@inetafrica/open-claudia 2.15.0 → 3.0.0

package/core/tool-guard.js

@@ -25,8 +25,39 @@ const CONFIG_DIR = require("../config-dir");
 const GUARD_LOG = process.env.TOOL_GUARD_LOG || path.join(CONFIG_DIR, "tool-guard.jsonl");
 const SETTINGS_FILE = process.env.DENY_GATE_SETTINGS || path.join(CONFIG_DIR, "deny-gate.settings.json");
 
-// The authorised channels themselves must never be denied.
-const ALLOW_RE = /^\s*open-claudia\s+(?:tool\s+run|keyring\s+exec)\b/;
+// The authorised channels themselves must never be denied, but the exemption
+// covers one complete outer shell command only. A prefix such as
+// `open-claudia tool run ... && curl ...` must not bless the raw suffix, and
+// command/process substitutions execute before the authorised CLI sees argv.
+const AUTHORIZED_PREFIX_RE = /^\s*open-claudia\s+(?:tool\s+run|keyring\s+exec)\b/;
+
+function isAuthorizedChannelCommand(command) {
+  const value = String(command || "");
+  if (!AUTHORIZED_PREFIX_RE.test(value)) return false;
+  let single = false;
+  let double = false;
+  for (let index = 0; index < value.length; index += 1) {
+    const char = value[index];
+    if (char === "\\" && !single) {
+      index += 1;
+      continue;
+    }
+    if (char === "'" && !double) {
+      single = !single;
+      continue;
+    }
+    if (char === '"' && !single) {
+      double = !double;
+      continue;
+    }
+    if (single) continue;
+    if (char === "`" || ((char === "$" || char === "<" || char === ">") && value[index + 1] === "(")) {
+      return false;
+    }
+    if (!double && /[;&|\r\n]/.test(char)) return false;
+  }
+  return !single && !double;
+}
 
 // An acting network/DB/shell-access binary at a command position (start of
 // string or after a separator). Deliberately excludes read-only diagnosis
@@ -79,7 +110,7 @@ const RULES = [
 function matchRule(command) {
   const cmd = String(command || "");
   if (!cmd.trim()) return null;
-  if (ALLOW_RE.test(cmd)) return null;
+  if (isAuthorizedChannelCommand(cmd)) return null;
   for (const rule of RULES) {
     if (rule.raw) {
       if (rule.raw.test(cmd)) return rule;
@@ -98,6 +129,30 @@ function denyMessage(rule) {
   );
 }
 
+// Provider-neutral command policy. This function deliberately performs no
+// payload parsing, configuration reads, logging, or process/exit translation;
+// those are transport concerns owned by the Claude and Codex hook adapters.
+function evaluateCommandPolicy(command, { mode = "strict" } = {}) {
+  if (mode !== "strict" && mode !== "relaxed") {
+    const error = new Error(`Invalid tool policy mode: ${mode}`);
+    error.code = "INVALID_TOOL_POLICY_MODE";
+    throw error;
+  }
+  const rule = matchRule(command);
+  if (!rule) {
+    return { decision: "allow", ruleId: null, message: "", auditKind: null };
+  }
+  if (mode === "relaxed") {
+    return { decision: "allow", ruleId: rule.id, message: "", auditKind: "relaxed-pass" };
+  }
+  return {
+    decision: "deny",
+    ruleId: rule.id,
+    message: denyMessage(rule),
+    auditKind: "deny",
+  };
+}
+
 // Append-only audit trail — read by the 5c KPI pass. Best-effort: a logging
 // failure must not turn into a denial or a crash.
 function logGuardEvent(evt) {
@@ -141,7 +196,7 @@ const RAW_OP_PATTERNS = [
 function matchRawOp(command) {
   const cmd = String(command || "");
   if (!cmd.trim()) return null;
-  if (ALLOW_RE.test(cmd)) return null;
+  if (isAuthorizedChannelCommand(cmd)) return null;
   if (matchRule(cmd)) return null;
   for (const p of RAW_OP_PATTERNS) if (p.re.test(cmd)) return p;
   return null;
@@ -191,57 +246,36 @@ function runHook(payload) {
   try {
     if (!data || data.tool_name !== "Bash") return { exit: 0, stderr: "" };
     const command = data.tool_input && data.tool_input.command;
-    const rule = matchRule(command);
-    if (!rule) return { exit: 0, stderr: "" };
     // Relaxed tooling mode: the gate observes but never blocks. The event is
     // still logged (as relaxed-pass, not deny) so the dream KPI can report
     // what WOULD have been denied — visibility survives the mode switch.
-    let relaxed = false;
-    try { relaxed = require("./tooling-mode").getToolingMode() === "relaxed"; } catch (e) { /* fail-strict */ }
-    if (relaxed) {
-      logGuardEvent({ kind: "relaxed-pass", rule: rule.id, command: String(command).slice(0, 300) });
-      return { exit: 0, stderr: "" };
+    let mode = "strict";
+    try { mode = require("./tooling-mode").getToolingMode(); } catch (e) { /* fail-strict */ }
+    const policy = evaluateCommandPolicy(command, { mode });
+    if (policy.auditKind) {
+      logGuardEvent({ kind: policy.auditKind, rule: policy.ruleId, command: String(command).slice(0, 300) });
     }
-    logGuardEvent({ kind: "deny", rule: rule.id, command: String(command).slice(0, 300) });
-    return { exit: 2, stderr: denyMessage(rule) };
+    return policy.decision === "deny"
+      ? { exit: 2, stderr: policy.message }
+      : { exit: 0, stderr: "" };
   } catch (e) {
     return { exit: 0, stderr: "" };
   }
 }
 
