) {
     this.filePath = `${options.directory ?? `${process.cwd()}/.omninode`}/${options.fileName}`;
-    this.schemaVersion = options.schemaVersion ?? 1;
+    this.schemaVersion = options.schemaVersion ?? SCHEMA_VERSION;
     this.onCorrupt = options.onCorrupt;
+    this.quarantine = options.quarantine ?? true;
     this.log = logger.child({ component: "persistence", file: options.fileName });
   }
   get path() {
     return this.filePath;
   }
-  /** All items, or [] when missing/corrupt. */
+  /** All items, or [] when missing/migrated-from-v1/corrupt. */
   async readAll() {
-    let raw;
-    try {
-      raw = await readFile(this.filePath, "utf8");
-    } catch {
-      return [];
-    }
-    try {
-      const parsed = JSON.parse(raw);
-      if (Array.isArray(parsed)) return parsed;
-      if (parsed !== null && typeof parsed === "object" && Array.isArray(parsed.items)) {
-        return parsed.items;
-      }
-      throw new Error("persisted file has an unrecognized shape");
-    } catch (error) {
-      this.log.warn(`Treating ${this.filePath} as empty \u2014 it could not be parsed.`);
-      this.onCorrupt?.(this.filePath, error);
-      return [];
-    }
+    return readDocument(this.filePath, this.onCorrupt, this.quarantine);
   }
   async writeAll(items) {
     const document = { schemaVersion: this.schemaVersion, items };
-    const tmp = `${this.filePath}.tmp`;
-    await mkdir(dirname(this.filePath), { recursive: true });
-    await writeFile(tmp, `${JSON.stringify(document, null, 2)}
-`, "utf8");
-    await rename(tmp, this.filePath);
+    await writeFileAtomic(this.filePath, `${JSON.stringify(document, null, 2)}
+`);
   }
   /** Serializes an async operation against this file. */
   synchronized(operation) {
@@ -2455,7 +2560,7 @@ function sleep(ms) {
 }
 
 // src/audit/index.ts
-import { appendFile, mkdir as mkdir2 } from "fs/promises";
+import { mkdir as mkdir2, readFile as readFile2 } from "fs/promises";
 import { dirname as dirname2 } from "path";
 var FileAuditLog = class {
   filePath;
@@ -2467,8 +2572,15 @@ var FileAuditLog = class {
   async record(event) {
     try {
       await mkdir2(dirname2(this.filePath), { recursive: true });
-      await appendFile(this.filePath, `${JSON.stringify(event)}
+      const { open: open2 } = await import("fs/promises");
+      const handle = await open2(this.filePath, "a");
+      try {
+        await handle.appendFile(`${JSON.stringify(event)}
 `, "utf8");
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
     } catch (error) {
       this.log.warn(
         `Audit write failed: ${error instanceof Error ? error.message : String(error)}`
@@ -2477,7 +2589,6 @@ var FileAuditLog = class {
   }
   /** Recent events, oldest first; used by the CLI. */
   async recent(limit = 20) {
-    const { readFile: readFile2 } = await import("fs/promises");
     let raw;
     try {
       raw = await readFile2(this.filePath, "utf8");
@@ -3310,6 +3421,7 @@ function truncate4(text, max) {
 }
 
 // src/reports/service.ts
+var MAX_REPORT_BYTES = 256 * 1024;
 var ReportService = class {
   constructor(store, log = logger) {
     this.store = store;
@@ -3344,6 +3456,16 @@ var ReportService = class {
     const reports = [];
     const rejected = [];
     for (const candidate of candidates) {
+      const size = Buffer.byteLength(JSON.stringify(candidate), "utf8");
+      if (size > MAX_REPORT_BYTES) {
+        rejected.push({
+          key: candidate?.id ?? "(unknown)",
+          reason: `report exceeds the ${MAX_REPORT_BYTES} byte limit (${size} bytes)`,
+          issues: []
+        });
+        this.log.warn(`Rejected oversized report (${size} bytes).`);
+        continue;
+      }
       const result = validateReport(candidate);
       if (result.valid) {
         reports.push(result.report);
@@ -4809,6 +4931,144 @@ function registerAuditCommand(program) {
   });
 }
 
