@hilbras/omninode 2.0.0-alpha.12 → 2.0.0-alpha.13

package/README.md

@@ -18,7 +18,7 @@ existing intelligence; it does not try to become another model.
 
 ## Status
 
-**v2.0.0-alpha.12 — v2 Phase 12: Persistence Layer v2**
+**v2.0.0-alpha.13 — v2 Phase 13: Security Hardening**
 (the reliability & interoperability line: architecture → execution →
 protocol → adapters → pipelines → providers → OmniHilbras → memory → reports) (the v2
 roadmap is [docs/ROADMAP_V2.md](docs/ROADMAP_V2.md); the v1 plan is complete:
@@ -31,6 +31,14 @@ for the plan and [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) for the design).
 
 ### What's new in v2 (so far)
 
+- **Phase 13 — Security Hardening**: configuration containing literal
+  credentials is **rejected before parsing** (with a redacted, actionable
+  error); reports over 256 KiB are rejected rather than persisted; static
+  guards keep shell execution out of the codebase; and `omninode security
+  audit` reviews a project's posture (environment exposure, external working
+  directories, credential references) and states the agent trust model
+  plainly — agents run with your OS user's permissions, and OmniNode is not
+  a sandbox.
 - **Phase 12 — Persistence Layer v2**: writes are now **fsynced and atomic**
   (temp → fsync → rename → directory fsync), corrupt store files are
   **quarantined instead of lost**, documents carry a **schema version** with

package/dist/cli/index.js

@@ -6,7 +6,7 @@ import { realpathSync } from "fs";
 import { Command } from "commander";
 
 // src/version.ts
-var OMNINODE_VERSION = "2.0.0-alpha.12";
+var OMNINODE_VERSION = "2.0.0-alpha.13";
 
 // src/errors/index.ts
 var OmniNodeError = class extends Error {
@@ -145,6 +145,39 @@ var appConfigSchema = z.object({
   logging: z.object({ level: z.enum(["debug", "info", "warn", "error"]) }).strict().optional()
 }).strict();
 
+// src/config/secrets.ts
+var SAFE_KEY_SUFFIXES = ["_env", "_env_var", "_file", "_path", "_ref", "_id", "_url", "_command"];
+var SECRET_KEY = /^\s*([A-Za-z0-9_-]*(?:api[_-]?key|token|password|passwd|secret|credential)[A-Za-z0-9_-]*)\s*:\s*(.*)$/i;
+var SAFE_VALUE = /^\s*(?:\$\{[^}]*\}|\$[A-Z_][A-Z0-9_]*|<[^>]*>|""|''|null|~)\s*$/i;
+function scanForInlineSecrets(source) {
+  const findings = [];
+  source.split("\n").forEach((line, index) => {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("#")) return;
+    const match = SECRET_KEY.exec(line);
+    if (!match) return;
+    const key = match[1] ?? "";
+    const rawValue = (match[2] ?? "").trim().replace(/,\s*$/, "");
+    const keyIsReference = SAFE_KEY_SUFFIXES.some((suffix) => key.toLowerCase().endsWith(suffix));
+    if (keyIsReference) return;
+    const value = rawValue.replace(/^["']|["']$/g, "");
+    if (value.length === 0 || SAFE_VALUE.test(rawValue)) return;
+    if (value.length < 8) return;
+    findings.push({
+      line: index + 1,
+      key,
+      excerpt: `${key}: ${value.slice(0, 3)}\u2026 (${value.length} chars, redacted)`
+    });
+  });
+  return findings;
+}
+function describeSecretFindings(file, findings) {
+  const lines = findings.map((f) => `  line ${f.line}: ${f.excerpt}`).join("\n");
+  return `${file} appears to contain ${findings.length} inline secret(s):
+${lines}
+OmniNode never stores credentials in configuration. Replace each value with an environment-variable reference, e.g. api_key_env_var: MY_API_KEY.`;
+}
+
 // src/config/loader.ts
 import { existsSync, readFileSync } from "fs";
 import { parse as parseYaml } from "yaml";
@@ -181,6 +214,10 @@ function loadConfig(options = {}) {
     );
   }
   const raw = readFileSync(path, "utf8");
+  const secretFindings = scanForInlineSecrets(raw);
+  if (secretFindings.length > 0) {
+    throw new ConfigError("CONFIG_INVALID", describeSecretFindings(path, secretFindings));
+  }
   const expanded = expandEnvRefs(raw, env, path);
   let data;
   try {
@@ -3384,6 +3421,7 @@ function truncate4(text, max) {
 }
 