-// The claude --settings payload wiring the hook in. Absolute node + cli paths
-// so it works regardless of the subprocess PATH; 10s timeout so a hung gate
-// can't stall a turn (hook timeout → claude proceeds, i.e. fail-open).
+// Compatibility wrappers for callers that predate provider adapters. New code
+// should use core/providers/claude-hook directly; delegating here keeps the old
+// API without retaining a second, weaker settings writer.
 function hookSettings() {
-  const cli = path.resolve(__dirname, "..", "bin", "cli.js");
-  return {
-    hooks: {
-      PreToolUse: [
-        {
-          matcher: "Bash",
-          hooks: [
-            { type: "command", command: `${JSON.stringify(process.execPath)} ${JSON.stringify(cli)} deny-gate-hook`, timeout: 10 },
-          ],
-        },
-      ],
-    },
-  };
+  return require("./providers/claude-hook").buildClaudeHookSettings();
 }
 
-// Write (or refresh) the settings file and return its path for --settings.
-// Content-compared so repeated spawns don't churn the file. Throws only up to
-// the caller's try/catch — a failure there just means no gate this turn.
 function ensureHookSettings() {
-  const body = JSON.stringify(hookSettings(), null, 2) + "\n";
-  try {
-    if (fs.readFileSync(SETTINGS_FILE, "utf-8") === body) return SETTINGS_FILE;
-  } catch (e) { /* missing/unreadable → write */ }
-  fs.writeFileSync(SETTINGS_FILE, body);
-  return SETTINGS_FILE;
+  return require("./providers/claude-hook").ensureClaudeHookSettings({ settingsFile: SETTINGS_FILE });
 }
 
 module.exports = {
   RULES, RAW_OP_PATTERNS, GUARD_LOG, SETTINGS_FILE,
-  matchRule, denyMessage, logGuardEvent, runHook, hookSettings, ensureHookSettings,
+  isAuthorizedChannelCommand, matchRule, denyMessage, evaluateCommandPolicy, logGuardEvent, runHook, hookSettings, ensureHookSettings,
   matchRawOp, noteRawOp, readGuardEvents,
 };

package/core/tools.js

@@ -949,13 +949,26 @@ function runGate(tool, argv = [], env = process.env) {
 
 // Env for running a tool: the bot's cred-free subprocess env plus ONLY the
 // keyring keys this tool declares via --requires — least-privilege credential
-// injection (5b). Undeclared keys never reach the subprocess; process.env wins
-// on conflict (bot infra config stays authoritative). Keys read fresh each run
-// so a cred set mid-session is live immediately.
+// injection (5b). Provider/control credentials inherited by the Open Claudia
+// CLI are stripped before declared keyring values are added, so a tool cannot
+// accidentally inherit the active model provider's auth. Other ambient values
+// retain the legacy process-env precedence. Keys are read fresh each run.
 function runEnv(tool) {
   let base;
   try { base = require("./config").botSubprocessEnv(); }
   catch (e) { base = { ...process.env }; }
+  try {
+    const { ALWAYS_STRIPPED_KEYS } = require("./providers/env");
+    for (const key of ALWAYS_STRIPPED_KEYS) delete base[key];
+  } catch (e) {
+    // The provider boundary is a required local module, but preserve a
+    // fail-closed fallback if a partial installation reaches this path.
+    for (const key of [
+      "CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY", "OPENAI_API_KEY", "CURSOR_API_KEY",
+      "CLAUDE_CONFIG_DIR", "CODEX_HOME", "TELEGRAM_BOT_TOKEN", "KAZEE_BOT_TOKEN",
+      "BOT_CONTROL_TOKEN", "OC_SEND_TOKEN",
+    ]) delete base[key];
+  }
   const requires = (tool && tool.requires) || [];
   if (requires.length) {
     try {
@@ -973,10 +986,14 @@ function runEnv(tool) {
 // by `tool show` to warn before a run fails on a missing credential.
 function missingRequires(tool) {
   if (!tool || !tool.requires || !tool.requires.length) return [];
+  let confined = new Set();
+  try { confined = require("./providers/env").ALWAYS_STRIPPED_KEYS; } catch (_) {}
   let present;
   try { present = new Set(require("./keyring").keys()); }
-  catch (e) { present = new Set(Object.keys(process.env)); }
-  return tool.requires.filter((k) => !present.has(k) && process.env[k] === undefined);
+  catch (e) { present = new Set(Object.keys(process.env).filter((key) => !confined.has(key))); }
+  return tool.requires.filter((key) => (
+    !present.has(key) && (confined.has(key) || process.env[key] === undefined)
+  ));
 }
 