+// src/persistence/index.ts
+var STORE_FILES = [
+  "tasks.json",
+  "pipelines.json",
+  "reports.json",
+  "plans.json",
+  "memory.json"
+];
+async function migrateProjectStores(directory = `${process.cwd()}/.omninode`, options = {}) {
+  const reports = [];
+  for (const file of STORE_FILES) {
+    const path = `${directory}/${file}`;
+    const state = await inspectDocument(path);
+    if (state.status === "missing") {
+      reports.push({ file, state: state.status, migrated: false });
+      continue;
+    }
+    if (state.status === "current") {
+      reports.push({ file, state: state.status, before: state.count, after: state.count, migrated: false });
+      continue;
+    }
+    if (state.status === "future") {
+      reports.push({
+        file,
+        state: state.status,
+        migrated: false,
+        note: `written by a newer OmniNode (schema v${state.schemaVersion}); not touched`
+      });
+      continue;
+    }
+    if (state.status === "corrupt") {
+      reports.push({ file, state: state.status, migrated: false, note: state.detail });
+      continue;
+    }
+    const items = await readDocument(path, void 0, false);
+    if (!options.checkOnly) {
+      await writeFileAtomic(path, `${JSON.stringify({ schemaVersion: SCHEMA_VERSION, items }, null, 2)}
+`);
+    }
+    const beforeCount = items.length;
+    reports.push({
+      file,
+      state: state.status,
+      before: beforeCount,
+      after: items.length,
+      migrated: !options.checkOnly,
+      ...options.checkOnly ? { note: "would migrate" } : {}
+    });
+  }
+  return reports;
+}
+
+// src/cli/commands/migrate.ts
+function registerMigrateCommand(program) {
+  program.command("migrate").description(
+    `Inspect and upgrade persisted store files to schema v${SCHEMA_VERSION} (v1 data is migrated in place).`
+  ).option("--check", "Only report what would change; do not write.").action(async (options) => {
+    const reports = await migrateProjectStores(`${process.cwd()}/.omninode`, {
+      checkOnly: options.check ?? false
+    });
+    let changed = 0;
+    for (const report of reports) {
+      if (report.migrated || report.state === "v1-legacy") changed += 1;
+      const detail = report.state === "corrupt" ? `  (corrupt: ${report.note})` : report.state === "future" ? `  (${report.note})` : report.state === "v1-legacy" ? `  ${report.migrated ? "migrated" : "would migrate"} ${report.before ?? 0} \u2192 ${report.after ?? 0} item(s)` : report.state === "current" ? `  ${report.after ?? 0} item(s)` : "";
+      console.log(`${report.file.padEnd(16)} ${report.state}${detail}`);
+    }
+    console.log(
+      changed === 0 ? `All stores are at schema v${SCHEMA_VERSION}.` : `${options.check ? "Would migrate" : "Migrated"} ${changed} store file(s) to schema v${SCHEMA_VERSION}.`
+    );
+  });
+}
+
+// src/cli/commands/security.ts
+function registerSecurityCommand(program) {
+  program.command("security").description("Inspect a project's security posture (advisory).").argument("[action]", "Action to perform.", "audit").action(async (action) => {
+    if (action !== "audit") {
+      console.log(`Unknown security action "${action}". Available: audit.`);
+      return;
+    }
+    const config = loadConfig();
+    const findings = [];
+    for (const agent of config.project.agents) {
+      const policy = resolveEnvPolicy(agent);
+      if (policy === "inherit") {
+        findings.push({
+          severity: "warn",
+          subject: `agent "${agent.name}"`,
+          message: "inherits the full environment \u2014 provider keys in OmniNode's environment are visible to it. Consider env_policy: allowlist|denylist|explicit."
+        });
+      }
+      if (agent.allowExternalCwd) {
+        findings.push({
+          severity: "info",
+          subject: `agent "${agent.name}"`,
+          message: "may run outside the project root (allow_external_cwd)."
+        });
+      }
+      if (agent.env && Object.keys(agent.env).length > 0) {
+        findings.push({
+          severity: "info",
+          subject: `agent "${agent.name}"`,
+          message: `receives ${Object.keys(agent.env).length} explicit environment variable(s).`
+        });
+      }
+    }
+    for (const provider of config.project.providers) {
+      if (!provider.apiKeyEnvVar) {
+        findings.push({
+          severity: "info",
+          subject: `provider "${provider.name}"`,
+          message: "no api_key_env_var \u2014 fine for keyless local endpoints, otherwise credentials cannot be resolved."
+        });
+      }
+    }
+    if (config.project.memory?.provider === "remembera" && !config.project.memory.apiKeyEnvVar) {
+      findings.push({
+        severity: "warn",
+        subject: "memory",
+        message: "Remembera is configured without api_key_env_var; requests will be unauthenticated."
+      });
+    }
+    console.log(`OmniNode security audit \u2014 project "${config.project.name}"`);
+    if (findings.length === 0) {
+      console.log("  no findings.");
+    }
+    for (const finding of findings) {
+      console.log(`  [${finding.severity.toUpperCase()}] ${finding.subject}: ${finding.message}`);
+    }
+    console.log(
+      `
+Trust model: agents execute with the permissions of the OS user running OmniNode.`
+    );
+    console.log(
+      `OmniNode does not sandbox agents \u2014 run untrusted agents in a container or as a dedicated user.`
+    );
+  });
+}
+
 // src/cli/index.ts
 function createProgram() {
   const program = new Command();
@@ -4828,6 +5088,8 @@ function createProgram() {
   registerPlanCommands(program);
   registerStatusCommand(program);
   registerAuditCommand(program);
+  registerMigrateCommand(program);
+  registerSecurityCommand(program);
   registerRunAlias(program);
   return program;
 }