 // src/reports/service.ts
+var MAX_REPORT_BYTES = 256 * 1024;
 var ReportService = class {
   constructor(store, log = logger) {
     this.store = store;
@@ -3418,6 +3456,16 @@ var ReportService = class {
     const reports = [];
     const rejected = [];
     for (const candidate of candidates) {
+      const size = Buffer.byteLength(JSON.stringify(candidate), "utf8");
+      if (size > MAX_REPORT_BYTES) {
+        rejected.push({
+          key: candidate?.id ?? "(unknown)",
+          reason: `report exceeds the ${MAX_REPORT_BYTES} byte limit (${size} bytes)`,
+          issues: []
+        });
+        this.log.warn(`Rejected oversized report (${size} bytes).`);
+        continue;
+      }
       const result = validateReport(candidate);
       if (result.valid) {
         reports.push(result.report);
@@ -4955,6 +5003,72 @@ function registerMigrateCommand(program) {
   });
 }
 
+// src/cli/commands/security.ts
+function registerSecurityCommand(program) {
+  program.command("security").description("Inspect a project's security posture (advisory).").argument("[action]", "Action to perform.", "audit").action(async (action) => {
+    if (action !== "audit") {
+      console.log(`Unknown security action "${action}". Available: audit.`);
+      return;
+    }
+    const config = loadConfig();
+    const findings = [];
+    for (const agent of config.project.agents) {
+      const policy = resolveEnvPolicy(agent);
+      if (policy === "inherit") {
+        findings.push({
+          severity: "warn",
+          subject: `agent "${agent.name}"`,
+          message: "inherits the full environment \u2014 provider keys in OmniNode's environment are visible to it. Consider env_policy: allowlist|denylist|explicit."
+        });
+      }
+      if (agent.allowExternalCwd) {
+        findings.push({
+          severity: "info",
+          subject: `agent "${agent.name}"`,
+          message: "may run outside the project root (allow_external_cwd)."
+        });
+      }
+      if (agent.env && Object.keys(agent.env).length > 0) {
+        findings.push({
+          severity: "info",
+          subject: `agent "${agent.name}"`,
+          message: `receives ${Object.keys(agent.env).length} explicit environment variable(s).`
+        });
+      }
+    }
+    for (const provider of config.project.providers) {
+      if (!provider.apiKeyEnvVar) {
+        findings.push({
+          severity: "info",
+          subject: `provider "${provider.name}"`,
+          message: "no api_key_env_var \u2014 fine for keyless local endpoints, otherwise credentials cannot be resolved."
+        });
+      }
+    }
+    if (config.project.memory?.provider === "remembera" && !config.project.memory.apiKeyEnvVar) {
+      findings.push({
+        severity: "warn",
+        subject: "memory",
+        message: "Remembera is configured without api_key_env_var; requests will be unauthenticated."
+      });
+    }
+    console.log(`OmniNode security audit \u2014 project "${config.project.name}"`);
+    if (findings.length === 0) {
+      console.log("  no findings.");
+    }
+    for (const finding of findings) {
+      console.log(`  [${finding.severity.toUpperCase()}] ${finding.subject}: ${finding.message}`);
+    }
+    console.log(
+      `
+Trust model: agents execute with the permissions of the OS user running OmniNode.`
+    );
+    console.log(
+      `OmniNode does not sandbox agents \u2014 run untrusted agents in a container or as a dedicated user.`
+    );
+  });
+}
+
 // src/cli/index.ts
 function createProgram() {
   const program = new Command();
@@ -4975,6 +5089,7 @@ function createProgram() {
   registerStatusCommand(program);
   registerAuditCommand(program);
   registerMigrateCommand(program);
+  registerSecurityCommand(program);
   registerRunAlias(program);
   return program;
 }