 // Recognise a Write/Edit aimed at a tool (for chat announcements). Legacy flat

package/core/transcripts.js

@@ -27,12 +27,37 @@ function transcriptProjectInfo(state = currentState()) {
   return projectTranscripts.pointer(state.currentSession.dir, state.currentSession.name, state.userId);
 }
 
+// Build a read-only transcript view from the synchronously captured run
+// identity. This does not migrate state; it only prevents an awaiting prompt
+// build from following a later project/user switch.
+function transcriptStateForRun(runContext, state = currentState()) {
+  if (!runContext) return state;
+  const project = runContext.project && typeof runContext.project === "object"
+    ? runContext.project
+    : (runContext.project ? { name: runContext.project, dir: null } : null);
+  return {
+    ...state,
+    userId: runContext.canonicalUserId || state.userId,
+    currentSession: project
+      ? { name: project.name || null, dir: project.dir || project.path || null }
+      : null,
+  };
+}
+
+function transcriptProjectInfoForRun(runContext, state = currentState()) {
+  return transcriptProjectInfo(transcriptStateForRun(runContext, state));
+}
+
 function transcriptPointerNote(state = currentState()) {
   if (!state.currentSession) return "";
   return projectTranscripts.buildPointerNote(state.currentSession.dir, state.currentSession.name, state.userId);
 }
 
-function appendProjectTranscript(role, text, metadata = {}, state = currentState(), getActiveSessionId) {
+function transcriptPointerNoteForRun(runContext, state = currentState()) {
+  return transcriptPointerNote(transcriptStateForRun(runContext, state));
+}
+
+function appendProjectTranscript(role, text, metadata = {}, state = currentState(), getActiveSessionId, options = {}) {
   if (!state.currentSession) return null;
   try {
     const transport = (state.userId || "").split(":")[0] || "telegram";
@@ -54,6 +79,7 @@ function appendProjectTranscript(role, text, metadata = {}, state = currentState
     return result;
   } catch (e) {
     console.error("Transcript write failed:", redactSensitive(e.message));
+    if (options.strict) throw e;
     return null;
   }
 }
@@ -102,7 +128,10 @@ function stripTranscriptPointerForStorage(prompt) {
 module.exports = {
   projectTranscripts,
   transcriptProjectInfo,
+  transcriptProjectInfoForRun,
   transcriptPointerNote,
+  transcriptPointerNoteForRun,
+  transcriptStateForRun,
   appendProjectTranscript,
   recentTranscriptText,
   promptWithTranscriptPointer,

package/core/usage-log.js

@@ -8,10 +8,24 @@ const CONFIG_DIR = require("../config-dir");
 
 const USAGE_HISTORY_FILE = path.join(CONFIG_DIR, "usage-history.jsonl");
 
-function appendUsageRecord(record) {
+function normalizeUsageRecord(record) {
+  const normalized = { ...(record || {}) };
+  const provider = normalized.provider || normalized.backend || null;
+  if (provider) {
+    normalized.provider = provider;
+    normalized.backend = normalized.backend || provider;
+  }
+  return normalized;
+}
+
+function appendUsageRecord(record, options = {}) {
   try {
-    fs.appendFileSync(USAGE_HISTORY_FILE, JSON.stringify(record) + "\n");
-  } catch (e) {}
+    fs.appendFileSync(USAGE_HISTORY_FILE, JSON.stringify(normalizeUsageRecord(record)) + "\n");
+  } catch (e) {
+    if (options.strict) throw e;
+    return false;
+  }
+  return true;
 }
 
 function loadUsageHistory() {
@@ -21,7 +35,7 @@ function loadUsageHistory() {
   for (const line of raw.split("\n")) {
     const t = line.trim();
     if (!t) continue;
-    try { out.push(JSON.parse(t)); } catch (e) {}
+    try { out.push(normalizeUsageRecord(JSON.parse(t))); } catch (e) {}
   }
   return out;
 }
@@ -101,6 +115,7 @@ function evaluateUsageAlert(previousRecords, record, policy = usageAlertPolicy()
 }
 
 module.exports = {
+  normalizeUsageRecord,
   appendUsageRecord,
   loadUsageHistory,
   usageAlertPolicy,